Another Craigslist Scam

A friend of mine got suspicious about an ad on Spokane's Craiglist and brought it to my attention.


The ad is for a 2008 Yamaha Grizzly Special Edition being sold for $3800 with only 188 miles on it. A new one would have set you back $8900 so a used one with only 188 miles for $3800 almost sounds too good to be true.

Almost?

The first thing I noticed about the ad was that the description was in an image file instead of typed in. Why would you do that--unless you planned on using that same image elsewhere? I checked out the HTML of the ad and found this: (I mangled the HTML so it'll show up in the post)

(a href="http://foormac.com/ygrizzly/" target="_blank" rel="nofollow">(img src="http://i973.photobucket.com/albums/ae214/sergiorodrigo/5a.jpg">(img src="http://i973.photobucket.com/albums/ae214/sergiorodrigo/5.jpg">

The two images, the description of the Yamaha and the four-picture collage, come from an account on Photobucket called sergiorodrigo. They are the only two images in the account. (As an aside, that pale blue display just doesn't look right to me. I would expect a monochrome display. But I can't say for sure because I don't know squat about the Yamaha Grizzly, Special Edition or not.)

As you can also tell from the (mangled) HTML, clicking on the images sends you to http://foormac.com/ygrizzly/.

First I looked at the domain registration info of foormac.com.

Registrant:
Holly Swope
410 Kensington Park Apt. A
Jefferson City, Missouri 65109
US

Domain name: FOORMAC.COM

Administrative Contact:
Swope, Holly gu.nloyemowu@gmail.com
410 Kensington Park Apt. A
Jefferson City, Missouri 65109
US
+1.5733016566

Registrar of Record: TUCOWS, INC.
Record last updated on 16-Dec-2009.
Record expires on 31-Aug-2011.
Record created on 31-Aug-2009.

A a whitepages search and a pipl search of Holly Swope in Missouri came up empty. Holly's phone is a Cingular cell phone number.

Sending your browser straight to foormac.com gets you a page that simply says "Holding page for 123-reg" which means the default page has never been updated--since Aug 31, 2009. Netcraft says the site is located in the United Kingdom.

Nothing seems out of the ordinary so far, right?

Here's the form on foormac.com you get after clicking on either image in the ad:
So I checked the HTML on this and found:

(form name="frmSample" method="post"
action="http://ezegroup.com.au/images/menu/ygrizzly.php" onSubmit="return
ValidateForm()">

The email form sends the data to and executes code on a server presumably based in Australia. I went to the ezegroup site.

The Eze Group of Companies professional services and products are designed and targeted towards reducing operational costs, escalating turnover and increasing the profile of your business.

Our products and services are designed to enhance your business and reduce your management workload. We make no secret about wanting you as our client for life.

I guess using an image instead of typing the same stuff over and over would reduce operational costs. Posting the same ad in a multitude of cities--and claiming that item is in that city-- would increase the profile of your business. I wonder if the Eze Group knows how some people are trying to make eze money using their eze servers.

A Google search for "ezegroup.com.au" and "ask a question" gave me this result:

http://ezegroup.com.au/image/1/

Which led to another form. Wow, deja vu all over again.

Just for grins I changed "http://ezegroup.com.au/image/1/" to "http://ezegroup.com.au/image/2/". It worked! I got another form. It also worked for the numbers 3 through 8, each one with an identical form to ask about a different item.

I advised my friend that when he finds something on Craigslist, he should do a search of the description. Had he done so with this Yamaha Grizzly, he would have found it was advertised in many places. Some have been taken down, but here are a couple that are still up as of this writing: Atlanta, Louisville, and Ann Arbor.

And, as always, if it sounds too good to be true--it is!