Ebay Con-Artist Updated.

[t5mission]

Watch out another Nigerian trying to rip people off.

I recived this in an email:

Dear Seller,
Greetings,I want to inform you that i have made payment via
paypal and you will be notify and also your paypal account will be credited,So kindly ship out the package and mail paypal customer care (customercarepaypal@consultant.com) the shippment tracking number for shippment verification....

Thanks.....

Then this 5 mins later.

(See Attached)

[Edited on 13-2-2006 by t5mission]

[Iconic944ss]

Sadly, I've had a similar one to this - but not with any attachment.

There appears to be not end to the scums ingenuity - why on earth its not used usefully is beyond me.

I keep fairly close tabs on my paypal account and change the password every few months just in case.

I notified paypal - but just got a standard form letter back again from them.

Good heads-up though.

F

[Rushjob]

One of the lads at work had a similar one on Sunday for an item he sold.
Luckily he logged in to his paypal account direct to check & smelled a large rat.

[Teddy1]

I get countless emails every week from 'the Halifax' asking me to renew my account details. The thing is, I'm not even with them!

Ebay and Paypal were a great idea once, but now it seems it's just a source of every scam going. Quite sad really, but that is the culture and mentality of people today. Like a ramoray fish, swim and feed in the slip stream of others.

[Edited on 15-4-2006 by Webteam]

[t5mission]

Revenge is a dish best served cold.

(Revenge of the Geek)

Wrote a bash script on ftp'd it to a unix mail server in canada last night that mailed customercarepay-pal@consultant.com

Subject:
DHL Tracking Number.

Message Body:
Your a total TW*T why don't you p1** off and leave E-Bay to the honest.

The E-mails were routed through a mail server on P.E.I in Newfoundland and at last count this morning I had sent it 24,612 times.

HA HA HA (Evil Laugh) :roll::roll::roll::roll:

[Edited on 15-4-2006 by Webteam]

[antonye]

The only thing is that it probably came from somewhere completely different to the email address it appeared to come from, so some poor guy is currently receiving thousands of emails for being as scammed as you were.

[Iconic944ss]

T5 sounds pretty clued up to me - so, more power to ya.

Flood the ****s whole mail server!!!

(Sorry - I aint had a cuppa yet! :lol::lol::lol: )

Frazzled Frank

[t5mission]

I did an MX ferify on the address and it was in the area as the postal address so I quite confident that I got him. Added note looking at the loging on my script the mail server went down at 10:51 at a mail count of 35,000 exactly at that point the script recived the first failer notice and errored out so as not to effect the P.E.I. mailserver to much. Revenge!! (with a conchents)

[antonye]

Of course, an mx verify would return a valid address because there's no better way round a spam list than using a valid from address ... still doesn't mean they were the real senders of the email!

[antonye]

Did you go through the mail headers and trace the route back that the mail took? That should at least point you to the originating server. Beware of falsified or injected entries though!

[TP]

Originally posted by antonye
Of course, an mx verify would return a valid address because there's no better way round a spam list than using a valid from address ... still doesn't mean they were the real senders of the email!

I agree - still difficult to tell and very easy to spoof a valid e-mail address.

You may have just knocked over a completely innocent ISP's mail server causing an outage to quite a lot of people.

This stuff annoys the pish out of me too and it's quite easy to lash out with DDoS attacks or whatever but you need to do more digging to make sure you definitely have the right people.

[t5mission]

Both the original mail that i have mailed him on and the paypal mail orginate from thew same ip. And its looks like it has aslo been on the orbs blacklist as well, so I quired the ip address and it is a vpop server so I would guess he is hosting it himself and using the multi domian function in vpop for the different domain names.

I will always do my homework as I know what kind of trouble it causes.

[t5mission]

Hi again.

another note I have just reported him to the ISP that issued him his address as the T&C for his ISP state "Any illegal internet activity will result in an instant stop to your account" So I have forwarded the emails to them.

[TP]

Fair enough - for me though not knowing for sure that the vpop server was his or not would have stopped me.

You certainly investigated more than most though, I'll give you that!

[antonye]

...and now we're into the realms of zombie machines!

I've just had a mail attack on one of my client sites and I now have a list of thousands of IP addresses that these attacks were launched from. I would expect that ALL of these machines were quite innocent, but being controlled from a remote source.

To be honest, what you've just done is likely to get your account pulled too and as TP says it's not a very responsible thing to do.

[t5mission]

The only way to be more sure is to A. Ask him lol B. Hack it which makes me as bad as him.

[antonye]

Exactly!

[TP]

Originally posted by t5mission
.... B. Hack it which makes me as bad as him.

But you've already done that by running your bash script no? I'm sure your ISP T's&C's cover that.

Sorry I don't mean to be anal about it, like I said it pishes me off too, but you need to be careful about what you do with it.

I'm certainly not qualified to be standing on this soapbox so I'll get off it now! Apologies!

[t5mission]

Probably not a responsible thing to do with hind site but someone has to do somthing now and again. How would you have felt if you or your familly had been riped off by this guy. Ebay and Pay-Pal send you the standard auto responce all they care about is getting your money. Belive me revenge isnt a good thing but I get so angry when people take the **** and spoil it for the good people out there.

[t5mission]

TP hence running the script for an unlogged server in canada and nohup'in it.

I was a bad person when I was younger, I'm no angel now but I'm trying to be good I promise.

[TP]

Fair enough :)

There's bigger things to worry about, like racing

[Iconic944ss]

T5 - right or wrong at least you have tried to do something.

As you say, Paypal and the hosting companies seem more than happy to take all our money and do little in return in terms of preventing stuff like this...

or am I wrong?

LOL - but I still cant stop STARING at your avatar :lol::lol::lol::lol:

[Edited on 10-2-2006 by Iconic944ss]

[t5mission]

Well I have recived nothing from either of them except the automated bog standard reply. And odds are getting my money for the ebay ad is going to be a pain in the 4r5e too.

[Edited on 10-2-2006 by t5mission]

[t5mission]

[i]LOL - but I still cant stop STARING at your avatar :lol::lol::lol::lol:

[Edited on 10-2-2006 by Iconic944ss]

Watch it long enough and your chest starts to hurt.

[weeian]

brilliant !

pm me his details as well then :devil: i H A T E Scammers

/ian

[Iconic944ss]

A A A A RRRR R R GGG G G HHHHHHHHHHHHHHHHH

Two lots of bouncing boobies in the same thread is TOOOO MUCH !!!!!

:lol::lol::lol::lol::lol::lol::lol::lol:

[crm250]

T5, like your train of thought and it's one i also have fun with when deserved. I have a couple of spare MIMESweeper servers on the end of a 2 meg leased line which i use for training Spamlogic, i gather around 10 - 20k a week of nastys and assorted rubbish which when the moment comes simply strip the headers off and replace and reproccess to the lucky recipient
Very satisfiying feeling :rolleye:

[t5mission]

This guy just doesnt get it does he????

Recived email.


jack kennedy <jack_will8@fastermail.com> wrote:
Hello..Just want to confirm if my daugther's package has been shiped out to her because i have already contacted you that i have made the payment via paypal and paypal told me that they are waiting for the shipment tracking number from you,so kindly ship out the package and get back to paypal customer care (payviapaypalonline@emailaccount.com)the shipment tracking number.
Thanks

My reply.

Hi there,

I have passed your so called Pay-Pal email on to them and they have confirmed you are a fruadster, I have also informed E-Bay and your ISP. So **** you very much and my you arse itch with the flees of a thousand camels.

Your Sincerly

Adam.