Detective Tambo is a Computer Guru (Massbait?)

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Posted: Mon Dec 14, 2009 12:12 pm

Black Dog and I have been baiting this lad for a while now. Little did we know that he was a fully-trained computer technician.

Tambo wrote:

I have the full ideal and knowledge of this business because I did A+ and N+ that is computer repair trouble shooting and networking the things needed are motherboards for Pentium 4,empty cases,power supplies,memories,lcds,speakers,printers,fax,Hard Drives,cooling fans,Amps and many other things please just trust me and help me I will never let you down.

Nothing was thought of it at first, until he tried to "ping" one of my e-mails, resulting in some meaningless drivel that is no doubt related to Google AdSense or the Yahoo equivalent. Here's a sample:

Quote:

"text": "Cape Town",
"wikiId": "Cape_Town",
"relatedWikiIds": ["Africa", "Beijing", "Buenos_Aires", "Durban", "Harare", "Johannesburg", "Pretoria", "South_Africa", "Stellenbosch", "Sydney"],
"relatedEntities": ["africa", "beijing", "buenos aires", "harare", "johannesburg", "pretoria", "singapore", "south africa", "stellenbosch", "sydney"],
"geoCountry": "South Africa",
"geoCounty": "Wynberg",
"geoIsoCountryCode": "ZA",
"geoLocation": "(18.4823, -33.979012)",
"geoName": "Cape Town",
"geoState": "Western Cape",
"geoTown": "Cape Town",

Shocked by this revelation that all along we've been messing him around from within his own country (we weren't, not even close) he decides to reveal his true identity.

"You have been tracked down"

"Detective" Tambo wrote:

Listen we are more smart than you guys and we are more trained and educated than you and to show you this is 419 and God will punish you and your place is hell don't use the name of God for evil.
God is not your mate we will teach you a lesson we are computer gurus if you don't know we know exactly where you are we know what kind of internet connection you are using we know your location.
We are going to shut down your website and all your email addresses if you don't send R10 000 we are giving you only tomorrow to do that or you will face problems which you don't expect.
You better cooperate or you will regret for doing fraud in this country we are looking for people like you because you have been so free in the passed not any more.
Send the money tomorrow through western union Name: N0mpinda M@jiki Johannesburg if you don't do this expect big problems.
We know exactly where you are you are in South Africa we have used our mobile system detector and will have picked up your address if you don't send this money you will explain in the court of law all these things you have been sending and saying.
We have tracked you very well and don’t think you will escape this is the only favor we are giving to you send the money and we will drop the investigation and the follow-up to catch you guys.
You are destroying the image of this country guys for your own information my real name is Detective Tambo Nk0si. Am in charge of this case it has been reported that you are a very bad group who can do anything to take money.

We picked up your website because it was reported that it was involved with fraud and we have proved it now and its time to bust you if you don’t cooperate.
This your chance if you don’t want don’t send but this just from my side to try and help you and after you send money I will give you some more secret information about you and I will advise you what to do.

"Action Will be Taken"

"Detective" Tambo wrote:

If you don't respond with a positive reply we will start taking action aganist you.
You can never run away from us because we have mapped you am in charge to give orders am waiting for you to respond the first thing we will do if you don't cooperate is all your emails the passwords will be changed and your site will be shut down after that we will arrest you.

In other words, if you want to mess with this lad, just put the name of a city where you want him to believe you are in in your letter several times, he'll "ping" it, and have your "true location" revealed by AdSense. Pretty cheap and easy way to get the paranoia flowing. Very Happy

For the record, this was my response.

Kobus wrote:

Ja, you got me ok. My name is Kobus Van Ren$burg and, you are correct, I have been here in Cape Town all along. I live in Mitchell's Plain.

Listen boet, I didn't know you were a detective ok. We are just businessmen struggling to make money. You know how it is. I am very sorry for tuning you grief.

Can't we make this problem go away? Come on my china. Surely we can settle this without money getting involved. Don't you want to work together? I can help you catch other guys. I'll even give your address to some others I know.

Come on bru.

Kobus

Here's the header:

Header wrote:

Delivered-To: [email protected]
Received: by 10.141.29.12 with SMTP id g12cs73419rvj;
Sun, 13 Dec 2009 07:01:10 -0800 (PST)
Received: by 10.100.50.36 with SMTP id x36mr5266707anx.151.1260716469540;
Sun, 13 Dec 2009 07:01:09 -0800 (PST)
Return-Path: <[email protected]>
Received: from web32102.mail.mud.yahoo.com (web32102.mail.mud.yahoo.com [68.142.207.116])
by mx.google.com with SMTP id 30si6483658yxe.122.2009.12.13.07.01.07;
Sun, 13 Dec 2009 07:01:08 -0800 (PST)
Received-SPF: pass (google.com: domain of [email protected] designates 68.142.207.116 as permitted sender) client-ip=68.142.207.116;
Authentication-Results: mx.google.com; spf=pass (google.com: domain of [email protected] designates 68.142.207.116 as permitted sender) [email protected]; dkim=pass (test mode) [email protected]
Received: (qmail 92110 invoked by uid 60001); 13 Dec 2009 15:01:07 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1260716467; bh=b9cscV/khEb1v6p4xqPCIgTjMYHsuYQtDVJcIKzX+Z8=; h=Message-ID:X-YMail-OSG:Received:X-Mailer:Date:From:Subject:To:MIME-Version:Content-Type; /91WUzB7tajUaPCDtdIye+smLibKbFYrOMgZlbXN0HbjS97eTkalOUiaMgLkU=
DomainKey-Signature:a=rsa-sha1; q=dns; c=nofws;
s=s1024; d=yahoo.com;
h=Message-ID:X-YMail-OSG:Received:X-Mailer:Date:From:Subject:To:MIME-Version:Content-Type;
<snip domain key to prevent forum blowout. - JF>
/DauYjT6Ed/iEwlYR4PO7lGZI5RxKsGTpMn0=;
Message-ID: <[email protected]>
X-YMail-OSG:
Received: from [41.243.146.233] by web32102.mail.mud.yahoo.com via HTTP; Sun, 13 Dec 2009 07:01:07 PST
X-Mailer: YahooMailClassic/9.0.19 YahooMailWebService/0.8.100.260964
Date: Sun, 13 Dec 2009 07:01:07 -0800 (PST)
From: En0ck Sich@lwe <[email protected]>
Subject: You have been tracked down
To: [email protected]

Posted: Mon Dec 14, 2009 8:37 pm

Quote:

We picked up your website because it was reported that it was involved with fraud and we have proved it now and its time to bust you if you don’t cooperate.

Better watch out I did not know that Detectives "busted" people ! I am sure that you will give your full cooperation !!!

Posted: Tue Dec 15, 2009 2:49 am

Hi Nick! I would like to mess with this lad but I need to know what to reply to. What was his original scam?

Posted: Tue Dec 15, 2009 7:05 am

unsure of his original scam format, it was deleted in my catcher inbox but he sure is angry at me

Posted: Tue Dec 15, 2009 11:25 am

I noticed something very strange.
I googled the email adress in the hope of finding the original scam mail.
It came up one (dead) hit. So when i tried another search engine, i found http://forums.driverguide.com/archive/index.php/t-15226.html
Its the same email adress asking for a driver for a network card. at 22/04/2006...
So is it just another email account , a hacked email account or has the lad seriously used his private email adress ?

Posted: Tue Dec 15, 2009 12:50 pm

Fartina o'douriss wrote:

I would like to mess with this lad but I need to know what to reply to.

Play the "detective" angle. Tell him you heard that he was "busting" scammers in Mitchell's Plain and beg him to destroy your case. Or, you could say that you're the superintendent of the Johannesburg branch of SAPS and demand he explain himself for impersonating an officer.

All you have to do is mention a city multiple times in your letter, it will get picked up by AdSense, the lad will check the source code, and believe beyond the shadow of a doubt that you are really there. Much paranoia can flow by abusing this misunderstanding.

auguste wrote:

has the lad seriously used his private email adress ?

Yes. Real name too. Or so I believe.

It's a long story, but suffice it to say, he can get really, really spooked since he's not hiding behind the anonymity of a fake account. Wink

Posted: Tue Dec 15, 2009 3:08 pm

I haven't worked out an angle yet, but I SO want in. Bob Arctor needs to see what this scam -er - scanner sees

Posted: Tue Dec 15, 2009 3:16 pm

HIS IP checks out to a place called Boksburg about 10-15kays from Johannesburg as the crow flies. I was thinking of being from Reiger Park, the suburb right next it Shocked

Posted: Tue Dec 15, 2009 3:26 pm

Boksburg is most likely simply the location of his ISP.

I'm not absolutely certain how those ads work, but I think they won't pick up on small suburbs. It's worth mentioning that I also had the words "travel" and "tickets" in my letter, so that may have helped the ads pick up on it as a travel destination.

This is all very new to me as well so I'm guessing it would be trial and error for all of us.

As for an angle, you could pretend to be another lad that heard about him outing other scammers, and have gotten some of your buddies together to beat him up for it. Oh, and you live in Johannesburg and know his real name. Wink

Just a suggestion.

Detective Tambo is a Computer Guru (Massbait?)	View next topic View previous topic