2011-05-22 14:50
 Oceń wpis
   
Hi folks. Today I wanted to write a new blog post about Android programming but a funny and sad at the same incident occured, which I considered to have a higher priority than the coding one. That's why I decided to write about it and warn some of you until something bad might happen. So here's the story.
 
I'm recently looking to buy a new car. On Tablica.pl I came across a very good and I'd say "occasional" advertisement of BMW, whose price was suprisingly low.
 
 
I didn't want to buy it, but as a curious person I wrote an e-mail to the address visible on screenshot. I asked if this car is still available. His answer was:
 
"Witam. Cena samochodu 5000 EUR. Samochód jest w idealnym stanie, nigdy nie mial wypadku lub problemów mechanicznych.Prosze pisac z powrotem w jezyku angielskim, jesli jest to mozliwe ( Nie znam bardzo dobrze polski, uzywam programu tlumaczenie ). To jest moja ostatnia cena, samochód nie jest w leasingu tak musisz zaplacic tylko ta cena i nic wiecej. Mam wszystkie dokumenty ( ksiazki serwisowej oraz ). Jesli jestes zainteresowany napisz do mnie e-mail w celu wiecej szczególów."
 
Well, he wrote that he uses a language translator and he prefer to write english. The car is in perfect condition with a price of 5000 EURO, bla, bla. The fun part is just about to start. I asked him if the car is located in Poland. His next anwser:
 
"The car is located in London/England and i am located in United States with my work. Few weeks ago somebody from England told to me that he will buy my car. I told him that it's Ok, we will meet in London and we will make the deal. The next day i was in London but there was no buyer. Never responded to my emails or to my calls so here is what i am suggesting you: There is a service named Western Union. With this service i will be sure that you have the money to buy the car and that you will come for sure in London. You must find the nearest Western Union agency and you will go there with a friend or a relative etc. Your friend will be the sender and you will be the receiver in London/England. I want to be 100 % sure that you will be in London because once the money are sent you have to be in London to get the money. Right now i am located in United States but as soon as the transfer will be made and i will have the receipt from Western Union so i can verify, i will immediately fly to London, meet with you and finish the deal. That's why i need to see the receipt because i already had a bad experience and i don't want that to happen again. If i will see the receipt then i will be sure that you will come and i will go to buy the ticket plane for London. When we will meet in London we will go to a mechanic to confirm you that the car is OK and to the Police so they can tell you that the car it's not stolen. We will make all the documents and complete the sale process and after that we will both go to Western Union office, you will get the money sent by your wife or friend and pay me there. If something is wrong with this car then i will give you 1000 Euro for your trip and for your time so please trust me because the car is like new. Here you have my phone number : 001/9255266822"
 
At this moment I was sure that he's a scammer. I did some Google research. I was shocked. Well, maybe not in fact, that he is a scammer, but the number of people he successfully cheated. I just don't get it, how naive one could be.
I was too lazy to count them all but there is more than ~100 people scammed all over my country, and as I later discovered - it's just a top of a mountain. I was just about to answer him to f*** off... and I almost clicked a "send" button :-) ...but since there was a cloudy Sunday and I was kinda bored... I have made him a surprise.
 
First I have read all posts of people that sent (and lost) him money using Western Union. I have noticed that he was scamming based of few cars like BMW, Skoda Octavia, etc. I used Tablica.pl to trace all his car offers and Hotmail e-mails:
 
 
I've "checked" ;-) few e-mails (you woudn't believe in the scale of this scam) 
  • kol201@hotmail.com
  • anwep299@hotmail.com
  • jopla01@hotmail.com
  • mlow03@hotmail.com
  • dreo293@hotmail.com
  • kros020@hotmail.com
I've traced his IP address (12/Jun/2011:02:42:33): 86.164.***.*** (FBI)
host86-164-***-***.range86-164.btcentralplus.com
 
At this time I wasn't sure if it's TOR'ed or not. I wanted to see occasionally if he is stupid enough not to use it... so I used Western Union (since I guess - that was the sphere of his interest) to find out. I've quickly made a normal looking "website":
  • http://[address].pl/western-union-warsaw/ 
which is only responsible for grabbing some stuff ;) and forwarding to Zumi.pl's list of Western Union Warsaw based Branch Offices... then I wrote him an e-mail:
 
"Okay, sounds like a plan. I feel sorry someone cheated on you. We've got some Western Union Offices - http://[some address]/western-union-warsaw/ Which one do you prefer from the list above? Greets, Pawel"
 
An hour later there it was (host86-164-***-***.range86-164.btcentralplus.com - a little bit different than the previous one, dynamic addressing) (FBI):
 
86.164.***.*** - - [12/Jun/2011:14:24:41 +0200] "GET /western-union-warsaw/ HTTP/1.1" 302 5 www.[address].pl "-" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)" "-"
 
Few hours later (***.ipt.aol.com), a logical connection with Hotmail (FBI).
 
172.130.***.*** - - [12/Jun/2011:17:51:22 +0200] "GET /western-union-warsaw/ HTTP/1.1" 302 5 www.[address].pl "http://co105w.col105.mail.live.com/mail/Inbox Light.aspx?n=1225085824" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; InfoPath.3)" "-"
 
 
I've made a notice script, that scanned his IP address just few seconds after he entered the "Western Union Warsaw" address.
 
 
 
Guess how hard was to knock at it and grab some more local storage data, scam evidences and bunch of funny things? ;-)
 
You've probably noticed (FBI) string above, it's related with the fact that I reported it and can not publish any "horny" things yet, but it's worth to wait :-) I'm wondering how the heck his connection in UK was able to cash out the money without ID or a special WN number. Maybe a corrupt WN employee? I don't get it, we're living in a world of CCTV ffs. It smells from a miles away!
 
Conclusion:
 - If the offer is too beautiful to be the truth -- it is!
 - Do not try to scam itsec guys ;-)

PJ
 
Tagi: usa, uk, car, scam, david oyston, gustav lukaszewski, andrzej camden, boleslaw grabowski, rafael kosman

Komentarze

2011-07-05 15:38:58 | 213.134.148.* | freeze
Re: Look out for car selling scammer [1]
Przesylasz oszustowi potwierdzenie, on podmienia dane w programie graficznym, i
idzie odebrac kase... Bylo w telewizji.. na Discovery albo czyms podobnym.
Zreszta niedawno... skomentuj
2011-07-02 17:20:08 | 79.163.49.* | expel22
Re: Look out for car selling scammer [0]
Nie istnieje w języku angielskim wyrażenie "a top of a mountain". To samo
znaczenie jednak oddaje idiom "tip of the iceberg". Popełnił Pan po prostu kalkę
językową :) Poza tym - dobra robota z tym wpisem. Pozdrawiam. skomentuj
2011-06-14 17:21:17 | 89.79.139.* | Spencer13@o2.pl
Re: Look out for car selling scammer [0]
Nie można by tego jakoś nagłoścnić w tvn ?? Prawie mnie przerobił skomentuj



O mnie




Najnowsze komentarze
 
2012-05-05 12:49
rych do wpisu:
Alfa Romeo Gtv 2.0 V6 TB 205HP
Ja bym się tym nie ruszał dalej niż 30km od domu. Szkoda czasu na czekanie na lawetę.
 
2012-05-01 10:13
gretrtrtr do wpisu:
Alfa Romeo Gtv 2.0 V6 TB 205HP
To auto mogło by brać udział w konkursie na najbrzydszy samochód jaki kiedykolwiek[...]
 
2012-04-14 17:29
grafi do wpisu:
Alfa Romeo Gtv 2.0 V6 TB 205HP
nice bro [;
 
2012-03-07 12:50
K.O.R.E.K do wpisu:
Alfa Romeo Gtv 2.0 V6 TB 205HP
Siemka Paweł ^.^ widze ładne Atuo wybrałeś rocznik też dobry :) ważne jest to aby pojazd[...]
 
2011-07-23 13:28
srebrnooka do wpisu:
The Palace of Culture and Science
The last day of sunshine summer this year?
 
2011-07-05 15:38
freeze do wpisu:
Look out for car selling scammer
Przesylasz oszustowi potwierdzenie, on podmienia dane w programie graficznym, i idzie odebrac[...]
 
2011-07-02 17:20
expel22 do wpisu:
Look out for car selling scammer
Nie istnieje w języku angielskim wyrażenie "a top of a mountain". To samo znaczenie jednak[...]
 
2011-06-18 16:51
marlowe do wpisu:
Warsaw City Public Transportation
how fuckin' deep...
 
2011-06-14 17:21
Spencer13@o2.pl do wpisu:
Look out for car selling scammer
Nie można by tego jakoś nagłoścnić w tvn ?? Prawie mnie przerobił
 
2011-06-03 09:30
K.O.R.E.K do wpisu:
Arrrrgh!
No Tak Racja Zgodze się z Pawłem powyżej @UP/\ z jego wypowiedzą :-> to zależy jak ktos ma czas[...]


Moje linki
 


Ulubione blogi
 


Archiwum Bloga
 
Rok 2012
 
Rok 2011


Kategorie Bloga