keter_magick (![[info]](http://l-stat.livejournal.com/img/userinfo.gif){kind=small} keter_magick) wrote,@ 2008-06-16 01:21:00 |
|
If you buy from eBay, watch out for emails of this type:
Hi, Dear keter93,
I am the seller of the Item# 170228005425, New box of Adobe Photoshop CS2(Windows) . I have to congratulate for your winning bid of $219.49. I have included some details about our transaction. Regretfully, I just got an email from Paypal which says that my account has been accessed without my permission. I am unable to receive payments at this time through Paypal, please note that any payments made to my account will be canceled. For your protection, if you have already made the payment through Paypal You will get a refund in 48 hours, We must use a second payment method approved by Paypal only for this transaction (Receipt Number: 2677-2676-2107-5277)! . My current location is Spain (Zaragoza). You have already received my payment address from Paypal, as well will find my information listed below:
FIRST NAME: FIRTAT
MIDDLE NAME: CONSTANTIN
LAST NAME: ALEXANDRU
ADDRESS: MANIFESTACION 16
CITY/ZIP CODE: ZARAGOZA, 50003
COUNTRY: SPAIN
eBay Item Number: 170228005425
Item Title: New box of Adobe Photoshop CS2(Windows)
Winning bid: $219.49 ( International MoneyGram apply additional fees to send a wire transfer, you will deduct them from the total amount and you will send the remaining amount ); The item is being shipped from US, I am out of country because i am architect and my time do not allow me to stay in one place for a long time, i am sorry this is not specified in the add, anyway one of my employees will ship the item to your address. Paypal recently noticed (when the auction closed) one or more attempts to log into my PayPal account and in this way my account has been blocked for our protection.
Payment approved by Paypal only for this transaction: International MoneyGram (Please visit www.MoneyGram.com for more details).
I`ll wait your confirmation with the details of payment as follows:
- REFERENCE# - 8 digit numbers from the payment receipt;
- Your Full Name and Address;
- Confirm the moneygram is sent to my name: Firtat C. Alexandru;
- Exact amount sent in file with moneygram.
I appreciate your prompt reply. If you need any help do not hesitate to reply to this email. Thank you again for your purchase!
And here's the second half of the scam: |
 |
|
|
The seller of item#: 170228005425 ( New box of Adobe Photoshop CS2(Windows) ) is unable to receive payments at this time through Paypal because his acount has been compromissed. Any payment sent to this account will be canceled!
If you already sent the payment, you will get a refund in 48 hours because you have protection from Paypal. Our program to reimburse Users for losses for up to (i) $2,000.00 USD (Top Tier Coverage Amount) for eligible items purchased on eBay and (ii) up to $200.00 USD (Basic Tier Coverage Amount) for all eligible items purchased on eBay.
 | Payment method approved for this transaction: International MoneyGram. Up to $2000 in buyer protection. See eligibility. |
| I am paying for: | |||||||||||
| |||||||||||
| New Payment Instructions for Item#: 170228005425 | |||||||||||||||
| 1. Locate the nearest MoneyGram Office and make the payment with cash; Or Online with your credit card;
If you are not familiarized with the MoneyGram services please visit: www.MoneyGram.com | |||||||||||||||
|
| Shipping & Handling via Other (see description) to 320XX (includes any seller handling fees) | $0.00 USD |
| Shipping Insurance (required): | Included |
 | |
| Total: | $219.49 |
Contact the seller:
| Item Number: | | 170228005425 |
| Contact E-Mail: | | fcamotors4sell@gmail.com |
Seller`s payment address:
| Seller information: | | FIRTAT CONSTANTIN ALEXANDRU MANIFESTACION 16 ZARAGOZA, 50003 SPAIN |
| Address status: | | Confirmed |
|
If you have been unable to resolve your questions with the merchant, PayPal offers a free buyer complaint resolution service that offers a quick, easy resolution to your concerns. It covers physical goods purchases made through PayPal, and is offered at no charge when you register for a free PayPal account.
If you have questions about the shipping and tracking of your purchased item or service, please contact the seller fcamotors4sell@gmail.com.
Thank you for using PayPal!
The PayPal Team
| Please do not reply to this email. Email sent to this address cannot be answered. |
PayPal Email ID PP847
And yeah, I got his ass:
Full header:
Return-Path: <hustonweest.com@pluto.webhero.com>And the WHOIS:
Received: from noehlo.host ([127.0.0.1])
by mx-taint.atl.sa.earthlink.net (EarthLink SMTP Server) with SMTP id 1k81J31Yd3Nl36L0; Sun, 15 Jun 2008 19:33:33 -0400 (EDT)
Received: from pluto.webhero.com ([209.217.33.23])
by mx-taint.atl.sa.earthlink.net (EarthLink SMTP Server) with ESMTP id 1k81J26cF3Nl36L0
for <removed so I don't get a ton of spam]>; Sun, 15 Jun 2008 19:33:32 -0400 (EDT)
Received: from pluto.webhero.com (localhost [127.0.0.1])
by pluto.webhero.com (8.13.8/8.13.8) with ESMTP id m5FNTwme020034
for <removed so I don't get a ton of spam]>; Sun, 15 Jun 2008 18:29:58 -0500
Received: (from hustonweest.com@localhost)
by pluto.webhero.com (8.13.8/8.13.8/Submit) id m5FNTvJJ020028;
Sun, 15 Jun 2008 18:29:57 -0500
Date: Sun, 15 Jun 2008 18:29:57 -0500
Message-Id: <200806152329.m5FNTvJJ020028@pluto.webhero.com>
To: removed so I don't get a ton of spam]
Subject: New Notification of Payment for Item Number: (170228005425)
From: Paypal<services@paypal-us.com>
Reply-To: fcamotors4sell@gmail.com
Content-Type: text/html; charset=iso-8859-1
X-ELNK-Received-Info: spv=0;
X-ELNK-AV: 0
X-ELNK-Info: sbv=0; sbrc=.0; sbf=00; sbw=000;
(Asked whois.catalog.com:43 about hustonweest.com)
Domain: hustonweest.com
Domain: hustonweest.com
Status: ACTIVE
Registrant
Javier lauret llerandi (CTLGDN-510211)
El Monte N: 89
Banugues no 33448
ES
Admin Contact:
Javier lauret llerandi (510213)
El Monte N: 89
Banugues no ES 33448
email: fernandovicedo@yahoo.es
ph: 985881954
Tech Contact:
Javier lauret llerandi (510212)
El Monte N: 89
Banugues no ES 33448
email: fernandovicedo@yahoo.es
ph: 985881954
Created on 19-feb-2008
Updated on 19-feb-2008
Expires on
Domain servers in listed order:
ns1.catalog.com 209.217.1.2
ns2.catalog.com 209.217.50.2
ns3.catalog.com 209.217.16.2
Catalog.com Providing Domains Webhosting Advertising Search
And The Best in Discount Online Shopping
You Can Earn Money With Catalog.com Net Search Today
http://www.catalog.com/
How to do it is pretty straightforward: expand the message headers to see to see where the email came from, then use samspade.org to do a WHOIS lookup. Then send abuse complaints with all of that info attached. At bare minimum, I've cost this guy his gmail and his webhost. If he really is living in Spain, he might not be prosecuted, but at least it will take him some time and effort to scam again.
