Tonight someone was trying 4 different credit cards on my merchant account. Different names, different numbers, although single IP (vietnamese), same e-mail address and same amount – $150. Interesting, now I know what carders think is a safe amount to check the card with.
Don’t you just love people who are about to social engineer you having no skills and being very stupid? I mean – everyone can fall for a lier if he’s good at it, but some morons lack brains and talent, yet they try to persuade you they’re legit.
Here’s this guy how have been on and off sending me “hello” and “hi” and “can I ask you a question” over and over. Didn’t seem like he needed an answer, so I didn’t mind. I get that a lot.
So yesterday at night he finally managed to talk to me. He asks if he can get a free hosting account. I suggest that he sends the letter through the web form so we can review it. So he does, but it’s not a paid account and it’s 3:12am on a clock, so I decide to look at his letter next day (i.e. today).
Which I certainly did, paid or not, he’s a potential client, so I must pay him due respect unless proven that he’s a fraud. So I went to all his web sites that he sited in his e-mail. First one was empty folder (not even index.html) on something like 1234.net.ru This triggered the alarm, since as far as I know .ru zone belongs to Russia and people there prefer to use free hosting resources of their own country (it has to do with providers paying for traffic from abroad – long story). Then there was a passage that I simply loved. The large red siren blared over my head “Social engineering shmuck is on the way!”. It was so hilarious, I can’ thelp but cite it all here – for all the people who read this. This is dumb!
“And my current website is http://*****.info
I will upload great templates and images to the good hosting and I wish you could wise enough to reply me.”
I went to this site, that had some unspeakable bunch of letters .info. Given that you can get a .info domain for free these days, it didn’t really raised the caution, but added to the suspicion. There was an empty forum about some music, with approximately ten posts total. I thought – yeah, I can set up something like this in 10 minutes. And since it’s already set up – why would you need another hosting? But nevertheless, I kept looking.
At this time the guy went on IM again and accused me of lying on my web site. He said he went to other resource that lists free hostings and there is no feedback about us. My response was that a) we just started offering free hosting less then a month ago and b) he didn’t try us to say we’re lying. I also added that most of people who contacted us wanted to host for free because they were planning to set up illegal download sites. “I would never do that“- he said. Riiight. “If you were a good hoster,YOu may replyed my 2 letters and told me my application was denited,But you never did” – he said. Ah, here comes the mask of “almost angry customer”. At this point I was almost sure that he’s a fraud, given that his info from the e-mail listed “Address: BEijing Normal University,ZHuhai Campus,Uk“… Not sure about Zhuhai, but I doubt the Beijing is in UK… Then there was one last check. I went to whois info to see who owns the .info domain the guy wanted to use. Surprise!
Domain ID:D7724977-LRMS
Domain Name:******.INFO
Created On:12-Oct-2004 02:59:11 UTC
Last Updated On:15-Oct-2004 03:14:10 UTC
Expiration Date:12-Oct-2005 02:59:11 UTC
Sponsoring Registrar:R183-LRMS
Status:ACTIVE
Status:OK
Registrant ID:C6823054-LRMS
Registrant Name:dsfs
Registrant Organization:fs adfsa
Registrant Street1:d fsa
Registrant City:fsd
Registrant State/Province:sdf sd
Registrant Postal Code:24234
Registrant Country:VC
Registrant Phone:+1.24234
Registrant FAX:+1.23424
Registrant Email: hotadv@yahoo.com.cn
Given that the TLD .cn belongs to China, I know no respectable asian person would agree to name dsfs. I suggested that the person should look elsewhere, which he did, eventually, making it look like he was dissatisfied. Ofcourse he was, since his lies got exposed.
Yeah, the election day is tomorrow and nobody seem to care about anything anymore. Personally I’d like to see someone else winning then some Texan cheater, but hey, that’s not even up to me.
During this weekend talked to some other folk to see if I was right about the attitude I was getting from the Russian guys and was totally supported. Nice to see the business is not only about making money, but also about making a good impression.
Strange thing about other guys who bid on my project. Where it clearly states that the budget is fixed, they nevertheless put their own price on things. Fun part is they feel discriminated when I tell them I have a budget. Cheapskates.
Some teams are so anxious to get the job, once they get my e-mail, they started sending me their ideas on the web site WITHOUT EVEN HAVING THE SPECS! That’s funny, because if I don’t like their ideas I’ll turn to others and they don’t even want to have a chance to look at what I, as a client, may want. This activity looks like premature ejaculation of some sort. C’mon, guys, save it for a proper moment. You’d please much more then.
Continuing on a subject of carding. I have bookmarked the carders’ web site last year. Yesterday went to it – it’s still up and perfectly running. Either web hosters who keep the site on their servers couldn’t care less or there’s some major twist in people’s minds that I totally missed. I mean – no matter what they tell you about not paying by stolen cards you may as well be their next victim. Not sure if banks would go for this, but I have a plan. It sort of like hiring ex-hackers to harden security that they themselves had breached. Instead of paying high insurance premiums and reimbursements, why not secretly purchase all those stolen credit card numbers and silently alter the accounts affected. It would cost much cheaper then making up for it, at least from my prospective. It would also give banks the edge on alerting insecure vendors that they have security flaws. All in all it would benefit both consumers and banks. If any bank wants to implement such a security measure I’ll be happy to do the research for them.