Artists Against 419 Takes On Scammers

419scammers writes "Hello, The following site is an anti scammers 419 site (plus associated scams) which has started to receive a great deal of publicity in a number of countries national publications. Their fifth international flash mob has now started. Have a look at the monthly flash mob link. Enjoy." An anonymous reader adds "More than 50 identified websites of the Nigeria-Connection are being targeted and the first ones has been already disabled. It was a very bad idea to copy the website of an innocent lawfirm..."

Comments

Comment removed

[account_deleted]

Comment removed based on user account deletion

Heh, Nigeria scam..

[LordK3nn3th]

I had fun with one of these guys here.

Re:Heh, Nigeria scam..

[LordK3nn3th]

After wasting his time I got into his hotmail account, changed the password and password question/answer, and notified everyone he was in contact with. He was actually scamming people-- it looked like he was rather close to getting some of them.

The main reason it was a bad idea

[Sonic McTails]

It was a very bad idea to copy the website of an innocent lawfirm..." *watchs the lawsuits and lawyer from the innocent lawfirm attack*

Oxymoron

[idgrad]

"Innocent Law Firm"

- Shouldn't it be "An innocent until proven guilty law firm?"

Verification?

[Anonymous Coward]

How do we know we're actually participating in a DDoS against a 419 site and not a legitimate business?

This kind of mob mentality is a little unsettling. I guess it doesn't matter as far as slashdot is concerned though. They'd take down a bus full of nuns if they were a website.

Re:Verification?

[DrEldarion]

While you have a point, Slashdot has taken down many legitimate business sites before. What's a couple more?

Re:Verification?

[LostCluster]

Unsettling yes. Sound to anyone like groupthink?

No. It's not. At least, most of us don't think so...

Re:Verification?

[General Fidul]

Usually those websites came up in connection with the various kinds of 419. Either they were from the initial spams or were presented later in a scambait: "My trunkboxes are stored in a security company in Amsterdam!" The search engine of your choise surely will find something.

For example, would you trust a "decades old" UK bank with a non-existant street address, only mobile numbers, the registrant in Nigeria and no listing in the official directories?

From what I know AA419 is checking every flashmob victim very carefully before feeding it to the nerds. ;-)

Re:Verification?

[RedBear]

I guess it doesn't matter as far as slashdot is concerned though. They'd take down a bus full of nuns if they were a website.

What makes you think we wouldn't take down a bus full of nuns in meatspace as well?

Especially if the nuns on that bus use... Micro$oft Windows! DUN-DUN-Duuuun!

Cha-ching. Thanks, I'll be here all decade. Try the sarcasm and don't forget to tip your waiter!

Re:Verification?

[Raphael]

They are scammers, not legitimate businesses. They steal text and images from other sites. As others have already mentioned, you can use Google to search for some parts of the text on their pages and you will usually find the real source of the content.

It is also interesting to check where the images are coming from. For example, take a look at one of these fake sites: "Trust Meridien". The home page contains a link to the so-called professionals who are supposed to run this fake company: http://www.trustmeridien.com/directors.htm.

Take a look at the second picture. This woman is supposed to be called "Elizabeth Gideon". However, the name of the image file is: Kay_ivey1.gif. The name does not seem to match. Indeed, a little googling allowed me to find an identical copy of the image: Kay_ivey1.gif. That one is linked from the home page of http://www.kayivey.com/, who is the Alabama State Treasurer. The scammer did not even bother changing the name of the file!

I am sure that someone could find the source of the other images included in that page. Anyway, if you still had any doubt that the site is not a legitimate business, I suggest that you get in touch with Kay Ivey and ask her if she is really part of "Trust Meridien". Or maybe she has a twin sister?

Finally...

[LostCluster]

This is going to be a major Slashdotting with a useful purpose!

Re:Finally...

[whovian]

thus suggesting that this website could take assume the tagline
Slashdot: The flash mob web site nerds prefer.

For some good 419 baiting try..

[Chilliwilli]

for good 419 sport try Ebola Monkey Man (n.b. site is in no way racist despite the name)

The Funny Thing...

[Ieshan]

The Funny thing about all these anti-419 ideas - especially the laws - is that it's probably easier to take out the stupid people here than it is to take out the stupid scammers in Nigeria.

The new Microsoft Email Initiative has promised to do just that- Every time people use their mail client, clippy will pop up with questions like:

Will you:
a) Give money away to people you don't know.
b) Double click nude.pics.exe.vbs.exe.jpg.exe
c) Mail this pyramid scheme to 30 other people
d) None of the above

Everyone loves messing with these scammers

[nev4]

419 Eater has been around for a while and is pretty well known for messing with these scammers. Take a look at some of the pictures scammers have sent them and listen to the audio recordings. Some of these scammers really need to brush up on their pop-culture.

Re:Joke's on who?

[Anonymous Coward]

"Q: Why are there so many broken images on your site? A: That's not a bug! It's a feature! If you can see any picture it means that a website of a 419 criminal is still not down. But they have to pay a price for it! Actualy our aim is to present only broken images at our web site." So to answer your question, by slashdotting the site, we are helping take down the 419 sites.

Natural selection

[Graftweed]

Well as much as I hate 419 scammers I still can't bring myself to think of them as scum quite on the same level as mass spammers.

Think of them as the internet's version of the lion, culling the weak and gullible thereby keeping the species healthy.

Re:Natural selection

[YOU LIKEWISE FAIL IT]

Of course, there can be substansive collateral damage, vis that lady who embezzled her company to finance her advance fee fraud, and another gentleman who collected money from his circle of friends and acquaintances on the pretext that it was to finance a large shipment of clothing items for his business.

These second tier victims aren't necessarily weak and gullible - nor are they all on the internet. They were often approached by someone they knew and trusted. These cases, if none other, are a reason for us to be vigilant, and do what we can to put the frighteners on people that would purvey such scams.

( Although personally I think the time would be better spent educating people instead of trying to slashdot some website which the proprietors will just take down and put up somewhere else... )

Slightly OT

[Meneudo]

Heh... now I have another site besides /. to constantly hit the refresh button on!

Not only that, but it hurts spammers!

Re:Why this

[bersl2]

Having many people actively (as opposed to automatically) participate against scammers indicates a mass disapproval of them. Each node in a manual DDoS requires one human being deciding that participating is worth his time.

Re:Joke's on who?

[nacturation]

It's a great idea. While the artists against 419 scammers have to serve up the HTML, they've hijacked the images, eg:

<img src="http://www.some-419-scam-site.ng/logo.jpg"&gt ;

So maybe a 1 KB of HTML vs. usually 10 to 20 KB of images, and that's for each image. You could easily add a 1 pixel frame which loads up dozens of images from the scam sites.

They Have a Game on the Site

[oobob]

Here is a game where you chase logos from the sites with your mouse, and if your cursor goes over them, they reload on the edges of the page.

Thing is, you can speed them up, and they automatically go towards your cursor. Even in the background (try it with a trillian window). And it's more addictive than you'd think.

Make 419ers spam each other...

[DocSnyder]

419 scams are the only kind of spam whose email addresses are valid and belong to the spammer - that's how the mugus want to be contacted by their victims. Of course this would get more and more difficult if these addresses get flooded with spam.

Many 419 mugus suffer from their small and weak penises, don't have any major education and need lots of stock opportunities to put their money into. It's only gentle to help them by having their email addresses fed into as many spammers' databases as possible.

Re:OK it's probably me but

[Anonymous Coward]

Basically this, 419ers are basically scammers. They try to get you to give them you bank information or credit information or just give them lots of money by making you think they're a bank or an investment firm.

The idea is you're stealing bandwidth to cost them a lot of money and wipe their site off the internet.

Are you attacking a good guy or a bad guy? That's a good question. You don't know, do you? You could be attacking a bad guy but you're taking down a small business internet provider that got duped themselves and you just ran up their bill thousands of dollars putting them out of business. You could be attacking a bad guy but their site is running off zombied machines in a hospital so you just shut down their network and killed a few people. Someone could have compromised that site and changed the pictures to ones on humanitarian websites and you're hurting the good guy. I don't know, you don't know. Who does?

And that is why a DDoS is generally regarded as a bad thing by everyone no matter who it's against.

Sounds like a job for wget

[Yonder Way]

Use wget from a few well connected machines to spider the 419'ers fake sites in an endless loop. Shouldn't take long to wipe 'em out. :-)

Re:Sounds like a job for wget

[MBAFK]

Something like this probably - I made it up on the fly - haven't tested it (yes I know it's cack and that you could probably do it in 2 lines of perl :)

#!/bin/sh

wget --mirror -np http://artists-against-419.mugus.com/
cat artists-against-419.mugus.com/*html* | tr ">" "\n" > all.txt
rm -rf artists-against-419.mugus.com/
cat all.txt | grep "http://" | egrep "\.jpg|\.gif|\.png" | sed -e "s/^.*http/http/g" | tr "'" " "| tr "\"" " " | cut -f 1 -d " " | grep -v "mugus.com/" | sort | uniq > urls

while [ true ]; do
for i in `cat urls`; do
wget -O tmp $i
rm tmp
sleep 1
done
done

Re:I'm sorry I haven't a clue.

[LostCluster]

Artists Against 419
A "419 Scam" is the attempt to defraud people of their money by claiming that they need to send money and/or account details in order to recieve a large ammount of funds. If any victim actually cooperates, they're told that they need to send more. Spam is commonly used because of the relatively low cost of sending massive e-mails, and the fact that the scammers net thousands of dollars from each fool that bites. The name comes from the chapter of Nigerian number in law that says this is illegal there, yet a majority of these scams come from there.

flash mobs
This is a concept that comes from people who send text messages to a mailing list of bunch of friends that says something cool is going on, so anybody free should come join them. In cities, this can cause 100s of people to show up on the "if you contact 10 friends, and they contact 10 friends..." principle. Singer Avril Lavigne is currently doing a tour of unadvertised events at shopping malls, which have attracted up to 6000 people that more or less depends on the first people to see the sign announcing the event telling their friends, and having those friends tell others. This group is encuraging a simple Slashdotting against 419ers, which is basically the same principle. More people showing up than expected causes problems...

Do some real damage (link)

[Anonymous Coward]

The Lad Vampire attack downloads 5 large images from the 50-something target sites continuously. It doesn't require refreshing or turning off cache, and uses all available bandwidth. Opera tells me I've got 10,000 images so far for about 240MB in just under 20 mins.

Nice idea. "Community "ttacks" can work.

[hkmwbz]

This is a very good idea, and seems to work to a certain extent.

Organizing communities to attack hostiles is a good idea, and lately I've seen a lot of mails pretending to be from Citibank, apparently linking to citibank.com, but instead hiding the URL by using HTML, and sending the user to a different page instead.

These new phishing scams have been covered by the media, and basically it opens a popup with the address field hidden, and it uses HTML/JS to recreate a fake one, giving the impression that one is actually at citibank.com.

An example of a received spam, which claims to link to web.da-us.citibank.com, but really links to a page which opens a popup. The address of the popup is:

http://www.strongerinfobase.us/scripts/sys.php

This page gathers credit card info. Maybe if there was a site to gather these addresses, hundreds or thousands of people could cooperate and submit so much nonsense - either random crap or seemingly real, but fake, CC info. That way, the scammers would have to wade through thousands of fake entries.

Maybe someone could even write a script to spam the scammers into oblivion :)

Re:Nice idea. "Community "ttacks" can work.

[Darthmalt]

Someone should write one of those screen saver programs that go in effect when your computer is idle. That would recieve instructions from a central site and constantly reload a spamers site until it was down then get insstructions for which site to attack next. If everyone installed this on all of their home computers just imagine the bandwidth you could drain.

Re:Nice idea. "Community "ttacks" can work.

[YOU LIKEWISE FAIL IT]

Yeah, what a good idea. I'll just join my computer up to a botnet and let some probably unknown individual give me a list of targets to attack. Perhaps when they run out of 419's they could start bombing the sites of political campaigns they don't approve of, or auction websites or microsoft.com.

If you're going to punch someone, don't let someone else guide your fist. You might end up biting off more than you can chew, if you'll excuse my mixed metaphor.

Bad Publicity

[yintercept]

Unfortunately, scammers and spammers often have a lot more available bandwidth than typical artists or honest business sites. Even worse, you toss up your anti-419 page that throws unwanted traffic at a page, and you increase the scammer sites rating. The various sustained DOS attacks on SCO gave SCO an Alexa Rating in the low thousands. A smart scammer might use the DOS attack to set cookies for merchant programs, and end up making money for the person you are trying to attack. We seem to forget that both good and bad publicity drive valuable traffic to sites.

... or as previously covered on slashdot

[cr@ckwhore]

Previous topic on the same subject ...

http://yro.slashdot.org/article.pl?sid=03/11/16/20 4210

A moment of your time, please

[Skevin]

Hello, my name is Solomon Chang, and I am a legal representative of a certain Cowboy Neil, who has a similar sig to yours on Slashdot. Recently, my client, a strong supporter of Artists Against 419, passed away, and has left behind an account with a hell of a lot of Karma on Slashdot. However, Hemos and Commandante Taco have dictated that the account be furthermore untouched should such an unfortunate occurance transpire. However, if you should be willing, your sig matches my client so closely that we may be able to trick VA Systems into sending his Slashdot password so that we may both reap the benefits of 1337 hax0r status. However, my firm would require the access information of your Slashdot account (i.e. username and password), so if interested, please send your information and we will proceed from there. You will need to hurry, as the Commandante will attempt to acquire the Karma for himself if/when he discovers the account to be deactivated.

In sincerest regards and utmost urgency,
Skevin

See for yourself.

[cryptor3]

If you're suspicious, check the targets out for yourself. Here's the clues that I relied on:

Mechanical/Formatting - The sites are decent, (i.e., not foreign spam bad) but they have enough errors and inconsistencies that I think they aren't up to the caliber of an international financial organization. If they really have any international dealings, they can afford a decent marketing firm or department to do their web site.

Sitebuilders - Look for systematic naming, formatting, and telltale HTML tags. Again, I wouldn't trust a financial org that uses a sitebuilder.

Plagiarized Wording - Try Googling some of the complex wording. A number of them show up word for word on other sites.

Take for example, financialsecurities.org.uk. The wording "has a highly experienced team of professionals providing unbiased and highly qualified services exclusively to its clients in selected technology & health care industries which drive the high-tech revolution" appears only at this site. Notice also the >>high tech revolution<< punctuation that appears afterwards.

Now it's possible that Viscardi is plagiarizing financialsecurities.org.uk, but Viscardi leaves a phone number, so you can call them and ask about it.

Now sure, this isn't hard evidence, but the consistency of clues on so many sites tells me these people (the artists) have gone through some work to come up with such a reasonably self-consistent list.

Re:See for yourself.

[SydShamino]

Or, for the one I looked at...after going through their huge disclaimer page, they have a web form to fill out an application.

What do they ask for buried in the middle of the form? Your current bank information. Together with the other info, they have everything they need to initiate a wire transfer.

Pretty clear from that alone that they are scammers. No real financial institution would ask for that on an application.

definitions....

[Carbon Unit 549]

Flash Mob
419

Heh

[beckerie]

I'd prefer this sort of scam-baiting. If only I had the capacity to do what this dude did...

Taylor: Hello, how may I help you?

Radar: I received an email from Worldwide Global Lotto stating that I had won $193,000. I want to collect my money.

Taylor: First of all, this is a financial company. I am aware the Worldwide Global Lotto is a promotion presently going on for all Microsoft users around the world.

Radar: But I don't use Microsoft. I use Apple.

Taylor: You must have used Microsoft once in your life. Probably this is where your email address has been gathered.

Radar: Great. And how do I get the money?

Taylor: All you have to do is make available the fees and charges for the processing of your winning and legal documentation and naturalisation papers. That is an equivalent of $2400. As soon as you make this payment available in the name of our chief accountant, Mr Kelvin Duncan, within 24 hours your winnings will be transferred to you as a certified cashier's cheque or into your bank account.

Radar: There is no lotto or prize, is there?

Taylor: What? Obviously you have emerged as a winner if you have the correct email.

Radar: How much money do you make from this scam?

Taylor: Bye-bye now. [Click]

Source: SMH

Re:Why this

[pyrrhonist]

This seems to be a round-about and innefficient way to do a DDoS (Distributed Denial of Service) attack. They should just automate the thing as opposed to having people sitting and clicking as they seem to plan on doing.

It is automated. RTFA. The pages automatically reload, or you can download scripts.

Their site features just about every grammatical mistake one can make.

English is not every person's first language.

They also accused me of stealing their bandwidth by going to their page. That seems to be a strange accusation coming from a group that is going out to crash other people's sites.

No they didn't. In fact they encourage people to, "...bookmark this site and revist us as often as possible", and, "link to us from your web site!".

Why is this guy's post modded "Informative"? I suppose wrong information is still informative, but jeez, people!

Re:419?

[Nerull]

The "419" scams take thousands of $ from people who fall for them, and there have also been reported murders involved when the unfortunate scamee (Is that a word?) goes to another country to meet the scammer, and is then mugged.

Wikipedia Article

Re:I'm sorry I haven't a clue.

[shadowbearer]

Should perhaps mention that wrt to flash mobs, Larry Niven AFAIK was conceptual inventor. Although his mobs were more ordinary communications, and relied on teleporation transportation, the concept really isn't that different from what's happening now.

I haven't seen any quotes from Mr. Niven about it (yet) but I do know that several people who know him are quite amused...

Cheers!
SB

Re:Joke's on who?

[giberti]

While I would agree with you most of these sites are running on $8.95/month hosting and so don't have that kind of customization.

Art

[jefu]

Since these guys are (or claim the word) artists, wouldn't it have been much more fun to grab images from lots of icky web sites and by resizing and placing them appropriately build a big mosaic image of something.

So if you had a 500 by 500 image built up of 10 by 10 images it would be 2500 images loaded on every page load.

Talk about artistic slashdotting.

Today's flash mob - 3rd May 2004

[milsim]

For modem users - Cube 419

For cable users - Scammers Nightmare

And here's an alternative - Lad Vampire

Come on, don't be shy, give them some good slashdotting - it's good fun for the whole family!

Re:Who really is punished here?

[hkmwbz]

"I'm sorry, but DDoS'ing 419 sites seems really stupid. You might take their site down temporarily but you're also wasting just as much of your own bandwidth and affecting other more important services."

I am not wasting my bandwidth if I think it's a worthwile cause. And it's not like it will suck up all my bandwidth either. All it does is to download images from a web server. I do that all the time anyway.

So we are wasting their bandwidth, but I can decide to stop downloading their images at any time. So it is not a problem at all.

And what more important services does it affect?

"The 419'ers exploit stupid people."

And they spam all kinds of people, including smart ones who will never fall for their scams anyway. And spam is a major problem today.

"While I don't condone the activities of the 419'ers, they don't bother me that much. Turn on the television and it'll take you about ten minutes before you see a commercial from an American company that's basically doing the same thing, misleading people into giving them money for something that is questionable."

Yeah, except these American companies don't kill their victims, which has happened to 419 victims.

"I figure anyone stupid enough to fall for these schemes will do so eventually, so we might as well let them learn from their mistakes sooner rather than later."

So it's OK by you that they send spam? I don't like it, so I'll be happy to use some of my bandwidth to take their sites down. If they can't scam people because their sites keep being taken down, maybe they'll stop spamming me.

" If you're selling something for $3000 and someone sends you a check for $6000 and wants you to wire the difference to another country, you're a fool who needs to be parted from your money."

And the money they make from scamming people will be used for what? Funding wars, for example? Drugs? Getting people tortured and killed?

Sorry, I can't accept that.

Right Click?

[Mattwolf7]

This site worries me because it has the right click mouse disabled. They have no good reason to disable the right mouse click.

It makes me wonder if they are DOSing more than just 419ers.

is that really effective?

[cute-boy]

Looking at the hit counter on their web page, showing ~330K hits, I'd be suprised it this is in the slightest bit effective...

The quantity of traffic you generate simply isn't that great when you can get a $9.95 hosting deal that allows 500MBytes per month or more.

Bandwidth is cheap. Loading the same image multiple times is a waste of space unless you don't cache in your browser (and elsewhere). If you have access to your web server config (even on shared servers sometimes) you can easily configure so others can't do this by requiring the referrer to be your own site.

RG

Re:Joke's on who?

[Anonymous Coward]

To annoy scammers - If you are the lucky recipient of a scam email, use the email address you're supposed to reply to to 'register' on a few porn sites - the mail scammers themselves will soon be flooded by spam email...

Comment removed

[account_deleted]

Comment removed based on user account deletion

Feed pages with false data

[gorfie]

I personally visit all of the scam sites and fill their forms with false data. I figure if a good chunk of people did the same thing, the scam would become pointless as it would cost too much to weed out the valid data from the invalid data.

Oh Neat

[Cylix]

On their site they listed some other websites.

I found a fantastic online banking presence. It looked very professional!

What did strike me as odd though... was the annoying POP up ad that jumped out at me. I suppose they are just a bit of a progressive banking instititution and using that money to pass the savings on to the customer!

Really, if you are going to scam people at least give it some good effort.

make sure, you use the new version

[Anonymous Coward]

It is here: http://www.freewebs.com/kinomakoto/lv-0305.html

Re:Why use a web page?

[sofar]

http://www.freewebs.com/kinomakoto/ladvampire.html