NYGF Possible scammers in PMs: Very low risk alert, but be aware and let us know.

[HEX]

This really isn't a huge deal, but since we've uncovered 3 instances of these so far I feel it's prudent to make members at least aware it's a thing.
Also, I ask any members who see this to alert the staff ASAP so we can quickly rid ourselves of these most noble of Nigerian princes.. heh

This has happened to only 3 people (as far as I know anyway) with WTB threads in the marketplace. Actually, one of the 3 instances was sent to was ME.. which shows you how smart these people are. Usually spammer/scammers don't get through our registration process (there's probably about 5 or more a day that try). Sometimes though there just aren't any immediate red flags; they have a standard NY IP address, etc, and one slips through and we don't know until they PM someone and we're told about it.

Methodology : You receive a PM of someone saying something very much like, "Frank in Chicago has the (fill in whatever the title of the WTB was) that you're looking for". Also included is an email address. That's it.

What would happen if you responded to one of those email addresses I can only make some educated guesses at. Most likely they'd use your address to send you fake scam emails in the hopes that you'll be tricked into disclosing information via phishing, or downloading some malware, or maybe they just start sending you emails about a Prince's ton of diamonds they secretly need shipped and will cut you in on for a small fee. The usual silly and (hopefully to you) obvious foreign scammer stuff.

So, if you receive a PM like that just simply please ignore it and let a staff member know who sent it. When you do this it helps not only our site's people, but potentially people everywhere from being targeted by introducing the data the scammer signs up with to the StopForumSpam database (and others) , so other sites will know to block them outright.

 

[libertysnake]

You could get the MD5 sum of the message body and block by that MD5 sum or something on the backend. That way you never actually read member messages, but can block any message that matches. Would be a little tricky since you'd have to scrape the WTB names and remove them before doing the MD5 of the message body.

Seems kinda heavy handed, but it's an option if it becomes numerous.

 

[Justincase]

^ What he said.

 

[togmaster]

You could get the MD5 sum of the message body and block by that MD5 sum or something on the backend. That way you never actually read member messages, but can block any message that matches. Would be a little tricky since you'd have to scrape the WTB names and remove them before doing the MD5 of the message body.

Seems kinda heavy handed, but it's an option if it becomes numerous.

Translation: Restart your computer.

 

[FLA45fan]

Thanks for the heads up

 

[Karpteach]

I received a PM from someone about an A5 a week ago.

 

[HEX]

I received a PM from someone about an A5 a week ago.

From who ? Details ?

Contrary to what some might believe, and in the interest of transparency, we can't ever see anyone's PMs unless invited to the conversation.

With the exception however of actually delving into the database via access to the server (outside of the forum software completely).. it's complicated , but even then we can't really see context. Like.. we couldn't easily pull up a back and forth conversation, but we could pick out a single response (in a format that isn't optimal) because all the text that someone has access to (such as in your PMs) of course has to be stored somewhere in the database for any person to retrieve it and see it here. That would only be used in the kind of extreme circumstance that we'd seriously need to know something someone said for some very important reason. Using the forum software alone though, we are 100% blocked from seeing any PMs/Conversations that a participant hasn't invited us into.

There do exist plugins for xenforo that allow Owners/Admins to see people's PMs, but we very intentionally do not have that sort of thing because we feel your privacy (even from us) is important.

 

[Saltwater60]

That’s

From who ? Details ?

Contrary to what some might believe, and in the interest of transparency, we can't ever see anyone's PMs unless invited to the conversation.

With the exception however of actually delving into the database via access to the server (outside of the forum software completely).. it's complicated , but even then we can't really see context. Like.. we couldn't easily pull up a back and forth conversation, but we could pick out a single response (in a format that isn't optimal) because all the text that someone has access to (such as in your PMs) of course has to be stored somewhere in the database for any person to retrieve it and see it here. That would only be used in the kind of extreme circumstance that we'd seriously need to know something someone said for some very important reason. Using the forum software alone though, we are 100% blocked from seeing any PMs/Conversations that a participant hasn't invited us into.

There do exist plugins for xenforo that allow Owners/Admins to see people's PMs, but we very intentionally do not have that sort of thing because we feel your privacy (even from us) is important.

that good to know info on the scammers and the privacy aspect. Thanks.

 

[Chicken Shoot]

Got this one tonight ...

I can help you out with a lead. Please contact Eliot on ***@***.*** regarding your request. He is located in Texas, and the last time I talked to him, he had AR upper bull barrel for sale. I purchased items from him in the past and they arrived in TOP condition.

Friggin scammers!!!!

HEX Note: Edited out scammer email address. We don't want that showing publicly

 

[HEX]

Got this one tonight ...
I can help you out with a lead. Please contact Eliot on *** regarding your request. He is located in Texas, and the last time I talked to him, he had AR upper bull barrel for sale. I purchased items from him in the past and they arrived in TOP condition.
Friggin scammers!!!!

Thanks for the heads up. Googling the address that was shown shows that they're showing up on other forums also.

Though the actual threat is low (so long as you don't give them your email address and then get tricked by some phishing scam or into downloading and running any programs they send you), these people are surprisingly insidious.. for scammers anyway.

They sign up with IP addresses that are actual regular home based cable IPs one would expect to see on new members here, and change emails enough to not be caught by spam filters. Presumably they're doing this via computers that they've taken over when scamming people into giving them remote access. They even vary up the message just enough each time to not flag that.

In so many years of doing this, I've never really seen scammers try so hard before.. and admittedly that is a slightly unnerving trend.

 

[Karpteach]

I just got this crap. It’s not showing in my messages.

 

[HEX]

Yeah, got him already (only because he sent me one too) but thanks for the heads up.

 

[libertysnake]

Yeah, got him already (only because he sent me one too) but thanks for the heads up.

The smart thing to do is to block him.

The fun thing to do is to make a bot that endlessly replies to waste their time.

 

[Chevusa]

I gave an Arabian prince who contacted me here my social security and bank account numbers. Was that wrong of me?

 

[HEX]

Hadn't seen one of these in many months now until a confirmed report of one tonight. So, keep an eye out folks.

It's pretty well explained above, but just as an example:
This scammer was user: John39
He'd been a member for about half a month and had started 6 on-topic threads to blend; such as "Best optic for Gen5 g19 mos" and "How to cut a magazine tube spring?"
His IP addresses were a little off, which had me slightly suspicious from the start, but not enough so that I could truly assume or prove any nefarious intent.

He was caught when a member reported a pm from him stating:
"Hi mate. My father told me he wants to sell a used Ruger 10/22 takedown,he lives in Hamilton MT,maybe you should contact him,his email is [Redacted]."
Thankfully the member reporting it was smart enough to recognize it for what it was (and also find evidence of this same person doing it on another gun forum by googling the email).

As I said, this one I already found suspicious and was kind of waiting for it.. but if I prematurely banned everyone I found a little suspicious not a lot of new users would get through..heh

 

[CaseHardened]

"MATE" ??

Well, that's suspicious right off.

Every PM I've ever received began with "YOU MOTHERF#KING AS#HOLE !!"

Those are totally legit.

 

[vago]

Talking about suspicious , any one hear about this company? megafirearmsusa
sell ammo good price , but do not accept credit cards they take cash app zelle or Wester union

 

[thegatman]

I gave an Arabian prince who contacted me here my social security and bank account numbers. Was that wrong of me?

Isn’t it usually a Nigerian prince?

 

[Chevusa]

Isn’t it usually a Nigerian prince?

It was his cousin

 

[Justin232]

I received this message today. Sent an email and the guy sent me pics and a price. Not sure if it’s legit or not.

STAFF EDIT (HEX): Even though it's potentially useful for people to see the message (it's the same deal as described in above posts), I had to remove the image because we don't want to show/advertise the scammer's email address.

 

[Justin232]

 

[Justin232]

I googled the email given to me by the member “dextron” and it was a known scammer on firearm forums nationwide! I suggest you remove “dextron” from this group immediately!

 

[masterswimmer]

I received this message today. Sent an email and the guy sent me pics and a price. Not sure if it’s legit or not. View attachment 102788

If the guy didn't go into the whole accident and broken neck story I might have believed it was a good deal. He actually took the scam to an unbelievability level.

 

[HEX]

I googled the email given to me by the member “dextron” and it was a known scammer on firearm forums nationwide! I suggest you remove “dextron” from this group immediately!

If the guy didn't go into the whole accident and broken neck story I might have believed it was a good deal. He actually took the scam to an unbelievability level.

That is interesting. Now we know what happens when you reply to one of these. Although I certainly would not have recommended it, in a way I kind of do appreciate you volunteering as guinea pig. I did mention above that these scammers using this method (and it's definitely at least one ring of them, rather than a single individual) do try much harder then the standard scammer/spammer, and it would appear that continues into putting work in to not only the pretending to fit in with posts but also putting the work into personalizing the whole deal. Interesting to know.

As I mentioned to @Justin232 in my reply to his report, I was absolutely waiting on this coming from the scammer/user in question. It was off right from his sign up because his IPs were a known VPN but trying to make it look like he was in NY. There is some logic to that certainly.. if I weren't as obsessively observant of these things as I am anyway. As I discussed in a post above, I couldn't ban it immediately though (even if I basically knew) because his posts were normal enough and a real member might do that with a VPN.. genuine enough people do things here that I don't find logical every day.

 

[Tinman]

Thanks for the heads up

 

[vago]

Thanks for the heads up

HI anyone familiar with company only take zelle for payment Cart - Federal Ammunitions

 

[Exonautic]

HI anyone familiar with company only take zelle for payment Cart - Federal Ammunitions

my opinion is if you find someone on the internet with prices too good to be true that only accepts zelle you'd have to be really gullible to think it's legit.

 

[vago]

thanks that's what i thought