Transaction on your Site; Possible Fraud

Discussion in 'Computer Support' started by Wereo_SUPREME43, Jul 18, 2007.

  1. You guys know everything about computers and beyond.

    I got 3 emails like this from my Site, from the same person, where I provide
    Music Downloads for sale at 99 cents per:

    Error code 506. Possible fraud. Error with REMOTE IP ADDRESS =
    66.211.180.66.
    The remote address of the script posting to this
    notify script does not match a valid PayPal ip address

    These are the valid IP Addresses:
    66.211.169.65,66.212.168.97,215.113.188.35,216.114.188.65,

    The Order ID received was: d023e749e8dec1fg6e528da24e13182a

    Does anyone know what this means? Incidentally I got a vibe to change these
    IP #'s slightly, but if need be I'll repost them as I got them.

    Many thanks for your help, Scott.
     
    Wereo_SUPREME43, Jul 18, 2007
    #1
    1. Advertising

  2. Wereo_SUPREME43

    Mike Easter Guest

    Wereo_SUPREME43 wrote:
    > I got 3 emails like this from my Site, from the same person, where I
    > provide Music Downloads for sale at 99 cents per:
    >
    > Error code 506. Possible fraud. Error with REMOTE IP ADDRESS =
    > 66.211.180.66.


    Presumably you have decided to display a bogus IP here instead of a real
    IP.

    > The remote address of the script posting to
    > this notify script does not match a valid PayPal ip address
    >
    > These are the valid IP Addresses:
    > 66.211.169.65,66.212.168.97,215.113.188.35,216.114.188.65,


    Presumably you have decided to display bogus IPs here instead of the
    real IP.

    > The Order ID received was:
    > d023e749e8dec1fg6e528da24e13182a
    >
    > Does anyone know what this means? Incidentally I got a vibe to change
    > these IP #'s slightly, but if need be I'll repost them as I got them.


    Presumably your brain is vibrating/vibing inside your head instead of
    not vibrating/vibing.

    What are we supposed to do with bogus IPs?

    --
    Mike Easter
     
    Mike Easter, Jul 18, 2007
    #2
    1. Advertising

  3. Wereo_SUPREME43

    why? Guest

    On Tue, 17 Jul 2007 22:50:50 -0400, Wereo_SUPREME43 wrote:

    >You guys know everything about computers and beyond.
    >
    >I got 3 emails like this from my Site, from the same person, where I provide


    Your site, you mean the shopping cart application hosted on your service
    provider?

    You have checked the email headers to see if the sender / originating IP
    matches a server you know is valid?

    Same person, so this is them telling you something rather than the
    administration side of the ordering process sending a email?

    >Music Downloads for sale at 99 cents per:


    Not important.

    Of course you mention the 99 cents, while at the same time didn't
    mention - shopping cart software or the versions / source of the scripts
    / provider try www.google.com first.


    >Error code 506. Possible fraud. Error with REMOTE IP ADDRESS =
    >66.211.180.66.


    That's -

    OrgName: eBay, Inc
    OrgID: EBAY
    Address: 2145 Hamilton Ave
    City: San Jose
    StateProv: CA
    PostalCode: 95008
    Country: US
    NetRange: 66.211.160.0 - 66.211.191.255
    CIDR: 66.211.160.0/19
    NetName: EBAY-2
    NetHandle: NET-66-211-160-0-1
    Parent: NET-66-0-0-0-0
    NetType: Direct Assignment
    NameServer: SJC-DNS1.EBAYDNS.COM
    NameServer: SJC-DNS2.EBAYDNS.COM
    NameServer: SMF-DNS1.EBAYDNS.COM
    NameServer: SMF-DNS2.EBAYDNS.COM
    Comment:
    RegDate: 2006-01-25
    Updated: 2006-01-25
    OrgTechHandle: EBAYN-ARIN
    OrgTechName: eBay Network
    OrgTechPhone: +1-408-376-7400
    OrgTechEmail: network<edited email addy removed the at>ebay.com
    # ARIN WHOIS database, last updated 2007-07-17 19:10
    # Enter ? for additional hints on searching ARIN's WHOIS database.
    OrgName: eBay, Inc

    at least that looks okay.

    > The remote address of the script posting to this
    >notify script does not match a valid PayPal ip address
    >
    > These are the valid IP Addresses:
    >66.211.169.65

    Ebay

    , 66.212.168.97
    An ISP
    Pathway Communications
    105 Commerce Valley Dr W
    Suite 500
    Markham, Ontario L3T 7W3
    CA
    Domain name: PATHCOM.COM

    , 215.113.188.35
    Seems odd, for paypal

    OrgName: DoD Network Information Center
    OrgID: DNIC
    Address: 3990 E. Broad Street
    City: Columbus
    StateProv: OH
    PostalCode: 43218
    Country: US
    NetRange: 215.0.0.0 - 215.255.255.255
    CIDR: 215.0.0.0/8
    NetName: DDN-NIC16
    NetHandle: NET-215-0-0-0-1
    Parent:
    NetType: Direct Allocation
    NameServer: CON1R.NIPR.MIL
    NameServer: CON2R.NIPR.MIL
    NameServer: EUR1R.NIPR.MIL
    NameServer: EUR2R.NIPR.MIL
    NameServer: PAC1R.NIPR.MIL
    NameServer: PAC2R.NIPR.MIL
    Comment:
    RegDate: 1998-06-05
    Updated: 2006-04-11
    OrgTechHandle: MIL-HSTMST-ARIN
    OrgTechName: Network DoD
    OrgTechPhone: +1-800-365-3642
    OrgTechEmail: HOSTMASTER<removed the at>nic.mil
    # ARIN WHOIS database, last updated 2007-07-17 19:10


    , 216.114.188.65

    OrgName: SoVerNet, Inc.
    OrgID: SOVR
    Address: 5 Rockingham Street
    City: Bellows Falls
    StateProv: VT
    PostalCode: 05101
    Country: US
    NetRange: 216.114.128.0 - 216.114.191.255
    CIDR: 216.114.128.0/18
    NetName: SOVER-NET-3
    NetHandle: NET-216-114-128-0-1
    Parent: NET-216-0-0-0-0
    NetType: Direct Allocation
    NameServer: CLOVER.SOVER.NET
    NameServer: APPLE.SOVER.NET
    Comment: ADDRESSES WITHIN THIS BLOCK ARE NON-PORTABLE
    RegDate: 2000-06-20
    Updated: 2004-03-09
    RTechHandle: NA22-ORG-ARIN
    RTechName: SoVerNet, Inc.
    RTechPhone: +1-802-463-2111
    RTechEmail: noc<removed at>sover.net
    OrgTechHandle: NOC1523-ARIN
    OrgTechName: Network Operations Center
    OrgTechPhone: +1-802-463-2111
    OrgTechEmail: noc<removed at>sover.net
    # ARIN WHOIS database, last updated 2007-07-17 19:10
    # Enter ? for additional hints on searching ARIN's WHOIS dat


    >
    > The Order ID received was: d023e749e8dec1fg6e528da24e13182a


    Means nothing unless you have access to the ordering system. In that
    case you confirmed this order id.

    >Does anyone know what this means? Incidentally I got a vibe to change these
    >IP #'s slightly, but if need be I'll repost them as I got them.


    If you had changed or did then tracing them is pointless in case was was
    a known problem site.

    >Many thanks for your help, Scott.


    Here is some help, www.google.com , OTOH ask the company that processes
    your payments.

    Web Results 1 - 10 of about 477,000 English pages for
    Error code 506. Possible fraud. . (0.10 seconds)

    VirtueMart: Your free e-commerce solution. - Error code 506 ...
    Error code 506. Possible fraud. Error with REMOTE IP ADDRESS =
    172.19.56.161. The remote address of the script posting to this notify
    script does not match ...
    http://virtuemart.net/index.php?option=com_smf&Itemid=71&?topic=25192.msg87421;topicseen
    - 66k - 17 Jul 2007 - Cached - Similar pages

    VirtueMart: Your free e-commerce solution. - Error Code 506 and ...
    + Error Code 506 and new Paypal IP - completely lost, please help. ... I
    GET AN 'ERROR 506' MESSAGE - 'POSSIBLE FRAUD' - THE PAYMENT GOES
    THROUGH, ...
    http://virtuemart.net/index.php?option=com_smf&Itemid=71&topic=30001.0;prev_next=next
    - 56k - Cached - Similar pages
    [ More results from virtuemart.net ]

    online marketing, search engine optimization, joomla, multi ...
    With the following message: Error code 506. Possible fraud. Error with
    REMOTE IP ADDRESS = 216.xxx.xxx.xxx. The remote address of the script
    posting to this ...
    www.sangriastudios.com/content/blogcategory/27/49/ - 17k - Cached -
    Similar pages


    PayPal UK - PayPal Developer Community
    This is a thread with new unread messages, Error code 506 Possible
    fraud. Error with REMOTE IP ADDRESS, 1, AGrant · 10-18-2006 02:25 AM by
    PayPal_DannyB ...
    www.pdncommunity.com/pdn/board?board.id=uk&page=5 - 62k - Cached -
    Similar pages



    Me
     
    why?, Jul 18, 2007
    #3
  4. "Mike Easter" <> wrote in message
    news:469d9e23$0$97242$...
    > Wereo_SUPREME43 wrote:
    >> I got 3 emails like this from my Site, from the same person, where I
    >> provide Music Downloads for sale at 99 cents per:
    >>
    >> Error code 506. Possible fraud. Error with REMOTE IP ADDRESS =
    >> 66.211.180.66.

    >
    > Presumably you have decided to display a bogus IP here instead of a real
    > IP.
    >
    >> The remote address of the script posting to
    >> this notify script does not match a valid PayPal ip address
    >>
    >> These are the valid IP Addresses:
    >> 66.211.169.65,66.212.168.97,215.113.188.35,216.114.188.65,

    >
    > Presumably you have decided to display bogus IPs here instead of the
    > real IP.
    >
    >> The Order ID received was:
    >> d023e749e8dec1fg6e528da24e13182a
    >>
    >> Does anyone know what this means? Incidentally I got a vibe to change
    >> these IP #'s slightly, but if need be I'll repost them as I got them.

    >
    > Presumably your brain is vibrating/vibing inside your head instead of
    > not vibrating/vibing.
    >
    > What are we supposed to do with bogus IPs?
    >
    > --
    > Mike Easter
    >

    Forgive me, Mike. I've totally lost control of the website. AND the only
    thing I know about IP's is what I do in the middle of the night.

    Is there a confidentialty issue with IP's, or is it ok to repost the real
    ones? If I post the real ones what happens? I already know the guy lives in
    Florida, because that's where he says he lives.
     
    Wereo_SUPREME43, Jul 19, 2007
    #4
  5. "why?" <fgrirp*sgc@VAINY!Qznq.fpvragvfg.pbz> wrote in message
    news:...
    >
    > On Tue, 17 Jul 2007 22:50:50 -0400, Wereo_SUPREME43 wrote:
    >
    >>You guys know everything about computers and beyond.
    >>
    >>I got 3 emails like this from my Site, from the same person, where I
    >>provide

    >
    > Your site, you mean the shopping cart application hosted on your service
    > provider?
    >
    > You have checked the email headers to see if the sender / originating IP
    > matches a server you know is valid?
    >
    > Same person, so this is them telling you something rather than the
    > administration side of the ordering process sending a email?
    >
    >>Music Downloads for sale at 99 cents per:

    >
    > Not important.
    >
    > Of course you mention the 99 cents, while at the same time didn't
    > mention - shopping cart software or the versions / source of the scripts
    > / provider try www.google.com first.
    >
    >
    >>Error code 506. Possible fraud. Error with REMOTE IP ADDRESS =
    >>66.211.180.66.

    >
    > That's -
    >
    > OrgName: eBay, Inc
    > OrgID: EBAY
    > Address: 2145 Hamilton Ave
    > City: San Jose
    > StateProv: CA
    > PostalCode: 95008
    > Country: US
    > NetRange: 66.211.160.0 - 66.211.191.255
    > CIDR: 66.211.160.0/19
    > NetName: EBAY-2
    > NetHandle: NET-66-211-160-0-1
    > Parent: NET-66-0-0-0-0
    > NetType: Direct Assignment
    > NameServer: SJC-DNS1.EBAYDNS.COM
    > NameServer: SJC-DNS2.EBAYDNS.COM
    > NameServer: SMF-DNS1.EBAYDNS.COM
    > NameServer: SMF-DNS2.EBAYDNS.COM
    > Comment:
    > RegDate: 2006-01-25
    > Updated: 2006-01-25
    > OrgTechHandle: EBAYN-ARIN
    > OrgTechName: eBay Network
    > OrgTechPhone: +1-408-376-7400
    > OrgTechEmail: network<edited email addy removed the at>ebay.com
    > # ARIN WHOIS database, last updated 2007-07-17 19:10
    > # Enter ? for additional hints on searching ARIN's WHOIS database.
    > OrgName: eBay, Inc
    >
    > at least that looks okay.
    >
    >> The remote address of the script posting to this
    >>notify script does not match a valid PayPal ip address
    >>
    >> These are the valid IP Addresses:
    >>66.211.169.65

    > Ebay
    >
    > , 66.212.168.97
    > An ISP
    > Pathway Communications
    > 105 Commerce Valley Dr W
    > Suite 500
    > Markham, Ontario L3T 7W3
    > CA
    > Domain name: PATHCOM.COM
    >
    > , 215.113.188.35
    > Seems odd, for paypal
    >
    > OrgName: DoD Network Information Center
    > OrgID: DNIC
    > Address: 3990 E. Broad Street
    > City: Columbus
    > StateProv: OH
    > PostalCode: 43218
    > Country: US
    > NetRange: 215.0.0.0 - 215.255.255.255
    > CIDR: 215.0.0.0/8
    > NetName: DDN-NIC16
    > NetHandle: NET-215-0-0-0-1
    > Parent:
    > NetType: Direct Allocation
    > NameServer: CON1R.NIPR.MIL
    > NameServer: CON2R.NIPR.MIL
    > NameServer: EUR1R.NIPR.MIL
    > NameServer: EUR2R.NIPR.MIL
    > NameServer: PAC1R.NIPR.MIL
    > NameServer: PAC2R.NIPR.MIL
    > Comment:
    > RegDate: 1998-06-05
    > Updated: 2006-04-11
    > OrgTechHandle: MIL-HSTMST-ARIN
    > OrgTechName: Network DoD
    > OrgTechPhone: +1-800-365-3642
    > OrgTechEmail: HOSTMASTER<removed the at>nic.mil
    > # ARIN WHOIS database, last updated 2007-07-17 19:10
    >
    >
    > , 216.114.188.65
    >
    > OrgName: SoVerNet, Inc.
    > OrgID: SOVR
    > Address: 5 Rockingham Street
    > City: Bellows Falls
    > StateProv: VT
    > PostalCode: 05101
    > Country: US
    > NetRange: 216.114.128.0 - 216.114.191.255
    > CIDR: 216.114.128.0/18
    > NetName: SOVER-NET-3
    > NetHandle: NET-216-114-128-0-1
    > Parent: NET-216-0-0-0-0
    > NetType: Direct Allocation
    > NameServer: CLOVER.SOVER.NET
    > NameServer: APPLE.SOVER.NET
    > Comment: ADDRESSES WITHIN THIS BLOCK ARE NON-PORTABLE
    > RegDate: 2000-06-20
    > Updated: 2004-03-09
    > RTechHandle: NA22-ORG-ARIN
    > RTechName: SoVerNet, Inc.
    > RTechPhone: +1-802-463-2111
    > RTechEmail: noc<removed at>sover.net
    > OrgTechHandle: NOC1523-ARIN
    > OrgTechName: Network Operations Center
    > OrgTechPhone: +1-802-463-2111
    > OrgTechEmail: noc<removed at>sover.net
    > # ARIN WHOIS database, last updated 2007-07-17 19:10
    > # Enter ? for additional hints on searching ARIN's WHOIS dat
    >
    >
    >>
    >> The Order ID received was: d023e749e8dec1fg6e528da24e13182a

    >
    > Means nothing unless you have access to the ordering system. In that
    > case you confirmed this order id.
    >
    >>Does anyone know what this means? Incidentally I got a vibe to change
    >>these
    >>IP #'s slightly, but if need be I'll repost them as I got them.

    >
    > If you had changed or did then tracing them is pointless in case was was
    > a known problem site.
    >
    >>Many thanks for your help, Scott.

    >
    > Here is some help, www.google.com , OTOH ask the company that processes
    > your payments.
    >
    > Web Results 1 - 10 of about 477,000 English pages for
    > Error code 506. Possible fraud. . (0.10 seconds)
    >
    > VirtueMart: Your free e-commerce solution. - Error code 506 ...
    > Error code 506. Possible fraud. Error with REMOTE IP ADDRESS =
    > 172.19.56.161. The remote address of the script posting to this notify
    > script does not match ...
    > http://virtuemart.net/index.php?option=com_smf&Itemid=71&?topic=25192.msg87421;topicseen
    > - 66k - 17 Jul 2007 - Cached - Similar pages
    >
    > VirtueMart: Your free e-commerce solution. - Error Code 506 and ...
    > + Error Code 506 and new Paypal IP - completely lost, please help. ... I
    > GET AN 'ERROR 506' MESSAGE - 'POSSIBLE FRAUD' - THE PAYMENT GOES
    > THROUGH, ...
    > http://virtuemart.net/index.php?option=com_smf&Itemid=71&topic=30001.0;prev_next=next
    > - 56k - Cached - Similar pages
    > [ More results from virtuemart.net ]
    >
    > online marketing, search engine optimization, joomla, multi ...
    > With the following message: Error code 506. Possible fraud. Error with
    > REMOTE IP ADDRESS = 216.xxx.xxx.xxx. The remote address of the script
    > posting to this ...
    > www.sangriastudios.com/content/blogcategory/27/49/ - 17k - Cached -
    > Similar pages
    >
    >
    > PayPal UK - PayPal Developer Community
    > This is a thread with new unread messages, Error code 506 Possible
    > fraud. Error with REMOTE IP ADDRESS, 1, AGrant · 10-18-2006 02:25 AM by
    > PayPal_DannyB ...
    > www.pdncommunity.com/pdn/board?board.id=uk&page=5 - 62k - Cached -
    > Similar pages
    >
    >
    >
    > Me

    Yes I changed the numbers around a bit genius me.
     
    Wereo_SUPREME43, Jul 19, 2007
    #5
  6. Wereo_SUPREME43

    why? Guest

    On Thu, 19 Jul 2007 00:23:03 -0400, Wereo_SUPREME43 wrote:

    Are you really that dense still?

    a) Bottom posting 1 line after not snipping anything?
    What is the point of copying 193 lines adding only 1.

    b) I need help, need to know if there is aproblem but I changed the
    conditions of the test first.

    c) Didn't even comment on any other remarks.

    d) Not genius you.

    >"why?" <fgrirp*sgc@VAINY!Qznq.fpvragvfg.pbz> wrote in message
    >news:...
    >>
    >> On Tue, 17 Jul 2007 22:50:50 -0400, Wereo_SUPREME43 wrote:
    >>
    >>>You guys know everything about computers and beyond.
    >>>
    >>>I got 3 emails like this from my Site, from the same person, where I
    >>>provide

    >>
    >> Your site, you mean the shopping cart application hosted on your service
    >> provider?
    >>
    >> You have checked the email headers to see if the sender / originating IP
    >> matches a server you know is valid?


    <snip>

    >> PayPal UK - PayPal Developer Community
    >> This is a thread with new unread messages, Error code 506 Possible
    >> fraud. Error with REMOTE IP ADDRESS, 1, AGrant · 10-18-2006 02:25 AM by
    >> PayPal_DannyB ...
    >> www.pdncommunity.com/pdn/board?board.id=uk&page=5 - 62k - Cached -
    >> Similar pages
    >>
    >>
    >>
    >> Me

    >Yes I changed the numbers around a bit genius me.


    Me
     
    why?, Jul 19, 2007
    #6
  7. Wereo_SUPREME43

    why? Guest

    On Thu, 19 Jul 2007 00:22:25 -0400, Wereo_SUPREME43 wrote:

    >"Mike Easter" <> wrote in message
    >news:469d9e23$0$97242$...
    >> Wereo_SUPREME43 wrote:
    >>> I got 3 emails like this from my Site, from the same person, where I
    >>> provide Music Downloads for sale at 99 cents per:
    >>>
    >>> Error code 506. Possible fraud. Error with REMOTE IP ADDRESS =
    >>> 66.211.180.66.

    >>
    >> Presumably you have decided to display a bogus IP here instead of a real
    >> IP.
    >>
    >>> The remote address of the script posting to
    >>> this notify script does not match a valid PayPal ip address
    >>>
    >>> These are the valid IP Addresses:
    >>> 66.211.169.65,66.212.168.97,215.113.188.35,216.114.188.65,

    >>
    >> Presumably you have decided to display bogus IPs here instead of the
    >> real IP.
    >>
    >>> The Order ID received was:
    >>> d023e749e8dec1fg6e528da24e13182a
    >>>
    >>> Does anyone know what this means? Incidentally I got a vibe to change
    >>> these IP #'s slightly, but if need be I'll repost them as I got them.

    >>
    >> Presumably your brain is vibrating/vibing inside your head instead of
    >> not vibrating/vibing.
    >>
    >> What are we supposed to do with bogus IPs?
    >>
    >> --
    >> Mike Easter
    >>

    >Forgive me, Mike. I've totally lost control of the website. AND the only
    >thing I know about IP's is what I do in the middle of the night.
    >
    >Is there a confidentialty issue with IP's, or is it ok to repost the real
    >ones? If I post the real ones what happens? I already know the guy lives in
    >Florida, because that's where he says he lives.


    Then you engage the forces of law and order. Skipping over the posting
    addresses in a public news group.

    Me
     
    why?, Jul 19, 2007
    #7
  8. Yeah, and if I told you that I lived in your ass, would you believe me?

    I already know the guy lives in
    > Florida, because that's where he says he lives.
    >
    >


    --
    Thanks,
    Bryan K

    To reply, remove .com
    ** PROUD USER OF THUNDERBIRD **
     
    Your Best Friend, Jul 19, 2007
    #8
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. =?Utf-8?B?TmFjaG8=?=

    Microsoft Transaction Server

    =?Utf-8?B?TmFjaG8=?=, Dec 18, 2004, in forum: MCSD
    Replies:
    2
    Views:
    475
    Daniel Joskovski
    Dec 21, 2004
  2. Consultant
    Replies:
    0
    Views:
    441
    Consultant
    Aug 18, 2003
  3. Roger Abell
    Replies:
    0
    Views:
    508
    Roger Abell
    Aug 22, 2003
  4. Replies:
    0
    Views:
    504
  5. Harry Stottle

    Reporting Fraud and Attempted Fraud

    Harry Stottle, Jan 9, 2014, in forum: UK VOIP
    Replies:
    0
    Views:
    366
    Harry Stottle
    Jan 9, 2014
Loading...

Share This Page