VoIP Mailing List Archives

[nogoodnameswereavailab...]

Hi List,
I made the mistake of having auto payments via PayPal. Just had some one put in payments and have them all denied. So far this person send in funds from:
julie tosh - juliert@hotmail.com (juliert@hotmail.com)
David Somerville - davso@nbnet.nb.ca (davso@nbnet.nb.ca)
Gaetane Fortier - fortier.3075@videotron.ca (fortier.3075@videotron.ca)
ray stewart - dragonr2262@hotmail.com (dragonr2262@hotmail.com)
Cédric Girard - realm415@hotmail.com (realm415@hotmail.com)

The IP's I have are 213.6.185.243 and 83.233.182.229.

The seem to be calling Palestine Mobile.

/J

[nk3569 at yahoo.com]

Funny. I got a guy from Palestine too today. They tried to use a stolen credit card from one Donald Boltz.

The real Donald has been notified (called him).

Beware of a guy who signs up by "tom mart" - he tried to use multiple stolen PayPal accounts and credit cards. Changes email every time so it's pointless to track email addresses.

Rule of thumb - if anyone makes payments using an American account/address/credit card and their IP is anywhere in the Middle East except Israel - it is almost 100% fraud.

Having said that - we still allow auto PayPal payments. You just have to follow up and verify each and every account afterwards. And don't allow large amounts automatically via PayPal!

--
Nitzan Kon, CEO
Future Nine Corporation
http://www.future-nine.com/

--- On Sun, 4/20/08, Justin Case <nogoodnameswereavailable@gmail.com> wrote:

[trixter at 0xdecafbad.com]

On Sun, 2008-04-20 at 21:47 +0300, Justin Case wrote:

[nogoodnameswereavailab...]

Nitzan,
Do you have their IP address's ? The reason we were caught off guard is because of the Chag. We were out for two days. I just blocked all of Paltel (Palestinian ISP) from our servers (http://www.domaintools.com/213.6.185.243) . Do you know of any other ISP's in Azaa ?

Thanks.

/J

On Sun, Apr 20, 2008 at 11:09 PM, Nitzan Kon <nk3569@yahoo.com (nk3569@yahoo.com)> wrote:

[nogoodnameswereavailab...]

On Sun, Apr 20, 2008 at 11:15 PM, Trixter aka Bret McDanel <trixter@0xdecafbad.com (trixter@0xdecafbad.com)> wrote:

[nk3569 at yahoo.com]

To put it in plain words - PayPal could care less about the merchant. They do very little to prevent fraud, and once it's discovered the merchant gets screwed 100% of the time.

We've added Google checkout recently. SO MUCH BETTER! cheaper too. If this keeps up we'll probably drop PayPal altogether.

Another cheaper (and appears to be safer - not sure yet) option is MoneyBookers. I did hear some horror stories with them though so make sure you don't leave large sums in your account. (horror stories being accounts frozen due to "suspected fraud" and never released)

--- On Sun, 4/20/08, Trixter aka Bret McDanel <trixter@0xdecafbad.com> wrote:

[nk3569 at yahoo.com]

Here's a list of those we've caught lately:

172.173.96.17
85.25.139.99
68.118.206.148
78.101.100.21
172.158.212.35
41.196.60.34
86.152.245.47
212.38.144.47

Beware of Egypt, Jordan, and Palestine. Qatar is pretty bad too.

Would probably be a good idea to put a database of offending IP addresses. We already block these, but would be a good thing to share a blacklist between multiple providers eventually.

-- Nitzan

--- On Sun, 4/20/08, Justin Case <nogoodnameswereavailable@gmail.com> wrote:

[trixter at 0xdecafbad.com]

On Sun, 2008-04-20 at 13:09 -0700, Nitzan Kon wrote:

[trixter at 0xdecafbad.com]

On Sun, 2008-04-20 at 23:40 +0300, Justin Case wrote:

[beckman at angryox.com]

MinFraud from MaxMind. Use it.

On Sun, 20 Apr 2008, Nitzan Kon wrote:

[beckman at angryox.com]

On Sun, 20 Apr 2008, Trixter aka Bret McDanel wrote:

[nk3569 at yahoo.com]

--- On Sun, 4/20/08, Peter Beckman <beckman@angryox.com> wrote:

[sip at arcdiv.com]

Good to know he's picking on someone else.

For the last 3 years, we've been getting one particular individual (or
small group) from Egypt that does the same thing. If you follow their
traces back as far as you can go, they all ultimately originate from
accounts on Link.net in Egypt. We've worked with the FBI and British
Authorities to try and track things down. The Egyptian authorities have
been little help. Link.net is either woefully ignorant or, more likely,
complicit in the activities.

The charges come in from IPs all OVER the world (proxies galore out
there), but connections can be traced back to Egypt, Jordan, and Paltel
(Link.net is firewalled out completely from our services).

It comes in waves. We'll see nothing for a month, and then a spate of
several days of concerted charges (sometimes as many as 30-40 attempted
charges in a day). From the looks of it, it looks like someone's going
through a VoIP directory one by one in a circuit. When he gets to us, we
get hit. When enough of his charges don't go through or we've notified
enough people that his cards begin to get cancelled and he feels the
pinch, he moves on. Until the next time 'round.

We've seen some posts on militant fora out there with the accounts that
had charged stolen cards, advertising that this guy (who, from his
colloquial Arabic, seems to be in his young 20's) is willing to offer
hacked accounts to anyone who wants to, in essence, stick it to the
Americans (even though we're not an American company).

I keep hoping that one day he'll get hit by a bus, but alas... it hasn't
happened yet.


N.


Justin Case wrote:

[nk3569 at yahoo.com]

This can't be just one guy. They hit us the first time about a month ago from Egypt, Jordan, and Paltel. We canceled all their accounts early on and blocked Egypt and Jordan completely, so they gave up and moved on.

They do come back occasionally using proxies, but since then we've managed to cancel their accounts before they managed to make any calls.

You are absolutely right- I believe they go through myvoipprovider.com and just hit every provider on there. That's how they got to us.

There is an easy way to tell it's them. It's quite obvious but given this is a public list I don't want to post and "ruin it". email me privately if you want this info (although you're probably aware of it already).

-- Nitzan

--- On Mon, 4/21/08, SIP <sip@arcdiv.com> wrote:

[shmaltz at gmail.com]

Interesting you mention Chag, there is has been lots of hacking
activities against Jewish companies during Chag oen that actually
closed Bank of Israel for 2 days. I guess they thing they'll gain a
few days until you catch them.
If thats the case I would recommend that before every Chag (next one
is in just 40 days) security is tightened so that more stricter rules
apply, in addition over Shabbat the same should be done.


http://www.jpost.com/servlet/Satellite?pagename=JPost%2FJPArticle%2FShowFull&cid=1208870494142
http://www.theinquirer.net/gb/inquirer/news/2008/04/27/bank-israel-hacked-temporarily

On Sun, Apr 20, 2008 at 4:30 PM, Justin Case
<nogoodnameswereavailable@gmail.com> wrote: