Urgent Information Required

sharger · 20-11-2006, 10:09 PM

Hi All

Could anyone who has purchased or were going to purchase from yangtse in any of the classifieds on these forums please PM me with any details they may have of name, address, paypal email address etc.

Unfortunately it appears this is a fraudster who has used these forums to try and con people out of their hard earned. Any information you can give will be much appreciated and hopefully help to catch this individual.

many thanks

Steve

Woodywizz · 20-11-2006, 10:13 PM

Have you PM'd the Mods and reported this???

**Steven** · 20-11-2006, 10:14 PM

Have you cleared this with Stuart or a mod?

Edit: what Woody said. Curse my one-finger typing

ijd · 20-11-2006, 10:18 PM

Very harsh, what grounds do you have to base these accusations on

ijd · 20-11-2006, 10:27 PM

oh dear, just read some of his sales,cheap ...more like to good to be true

**UrbanT** · 20-11-2006, 10:27 PM

The mods are aware of the situation, and I'm happy for information to be collected on this individual. But I am requesting that the language used be 'professional'. I am editing the first post to reflect this.

sharger · 20-11-2006, 10:28 PM

I have PM mods, what I'm trying to do is gather info. If you look the individual has been banned.

If you have not had dealings then do not reply. The information obtained will be passed onto the police and Paypal for invesigation.

Thankyou

Woodywizz · 20-11-2006, 10:36 PM

Quote:

Originally Posted by sharger

I have PM mods, what I'm trying to do is gather info. If you look the individual has been banned.

If you have not had dealings then do not reply. The information obtained will be passed onto the police and Paypal for invesigation.

Thankyou

Best of luck Sharger, can the mods not provide his IP address to you and the police in order to help track him down? These people are never that clever and will be caught.

**UrbanT** · 20-11-2006, 11:33 PM

Quote:

Originally Posted by woodywizz

Best of luck Sharger, can the mods not provide his IP address to you and the police in order to help track him down? These people are never that clever and will be caught.

This member does not have a unique IP, its shared with a large number of other members

Steve.J.Davies · 20-11-2006, 11:51 PM

It is probabaly his ISPs cacheing proxy. the ISP can nail the real IP address.

sharger · 20-11-2006, 11:54 PM

Quote:

Originally Posted by Steve.J.Davies

It is probabaly his ISPs cacheing proxy. the ISP can nail the real IP address.

Can the mods help out here with what Steve is saying?

thanks

Steve.J.Davies · 21-11-2006, 2:25 PM

ISPs use cacheing proxies. (ir you do a trace route or use a graphic display prog you will see yours). ISPs do this to reduce traffic flow so that they can reply to a request from their own proxy rather than go to the original site. Its just like cache on disk really, same principal). These proxies are supposed to be 'transparent' - but they can cause problems sometimes. e.g. If you have trouble with some sites you may need to push through a different proxy at the ISP.
That means that the request the board sees will be from the 'transparent' proxy - not so transparent are they ? As ISP proxies tend to be large (and there tend to be clusters of them so no single point of failure) you get a lot of Users going through the same proxy hence this board (and others) see a lot of Users coming through on the same address.
Look for the doc that comes with Privoxy for a better explanation than mine. it is a privacy and filtering proxy. I am running it now. My browser thinks it is talking to the Board. The board thinks the html it is sending is going to my browser - but it isn't, my proxy intercepts the html and processes it before it gets to my browser modifying it on its way.

Real IP addresses can be retrieved despite all this (after all it is an end-to-end connection although the protocol is stateless). However this requires programmatic techniques to be used which aren't always in place in all software.

The information that tallies the real IP address of a User with 'the event' that passes through the proxy will be held in the ISP infrastructure in all cases but unless the board software is correctly coded, which judging by a Mod response it isn't otherwise the board would not be seeing 'lots of users from the same IP', it will not see the 'real' IP addresses.

Don't know if that has made it better or worse for you....have reduced my coffee intake today - mistake !!

mrtbag · 21-11-2006, 2:33 PM

Just looking back, users: Lurcher, Si1441 & Dan653 have all traded with him. May be worth sedning them Pm's to see if they have some info.

Ian J · 21-11-2006, 5:37 PM

Quote:

Originally Posted by sharger

Can the mods help out here with what Steve is saying?

The FS post that you responded to is logged as having come from 80.3.64.13 brig-cache-6.server.ntli.net whilst the bump the following day was logged as coming from 61.50.188.197 China Netcom Group Beijing Corporation followed up ninety three minutes later by another post from 80.3.64.12 brig-cache-6.server.ntli.net.

Twenty two minutes later at 4:25pm the next post was made from 211.115.230.93 Korea Network Information Center whilst another hour brought another post but this time from 211.162.62.161which is an IP address owned by GWBN GUANGZHOU JIANGNANZHONG4HAO RESIDENTIAL COMMUNITY BROADBAND NETWORK USERS' ACCESS in China.

Two hours later at 7:23pm the next post was logged from 85.120.28.99 which is B-DUL MATEI BASARAB, BL. F3, PARTER,
LANGA STADIONUL 1 MAI in Slobozia whilst a further 17 minutes brought another post from closer to home via 80.3.64.13 brig-cache-6.server.ntli.net

At 8:16pm 8:19pm 8:21pm and 8:25pm he was still posting from 80.3.64.13 so that covers every IP address logged on that thread

dudeness · 21-11-2006, 7:45 PM

Quote:

Originally Posted by Ian J

The FS post that you responded to is logged as having come from 80.3.64.13 brig-cache-6.server.ntli.net whilst the bump the following day was logged as coming from 61.50.188.197 China Netcom Group Beijing Corporation followed up ninety three minutes later by another post from 80.3.64.12 brig-cache-6.server.ntli.net.

Twenty two minutes later at 4:25pm the next post was made from 211.115.230.93 Korea Network Information Center whilst another hour brought another post but this time from 211.162.62.161which is an IP address owned by GWBN GUANGZHOU JIANGNANZHONG4HAO RESIDENTIAL COMMUNITY BROADBAND NETWORK USERS' ACCESS in China.

Two hours later at 7:23pm the next post was logged from 85.120.28.99 which is B-DUL MATEI BASARAB, BL. F3, PARTER,
LANGA STADIONUL 1 MAI in Slobozia whilst a further 17 minutes brought another post from closer to home via 80.3.64.13 brig-cache-6.server.ntli.net

At 8:16pm 8:19pm 8:21pm and 8:25pm he was still posting from 80.3.64.13 so that covers every IP address logged on that thread

Having lost money to him too!

Sooo from my knowledge of what the police can do.. is bugga all seein as he's in China! Am i right..??

Steve.J.Davies · 22-11-2006, 12:57 AM

Could be China, could be anywhere...
I haven't looked at the non-NTL addresses (yet) but if they are proxies (seems likely) then it goes back to my point about the way the board software logs.

Firefox has a nice addon called switchproxy that lets you do stuff like this. Or summat called Proxy Analyzer can help the culprits.

if people want to read up on both sides of this try
wwwdotgoogledotcom/search?as_q=logged+proxy+instead+forum&num=10&hl=e n&btnG=Google+Search&as_epq=real+IP&as_oq=&as_eq=& lr=&as_ft=i&as_filetype=&as_qdr=all&as_nlo=&as_nhi =&as_occt=any&as_dt=i&as_sitesearch=&as_rights=&sa fe=images

neilmcl · 22-11-2006, 1:09 AM

Quote:

Originally Posted by Steve.J.Davies

Could be China, could be anywhere...

Exactly.

I'm afraid the OP is going to have to put this down to experience unfortunately and lets hope he doesn't try targeting this forum again.

Steve.J.Davies · 22-11-2006, 11:43 AM

That google search link will bring up posts that show how Vbulletin can be changed to record real IPs. that could help the members of the board in any future occurence.

Ian J · 22-11-2006, 12:00 PM

It doesn't work on anonymous proxies

Steve.J.Davies · 22-11-2006, 5:14 PM

Yep, works on the rest though...

dudeness · 24-11-2006, 1:15 AM

Just had this message from the guy himself, from fme666@hotmail.com

Joe smith wrote:
> cops dont swear at kids i cud get u done 4 tht im only 13

Mmmmm

dan653 · 04-12-2006, 8:26 PM

raised a dispute with this guy via paypal in relation to a deal in this thread http://www.avforums.com/forums/showt...34#post3785434 paypal have ruled in my favour; recovering £33.61 of the £35

the paypal address i have for him is danperk_1984@hotmail.co.uk but unfortunately nothing more such as a bricks and mortar address or a real name (dan perk?)