How exactly did you confirm their location? Did you use Google maps to see if it exists or have you or someone that lives near them visited the location itself? I'm always skeptical about these things.

The only things that will act as a form of protection is to use credit card with buyers protection or PayPal if they support it. If not, and they only accept crypto currencies, then it's a good idea to avoid them.

Too bad their whois info doesn't state when it has been registered, probably due to the fact that it is a sub domain.