New Member here, please help!

[Frozen]

Hello everybody!

First of all I would love to thank the creators of this site for making it!
I have skimmed through the forum and read stories...horrifying stories!
I am currently planning to sell a 900€ Louis Vuitton bag on eBay and I have been contacted by a person from Spain, asking for me to use such an escrow service. This is the first time I am planning to use such a service.
Being a kid of the technology age I know what a fraud and scam site can look like and the one recommended by the person who 'wants' to buy it does in deed look shabby.
Please make yourself a picture : http://www.global-traderonline.com
Even that URL is alarming? the way the "-" is being used to seperate three words is odd to me.
I would like to hear some oppions about this site from members here who have more experience with escrow services than I do, if possible.
I further found a "to-do" list on the web that outlines actions to be taken in case you assume a site to be fraudlunet. So they say : cally cally
I look up the site that has the contact info on it an flag one flies : FAX and PHONE are the exact same number?? Odd but possible if it runs through a PC. So: I call. It rings once, and I'm being told (by the official german t-mobile woman that the number doesn't exist). Now at this point I jump in joy not having sent of that bag!
So now I have sent the potential buyer (who uses a @yahoo.com adress ->another odd thing for a person who wants to buy such an expensive bag! or?)
I'm now waiting on a reply by this person to an e-mail in which I ask him/her/it to change the escrow service so I can be sure they aren't trying to conn' me.
I'll post the reply here in case it's dodgey!
Oh and the first thing which made me think fraud was : the bag is used and the exact same model costs €1000 and this person wants to buy it for (in total, including fees for 'escrow service' and shipping) €981.89.
If this is a scam I'm gonna (pardon my french) shit a brick and throw it at this person!

Thanks again for indirectly encouraging my nosy-ness and for providing such vital information to people! This is an incredible service

Oh and in case this is a fraud I will post all information I have. E-Mail, adress, IP-Adress and eBay user name /people who gave that username a comment etc. etc. etc.

Thanks

[peg]

Well I will tell you that you can take it to the bank (that would be YOUR bank and keep your money and purse there) because the site is DEFINITELY a fraud. I have NO doubt that the person that you are dealing with is also a fraud (and not just an innocent bystander).

First inclination of a fraud is that the WHOIS shows a creation date of November 28, 2007 while the site shows a copyright of 2005-2007. Interesting since the site is only 2 weeks old.

There "Verisign" Secure logo (which normally would pop up in a window with the Address bar removed but for some reason did not on my machine) is hosted on THEIR site and not Verisigns site as it should be and as suggested in the text of the page itself.

The URL of this page is https://digitalid.verisign.com.

To top it off, there is no https (the reason to USE verisign) available on the site.

Don't waste time waiting for the Scammer to reply... Post their info now especially the email address.

This site has been added to our database at http://escrow-fraud.com/fraud_data.php?id=5418

[Frozen]

Thank you peg!

I am so glad you already posted
I have found out the things you have just mentioned in your post and I have already taken action. I have reported the site to verisign and I have gotten replies from that person urging me to send the purse using that site. I told him /her to use a escrow service of my choice and they just replied to me that they already paid and that they don't know what to do about the fees for the escrow service.
I'm so glad my suspision was bigger than anything.

I also have traced the IP adress and found out that all mails were sent from dynamic IP adresses which all lead to the same adress :

OrgName: Internet Assigned Numbers Authority
OrgID: IANA
Address: 4676 Admiralty Way, Suite 330
City: Marina del Rey
StateProv: CA
PostalCode: 90292-6695
Country: US

I don't know what to make of this seeing as I was supposed to send the purse to Castellon, Spain.

Here are all the infos I have from this idiot:

rslwidow@yahoo.com
Names : Thomas and Karen Malko
Adress :

Name Thomas Malko
Address Calle Dean Marti nr.30
City Castellon de la Plana
State - Outside US and Canada -
Zip Code: 12004
Country: Spain

IP adresses :


10.142.193.2 (Got this one from the "support" of the website. Leads to the same adress as the ones I got from the @yahoo.com adress)
10.140.179.18
and so on. all are dynamic and lead to that same adress I posted before.

The mail I received from their "support" was sent through : mx-out.daemonmail.net [216.104.160.38]. Are there any steps to take again daemonmail.net ?

Oh and the username on eBay is : borntobill

I have also notified eBay about this member and I am awaiting a reply by eBay.

I am lucky not to have fallen for this. I was going to send the purse TOMORROW!! Good lord. Thanks for internet. Or not? haha

[Eniac]

IP adresses :


10.142.193.2 (Got this one from the "support" of the website. Leads to the same adress as the ones I got from the @yahoo.com adress)
10.140.179.18
and so on. all are dynamic and lead to that same adress I posted before.

These are internal addresses used for the communication between the mailservers. The original IP must be another one. Pls. post the full email headers.


Eniac

[Frozen]

oh okay. I thought I did it right. Thanks for the help though!!

here. Oh an I used **** to cover my adress

Delivered-To: ********@******.com
Received: by 10.151.12.17 with SMTP id p17cs46560ybi;
Mon, 10 Dec 2007 09:26:22 -0800 (PST)
Received: by 10.100.215.5 with SMTP id n5mr6883589ang.1197307582667;
Mon, 10 Dec 2007 09:26:22 -0800 (PST)
Return-Path: <rslwidow@yahoo.com>
Received: from web52501.mail.re2.yahoo.com (web52501.mail.re2.yahoo.com [206.190.48.184])
by mx.google.com with SMTP id v26si211207ele.2007.12.10.09.26.11;
Mon, 10 Dec 2007 09:26:22 -0800 (PST)
Received-SPF: pass (google.com: domain of rslwidow@yahoo.com designates 206.190.48.184 as permitted sender) client-ip=206.190.48.184;
DomainKey-Status: good (test mode)
Authentication-Results: mx.google.com; spf=pass (google.com: domain of rslwidow@yahoo.com designates 206.190.48.184 as permitted sender) smtp.mail=rslwidow@yahoo.com; domainkeys=pass (test mode) header.From=rslwidow@yahoo.com
Received: (qmail 86826 invoked by uid 60001); 10 Dec 2007 17:26:11 -0000
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
s=s1024; d=yahoo.com;
h=X-YMail-OSG:Received:Date:From:Subject:To:In-Reply-To:MIME-Version:Content-Type:Content-Transfer-Encoding:Message-ID;
b=rZkAq87TVgYYC2gBJG5uM3r/IqF33R/QkaSfZvs//
actPPkdVj4kildYxvKWAkbTH0L10AmbbGiVFsaIuN5wixFjE4KetlkeOOKNIcHw7G/
gNya8+qD9TtAvnwNA6LENpCRyzmPlsIdpMFYcjq2QkEF3tGuYqPPqPJAWqq91dTU=;
X-YMail-OSG:
R39.KJoVM1n2rwVWWXBGKkSBO30czvaTleUfC6MS1CKaJBc3uRiyDvTVx1jBbir6pa.
PWHIqH9mL2E6GA_aMJYKAFxuvXyIXXVOThg1.zGUauY5wM3M-
Received: from [172.132.65.171] by web52501.mail.re2.yahoo.com via HTTP; Mon, 10 Dec 2007 09:26:11 PST
Date: Mon, 10 Dec 2007 09:26:11 -0800 (PST)
From: Karen Malko <rslwidow@yahoo.com>
Subject: Re: Escrow Service
To: **** ****** <*******@gmail.com>
In-Reply-To: <3ae1d5d60712100921s7f6190b7qc798b97d06085359@mail.gmail.com>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="0-1017095900-1197307571=:85946"
Content-Transfer-Encoding: 8bit
Message-ID: <347827.85946.qm@web52501.mail.re2.yahoo.com>

please let me know which one the real IP could be
Thanks for all the help!!
Do you want me to post ALL the email headers or is one fine?

[Eniac]

Received: from [172.132.65.171] by web52501.mail.re2.yahoo.com via HTTP; Mon, 10 Dec 2007 09:26:11 PST

172.132.65.171 = AOL

Most probably sent from Romania as AOL is very popular in Romania.


Eniac

[Frozen]

thanks for clarifying this to me Eniac!
Is there any means by which I could truly find out where this AOL person is doing this business from?
Although I have reported him/her I still doubt that there is more going to happen than his website being shut down and his account on ebay being deleted. (I am selling another purse which on ebay gets sold for around €201 in unused and NEW condition and I have biddings for €202, auction ending today at 20:00. There are two bidders both with 0 feedback comments) Is there a way I can check these guys out before the auction is done?
Thank you very very much!

[Eniac]

thanks for clarifying this to me Eniac!
Is there any means by which I could truly find out where this AOL person is doing this business from?

Well, you have to ask AOL where the connection is coming from exactly. But I'm sure they won't give you any details without court order. If they would do, you still can't do anything. Remember, these crooks are in countries where the jurisdiction is corrupt.

Although I have reported him/her I still doubt that there is more going to happen than his website being shut down and his account on ebay being deleted. (I am selling another purse which on ebay gets sold for around €201 in unused and NEW condition and I have biddings for €202, auction ending today at 20:00. There are two bidders both with 0 feedback comments) Is there a way I can check these guys out before the auction is done?

You could discard the bids if you distrust them, that's all you can do. Unfortunately ebay is besieged by the scum of the world, all these romanians with their fake escrows, the nigerian mugus offering their fake cheques and all the other chinese or russian crooks. It's a real pest.


Eniac

[peg]

Although I have reported him/her I still doubt that there is more going to happen than his website being shut down and his account on ebay being deleted. (I am selling another purse which on ebay gets sold for around €201 in unused and NEW condition and I have biddings for €202, auction ending today at 20:00. There are two bidders both with 0 feedback comments) Is there a way I can check these guys out before the auction is done?

You could also REQUIRE a certain feedback to be achieved prior to bidding. I agree that eBay does attract scum, that leads to long (legal type) "Terms". I know my terms have a long list of do's and do not's.

The safest thing you can do is trust your gut. If something is telling you to be suspicious, then be suspicious. It's better to risk losing a sale at your asking price only to resell it at a slightly lower price, rather than to "Get" your asking price, only to lose the item (or money) and be left with nothing.

Of course if you have your doubts, you can always come back here and ask our opinion... I am sure you will get good advice from our forum.

[Frozen]

Of course if you have your doubts, you can always come back here and ask our opinion... I am sure you will get good advice from our forum.

Thank you so much peg!
I really appreciate that! I do agree that eBay attrackts scum and fraud but why on me? I realize that when they saw I had a high priced pruse they looked for other things I sold on ebay and started bidding there. the two people who are bidding both have only bid on my action in the last month. one member registered in august and on within the last 30 days. I will wait to see if they are just new members or like I think, are trying to conn.
Thanks for all the help!
If they offer me escrow then I will make sure to post their info here.
I will have to stop thinking about the "malko" person I guess before I do stuff or arrange stuff that could get me into trouble.
Thanks for teaching me and helping me ever so quickly! I will make sure to support this forum and consider a donation if I have money left over once all christmas gifts have been bought.
Thanks once again. I will check this forum and thread in the future so do let me know if there are other things I should/could do.

best regards,

Frozen