Reply
 
Thread Tools Search this Thread Display Modes
 
Old 06-03-2006, 04:18 AM   #1
Moderator
 
Stefrobrts's Avatar

 
1968 17' Caravel
Battle Ground , Washington
Join Date: Dec 2002
Posts: 11,906
Images: 50
Blog Entries: 1
Beware phishing scams!

I know we've talked about this before, but just a refresher...

I recieved an email this evening that said it was from an eBay member, a question about an item, and it looked just like an eBay email.
It said it was from "John with the Camera. you picked up my check 2 weeks ago and still haven't shipped my item! Are you scamming me? Respond immediately or I'm turning you in to eBay!" And since it looked just like an eBay email, it had a button that said click here to respond now. They're hoping you'll panic and click on that button to straighten out this misunderstanding, log in, and hand over your password. Then they're going to go list a $5000 Bambi on your account.

But of course if you do a 'view source' on that button, it's not from eBay, it's from:
Quote:
OrgName: Asia Pacific Network Information Centre
OrgID: APNIC
Address: PO Box 2131
City: Milton
StateProv: QLD
PostalCode: 4064
Country: AU

ReferralServer: whois://whois.apnic.net

NetRange: 61.0.0.0 - 61.255.255.255
CIDR: 61.0.0.0/8
NetName: APNIC3
NetHandle: NET-61-0-0-0-1
Parent:
NetType: Allocated to APNIC
NameServer: NS1.APNIC.NET
NameServer: NS3.APNIC.NET
NameServer: NS4.APNIC.NET
NameServer: NS-SEC.RIPE.NET
NameServer: TINNIE.ARIN.NET
Comment: This IP address range is not registered in the ARIN database.
Comment: For details, refer to the APNIC Whois Database via
Comment: WHOIS.APNIC.NET or http://www.apnic.net/apnic-bin/whois2.pl
Comment: ** IMPORTANT NOTE: APNIC is the Regional Internet Registry
Comment: for the Asia Pacific region. APNIC does not operate networks
Comment: using this IP address range and is not able to investigate
Comment: spam or abuse reports relating to these addresses. For more
Comment: help, refer to http://www.apnic.net/info/faq/abuse
Comment:
RegDate: 1997-04-25
Updated: 2005-05-20

OrgTechHandle: AWC12-ARIN
OrgTechName: APNIC Whois Contact
OrgTechPhone: +61 7 3858 3100
OrgTechEmail: search-apnic-not-arin@apnic.net

# ARIN WHOIS database, last updated 2006-06-02 19:10
# Enter ? for additional hints on searching ARIN's WHOIS database.
I've gotten a ton of these lately, supposedly from eBay or
Paypal or Chase bank, none of which would be emailing me on
the account I receive these emails at. And they're always
going back to the same IP address - this dang Asian Pacific
Network. So what, we don't have a treaty with Australia to shut
B$^#&* like this down? Isn't there anyone to turn them in to?

It ticks me off. You know they catch unsuspecting people everyday.
__________________

__________________
Stephanie




Stefrobrts is offline   Reply With Quote
Old 06-03-2006, 06:25 AM   #2
Site Team
 
, Minnesota
Join Date: Aug 2003
Posts: 6,940
Images: 59
Another refresher:

Yesterday I recieved a very offical notice from NCUA, National Credit Union Association, Billing Departament; with the usual request to update my account or it would be restricted.

Very well done, with a link to an update form. Other than one misspelled word, it looked perfect.

It's been around before, and is making a return appearance at a computer near you!
__________________

__________________
markdoane is online now   Reply With Quote
Old 06-03-2006, 06:54 AM   #3
Rivet Master
 
yukionna's Avatar
 
Massachusetts
Join Date: Oct 2002
Location: 1964 17' Bambi II
Posts: 4,278
Images: 18
Send a message via Yahoo to yukionna
Quote:
Originally Posted by Stefrobrts

It ticks me off. You know they catch unsuspecting people everyday.
I receive phishing emails daily (e.g., PayPal, eBay, banks I don't do business with, etc.) but also know how to check the IP information. I am concerned about the unsuspecting people. I think about people like my parents or retired neighbors, or anyone who is new to computers, the internet and email. Those are the people who are getting caught which further fuels these nefarious scammers.
__________________
WBCCI Region One

Attitude is the only difference between ordeal and adventure
yukionna is offline   Reply With Quote
Old 06-03-2006, 06:58 AM   #4
4 Rivet Member
 
Tikihut's Avatar
 
1977 Argosy Minuet 6.0 Metre
schaumburg , confusion
Join Date: Feb 2003
Posts: 252
Send a message via AIM to Tikihut
If you are not sure of the email. Instead of using the link they supply, open probbly get 10 a month. I noup a new internet explorer and go to the site and see if anything is wrong. I w just ignor them
__________________
Tikihut is offline   Reply With Quote
Old 06-03-2006, 07:08 AM   #5
Rivet Master
 
yukionna's Avatar
 
Massachusetts
Join Date: Oct 2002
Location: 1964 17' Bambi II
Posts: 4,278
Images: 18
Send a message via Yahoo to yukionna
Information for reporting these scammers

For those interested in further IP address sleuthing, here are two websites I use to decode the email address header. I can usually find out what US network is routing the scammer email so I can forward their email to the network website administrator to report the incident. It takes a few minutes to go through the whole process to decode and report them, but it makes me feel good with the hope that I have made life difficult for a spammer scammer.

1) Arin whois database search: http://ws.arin.net/whois
2) IP address locater: http://www.geobytes.com/IpLocator.htm?GetLocation

If anyone knows any more or better ways to go about this, please let me know.
__________________
WBCCI Region One

Attitude is the only difference between ordeal and adventure
yukionna is offline   Reply With Quote
Old 06-03-2006, 07:15 AM   #6
Rivet Master
 
AYRSTRM2's Avatar
 
1966 22' Safari
Armada , Michigan
Join Date: May 2004
Posts: 939
Images: 4
When I get these, first thing I do is hold my cursor over the link. At the bottom of the window in Firefox it will tell where that link goes to. If it isn't paypaldotcom or ebaydotcom I know it's a scam. I then forward that email to either spoof@paypal or spoof@ebay. Those are the addresses they have set up for you to do that. At least you can make them aware of what's going on for them to take action if they can.
__________________
John

Visit my Camping Blog!
AYRSTRM2 is offline   Reply With Quote
Old 06-03-2006, 09:14 AM   #7
Rivet Master
 
summerkid's Avatar
 
1956 16' Bubble
Rose Lodge , Oregon
Join Date: Dec 2003
Location: 1961 26' Overlander
Posts: 921
The one that startled me most was an official-looking paypal email that purported to confirm a payment of $358.29 to some unfamiliar name, which of course made me think my account & had been hijacked & drained. There were lots of links like "if you believe this payment was made in error, click here."

But a quick look at paypal showed no payments made to anybody & the same balance as from the day before, so that was that (after i forwarded the email to spoof@paypal)
__________________
Of course I'm an elitist. Look around you.
summerkid is offline   Reply With Quote
Old 06-03-2006, 09:17 AM   #8
Rivet Master
 
InsideOut's Avatar

 
1956 22' Safari
Vintage Kin Owner
Conifer/Evergreen , Colorado
Join Date: Feb 2002
Posts: 11,793
Images: 108
Hey, steph...I "sold" that same camera!

The funny thing is I've received that email at each of my 6 accounts, except my eBay one. That's my first clue it's not real to me...and one of the reasons I have multiple email mailboxes set-up, I can prescreen where mail comes from based on which mailbox it's received in. If I only have time ti deal with ebay, or WBCCI/VAC, or family, etc.I only go to that mailbox.

Works for me and is an immediate clue if something is out of line...wrong mail in the wrong box.

Shari
__________________
Vintage Airstream Club - Past President 2007/2008
WBCCI #1824 - DenCO Unit Past President (2005)
AIR #30 - Join Date: 2-25-2002

RMVAC | WBCCI DenCO Unit | Sisters on the Fly | Tin Can Tourists
BIRDY - our 1956 Safari | 1964 Serro Scotty
InsideOut is offline   Reply With Quote
Old 06-03-2006, 09:32 AM   #9
Rivet Master
 
yukionna's Avatar
 
Massachusetts
Join Date: Oct 2002
Location: 1964 17' Bambi II
Posts: 4,278
Images: 18
Send a message via Yahoo to yukionna
Quote:
Originally Posted by InsideOut

...That's my first clue it's not real to me...and one of the reasons I have multiple email mailboxes set-up, I can prescreen where mail comes from based on which mailbox it's received in. If I only have time ti deal with ebay, or WBCCI/VAC, or family, etc.I only go to that mailbox.

Works for me and is an immediate clue if something is out of line...wrong mail in the wrong box.
I do the same thing! Nice to hear that I'm not the only one.
__________________
WBCCI Region One

Attitude is the only difference between ordeal and adventure
yukionna is offline   Reply With Quote
Old 06-03-2006, 09:42 AM   #10
3 Rivet Member
 
65glbtrotter's Avatar
 
1965 20' Globetrotter
Yakima , Washington
Join Date: Apr 2005
Posts: 182
Images: 31
here are some government addys that you can send them to as well.
spam@uce.gov for spam and

reportphishing@antiphishing.org for phishing emails

and it is best if you forward them with full headers, with yahoo scroll to the bottom of the email and click on show full headers
__________________
Cory Harrington
http://65airstream.tripod.com/
Alumineyezed
AIR 7834 WBCCI 2105/VAC
65glbtrotter is offline   Reply With Quote
Old 06-03-2006, 10:08 AM   #11
3 Rivet Member
 
Killo1's Avatar
 
2005 22' Safari
Santa Ana , California
Join Date: May 2006
Posts: 167
Saved someone a headache.

About a month or so ago a buddy was looking for a navigation unit for his sailboat. He came across a deal, "Buy It Now" for $750. (normally a $3500 unit or so) He sent me the link to check it out. The seller had a 327 feedback, been a member for 5 or so years and had a ton of stuff for sale, including hi end audio, photography, video...After I bid on a few items myself,

I kind of came to realize something is off. They are either hot or he'd been planning this scam for a long time.

After reviewing the page I had realized the seller had been phished. The listing were all three day listings. The listings all had an email address to arrainge payment that was not the actual owner of the accounts email address and he would only take "western union"
I figured I'd give the seller a call. With ebay, if you are bidding on someones item, or someone is bidding on items your selling you may request a limited email of personal information, including phone number.
After about 10 minutes of explaining to him what happened he hung up the phone and notified ebay, which in turn shut his account down temporarily, changed his password and canceled all the fradulent listings. He called about an hour or so later thanking me.

Since I had a little free time, I thought I'd email the criminal and make him think he got somewhere (yes, I have a little evil in me) First I told him, "I paypal'd the monies to you, when will you be shipping my items?" at which time he told me, "sorry, you will have to get your money back and western union me" I basically emailed him back and forth basically acting like I was mentally incompatent and hopefully frustrating the heck out of him.

As a side note, he wanted the monies Western Union'd to Romainia.
__________________
Alan
2005 22ft Safari
2003 Chevrolet Suburban Z71 5.3l
"Life is like a box of chocolates..." Forrest Gump
Killo1 is offline   Reply With Quote
Old 06-03-2006, 11:16 AM   #12
Moderator
 
Stefrobrts's Avatar

 
1968 17' Caravel
Battle Ground , Washington
Join Date: Dec 2002
Posts: 11,906
Images: 50
Blog Entries: 1
I read a webpage about a most excellent prank a few years ago with one of those scammers who pops up wanting to buy your item for full price no questions asked. Mostly you hear about them wanting to send a cashiers check for too much and have you send back the difference. But this scammer had set up his own fake Escrow website, so he wanted to pay for a laptop using the escrow site. The guy getting scammed caught on and instead sent the guy a three ring notbook with keyboard keys glued on it to look like a fake keyboard and all kinds of funny stuff drawn on it to make it look like a laptop - and sent it to the scammer with a huge value on the customs form so he'd have to pay big taxes in England to claim his package. I love seeing scammers get scammed!

I agree, I'm pretty good at spotting the scams, but a friend of mine (an old hot rodder who's 60+ and not quite as sharp on computers) got one of those ebay ones, and fell for it, THEN emailed me to ask if I thought it was legit. He got lucky and didn't lose any money because we helped him change all his passwords and contact his bank (he'd even given up his SS#). But they're so realistic looking, you can't hardly blame people for falling for them.
__________________
Stephanie




Stefrobrts is offline   Reply With Quote
Old 06-03-2006, 04:53 PM   #13
We can tow it!
 
tin sista's Avatar
 
1996 28' Excella
Where the water tastes like wine , Michigan
Join Date: Jan 2005
Posts: 1,625
Images: 82
Smile Thanks for creating this thread!

Wow I didn't realize about the view source feature, thanks for sharing it Stephanie. Thanks to all for sharing the tips and info about where to forward this stuff! Kudos!
__________________
Steph in MI Air# 6996-
I Hockeytown USA!!
tin sista is offline   Reply With Quote
Old 06-03-2006, 09:52 PM   #14
Well Preserved

 
1993 21' Sovereign
Colfax , North Carolina
Join Date: Jun 2003
Posts: 20,193
Quote:
Originally Posted by Stefrobrts
I read a webpage about a most excellent prank a few years ago with one of those scammers who pops up wanting to buy your item for full price no questions asked. Mostly you hear about them wanting to send a cashiers check for too much and have you send back the difference. But this scammer had set up his own fake Escrow website, so he wanted to pay for a laptop using the escrow site. The guy getting scammed caught on and instead sent the guy a three ring notbook with keyboard keys glued on it to look like a fake keyboard and all kinds of funny stuff drawn on it to make it look like a laptop - and sent it to the scammer with a huge value on the customs form so he'd have to pay big taxes in England to claim his package. I love seeing scammers get scammed!
The website is www.scamorama.com
It was a G4 powerbook that was supposedly sold, and the guy declared full retail value plus $$$.
I just got an official-looking email purporting to be from PayPal wanting me to update my account by clicking on a link, and my account would be restricted until I did. The web address was even wwwdotpaypaldotcom, but the suffix was way different. I forwarded it to Paypal, they said it was a very elaborate scam with multiple pages that looked just like paypal, but none of it was.
Anytime you get one of these, go to that website by opening a new browser window, not by clicking a link. Also, Paypal will address you by name in an email, not just "dear paypal user". Same with Ebay, they will address you by your user ID, not a generic "dear Ebay user".
__________________

__________________
Meddle not in the affairs of dragons, for you are crunchy, and taste good with ketchup.
Terry
overlander63 is offline   Reply With Quote
Reply


Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
 
Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are Off
Pingbacks are Off
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Buying mattress pad? beware of Camping World false ad. femuse Our Community 5 03-19-2003 07:55 PM
Hello from Seattle / Moving Scams JodynJeep Our Community 1 01-15-2003 08:09 PM
Where to mount spare tire 74SovereignInt. Tires 26 11-27-2002 11:00 PM
"sewer solution" Chuck Waste Systems, Tanks & Totes 17 08-29-2002 10:17 AM


Virginia Campgrounds

Reviews provided by




Copyright 2002- Social Knowledge, LLC All Rights Reserved.

All times are GMT -6. The time now is 04:00 PM.


Powered by vBulletin® Version 3.8.8 Beta 1
Copyright ©2000 - 2017, Jelsoft Enterprises Ltd.

Airstream is a registered trademark of Airstream Inc. All rights reserved. Airstream trademark used under license to Social Knowledge LLC.