DaemonForums  

Go Back   DaemonForums > Miscellaneous > Off-Topic

Off-Topic Everything else.

Reply
 
Thread Tools Display Modes
  #1   (View Single Post)  
Old 9th February 2011
Carpetsmoker's Avatar
Carpetsmoker Carpetsmoker is offline
Real Name: Martin
Tcpdump Spy
 
Join Date: Apr 2008
Location: Netherlands
Posts: 2,243
Default Internet scam: A live example

Today I placed one laptop we've been having on stock for quite some time on ebay.

In 30 minutes I received a response from a guy named "van.royal12".

Quote:
Hello Seller,Good Morning..I just wanna know if your item is still available for sale please get back to me with your last price and condition so i wait to hear from you asap.
I immediately smelled a rat: I placed the ad on the Dutch ebay (called marktplaats.nl), and the listing included the requested information so the question didn't make a lot of sense.

However, just in small chance it is a genuine message I replied. In case it was some form of scam at least I would entertain myself.

Quote:
Dear van.royal12,

Yes, this item is still for sale.

Regards,
Martin
Which prompted a quick reply:
Quote:
Thanks for your fast response, i want to know that i am a Marine Engineer and am purchasing this item for my Associate, I have been buying things here and i always buy good item so i will be paying you 1200Euro for this item and also will be paying 50Euro for the shipping fee via TNT POST so i want you to get back to me with your payment details either your Pay Pal Email Address or Bank Transfer Details so i can proceed with the payment now so wait to receive your payment details asap.So here are the details needed from you below:

Bank Name Full Name Account Number Total Cost
OR PayPal Email Address.
This was even more suspicious, the item was listed at 1149 euro. Someone offering to pay more than the listing price? Right...

Regardless, lets reply and see what happens:
Quote:
Hello,

We do not have paypal. You can make a bank transfer to:

Aragorn B.V.
Account# [strip]
IBAN: [strip]
BIC/SWIFT: [strip]

The total amount is €1149 + Shipping.
Shipping is €10 for european (E.U.) shipments, and €25 for international shipments.

Please make sure you provide "Thinkpad T400" as a reference so we can trace the transfer.

Regards,
Martin
Now things get more interesting, I promptly received another email.

Quote:
Okay i am on my way to make the transfer now so i want you to packed the item and get it ready for shipping so as soon as the payment is done now i will get back to you cos the bank is near to me here so try and wait for online for some minutes.

Pleasure doing business with you.
Quickly followed by a "transfer confirmation":

Quote:
This is to inform you that we have received your payment of €1250.00 EUR from Van Royal for an items(Thinkpad T400) Purchased from via (marktplaats.nl)online advert .The money has now been deducted from the buyer's bank account and ready to be transfer into your bank account. It will be deposited into your Bank account :
________________________________________
***Sellers Bank Account Details***As provided by the Buyers (Van Royal)***

________________________________________
Account Nam:Aragorn B.V
Account number:[strip]
IBAN:[strip]
BIC Nummer:[strip]
Banknaam:[strip]
Location:[strip]
Email Address:[strip]
This goes on for a bit more and includes images and fancy HTML markup.

This is quite obviously fake, not just from the spelling and punctuation errors, but a quick look at the email headers removed any possible doubt.

The bottom (that is first) Recieved: header
Quote:
Received: from mail-qy0-f175.google.com (mail-qy0-f175.google.com
[209.85.216.175]) by mailrelay.signet.nl (Postfix) with ESMTP id CC0EE800BE
for <[snip]@[snip].nl>; Wed, 9 Feb 2011 13:18:49 +0100 (CET)
Received: by qyk8 with SMTP id 8so1253451qyk.20 for
<[snip]@[snip].nl>; Wed, 09 Feb 2011 04:21:01 -0800 (PST)
And the transfer was quickly "confirmed" by another email from my "buyer" van.royal12@gmail.com

Quote:
I would want to inform you that i just make the transfer into your Bank Account, and you should have gotten the payments notification from my Bank by now, you can check in your email inbox and bulk folders cause it goes in there sometimes, So i will love you to go ahead with the shipping this morning via TNT POST OFFICE....... and get back to me with the shipment details, and you are also to get back to my Bank customer email with the shipment details also, so they can deposit your funds into your account immediately, make sure you ship it to my Bank verified address on the payments notification.

Name: [strip]
Address: No 37 Lalubu Avenue
State: Ogun
City : Abeokuta
Country: Nigeria
Zip Code: 23403

Pleasure doing Business with you
uhuh

I am still thinking of a way to reply to that ... Just for fun
__________________
UNIX was not designed to stop you from doing stupid things, because that would also stop you from doing clever things.

Last edited by Carpetsmoker; 10th February 2011 at 10:04 AM.
Reply With Quote
  #2   (View Single Post)  
Old 9th February 2011
marcolino's Avatar
marcolino marcolino is offline
Real Name: Mark
Custom Title Maker
 
Join Date: May 2008
Location: At the Mountains of Madness
Posts: 128
Default

It is amazing how something as simple as checking e-mail headers can thwart a scam. It is more amazing that the average person would be fooled so easily by this as well.

It might be fun to ask him about the headers and see what his explanation is. Or, it might be more fun to turn it into the authorities. Nothing would come of it, of course, but it might provide some amusement.
__________________
That's nothing a couple o' pints wouldn't fix.
Reply With Quote
  #3   (View Single Post)  
Old 9th February 2011
Beastie Beastie is offline
Daemonology student
 
Join Date: Jan 2009
Location: /dev/earth0
Posts: 335
Default

Quote:
Originally Posted by Carpetsmoker View Post
Quote:
Country: Nigeria
Is that real data from the mail Carpetsmoker?

How clichéd?! You'd think people would learn! It's almost like a practical joke. But at least he didn't identify himself as a prince. LOL
__________________
May the source be with you!
Reply With Quote
  #4   (View Single Post)  
Old 9th February 2011
J65nko J65nko is offline
Administrator
 
Join Date: May 2008
Location: Budel - the Netherlands
Posts: 4,125
Default

A more sneaky way is that they pay you by false check/cheque. Initially the check clears and the bank transfers the money into your account.

Having received the funds, you ship out the goods. But after a week or two, the bank informs you that the check is fake and it undoes the transaction.
__________________
You don't need to be a genius to debug a pf.conf firewall ruleset, you just need the guts to run tcpdump
Reply With Quote
  #5   (View Single Post)  
Old 9th February 2011
BSDfan666 BSDfan666 is offline
Real Name: N/A, this is the interweb.
Banned
 
Join Date: Apr 2008
Location: Ontario, Canada
Posts: 2,223
Default

It's kind of pathetic how these people operate, glad you caught it C.S.
Reply With Quote
  #6   (View Single Post)  
Old 10th February 2011
Carpetsmoker's Avatar
Carpetsmoker Carpetsmoker is offline
Real Name: Martin
Tcpdump Spy
 
Join Date: Apr 2008
Location: Netherlands
Posts: 2,243
Default

Yeah, Nigeria ...
__________________
UNIX was not designed to stop you from doing stupid things, because that would also stop you from doing clever things.
Reply With Quote
  #7   (View Single Post)  
Old 10th February 2011
tuck's Avatar
tuck tuck is offline
Shell Scout
 
Join Date: May 2008
Posts: 99
Default

A while ago I read a story on http://thescambaiter.com where the guy sends them crap instead of notebooks The fact that they sent him a picture of guys standing infront of his house was a bit scary but the whole story itself was a win!
Reply With Quote
  #8   (View Single Post)  
Old 16th February 2011
Carpetsmoker's Avatar
Carpetsmoker Carpetsmoker is offline
Real Name: Martin
Tcpdump Spy
 
Join Date: Apr 2008
Location: Netherlands
Posts: 2,243
Default

Quote:
CITIBANK INTERNATIONAL PLC
____________________________
ASIA BRANCH OFFICE.
RC: 103002 Our Ref: CITIBN-0XX2/937/2011
Menara Citibank, 165 Jalan Ampang,
50450 Kuala Lumpur Malaysia


Dear Beneficiary,

On behalf of the UNITED NATIONS, we wish to notify you as a beneficiary of $950,000.00 USD in compensation of scam victims. This is to bring to your notice that we are directed by delegates from the UNITED NATIONS to pay 10 victims of scam $950,000.00 USD each.

Your E-mail ID were listed and approved as one of the scam victims to be paid US$950,000.00.

We are directed to compensate scammed victims as it is stipulated in Section B act 4 of United Nations Compensation Commission (UNCC) guide lines and regulations of (08/04/2003) you can view this website for confirmation: Kindly click on the link below: http://www.un.org/News/Press/docs/2003/ik344.doc.htm

Kindly fill Citibank Transfer Form for verification below:


Full Name:
Contact Address:
Date of Birth:
Place of Birth:
Sex:
Marital Status:
Telephone Number:
Occupation:
Any Means of Identification:
Amount Defrauded:


I................. hereby attest that all the information given above is correct to the best of my knowledge, and applicable to the release of paying under review, accept and liability or any consequences arising in the transfer or wrong placement of my FUND due to wrong information given by me. Declared that all the information supplied above are correct.

Yours Faithful.
Mr. Sanjeev Nanavati

for Future Purposes where you might receive larger message from us, you should ensure you check your BULK/JUNK/SPAM mail folder always as there is a probability that it may be delivered there.
I'm rich!!!!
__________________
UNIX was not designed to stop you from doing stupid things, because that would also stop you from doing clever things.
Reply With Quote
  #9   (View Single Post)  
Old 16th February 2011
jggimi's Avatar
jggimi jggimi is offline
More noise than signal
 
Join Date: May 2008
Location: USA
Posts: 7,975
Default

Why, this must be a copy of a very old Email, and a popular one to scam with. Check out the disclaimer at the top of the un.org page referenced.
Reply With Quote
Old 16th February 2011
Carpetsmoker's Avatar
Carpetsmoker Carpetsmoker is offline
Real Name: Martin
Tcpdump Spy
 
Join Date: Apr 2008
Location: Netherlands
Posts: 2,243
Default

The email probably got delayed because they outsourced the actual sending of the emails to a Polish contractor.

Quote:
Date:Wed, 16 Feb 2011 04:41:26 -0800
From:CitiBank International Plc <przeclawsiostry@neostrada.pl>
To:info@info.net
CC:
Subject:SCAMMED VICTIM COMPENSATION FUNDS
__________________
UNIX was not designed to stop you from doing stupid things, because that would also stop you from doing clever things.
Reply With Quote
Old 16th February 2011
TerryP's Avatar
TerryP TerryP is offline
Arp Constable
 
Join Date: May 2008
Location: USofA
Posts: 1,547
Default

When I think about how many people must have fallen for that scam, I feel like rolling on the floor and laughing until it hurts.
__________________
My Journal

Thou shalt check the array bounds of all strings (indeed, all arrays), for surely where thou typest ``foo'' someone someday shall type ``supercalifragilisticexpialidocious''.
Reply With Quote
Old 17th February 2011
BSDfan666 BSDfan666 is offline
Real Name: N/A, this is the interweb.
Banned
 
Join Date: Apr 2008
Location: Ontario, Canada
Posts: 2,223
Default

http://www.imdb.com/title/tt0387808/combined

A movie about a future society, ironically, there is nothing futuristic about it.
Reply With Quote
Old 2nd June 2011
nilsgecko's Avatar
nilsgecko nilsgecko is offline
Port Guard
 
Join Date: Apr 2011
Location: Chicago, USA
Posts: 45
Default

Quote:
Originally Posted by BSDfan666 View Post
http://www.imdb.com/title/tt0387808/combined

A movie about a future society, ironically, there is nothing futuristic about it.
I've been searching for this movie for a long time having caught blips of it years ago...Thank you BSDfan666!!!
Reply With Quote
Old 2nd June 2011
Pjoter's Avatar
Pjoter Pjoter is offline
Shell Scout
 
Join Date: Sep 2008
Posts: 92
Default

Better look on kamernet.nl. The scam looks like this:

-beautiful apartment to rent
-price and location is good

Now all you have to do is send deposit plust monthly fee and expect a keys to be sent to you

Usualy scammer lives abroad (UK) for studies etc.



Piotr.
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
HOWTO: TeX Live 2008 on FreeBSD vermaden Guides 14 3rd January 2011 08:52 AM
Live *BSD Distribution JMJ_coder Other BSD and UNIX/UNIX-like 22 12th February 2010 05:29 PM
Live backup mrthomas FreeBSD General 4 21st December 2009 11:30 PM
can't boot live *BSD through QEMU! atphalix Other BSD and UNIX/UNIX-like 7 12th June 2009 02:04 AM
pf and xbox live _mg_ FreeBSD Security 2 7th January 2009 10:32 PM


All times are GMT. The time now is 03:43 AM.


Powered by vBulletin® Version 3.8.4
Copyright ©2000 - 2024, Jelsoft Enterprises Ltd.
Content copyright © 2007-2010, the authors
Daemon image copyright ©1988, Marshall Kirk McKusick