[Beware] Scammer on TZ-UK - user 'okzbow' (maybe more?)

Printable View

24th January 2020, 17:55
cman

[Beware] Scammer on TZ-UK - user 'okzbow' (maybe more?)

Hi all, scammer alert. Or hacker alert, as I think is the case here.

I have something posted in SC and was contacted by a 'member' expressing an interest. It was fishy from the beginning:

This morning:

https://i.imgur.com/p07Kvil.png

Before proceeding to send an email, I did a quick check on the user's posts.... yes seemed genuine enough, albeit somewhat dated.

I knew signing off with 'N' did not tally up with how they have signed off on their TZ posts. So, I proceeded with a very tentative email:

https://i.imgur.com/338KGOo.png

Here is the response a short while ago:

https://i.imgur.com/bcuqjPi.png

Pure scammer talk.
The item is not marked as sold.
Asking about shipping when it's not relevant.
Asking me to click - what seems like - a genuine link? It is not....

It reads as follows: https://forum.tz-uk.com/forum.php/35334435

But it points to this location: http://tz-uk.foruptu.com/

...and see what that location looks like:

https://i.imgur.com/Lp4gMi7.png

Yes, that's right. An attempted mirror of TZ-UK forcing you to enter your username and password so they can capture your details as you submit them.

When I was suspicious earlier this morning, and took a look at TZ-UK profile of okzbow, I could see his activity was erratic, always being in PM's and with different user names.
I suspect many other people who have items in SC have received this type of contact.
I'm almost certain 'ingenioren' would've been PM'd by this guy, as that was the last PM activity I last saw last on the profile of okzbow. If you're reading ingenioren, watch out!

One can assume okzbow was tricked into this and hence the 'scammer' using his profile to contact other members.

By the way the bikes are still available :witless::welcoming:
24th January 2020, 17:59
Macca

[Beware] Scammer on TZ-UK - user 'okzbow' (maybe more?)

I replied to his pm saying I had no idea what he was on about.. I don’t click links I didn’t ask for but that looks bad on the face of it.. bad scammer though he tried buying a seiko off me I never owned lol.. mine didn’t have a link I’ve screen shotted it

Hope nobody got caught up in it

https://uploads.tapatalk-cdn.com/202...584f596f4e.jpg

Sent from my iPhone using Tapatalk
24th January 2020, 18:02
wjkerfoot

Exactly the same email that I received this morning & with the same ‘fake’ link to TZ-UK.

I didn’t send any bank or PP details.

Be careful out there.

Sent from my iPhone using Tapatalk
24th January 2020, 18:05
Bluetinfloor

Me too
24th January 2020, 18:11
xellos99

He messaged me on here asking me to email him also. I replied and said I only talk on the forum so I never emailed him or her, whoever they really are
24th January 2020, 18:14
Foxy100

Good work cman, I suspect a lot of us would have clicked that link without necessarily checking. In fact I wonder if anyone has entered their details - time to be on the lookout for any suspicious PMs.
24th January 2020, 18:15
swanbourne

The okzbow account has now been banned but there may be more so PLEASE let me know so I can do some tidying up.

Regards,

Eddie
24th January 2020, 18:15
Captain Morgan

I just tried to log into that fake site but I might have got my email and password a bit wrong ;-)
24th January 2020, 18:23
luckyal

Me too

I'd reported my very similar approach re my Zenith on SC to Eddie this afternoon.......

Fishy AF as the kids say apparently.
24th January 2020, 18:28
swanbourne

That website address must be disguised because an ICANN WHOIS search on tz-uk.foruptu.com returns

Quote:

The requested domain was not found in the Registry or Registrar's RDAP server.

The page source contains an IP address which comes back to Virgin Media in Camden Town.

Quote:

!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<meta http-equiv="X-UA-Compatible" content="ie=edge">
<title>TZ-UK Forums</title>
<link rel="stylesheet" href="style.css">
</head>
<body>
<div class="all">
<div class="header"header></div>
<div class="user"user>
<form action="action.php" method="post">

<input type="hidden" name="ip" value="92.236.33.227" />
<input type="hidden" name="httpref" value="" />

<input type="hidden" name="ip" value="92.236.33.227" />

<input type="text" name="visitormail" class="u-name">

<input type="password" name="nameis" class="pass">
<br>
<input type="checkbox" class="check">
<br>
<button type="submit" class="bt-1">Log in</button>
<button type="reset" class="bt-2">Reset Fields</button>
</form>

</div>

<div class="footer"footer></div>

</div>
</body>
</html>

Eddie
24th January 2020, 20:16
dizz

Had an email today (with a clickable link) saying I had a PM, I logged on through TapaTalk and there was nothing in my inbox I can only assume it was an attempt to get my password etc via the email link.

Sent from my iPad using Tapatalk
24th January 2020, 20:52
Macca

Quote:

Originally Posted by swanbourne

The okzbow account has now been banned but there may be more so PLEASE let me know so I can do some tidying up.

Regards,

Eddie

Thanks Eddie [emoji106]

Sent from my iPhone using Tapatalk
24th January 2020, 20:52
wjkerfoot

[Beware] Scammer on TZ-UK - user 'okzbow' (maybe more?)

My second one of the day

https://uploads.tapatalk-cdn.com/202...3b63960b1a.jpg

Sent from my iPhone using Tapatalk
24th January 2020, 21:00
Andyp1973

Thanks for the heads up.

He’s emailed me the same thing offering to buy my ORIS that currently up for sale.

Same MO and link.

I have emailed him but no personal details have been sent. I was deliberately vague as I though something was off when Mac didn’t recognise the website.

Sent from my iPhone using Tapatalk
24th January 2020, 21:27
RajLondon

Thanks Eddie. Received an email as well. Looked at the profile and it didn't seem right. Its good that there are vigilant members here!
24th January 2020, 21:35
wjkerfoot

Can I ask what is maybe a naive question? What’s the scam?

Sent from my iPhone using Tapatalk
24th January 2020, 21:37
Macca

Quote:

Originally Posted by wjkerfoot

Can I ask what is maybe a naive question? What’s the scam?

Sent from my iPhone using Tapatalk

I’m not going to click to find out but often they are after your financial info or worse could be ransomware or malware

Sent from my iPhone using Tapatalk
24th January 2020, 21:41
wjkerfoot

Quote:

Originally Posted by Macca

I’m not going to click to find out but often they are after your financial info or worse could be ransomware or malware

Sent from my iPhone using Tapatalk

I understand that but it takes you to what is obviously a clone TZ forum where it asks you to log-in.
I’m assuming that most of us have the forum as a favourite which would automatically log you in, unlike the fake site, which doesn’t, so red flags immediately.

Sent from my iPhone using Tapatalk
24th January 2020, 22:27
Macca

Yeah I have a link stored and wouldn’t use that one, I’m really not desperate to find out what happens if I were to log in though.. could just be for stealing logins if someone is being a bit of a cretin

Sent from my iPhone using Tapatalk
24th January 2020, 22:54
chicaneuk

PM'd me too. Replied saying they'd made a mistake but I think it should have set off my scammer alarm.
24th January 2020, 23:06
PreacherCain

Should I feel offended that I didn’t get a PM...? 🤔 😉
24th January 2020, 23:17
oldoakknives

Quote:

Originally Posted by wjkerfoot

Can I ask what is maybe a naive question? What’s the scam?

Sent from my iPhone using Tapatalk

If they get your log in details with password, they can try to find you on other sites etc. and some people use the same passwords on more than one site. And if they ask for your name and address and bank details to 'pay' for something then they can try logging in on your bank website etc. They do this for a living so no doubt there's much more they can try.
24th January 2020, 23:17
oldoakknives

Quote:

Originally Posted by PreacherCain

Should I feel offended that I didn’t get a PM...? 樂 

PM sent. :icon_biggrin:
25th January 2020, 00:26
vulcangascompany

I got a PM this morning about my iPhone, they wanted me to go off PM and to their gmail - i said no, no response after that.
25th January 2020, 00:54
Seamaster73

Quote:

Originally Posted by swanbourne

The page source contains an IP address which comes back to Virgin Media in Camden Town.

London is the new Nigeria.
25th January 2020, 08:37
Boss13

Quote:

Originally Posted by oldoakknives

If they get your log in details with password, they can try to find you on other sites etc. and some people use the same passwords on more than one site. And if they ask for your name and address and bank details to 'pay' for something then they can try logging in on your bank website etc. They do this for a living so no doubt there's much more they can try.

Or a lot simpler attempt to list things on SC using member accounts and await bank transfers to their scam accounts.

If they manage to get hold of login details for members who are not so active it may work.

Beware of any upcoming SC bargains!

Sent from my SM-N950F using Tapatalk
25th January 2020, 08:47
joe narvey

Dear all, do not click on a link to view the phishing site. Accessing the site may infect your computer. Capturing you logon credential may not be as simple as asking you to logon, but malware can be installed from accessing the home page of the fake site.

If you did access it then virus scan your machine. Once clean change passwords using the link to the site you normally use in your book marked sites or type it in by hand, do not follow a link.

Suggest you delete the email from the fraudster as they can be used to drop code onto your machine.
25th January 2020, 10:54
konlew

Good work - we have to be careful!
25th January 2020, 11:52
SuperVM

Thanks a lot OP, always good when someone raises these things with the rest of the forum rather than simply ignoring it.
27th January 2020, 21:10
Filterlab

Very interesting, and thanks for the good work.

One of my iPhones had a login problem, refusing to find my details from the keychain. Now I know why.

Needless to say I didn’t enter my details, just used the other phone.
28th January 2020, 11:52
Scepticalist

Quote:

Originally Posted by swanbourne

That website address must be disguised because an ICANN WHOIS search on tz-uk.foruptu.com returns

The page source contains an IP address which comes back to Virgin Media in Camden Town.
Eddie

You should report to VM if possible. That IP address is likely to be very traceable by them to a specific user.
29th January 2020, 09:11
Xantiagib

Quote:

Originally Posted by Scepticalist

You should report to VM if possible. That IP address is likely to be very traceable by them to a specific user.

The HTML code could have been copied and pasted from somewhere - doesn't mean the bloke was ever in London.... though most likely he was as he seems clever enough to craft a fake tz-uk login page but dumb enough not to read the actualy replies to set up the sales... perhaps a bot?

Goes without saying but:

Don't keep your personal details or bank details in your private messages.....

Do change your password if you think you used the fake link...
29th January 2020, 16:53
tixntox

Delete all personal messages as soon as you don't need them. They may contain contacts and personal details etc.
29th January 2020, 17:10
Rob s

Good catch. Good to see people looking out for the other members.
31st January 2020, 11:23
Steve B

Quote:

Originally Posted by Rob s

Good catch. Good to see people looking out for the other members.

Earlier this week I had my account compromised, first I knew was a PM about an explorer watch. How anyone got my details is beyond me, I am always very careful with passwords etc, in the meantime I have changed all my passwords for email accounts and other sites. I apologise if this caused any angst among the forum members and it was good to see that my small c*ck alter ego :smug: was challenged by others, I just hope no one got scammed. A warning to us all I suppose that we are being targeted by some very unscrupulous people. Steve
31st January 2020, 13:16
Raffe

Quote:

Originally Posted by Steve B

Earlier this week I had my account compromised, first I knew was a PM about an explorer watch. How anyone got my details is beyond me, I am always very careful with passwords etc, in the meantime I have changed all my passwords for email accounts and other sites. I apologise if this caused any angst among the forum members and it was good to see that my small c*ck alter ego :smug: was challenged by others, I just hope no one got scammed. A warning to us all I suppose that we are being targeted by some very unscrupulous people. Steve

Good to have you back.

I think it's still interesting to get to the bottom of how they gained access to your account in order to warn others.

Did you use the same password across a number of sites?
Did you recently see an unusual or unexpected log in request for TZ?
Die you get unusual emails referring to any TZ business?
31st January 2020, 15:01
Steve B

Raffe

thanks for the reply, I honestly don't know how they gained access

Did you use the same password across a number of sites? No I always use different passwords
Did you recently see an unusual or unexpected log in request for TZ? No, nothing at all
Die you get unusual emails referring to any TZ business? As i my previous comment first I knew was Wednesday morning I received a notification of a PM regarding a Rolex Explorer watch that was for sale by me (I hadn't one for sale) this set alarm bells ringing as I don't have an Explorer.

When I logged on a few hours later when I got home I had been banned by Eddie! I'm just happy that it got rumbled pretty quickly and no one got scammed.

Steve

Quote:

Originally Posted by Raffe

Good to have you back.

I think it's still interesting to get to the bottom of how they gained access to your account in order to warn others.

Did you use the same password across a number of sites?
Did you recently see an unusual or unexpected log in request for TZ?
Die you get unusual emails referring to any TZ business?
31st January 2020, 22:48
Raffe

Quote:

Originally Posted by Steve B

Raffe

thanks for the reply, I honestly don't know how they gained access

Did you use the same password across a number of sites? No I always use different passwords
Did you recently see an unusual or unexpected log in request for TZ? No, nothing at all
Die you get unusual emails referring to any TZ business? As i my previous comment first I knew was Wednesday morning I received a notification of a PM regarding a Rolex Explorer watch that was for sale by me (I hadn't one for sale) this set alarm bells ringing as I don't have an Explorer.

When I logged on a few hours later when I got home I had been banned by Eddie! I'm just happy that it got rumbled pretty quickly and no one got scammed.

Steve

Very strange, all of it. Pity if we never learn how it happened, leaves the door open for them to repeat the stunt with someone else.
1st February 2020, 18:06
cman

The number of site visitors may indicate unusual activity...
For example, check the time stamp, for which the 'most users ever' of this forum was:

https://i.imgur.com/mrj05Iv.png

Must be a lot of bots...?
2nd February 2020, 13:28
trott3r

Might be a good idea test you passwords strength i use: https://howsecureismypassword.net/

I also use keepassxc (which does not sync over the internet) to generate passowords and store them.