WARNING!!! Car Sales Scam

[groops]

Hey guys.

As some of you are aware, I'm selling my car..and funnily enough have made an ad on Carsales.com.au Now before you close this for advertising, I'm not going to link either my ad or the thread that my car is advertised in, I'm really only going to share information I've found through this person trying to get my Carsales login details. Who knows why, but they did.

I recieved an email informing me that this guy was interested in looking at my car, but lived near woolongong so wanted to negotiate via email suggesting that he'd tried to call my mobile and even gave me a mobile number for contacting him. The email that was sent to me was from davewalton47@yahoo.com and the mobile given to me was 0419219525. I responded to his email suggesting that he call me and that he should come and have a look at the car. I apparently recieved an email from him later that evening with the following message:

*start email*
Hi again,

I'm very interested to buy your car. But first of all i need to know if the car is that one in the link. Just please confirm me that, because i have contacted another seller, and i want to be sure that this is your car. Please confirm me that, and after that i will call you so we can arrange all the details and i can come and pick up the car.


http://www.carsales.com.au/used-cars/private/details.aspx?sid=117D360A9E1D&Cr=2&__Ns=pCar_Priva teSpecialFlag_Int32|1||pCar_ImageCount_Int32|1||pC ar_LastModifiedDate_DateTime|1&State=All%20States& distance=25&silo=1003


Thank you for your understanding and i will wait your answer.

Dave
*end email*

That link now doesn't work cause the source isn't linked here but the underlying URL was:

http://carsalesview.fromru.su/carsal...s_content.html

This link does still work (at this stage). It's asking for you to put your username and password in. What's funny is you can put anything you want in either the user and password....I typed test and test...then something not so nice in both. LOL. NOTE!!! DO NOT PUT YOUR OWN DETAILS IN HERE!!!! If you mouse over the 'Login' button you will see the URL in the bottom bar is not something logical...it is:

http://www.datacomm.ch/cgi/mailer.pl

If you put this in the address bar you will get a page showing the following:

**************************
Stray's General Purpose Form Mailer

Error: Hidden fields not supplied.

Values submitted were:
Error URL:
Thanks URL:
**************************

Of course, being a techo, I've gone and had a look at the source file which is too long for me to post here(however you can look at it by going to the view menu and clicking source***press Alt with IE7 to get menus***)...but the crux of it is that from what I can find in the email that it is sending it to is:

yesilcar99@hotmail.com

Anyways..just thought I'd bring this to light so you folks get any scams.

Mike - 1
Scammers - 0

:

[DoreSlamR]

I just put in a couple of expletives and it took me here

[groops]

Yep....that's exactly where it took me...

Mike

[groops]

http://cgi.ebay.com/ebaymotors/2007-FORD-MUSTANG-GT-10K-MILES-EXC-COND-NO-RESERVE_W0QQitemZ120190993011QQcmdZViewItem?hash=i tem120190993011">

Just found this in the source file too...probably an ebay scam too

Mike

[dom_105]

The old Myspace trick.

Bloody pricks.

[partie]

wow, very impressed

[Yellow_Festiva]

I have busted a hand full of scammers, when advertising things, both physical and otherwise.

You are easily able to trace the rough origin of an email by viewing the source or "full header"... the old hotmail was able to do it easily, the new hotmail, I can't seem to work out how to show full headers.

So I just use an account that shows full headers... I advertised some spare rooms for rent in my place, it's amazing how many people told me they were from the UK or Sydney, and I traced them to South Africa etc....

[Bobman]

Thanks mate.

Bloody scamming morons.

[woodsy109]

Originally Posted by Yellow_Festiva

I have busted a hand full of scammers, when advertising things, both physical and otherwise.

You are easily able to trace the rough origin of an email by viewing the source or "full header"... the old hotmail was able to do it easily, the new hotmail, I can't seem to work out how to show full headers.

So I just use an account that shows full headers... I advertised some spare rooms for rent in my place, it's amazing how many people told me they were from the UK or Sydney, and I traced them to South Africa etc....

Really? What possibly could they have to gain by replying to a rental ad?

[Yellow_Festiva]

Originally Posted by woodsy109

Really? What possibly could they have to gain by replying to a rental ad?

Ok, here is the last email....

Hello,

I do hope you are alright. Thanks for the prompt response to my mail.The room is
perfect for me and the price is okay with me.

I would make a month deposit of $440 Inclusive all bills,thus will update our
account officer to issue payment.

More about myself.I'm 37 years old Female.Born in Britain.Like going to beaches and
swim and hang out with my friends.

But in the meantime i need you to provide me with your payment details because as
soon as my company approves the payment a cheque would be issued out in your favour:

1. Full name to be written on cheque

2. Your full postal address

3. Your contact telephone number (Home & Mobile)

Thanks and hope to hear from you soon.

Best Regards

This is a toned down version. This girl "Dennsie Greene" will then reply saying that her boss now needs "my bank account number, as well as branch, as well as my DOB etc etc etc" as their company cannot issue a cheque, so they will just pay me directly into my account.

Do you see what is happening?? They try to be subtle, and pretend to be honest. I must admit, this person was good, as they actually asked a few questions about the room, as well as the area. I have got messages from people saying the same thing, (wanting to know payment info etc) in their first msg to me WITHOUT even asking 1 question about my place, the artea or even the price.. questions one would naturally ask when wanting to move into a house I would imagine.

But this is what ensures that "Dennsie Greene" is a BS atrist. She tells me she is in Scotland in the first email, yet a simple trace of the origin of her email (a free online service available to all mind you) reveals this:

Email sender location back-tracer

The last step shows the origin of the email.

Step IP address Continent Country Flag Region City Time zone
1 203.188.202.146 ASIA TAIWAN, PROVINCE OF CHINA T'AI-PEI GMT+8
2 202.43.196.224 ASIA TAIWAN, PROVINCE OF CHINA T'AI-PEI GMT+8
3 216.252.122.218 NORTH AMERICA UNITED STATES CALIFORNIA SUNNYVALE PST
4 69.147.65.152 NORTH AMERICA UNITED STATES CALIFORNIA SUNNYVALE PST
5 196.211.116.2 AFRICA SOUTH AFRICA JOHANNESBURG GMT+2

[fpr_esp]

why the hell would someone hack into car sales website to sell a car, i clicked the first link and it was for a mini van some dude gus from scoresby in vic anyone tried ringing gus and ask him.

i get emails like this all the time strangest one was from some gorgous 26 year old complete with a pic from russia who rekons she got my addy off adult match maker. problem is ive never signed up to adult match maker she wanted to start a online relationship then move to australia for an intimate relationship.

anyways after talking to a mate at work about it he said do not reply its a scam they ask for money and personal details and then go on shopping sprees in your name hehe.

[DoreSlamR]

Originally Posted by fpr_esp

why the hell would someone hack into car sales website to sell a car, i clicked the first link and it was for a mini van some dude gus from scoresby in vic anyone tried ringing gus and ask him.

i get emails like this all the time strangest one was from some gorgous 26 year old complete with a pic from russia who rekons she got my addy off adult match maker. problem is ive never signed up to adult match maker she wanted to start a online relationship then move to australia for an intimate relationship.

anyways after talking to a mate at work about it he said do not reply its a scam they ask for money and personal details and then go on shopping sprees in your name hehe.

She said she was only interested in me! :

[XW 393]

Originally Posted by DoreSlamR

She said she was only interested in me! :

Me too !!

[burnz]

neo ip tracer work's well

[AusM]

:

Originally Posted by groops

I recieved an email informing me that this guy ...

Hope you've forwarded it all on to Carsales so they can block him?

That datacomm link would just be someone's poorly written mailing script being used for bad. Datacomm should be notified of that one...

Same sort of system used in those phishing bank login emails. Best policy is to avoid clicking links in html mail and just typing in what you need...

[dave351cid]

story on front page of yesterdays local paper.

gladstone familly bought a car ( without seeing it ) from sydney through evilbay ,paid $9300 for it and waited for it to turn up on a truck. when it was late they rang the number and the lady answered saying she was now in london and the truck with the car on it was broken down in darwin (must have been taking the senic route from sydney to gladstone ) and that they would need to send another $5000 to fix the truck so that they could get the car.
and they had paid using western union so evilbay would not help them..


.............. FOOLS AND THEIR MONEY ARE EASILY PARTED.......

[TwistedEL]

I take it you paid carsales using your credit card and then maybe your credit card details are visible once you log in?

[AusM]

Card details shouldn't be visible, except for maybe the first few and last digits? But I would expect that address and phone number would be there... ie if you're hacked, then they know where you live, can ring to see when you're at home and steal your car?

Unless they just use your login info to sell a stolen car to someone else?