btcvender scammed me at bitmarket.eu - 5 BTC reward for hints

[mralbi]

Dear all,
a user called btcvender scammed me recently for 77.6 EUR on bitmarket.eu.

The case is already followed up by the police and they promised to request IP log data etc. from bitmarket.eu, but I was wondering if someone in this forum has additional information or can at least be warned by this by this scammer.

His standard email-reply bank data was empty, after that a second email with the bank data contained the following bank information:
iban: pt50000700000011573225323
SWIFT/BIC: BESCPTPL

the two email adresses he used are:
pgiesteira@gmail.com
danielmscorreia@gmail.com


All information is welcome and be warned :-)

[OpenYourEyes]

Removed as wrong user

[Bitsky]

Also, from the swift code he's using Banco Espirito Santo S.A. in Portugal:
http://www.swiftbic.com/bic-code.html?swift_search=BESCPTPL

Since the branch code is 0000 it should be the one in Lisbon.

[mralbi]

Purchasing email header:


Delivered-To: mralbihtc@gmail.com
Received: by 10.49.120.4 with SMTP id ky4csp611900qeb;
        Wed, 28 Nov 2012 11:55:12 -0800 (PST)
Received: by 10.14.177.1 with SMTP id c1mr72982549eem.8.1354132511588;
        Wed, 28 Nov 2012 11:55:11 -0800 (PST)
Return-Path: <notifications@bitmarket.eu>
Received: from mx0.gmx.net (mx0.gmx.net. [213.165.64.100])
        by mx.google.com with SMTP id m3si44859665een.32.2012.11.28.11.55.11;
        Wed, 28 Nov 2012 11:55:11 -0800 (PST)
Received-SPF: neutral (google.com: 213.165.64.100 is neither permitted nor denied by best guess record for domain of notifications@bitmarket.eu) client-ip=213.165.64.100;
Authentication-Results: mx.google.com; spf=neutral (google.com: 213.165.64.100 is neither permitted nor denied by best guess record for domain of notifications@bitmarket.eu) smtp.mail=notifications@bitmarket.eu
Received: (qmail 4398 invoked by alias); 28 Nov 2012 19:55:11 -0000
Delivered-To: GMX delivery to martin.albert@gmx.net
Received: (qmail invoked by alias); 28 Nov 2012 19:55:11 -0000
Received: from mail-we0-f179.google.com (EHLO mail-we0-f179.google.com) [74.125.82.179]
  by mx0.gmx.net (mx070) with SMTP; 28 Nov 2012 20:55:11 +0100
Received: by mail-we0-f179.google.com with SMTP id r6so4833651wey.38
        for <martin.albert@gmx.net>; Wed, 28 Nov 2012 11:55:10 -0800 (PST)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=google.com; s=20120113;
        h=message-id:date:from:to:subject:reply-to:content-type
         :x-gm-message-state;
        bh=UtS3mMb32CyUmmPC1xnp5wE9sayBocXmQKSlLEsc/zs=;
        b=V+J90au2/w8UJY4T8abgZGR1IE8MH5QW2YICMuc00IcbQz8AXXXnrk7reFt2/ABSbZ
         GdAz+GEB+6GidN16FSuvBWEpKB1y1yEJn4hUCXSD0UjcDqE1uIOPBGdFVktjNZ5jvzV6
         1KTvU0/ngOW1pmPDdUVH3gHdEuHQ6NvdXnh0KZPPjqI3G5fgcTqyv9lFzFoCJOXpl+YA
         mo2X42RZXG5i/MVM0HL9IV7/cjrU6/wi7LgGy+axJfV85QMugC41rQNQcxOASlmjpv03
         79uRdVpCLbmucB4+syVJA2FzUAY9AQvtORlpWw8KoB+6zkik5/V+bsiLEEH+a22TSfiW
         eSjw==
Received: by 10.181.11.234 with SMTP id el10mr6917219wid.7.1354132510650;
        Wed, 28 Nov 2012 11:55:10 -0800 (PST)
Received: from localhost ([178.217.184.228])
        by mx.google.com with ESMTPS id gz3sm8338489wib.2.2012.11.28.11.55.09
        (version=TLSv1/SSLv3 cipher=OTHER);
        Wed, 28 Nov 2012 11:55:09 -0800 (PST)
Message-ID: <50b66c1d.236bb40a.4dc8.ffff918e@mx.google.com>
Date: Wed, 28 Nov 2012 11:55:09 -0800 (PST)
From: "BitMarket.eu notifications" <notifications@bitmarket.eu>
To: martin.albert@gmx.net
Subject: Bitcoins bought on BitMarket.eu! (Transaction ID 23361)
Reply-To: pgiesteira@gmail.com
Content-Type: text/html; charset=utf-8
X-Gm-Message-State: ALoCoQkvxr/Lhb1B2rvbu4+VuhU9OvWl9uZWWU0/hcr/FrSYfvPSDzqV+poyeHBfFkjQdGjZ3MIR
X-GMX-Antispam: 0 (Mail was not recognized as spam);
 Detail=5D7Q89H36p4L00VTXC6D4q0N+AH0PUCnGL2vqOgpaBYL16oitsMrgDt/NQNpSCZFSflc5
 T+wmVv0SArOm6I6k8QiukBvIHcUwSrFqPCYxE3Lt+XYu9XPSwQ7tsHi9jMGVtDLwiJUIqMwI3mXM
 eVcBw==V1;
X-Resent-By: Forwarder <forwarder@gmx.net>
X-Resent-For: martin.albert@gmx.net
X-Resent-To: mralbihtc@gmail.com

<style type="text/css">
p {
   font-family: Arial, sans-serif;
   font-size: 13px;
   line-height: 18px;
   color: #444;
}
</style>

<p>mralbi,</p>

<p>You have purchased 8 BTC for 77.60 EUR (9.7 EUR per 1 BTC). Message from the seller follows:<br><br>Please pay 77.60 EUR to my bank:
<br>
<br><br><br>For more information please contact with the seller by replying to this message or email them directly on: pgiesteira@gmail.com.<br>Once the money has been transfered to the seller, the Bitcoins will be sent to your Bitcoin address at BitMarket.<br>Remember, that unless Paypal is used, as a buyer you are obliged to pay all fees associated with money transfer!<br><br>The ID for this transaction is: 23361.</p>

-- <br>
Best regards,<br>Bitmarket.eu team.

[mralbi]

and the second email with the banking data from the other email address:


                                                                                                                                                                                                                                                               
Delivered-To: mralbihtc@gmail.com
Received: by 10.49.120.4 with SMTP id ky4csp615127qeb;
        Wed, 28 Nov 2012 12:20:34 -0800 (PST)
Received: by 10.14.172.195 with SMTP id t43mr73650381eel.17.1354134033877;
        Wed, 28 Nov 2012 12:20:33 -0800 (PST)
Return-Path: <danielmscorreia@gmail.com>
Received: from mx0.gmx.net (mx0.gmx.net. [213.165.64.100])
        by mx.google.com with SMTP id a9si44955040eeo.78.2012.11.28.12.20.33;
        Wed, 28 Nov 2012 12:20:33 -0800 (PST)
Received-SPF: neutral (google.com: 213.165.64.100 is neither permitted nor denied by domain of danielmscorreia@gmail.com) client-ip=213.165.64.100;
Authentication-Results: mx.google.com; spf=neutral (google.com: 213.165.64.100 is neither permitted nor denied by domain of danielmscorreia@gmail.com) smtp.mail=danielmscorreia@gmail.com; dkim=pass header.i=@gmail.com
Received: (qmail 19002 invoked by alias); 28 Nov 2012 20:20:33 -0000
Delivered-To: GMX delivery to martin.albert@gmx.net
Received: (qmail invoked by alias); 28 Nov 2012 20:20:33 -0000
Received: from mail-oa0-f49.google.com (EHLO mail-oa0-f49.google.com) [209.85.219.49]
  by mx0.gmx.net (mx002) with SMTP; 28 Nov 2012 21:20:33 +0100
Received: by mail-oa0-f49.google.com with SMTP id l10so18487189oag.22
        for <martin.albert@gmx.net>; Wed, 28 Nov 2012 12:20:32 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=gmail.com; s=20120113;
        h=mime-version:date:message-id:subject:from:to:content-type;
        bh=0ztoQmvnPptpJe+IAm2AcFPcgb0FCb3Fdci3wTZlZ1o=;
        b=UCr8rYGYmBummYM9+WhKqj3Qowbb/i1BIVRYP1R8eMUEaGt2FtzEqbsxeHS11wkrGu
         8LwGjsj1htzoi9RrkkP2cst62rILqxvkvYBOAhsUYNnuxuk7bbdlKc5vugTk3fi7Bord
         MdtT/nLST6Nij908Zj+Ok7AjPNlTQiogEMwpbQIp+aoytTb7m32NaoPXFpzfKh79qHsu
         EpR/bAP8eP1/gcPLA4BNzrRGPtZKerCH/HoanzAcbovr2AkGP7z//ZSzJR265XVtGlWT
         ELhUsxkJe3hXlPEAOfloC4jYSTKCeRn4qLprLVQGAniT9msVZBUkkyqIrnQupGjpkNqe
         JYLg==
MIME-Version: 1.0
Received: by 10.182.31.43 with SMTP id x11mr5579063obh.68.1354134032264; Wed,
 28 Nov 2012 12:20:32 -0800 (PST)
Received: by 10.76.153.65 with HTTP; Wed, 28 Nov 2012 12:20:32 -0800 (PST)
Date: Wed, 28 Nov 2012 20:20:32 +0000
Message-ID: <CADdmMPPgxejmdaVw=7M6cy6EdEat-WbM3wgud1TptkN2A-7Q3g@mail.gmail.com>
Subject: btcmarket.eu
From: Daniel Correia <danielmscorreia@gmail.com>
To: martin.albert@gmx.net
Content-Type: multipart/alternative; boundary=14dae93b5776f8ae3b04cf93e5f0
X-GMX-Antispam: 0 (Mail was not recognized as spam);
 Detail=5D7Q89H36p4L00VTXC6D4q0N+AH0PUCnGL2vqOgpaBYL16oitsMrgDt/NQNpSCZFSflc5
 T+wmVv0SArOm6I6k8QiukBvIHcUwSrFqPCYxE3Lt+XYu9XPSwQ7tsHi9jMGVtDLwiJUIqMwI3mXM
 eVcBw==V1;
X-Resent-By: Forwarder <forwarder@gmx.net>
X-Resent-For: martin.albert@gmx.net
X-Resent-To: mralbihtc@gmail.com

--14dae93b5776f8ae3b04cf93e5f0
Content-Type: text/plain; charset=ISO-8859-1

Hello,

please send the payment to:

iban: pt50000700000011573225323
SWIFT/BIC: BESCPTPL

Thanks

--14dae93b5776f8ae3b04cf93e5f0
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

Hello,<br><br>please send the payment to:<br><br>iban: pt500007000000115732=
25323<br><span style=3D"color:rgb(0,0,0);font-family:Arial,Helvetica,sans-s=
erif;font-size:13px;font-style:normal;font-variant:normal;font-weight:norma=
l;letter-spacing:normal;line-height:normal;text-align:start;text-indent:0px=
;text-transform:none;white-space:normal;word-spacing:0px;display:inline!imp=
ortant;float:none">SWIFT/BIC: BESCPTPL <br>
<br>Thanks<br></span>

--14dae93b5776f8ae3b04cf93e5f0--

[mralbi]

thanks for the tips so far,

but i think the email header is of no use, as i forwarded it from my own email adress (martin.albert(aet)gmx.net) to my second address (mralbihtc(aet)gmail.com), and i do not save the mails on the first account :-(

[OpenYourEyes]

thanks for the tips so far,

but i think the email header is of no use....

If you forwarded them then yeah it's no use. Have you contacted your banks fraud department? Depending on who you bank with they may be able to compensate you, especially as you have contacted the police.

Did you actually communicate with the guy at all using his email addresses?
If not, it could be that he just used a random email address he found and pretended it was his.
But it would be a bit coincidence that the owner of the one email and this guys bank details are both located in Lisbon.

If it was me, I'd send the guy an email with a link to a 'fake' web page that will grab his IP address, you could then send an abuse complaint to his ISP and forward it to the police. If you decide to, I'll be able to do a 'fake' webpage for you if need be.

You should also try emailing him, if you haven't already, stating that you have contacted the police, direct him to this thread, and threaten to inform his employee/friends/family for the shame.

my own email adress (martinxx@gmx.net) to my second address (mralxx@gmail.com)

Probably best to remove your email addresses from your post if you don't want spam bot harvesters to get hold of it.

[Bitsky]

my own email adress (...) to my second address (....)

Probably best to remove your email addresses from your post if you don't want spam bot harvesters to get hold of it.

Luckily you quoted his addresses so that it'll be useless if he edits his own posts.

[OpenYourEyes]

my own email adress (...) to my second address (....)

Probably best to remove your email addresses from your post if you don't want spam bot harvesters to get hold of it.

Luckily you quoted his addresses so that it'll be useless if he edits his own posts.

I never, I replaced them with xxx's

[Bitsky]

I really shouldn't be online when I'm tired

[mralbi]

yes, i contacted the guy, but at first there was no answer at all, after some time he simply stated that he didnt receive the money and that he refuses to give me any contact data.

I also checked with my bank and they confirmed that the account exists and that the money was actually transferred. The other partys bank only provides information to the police, therefore i would simply have to wait some more time i assume.

The weird thing is anyway that the bitmarket.eu admin does not answer at all and that the transaction was "cancelled" without me being asked at all. Usually a cancellation required the consent of both parties.

[OpenYourEyes]

yes, i contacted the guy, but at first there was no answer at all, after some time he simply stated that he didnt receive the money and that he refuses to give me any contact data.

Any chance you could post the email he sent and the headers?
If his IP is listed within it, you maybe able to ask bitmarket.eu (if they eventually get back in touch) to check if that IP matches ones in their logs from that account he used.

BitMarket.eu has a lot of bad rep. Check the google results out

The webmaster of BitMarket.eu is: M4v3R
He was last active today, maybe you should try sending him a PM on here.

[mralbi]

yeah, bitmarket.eu does not seem to work anymore. I had very good experience in the past but currently i do not get any answer for quite some time.....

just sent the webmaster a private msg here, thanks for the tipp

[OpenYourEyes]

Good, hope you've got enough information to get this scum bag.

[Aahzman]

holy shit, you guys are amazing. Even if I had any thoughts of pulling a scam, seeing the results you guys pull would certainly give me pause. 

See, boys and girls? This is why it's best and simplest to just play it straight and do the right thing. The internet will FUCK. YOU. UP.

[mralbi]

yeah, thanks a lot for the help so far, if it helps to find the guy i will forward the reward asap, but i think the police will not do anything before christmas