Need some help (dating site scammers)

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Hello I'm New here! Joined: 06 Feb 2011 Posts: 10

Hi,

I run a dating site and I need some help in understanding how these scammers join. They are bypassing every mode of security I can think of. I'd like to know how exactly they join dating sites. Meaning, what programs they use, if they are using socks proxies, etc.

So far I have gone as far as to try setting up a program that will make them run a traceroute and send the results back to me, but it looks like they are all getting past even that!

I can give you more emails of these scammers than you can handle (100k) as well as corresponding profiles, etc to help me capture this information.

Any help will be appreciated.

Thanks

Posted: Thu Feb 10, 2011 12:02 am

Hi, this is a huge question, and I don't think you can stop all scammers as many are just human signups so captcha's etc will not work. Can you tell a bit more about your site without naming it? Size, #scammers vs #real people, etc?

Hello I'm New here! Joined: 06 Feb 2011 Posts: 10

thanks for the response! i do indeed realize they are signing up by hand, but i thought if they are using some type of proxy i'd be able to figure out their real ip and ban them from that.

we are a regular dating site with about 100k members, unfortunately, i'd say as with most of the other free sites out there, over 90%, maybe even over 95 or 99% are scammers. it is very hard to give an exact number.

the information we have on them includes a bunch of questions we ask about them which they fill out corresponding to the photo and information they list about themselves. we ask people to write at least a paragraph about themselves. the photos are pretty standard ones they get from wherever, myspace, zoosk, etc. a lot of them even have facebook profiles with years of updates and hundreds of friends. many use yahoo emails or gmail, but not many use .edu emails (which are harder to get). we can't exactly require .edu emails because not everyone has those. their ip lines up with their stated address. when they pay for premium accounts, all their payment info lines up as well. they don't send tons of emails, maybe 1 or 2, and usually none.

let me know if you need any other details.

Posted: Thu Feb 10, 2011 1:05 am

Wow 95% scammers sounds like a place we would like to hang out Laughing

Kidding aside is there an approval step when a user registers a profile? I would think your run of the mill love scammer would not use a proxy. I guess if they thought their IP would be blocked due to a West African or Rusian geographical location (not the only place romance scammers originate but a good majority) they may try a proxy.

All dating and social networking sites are riddled with romance scammers. There is thousands upon thousands of romance scammers and where there is a will there is a way.

I think education and monitoring may be your best bet. Here is a pretty good general overview of romance scammers here http://scamwarners.com/forum/viewtopic.php?f=13&t=25

I'm sure someone else will come along with more help. Best of luck!

Hello I'm New here! Joined: 06 Feb 2011 Posts: 10

bravo95: no, there's no approval step in terms of them calling in or receiving a text message. i think they'd be able to fake text messages and i don't want to make joining to hard.

really, i know a lot about all the things these guys commonly do. what i'm looking for is specific information i would not be able to get from looking at their profiles. i need to know what goes on "behind the scenes" with these guys. what programs, etc they use.

Posted: Thu Feb 10, 2011 2:01 am

The programs they use are typically yahoo mail on a pc in a cybercafe, and typically not via proxy.

If you're looking to get a bit AI then you can use tineye to pick up some scammers stolen pictures, maybe make people pose with that days newspaper and your sitename both in shot as an indicator of being who they say they are, living where they say they do, at the time they claim to, on the site they're joining. That would knock out most of the Romance scammers in one easy step. If you want to get rid of the low hanging fruit, bar all African and Russian IP addresses - very crude filtering, but I expect you will lose very little genuine business because of it. Watch out for obvious copy/paste body text, you could randomly sample parts of what they 'type' and let a search engine tell you if it is unique or copied.

Can you do a big user education drive, appoint some members as informants who take scammer reports and do a checklist of tests (changing/jumpint IP suggesing random proxy, can they be found on facebook, do they have the photo of proof, etc) and make a deal of it being like neighbourhood watch?

If you were hoping for an easy "yeah all scammers use "The Bat!"" Or something, it's just not the case - it is mostly stolen photos and hand copy/pasted descriptions. You can use tineye and google API's to semiautomate those tasks, although you will never know for certain, but be able to rank members risk levels.

Posted: Thu Feb 10, 2011 2:07 am

Hi eater232450 and welcome to Eater.

Like bravo said, I think better than anything else, education of your members would be an incredible step in the right direction. Become known as the dating site that will not tolerate scammers. Educate the members, allow for easy reporting of scam profiles from the members, etc.

eater232450 wrote:

the information we have on them includes a bunch of questions we ask about them which they fill out corresponding to the photo and information they list about themselves. we ask people to write at least a paragraph about themselves. the photos are pretty standard ones they get from wherever, myspace, zoosk, etc. a lot of them even have facebook profiles with years of updates and hundreds of friends. many use yahoo emails or gmail, but not many use .edu emails (which are harder to get). we can't exactly require .edu emails because not everyone has those. their ip lines up with their stated address. when they pay for premium accounts, all their payment info lines up as well. they don't send tons of emails, maybe 1 or 2, and usually none.

I don't know a lot about the typical romance scammer, but the bolded parts just don't make much sense for me. How can their payment info line up unless they are signing up with the identities of the stolen credit cards? And then how could the IPs then match up? No scammer is going to be paying with his personal payment details -- only stolen. How odd.

Anyway, please take this with understanding -- I don't think anyone here is going to post up too much information about 'how scammers work behind the scenes' and then give you ways to avoid it, because simply, we don't know who you are. You are new and claiming you own a dating site. How do we (as a group) know you aren't really a scammer looking for ways to get better and avoid being caught?

I am sure that is not the case, but you must understand it is possible. I would recommend you contact the admins/mods over at our sister site, www.scamwarners.com, which would be probably better suited for your inquiries and speak to them off the forum (via PM or email). I am sure you can share more details with them (the name of your dating site and the such), they can verify your bona fides and the such, and you would likely get more help. Very Happy

Edit -- And follow manbiteslions tips too. Laughing

Posted: Thu Feb 10, 2011 2:12 am

Most of them are going to be registered on several dating sites so as the above post mentioned googling parts of their profile information will help if you turn up several results. Of course they often use a few differant identities so you may find differant names associated but it could be used as a red flag.

I'm not sure if you collect phone numberes or not but romance scammers from Africa commonly use UK redirect numbers starting with 477.

Like manbiteslions says there is no easy way and education is probably your best bet.

Juan's stalker Joined: 28 Aug 2008 Posts: 1423

A lot of them use this. HideMyAss! Pro VPN This is the favorite of scammers right now. They actually fight over this.

Most of the ones I know have private laptops. If you get a member that signs up and almost immediately sends out invites that they are interested to hundreds of members.

You need to take a good look at that member. Seriously they move fast and know how to pick their victims.

They like "NEW" members most and will latch onto them very fast and move them quickly to email and chat off the site using meebo.

Good luck in your battle, it is a hard, uphill one.

Hello I'm New here! Joined: 06 Feb 2011 Posts: 10

thanks for the tips guys. i really have no idea how they do it, but they def don't sign up either without really living in the US or without a proxy. here is a profile of someone who signed up, which I'm sure you can tell for 100% certain is a scammer that we did a full traceroute on and have their ip and it came up as being from the US in exactly where they said they are from. we get people like this with real ips 99.9% of the time.

"Widowed for last 9 years ,Looking for trustworthy man for dating ,hang out or just having fun ,Likes boating , camping ,dancing ,fishing ,bbqs in backyard with family and friends ,.Likes all kinds of music except rap , boggles Have 2 children 5 grandchildren large family very family oriented Likes also traveling garages sales flea markets , and music festivals"

i suppose we could look these people up on other sites, but we would have to do that by photo online. we've tried looking them up by username or profile info and that usually just results in another profile they made with the same info which doesn't tell us much. maybe i'll look into the tineye site though.

we haven't been logging phone numbers longer than 10 digits, maybe ill try doing that to see if 477 numbers are submitted, but they do enter a lot of standard US numbers with US area codes.

scamwarners looks a little dead, but i'll look into it. i've looked into romancescam as well.

if anyone wants to verify i'm not a scammer, feel free to private message me. the more info you can help provide me, the more i will be able to validate my identity (i can't give all my info out to everyone that says 'hi'). unfortunately, the moderators have prohibited me from offering a monetary reward for your services at the moment, but i can contact the site owner if need be.

Posted: Thu Feb 10, 2011 2:49 am

eater232450 wrote:

scamwarners looks a little dead, but i'll look into it.

SW is far from dead. I am not sure why you would think that. Confused

Quote:

if anyone wants to verify i'm not a scammer, feel free to private message me. the more info you can help provide me, the more i will be able to validate my identity (i can't give all my info out to everyone that says 'hi'). unfortunately, the moderators have prohibited me from offering a monetary reward for your services at the moment, but i can contact the site owner if need be.

Almost all the mods here are the mods over on SW. And the site owner here is the site owner of SW, also. Wink

I don't think anyone needs or wants a monetary reward, but we are more about scambaiting here, whereas SW is more about prevention and education of scams. With the tips in this thread and possibly more information from over there, you should be able to make some progress against the scammers.

Hello I'm New here! Joined: 06 Feb 2011 Posts: 10

thanks Dramaqueen!! that is the type of information i am looking for! unfortunately, i don't know if many of our members are using those ips. i checked a couple and they weren't used as well as they only have a few thousand US ones. since there are wayy more scammers than that, they must at least be using something else... also, believe it or not, not only do the ips our users use resolve to US destinations, but they have residential ISP hostnames. some hidemyass ips have residential hostnames, but not all...

DoraTheExplorer: ok, i didn't mean dead, just less active. there is WAY more activity here and since i'm in such critical need of help in this situation i posted here. really, we need a well thought out solution from an expert and that is why i had mentioned i would pay for it. i know some of you guys are in contact with these scammers all day too and seem more technically inclined, so i thought it would be easier for you to just message them.

Baiting Guru Joined: 03 May 2007 Posts: 18313

You're saying that the info the scammer gives you, including payment info, and IP are matching up? Some do use proxies and some like Virtual Private Networks.
I suggest you research the IPs themselves. That information should help you to see if they are proxies, VPRs, etc. What percentage of the scammers are using US IPs?
Any credit cards used for payment are stolen.

Edit: You were posting as I was posting.

Hello I'm New here! Joined: 06 Feb 2011 Posts: 10

Ima Baeder: what they do is they enter their city as the same city the ip is from. right now we only use paypal, which doesn't give us as much info as we'd like, but if they decide to pay (less than 1% do) then usually the name and location on the paypal account matches up with what they say on their profile. sometimes even if i look for a name in their email addr, that matches too as well as the name/location on their facebook account if i look for that.

how would I determine if it is a proxy, VPN, etc? you mean search google? i've tried a couple doing that and nothing came up. i've tried running a proxy checker on all the common ports of our users ips, but almost 0 came up as a proxy.

about 99.9% of scammers have a US proxy resolved to a residential US ISP. so far all of them that ran the traceroute checked out fine. we also have a flash application that has been proven to get their real ip if they are using a http proxy and not a socks proxy. so far only about 0.1% are shown to be using a http proxy.

Baiting Guru Joined: 03 May 2007 Posts: 18313

My guess is that they're setting up a fake persona that matches their "tools", or vice versa. So, if they have a VPN for a New York IP, they set up the rest of their details to match. If they've set up a New York persona, they get a VPR with a New York IP.

Is the IP only recorded at sign up?

To research IPs: I'm not the best resource as that isn't my forte, but there are a ton of tools listed around the forum here. Try http://iptrackeronline.com , http://whatismyipaddress.com/proxy-check or Google the IP. I'm sure someone else here can give you more detail in researching IPs.

Edit to add: I can assure you that the forum at ScamWarners isn't dead but there's no need to post a thread there. Anyone on staff there in a position to help you will see your thread here.

Hello I'm New here! Joined: 06 Feb 2011 Posts: 10

correct, the ip is only logged right now at sign up. you think we should log it for all logins? maybe ill try adding that, i'm just worried about the amount of false-positives. we also log other stuff at the moment, like browser info and all browser plugins as well as the time zone on the computer, none of which has helped us at all.

maybe ill look into researching the ips a little more. so far, i've just looked at the location and hostname/ISP of the ip.

Posted: Thu Feb 10, 2011 8:58 am

^^ Logging all logins is a must, but usually, Googling their sign up IP will be enough to give them away. If you put in the IP and find it appearing on lots of different sites, 9 times out of 10, it will be a proxy (they're usually shared). The majority of the time, you can confirm this as you will see that different people are using the same IP on different forums.
Also regarding logging all logins: I have seen a scammer based in the US sign up accounts and then hand them off to his accomplices in Africa to work the scams. All he does is sign up so he can get past any initial checks. Once he's done that, everything is handed over to his pals. Like Dramaqueen says, the initial guy may use VPN or a secure server but after that, you'll only hit African IPs. The anonymous IP thing works a bit arse about face with scammers: you'd expect the guy in the US to sign up normally and the Africans to use the proxy but it doesn't normally work that way. The guy in the US uses the proxy as he's vulnerable to Western LE and needs to hide his real IP but the guys in Africa can scam away all they like without fear of comeback. It's only that initial IP that they need to cover. And it's only that initial IP that you're checking so you can see where the problem is.
Unfortunately though, there's always the possibility that you won't ever see more than the one IP simply because once the replies from victims start coming in, the profile has done it's job. The African lads won't even need to visit the site. The US scammer signs up, hooks the victims, hands them over and they just go and deal with the lad in Africa bypassing your site with email and chat.

Be aware that there is no hard and fast way of catching scammers who sign up. Without blowing our own trumpets, there are many people here who can instantly spot a scammer on a romance site but it takes time and experience. We also use several different criteria. For example: Scammers normally use professional modelling photos - they stand out a mile. They'll also normally use a script so you don't have to rely on tracing through the photo. Google some of the words in the profile and if it's a scammer, you'll find them elsewhere. With experience, you also get to learn just how a scammer writes. Africans very, very rarely write with the same sort of grammar as Westerners or Europeans do. Even small points like professions working abroad give them away - there have been plenty of "US engineers" who have been called away to jobs in Africa and although this in itself is not a clincher, it is a huge red flag; and you can normally find something else to go along with it in the profile that will corroborate that it's a scammer. Signup emails are another one that can be Googled. Also be on the lookout for any addresses with numbers - the scammer is using johnsmith07 because he's already scammed with johnsmith01 to 06 and they've been closed down. Again, not a clincher but a definite red flag.

I don't know how many people you get signing up to your site every day, but if possible, it might be worth having someone check out each profile as they sign up. I'd also try to stay away from profiles that fill themselves in - you know the sort: Likes camping, fishing dancing etc in a drop down or multiple choice. Make the member write. A scammer will then either copy and paste (in which case he'll be easy to catch) or he'll give himself away by his style.

But with the best intentions in the world and every safeguard that you can put in place, be aware that one or two will always slip through the net - as we adapt, so do they.

insults and more · Posted: Thu Feb 10, 2011 9:12 am

I just had an idea: automatic side ASEMs.

Suppose that your system, upon signup, automatically sent a message from some anonymous email address to the email address given, saying something like "I'm interested, tell me more." Any response flagged by a spamfilter trained on scams would be a giant flag. Depending on the rate of signups per day, humans could manually inspect the responses.

Probably impractical due to bandwidth limitations as well as the annoyance factor to real people.

Posted: Thu Feb 10, 2011 9:27 am

eater232450 wrote:

when they pay for premium accounts, all their payment info lines up as well.

Hmm, sounds to me that we're not talking African scammers. Maybe Eastern European - I don't have a lot of expierience with those - but I'm willing to bet you 10 hot dogs, that if an African scammer pays to be on a dating site, he's one out of a million.

Do you have any statistics on where the IP's you've investigated tracks to?

Posted: Thu Feb 10, 2011 9:38 am

^^ African lads buy phished CC details from Asian/Eastern European lads. As soon as they get the card details, they start spending. And one of the things they'll use them for is to sign up for different sites and services.

It's certainly not uncommon and you owe me 10 hotdogs. Wink

Posted: Thu Feb 10, 2011 9:56 am

Very well - I always pay my debts:

Posted: Thu Feb 10, 2011 10:57 am

Do you get multiple signups from a single IP address too?. Proxies have a limited number of nodes, and if you get 2 signups from the same IP, you may want to look into both.

As I suggested earlier, there are good search API's for grabbing bits of text and checking for uniqueness, especially with a little human supervision.

If you really want to cut this right down though, stop members contacting others without a "verification photo" with that week's local paper and your site name (watching for crappy photoshops). I'm sure many of your members will appreciate you caring for them hence, and it'll get rid of almost all of the scammers.

insults and more · Posted: Thu Feb 10, 2011 11:28 am

^^^ Perhaps error level analysis could be useful.

I had another idea. I assume you have some people on the site who can be trusted, and have available time. What if you provided a feature whereby these trusted people could engage a new applicant in a brief chat during sign-up? Say, the final stage of signing up is opening a chat window in-site and having an IM interview.

Such moderators could be very useful for weeding out obvious scammers, especially if they are experienced.

ETA:

E.g.

Quote:

Mod: You say you are in New York City. Could you tell me what sport the Yankees play?
Newbie: [twenty seconds of silence] BASEBALL
Mod: You say you are an engineer. What field was your last job in?
Newbie: ENGINEERING
Mod: thanks. Now gtfo.

Posted: Thu Feb 10, 2011 11:34 am

Do you have a "report scam" funtion? I bait a bit on Interpals.net, and they have such a function. I tested it a couple of times on a few of the most obvious lad profiles - and it works! The staff takes it seriously and effectively close down the profiles. Might be worth consideration?

Posted: Thu Feb 10, 2011 1:13 pm

This might sound like a bit of a noob suggestion, but why not put up a scam warning on the site itself? You can gently suggest to people wanting to sign up that they should be aware that scammers target these types of sites, and that they should watch out for certain things in correspondence with anyone, eg if someone suddenly starts asking for money, they should be circumspect and so forth.

It would help spread awareness, and, if I were a scammer, it might make me more cautious of your site, beacuse automatically new signups would be aware that I might be there.

Need some help (dating site scammers)	View next topic View previous topic