Reports are circulating of a security breach at Flippa and screenshots have been posted online of what their admin interface looks like.

The known hacker (and possibly some unknown ones) may have had access to all Flippa accounts, private messages, bids, watchlists and other user controlled functions.

Flippa has neither accepted nor denied the allegations.

It would be a prudent move to change your Flippa account password. If you’ve ever given Flippa access to take a pdf of your Google Analytics stats, it may be worth changing the password of your GA account as well. If you’ve used Flippa’s integration with the escrow.com service … you get the picture.

As Flippa and Sitepoint have common logins, this may apply to you even if you don’t use Flippa, but have an account at the Sitepoint forums.

I don’t believe anyone has blogged about this yet.

Details are patchy at the moment, but Flippa’s General Manager Dave Slutzkin has announced that Flippa is adding an escrow service to their site. It’s in partnership with escrow.com (well known, but seriously flawed) and is likely to be an optional service buyers and sellers can use at Flippa.

In the past there’ve been instances where Flippa wasn’t paid the “success fee” for a site selling in their marketplace. The advantage with having an in-house escrow is that Flippa will now know when a site sold in the marketplace has changed hands (whether on not the WHOIS is modified). Honest buyers and sellers who aren’t looking to cheat Flippa out of their success fee should have no issues with Flippa knowing the sale completion date.

It’s not yet known whether the pricing will be fair i.e. users being charged for only the service provided: escrow on the domain. It may well follow escrow.com’s current pricing: price based on the entire value of the site even though it’s only the domain that’s getting escrow protection.

Here’s a headsup: People wanting to discuss matters relating to the buying and selling of websites now have a new forum where they can chat with like minded individuals.

The quality of the chat is extremely high and though the forum is only a week old today, it boasts some of the most respected members from places like Sitepoint and elsewhere who advise on the subject. Already signed up are brokers, accountants and lawyers who deal with matters like Accountancy Due Diligence and Contracts of Sale, buyers and sellers. Flippa is there asking questions and getting feedback on how they can improve their service.

It’s a place where you can find out about the best places to buy a site, what scams to watch out for, what’s a fair price, how to perform due diligence, the best places to list a site for sale, how the pros make money from site holding and site flipping …and much more. Head on over and pose them your most difficult question.

If you interested in any aspect of website buying or selling – you need to be there. Go to the Experienced People forum right now and register today.

When buying or selling a domain you are often dealing with a party you don’t know. Do you remit a large sum of money to them and trust them to transfer the domain to you? Probably not. But then again, they don’t know you either, so they can’t transfer the domain to you first in the hope that you will indeed keep your promise to pay them in full.

That’s where escrow companies come in.

An escrow company will take the full payment from the buyer and hold it till the seller transfers the goods. Once the buyer confirms that he’s received the goods the escrow company releases the funds to the seller. Should the buyer reject the goods, the escrow waits for the seller to confirm receipt back before they refund the payment to the buyer. So everyone’s safe.

But it’s important to choose a good, trusted escrow company to handle what is often a large sum of money. Who do you go to for that? The most well known name is escrow.com. Most experts in website buying and selling swear by escrow.com and they do so with the experience of many transactions behind them. But today I’m going to tell you five secrets that you really should know before you deal with them.

Five Things That You Did Not Know About Escrow.com and Which Should Scare You

1. There is no company called escrow.com. The company you are dealing with is IES that rents/leases or has some other arrangement involving the escrow.com domain (I don’t know what it is and you likely don’t either). That’s not a reason to distrust them but you need to know who you are dealing with. Should IES go bust sometime – no company is immune from the laws of finance – the escrow.com name will likely continue and many buyers and sellers will likely be unaware that anything has changed even though they may be dealing with a brand new company with no history! They’ll assume it’s the good, old escrow company they’ve always dealt with. On the escrow.com website, you’ll find bold claims about “services provided by escrow.com“. They flash “escrow.com” all over the site. Even their postal address is “escrow.com” (no mention of IES). You need to go to the small print to realise that it’s IES you’re dealing with and, in their own words, they are only “one of the operating subsidiaries of Escrow.com”.

Disclaimer: I’m not suggesting anything about IES’s current financial position. They may be rock solid for all I know. And do bear in mind that they are heavily regulated (more about that later) so they don’t do a runner with your money.

But “they” are not escrow.com.

2. Escrow.com/IES doesn’t provide an escrow service for websites: Seriously! It never ceases to amaze me how few people know this. Or realise the huge risk involved in putting website transactions through this company. IES has four categories: Motor Vehicle | Domain Name | General Merchandise | Services.

The closest you have to websites is “Domain Name” and people happily choose that as the closest match and think all is hunky dory. It’s not!

Risks for Buyer: You can end up getting just the domain name and none of the files, templates, designs, databases or anything else that is contained in the website you’re buying and, as far as IES is concerned, they’ll release the funds to the seller on the sole grounds that he has transferred the domain control to you.
Risks for Seller: You can transfer all the copyright, other rights, programs, files etc., to the ownership of the buyer and the buyer can then demand IES give him a refund because he’s changed his mind about taking control of the domain.

3. IES/escrow.com don’t give a fig leaf about your contract. In the purchase of a website the buyer and seller often negotiate terms and draw up a Sales Contract. It may say that certain conditions need to be met and that the buyer/seller can pull out of the transaction if there is a material change. Example: You agree with the seller that if his PR9 site suddenly drops to a PR4 then the deal is off. You send your funds to IES for them to hold during the 10 day “inspection period”. The seller changes the WHOIS for the site and sends you the password to take control of the domain. But on the very first day you find that the PR has dropped (or there is something else drastically wrong with the site and it doesn’t match what the seller described). Tough! As far as escrow.com/IES’s terms are concerned your agreement has no value. The seller gave you control of the site and if he wants to complete the transaction then IES is just going to release the funds to him. The contract entered into by the Buyer and Seller is a carefully constructed document designed to protect each party’s interest. IES won’t even look at that contract. They go by their own terms and conditions and it may or may not be in your favour.

To be fair, you can try raising a dispute or arguing the terms with IES, but there’s no guarantee you’ll succeed, it’s entirely up to them.

4. Many of the “experts” who recommend escrow.com are doing so because they get a commission. Escrow.com is one of the few (if not the only) escrow companies that has an affiliate program. That they are paying people to recommend them is not reason enough to shun their services. But be aware that any recommendation of their service may be driven by expectations of commission rather than a desire to help you.

5. Escow.com is regulated by an authority on another planet. Most experts agree that while the banks took a lot of liberties it was ultimately the regulators who failed in controlling the financial institutions and were responsible for the credit crunch of 2008.

But there is no regulator on this planet quite like the Commissioner in California. He sounds like a cross between Saddam Hussein, Michael Jackson and Imelda Marcos.

He’s power mad and a bit crazy. Nobody – anywhere in the world – can do this business with anyone based in California unless they pay the Californian Commissioner huge amounts of money, bow to his authority, promise to jump when he says jump and sign up to lots of nonsense. But the madness doesn’t end there. If an escrow company in Syndey or Singapore or Sierra Leone decides they can’t be bothered with some jobsworth in California, they need to be aware that he has banned anyone, anywhere in the world, from saying anything critical about him. I promise, I’m not making this up!

That’s just the start. If you read the California Financial Code (div 6, 17000-17305) there’s some pretty serious stuff in there that should dissuade anybody from buying or selling a site if the party they are dealing with is California based. But if the escrow company is registered there it’s even more serious. You will almost certainly lose should a dispute arise. In fact, if they file a court case against you in California, they don’t even need to inform you of the action. In can be all decided in your absence.

Read the full story of the California Risk here.

So even if IES is a very trustworthy company, has a strong balance sheet and great customer service, the fact that they are based in California and signed up to the California Financial Code is reason enough to go look elsewhere for your escrow needs.

Reliable escrow companies that proudly declare they are not registered in California:

Moniker:

Moniker is an ICANN Accredited Registrar and the only company with a special domain escrow account at its registrar to safely hold domains and protect both buyer and seller of domain related transactions. (not registered in California… for the moment)

iEscrow:

I-Escrow, Inc. is Licensed by the Washington Department of Financial Institutions (No. 540-EA-42257) and adheres to its strict regulations, as well as the ordinances put forth by the Revised Code of Washington.

SEDO, escroweurope, Escrow Europa (recommended by eBay) etc., are other alternatives.

Shhh! I’ve got a killer tip for those interested in finding good sites to buy.

Send the owner an email.

No, no, it’s not about searching Google for sites saying “copyright 2002″ to identify abandoned sites and email the owner. Nor does my tip involve crawling through DMOZ listed sites to see which ones look dated. The first is a very hit and miss affair. The second is far too time consuming as well as hit and miss.

It’s where you look and how you time it!

But first, the example: Today I bought a $35K site. It didn’t come through any of the methods described above. It came through a very simple route – something any of you could duplicate (but probably don’t).

And I Got It At Half Price

History: I keep track of sites that I have been interested in but didn’t end up buying. And I revisit those sites after a reasonable lapse of time.

One of those sites listed in Sitepoint a long time ago went for over $60K. I thought the bidding was too high and there may have even been some shill bidding involved. So I took a back seat. Today, over a year from when that site “sold”, I find the WHOIS hasn’t changed, the contact email address for that site hasn’t changed and the appearance of the site hasn’t changed.

Conclusion: The purchase didn’t go ahead (surprise, surprise) and the owner didn’t get to do much with the site either.

So I emailed him out of the blue. Now, these emails don’t normally work. At least they don’t work when people email me. They often get my email address from WHOIS and write to say they want to buy xyz site of mine. Usually they are lowballers looking to pick up something on the dirt cheap. They first express interest and it’s only after a few emails back and forth that they disclose their budget is a paltry $100. I’ve learnt to ignore those emails. And other webmasters do too.

But this email was different because of timing. I worded my email carefully and, importantly, offered him a decent price. I quoted $35K for a quick deal via escrow. Voila! It worked!

Why Did It Work?

What was different was that I had identified someone who was motivated to sell and had been motivated for a long time. Further, he may have been disillusioned with the sale process as he spent a lot of time trying to sell his site and it didn’t work. So when a half decent offer came up, he grabbed it.

Can You Do It Too?

Yes, you can. Let me give you an example. webmasters.org came up for sale here. It raised quite a lot of interest because of the domain name. And it sold for $50K about 15 months ago. Apparently. In the thread you’ll find the owner signed his replies with the name “Chad”. If you do a WHOIS on that domain today, it’s owned by a Chad and the email address is chad@xxxx. Coincidence? Hardly likely.

The site has dropped in PR, from a PR7 to a PR5 – a good reason why there is extra motivation for the owner to sell and why he may be even more open to a lower price. This isn’t a recommendation to go buy that site but to demonstrate that sites where the owner expressed interest in selling, went to the trouble of listing and actually sold… may not be sold. And he may still be interested in selling, even if it’s at a lower price! It won’t always work, but the success rate is a hundred times better than for a completely blind approach.

Have you got website listings you’ve ever bookmarked or added to your shortlist? Have you tried re-visting those sites or checking on their progress? Are you doing it with just Flippa listed sites or all the main site selling forums?

Does it take a bit of work? Sure. Is it worth a shot? You tell me.

Moving a site from one hosting company to another can be easy or fraught with problems and cause you to lose days in downtime and/or lose valuable data. The key to moving a site safely – whether it’s a site you’ve owned for a while or a website / blog you’ve just acquired – is preparation, preparation and preparation.

Plan 10 times, move once.

Here’s a brief guide to the process.

Step 1: If it’s a new acquisition, transfer the domain name to your control.

Step 2: Download all the site’s files and folders with the correct structure. If it’s an acquisition, get a copy of the applications (if any) and database/s (if any) together with a zip of all the files. Even better if you can get copies of the traffic stats for your future reference as they’ll get lost when the old hosting account is closed.

Step 3: Upload all the files, databases etc., to your new hosting account. Make sure you put them all in the right location. Ask your hosting company for help if you are not sure. (Do all this while the site is still fully operational at the “old” server).

Step 4: Configure the files, set permissions etc., and test, test, test to make sure everything is working as it should.

Step 5: Change the DNS settings at the domain registrar to point to the new IP so visitors can now reach the site at the new location.

More information on moving Wordpress blogs can be found here, here and here. And guides to moving Joomla blogs can be found here and here.

Have you ever bid for a website or domain and had the uneasy feeling that the seller himself was bidding against you to artificially push your bidding up? You’d be surprised at how often that happens. Rigged bidding (also called shill bidding) is common in any bidding marketplace and there’s just no way you or the auction platform owners can do much about it.

Shill bidders are a clever lot. They setup new accounts on different IPs. They buy accounts. They ask friends to bid (and they reciprocate the favour when the friend has a domain or site he’s selling).

The net effect of the shill bidder’s activity is that you end up paying a higher price than if the auction was a fair competition among competing bidders. Places like Digital Point, Sitepoint and Flippa seem to make no attempt at shill control. True, they’ll ban you if you try to open another account from the same IP you currently use to sign into their services. But that’s pretty much their own defence. And, let’s face it, pretty useless. We’re talking a webmaster crowd here – people who know their way around using a proxy, people who know how to monitor their IP and are aware when the ISP changes it. If there’s extra profit to be made you can be sure people will try to make it even if the method is dishonest. Bear that in mind the next time you’re bidding – there’s a good chance there’s a shill bidder competing against you.

The latest news is that one of the biggest domain name resellers, Snapnames, has been caught with their pants down. For the last four years or so they’ve had an employee who’s been pushing prices up, causing people like you and me to overpay for our domains … and making Snapnames a huge chunk of extra profit in the bargain.

Unfortunately, many auction sites are designed so that the owner stands to gain if the auction item sells for a higher price. I point no finger at Flippa, I believe they are perfectly honest in their business and above what happened at SnapNames. But, a percentage link between sale price and earnings at the holding company – whether it’s eBay or SEDO – is always going to cause some level of suspicion.

It’s a rough world out there. Take care.

As many of you know, Sitepoint has split its marketplace. While link exchanges, service advertisements etc., are still with Sitepoint, website sales have moved to a new company and a new domain: http://www.flippa.com.

Flippa, controversially, charges a “success fee”. While you still pay for listing a site – albeit, a slightly lower price than before – there’s a hefty 5% success fee (capped at $500). A summary of what has changed is on this Sitepoint thread.

Flippa does offer more filtering options and allows site buyers to specify just high PR sites, low Alexa ranked ones or those selling for more than $10K, for example. There are a few other improvements though it’s hotly debated whether the Web 2.0 look is an improvement on not. The overall Flippa concept and implementation come in for scathing attack in the comments on Flippa’s own blog triggering a frantic response from Flippa that they really are taking feedback.

The name, Flippa, and the overall design and focus of the new enterprise seems to cater for the lower priced-lower quality sites at the expense of the better ones. For example, anyone interested in buying a listed site at the BIN price is expected to complete the transaction immediately via Paypal. All well and good but Paypal has a limit of $10K. It’s apparent that Flippa doesn’t expect to list a lot of websites at above that price point. Interestingly, that’s the price point at which their success fee maxes out (5% of $10K = $500 which is the success fee cap).

What do you think of Flippa?

Added: Snapshot of Flippa page when you click the BIN button

As someone who bought a house a few years ago and has since watched it drop in value faster than an athlete who just lost an leg, I am well aware that the property market is really struggling, and is set to continue to do so.

So this begs the question: If property is no longer the solid investment that it used to be, could websites be the new boys in town?

There are of course, many factors at play, but I was recently looking at an apartment in a tourist area in Europe, it cost $200,000

I am told that I could rent that out and if I do it right, I could cover my mortgage.

In other words, I could break even.

Now, on the other hand, I could purchase a large entertainment website which also can be bought for $200,000

However, this site is making $7,000 profit per month.

Let’s assume the mortgage on the apartment is $700 per month, and the re-payments to finance the website are $1,000 per month, that is still a $6,000 per month advantage to the website.

I would love your opinions on this, considering the current climate, if you had to choose, would you rather invest your money into property, or into a website?

Midascode