Rental Scammer - [email protected]

Welcome to ScamWarners EM7715, it is good you didn't send money to the scammer.

You can report the scam to the Internet Crime Complaint Center (IC3). They don't necessarily shut down the sites. We have site killers who are members here and they can get most fake sites shut down. We need the URL (address) for the site and a copy of the email message(s) that you received. Just post that information here in this topic and we will give it some special attention.

This is the link to the IC3: http://www.ic3.gov/complaint/default.aspx

I too got singed by "Stacy". I just got to the Bay Area and even legit rentals require a credit report. Since I didn't have a current one, and was in need, the timing was perfect when I received the above email. I clicked on the link and it looked like it went to an Equifax site. I started entering my info, until I came to the part where it asked for a credit card. At that point, I bailed and went to www.annualcreditreport.com. But, I don't know if the info I entered got scrapped or is it just about getting me to sign up for the service?

Today, I got two more such emails from two other craigslist ads. Is there anything that can be done to stop this?

Here's what I got this morning... Ugh...

And here's the link attached to the email: http://crredtrrchck. cz. cc/6cPG44n4x2MgFY0WlQDbag (Should have looked at it first before I clicked on it!)

Hello,
I apologize for not responding to you earlier, I have been extremely busy the last few days!

The good news is that the rental is still available! We had a tentative agreement from the first person we showed it to, but now it seems that they changed their mind, so we need to lease it as soon as possible. You were the second one to email me about it, so its only fair to give you the first shot.

We know you will want to do a walk through of the property, but my husband doesn't want me to advertise the address as a measure of safety. Last time we did that without verifying people, the empty property was broken into and vandalized. We don't want that to happen again! You will be responsible for cable, internet, and phone, if you decide to have these services. Just to confirm, we DO allow pets at this property.

The rental term is 12-month lease, but can be switched into a 6-month lease if preferred. We just ask that you give us fair notice if you are moving out.

If you would like to set up an appointment, go to the link below and request the free copy of your rental report. We use this site for all the properties we manage. Just fill out the form and indicate that you want the free report. The actual scores aren't important to us, it's more of a formality to have it on file, to make sure there are no previous proerty related issues.

Get your report here: FULL REPORT

Remember, we only need to see the page about the rental history. That will be all you will need to bring with you to the showing.

As far as getting together to see the property goes, I am available to show it any time from 10:00 am on, for the next few days. Let me know once you have it printed out, and we will set up a time to do your walk-through.

Thank you once again for your interest!

Stacy












"When you start off by telling those who disagree with you that
your mind." -- Donald Knuth
"... the designer of a new system must not only be the implementor
"Rules of Optimization:"
-- Henry Spencer
but you don't have to do it this way. That's their fundamental

I don't think I put in enough info on the site but I'm still worried...
Went to annualcreditreport.com instead and purchased another report through there (apparently I already used up my free one).
By the time I replied back to the email address it came back with a "delivery failure" so I googled the email address and confirmed my fear.
Cancelled my credit card just in case. Hope everything's going to be ok. Kind of a crappy way to start the New Year...

Thank you very much for this site.

Hey guys,

I have had nothing but problems finding a place on Craigslist because of this Phishing email. If you click the link it will take you to a website, then it quickly forwards to the credit bureau Equifax. The middle website installs a keyboard recorder, so anything you type is saved and sent back to them so that they can try and steal your ID.

Now being tech savy, I checked the full header and went through my email from her. It comes from an IP of 216.24.194.46, which is linked to Pyschz.net. They say they are located in Walnut CA. I have sent an email to the Domain name administrator to stop with this activity. Under the Whois Domain name database rules, the email has to be a valid email address and if I get no response the internet provider will pull the domain name down and no more emails can go out from them. I will keep doing this until it stops. I will post the contact information when I have all of it here and everyone can send a complaint email. this will overwhelm them and make them take action. A lot of times one complaint wont do it, but multiple will.

Check your full header and post the IP address here and I can reverse look up the information needed to track them down. Here is an example of the header when looking at the full deal. this is a yahoo account...I will blur out my private info. FYI her Hotmail account is bogus. I tagged the IP in Blue font below, the 98. IP is Yahoo's email servers.

From Stacy Thu Jan 3 06:27:55 2013
X-Apparently-To: [email protected] via 98.139.214.243; Thu, 03 Jan 2013 06:27:54 -0800
Return-Path: <[email protected]>
Received-SPF: softfail (transitioning domain of hotmail.com does not designate 98.136.217.80 as permitted sender)
byB5b3UgZWFybGllciwgSSBoYXZlIGJlZW4gZXh0cmVtZWx5IGJ1c3kgdGhl
IGxhc3QgZmV3IGRheXMhIFRoZSBnb29kIG5ld3MgaXMgdGhhdCB0aGUgcmVu
dGFsIGlzIHN0aWxsIGF2YWlsYWJsZSEgV2UgaGFkIGEgdGVudGF0aXZlIGFn
cmVlbWVudCBmcm9tIHRoZSBmaXJzdCBwZXJzb24gd2Ugc2hvd2VkIGl0IHRv
LCBidXQgbm93IGl0IHNlZW1zIHRoYXQgdGhleSBjaGFuZ2VkIAEwAQEBAQN0
ZXh0L3BsYWluAwMwAgN0ZXh0L2h0bWwDAzM-
X-YMailISG: AWt3EoEWLDtWjZcWYU0cpG.Vpl.LYCflYT3afC2Qe6j1UmEQ
ANjVeelgLovaBhVK8ZZ8I5IGpkihHySJafun4WxSzWmuOOyVKNsZtZa3BsSU
Q1kqRVohslLjW_Bqd0r8nGccrtZSxoGqffigsKWAPGEgjwfgqriNOQ7ZUUQE
SB34YJXdLfLoncdQfLiCIQI8j..Qfb55HXKFaQQFXrAll_oLldVyPiIvKoTX
fyYz88E3NGTbb.GDeIA.Ku_n9t_fZlC9goEOZ8gpCr2TYBsHoyQU4ljxVCuH
7_MMaTfscqHVa3rgycKHIT5Oh5VBMWo60baG0r2NgWbphbsNSqygNJJSIMUu
DJSvv.278Hifgbnrw.n13omklbROz8Yp2vOCGe3p2l0W4g8kze88HYj3Pzkv
KdriVLcFwXVYdg9ULMUxLe9mXMCTaF2B.m2e.g7__WAETFo7819I84nlVFO3
mBfaIlvCPRZcSiFHx8tXq8KONVGb18bF1Z9FaAS8coiYiH3CHAQTWfSYhkVE
IA1TUPi56Qm5Prr_Mv3sLCvh16.pThm2NQ1QblGGPnrFMlUwcZgu_N9KHZLE
cPhY17Tdm4dCTdpi5vvpDSiwjApLIUiP8dGCZKViEev_dmYhX52auHtONDpv
qfmg9JrqGpD5yJWWBUnFm_CDdk3x.IxSu396uTT_kgINAE4xT0Yq5.rzGseL
JRd6JmnHyRT5Ljl2R7donTGvrU97RPlqXjgXZKJGPUutjGnlAMtmgs1RA430
xd7ghJxGK9XtPllbqtVekD3OYRql2bZQT6yu0fBWgm2FtVSPjr.CPhpJmmZI
pWp.53FTsglgqP289yoQw2yCDJ9gF9laHy75DXhQlgBp3mt_8rvfFiNoZbTg
N_INZNMruulpIZuTsCSjBz2Sk8F9_cOiMY2FgLggBS7_rG.cGBl.OGg.Jit.
HMvzOnCaI0eBlxrT0JrCMajzAo_7ELc7SFKSryqJU_V.deEOAr2iBB.YcV47
_C9fqqB5r51ESiNmXPLgfyciRUVT.7NzkslSX5tL22TKg8PSmHsoQZMgCfGQ
rxSKYAQeuV5yzA_5Zk0hK43bKKfvAXHzoF.a05IWvUg3VgtVWk1tLwmy.Ppk
RLqNHuhU7hgjph9OOUAl7.luqC.eNk7E1JVvaGiOWbz1hoe7BZv9ZHfyx58y
Dahm.eF7qTN6ruMT.q15DlCR9P64WBqXqHbU.jmns0pyqYlg5I.vksZ0vUd6
19brZI5jMgxK6yqfQ51q5l6s0Vk8oyNsXwNHeldneUHHl9nIdDHruGbg.0Qv
hk9opx.cW1qHIhAL5fQVRa8uKlFFZEaW3dJJTZbfmE7tJHJ13X5dx4ov.ze2
86yfx5P11p3evgyO2ZMTth5YVc66u60-
X-Originating-IP: [98.136.217.80]
Authentication-Results: mta1372.mail.bf1.yahoo.com from=hotmail.com; domainkeys=neutral (no sig); from=hotmail.com; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO nm23-vm1.bullet.mail.gq1.yahoo.com) (98.136.217.80)
by mta1372.mail.bf1.yahoo.com with SMTP; Thu, 03 Jan 2013 06:27:54 -0800
Received: from [98.137.12.59] by nm23.bullet.mail.gq1.yahoo.com with NNFMP; 03 Jan 2013 14:27:53 -0000
Received: from [98.136.44.57] by tm4.bullet.mail.gq1.yahoo.com with NNFMP; 03 Jan 2013 14:27:52 -0000
Received: from [127.0.0.1] by smtp102.prem.mail.sp1.yahoo.com with NNFMP; 03 Jan 2013 14:27:52 -0000
X-Yahoo-Newman-Id: [email protected]
X-Yahoo-Newman-Property: ymail-3
X-YMail-OSG: bjBl1BcVM1lRmhSpHKD71GarClgg1FsO5aOKONoyJ4ptpS.
luBLjwI288byqm5gBHKG_I0azzgxCpn1i7h9a4Luu.NtDoqB3H_jQdEM5eGL
woYOKW0DLC4C_BOga..PC5MbLVMG4xmJ7UcUl2nmLcQj..mYY.melXdANJuY
L9MM5jCcyB9MJRZagYZ5SPGUA6xcyiEktix8e3vBZYbuLYfMCVrsxfmEMX9h
Nww4amNQHujCG4PufibxT3Bh89TEsyqWlDTss_HbW2IQrtba6PyMrKahSBPe
NfSW4yoOHO5.5uRKJ9_JL4tF3bFISkLETtHRefDRWwVYLSLhkWebbwbI2u56
dpsQsx2gPNOP82aKqBAri3s11kKhHoJcZl0vCW47KwWTHrhKPQP1CDYpAYhz
IS8pNytc6mNTE6alA.J74aRtdE2Uy5XRg3JrgDTciQl_gEVU2qH6MVZtj4uN
qiiVG2J91rlqWzXxaVO6plnvcMBznEfy1SY45xSQzjTv_jr1rHyAYnyzKetJ
25.ZsVzzZRzkg5NY-
X-Yahoo-SMTP: OGW8lvOswBDhXpB16Etaiq_AQgpWDmrAt3JHtGQ-
Received: from zap-server ([email protected] with login)
by smtp102.prem.mail.sp1.yahoo.com with SMTP; 03 Jan 2013 06:27:52 -0800 PST
MIME-Version: 1.0
Date: Thu, 03 Jan 2013 06:27:55 -0800
Message-ID: <CHILKAT-MID-3a632282-5422-9b64-dd37-9a038e8a6072@zap-server>
X-Mailer: Chilkat Software Inc (http://www.chilkatsoft.com)
X-Priority: 3 (Normal)
Subject: RE: Townhouse for rent
Reply-To: [email protected]
Return-Path: [email protected]
From: "Stacy" <[email protected]>
To: "Dave" <[email protected]>
Content-Type: multipart/alternative;
boundary="-----_chilkat_5eb_f71b_10e242c3.63f502b1_.ALT"
In-Reply-To: 1357143521.74787.YahooMailNeo@web161502 ... .yahoo.com
Content-Length: 5103


Below is the email I sent the domain registered owner.

Psychz Networks
20687-2 Amar RD. # 312
Walnut, CA 91789
US

Just gathering information on a Stacey Low who keeps posting ads on craiglist, and then try's to get people to click on her phishing link to a credit bureau. I will be contacting other people in regards to this spam and illegal activity. If I get no response from you then you are considered fake and that breaks the terms of the whois domain registration rules. I have an IP address 216.24.194.46 linked to unassigned.psychz.net sending out this spam. Please make it stop.

Thank You,

Dave


I'll keep you posted on any reply's

I too was sent an email from "Stacey". Same letter. What I DID notice first, was the email spelled stacey with an "E". At the bottom of the letter for signature, it's spelled without one. At the end of my letter was this as well:

"We are faced with an insurmountable opportunity." -- W. Kelley
"UNIX is simple. It just takes a genius to understand its
write bad code." -- Flon's Law
-- Donald Knuth
"The truth does not change according to our ability to stomach
civilisation." -- Gerald Weinberg


.... .WHO DOES THAT?!?!?!

My SOPHOS blocks the link stating it is Malware - Mal/HTMLgen-a

http://www.sophos.com/en-us//threat-cen ... Gen-A.aspx

I think it is good to have the Phishing and Malware protection on your browser enabled. It can be a pain sometimes, but for some people who are not too Internet savvy, it can save them money and grief.

My Mother who is very computer savvy, fell for the great pictures of the new apartments/houses on Craigslist and went through with the sign up. She only cottoned on when she received the same reply for another house listing.

Be safe all.

...At the end of my letter was this as well:

"We are faced with an insurmountable opportunity." -- W. Kelley
"UNIX is simple. It just takes a genius to understand its
write bad code." -- Flon's Law
-- Donald Knuth
"The truth does not change according to our ability to stomach
civilisation." -- Gerald Weinberg
.... .WHO DOES THAT?!?!?!

That is a sure sign of a spammer/scammer. You will see this on almost all of your spam you receive in your email.

"This is an attempt by spammers to defeat the content filters that spam blockers are using.

If an email contains little more than "Enlarge your body parts! Click Here to Buy!!!" then it's pretty easy for a program to score those words and zap the message as spam. But if that text is buried in an avalanche of meaningless text that has nothing to do with anything, the job of determining whether or not a message is good or bad becomes much harder." Read more: http://askbobrankin.com/nonsense_words_ ... z2H7z8wXvX

Ok, I fell for this too. First time I've ever been taken in by a Craigslist scam, and I feel like a total fool. I received the exact same email that others have posted, this one for an apartment in Glen Park (SF Bay Area). I foolishly clicked the link, saw that it had taken me to Equifax, and entered in my information - all of it - and got the credit report. Only then did I think to google it. As soon as I saw this forum, I cancelled my credit card, and ordered a credit freeze through all three bureaus. But now I'm really paranoid about what davest67 said about a keylogger. I ran a full system scan with Symantec, but it didn't turn up anything. davest67, do you know anything about what keylogger they are using, if any, and where it is stored? I'm tired of using the onscreen keyboard to log into things, and I'd like to know once and for all if there is a keylogger here or not.

Thanks for posting this information, all. Thanks to you I was able to lock down my credit within an hour, so hopefully everything will be ok. Hopefully.

-Bay Area Renter

Thanks for the warning. I received the following email today in response to this ad on craigslist http://sfbay.craigslist.org/sby/apa/3542754565.html . I am glad that I came across your post as I was about to fill out the form.

-------------------------------------------------------------
From: Stacy <[email protected]>
Sent: Monday, January 14, 2013 6:41 AM
Subject: RE: $1935 / 2br - Beautiful 2BR/2BA condo for rent (milpitas)

Hello,
I apologize for not responding to you earlier, I have been extremely busy the last few days!
The good news is that the rental is still available! We had a tentative agreement from the first person we showed it to, but now it seems that they changed their mind, so we need to lease it as soon as possible. You were the second one to email me about it, so its only fair to give you the first shot.
We know you will want to do a walk through of the property, but my husband doesn't want me to advertise the address as a measure of safety. Last time we did that without verifying people, the empty property was broken into and vandalized. We don't want that to happen again! You will be responsible for cable, internet, and phone, if you decide to have these services. Just to confirm, we DO allow pets at this property.
The rental term is 12-month lease, but can be switched into a 6-month lease if preferred. We just ask that you give us fair notice if you are moving out.
If you would like to set up an appointment, go to the link below and request the free copy of your rental report. We use this site for all the properties we manage. Just fill out the form and indicate that you want the free report. The actual scores aren't important to us, it's more of a formality to have it on file, to make sure there are no previous proerty related issues.
Get your report here: FULL REPORT

Remember, we only need to see the page about the rental history. That will be all you will need to bring with you to the showing.
As far as getting together to see the property goes, I am available to show it any time from 10:00 am on, for the next few days. Let me know once you have it printed out, and we will set up a time to do your walk-through.
Thank you once again for your interest!

Stacy

I to got the exact same email as everyone else concerning Stacy. Luckily I'm a puter geek and didn't click the link...i wanted to look up her email first and found this site. This is cruel, I need a place by next month or on the street.....can I trust anyone on Craigslist? Thanks for this site...

Stacy <[email protected]>


Hello,

I apologize for not responding to you earlier, I have been extremely busy the last few days!

The good news is that the rental is still available! We thougth we had the place rented to a couple we showed it to last week, but now it seemss that they changed their mind, so we need to lease it as soon as possible. You were the second one to email me about it.

I am sure you will want to do a walk through of the property, but my husband doesn't want me to advertise the address as a measure of safety. Last time we did that without verifying people, the empty property was broken into and vandalized. We don't want that to happen again! You will be responsible for cable, internet, and phone, if you decide to have these services. Just to confirm, we DO allow pets at this property.

The rental term is 12-month lease, but can be switched into a 6-month lease if preferred. We just ask that you give us fair notice if you are moving out.

If you would like to set up an appointment, go to the link below and request the free copy of your rental report. We use this site for all the properties we manage. Just fill out the form and indicate that you want the free report. The actual scores aren't important to us, it's more of a formality to have it on file, to make sure there are no previous property related issues.

Get your report here: FULL REPORT

Remember, we only need to see the page about the rental history. That will be all you will need to bring with you to the showing.

As far as getting together to see the property goes, I am available to show it any time from 10:00 am on, for the next few days. Let me know once you have it printed out, and we will set up a time to do your walk-through.

Thank you once again for your interest!

Stacy












"I do not find in Christianity one redeeming feature."
"Copy and paste is a design error" -- David Parnas
the way you think."
"Say what you will about the Ten Commandments, you must always
experience, we still feel that way."
"Software obeys the law of gaseous expansion - it continues to

I just got this scam as well. The advertisement was on Craigslist for a home in San Carlos. When I inquired, received the same form letter to obtain the Experian credit report and bring it with me to an upcoming showing. Thankfully, Craigslist flagged and removed the posting, but not until after I had already seen it. The ad was up for about 24 hours.

Hi Everyone,
Eager to find reasonable housing I fell for the exact same email from "Stacey Low". I began entering my personal information on the first page of what looked to be the Equifax website, hit continue, and began to enter my credit info. I got called to dinner and deleted my credit card information before hitting submit. I also hit the back arrow and deleted my other information. When I went back to redo the process an hour later, the link directed me to the Google home page. That is when I noticed the link looked fishy. I am worried that someone now has my social and other personal information.

Can anyone tell me if hitting the next button on the first page would transmit this to a fraudulent location? Would my credit card info have gone through if i never hit submit?

Has anyone had anything happen to their credit or other repercussions? I am nervous, this is the first scam i have fallen for.

Any incite would be much appreciated.

Thanks!

Thanks for posting this, it saved me a lot of time. I knew the ad looked fishy, no exterior picture, no address, no telephone number, very few pictures etc.

Does anyone know if this can be reported to the district attorney or some other law enforcing agency, these people seem to have been operating for quite some time.

All I can say is if you think your information has been compromised to place a security freeze on your credit report with all 3 credit bureaus (Experian, Equifax, and Transunion) . Ref: http://www.experian.com/consumer/security_freeze.html Also, there is a paid service called LifeLock that sends you warnings when your credit report is requested etc, you can Google it and find out more.

This is the Ad in Craigslist that I ran into:
http://sfbay.craigslist.org/eby/apa/3567160868.html

Thanks!
Ronald

@Darn: I happen to be a software engineer and I have not seen the credit report site because its been blocked by Umbrella Security http://malware.opendns.com/main?url=credteresche.cz.cc%2F6cP644nwR2Mgkk0Wlhbbag&nref=&w=1287&h=894&ifc=0

but I can tell you if you click next or any link or button on a web page any information entered so far could have been submitted (depending on how the web page/site is built) many pages now adays save the info entered in increments as the user enters next and the final submit button finalizes he data entry. So I would say whatever info you entered before clicking next is at risk. I would place a security freeze on all 3 credit bureaus if I were you.

Best of Luck,

Ronald

Hi Everyone,
Eager to find reasonable housing I fell for the exact same email from "Stacey Low". I began entering my personal information on the first page of what looked to be the Equifax website, hit continue, and began to enter my credit info. I got called to dinner and deleted my credit card information before hitting submit. I also hit the back arrow and deleted my other information. When I went back to redo the process an hour later, the link directed me to the Google home page. That is when I noticed the link looked fishy. I am worried that someone now has my social and other personal information.

Can anyone tell me if hitting the next button on the first page would transmit this to a fraudulent location? Would my credit card info have gone through if i never hit submit?

Has anyone had anything happen to their credit or other repercussions? I am nervous, this is the first scam i have fallen for.

Any incite would be much appreciated.

Thanks!

Wow I am just amazed at the length people will go to. I am glad I followed my mind on this one. This person is still doing the thing. I responded to the email she or whoever sent stating that I have my credit report and did now need to run it, and that I montor it frequently. Today I decided to google the name stacey low and found this site. I am glad that there are still honest people out there.

Thanks