Scambait that took a turn... need expert help

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Posted: Wed Mar 23, 2011 10:56 pm

My employer recently got a quote request through our website for a bunch of highend Cisco equipment. Fortunately, the IP address was captured in the web form so I knew it was from Nigeria and my coworkers had me "take over".

Right away the level of sophistication was surprising. The scammer actually got a real company in Fremont, CA and registered a variation of their domain name. He has the domain parked at hotmail.com so he use the custom domain. The real company is optoplex.com and his domain is optoplex-corp.com. He took the real name of one of the officers of the company. My quote was for $70k or so and he sent me his credit reference sheet. He used real companies in the same area as references and he had the Fed ID and other information for the real company. I was impressed.

I told him that we would check the references and prepare his shipment. He sent me a PO and asked me to ship the goods to a private address in Washington state.

While all of this was going on, I was attempting to contact the company in Fremont that he was impersonating. The receptionist heard something was going on with a scam and thanked me. There was a bit of a language barrier. I left a voicemail for the guy that they were impersonating and sent him a message via Facebook. No reply.

I kept stringing the scammer along while waiting for a reply from either the real company or the FBI. Today the FBI called me back and said that I should file a complaint on the website. I used the website 13 days ago to complain about a fake Tsunami/Earthquake donation site and they never replied so I had the site taken down myself. I asked if there was anyone I could talk to about it and they suggested the FTC.

Contacted the FTC and they had a laugh about scambaiting. The agent that took my report actually knew this site! So I give all the information and then ask what to do next. They suggested I call the local police in the city that I was supposed to ship the goods to.

I called the police in Shoreline, WA and told them the whole story and they told me to shit in a hat. I think the exact terminology was that they don't warn people about scams.

I then tried to track down the individual and had no luck. I did get a number to her apartment complex and called the manager. It turns out they are a public housing complex for seniors and people with various disabilities. It's for people with extra needs, but not bad enough to be in assisted care.

I explained the whole story to the manager and they seemed to think that this person could be scammed. They asked if it would be possible to have her call me so I could explain it all.

She called me about an hour later and I told her what was going on. She told me that the only person that has shipments sent to her is her fiance in Germany. He works with some organization that is building schools around the world and she gets shipments of DVD players, books, computers, etc. She then volunteers information that she has a bunch of checks to cash and send out via Western Union. She told me that her fiance is coming to the US to marry her next year. I tried to tell her it is a scam, but she is just too simple to grasp that concept.

I called the manager back and told her what is going on. She said there is no way to get a court order since the victim is classified as independent.

I called the FTC back to report what is going on and they suggested that I call the California Attorney General's office. I called them and the agent I talked to was weird. He thought that maybe the Nigerians had infiltrated the FBI and that is why they did not want to help. Suggested I write a letter to the President... weirdo

What do I do now? The scammer is still active, he messaged me just minutes ago asking for the tracking number. He's obviously scamming other companies and this individual in Washington. NOBODY seems to care that this handicapped person is being taken advantage of.

Normally I would say screw it and tell the scammer I shipped the goods and make up excuses about the non-delivery, etc. Make it look like his recipient handling the shipment lost it or whatever but this is more complicated than that. The company in CA that is getting impersonated, their officer, the FBI, the FTC, CA AG, local police, etc do not care.

Please help!

Posted: Wed Mar 23, 2011 11:14 pm

This is obviously a complicated and ugly situation..... I suggest you post this at our sister site, www.scamwarners.com, both as a warning for others (people Google their way to Scamwarners constantly) as well as for help by our support members. It's obviously going to take some coordination to take down a group of scammers this sophisticated, and heartless.

Posted: Wed Mar 23, 2011 11:39 pm

Cross posted on scamwarners.

Any suggestion on how to proceed with the bait? The guy is still emailing me. I was ready to ship a load of broken equipment until I actually talked to the lady in Washington... Sad

Posted: Thu Mar 24, 2011 12:09 am

Sticky situation since your trying to bait the lad with your real life details. If it was me I would just drop the lad.

The person he is having shipments sent to sounds like a romace scam victim being used as a mule. The folks over at scamwarners will be able to help with that and tbh its best left up to the pros so probably best to stop comunicating with her.

You have an easy out with th lad without burning him. You can simple say his refferances came back negative.

I think you have done all you can warning the company and contacting LE.

In RL the company I office at was scammed in a similar way. These lads that target specific companies are much more sophisticated that your run of the mil 419er.

Edit meant to add If Juan did not already ask you may want to PM him the stollen credit cards you received for the mode to do their magic.

Posted: Thu Mar 24, 2011 12:16 am

I am actually baiting him with a fake company and email address. Mr Footlong Cox happens to have an IT company Cox In Hand Industries. Very Happy

When I emailed him and said I got a quote request on my website and gave the fake details, he did not hesitate to start his scam.

I was thinking maybe UPS refused delivery because it was an apartment. Not too sure now because I'm also stuck thinking about this lady that is about to get royally jammed sooner or later.

In the meantime, I left a voicemail for the fraud officer in Fremont where the real company is located. I also left a voicemail for a TV station in the victim's area.

Posted: Thu Mar 24, 2011 1:20 am

Ok if that is the case and he cannot trace you back to your RL detail one thing you could do after you report the stollen credits cards to a mod is tell him you ran the card (im assuming cards because of the amount) and they did not work. Rinse and repeat see how many cards you can get killed.

As far a the lady in Washington she is going to need a lot of help from one of the pros at scamwarners. There is no telling how long she has been decieved by the lad.

Posted: Thu Mar 24, 2011 1:28 am

He wants to pay me by check with NET 15 day terms, so no stolen cards yet.

I managed to find her Facebook page and her "fiance" has his own page too. Good looking model pics on his page. One of them was stolen from a gay dating site. She has comments on his pics going back 4 months. It might be too late for her.

Posted: Thu Mar 24, 2011 10:05 am

This is pretty depressing that you have a bunch of information but no one with authority will do anything about it Confused

Posted: Thu Mar 24, 2011 4:46 pm

Scamwarners is on the case. I forwarded all of the vic's details to them and they are going to work their magic. I suspect it is not going to be easy.

On another note, I was sitting here trying to figure out who else to call. I ran down the whole story to my brother who is in law enforcement in Utah and he said it would be hard for him to do anything given that it has crossed so many state lines and out of the country. My ex-wife overheard me talking about it and when I got off the phone suggested that I contact someone that I know at Harpo, Oprah's production company. I do happen to have a good working relationship with someone there so I dropped him an email. The last time I was there at the studio, I was telling him how I had this scambaiting hobby. In my email to him I did mention that I reached out to Scamwarners for assistance. If anything came of this, I don't think the publicity would be bad for them. In the case of mentioning 419eater, I guess I would have to take that up with the moderators and admins here.

I'll keep you informed.

Master of Master Baiters Joined: 27 Dec 2010 Posts: 586

Can you please post the headers? Let us have a crack at them! Twisted Evil

Posted: Fri Mar 25, 2011 12:34 am

Here are the emails as they came. I've cleaned up some of the info :

Here is the original request sent via my real employer's website.

From: [email protected]
To: [email protected]
ReplyTo: [email protected]
Subject: Quote Request.
Sent: Mar 21, 2011 6:26 AM

Name: Yigao Sha
Email: [email protected]
Subject: Quote Request.
Message: Hello,
Please I need your support for this Cisco equipment switches,

CISCO WS-C2960-48-TT-L (10unit)plus UPS Overnight.

Please I want you to get back to me with the total cost for 10units plus the cost of UPS overnight shipment. Please I will be paying with Net 15 term of payment, get back to me with the quote as soon as possible so I can forward our credit references and the PO to complete this order.
Regards,
Yigao Sha.

Optoplex Corporation
3374 â€“ 3390 Gateway Boulevard
Fremont, CA 94538
Tel: (510) 225-4096
Email: [email protected]

IP: 41.184.3.10
Website Contact

I replied with :

Hello.

I am pleased to quote you the following for your shipment :

Cisco WS-C2960-48-TT-L
10 @ $5600.75 = $56,007.50
CA Sales Tax : $5180.69
UPS Overnight to Fremont : $987.00

TOTAL : $62,175.19

Please advise how you would like to proceed. If you can wait a couple days, we do have the WS-C2965-96-TT-L coming in to our stock. That switch has a 58 Pedabit backplane, 96 ports 10/100/1000/9999M half/full/double duplex, firewire 4.0, USB 3.0, and BlueToof capabilities. The list price is around $6600 per unit, but it is a much superior product.

Best Regards,

Footlong Cox
Cox In Hand Industries

I received this reply from him :

Delivered-To:removed - spot
Received: by 10.216.89.16 with SMTP id b16cs25334wef;
Mon, 21 Mar 2011 14:57:53 -0700 (PDT)
Received: by 10.42.18.197 with SMTP id y5mr542421ica.423.1300744672134;
Mon, 21 Mar 2011 14:57:52 -0700 (PDT)
Return-Path: <[email protected]>
Received: from blu0-omc3-s5.blu0.hotmail.com (blu0-omc3-s5.blu0.hotmail.com [65.55.116.80])
by mx.google.com with ESMTP id m14si8628620ibc.126.2011.03.21.14.57.50;
Mon, 21 Mar 2011 14:57:50 -0700 (PDT)
Received-SPF: pass (google.com: domain of [email protected] designates 65.55.116.80 as permitted sender) client-ip=65.55.116.80;
Authentication-Results: mx.google.com; spf=pass (google.com: domain of [email protected] designates 65.55.116.80 as permitted sender) [email protected]
Received: from BLU159-W52 ([65.55.116.74]) by blu0-omc3-s5.blu0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675);
Mon, 21 Mar 2011 14:57:34 -0700
Message-ID: <[email protected]>
Return-Path: [email protected]
Content-Type: multipart/alternative;
boundary="_a0acf8b9-6c95-4233-b69b-216b57c19957_"
X-Originating-IP: [41.184.131.205]
From: Yigao Sha <[email protected]>
To: <removed - spot>
Subject: RE: Quote
Date: Mon, 21 Mar 2011 21:57:34 +0000
Importance: Normal
In-Reply-To: <[email protected]>
References: <[email protected]>
MIME-Version: 1.0
X-OriginalArrivalTime: 21 Mar 2011 21:57:34.0706 (UTC) FILETIME=[FC1DD520:01CBE812]

--_a0acf8b9-6c95-4233-b69b-216b57c19957_
Content-Type: text/plain; charset="Windows-1252"
Content-Transfer-Encoding: quoted-printable

Hello Footlong,

Thanks for the support of the quote, please let me know if you are presently on your sit so I can forward our credit references and the PO to complete these order on Net 15 term.

Yigao.

I have many more emails between us because he was getting anxious on the status of the shipping. I am hesitant to post the PO and Credit Reference sheet he sent me because it contains sensitive information. The credit sheet has real financial information about Optoplex and they have yet to return a single one of my phone calls. I have called EVERY extension I could find and nobody picks up.

If you manage to get a PO from him and the Ship To address is in WA state, send me a PM so we can confirm it is the same victim as my bait. I will not post her name here but I want to make sure that if it is the same person, nothing is sent to her. She's a victim to her own scam and as I noted above, she's getting the help she needs. I'm sure this dick has other delivery locations spread around the country.

Posted: Fri Mar 25, 2011 1:52 am

Cornloaf wrote:

If you manage to get a PO from him and the Ship To address is in WA state, send me a PM so we can confirm it is the same victim as my bait.

There is no need for this. The mods and scam warners over at ScamWarners have the information you gave them and I am sure they are taking care of it. If anyone else gets vic/mule information, just pass it to any mod here on Eater and they will make sure it gets dealt with appropriately.

Good job on finding all this information on this vic/mule and I sincerely hope the scam warners can help her.

On another note, http://optoplex-corp.com/ looks to be a fakey just used for email-only. I will take it to our Fake Banks forum and get the domain killed. Very Happy

Posted: Fri Mar 25, 2011 2:02 am

No problem. Who here should I pass my mule's info to?

Posted: Fri Mar 25, 2011 2:09 am

We work with Scamwarners so no need on this one but if it comes up in the future please do PM the info to the mods.

Master of Master Baiters Joined: 27 Dec 2010 Posts: 586

Hmmmm. Header posts to Nigeria from my checks. I am gonna get it. Twisted Evil

Master of Master Baiters Joined: 27 Dec 2010 Posts: 586

and no cornloaf.....you do not reside there.......

Posted: Fri Mar 25, 2011 4:11 am

bigdaddy wrote:

and no cornloaf.....you do not reside there.......

This confused me so much and then I realized what you were talking about! I couldn't resist using that line from the MacGruber movie!

Master of Master Baiters Joined: 05 Mar 2009 Posts: 582

@ cornloaf
That is one sad and frustrating situation. You mentioned that the victim is receiving packages via UPS (and maybe FedEx?). What about calling the UPS toll free number? 1-800-742-5877, ask for their fraud department and see if they will cease delivering to her. Maybe let them know you suspect she is receiving packages purchased with stolen credit cards or is a money mule.

Posted: Fri Mar 25, 2011 4:40 am

Not a bad idea. I guess I could contact FedEx and UPS and let their fraud department know. I don't want to get her in trouble though just in case someone from their fraud dept decides to contact the police and file a report. I'll have to consult with the sister site about that.

Master of Master Baiters Joined: 27 Dec 2010 Posts: 586

Just to be sure....I really like and am very impressed by your post. Thank you very much. I am inspired very much!

Posted: Fri Mar 25, 2011 10:53 am

^^^ I second bigdaddy's comment.

You've put in so much hard work trying to resolve this and it's obvious you care very much. It's really nice to see such dedication to the side of good.

Posted: Fri Mar 25, 2011 11:39 am

Wow. That is sad. I think I am going to start selling stuff to him....

Posted: Fri Mar 25, 2011 12:13 pm

Dora the site exploder killed his website with the quickness! That means his email address will stop working too. Cornloaf he will probably email you from a new email address with some excuse just buy what ever bs he tells you and if you don't mind posting his new email address so we can play with him that would be great! Laughing

Posted: Fri Mar 25, 2011 5:50 pm

Nothing from his new email yet. I emailed him last night and said that his credit checked out and gave him the tracking number for his shipment. I think he was on to me anyway because of my contact with the victim/mule.

When I was on the phone with the vic, she mentioned that she was expecting either money or a package from KEL Connectors which was also in the San Francisco area. While I had her on the phone, I found that they were a Japanese company with offices on West and East Coasts in the US. They look to be a small company like Optoplex, so maybe he's got a fake domain with them as well.

I'm still taken aback that not one person out of the almost 20 messages I left at Optoplex has called me back. I even emailed them through their job application address and got nothing!

Posted: Fri Mar 25, 2011 5:54 pm

GreyAmadeus wrote:

^^^ I second bigdaddy's comment.

You've put in so much hard work trying to resolve this and it's obvious you care very much. It's really nice to see such dedication to the side of good.

But I don't want to be good! I want to be EEEVIIILLLL! *Evil laugh here*

Evil Lol

<--- we have in icon for the evil laugh now Wink

- JC

Scambait that took a turn... need expert help	View next topic View previous topic