Fancy scam here?
Discussion started by Karen Mardahl , on 20 August 10:27 AM

Dang. I think I have been scammed. Mid-July, I received a mail via our site contact form at stc-access.org from a Girl Scout Troup Leader. They had been doing some research using stc-access.org and found it valuable. As thanks, they had a link to share with me for the site.

I checked the Whois, but it didn't work that day. I thought, how can I suspect the Girl Scouts. The link they proposed wasn't totally dubious. I tend to shun all sites with fluff in their About page that can't tell me the people or the place behind the site. This one had an address, etc. so it seemed OK. I was also keen to help a young girl who was eager to help me. I wrote back when I had added the link and the Troup Leader wrote me a thank you email. All seemed well. Oh, her email address seemed legit, too.

Then today... I received another mail via our site contact form. This time, it's a woman tutoring a middle school boy. They found our site, yada yada, and the boy has a link for me. This time, it's what I call a dodgy link - no clear source for the info. The name itself makes me suspicious: autoinsurancecenter dot com. She says the boy is so motivated to do this, and she apologizes for the interruption. Her email is coloradotutors dot org. No such thing, says Google, but there's a dot com and without the s.

I suddenly checked both IP addresses.

The first one was 173 45 230 10.

The second one was 173 45 230 196. (I left out the delimiters on purpose.)

They are owned by Slicehost (connected to Rackspace). I didn't really get any closer to the source, but the proximity of those numbers and the parallels in the story make me feel I have been scammed. No financial damage, just link bait junk, but still. I am annoyed. I am especially annoyed that I fell for the kid angle. I even tweeted about the first one I thought it was so sweet!!

So... am I right in kicking myself or is there really a sweet middle school boy out there?

Regards, Karen Mardahl

Manager, AccessAbility SIG

Replies
You will need to be a member of this group first before you can post a reply.
Carol Anne Wall
I think you're right -- it's a scam. If I forget to block the comments on a blog post, you wouldn't believe all the scam spam that gets posted. Just go back and delete the links. Don't kick yourself -- the scammers are getting more clever every day with their social engineering.

Carol Anne
Academic SIG Communication Manager
Monday, 20 August 2012 17:06
 
Karen Mardahl
PS I have the details from both contacts if anyone is curious.
Also, I tend to be über-suspicious of many of these contact attempts. I don't click on unknown attachments, etc. I feel I have lots of experience. That is why it galls me if this is a scam that I fell for it and that my correspondence in the first instance was with a scammer.
Monday, 20 August 2012 10:34