so angry at this scam. please see if someone can find it

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Posted: Tue Nov 11, 2008 3:25 am

http://www.cbc.ca/canada/story/2008/11/10/car-ad.html for full story

An internet scam has been using the photo of a Canadian soldier killed in Afghanistan to try to sell supposed used vehicles.

The advertisements, which have been appearing on online free classifieds such as Kijiji and Craigslist, use a photograph of Sgt. Prescott Shipway.

Shipway, 36, died after his armoured vehicle hit an improvised explosive device during a security patrol in the Panjwaii district of southern Afghanistan on Sept. 7. He was a member of the 2nd Battalion of the Princess Patricia's Canadian Light Infantry based out of Shilo, Man.

On the CBC news, they said they tried to trace the email, but it came to a dead end.

Please please please anyone who comes across an ad like this on Craigslist, please post it and see if we can get this bastard. This Canadian soldier only died a few months ago. The bastards even went as far as calling the funeral home to get information.

It is an affront considering tomorrow is Remembrance day.

I don't normally get this angry at scammers, but this is got to me.

Posted: Tue Nov 11, 2008 4:07 am

He posted an ad over here:

http://tinyurl.com/4yu6se

http://tinyurl.com/3hhm8g

http://tinyurl.com/476cyl

http://hamilton.en.craigslist.ca/mcy/912816920.html

Chuck Norris Joined: 11 Jun 2007 Posts: 1369

Romanian escrow scammer. They also do this with American GI's and the war in Iraq (this car was my son's and he was killed in Iraq...etc). I'll bait him for a website and try to get it killed.

If you see any other of his scam listings on Craigslist please flag them for removal.

Posted: Tue Nov 11, 2008 4:35 am

good to see there is no lien on the car must mean the tyre presure is correct hit him were it hurts many times ffffffffffffffahole

Posted: Tue Nov 11, 2008 4:39 am

Thanks pwwbear for sharing this on your 419th posting and thanks Lotta for the research. I have tried contacting the seller and do hope that other members pile on, especially since tomorrow is Remembrance Day. If anyone else can dig up anything, please post it up.

Posted: Tue Nov 11, 2008 4:40 am

More proof that there are no depths to which these guys will not sink. Evil or Very Mad

Posted: Tue Nov 11, 2008 5:53 am

Dont get me going on this type of scam bag scammer Evil or Very Mad

Our boy is in Afghanistan and still has many months before he is home to his wife and son, he survived a road side blast 2 years ago in iraq.

anyhow back to baiting lets give these lads hell Twisted Evil

Posted: Tue Nov 11, 2008 1:57 pm

Just remember, you can still bait him and have the posts removed. Kijiji and Craigslist usually require a few people to flag it before they remove the offending posts.

Edit Added: He may try to repost it so keep a watch out for it in different cities.

Chuck Norris Joined: 11 Jun 2007 Posts: 1369

He's replied. Smile

Posted: Tue Nov 11, 2008 3:13 pm

Is there any possible way we can catch this guy? Get him arrested?

Posted: Tue Nov 11, 2008 3:41 pm

/\ I doubt you could get him arrested, depends on where he is and how safely he scams.

Googling 'Anderson Shipway Bruce' pulls up a lot of ill will towards him, as well as the ads your lad has run. Ideally you'd like to bait him on safari to a military base somewhere, one which had been tipped off as to who he was and what he was doing... Twisted Evil

I found a current Craigslist listing, and flagged it. [email protected] My email bounced.

@ Akai Ryu, did you get an Ip adress from him?

Posted: Tue Nov 11, 2008 4:19 pm

Quote:

from Petre Jh0n <peter_<removed>@msn.com>
to <baiter>
date Tue, Nov 11, 2008 at 12:27 AM
subject RE: Kawasaki

Hello there and thanks for your words.

The unit is in excellent condition.
No scratches or any kind of damage and it has a clear title.
If you are interested to buy it, the price is $3,500.
The unit is already at the shipping company in Montreal sealed and ready for shipping. I have a contract with eBay so this deal must go through them. I'm very busy with my job and I`m left out of town so I can't meet you in person, so this is the reason why I chose to sell my son unit over the Internet.
If you are interested please reply with your details:
- Full Name
- Full Shipping Address
Thank you!

Thanking me for my kind words? All I said was that I was interested.
He is effectively hiding his IP behind an AOL account.

EDIT - altered the scammer's name at the request of a fellow baiter.

Posted: Tue Nov 11, 2008 6:14 pm

he deals with e-bay

This means you send your name and address and you'll get an official looking e-bay invoice complete with banking details for you to credit ..I mean report Twisted Evil

AOL + E-bay ...looking typical Romanian scammer

Posted: Tue Nov 11, 2008 6:22 pm

After a few exchanges tell him that your email provider is dumping his mails in the spam box. - ask him to use yahoo as it's so much more reliable.

Chuck Norris Joined: 11 Jun 2007 Posts: 1369

pwwbear wrote:

Is there any possible way we can catch this guy? Get him arrested?

Sadly, no.

The best way we can hurt this scammer (and others like them--there are tons of these on Craigslist, etc.) is to get their ads removed and their websites killed, or their bank accounts reported if they deal with eBay, as Spot said.

Quote:

I doubt you could get him arrested, depends on where he is and how safely he scams.

As Spot said...he's in Romania.

An IP address will not tell me anything, but I won't need one to know where he is.

Quote:

After a few exchanges tell him that your email provider is dumping his mails in the spam box. - ask him to use yahoo as it's so much more reliable.

That won't much matter in this case.

@ Connie--looks like we both got the same "script." I'll keep on pestering him about that Audi.

Posted: Tue Nov 11, 2008 9:43 pm

You keep saying he's in Romania - Where did you get this info from?

Posted: Tue Nov 11, 2008 10:32 pm

Kijiji sez:

Quote:

Important Safety Warning:
Avoid fraud by meeting all sellers in-person to pay for items. Kijiji does not offer any transaction or payment services.

This might be an angle for a short safari. After all, who would buy a car without seeing it first?

Sid

Posted: Tue Nov 11, 2008 10:45 pm

http://bgky.craigslist.org/cto/913050108.html

Posted: Wed Nov 12, 2008 12:40 am

@Connie, you might want to mask the sender's name, It's showing on google!

I got a similar reply

Petre Jhon wrote:

Hello,

You made the right choice!My unit is in great shape,no engine problems,damages or hidden defects.The price is 3,700$.If you are decided and have the money please reply.
If you are interested please reply with your details:
- Full Name
- Full Shipping Address
Thank you!

Yeah I've got the cash.. but there are just a few questions to answer first. Evil or Very Mad

IP trace shows it as originating from 80 miles north of Frankfurt, Germany. but I guess that can be faked.

*Edit, I just double checked the IP, and its now showing as Wichita USA. This keeps happening to me. Am I doing something wrong Rolling Eyes

Posted: Wed Nov 12, 2008 2:10 am

Post the headers Roger and we'll break it down for you.

Elite Baiter Joined: 15 Sep 2008 Posts: 1006

I'm in...and got the same response when I asked about the Kawasaki. IP is showing US for me.

What a cold guy...selling his son unit over the internet. Crying or Very sad

Posted: Wed Nov 12, 2008 3:17 am

Please post the headers.

Posted: Wed Nov 12, 2008 3:29 am

Looks like AOL but from Germany to me from this two hour old email.

Quote:

Delivered-To: <baiter>@gmail.com
Received: by 10.214.241.12 with SMTP id o12cs471086qah;
Tue, 11 Nov 2008 16:13:54 -0800 (PST)
Received: by 10.151.102.16 with SMTP id e16mr12925447ybm.240.1226448834380;
Tue, 11 Nov 2008 16:13:54 -0800 (PST)
Return-Path: <peter_(removed)@msn.com>
Received: from mx2.fanmail.com (mx2.fanmail.com
[216.180.38.177]) (This is the fanmail remailer used by connie)
by mx.google.com with ESMTP id 5si23679897gxk.77.2008.11.11.16.13.54;
Tue, 11 Nov 2008 16:13:54 -0800 (PST)
Received-SPF: softfail (google.com: domain of transitioning peter_(removed)@msn.com does not designate 216.180.38.177
as permitted sender) client-ip=216.180.38.177;
Authentication-Results: mx.google.com; spf=softfail
(google.com: domain of
transitioning peter_(removed)@msn.com does not
designate 216.180.38.177 as permitted sender) smtp.mail=peter_(removed)@msn.com
Received: from blu0-omc4-s8.blu0.hotmail.com (blu0-omc4-s8.blu0.hotmail.com [65.55.111.147])
by mx2.fanmail.com (Postfix) with ESMTP id 98C292F4448
for <<baiter>@aggies.com>; Tue, 11 Nov 2008 18:06:06 -0600 (CST)
Received: from BLU126-W38 ([65.55.111.137]) by blu0-omc4-s8.blu0.hotmail.com with
Microsoft SMTPSVC(6.0.3790.3959);
Tue, 11 Nov 2008 16:13:53 -0800
Message-ID: <[email protected]>
Content-Type: multipart/alternative;
boundary="_3a97dba0-9a7b-4c1c-a36f-ff91b17b4999_"
X-Originating-IP: [172.158.38.222]
From: Petre Jh0n <peter_(removed)@msn.com>
To: < [email protected]>
Subject: RE: Kawasaki
Date: Tue, 11 Nov 2008 17:13:54 -0700
Importance: Normal
In-Reply-To: <[email protected]>
References: <[email protected]>
<[email protected]>
<[email protected]>
MIME-Version: 1.0
X-OriginalArrivalTime: 12 Nov 2008 00:13:53.0615 (UTC) FILETIME=[8BDF4DF0:01C9445B]

--_3a97dba0-9a7b-4c1c-a36f-ff91b17b4999_
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

Here is the message-

Quote:

Hello again,

I have used your info to open a case at eBay International Services about this deal, they will contact you soon with everithing you have to do to get in posesion of the unit. Please let me know when you will hear from them.

Thank you verry much!

Posted: Wed Nov 12, 2008 10:50 am

here's mine.

Quote:

Delivered-To: [email protected]
Received: by 10.142.204.19 with SMTP id b19cs482442wfg;
Tue, 11 Nov 2008 16:37:28 -0800 (PST)
Received: by 10.151.42.21 with SMTP id u21mr3181376ybj.231.1226450248088;
Tue, 11 Nov 2008 16:37:28 -0800 (PST)
Return-Path: <[email protected]>
Received: from blu0-omc1-s20.blu0.hotmail.com (blu0-omc1-s20.blu0.hotmail.com [65.55.116.31])
by mx.google.com with ESMTP id 3si24917595gxk.86.2008.11.11.16.37.27;
Tue, 11 Nov 2008 16:37:28 -0800 (PST)
Received-SPF: pass (google.com: domain of [email protected] designates 65.55.116.31 as permitted sender) client-ip=65.55.116.31;
Authentication-Results: mx.google.com; spf=pass (google.com: domain of [email protected] designates 65.55.116.31 as permitted sender) [email protected]
Received: from BLU126-W47 ([65.55.116.8]) by blu0-omc1-s20.blu0.hotmail.com with Microsoft SMTPSVC(6.0.3790.3959);
Tue, 11 Nov 2008 16:37:27 -0800
Message-ID: <[email protected]>
Return-Path: [email protected]
Content-Type: multipart/alternative;
boundary="_2dd2a7cb-a224-4306-8439-edac881d6404_"
X-Originating-IP: [172.158.38.222]
From: Petre Jhon <[email protected]>
To: <[email protected]>
Subject: RE: motorbike
Date: Tue, 11 Nov 2008 17:37:27 -0700
Importance: Normal
In-Reply-To: <[email protected]>
References: <[email protected]>
MIME-Version: 1.0
X-OriginalArrivalTime: 12 Nov 2008 00:37:27.0539 (UTC) FILETIME=[D6A2FC30:01C9445E]

--_2dd2a7cb-a224-4306-8439-edac881d6404_
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

It looks like is the bit that's the German IP

I got this from a tutorial about tracing Emails

Quote:

X-Originating-IP: If you are attempting to track down an email received from a Hotmail email account, look for the X-Originating-IP header field, which will tell you the IP Address of the computer that sent the email.

He's selling a mini on craigslist too.

Posted: Wed Nov 12, 2008 11:35 am

Apelord just resolved the Ip's as AOL USA, but ip-adress.com comes up Germany.

Quote:

IP address [?]: 172.158.38.222 [Whois]
IP address country: Germany
IP address state: n/a
IP address city: n/a
IP address latitude: 51.000000
IP address longitude: 9.000000
ISP of this IP [?]: America Online

I'm a bit suspicious of all those zero's though, a bit like when Gilsat reolves to the Atlantic ocean, its because its coming back as zero latitude, zero logtitude.

[email protected] googled to another Mini Cooper, (as spotted by RTCB above) this time without all the light a candle crap,I flagged it for removal. Please have a go at flagging it too. I also replied as an interested punter, no bounce as yet.

http://kingston.en.craigslist.ca/cto/905680306.html

so angry at this scam. please see if someone can find it	View next topic View previous topic