Slashdot Mirror
Artists Against 419 Takes On Scammers
419scammers writes "Hello,
The following site is an anti scammers 419 site (plus associated scams) which has started to receive a great deal of publicity in a number of countries national publications. Their fifth international flash mob has now started. Have a look at the monthly flash mob link. Enjoy." An anonymous reader adds "More than 50 identified websites of the Nigeria-Connection are being targeted and the first ones has been already disabled. It was a very bad idea to copy the website of an innocent lawfirm..."
Comment removed based on user account deletion
Artists Against 419... flash mobs... what are you on about?
"Q: Why are there so many broken images on your site? A: That's not a bug! It's a feature! If you can see any picture it means that a website of a 419 criminal is still not down. But they have to pay a price for it! Actualy our aim is to present only broken images at our web site." So to answer your question, by slashdotting the site, we are helping take down the 419 sites.
It's a great idea. While the artists against 419 scammers have to serve up the HTML, they've hijacked the images, eg:
t ;
<img src="http://www.some-419-scam-site.ng/logo.jpg"&g
So maybe a 1 KB of HTML vs. usually 10 to 20 KB of images, and that's for each image. You could easily add a 1 pixel frame which loads up dozens of images from the scam sites.
Want to improve your Karma? Instead of "Post Anonymously", try the "Post Humously" option.
Here is a game where you chase logos from the sites with your mouse, and if your cursor goes over them, they reload on the edges of the page.
Thing is, you can speed them up, and they automatically go towards your cursor. Even in the background (try it with a trillian window). And it's more addictive than you'd think.
Organizing communities to attack hostiles is a good idea, and lately I've seen a lot of mails pretending to be from Citibank, apparently linking to citibank.com, but instead hiding the URL by using HTML, and sending the user to a different page instead.
These new phishing scams have been covered by the media, and basically it opens a popup with the address field hidden, and it uses HTML/JS to recreate a fake one, giving the impression that one is actually at citibank.com.
An example of a received spam, which claims to link to web.da-us.citibank.com, but really links to a page which opens a popup. The address of the popup is:
http://www.strongerinfobase.us/scripts/sys.php
This page gathers credit card info. Maybe if there was a site to gather these addresses, hundreds or thousands of people could cooperate and submit so much nonsense - either random crap or seemingly real, but fake, CC info. That way, the scammers would have to wade through thousands of fake entries.
Maybe someone could even write a script to spam the scammers into oblivion :)
Clever signature text goes here.
Previous topic on the same subject ...
0 4210
http://yro.slashdot.org/article.pl?sid=03/11/16/2
Skiers and Riders -- http://www.snowjournal.com
Flash Mob
419
nohup rm -rf ~/. >& zen &
The issue to this is that if you look at the headers that most browsers send to the site they request files from there's a referrer tag. A site owner can actually with minimal effort block requests unless they are referred from their own site... This seems like a lost cause to me.
I can count to 1023 on my hands. Ask me about #132.
It is automated. RTFA. The pages automatically reload, or you can download scripts.
Their site features just about every grammatical mistake one can make.
English is not every person's first language.
They also accused me of stealing their bandwidth by going to their page. That seems to be a strange accusation coming from a group that is going out to crash other people's sites.
No they didn't. In fact they encourage people to, "...bookmark this site and revist us as often as possible", and, "link to us from your web site!".
Why is this guy's post modded "Informative"? I suppose wrong information is still informative, but jeez, people!
Show me on the doll where his noodly appendage touched you.
The "419" scams take thousands of $ from people who fall for them, and there have also been reported murders involved when the unfortunate scamee (Is that a word?) goes to another country to meet the scammer, and is then mugged.
Wikipedia Article
This guy actually managed to get the scammer to send him money. He ended up donating it to charity, but none the less, that's pretty impressive. Worth a read if you've got nothing better to do.
http://www.419eater.com/html/stev_ebe.htm
And more importantly, how you can conserve your bandwidth from unwanted inlining of images from the growing herd of bulletin boards and weblogs, via some Apache commands in your .htaccess file: Prevent bandwidth theft.
You can block inlining altogether, or allow it only for specified domains. You can also redirect users to an error image (I used the goatse.cx pic for awhile but found it a little over the top, and switched it to a small "no inlining" note - the phrase "bandwidth theft" has as many problems as does "stealing music").
For modem users - Cube 419
For cable users - Scammers Nightmare
And here's an alternative - Lad Vampire
Come on, don't be shy, give them some good slashdotting - it's good fun for the whole family!
Mr AC: it is slang to describe Nigerian scams involving requests to handle money.
Or, for the one I looked at...after going through their huge disclaimer page, they have a web form to fill out an application.
What do they ask for buried in the middle of the form? Your current bank information. Together with the other info, they have everything they need to initiate a wire transfer.
Pretty clear from that alone that they are scammers. No real financial institution would ask for that on an application.
It doesn't hurt to be nice.
Comment removed based on user account deletion
Quite an interesting idea they have here. From Artists Against 419's FAQ:
Wouldn't it be more effective to start a Denial of Service attack (DoS) against this 419 sites?
We here at artists against 419 don't recommend any illegal practices! Such an attack might be more effective, but its less art.
Also from their FAQ:
Aren't you fighting abuse with abuse?
It's art! Sometimes art hurts, but there are no civil casualities in this battle.
You're right about the grammatical mistakes, though. Maybe artists aren't the best spellers.
I take it you are not involved in network admin...
This type of online demonstration is NOT a dDOS attack.
The pages request legitimate files.
A dDOS attack is a hammering of a server with spurious requests...
Just disable Java/Javascript in your browser when visiting that site. Right Click problem solved. Denial of Service problem, that's another issue completely.
"Forget the engineers." -Carly Fiorina, briber of MIT Technology Review.
It is here: http://www.freewebs.com/kinomakoto/lv-0305.html
Actually, the official Flash Mob site has a couple of Linux scripts that use wget to hammer the targets.
STOP MISUSING APOSTROPHES, YOU MORONS!!!
It's all worth mentioning there's to more flash mobbing than just loading the images; they also encourage people to contact the hosts of the sites, call the authorities, and basically attack the 419ers from every angle.
They are scammers, not legitimate businesses. They steal text and images from other sites. As others have already mentioned, you can use Google to search for some parts of the text on their pages and you will usually find the real source of the content.
It is also interesting to check where the images are coming from. For example, take a look at one of these fake sites: "Trust Meridien". The home page contains a link to the so-called professionals who are supposed to run this fake company: http://www.trustmeridien.com/directors.htm.
Take a look at the second picture. This woman is supposed to be called "Elizabeth Gideon". However, the name of the image file is: Kay_ivey1.gif. The name does not seem to match. Indeed, a little googling allowed me to find an identical copy of the image: Kay_ivey1.gif. That one is linked from the home page of http://www.kayivey.com/, who is the Alabama State Treasurer. The scammer did not even bother changing the name of the file!
I am sure that someone could find the source of the other images included in that page. Anyway, if you still had any doubt that the site is not a legitimate business, I suggest that you get in touch with Kay Ivey and ask her if she is really part of "Trust Meridien". Or maybe she has a twin sister?
-Raphaël
http://www.freewebs.com/kinomakoto/ladvampire.html
Funny site, yet:
"Question.
How do I contact the scammers without using my real email address?
Answer. [...] You could of course buy your own Domain Name and use a redirect to have emails sent to you via the D.N. I nearly always use my own Domain Name to set up email accounts."
(emph. mine)
Be very, very careful if you're up to do this. A simple whois could reveal your personal data to the scammer. I wouldn't want to have some Very Angry Criminal standing at my door...
It has been done by folks at the somethingawful.com forums, and used to slay pedo sites.