A silly mistake tipped me off to a click fraud and pump-and-dump scheme.
Every once in a while, someone running a click fraud scam slips up. And sometimes they slip up in a big way: by accidentally tipping me off about it.
For example, In August this year I uncovered one such scam after digging around following a suspicious phone call from someone pretending to be with ICANN. The people behind the scam had been boasting about how they’re making so much money with domain name parking. It turns out that’s because they were paying people to click on their parked pages.
Now we have another winner.
Last week Domain Name Wire started receiving a large amount of traffic from directory sites. We’re talking thousands of visitors from seemingly unknown directory sites such as TheTusker.biz and WelcomeLinks.info.
When I went to the sites, I couldn’t find a link to Domain Name Wire.
So I dug into the HTML of these sites. Although I couldn’t find any links to DomainNameWire.com, I discovered 30 domain names that were in hidden iframes. One of these domains, it turns out, forwarded to an article on Domain Name Wire.
Why would someone send fake traffic to DNW? It didn’t make sense.
I emailed the owner of one of the directories, who responded:
“was a ad problem from our programmers, solved. Sorry.”
I also emailed the owner of the domain that was forwarding to DNW, domainindustryreseller.com, and asked him why he was forwarding the domain name to me. I didn’t hear back.
It seemed strange, but I decided to let it go.
Yet the traffic didn’t stop coming, so I took another look at it the next day.
I started by checking the other 29 links that were in the iframes. They were all parked with GoDaddy Cash Parking. And all of the domains were listed for sale on GoDaddy Auctions.
This led me to believe that someone was up to two types of fraud.
First, it was a click fraud scam. Normally, if a parked page was just being delivered in an invisible iFrame, you wouldn’t get any clicks on the ads. But I checked Google Analytics to see how these visitors “interacted” with Domain Name Wire when they visited and found that they were actually visiting multiple pages. So the fake traffic was actually designed to click on links on the landing page.
Second, the perpetrators were trying to pump-and-dump on GoDaddy Auctions. GoDaddy Auctions shows traffic numbers next to domain names listed for sale that are also parked with GoDaddy. By opting in to display the traffic data in the auction listings, the scammers could trick unsuspecting buyers who thought the domain names received lots of traffic.
One of the domains included in the iframe, YNUV.com, showed 20,629 for its traffic.
Not to be outdone, EnrollWithEnblemHealth.com showed 41,972.
I reached out to GoDaddy to confirm my suspicions. Paul Nicks, GoDaddy Director of Product Development – Aftermarket, had his team look into the matter. GoDaddy uncovered what Nicks described as a fairly sophisticated click fraud scheme, although it was limited to about 100 domain names. Using the 30 domain names listed in the directory sites, Nicks’ team was able to find consistencies and link the domain names together. It involved multiple accounts with what originally appeared to be different owners.
That someone would undertake this scheme is no surprise. But why was Domain Name Wire ever linked to?
Looking at historical nameserver records, it appears the forwarding may have only been temporary. The domain name at issue, domainindustryreseller.com, was once parked with GoDaddy, then changed to a hosting service that did the forwarding, and then changed back to GoDaddy parking after I started poking around.
Since GoDaddy blocked the domains, they now resolve to the same nameservers that were forwarding to DNW, NS1-PRESIDENT.VIVAWEBHOST.COM. Each of the domains now forwards to a website you might expect to find if you type in the domain name.
For example, eDrafted.com forwards to DraftedMagazine.com and enrollwithemblemhealth.com forwards to EmblemHealth.com. Domainindustryreseller.com forwards to a page about domain name resellers at OnlineNic. This makes me wonder if part of the scam involved forwarding the domain names to legitimate sites for particular periods of time.
I’m not sure how long these guys got away with their scam. But whomever decided to forward that one domain to DNW made a fatal mistake.
Reality being what it is, though, these scammers will be on to the next parking company…
It has a nice ring to it.
Over the weekend Elliot Silver posted an ad with the headline “Dot Com is Dead” from Minds + Machines. I’ve seen a lot of other blog posts about how new TLD backers are beating the drum that .com is dead. Domainers commenting on the posts then typically say that the idea that .com is dead is ridiculous.
Of course it’s ridiculous. But it’s also exactly what you’d say if you were a new TLD operator.
It sure beats “.Com is the biggest domain, and we hope to siphon off a small bit of future .com registrants, and maybe as a collective all of these new TLDs can take away a bit of .com’s dominance.”
Besides, I don’t think that longer description will fit in a Facebook or Google ad.
Come on, folks. New top level domain backers are selling something. Do they really think .com is dead? Of course not! (Well, there may be a few screwballs, but most understand reality.)
Antony Van Couvering of Minds + Machines stopped by DomainInvesting.com to comment on the story, and noted “…you could hardly expect me to put up an ad that said the opposite…”
Exactly. Don’t think that registries are idiots for pitching that .com is dead. It’s a smart marketing line. If you’re trying to sell an alternative to .com, you create your own marketing narrative.
MutualFunds.com highlights post-auction activity as sales reach into the seven figures.
Heritage Auctions’ first ever domain name auction just became a much bigger success.
The auction has now sold a total of $1.5 million worth of domain names including post-auction deals. That means around $1 million worth of sales have taken place since the auction.
The most expensive sale is MutualFunds.com, which was sold by Marc Ostrofsky, the man who made headlines selling Business.com back in the day.
Heritage Auctions did not reveal the sales price for MutualFunds.com, but Ostrofsky was asking $1 million (plus the 15% buyer’s premium).
Other domains that have sold post-auction include QR.com and Dayton.com. QR.com initially had a $200,000 reserve price.
There are still some domain names from the auction available for offers.
Heritage Auctions is one of the top three auction houses in the United States, and this was the first foray into domain names by any of the major auction companies.
Despite Whois problems in June, Verisign reported meeting its SLA for .com.
Each month Verisign and the other domain name registries submit reports to ICANN that include their uptime and performance numbers.
One of the Service Level Agreements (SLAs) for Verisign’s .com contract is 100% uptime for Whois.
While reviewing recent registry reports this week I was surprised to see that Verisign reported it met its 100% SLA in June.
You may recall that Verisign had a hiccup in its Whois service in early June. When you searched for a domain on VerisignInc.com or via port 43, you received a response “No match for domain….” If you did the same domain search a second time you got the correct result.
This caused problems for anyone doing Whois lookups at the registry, not to mention some registrars that apparently use Whois for domain availability lookups (it’s uncommon for registrars to use Whois for this purpose).
I reached out to Verisign to understand why it reported 100% for Whois in June. The company released this statement to Domain Name Wire:
Due to a configuration issue, some users querying Verisign’s public Whois service during the period June 1-June 2, 2013, may have intermittently received an incorrect response of No Match for the specified domain name. We corrected the issue on June 2 and have implemented additional monitoring to prevent this from occurring again.
We conducted a review of the issue and determined in the course of that review that while non-persistent but nevertheless inaccurate responses are undesirable, they did not constitute what common understanding would call service unavailability.
A bitcoin marketplace is among the end users buying domain names at Sedo last week.
Sedo closed $1.2 million of transactions last week, including five domain sales to one end user. You may view previous sales lists here.
Bitok.com $15,000 – Purchased by Bitcoin Innovations Ltd. It looks like a bitcoin marketplace, including for buying and selling options on bitcoins.
Brainlab.at 1,700 EUR – Brainlab, a medical device maker. It uses Brainlab.com for its web address.
CoolCash.co.uk £1,000 – a London company called CoolCash UK Limited.
NetMerit.com $1,695, WebProShop.com $1,995, HomeProNetwork.com $1,195, Netprosys.com $2,495, and Speedtestt.com $2,595 – Ookla, a network measurement and internet metrics company. Interesting that they bought a
CarAdvice.net $950 – CarAdvice.com.au Pty Ltd, which obviously owns the matching Australian ccTLD. They also own CarAdvice.com.
ElectroBill.com $1,395 – Robinhood Films, a movie distributor. Given the films they distribute, this title is right up their alley.
Logway.com 7,900 EUR – Supply chain and logistics company Logway.com.
GImages.com 2,495 – Photo licensing company Getty Images.
Saucony.co.nz $1,342 – Wolverine World Wide, which owns the athletic shoe maker.
TinyPtints.com $1,000 – CitizenHawk, the typo recovery firm. Assuming they have their typical contract with Tiny Prints, this means they believe the domain gets enough traffic to warrant this purchase price through its monetization contract. The price made it cheaper to acquire the domain through purchase rather than UDRP, although I don’t know if that’s good for its client in the long run.
JIUS.com 1,150 EUR – The owner of JobsInTheUS.com apparently decided a shorter domain name might help.
Politerm.com 1,199 EUR – the owner of Politerm.com.ru.
Alphaworks.net $2,400 – Betaworks, the company behind Digg, Instapaper, and other services. IBM owns Alphaworks.com.
MyInvestments.co.in $1,000 – Kotak Securities Ltd in Mumbai.
DoubleDeckerTour.com $800 – Quality Tours outside of Washington, DC.
CSASecurity.com $2,295 – CSA INVESTIGAZIONI S.R.L. in Italy, which uses the domain CSAGroup.eu.
MSchem.com $2,000 – Miller-Stephenson Chemical Co., Inc. picked up a shorter address.
AppsEasy.com $1,095 – The owner of AppsMakerStore.com, a service for creating apps.
SSTrecords.com $1,995 – SST Superstore, seller of punk music.
Mannschaft.com 1,888 EUR – Lautes Haus GmbH, which owns the website mannschaft-magazin.ch.
MyLifehouse.com $2,499 – Jesus Lifehouse Church in Japan.