SmartFeedSmartFeed          

Porsche Hangout


WELCOME - YOU ARE CURRENTLY VIEWING 419EATER AS A GUEST

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

ScamWarners.com - Internet Anti-Fraud Center - now open!


 Warning - Scammers re-using baiters' ID's, docs, etc.

View next topic
View previous topic
 
Post new topicReply to topic
Author Message
William Wankur
Master Baiter


Joined: 24 Oct 2007
Posts: 207
Location: 6�27'11"N 3�23'45"E


PostPosted: Sun Apr 13, 2008 3:33 am Reply with quoteBack to top

I have been informed by some contacts of mine that it appears that scammers are visiting all of the various baiter sites and using posted documents against their victims. Passports, Certificates of Deposit etc appear to be getting re-used.

It seems that the scammers are photoshopping out the FAKE markings that all conscientious baiters put on these sorts of things.

This is just a heads up to everyone to please try to take extra care when obscuring docs to make it as difficult as possible for the mugus to use them.

I have not heard of any specific incidents of anything from here being used, but it's worth being a little careful just in case.

_________________
"I can see that you are from south sudan monkies." - ARITA JACK

"Why are you making me feel stupid?" - Mike Tutu

$5 Million in fake checks and counting!
View user's profileSend private message
sheboppe
The Sparkly Member


Joined: 10 Dec 2004
Posts: 5002
Location: United States


PostPosted: Sun Apr 13, 2008 3:35 am Reply with quoteBack to top

Thanks for passing on the info. Very Happy

_________________
| <a href=http://forum.419eater.com/forum/viewtopic.php?t=135992> Official Eater T-Shirts</a> | <a href=http://forum.419eater.com/forum/viewtopic.php?t=81028> Premium Membership</a> | ScamWarners | <a href=http://forum.419eater.com/forum/viewtopic.php?t=5413> Forum Rules</a> | <a href=http://forum.419eater.com/forum/viewforum.php?f=51> Baiting Tutorials</a> | <a href=http://forum.419eater.com/forum/viewtopic.php?t=118738> Baiting Help</a> | <a href=http://forum.419eater.com/forum/viewtopic.php?t=137846> FAQs</a> |

star pony pony pony Pretty Rose Pretty Rose Mortar x22
View user's profileSend private messageSend e-mail
Ima Baeder
419Eater Admin


Joined: 03 May 2007
Posts: 18314


PostPosted: Sun Apr 13, 2008 3:48 am Reply with quoteBack to top

Thanks William, I'm glad you posted this . . .
but I can't help but think of what I've seen of the lads' photoshop skills and would love to see their handiwork regarding this. Would the ID have a big white "fake" where they tried to take out the red one? Laughing

_________________
348 Fake Sites killed United StatesUnited KingdomUnited NationsMaltaNigeriaGhanaBeninGermanySouth AfricaRussiaTogoMalaysiaEuropean UnionJapanIvory CoastSpainFranceSwitzerlandChinaCanadaItalyThailand

Star Mugu Reseller Mortar Closed lad accounts x 100 Sand Timer 2 Years Pretty Rose Mc Fry Mc Fry Nurse Nastys Audi TT Goat Flying Monkey Easter Egg 2011
View user's profileSend private message
thud419
Baiting Guru


Joined: 04 Jan 2006
Posts: 3193


PostPosted: Sun Apr 13, 2008 8:13 am Reply with quoteBack to top

Some "FAKE" markings are easier to remove than others. It is far easier to remove a red "FAKE" from a green background than a green "FAKE" from the same background. It is trivially easier to remove any sort of "FAKE" on a plain white background.

It is tempting when you write FAKE on a document to do so so it doesn't obscure anything, after all you want everyone to see the document. However that marking is easily removed. The "FAKE" should cover all areas of the document that may be useful to a scammer.

See this aged thread for other ideas. Don't necro it.

_________________
Click here to feel warm and cozy.

I did not f**k your wife in any way -- Nike Akanbi
I don't know what else to do or do I continue filling and filling forms. -- Barr. Koloti
you has been dribbling me up and down but I will show some thing you have never seen before, I think you breath air wait and see. -- Sand Timer Barr. Cole
Cellphone x14
United States x 0.25 won from Reaper in a sucker's bet

Hello Kitty! pony Mortar x8 Closed lad accounts x several
View user's profileSend private messageSend e-mailVisit poster's website
manbiteslion
Baiting Guru


Joined: 12 Dec 2007
Posts: 4816
Location: Connecting my chair and keyboard


PostPosted: Sun Apr 13, 2008 11:08 am Reply with quoteBack to top

Technically another way to make the "Fake" harder to remove is to use rainbow-gradated coloured text (ideally obscuring some text on the page, or leaving it just visible through your rainbow text) - no longer does the photoshopper just need to key out a single colour or hue, instead the task becomes monumental and far easier to start from scratch

Another trick is using highly compressed jpegs - JPEG is a 'lossy' format, so compress until the text is still readable but you see 'compression artefacts' (eg mysterious "mosquitoes" around text), it becomes very hard (near-impossible!) to alter that image cleanly.
View user's profileSend private message
Mr Fishe
Baiting Guru


Joined: 22 Nov 2003
Posts: 2242
Location: PL_Goldrush


PostPosted: Sun Apr 13, 2008 12:36 pm Reply with quoteBack to top

William Wankur wrote:
It seems that the scammers are photoshopping out the FAKE markings that all conscientious baiters put on these sorts of things.

Id be very surprised if scammers are doing this. That is a lot of work for something that can be easily obtained though other methods. It takes less time and effort to knock documents up from scratch, something scammers have been doing successfully for years - who produced all these fake-stamped certificates and passports in the first place?

_________________
Lads love forms!

Magic eye fun: Western Union MoneyGram
Pre-transfer red tape: Department of Homeland Security HM Revenue & Customs
Mandatory customer survey: Western Union


"I have decided to leave the church and join a travelling circus..." - the original and best
View user's profileSend private message
Afferbecklauder
Master of Master Baiters


Joined: 08 Jan 2007
Posts: 923
Location: Wide open spaces


PostPosted: Sun Apr 13, 2008 2:25 pm Reply with quoteBack to top

I tend to agree with Mr Fishe. If the source of this information was a newspaper or magazine, I would go looking for Tigbitties and Gomer.

_________________
DEVIL NA E GO KILL YOU THIEF Williams J Spillboard
I will send a photo copy of your draft to your state security agent with all your information that you are using the money to finance TERRORIST in America that you have received one already, and you also involved in the slept 11 attack.
NA BABA GOD GO PUNISH INA LIVES ANY WHERE INA DEY PLUS
UR BASTARD GOMER COS IN NO BE MISTER ATALL U SILLY
SCOMBERGS U NA DEY CUTT MY JOBS ABI.NO WORRY I NO GO
TELL UNA AGAIN,BUT IF UNA TRY AGAIN UNA NO GO WAKE
FROM SLEEP THE VERY NEXT MORNING I MEAN U WILL BE
MURDERED WITHOUT WARNING THE VERY NEXT MORNING NINFO . Walter Savvidez

pony
View user's profileSend private message
Spear N. Magichelmet
Wannabe Baiter


Joined: 08 Apr 2008
Posts: 86
Location: eating nice puffy rolls full of yeasty goodness


PostPosted: Sun Apr 13, 2008 3:29 pm Reply with quoteBack to top

I also have another suggestion. If you do, for any reason, send a fake ID or some other document that could potentially be used this way, add something to make it patently ridiculous to anyone looking at the document.

In my experience, the scammers don't look closely at the documents and, even if they do, they are unlikely to catch cultural references.

I'm not saying that there aren't some victims that would be snowed anyway, but anything that reduces the odds can't be bad.

Most of us do this sort of thing anyway--having ID for Woody Wankur or Fanny Mingetoucher is more likely to be a red flag to a potential victim. Or having a scanned passport that has an extra typed line at the bottom stating "NOTE: All citizens will be required to dance the Macarena when entering the country" can help.

_________________
we must delay in this as soon as possible - k3vin4 w1ll14ms
I DO NOT LIKE INSULTS AND ABUSIVE LANGUAGES - P4stor B4ll4s W4l4s
View user's profileSend private message
January
Master Baiter


Joined: 23 Jan 2008
Posts: 152


PostPosted: Sun Apr 13, 2008 4:31 pm Reply with quoteBack to top

Spear N. Magichelmet wrote:
Most of us do this sort of thing anyway--having ID for Woody Wankur or Fanny Mingetoucher is more likely to be a red flag to a potential victim.


I think that "most of us" don't even send fake IDs or other documents any scammer might re-use. If the laddie doesn't take a close look at the document, why should the victim do that? I, for example, would not understand the Fanny Mingetoucher-joke, because english is not my first language. So better keep those fake IDs for yourself and send the lad some re-named dlls or use writejunk.

_________________
Safari = Rev T0UR3Y - From Conakry GV to Monrovia LI and environs (960km) - 5imba Liberia Camp - "my friend who is with me sold his shoes and telephone to enable us go back to Monrovia since there is no money left for us" (current status: still in Monrovia, but nothing interesting is happening)

[ <a href="http://forum.419eater.com/forum/viewtopic.php?t=125498">Eater University</a> - <a href="http://formcentre.download.your-mail.com/">Forms</a> - <a href="http://forum.419eater.com/forum/viewtopic.php?t=81028">Premium</a> - <a href=http://forum.419eater.com/forum/viewtopic.php?t=142769>Tools</a>]
View user's profileSend private message
William Wankur
Master Baiter


Joined: 24 Oct 2007
Posts: 207
Location: 6�27'11"N 3�23'45"E


PostPosted: Sun Apr 13, 2008 4:53 pm Reply with quoteBack to top

Afferbecklauder wrote:
If the source of this information was a newspaper or magazine, I would go looking for Tigbitties and Gomer.


These re-touched documents have come directly from scam victims.

Quote:
Most of us do this sort of thing anyway--having ID for Woody Wankur or Fanny Mingetoucher is more likely to be a red flag to a potential victim


I know that this has been discussed ad-nauseum, but cultural and language barriers make this problematic. I bait under many ludicrous names and the scammers never complain because American pop culture is unknown to them and our double entendres don't register. I have plenty of checks made out to Alotta Chexx and Iyamma Frawd that bear this out.
View user's profileSend private message
tada
Gone fishin'


Joined: 28 Mar 2008
Posts: 20


PostPosted: Sun Apr 13, 2008 5:23 pm Reply with quoteBack to top

First of all, thanks to William Wankur for putting this issue up here. As for those of you questioning the source of the information, I am the source. I put the information up on a few anti-fraud sites yesterday, and contacted a few site owners about it. The tough part about it is, this is my first post to eater, so I doubt I'll be considered a reliable source by the members here.

The only convincing thing I can do is give you some of the data, and you can draw your own conclusions about it.

The following three image files are from a single scammer email. I've located the original sources of where the scammer got them and provided links.

http://www.biskitz4cheez.com/scambait1-1.htm
Image

http://419.bittenus.com
Image

http://antifraudintl.org
http://img80.imageshack.us/img80/1060/powerofattorney2vw8.jpg

Mod edit - image changed to link to prevent blowout, 600 pixels maximum width for images - SP

As you can see from this set of headers below, the scammer is sending from his account, back to his account as a way to save the files. The scammer account name has been intentionally changed and I removed the encoded image attachments (they're above).

Quote:

X-DUMP-MBOX: From scammer Wed Dec 26 03:51:49 2007
X-RocketMail: 00000002;R---------------;9909
X-RocketUID: 0000019116
X-RocketRCL: 497459;1;1286137690
X-RocketYMUMID: AFlhxEIAAVMyR3IWJQUzvHM6RFs
X-RocketMIF: 1198659109;506010;
Received: from [80.255.59.243] by web56815.mail.re3.yahoo.com via HTTP; Wed, 26 Dec 2007 03:51:49 EST
Date: Wed, 26 Dec 2007 03:51:49 -0500 (EST)
From: [email protected]
Subject: POWER OF ATTORNEY
To: [email protected]
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="0-978337894-1198659109=:86834"
Content-Transfer-Encoding: 8bit
Content-Length: 497459
X-Folder: Sent
X-DUMP-BEGIN: **********************************************************
X-DUMP-NOTES: The "X-DUMP-*" headers were created during account dumping
X-DUMP-COUNT: Message 189 of 681
X-DUMP-TIMES: 2008.04.09-22:56:31-GMT
X-DUMP-MSGID: 9909_543737_25765_615_370263_0_19116_497459_1286137690
X-DUMP-HDLEN: 615 Bytes In Header
X-DUMP-HDMD5: 16dcd57ab612e593a9c6fb440d4cf27c - Header Perl Digest::MD5
X-DUMP-BDLEN: 497459 Bytes In Body
X-DUMP-BDMD5: 8dd1a4a719e5964fa783a2d1a2877473 - Body Perl Digest::MD5
X-DUMP-DATUM: Body-Content-Encoding: (none)
X-DUMP-DATUM: Body-Content-Transfer-Encoding: (none)
X-DUMP-CEASE: **********************************************************
Status: R
X-Status: NT

rdhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhh

--0-978337894-1198659109=:86834
<encoded files removed>



As far as any of you know, the data above was obtained through perfectly legal means. None the less, all sites where I've post the above have moved the data off to their private sections because they do not want any indication of data from a scammer account being posted publicly. It is an understandable sentiment, and I wouldn't blame the mods/admis here on eater for doing the same. In fact, it's probably a good idea. If I could have posted it to your private section to begin with, I would have.

Everyone agrees there's no way to both prove the point with evidence, and keep things stealthy, so if my first post to eater disappears, I won't take it personally. :-)

In fact, I've PM'd one of your mods to have it moved. If it happens, I won't be able to see it or reply.

Unfortunately, the above is not the only occurance, and not the only account. I'm still trying to figure out quite a few things, in particular how and why the scammers are doing this. There are a handful of possibilities.


  • The scammers are sending the defaced documents to victims (a good thing since it warns the vics)
  • The scammers are attempting to remove the defacements and reuse the fake documents.
  • The scammers are collecting and indexing the defaced fake documents to prevent resusing them, so a victim would be unable to find the defaced version through a search engine.
  • ...


I'm still doing the foresics work, and I may never have a solid answer, but it shouldn't really matter. The point is, you're getting used. It's a known issue, so I'm really just stating the obvious. It's still better to have the defaced documents available to the public in hopes a victim or investigator might find them.

If you do post similar files, please make sure they are significantly defaced to prevent the scammers from reusing them. Using rainbow gradients for your "FAKE" defacement text makes the defacements significantly more difficult to remove. It is also valuable if any important text such as names and similar contained in the images is typed out as in your posts containing the images. The reason for this is search engines cannot read the text within the images, but if you type out the text, then the search engines will find and save it.

For example, the name "GEJERO SIMBARU" in the first image above is what allowed me to find the original source of the image (I'm still in the process of contacting the site owner).

http://www.google.com/search?q=%22GEJERO+SIMBARU%22&num=100&hl=en&filter=0

Typing out the important text and posting it along with the images is important because it enables potential victims who run searches on names to find the fake documents.

Lastly, never post office document files (i.e. MS "Word" or similar) or PDF files. The reason is because no matter what you do to them, it is still very easy for the scammers to remove markings and reuse them. If you get scam documents in these formats, and want to post examples, please use "screen capture" software to get an image file (JPEG), then properly mark and post the image.

And never forget, the scammers are watching.

thanks,
tada
View user's profileSend private message
Rodus
Baiting Guru


Joined: 13 Dec 2006
Posts: 3685
Location: Back under the cold shower


PostPosted: Sun Apr 13, 2008 5:26 pm Reply with quoteBack to top

google image search for passport, ID, driving license. All turn up useable pics and all in seconds. Why would a lad bother chopping an ID when this is so much easier. Lads aren't that stupid.

_________________
I will kiss you romance u,suck and penetrate u - Williams Muyeke
now am as poor as a church rat - Lou1s Mar1on
I AM FINANCIALLY DEAD RIGHT AWAY - Louis in Accra
u can keep sending money to Gomer and leave me alone - Agent Smith cracks up

Pith Helmet Lou1s Mar1on - Lagos to Accra (satellite IP) - "so, what i need to do to get out of these place?"
Sand Timer - 18 mths: Louis

starstar

The*Catb1ngo Hotel*
*My Church*

pony pony pony Nurse Nastys Audi TT Nurse Nastys Audi TT Mortar x23 Closed lad accounts
View user's profileSend private messageSend e-mailYahoo Messenger
tada
Gone fishin'


Joined: 28 Mar 2008
Posts: 20


PostPosted: Sun Apr 13, 2008 6:08 pm Reply with quoteBack to top

I can tell you for certain one of the above images was found by the scammer through a google image search. This is known from the HTTP server logs. None the less, it was saved to his account.

If you have even a wild guess what the scammers purpose might be, I'm more than willing to listen. Though I have more information, your guess is still as good as mine.

-tada
View user's profileSend private message
Mr Fishe
Baiting Guru


Joined: 22 Nov 2003
Posts: 2242
Location: PL_Goldrush


PostPosted: Sun Apr 13, 2008 6:23 pm Reply with quoteBack to top

tada wrote:
The following three image files are from a single scammer email.

Erm, am I missing something here? Your three images all have fake stamps.

_________________
Lads love forms!

Magic eye fun: Western Union MoneyGram
Pre-transfer red tape: Department of Homeland Security HM Revenue & Customs
Mandatory customer survey: Western Union


"I have decided to leave the church and join a travelling circus..." - the original and best
View user's profileSend private message
tada
Gone fishin'


Joined: 28 Mar 2008
Posts: 20


PostPosted: Sun Apr 13, 2008 6:32 pm Reply with quoteBack to top

Yes, you're missing the fact the scammer is saving them into his yahoo account for some unknown reason.

If it was an isolated occurance, I would just think the scammer was an idiot. But considering there are a number of instances, and a number of related scammers doing this, it should make you wonder what's really going on here.

-tada
View user's profileSend private message
SlayerFaith
"Loves her joy stick"


Joined: 03 Mar 2005
Posts: 5778
Location: Vegas, baby!


PostPosted: Sun Apr 13, 2008 6:34 pm Reply with quoteBack to top

For some unknown reason. Confused

_________________
Mugu Reseller Ukraine x2 United Kingdom x24 United States x7 Spain x5 Nigeria x5 Russia x96 South Africa x2 Ivory Coast x2 Netherlands x2 Ghana x2 Australia x2 cameroon x2 Japan x3 Germany Malaysia Canada Benin x3 Malawi France United Arab Emirates United Nations x2 x2 (in a team effort)

ANIMAL,MY FRIEND MY PRAYER IS THIS,LET ALL MY ENEMIES BE IN TROUBLE LIKE CHRIST INGIGE,AND LAZY PEOPLE LIKE YOU BE LIKE WABARA.THANK YOU- Kelechukwu Nduka
"Did he say they have an inflatable pig? That's sick!"- Crash, Vegas 06
"You can be a right Bitch sometimes SF"- Cherrie, GenChat 07

Naked Mod pics!
star
View user's profileSend private message
Rodus
Baiting Guru


Joined: 13 Dec 2006
Posts: 3685
Location: Back under the cold shower


PostPosted: Sun Apr 13, 2008 6:41 pm Reply with quoteBack to top

He's probably just getting ideas for what to send out. IMO you're reading far too much into this.

_________________
I will kiss you romance u,suck and penetrate u - Williams Muyeke
now am as poor as a church rat - Lou1s Mar1on
I AM FINANCIALLY DEAD RIGHT AWAY - Louis in Accra
u can keep sending money to Gomer and leave me alone - Agent Smith cracks up

Pith Helmet Lou1s Mar1on - Lagos to Accra (satellite IP) - "so, what i need to do to get out of these place?"
Sand Timer - 18 mths: Louis

starstar

The*Catb1ngo Hotel*
*My Church*

pony pony pony Nurse Nastys Audi TT Nurse Nastys Audi TT Mortar x23 Closed lad accounts
View user's profileSend private messageSend e-mailYahoo Messenger
Juan Freizwidatt
Forum Admin


Joined: 18 Apr 2004
Posts: 19777
Location: Hanging out at In-n-Out


PostPosted: Sun Apr 13, 2008 6:46 pm Reply with quoteBack to top

If I'm reading this correctly, the only way you would know if the scammer is saving them in his account is if you're in his account.... Just as a reminder, hacking is illegal and NOT condoned here.

_________________
"SATAN WILL KILL YOU . BECAUSE YOU ARE A DAUGHTER OF MERMAID"

"HOW DOES IT SOUND TO YOU THAT ANOTHER PERSON IS DEALING WITH YOU AND ASK YOU TO CONTACT ANOTHER PERSON AND NOW YOU SAID THAT YOU WANT TO DEAL WITH THE OTHER PERSON WITHOUT THE KNOWING OF THE PERSON THAT ASK YOU TO CONTACT THE OTHER PERSON"

"please if you want your funds just pay me,!! pay me!! pay me!!"

Sand Timer x4: Shorty
Safari x 16:
US lad w/Capone: ( Golden Pith ) Black Ribbon
- ATL>DC>ATL>Vegas>Seattle>ATL>San Diego>LA>ATL>Seattle>ATL>WY>ATL>Aspen>ATL (21K+ miles, $11K+ expenses)
Shorty w/bohigal:
- Lagos>Abidjan
Random lads:
- Douala>Korup; Lagos>Cotonou>Parakou; Cotonou>Niger border; Cotonou>Pendjari>jail in Tanguietta; Asaba>Abuja; Accra>Tamale
Purple Flower Goat Jack Boot Whip
View user's profileSend private message
Mr Fishe
Baiting Guru


Joined: 22 Nov 2003
Posts: 2242
Location: PL_Goldrush


PostPosted: Sun Apr 13, 2008 6:59 pm Reply with quoteBack to top

Maybe hes the real Dr Gejero Simbaru of Sierra Leone? Wink

Look at the repository of fake documents on Eater and elsewhere. There are thousands of them. Tens of thousands. Lads have no problem creating them from scratch. Hell, there are markets in Lagos where you can get a birth certificate or banking document created to your specification for pennies, while you wait. Scammers have hundreds of templates at their disposal. They are not photoshopping old documents from baiter sites.

And how did we get to that anyway? It is quite a leap of logic from one lad making a copy of old documents to scammers are visiting all of the various baiter sites and are photoshopping out the FAKE markings that all conscientious baiters put on these sorts of things.

_________________
Lads love forms!

Magic eye fun: Western Union MoneyGram
Pre-transfer red tape: Department of Homeland Security HM Revenue & Customs
Mandatory customer survey: Western Union


"I have decided to leave the church and join a travelling circus..." - the original and best
View user's profileSend private message
Pastor Frank
Moderator


Joined: 31 Jan 2007
Posts: 11521
Location: EN34ix


PostPosted: Sun Apr 13, 2008 7:08 pm Reply with quoteBack to top

tada wrote:
It's still better to have the defaced documents available to the public in hopes a victim or investigator might find them.


What am I missing, This is what have I gathered so far.

1. Lads are searching Anti 419 sites for lad documents and saving them, even if they have been defaced to prevent re-use. (You are not sure why, but it concerns you that they are)

2. We should post defaced documents for public view (Indexed with plain text of thier contents so they are more available to be captured by the Google, and thus easier to find by a Google search) so investigators and possible victims can locate them.

Wont this make it easier for the lads to find and save even more defaced documents, adding to concern #1?

I am not trying to be sarcastic, I really don't understand what you are getting at.

_________________
"Father Juan are sure that you are man of God,because your behaviors showed you as unbeliever" -Mary R
View user's profileSend private messageSend e-mail
tada
Gone fishin'


Joined: 28 Mar 2008
Posts: 20


PostPosted: Sun Apr 13, 2008 7:17 pm Reply with quoteBack to top

SlayerFaith wrote:
For some unknown reason. :?


I admire the skepticism.

I've got one example of a sad photo modification attempt done by this particular scammer, but it is merely to reuse an existing form image (name changes and such), rather than remove defacements.

It doesn't prove there was an attempt to remove defacements, but it does prove some knowledge of image manipulation.

I haven't had the time to fully analyze the modified image yet but I'll get to it eventually in the next week or so. If you're curious about image forensics and detecting modifications, there's a good starter article here:

http://blog.wired.com/27bstroke6/2007/08/researchers-ana.html

I would prefer to not post the example of a modified image, mainly because it further identifies a particular scammer, and I've already provided a good deal of information which could be recognized. I'm not too worried about it, but if you absolutely need to see it for further proof, then send me a PM.

It's not really a matter of one piece of information, instead, it's a bunch of pieces, and how they all fit together.

kind regards,
tada
View user's profileSend private message
SlayerFaith
"Loves her joy stick"


Joined: 03 Mar 2005
Posts: 5778
Location: Vegas, baby!


PostPosted: Sun Apr 13, 2008 7:26 pm Reply with quoteBack to top

tada wrote:
I've got one example of a sad photo modification attempt done by this particular scammer, but it is merely to reuse an existing form image (name changes and such), rather than remove defacements.

Lads do this all the time, usually badly. It is nothing new.

_________________
Mugu Reseller Ukraine x2 United Kingdom x24 United States x7 Spain x5 Nigeria x5 Russia x96 South Africa x2 Ivory Coast x2 Netherlands x2 Ghana x2 Australia x2 cameroon x2 Japan x3 Germany Malaysia Canada Benin x3 Malawi France United Arab Emirates United Nations x2 x2 (in a team effort)

ANIMAL,MY FRIEND MY PRAYER IS THIS,LET ALL MY ENEMIES BE IN TROUBLE LIKE CHRIST INGIGE,AND LAZY PEOPLE LIKE YOU BE LIKE WABARA.THANK YOU- Kelechukwu Nduka
"Did he say they have an inflatable pig? That's sick!"- Crash, Vegas 06
"You can be a right Bitch sometimes SF"- Cherrie, GenChat 07

Naked Mod pics!
star
View user's profileSend private message
tada
Gone fishin'


Joined: 28 Mar 2008
Posts: 20


PostPosted: Sun Apr 13, 2008 7:59 pm Reply with quoteBack to top

Pastor Frank wrote:
tada wrote:
It's still better to have the defaced documents available to the public in hopes a victim or investigator might find them.


What am I missing, This is what have I gathered so far.

1. Lads are searching Anti 419 sites for lad documents and saving them, even if they have been defaced to prevent re-use. (You are not sure why, but it concerns you that they are)

2. We should post defaced documents for public view (Indexed with plain text of thier contents so they are more available to be captured by the Google, and thus easier to find by a Google search) so investigators and possible victims can locate them.

Wont this make it easier for the lads to find and save even more defaced documents, adding to concern #1?

I am not trying to be sarcastic, I really don't understand what you are getting at.


It's a good question and it means I've done a very poor job at being clear.

Scammers have countless ways of getting fake documents. The fact that the scammers grab defaced documents from anti-fraud sites is a well known fact. Every anti-fraud or baiting site I've seen request defacement of images, so there's nothing new here, but often people forget or do a poor job of defacement.

My only real concern is a particular group of scammers doing something very odd with defaced documents. As older members here have pointed out, even when I do finish the forensics, it will still be very difficult, if not impossible, to prove what the scammers are doing.

Think about it this way; If the scammers are trying to index the information to prevent discovery of duplicates, we can burn up the scammers time by making tons of heavily defaced and easily found documents available on the `net.

We cannot prevent the scammers from indexing the defaced documents, or trying to undeface them, but if we can burn up their time, it's a good thing.

-tada
View user's profileSend private message
sheboppe
The Sparkly Member


Joined: 10 Dec 2004
Posts: 5002
Location: United States


PostPosted: Sun Apr 13, 2008 8:10 pm Reply with quoteBack to top

Quote:
In fact, I've PM'd one of your mods to have it moved.


I didn't see the need to move your post. Smile

Fake documents that are posted on Eater are required to be be defaced, and posted in a forum that is behind a login. If a scammer logs on to look for fake documents, we usually peg him pretty quickly.

What I am not getting out of this, is why scammers would look for defaced documents when there are plenty of sources to have any document made that suits the purpose.

Why are posted and defaced fake documents a concern all of a sudden?

_________________
| <a href=http://forum.419eater.com/forum/viewtopic.php?t=135992> Official Eater T-Shirts</a> | <a href=http://forum.419eater.com/forum/viewtopic.php?t=81028> Premium Membership</a> | ScamWarners | <a href=http://forum.419eater.com/forum/viewtopic.php?t=5413> Forum Rules</a> | <a href=http://forum.419eater.com/forum/viewforum.php?f=51> Baiting Tutorials</a> | <a href=http://forum.419eater.com/forum/viewtopic.php?t=118738> Baiting Help</a> | <a href=http://forum.419eater.com/forum/viewtopic.php?t=137846> FAQs</a> |

star pony pony pony Pretty Rose Pretty Rose Mortar x22
View user's profileSend private messageSend e-mail
HeavyWater
Not quite a Newb


Joined: 04 Apr 2008
Posts: 20


PostPosted: Sun Apr 13, 2008 8:35 pm Reply with quoteBack to top

I took that first document that somebody posted, and I was able to remove the FAKE watermarks from it. I didn't use Photoshop or any other advanced program. I used Microsoft Paint.
Image

As you can see, there are still some red things around the writing, but it would be hard to notice unless you were looking for it. I'm not saying that this is what they are doing. It still seems much easier for them to just create a new one. I'm just saying it is possible to do it with readily-available tools. If you want to put FAKE watermarks on something in manner that would deter this sort of "cleaning" of the document, best put them over things like photos or signatures, since a pattern can't easily be established around the watermark, and the lad can't easily overwrite it with something similar to the background.

_________________
I do it for the lolz...

Last edited by HeavyWater on Mon Apr 14, 2008 12:56 am; edited 1 time in total
View user's profileSend private message
Display posts from previous:      
Post new topicReply to topic


 Jump to:   



View next topic
View previous topic
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum



** Find out information about your IP address **


All Content © 2003 - 419Eater.com
Powered by phpBB © 2001, 2002 phpBB Group :S5: FI Theme :: All times are GMT