Another Scam - Nearly caught out

benc · 07 July 2011, 11:30

As some of you know, I am looking or a SIB... and I found one on gumtree which I was quite interested in:

Honda Honwave TS38 inflatable with Honda BF20SHU Engine Boats, Kayaks & Jet Skis for Sale central london London

All looks good, seemed a bit cheap, but thought it might just be a bargain, so I contacted them... and offered £1,400, they said £1,450.. I agreed... I asked when I could go see/collect.. they said they wanted 50% of the money up front because they've had two time wasters yesterday who were using stolen paypal accounts... I said I understand, but didn't feel confident in transferring £700 without even seeing the boat first. I suggested I would go to a cash machine, and use 3 of my bank accounts to draw £500 from each to pay for it so that he can see the cash is not fake notes.. they said they still want money up front, and to use moneygram to send..

Anyway, it went on a bit like this... and it all seemed a bit fishy. I noticed he was using a microsoft email address (live.com) so I use the option in my email client to show all of the mail headers, and found the relevant one I was looking for:

X-Originating-IP: [178.138.35.204]

Microsoft automatically add this head which contains the IP of the internet connection the person was using to send the email.... so I used some of the tools on the internet to look the IP up, including IP Address Lookup (IPv4 & IPv6). The IP is in romania - the guy has told me he lives in london and owns a construction company... etc etc

Mail transcript is here (read bottom to top)
http://www.bencummins.com/honda/

Burtox · 07 July 2011, 11:41

Blimey well done, checking the IP address is a pretty good idea

The are so many robbing B*sterd out there, if you are at all suspicious do not carry on. I never hand any money over until I have the goods in my hand.

Cheers,

Paul

biffer · 07 July 2011, 12:24

you need to send thhat one to the old bill, ben, you've done there work for them

benc · 07 July 2011, 12:38

Ooo, looks like gumtree are on the ball, I reported it, and they've removed it already

benc · 07 July 2011, 12:52

I think this is it too
Honda Honwave TS38 inflatable with Honda BF20SHU Engine | eBay UK

boristhebold · 07 July 2011, 20:39

Checking ip address very good idea, I do IT Security for a living so I am well impressed.

Courageous · 07 July 2011, 22:51

The old "Bill Ben" Biffer? Sounds like the makings of a good movie there miss Poppins!

benc · 07 July 2011, 22:58

Quote:

Originally Posted by Courageous

The old "Bill Ben" Biffer? Sounds like the makings of a good movie there miss Poppins!

biffer · 08 July 2011, 07:25

A thought. Is there a program that could check where ip addresses are registered

Sent from a remote device

benc · 08 July 2011, 07:37

Quote:

Originally Posted by biffer

A thought. Is there a program that could check where ip addresses are registered

Sent from a remote device

Lots of them, I use the websites though as it's easier, just google "ip lookup"

nathanh1 · 08 July 2011, 11:30

Quote:

Originally Posted by benc

As some of you know, I am looking or a SIB... and I found one on gumtree which I was quite interested in:

Honda Honwave TS38 inflatable with Honda BF20SHU Engine Boats, Kayaks & Jet Skis for Sale central london London

All looks good, seemed a bit cheap, but thought it might just be a bargain, so I contacted them... and offered £1,400, they said £1,450.. I agreed... I asked when I could go see/collect.. they said they wanted 50% of the money up front because they've had two time wasters yesterday who were using stolen paypal accounts... I said I understand, but didn't feel confident in transferring £700 without even seeing the boat first. I suggested I would go to a cash machine, and use 3 of my bank accounts to draw £500 from each to pay for it so that he can see the cash is not fake notes.. they said they still want money up front, and to use moneygram to send..

Anyway, it went on a bit like this... and it all seemed a bit fishy. I noticed he was using a microsoft email address (live.com) so I use the option in my email client to show all of the mail headers, and found the relevant one I was looking for:

X-Originating-IP: [178.138.35.204]

Microsoft automatically add this head which contains the IP of the internet connection the person was using to send the email.... so I used some of the tools on the internet to look the IP up, including IP Address Lookup (IPv4 & IPv6). The IP is in romania - the guy has told me he lives in london and owns a construction company... etc etc

Mail transcript is here (read bottom to top)
http://www.bencummins.com/honda/

I hope you sent a nice email back after you sussed out what a scumbag he was.

willk · 09 July 2011, 09:24

Just read the emails. As is so often the case, the standard of English gives him away as a "non-national" which doesn't sit with his cover story.

jezza2011 · 11 July 2011, 20:01

Arr a IP lookup would not work for my IP.
its via a VPN link and comes back as switzerland. I am in northampton.

I can also jump on other in our company and do all sorts of fun.

But I do work for one of the largest network companys in the world.

By well spotted and what a crafty bugger.!!

benc · 11 July 2011, 20:04

Yes, but why would someone selling a boat, go via a proxy in romania

Switzerland i like the banking capital of the world, I understand people using proxies over there

TIMO · 11 July 2011, 23:03

i have a howave 40 with ally floor and twatsu 40 hoss if youre intrested fella ,, boat 2011,, motor 2006 just serviced

PS im not a scammer

benc · 11 July 2011, 23:49

Too big for me im afraid, thanks though

MeMe · 15 July 2011, 11:09

Quote:

Originally Posted by benc

I think this is it too
Honda Honwave TS38 inflatable with Honda BF20SHU Engine | eBay UK

Yes this is it - I contacted the guy with a view of purchasing this for a pal - he claimed he was Irish and would ship it to the UK FOC and he would still knock £200 off the price but wanted the funds up front - I immediately withdrew.

Well done for searching this bugger out.

stul · 15 July 2011, 11:17

Quote:

Originally Posted by MeMe

Yes this is it - I contacted the guy with a view of purchasing this for a pal - he claimed he was Irish and would ship it to the UK FOC and he would still knock £200 off the price but wanted the funds up front - I immediately withdrew.

Well done for searching this bugger out.

Hi a guy on a firm in Stoke on Trent bought a dog (PUP) on gumtree big scam never turned up.