Fresh Noob here...

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Hello I'm New here! Joined: 16 Nov 2011 Posts: 9

I just found this site because of a "seller" with a used vehicle on Craigslist.
He wants me to send bank info to escrow.com but fax it to a number he provided through an email (fake) from [email protected]

Here's what I have so far:

fake address (State #1)
fake email from escrow.com
REAL domain that the email came from
fake(?) name and address of domain registrar (State #2)
name and address of "his" bank (State #3)
fake fax # (State #4)
IP Address (he loaded a tracking image in a reply email)(State#5)

I really don't have the time for this but I'm soooo tired of these stupid idiots that can do this but not make money without ripping someone off.

Any suggestions on what I should do next?

Master Baiter Joined: 03 May 2011 Posts: 237

Welcome to 419eater, first of all.

If you want to bait him, you need to know how to bait safe. That means, use no personal information whatsoever that could let the scammer trace back to you. Made-up name, e-mail, addresses; everything.

There are stickies in the different forums on how to bait safe - educate yourself thoroughly before you even think about scambaiting. These people are ruthless criminals - always remember that.

Hello I'm New here! Joined: 16 Nov 2011 Posts: 9

I just wanted to shut this guy down.

I'd be happy to turn over what I have so someone else can have fun with him...

Posted: Wed Nov 16, 2011 6:15 pm

Welcome to Eater!

What exactly do you want shut down? We shut down fake bank sites, fake lawyer sites, and real bank accounts of scammers. Escrow.com, from a quick look at its whois record, looks like a real site.

Do you have an initial script that you could post for us to bait? (Script is the canned messages that a scammer sends.)

Posted: Wed Nov 16, 2011 7:30 pm

scumbait_57 wrote:

...from [email protected]...

escrow.com doesn't use [email protected], the correct addy is [email protected] ( https://www.escrow.com/support/faq/index.asp?sid=8&qid=141 )

Quote:

confidence rating: 0 - Bad address
error : RecipientRejected - Mail server rejected the email address.
canonical address: <[email protected]>

vs

Quote:

confidence rating: 3 - SMTP
The email address passed this level of validation
without an error. However, it is not guaranteed to be
a good address. more info
canonical address: <[email protected]>

Sounds like your lad spoofed an email from escrow.com. Post up the email with the complete header and we can take a look at it for you.

But like vonpaso indicates, there isn't much we can do to 'shut him down'. The only way to shut a scammer down is when they are arrested (or dead) and that ain't gonna happen. So we bait them, kill their websites, their bank accounts, aggravate them, and waste their time. So join us -- it can be fun! Laughing

Welcome to Eater, scumbait_57! Very Happy

Hello I'm New here! Joined: 16 Nov 2011 Posts: 9

Where should I post it, Dora?

Hello I'm New here! Joined: 16 Nov 2011 Posts: 1

The first thing you should do is report this at ic3.gov. That is the FBI website to report internet crimes.

Also, I would suggest contacting Escrow.com to give them any information or email correspondence you have with this scammer, since they are using their name and representing them falsely. You can contact Escrow.com via email at [email protected] or by phone at 888-511-8600.

Finally i would suggest contacting the site that posted this add to let them know that it s fraud. This way they can at least remove the add.

Hello I'm New here! Joined: 16 Nov 2011 Posts: 9

The one thing I find amusing is tracking him with my image I put in the email...lol

I'm generating a list of IPs.

It's just a little tool I use for all my CL ads but it's working:)

Posted: Wed Nov 16, 2011 8:31 pm

scumbait, just post it up here in the thread. Or you can send it to me via PM and I will take a peek at it. Wink

KethG, welcome to Eater! Your ideas are good and of course anyone can make a report to IC3. But that won't stop this scammer at all. And reporting it to escrow.com? Sure, but again, there are so many scammers impersonating escrow.com (and other legit sites), there is little they can do about it,save for the warnings they post up all over their site.

Hello I'm New here! Joined: 16 Nov 2011 Posts: 9

First the sender's masked email address:

http://ed84322.appleggs.com/pay1/?2c=6c47f141-bb24-43b9-b952-14344c8bd26b&t=i

Then the email:

http://xp70665.urlctr.com/ptg/?d=7be70c76-6280-45c4-8e78-50f305fe6b2d&t=i

I'm not sure if this will work here...

Nope not as images. You have to click the links.

How else can I upload them but stay anonymous?

Posted: Wed Nov 16, 2011 9:45 pm

Ok, can you go back and get the header too? That will help see where it was sent from. And this time, just copy and paste, don't do an image since that won't help as much.

To get the header in gmail:

Go to the little drop down arrow next to the reply arrow in the right upper corner.

Pick the option SHOW ORIGINAL. This will open a new window with the header.

Copy and paste that into a post here. Very Happy

Hello I'm New here! Joined: 16 Nov 2011 Posts: 9

from Escrow.com Transactions [email protected]
reply-to "Escrow.com Transactions" <[email protected]>
to [email protected]
date Mon, Nov 14, 2011 at 5:51 PM
subject #570085-0 2010 Forest River Solera SS24S 24' one slide class C motorhome - A secure online transaction is waiting for you at Escrow.com
Important mainly because of the words in the message.

Hello I'm New here! Joined: 16 Nov 2011 Posts: 9

Delivered-To: My Email [email protected]
Received: by 10.68.64.66 with SMTP id m2cs75296pbs;
Mon, 14 Nov 2011 17:51:46 -0800 (PST)
Received: by 10.52.34.78 with SMTP id x14mr32453049vdi.122.1321321904336;
Mon, 14 Nov 2011 17:51:44 -0800 (PST)
Return-Path: <[email protected]>
Received: from qmta12.westchester.pa.mail.comcast.net (qmta12.westchester.pa.mail.comcast.net. [76.96.59.227])
by mx.google.com with ESMTP id d8si15510140vdw.61.2011.11.14.17.51.43;
Mon, 14 Nov 2011 17:51:43 -0800 (PST)
Received-SPF: softfail (google.com: domain of transitioning [email protected] does not designate 76.96.59.227 as permitted sender) client-ip=76.96.59.227;
Authentication-Results: mx.google.com; spf=softfail (google.com: domain of transitioning [email protected] does not designate 76.96.59.227 as permitted sender) [email protected]
Received: from omta09.westchester.pa.mail.comcast.net ([76.96.62.20])
by qmta12.westchester.pa.mail.comcast.net with comcast
id xDqZ1h0040SCNGk5CDrka2; Tue, 15 Nov 2011 01:51:44 +0000
Received: from it ([172.129.67.172])
by omta09.westchester.pa.mail.comcast.net with comcast
id xDrW1h00t3j07103VDra13; Tue, 15 Nov 2011 01:51:42 +0000
Message-ID: <001201cca339$1db24ef0$ac4381ac@it>
Reply-To: "Escrow.com Transactions" <[email protected]>
From: "Escrow.com Transactions" <[email protected]>
To: <My Email [email protected]>
Subject: #570085-0 2010 Forest River Solera SS24S 24' one slide class C motorhome - A secure online transaction is waiting for you at Escrow.com
Date: Mon, 14 Nov 2011 17:51:30 -0800
MIME-Version: 1.0
Content-Type: multipart/related;
type="multipart/alternative";
boundary="----=_NextPart_000_000E_01CCA2F6.0A7954C0"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.3028
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3028

This is a multi-part message in MIME format.

------=_NextPart_000_000E_01CCA2F6.0A7954C0
Content-Type: multipart/alternative;
boundary="----=_NextPart_001_000F_01CCA2F6.0A7954C0"

------=_NextPart_001_000F_01CCA2F6.0A7954C0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

=20
Protects Online Buyers and Sellers from Fraud

=20

A Seller Sean Claxton, has selected Escrow Payment Services to =
handle a secure online transaction and registered you, My Name , as =
the Buyer.

Item title: 2010 Forest River =
Solera SS24S=20
Sale price: $15,000.00=20
Quantity: 1=20
Status: Payment Pending=20
Transaction Date: November 14, 2011=20
Insurance: Offered=20
Case ID: 570085-0=20
Shipping and handling: $0.00
=20
=20
=20
Buyer Information =
Seller Information
My Name
8595 Monterey Hwy.
Gilroy CA 95020
United States Sean Claxton
1520 3rd Street NW
Great Falls MT 59404
United States=20

How does it work?
1.. Buyer and Seller Agree to Terms
Both parties agree to terms of the transaction, which includes a =
description of the merchandise, sale price, number of days for the =
Buyer's inspection, and any shipping information.=20
2.. Buyer Sends Payment to Escrow
The Buyer submits a payment by selecting wire transfer.Check, =
Paypal or money order are also available on amounts $2000 and under. =
Escrow verifies the payment. Processing time by payment method: 3 days =
for wire transfers.=20
3.. Seller Ships Motor Vehicle to Buyer
Upon payment verification, the Seller is authorized to ship the =
motor vehicle to the buyer's address and submit tracking information.It =
will be shipped within 5 days after the payment will be cleared in our =
account. The shipping is free of charge and the vehicle is fully insured =
for damage during the transportation, inspection process and prior to =
the physical sale. Escrow verifies that the Buyer receives the motor =
vehicle.=20
4.. Buyer Inspects and Accepts
The Buyer has a set number of days for inspecting the motor =
vehicle and the option to accept or reject.=20
5.. Seller is Paid by Escrow
Escrow pays the Seller by the method selected by the Seller. The =
transaction is complete.
Wire Transfer Payment Instructions

Funds must be sent to this account as a wire transfer and not as =
an account to account transfer, electronic check or ACH.Provide to your =
bank the information below to successfully transfer funds to us :

Bank Name:
Fifth Third Bank=20
Credit Account Name: William Burleigh III=20
Account Number: 7914325928=20
Bank Address: 36700 Ford Rd.Westland, MI 48185,United States =
of America =20
Wire RTN Number:
072405455=20

In order to properly validate your payment and avoid transfer =
related issues, please send us your copy of the bank transfer to our =
central fax number: 1-(636)212-9624.Sending the payment by any other =
method of payment will void this transaction and your right to be =
refunded.Your payment can't be lost in the mail, like money orders or =
checks, and it can be confirmed in 3 days.=20
=20
The payment must be completed within the next 3 business days and =
it's fully refundable if the sale is not completed.=20

Title Transfer and Registration
Escrow Title Transfer Services assists with title and registration =
from start to finish, and covers cars, trucks, motorcycles, motor homes, =
boats, watercraft, off-road vehicles and trailers.
a.. Filling out all the paperwork for you through a limited =
power of attorney.=20
b.. Collecting all needed documents from all parties.=20
c.. Provides all paperwork, including bill of sale and power of =
attorney.=20
d.. Lien holders such as finance and leasing companies are =
included in the process.=20
e.. Will notify the seller of necessary documents to send us, =
including proof of insurance and smog/emission inspection.
What are the benefits?
Escrow.com, an accredited escrow company, acts as a secure third =
party to protect the Buyer and Seller.

How Buyers are protected:
a.. Escrow confirms with the Buyer and verifies the merchandise =
was received.=20
b.. The Seller isn't paid until the Buyer accepts the =
merchandise, or the inspection period expires.=20
How Sellers are protected:
a.. Escrow confirms when the Buyer receives the merchandise.=20
b.. The Seller is authorized to deliver the merchandise only =
after Escrow verifies good funds.=20
Please respond by replying to this email.Your email will go =
directly to our Customer Support Department.=20
=20

Copyright =A9 1999-2011 Escrow.com. All rights reserved.=20

(Mod edit to delete superfluous HTML and image coding- JF)

Posted: Wed Nov 16, 2011 9:59 pm

Thanks!

That email was spoofed and if you reply to it, it is really going to:

Reply-To: "Escrow.com Transactions" <[email protected]>

http://transactions-world.com/

Which is a fake domain, hosted on yahoo, being used by the scammers for the email facility.

What that means is if you email [email protected] and get a reply from them, we can work on getting it killed by Yahoo in our Fake Bank forum. But for Yahoo to kill it, we need the scam email from the domain (with header).

Are you baiting with your RL email addy or an addy that has any ties to your RL details?

Hello I'm New here! Joined: 16 Nov 2011 Posts: 9

Yep. This was not baited. I responded to a CL Ad with a good price and instantly recognized a scam. We're still emailing back and forth. I want to pass this on to another "Buyer" (because I work for a dealership and I'm using my real contact info). Are you game?

I can give your "contact info" to him and say something like, "Sean, here's the buyer I have that's interested in the Solera. I can't do this transaction (my boss won't let me) but my buyer is really interested and they want to buy it ASAP! "

He's been emailing me from:
[email protected]

Posted: Wed Nov 16, 2011 10:51 pm

Naw, I don't want to bait CL scammers -- I just wanna kill his domain. Laughing

Anyways, it really isn't a good idea to connect any new character to your current details. Anything that connects back to you in RL is not a good idea and you should really just stop emailing with this scammer/lad now. We advocate complete isolation between our baiting details and our RL details always. It may seem like many of these scammers are idiots (and some may be), but remember, they are all criminals and many have contacts in other countries including the US.

If you really want to keep playing with this scammer, just make a new email account (gmail is the best) with completely fake details and reply to the lad like you just saw his ad. Or that you had seen his ad recently, made a note of his email addy, and just now got around to asking about it. Don't make any mention to your current contact with him.

You might also want to sign up for a mentor -- they are really great and can help with the ins and outs of baiting. Very Happy

Hello I'm New here! Joined: 16 Nov 2011 Posts: 9

OK. Well I just want to know how it goes. Shall I post his details here that I have gathered so far?

OK, I will...

Sean Claxton
"Senior Medic Sgt. 1st Class Sean Claxton"
1520 3rd Street NW
Great Falls MT 59404
United States

Bank Name: Fifth Third Bank
Credit Account Name: William Burleigh III
Account Number: **********
Bank Address: 36700 Ford Rd.Westland, MI 48185,United States of America
Wire RTN Number: *********

Email addresses:
[email protected]
[email protected]
(Registered to:
Daniel Lindley
PO Box 61359
Sunnyvale, CA 94088
(510) 595-2002)

FAX#: 1-(636)212-9624

IPs (when he opens my email):
172.190.1.135
172.129.21.153
Wichita, KS

Images at transactions-world.com hosted at
yimg.com
(Doug Burton)?

Posted: Thu Nov 17, 2011 12:15 am

Not much of the information about the scammer will be real.

scumbait_57 wrote:

Sean Claxton
"Senior Medic Sgt. 1st Class Sean Claxton"
1520 3rd Street NW
Great Falls MT 59404
United States

Address is a pizza place:

http://localdirectory.azcentral.com/great-falls+mt/pizza.zq.html

Quote:

Little Caesars
(406) 770-3181
1520 3rd St Nw, Great Falls, MT 59404

Quote:

Name of potential victim
And banking details

I didn't quote the name and bank details because they are likely a victim's or a mules. Until we know for sure it isn't a victim, it shouldn't be posted up in the open forum.

Quote:

Email addresses:
[email protected]
[email protected]
(Registered to:
Daniel Lindley
PO Box 61359
Sunnyvale, CA 94088
(510) 595-2002)

[email protected] doesn't exist.

That address and phone number of the registrant is for Yahoo's Privacy Registration service -- it isn't the scammer's.

Quote:

FAX#: 1-(636)212-9624

This is a mobile number in Missouri. I can't find any info that it is a VOIP, so it might be a true Verizon mobile number.

Quote:

Number billable as mobile number
Country or destination United States
City or exchange location Maxville, MO
Original network provider* Cellco Partnership Dba Verizon Wireless - Mo

Quote:

IPs (when he opens my email):
172.190.1.135
172.129.21.153
Wichita, KS

Those IPs belong to AOL. They aren't where your lad is. I believe most of AOLs resolve to their proxy IPs (that may not be the correct terminology).

Quote:

Images at transactions-world.com hosted at
yimg.com
(Doug Burton)?

That's Yahoo's standard parked webpage image. Nothing sinister.

So to be honest, except for a possible vic/mule (I don't know I haven't researched more), you got a whole lot of nothing. Just as the scammer wants. Wink

Can you please go back and edit your post with the potential vic details? I will take them over to our sister site, Scamwarners, and have one of the warners check into it and see if it is a possible vic. Thanks! Very Happy