In my last post, we exposed a scammer who used a famous actress’s identity to scam people. In this post, I will expose a new scammer who went by the name ‘Mary J.’ This time, she found me on the encrypted app Signal. She claimed to have lived in Buffalo, NY, for the past seven years but was born in Portland, Oregon.
She first tried to get to know me by asking similar questions that the first scammer asked, such as my name, age, and where I lived. Of course, I made up information. I told her I lived in Utica, New York. She even asked if I had ever been married, and I told her I was 36 years old.
She asked if I lived alone, to which I replied that I lived in a log cabin by myself. She also asked if I had ever been in an online relationship, which I found interesting because it’s a strange question to ask a complete stranger on the internet. This leads me to believe it might be a romance scam.
She asked what I liked to do, and I told her what she liked to do. These included fishing, dirt bike riding, snowboarding, and clubbing. The scammer was using the social engineering technique of familiarity to build trust so I would fall for whatever scam they were attempting to pull. I suspect that she claimed to be into a wide range of hobbies to create a sense of connection and rapport with me.
Mary also asked for a picture of me, which I sent as a random image of some guy. I think once again she was trying to get me more familiar with her and attempting to build trust. Maybe she even asked for an image to make sure I was a man.
Mary’s Information
Once again, I used social engineering to get Mary to click a link that logged her IP. I will not reveal how I achieved this, as it could allow scammers to learn about it.
| IP | 164.152.105.157 |
| Internet Service Provider | Oracle-BMC-31898 |
| Local IP | 192.168.12.172 |
| Location | Chicago, United States ( detected as possible vpn or proxy ) |
| Browser | Chrome Mobile |
| OS | Android 10 |
| Time Zone | Africa/Lagos GM+1 |
I asked “Mary” for a selfie, she sent the image below.
Sadly, I tried to use tineye.com and Google to search for the image on the internet, but I did not find any traces. Also, since Signal removes metadata from the image, I could not get any other information about it.
After I asked her for an image of herself, she asked if I could send another image of myself. I took the opportunity to IP log her again to see if it’s the same device and IP from earlier.
| IP | 102.89.34.172 |
| Country | Nigera, Lagos |
| Screen Size | 384 x 832 @ 60Hz |
| Local IP | 10.161.27.149 |
| Browser | Chrome Mobile 132.0.0.0 |
| Operating System | Android 10 |
| Platform | Linux armv81 |
| Internet Service Provider | MTN NIGERIA Communication limited |
I tired to keep the scammer, Mary engaged by asking them who they wanted to win the Super Bowl. She responded with the response below.
It is a strange question to ask some random person on the internet who my phone carrier is. I asked her why she needed my phone carrier, she responded with the message below.
I was able to convince the scammer into giving me the address where I was supposed to be sending the phones that would be shipped to my house. Something that I had no intention in going through with the plan, I just want to get as much information about the scammer and how they operate, with the intention of educating other people that may fall from this scam.
Jan Lupschen
Parkstraat 36
6443 VP - Brunssum
The Netherlands south
Above is a screenshot of the address where I am supposed to send the phones to.
So this person found me in a public signal chat, apparently they check that chat as I mentioned that “she” was a scammer and about an hour later she private messaged me with screenshot of me warning others about her. They or “she” were not happy about it. Of course I just ignored her comments and changed the subject.
Leave a Reply