EvilKyote

Hi Guys,

Due to impending marriage and needing to save fr the future I'm very reluctantly selling my scoob. Has it up for sale for a week or 2 and today got the following e-mail. I replyed answering the questions about the condition of the car but not the one about it's location.

I'm a little dubious that this is a ligit buyer, just wondering what your thoughts are, apart from the fact this person should retake their gcse english


The email:

i will like to purchase this your car and i will like to know
the condition of the car also the bottom price of the car.i will
like to have the pics
best regard..
1. Can you describe the car and its condition?
2. Does it run well?
3. How is the:
Body?
Any Rust?
Paint?
Interior?
Tires?
Engine?
Brakes?
Shocks?
4. Does it have Overdrive or Turbo? Does it work?
5. What special features or options does it have?
6. Why are you selling it?
7. How long have you owned it? ...had it for sale?
8. Is it currently registered and licensed?
9. Where is the car located?
10. How many miles does it have on it? [15K/yr?]
11. What problems have you had with the car?
12. Has it ever been hit or in an accident?
13. What work does it need done on it now?
14. How much are you asking for it? or What's the least you're willing
to take for it?

end of e-mail




Ok, What do you guys reckon?

scoobynutta555

overdrive?

subaru-impreza.org

I'm guessing any sensible potential buyer would ask that sort of question... I know i would if committing thousands to a car

Hope all goes well anyway

EvilKyote

yeah lol, they don't seem to know much about it considering they want to buy it.

Iwan

If it looks at all foreign then it's 99.9999% likely to be a scam. The wording looks dodgy, and it looks like a "standard email" rather than one they just wrote for one car.

The scam is something to do with foreign cheques, which appear to cash then bounce a week or so later and the bank claws the money back from you. By which time the car's long gone.

I'd run a mile.

Floyd

iTrader: (9)

You don't have to give an exact location details at this point and there's no harm in giving him the other answers IMHO.

If he then asks you to export the car to Africa, walk away

F

mrklaw

location could simply mean is it garaged, parked on street etc.

However, the spelling of Tires in the American way is a little dodgy sounding.

EvilKyote

Yeah i'm well aware of those scams and i've told everyone I would only release the car after funds have cleared, that for people in the UK, anyone outside the UK i'll turn away, just wanted opinions as don't want to turn away a legit potential buyer.

Nick

I agree with other posters about the email. First it looks as though it's a mailshot sent to many sellers. Second, tyres in spelt the NA way.

Have you tracked the IP address? If not, post the full emails headers here.

EvilKyote

Hi nick,

Yeah I reckon either dodgy IP or they have ICMP disbaled....

Header:
Received: from webmail-outgoing.us4.outblaze.com [205.158.62.67] by mail1.redstation.co.uk with ESMTP
(SMTPD32-8.11) id A3E446B00EC; Wed, 04 Aug 2004 03:03:16 +0100
Received: from wfilter.us4.outblaze.com (wfilter.us4.outblaze.com [205.158.62.180])
by webmail-outgoing.us4.outblaze.com (Postfix) with QMQP id AA7E9180208E
for <impreza@purewillow.co.uk>; Wed, 4 Aug 2004 02:02:13 +0000 (GMT)
X-OB-Received: from unknown (205.158.62.94)
by wfilter.us4.outblaze.com; 4 Aug 2004 01:59:46 -0000
Received: by ws5-9.us4.outblaze.com (Postfix, from userid 1001)
id DB74414863; Wed, 4 Aug 2004 02:02:10 +0000 (GMT)
Content-Type: text/plain; charset="iso-8859-1"
Content-Disposition: inline
Content-Transfer-Encoding: 7bit
MIME-Version: 1.0
X-Mailer: MIME-tools 5.41 (Entity 5.404)
Received: from [81.199.84.139] by ws5-9.us4.outblaze.com with http for
nicolenice@graffiti.net; Wed, 04 Aug 2004 10:02:10 +0800
From: "nicole nice" <nicolenice@graffiti.net>
To: <christopheroceanic@yahoo.com>
Date: Wed, 04 Aug 2004 10:02:10 +0800
Subject: purchase
X-Originating-Ip: 81.199.84.139
X-Originating-Server: ws5-9.us4.outblaze.com
Message-Id: <20040804020210.DB74414863@ws5-9.us4.outblaze.com>
X-RCPT-TO: <impreza@purewillow.co.uk>
Status: R
X-UIDL: 364946778





Checked the origin and got this.....



Address lookup
lookup failed 81.199.84.139
Could not find a domain name corresponding to this IP address.

Domain Whois record
Don't have a domain name for which to get a record

Network Whois record
Queried whois.ripe.net with "81.199.84.139"...

% This is the RIPE Whois server.
% The objects are in RPSL format.
%
% Rights restricted by copyright.
% See http://www.ripe.net/ripencc/pub-serv...copyright.html

inetnum: 81.199.84.0 - 81.199.87.255
netname: CIDR-COMMUNICATION-01
descr: Internet service provider
country: NG
admin-c: CO240-RIPE
tech-c: CO240-RIPE
status: ASSIGNED PA
notify: lir@ipplanet.net
mnt-by: AS12491-MNT
changed: lir@ipplanet.net 20040315
source: RIPE

person: Chikezie Okwunakwe
address: 21 Mobolaji Bank
address: Anthony Way Ikeja
address: Lagos
address: Nigeria
phone: + 234 4976493
e-mail: chikezieokwunakwe@supernet300.net
nic-hdl: CO240-RIPE
notify: lir@ipplanet.net
changed: lir@ipplanet.net 20030320
source: RIPE



DNS records
DNS query for 139.84.199.81.in-addr.arpa returned an error from the server: NameError

No records to display

Traceroute
Tracing route to 81.199.84.139 [81.199.84.139]...

hop rtt rtt rtt ip address fully qualified domain name
1 0 0 0 216.46.228.229 port-216-3073253-es128.devices.datareturn.com
2 0 0 0 64.29.192.145 port-64-1949841-zzt0prespect.devices.datareturn.com
3 0 0 0 64.29.192.226 daa.g921.ispb.datareturn.com
4 0 0 0 168.215.241.133 hagg-01-ae0-1001.dlfw.twtelecom.net
5 0 0 0 66.192.253.116 core-02-ge-0-3-1-508.dlfw.twtelecom.net
6 0 0 0 66.192.246.53
7 0 0 0 206.223.118.48 ge3-0.cr02.dal01.pccwbtn.net
8 35 35 35 63.216.0.25 pos5-2.cr01.vna01.pccwbtn.net
9 37 37 37 63.216.0.178 ipplanet.pos2-0.cr01.vna01.pccwbtn.net
10 592 577 588 81.199.1.137 1-137.ipplanet.com
11 586 580 590 81.199.1.138 1-138.ipplanet.com
12 * * *
13 * * *
14 * * *
15 * * *

Trace aborted







Yeah looks dodgy, well, be interested to see what they say if they get back to me! bliimin muppets

gregh

ask for a phone number to ring and discuss their questions with them.....

EvilKyote

oh yeah..... BLOODY NIGERIAN FRIGGIN MUPPETS!

Check this....

person: Chikezie Okwunakwe
address: 21 Mobolaji Bank
address: Anthony Way Ikeja
address: Lagos
address: Nigeria

Bet ya pound to a penny even though no difinite trace that e-mail came from nigeria.


Ok, Please choose from the following as to which I should send as a reply should they contact me

a) Go get a job you friggin worthless numpty!!
b) What sort of muppet do you think I am you jobless scamming scumbags?
c) There more chance of Christina Aguialera (SP) becoming a self confessed sheepshagger than me selling my car to a theiving scamming muppet like you! SOD OFF!!!

EvilKyote

Ok I am going to arrange for him to 'come and see my car' at 'my house'

Can someone give me the address for a computer crimes devision please?

BuRR

Say "Hello" to Rodders for me, please?

GaryScoobNCBR

string him along, get him to send you £20 as a release fee...see if he does it

then you have scammed him

EvilKyote

Just received this reply from him



'Payment ;
There is creditor of mine owing me the sum of (35,000pounds) but he had paid me part of the money(22,000pds) .I want to seize this oppurtuionity in retriving the balance .I will inform him in sending you the cashier cheque that belongs to mine on your behalf .I will be hoping in be in assisstance of mine in retriving the money back .I will want you to send me the necesary infomation to send .You will help me to pay the shipper the remaining balance .With your agrement i will want you to get back to me with your;name, address, zip code, telephone number for faster communication thanks for your copration.
Best regsrd..'


Muppet

douglasb

I think your response to that should be, "I'm sorry, but I only speak English. I don't recognise the language you are speaking and Google's translate tool has had no success either. Could you please try again but respond in English."

or

"Google's translate tool has converted your message to "I am an incompetent thief who is so useless that they can't even compose a convincing scam message." Now **** off before I report you to the Police Computer Crimes Unit".

BuRR

http://bbs.scoobynet.co.uk/showthrea...hlight=scammer

Tandy

http://www.geocities.com/scambaiter2003/

Use this site and have some fun with them.

Apple

kilo_4que

Hi mate, have just done an ip Check on the email for you and it traces it to Amsterdam.

Nevertheless, id go with GaryScoobNCBR's idea of back firing the scam on him

Nick

I'm sure I've seen the exact same scam on http://www.419eater.com somewhere. String him along if you have time for some fun! Don't however give your real name, address, phone number or banking details & don't call him. 419eater also have a forum that you may find interesting.

Nick

Amsterdam? It's Nigeria mate!

scoobyboy

how do you do an ip address trace it looks pretty complicated

BedHog

Neotrace is pretty good.

Problem is it's probably an ISP dialup ip (dynamic), so won't really tell you anything except the country. You would need to catch him online then Neotrace would give you a bit more info on location.....

kilo_4que

Hi Nick, id expect something like this from Nigeria but the result come back as follows:

81.199.84.139 (IP Address)

OrgName: RIPE Network Coordination Centre
OrgID: RIPE
Address: Singel 258
Address: 1016 AB
City: Amsterdam
StateProv:
PostalCode:
Country: NL


NetRange: 81.0.0.0 - 81.255.255.255
CIDR: 81.0.0.0/8
NetName: 81-RIPE
NetHandle: NET-81-0-0-0-1
Parent:
NetType: Allocated to RIPE NCC
NameServer: NS-PRI.RIPE.NET
NameServer: NS3.NIC.FR
NameServer: SUNIC.SUNET.SE
NameServer: AUTH62.NS.UU.NET
NameServer: SEC1.APNIC.NET
NameServer: SEC3.APNIC.NET
NameServer: TINNIE.ARIN.NET
Comment: These addresses have been further assigned to users in
Comment: the RIPE NCC region. Contact information can be found in
Comment: the RIPE database at http://www.ripe.net/whois
RegDate:
Updated: 2004-03-16

BedHog

You need to check the RIPE database

Hashi

Singel? I know that place! I went to the Dam a few months ago and the b&b I stayed in was between Singel and Herengracht.

There were at least 4 knocking shops on Singel so I wouldn't be surprised at all if there were internet scammers too.

EvilKyote

Kilo,
RIPE are an organisation that handle and deal with IP allocations to companies and ISP's, RIPE manage the entire 81.* iprange along with many other IP ranges, and the address you got is just for RIPE's coordiation centre.

To find where the e-mail orginated you need to find out what company or ISP was assigned that IP as part of their range by RIPE.

You should be able to get this info:

inetnum: 81.199.84.0 - 81.199.87.255
netname: CIDR-COMMUNICATION-01
descr: Internet service provider
country: NG
admin-c: CO240-RIPE
tech-c: CO240-RIPE
status: ASSIGNED PA
notify: lir@ipplanet.net
mnt-by: AS12491-MNT
changed: lir@ipplanet.net 20040315
source: RIPE

CIDR-COMMUNICATION-01 is the company that the IP address belongs to. 81.199.84.0 - 81.199.87.255 is the entire IP range that that company actually owns.

The registered details for that IP range are:

person: Chikezie Okwunakwe
address: 21 Mobolaji Bank
address: Anthony Way Ikeja
address: Lagos
address: Nigeria
phone: + 234 4976493
e-mail: chikezieokwunakwe@supernet300.net
nic-hdl: CO240-RIPE
notify: lir@ipplanet.net
changed: lir@ipplanet.net 20030320
source: RIPE

So in a way you were technically correct, the IP is managed by RIPE based in amsterdam, but the company that actually own it are a Nigerian ISP.

kilo_4que

AAH now i get it, my bad lol