A warning about "Dater Baiting" ?

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Posted: Fri Apr 15, 2016 8:04 pm

I joined Match.com about a 7 weeks ago. In the last 3 weeks I have got a few of these... They always start with a single word match email... "hi"

Quote:

Hi, thanks for the message. whats your name?I did try sending a chat request but it didn't work,If you care to chat more , then you should probably write to my email as my membership will expire in a bit and would love to stay in contact to see what could happen..reach on xxxxxxx at g mail dot com i will be looking forward to your message xxxxxx

They get your gmail, and within a day you will get an unsolicited Phishing email leading to a fake and convincing Match sign in page.

So... I burned a few of their "sites" in the last two weeks. Today I get a message that smells the same, but this time she "wants to meet" (or "meat" actually)
Hmmm.. This is not a burner match account. That's my warning !

PS: If anyone want's to see it play out,PM and I will send you the latest gmail accounts

Posted: Fri Apr 15, 2016 10:50 pm

Interesting. I have not seen that particular modality/phish before.

Posted: Fri Apr 15, 2016 11:29 pm

Phish part looks like this...

********
Hi Again,

Remember me?I know it's been a while. We met on match a week ago. I was suppose to write to your email but i have been a little bit busy with work . But been able to get my work done so i am free for now and will be able to talk more. that is if you still want to. Just in case you are not sure of who i am. You can check my match profile . Just click on the link to my profile below and it will be redirected to my profile if you are signed in.I will be looking forward to your reply..

<<Link Removed>>-bware419ers
My Bad - Imagine a convincing looking link, but if you hover on it, looks more like the confirmed phish URL below
********

"Interesting" - I never know what to take as sarcasm here Smile

But.. Their profiles are smarter than average...
- More than one photo
- Reasonable grammar
- Interests fields filled
- Located in small town just outside of your area
- They are using a "paid" account to start the process
- They go light on the winking and liking - if any

Posted: Sat Apr 16, 2016 1:01 am

Quote:

I joined Match.scam a while back

+

Quote:

I’m not sure what to take as sarcasm here

Firstly: Calling a dating site a scam only because they might have scammers there is completely wrong - there is no dating site around entirely clean, paid or not. While trying to tarnish the reputation of a dating site, you might need more than a mass mail message using that site as proof.

Secondly: Most of the paid dating sites are offering free promotional activation from time to time - targeting potential clients that will pay for keeping that account after the free activation expires. In plain English - sending a message to another user on a paid dating site does not mean necessarily the sender is using a paid account.

Quote:

Just click on the link to my profile below and it will be redirected to my profile if you are signed in.

This part can be a recruiting attempt - and yes, most of the paid dating sites active online are using mass mail messages supposedly sent by their users to get "clients" willing to pay for a subscription.

Quote:

I did try sending a chat request but it didn't work,If you care to chat more , then you should probably write to my email as my membership will expire in a bit and would love to stay in contact to see what could happen

This part looks like an obvious scam message - while that link might not work, he can always claim his profile is no longer viewable for different reasons:

- He is keeping it private because of previous harassment cases
- He is not paying for the subscription anymore
- You cannot see the profile because you are not registered on the site - or if you are registered there is another technical reason you cannot see it.

Reasonable grammar:

Quote:

I was suppose to write to your email but i have been a little bit busy with work .

The self-presentation on the site is more likely copy-pasted.

Quote:

you will get an unsolicited Phishing email leading to a fake and convincing Match sign in page.
So... I burned a few of their "sites" in the last two weeks.

Harvesting websites the scammers are using for impersonating a dating site is a danger for any potential victim and I would really appreciate if we can have some clear examples of the ones you burned in the last two weeks.

Posted: Sat Apr 16, 2016 1:16 am

I have removed the link to the match.com profile above.

Per our "Guidelines" linked at the top of the page:

Quote:

Do not post email addresses, profile links, or phone numbers without sourcing them to a scam mail, fake site, or other verifiable evidence of scamming. The potential for abuse of non-scammers is too great. We're not saying that you would point other baiters towards an ex-significant whatever, cheating spouse, or that neighbor who never returned your power tools. We are saying that in the past, others have. Moderators reserve the right to remove un-sourced phone numbers, links, or email addresses, or just delete that particular post entirely (they're like your credit card company, lots of reserved rights).

Posted: Sat Apr 16, 2016 3:54 am

Below is from an older article, but it does give some sense of what we are up against as online daters, using legitimate sites like Match.

“The most recent attack used a single compromised website to host hundreds of fraudulent PHP scripts, most of which were designed to steal usernames and passwords from users of the most popular dating sites,” explained Netcraft.

http://www.itproportal.com/2014/06/19/massive-phishing-attack-instigated-against-online-dating-sites/

In response to some well deserved PM slaps, I would like to clarify...

"Burned" - sorry my word, and perhaps out of context in this forum.

It's important to point out that these are not "sites", they are simply small
HTML files, with some simple script, typically buried deep in legitimate websites. Most often thru a common and old "vulnerability" https://webmasters.googleblog.com/2009/01/open-redirect-urls-is-your-site-being.html
NOT the same as say shutting down a fake bank site, with it's own domain name.

What I am talking about is much simpler, in that there is immediate and obvious proof that this "site" doesn't belong. I have been reporting to Netcraft and Google for years, and I have seen stuff dissolve in a matter of hours. My goal is to get browser warnings "unsafe site ahead" as global as possible, as fast as possible. So.. From a "six degrees of separation" perspective, if you report a phish to 6 authorities in your area... And their feeds start to cross and confirm... The sites are effectively "burned"

Match - (or the real owner of the sign in) - Is the first to report it to
Google - https://www.google.com/safebrowsing/report_phish/
Netcraft - http://toolbar.netcraft.com/report_url
USG - https://www.us-cert.gov/report-phishing
X - Pick one that specializes in
Y - Pick one in your area

I would caution... Reporting it to the legitimate domain's Webmaster falls into the "mule contact" area of risk.
Google is anonymous and safer.

Netcraft Koolaid... http://www.netcraft.com/anti-phishing/phishing-site-takedown/

Quote:

Netcraft’s phishing site feed is consistently recognized in third party reviews as the most effective blocking mechanism for protecting customers against phishing, and is licensed by leading browsers, anti-virus and content filtering products, firewall and network appliance vendors, mail providers, registrars, hosting companies and ISPs.

Consequently, once the phishing site has been accepted into the feed, access to the site will be blocked for hundreds of millions of people shortly afterwards, significantly reducing the effectiveness of the phishing site even before it has been removed.

Within an hour of submitting one of the previously mentioned Phish to Netcraft, I received this... NOTE the domain is legitimate

Quote:

The URL you recently submitted has been accepted as a phishing site by
Netcraft.

URL:
http://www.fashion-kortingscodes.nl/wp-includes/akkaniologbe/mapsdic.html

As of 1st April 2016, the Netcraft Toolbar community has blocked over
6 million phishing attacks. To provide an incentive for the community
to continue sending us reports of phishing sites, Netcraft currently
sends reporters the following goodies:

?

Posted: Sun Apr 17, 2016 3:53 am

A typical letter from their "catch" gmail to confuse you for a week until the unconnected phish arrives.
This gmail can link to their Match account, so you won't see a the phish from it.

So far this is the 4th almost identical letter from different "profiles" - some of which have been active/hijacked? for more than a typical three day trial run.

Quote:

From: XXX
Sent: Saturday, April 16, 2016 2:23 PM
To: YYY
Subject: A little about me!

Hello YYY.You sounded Interesting in your profile, and u also look good.Anyway let me tell you about myself, I'm 52 and live in Grande Prairie Alberta ,I was born and raised in Germany.was married.been a widow for 8 years He was a nice man i guess this is how it was meant to be. It caused me so much pain that i didn't know how to love any other man because i am scared of loosing anyone again.Don't know if that makes any sense to you..have no kids .My Dislikes are Lies,Cheat,dishonestly,Games,My Likes are Good Heart,God Fearing,Fun person,Loving and Caring,someone i can talk to,my soul mate and more from him.I don't want something in my life and it is separation of a good family later ..My hobbies are swimming,Reading,Partying and I love to cook,I like sea foods but would eat anything good..Lol .My Colors are White,Red,Brown and Blue. I definitely don't play games nor like people that do. I know giving oneself to another person is a risk, that can lead to a broken heart,but I believe it is better to love (to take the risk of heartache) than to be alone (because we don't want to take the risk of heartache). ..I'm easy to get along with...I've been told that i'm a classy girl with a great smile.I'm an optimistic person who has a variety of interests.I'm a down to earth lady who consider herself,honest,romantic,caring with a big heart,intelligent,ambitious,self-motivated,secure,expressive,passionate,good Christian with a good sense of humor. .lol. I'm open minded and fun loving.I do not want someone who play games and that would break my heart..I am looking for a man who finds deep care and humble commitment in his heart and thrives to excellence in service for woman and that i can spend the rest of my life with a man that has a winning personality and clean straight forward character: always with a smile on His face and a warm open inviting heart! A man who can and will support his woman in all walks of life..To be there on my side in good- and bad times!! A proposition to make a life....A great life, but also with exhaustive love-energy and love-commitment to invest.. A man that will attend to are female role with deep cultural understanding..I forgot to include in my profile that i am away from right now on a business trip which will be over in a week.and will be back.But i guess it gives us time to get to know each other through messages first .I am into Gemstones(My Job)... I have been doing business in UK, USA, Canada and Australia for over 27 years. My business has been booming flourishing. My dad worked in Holland before I lost him. I am originated from Germany like i said before and spend most of my adult life in Canada.. I hope to learn more about you soon.Take the time to write me and tell me more about yourself, and about all you have been through in life also what you are looking for..I hope you'll write back soon.i am trying to take my profile off the site. i believe it be worth it.i liked what u said in your message, and u seem to be the type of man i would love to know. so lets see what happens.

Now... and correct me if I am wrong, but no woman in her right mind would spew something out like that, so a "guy" is probably going to think hard about responding.

Posted: Sun Apr 17, 2016 8:29 am

Hi and welcome to the Love Shack, Wealthy Fool Cool

Please read the stickies and sign up for a mentor if you consider baiting as an option for you. Please bait safe any time, don't use your real life information. You have chosen to go gold from the very beginning? That is great Cool

Happy baiting

Posted: Sun Apr 17, 2016 9:46 am

Mountain Goat wrote:

Hi and welcome to the Love Shack

Thanks !
"Love Shack" - Is there a B52 reference ?
As in the song's line "Sign says (woo) Stay away, fools"
Or.. more of a 60's carpet bombing thing ? Either/both works for me.
Everything in here has such amusing semi-demented layers, and now I am expecting to find a video with a lad singing Love Shack ?

Posted: Sun Apr 17, 2016 12:41 pm

I'm not really sure where this thread is headed. We don't deal with phishing sites at 419Eater.

A warning about "Dater Baiting" ?	View next topic View previous topic