Joe Perez

iTrader: (8)

As many people have figured out, scammers love to troll people who post in the WTB forum. It's usually some variant of a message which says "Hello, you should contact (name) at (email address), he has (whatever you posted a WTB for) available in good shape."

Well, I'm damned curious to see how one of these scams plays out. I'm assuming it's something along the lines of "I send them money, and they either vanish or ship me some random bullshit object."

So I'm going to start playing along. I already have an email account which I use for this sort of thing. It's an AOL account, no less, (they're free these days) so for anyone who knows some internet history, that should make me look like a gullible rube.



Two days ago, I replied to "Mitch" (now banned and nuked) who had posted in the WTB 1994 airbag module thread. Mitch's email is mitchellsteve071@gmail.com, and the post containing that info came from a user named JackjonaParts004 whose IP address is 102.88.36.29. A quick WhoIs lookup tells me that IP address belongs to Chukwuebuka Ani (phone +234-803-200-0490) who works at the Yello Drome MTN building located at 1612 Adeola Hopewell St, Victoria Island, 06104, in (wait for it...) Lagos, Nigeria.






Here's the conversation so far:
‎
‎
‎
So, what do we think I should do from here? Should I make an offer? Does "Lowa" mean Iowa?

Z_WAAAAAZ

That intro was everything I’d hoped for and more.

A quick search for “Lowa” on Apple Maps would only correct me to Iowa. Switching to google brought up the location of Lowa Boots HQ and some of their retailers, so maybe that’s a clue?





I remember reading somewhere that a lot of these scammers/scambots attempt to sound a little inauthentic to weed out everyone except the absolute most naive from messaging them back. What makes me scratch my head, though, is how they find their way to such a little niche forum somewhat regularly.

technicalninja

Go Joe go...

You could ask if it's been tested.
Does he have a video of the "test"?

You might make an offer in naira (worth 0.0061 USD) or kobo (1/100 of a naira) but that would give the show away.

If you could find out more info on him/her you might be able to pull off "psychic" too.

This could be fun!

sixshooter

iTrader: (12)

You are the best, Joe!

rwyatt365

I've had a couple of these happen to me so I'm all in for the "scammer-baiting"

natewin

Good luck. I tried ******* with an eBay scammer after I sold a RTX3060. After the sale I got 3 or 4 “I need you to send the card to a different address than the one in the auction that I won” from non winners. I decided to play along with one of them saying things like ok I will etc. After a few back and forth I said I had already shipped and they got super aggressive and angry in the messaging. It was kind of funny, but also I don’t need that kind of aggression towards me, so won’t be doing that again. If I was a single guy without a house and family I could see playing that game all day long though.

maplewood

iTrader: (2)

How are you going from IP to specific person? In my experience, that's usually not possible...

I'm all for toying with them, surprised they'd use a Nigerian IP. In the ecommerce fraud world, they use a proxy from the correct country. The better fraudsters use an IP within 100 miles or so of the cardholders last known address. I guess the forum scammers assume there's little oversight on the forum admin side, so no need for "good" IPs.
​​
I helped once with FB fraud, a vendor semi-related to the Miata world got scammed. Couldn't get his money back, but it was interesting seeing all the messages between them. The scammers went so far as to send tracking numbers, from a nonstandard (fake) shipping company. The tracking numbers "worked" and showed a delay at the port or w/e. The sites had legitimate sounding domain names, about us pages, etcetc. The content of course is the same on all their scam shipping sites, so it was trivial to find related fake ones. Shockingly, an email to their registrar/host, NameCheap, actually resulted in action and they were all shut down within a day. Probably only cost them $50 and half an hour of work though.

Joe Perez

iTrader: (8)

By looking at the domain registration. Sometimes the listed registrant is some big company which specializes in anonymizing domain registration. Other times it reveals the name, address and phone number of an individual person.


Anyway, making some progress:

‎‎
‎
What do you guys think? Is $96 a good price, or do I haggle?

technicalninja

Just swap the numbers.
And include shipping.

"$69 shipped sounds great!"

TurboTim

iTrader: (9)

Go with $90 shipped.

rwyatt365

I say split the difference and knock off some for the shipping. Then ask them where they are shipping from so that you can "Check around for a better shipping cost". Keep them on the line for as long as possible. Waste their time...

Joe Perez

iTrader: (8)

Ok, I've got him on the hook.Not really sure what "once you're ready for it" means, but I think we're making progress.

Big question now is, do I give him 1060 W. Addison St. as my ship-to address? Like, do we think he's likely to actually check on that?

TurboTim

iTrader: (9)

He may check on it (like I had to), and that's ok.

turbofan

iTrader: (1)

Is there some significance to the 1060 w. addison st address?

Crarrs

iTrader: (3)

It's Wrigley Field in Chicago, and also the fake address The Blues Brothers gave the cops in the movie when they got pulled over.

turbofan

iTrader: (1)

Thanks. Not a sports fan and... not old enough

Z_WAAAAAZ

Didn't think I was going to get to see a Blues Brothers reference today. Great going.

I should be too young to get the reference as well but that was my pop's favorite movie when I was a kid lol.

sixshooter

iTrader: (12)

I chuckled at 1060 W. Addison. Big Blues Brothers fan here. If he balks at the address, say it's your work address.

Joe Perez

iTrader: (8)

HAH!

I'd never heard of Redfin before, but that doesn't give me much faith in it. Pretty sure there has never been any condo in that location.


But yeah, I was a big fan of The Blues Brothers as a youngster. To the point where I actually went to the Post Office and asked them what the ZIP code was for that address, so that I could properly lie to the guy at Radio Shack when he asked for my address, which in the 80s was something they did for every single purchase you made there.

I have no idea how many Radio Shack flyers and catalogs the Cubs received over the years...



Anyway:
‎

Joe Perez

iTrader: (8)

Man, this guy responds fast. Like, within a minute. I suspect we're dealing with someone who does this scam as a regular 9-5 type job working for an employer, rather than just some random independent scammer.


‎I was honestly expecting him to direct me to some other form of payment. But, and this is the clever part, he's gone along with my PayPal lead, but specified the "family and friends" option. Transactions made under that option are specifically excluded from PayPal's Purchase Protection Program according to their terms of service.

So.... I want to keep leading this guy along in a plausible-seeming manner, but of course I'm not going to actually send him any money. I mean, I'd be ok sending him like 5 cents, if we can figure out how to make that seem like a technical issue rather than a mistake on my part. Though of course I'd need to do it in a way that he doesn't learn my legit email address / phone / etc., and I really don't feel like linking a bank account to this disposable address which I use solely for scammy / spammy sorts of things.

Maybe I tell him that I'm fine if shipping is delayed a bit, since this is a project car that I don't need to drive immediately anyway?

I'm open to suggestions here.


I was initially curious about the lacenrosalinda address. I'm not getting any hits at all for lacenrosalinda or lacenrosalinda66, however I'm getting some results for "rosalinda lacen." One of them is a cashier at CVS in da Bronx, one works at a daycare in Meriden, Connecticut, one of them designs patterns for knit crafts and shares them on Pinterest, all pretty boring stuff.