Scammer on Facebook

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Posted: Fri Feb 28, 2014 12:28 am

This guy claims to be a U.S. Citizen living in Qatar who knows his way around Nigeria to get your money. Got him to send an EMail and it traces back to Lagos, Nigeria. Having his FB profile closed will only achieve losing track of him. Any ideas?

https://www.facebook.com/john.watson.18294?fref=ts

Posted: Fri Feb 28, 2014 12:49 am

Send him an email from a fake baiting account & bait as usual.

Posted: Fri Feb 28, 2014 4:08 am

This guy has gone to some work. His Facebook page is almost believable. Look closely at it and you can see it is a facade. None of his photo posts have more than two comments and they are mostly not even involved with the post. Only the python has comments and they seem canned.

Posted: Fri Feb 28, 2014 4:50 pm

@Chuck U Farley : Right. More elaborated profile than the typical scammer on FB. The English in FB and Email texts is pretty good too. This lad is one step above and that makes him more dangerous.

Posted: Fri Feb 28, 2014 4:56 pm

And he insists that instead of Facebook or EMail we communicate via Yahoo or Skype live chat for better "visual contact". I will find out what he shows in the cam at his end.

Posted: Sat Mar 01, 2014 3:20 am

Hi, new to this Forum but I would like to share a similar Facebook incident here. This person seems to target aviation groups.

https://www.facebook.com/fabio.delgado.31924

I have done a screenshot of his post but couldn't figure out how to attach it here.

His email: [email protected]

Thanks

Posted: Sat Mar 01, 2014 7:34 pm

@blackbean : I will take a look at this scammer who likes "wings".

Here is another one who poses as an innocent chick looking for love. Photos are of a model from a porn site.

https://www.facebook.com/princess.johnny.37?fref=ts

Posted: Sat Mar 01, 2014 7:43 pm

@blackbean: Your lad is definitely into pilots and aviation sites.

Uses hispanic name Fabio Delgado, apparently not knowing Fabio is a masculine name, 'cause the profile photo is of a woman.

Requested friendship. Will keep you posted on what comes up.

Posted: Sun Mar 02, 2014 8:38 am

Joaquin, thanks for picking up on this lead. I will "case study" your work on this lead and hopefully learn a thing or two from you. Very Happy

Edit: I'm slowly learning Wink

. I reverse search the photo of "Fabio"
in Google Images and found the real name of the lady in the picture

http://www.women-equity.org/ce-que-nous-proposons/entrepreneuriat-feminin/article/presentation-d-isore-batiment-dans-le-cadre-du-women-equity-50_297

Posted: Sun Mar 02, 2014 10:02 pm

@blackbean: No reply to my FB friendship request. But then again we all know that Nigerian internet cafes are closed on weekends and scammers can't "work". Good work tracing Fabio's fake profile picture.

Posted: Mon Mar 03, 2014 4:50 am

@Joaquin, I doubt he will add you. the Lad specifically said contact by email only. He doesn't have any friends in his list.

Looks like someone submitted a "request" to him

https://www.facebook.com/photo.php?fbid=598172826925003&set=gm.601556876599767&type=1&theater

A certain Tariq Nazir Syed. Baiter perhaps? But Mr Tariq's FB looks legit
judging from his friends list.

Posted: Mon Mar 03, 2014 1:14 pm

@Joaquin, I saw he now has 5 friends (0100 GMT). Are you one of them Laughing

(the one with a dog reading a magazine?).
I'm still a greenhorn but if you think i can help, just let me know.

Posted: Mon Mar 03, 2014 5:57 pm

@blackbean : He accepted my FB friend request. And those of two other acquaintances I asked to follow this guy. My profile is the one you mention.

He immediately came back with the "modality" of offering the long term, low interest, no questions asked loan. This is the third lad in one month offering loans on Facebook.

I suggest you send him a FB friend request. He will most likely accept it and make you an offer I'm sure you won't refuse.

Posted: Mon Mar 03, 2014 8:51 pm

@blackbean: Your lad's email traces back to Redmond, Washington, U.S.A. Somehow I expected him (or her) to be in Africa. Maybe someone wants to double check this header.

Quote:

Delivered-To: [email protected]
Received: by 10.170.67.85 with SMTP id j82csp70424ykj;
Mon, 3 Mar 2014 12:37:34 -0800 (PST)
X-Received: by 10.194.59.210 with SMTP id b18mr9926051wjr.60.1393879053651;
Mon, 03 Mar 2014 12:37:33 -0800 (PST)
Return-Path: <[email protected]>
Received: from dub0-omc3-s25.dub0.hotmail.com (dub0-omc3-s25.dub0.hotmail.com. [157.55.2.34])
by mx.google.com with ESMTP id pv1si12206260wjc.65.2014.03.03.12.37.33
for <[email protected]>;
Mon, 03 Mar 2014 12:37:33 -0800 (PST)
Received-SPF: pass (google.com: domain of [email protected] designates 157.55.2.34 as permitted sender) client-ip=157.55.2.34;
Authentication-Results: mx.google.com;
spf=pass (google.com: domain of [email protected] designates 157.55.2.34 as permitted sender) [email protected]
Received: from DUB129-W13 ([157.55.2.7]) by dub0-omc3-s25.dub0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4675);
Mon, 3 Mar 2014 12:37:32 -0800
X-TMN: [kT/+232aKzmtmzIWEi3z2GG16YDozjMW]
X-Originating-Email: [[email protected]]
Message-ID: <[email protected]>
Return-Path: [email protected]
Content-Type: multipart/alternative;
boundary="_83525b01-a1c5-4b45-a8c2-0f853c174c87_"
From: nicole fromentin <[email protected]>
To: joaquin altami <[email protected]>
Subject: =?iso-8859-1?Q?RE:_Necesi?= =?iso-8859-1?Q?to_pr=E8stam?=
=?iso-8859-1?Q?o?=
Date: Mon, 3 Mar 2014 21:37:33 +0100
Importance: Normal
In-Reply-To:
<CAHqOPHZVdiQjP2XZtc6=uBC83G+jjx7KxVgjRXVT6avD9Jn02Q@mail.gmail.com>
References:
<CAHqOPHZVdiQjP2XZtc6=uBC83G+jjx7KxVgjRXVT6avD9Jn02Q@mail.gmail.com>
MIME-Version: 1.0
X-OriginalArrivalTime: 03 Mar 2014 20:37:32.0808 (UTC) FILETIME=[6744D880:01CF3720]

Posted: Tue Mar 04, 2014 9:52 am

IP resolves to Microsoft servers in Redmond because this lad is using Hotmail. It masks the sender IP, just like gmail.

This lad could be anywhere.

Hello I'm New here! Joined: 03 Mar 2014 Posts: 15

Very well done profiles here.
Seems that very smart people are behind these
But right clicking their photos and "search google for this image" will reveal that those photos are taken from somewhere.

I wouldnt go into messing with them.
Its not so simple, could even be an organised crime syndicate behind these
Way too dangerous.

Posted: Tue Mar 04, 2014 10:16 am

WilliamHuang wrote:

I wouldnt go into messing with them.
Its not so simple, could even be an organised crime syndicate behind these
Way too dangerous.

If you're taking adequate precautions to bait safely then this should not be a problem. Some of us regularly bait the East European crime gangs that target classifieds sites with fake car sales and fake job adverts.

The worst that has happened is that this forum, Scamwarners and AA419 got DDOS'd for a few days - it didn't stop us, we intensified our attack on them and carried on killing their websites while the forums were down.

Posted: Tue Mar 04, 2014 6:12 pm

I don't see anything to worry about here, as long as the most basic safe baiting precautions are taken. The profiles in FB are pretty good. John Watson's is more elaborated than Fabio Delgado's.

But once you get them into EMail they use the same old stupid stories and scripts and become totally uncontrolled once you take them off script, which by the way is relatively easy with these lads, because someone actually reads your responses and tries to specifically address your "concerns".

BTW Watson claims to be in Qatar but his mail traces to Lagos. And Fabio claims to be in France, but as blackbean says he could be anywhere.

Posted: Tue Mar 04, 2014 8:22 pm

If you're curious where he really is, send him an email using SpyPig. It works better if you attach an image he has to open (like a fuzzy receipt or something). You'll be able to get his real IP.

And yes, don't worry about a thing. If these lads were capable of tracking their victims online, they wouldn't be wasting their time on FB scams. Basic precautions are good enough.

I used to be super paranoid, but now I even use Yahoo, which doesn't mask IPs. Lads never check, and if they did, the IP resolves to a city half an hour away. They'd need a court order to find my location. Oddly enough, I rather doubt they'd ever get one Wink

Posted: Wed Mar 05, 2014 7:48 am

I have not requested friendship with him in FB yet because I don't have
a fake profile to use Embarassed

. Don't I need a few fake friends to make my
fake profile credible? I don't think I should involve my real friends surely?
Must make up a fake email too. Should I start a whole new email or use
a disposable alias via one of my real email account?

Thanks for the advice.

Posted: Wed Mar 05, 2014 8:21 am

Blackbean,
Just start playing Farmville and you will have more friends than you will know what to do with. None of them will really know who you are.

If this is creates a third party victim situation I will rescind. please ask your mentor in any event.

Posted: Wed Mar 05, 2014 10:24 am

redo wrote:

If you're curious where he really is, send him an email using SpyPig. It works better if you attach an image he has to open (like a fuzzy receipt or something). You'll be able to get his real IP.

I do this myself now. I have my own webserver.

If a lad is using an email that masks his IP, I wait for the point in the bait where he wants me to send him something, a scan of documents, ID or something like that that will make him allow his email to display images.
In the body code of the email I I hide in there a link to a small, invisible image hosted on my webserver.
Lad opens email, accepts images, his PC sends a request for the images from my webserver and hey presto, his IP is logged. Works every time Smile

Chuck U Farley wrote:

Just start playing Farmville and you will have more friends than you will know what to do with. None of them will really know who you are.

Not advisable, this will actually help to bring your lads into contact with ITPs.

Befriend your fellow baiters. There's a few here with fake FB profiles. C.D.XIX...

Posted: Wed Mar 05, 2014 1:38 pm

Basinga wrote:

Lad opens email, accepts images, his PC sends a request for the images from my webserver and hey presto, his IP is logged. Works every time Smile

Have you tried this recently for a Gmail user?

Posted: Wed Mar 05, 2014 2:19 pm

B8er wrote:

Basinga wrote:

Lad opens email, accepts images, his PC sends a request for the images from my webserver and hey presto, his IP is logged. Works every time Smile

Have you tried this recently for a Gmail user?

Haven't baited any gmail lads recently, but if you're saying it wouldn't work, I don't see why it wouldn't. It works fine with hushmail and hotmail.
Afterall, it isn't the webmail provider that fetches the images from my server. HTML in the email body tells the client where to find the image when he opens the email. Most webmails these days will initially block this and ask your permission to show web sourced images, and when you say yes, it's your machine that sends the request to my server for it. And when it does, the IP gets logged on my server.
I haven't bothered to check this myself, but I assume gmail works the same way.

Posted: Wed Mar 05, 2014 2:30 pm

Gmail changed this late last year/early this year. They now cache the image on their server, so all you see is the Googe IP address.

Have a search online and you will see the email marketing industry moaning about being unable to track leads any more.