Divicasales self impersonation

as you'll see in this report: http://www.sythe.org/report-scammer/1613239-fake-mm.html

i decided to look into it more and i found that the impersonator on skype had logged into skype twice with the same ip that divica has also logged into with twice on skype. I'm not saying it's the ip they use for posting on sythe, but they do match for both skypes. divica.sales- and divica.sales seems as if they used a proxy to imposter themselves, only thing is they forgot to get off the proxy before they logged back into their actual skype.


Skype Impersonation










Skype Ips







another resolve





another resolve












Check the Ips on skype. Cheers

 

There are a couple problems with resolvers:

1. When the user is offline, they don't tend to work
2. You can stop your IP from being revealed with the Skype 6.5(?) Beta, which will display a "Skype server" IP.

​

Because of this, it's hard to tell who's IP is being shown.

Additionally, DivicaSales has never used an 83.83 IP on Sythe. Resolvers are only really useful to us when the resolved IP matches a Sythe IP to prove ownership of a Skype, otherwise they're a bit hit & miss.

 

Adding some thing to this in a minute.

 

Alright to start i'd like to point out that skype resolve actually does prove that divica.sales and divica.sales- on skype are the same person under these circumstances, regardless of what the Ip they use for sythe actually is, and i'll explain why.



I'll start by informing you that yes skype resolve does not always show the actual accurate ip address for every user but, in this case it does match divica.sales- to the same proxy ip as divica.sales. I took the liberty of using 20 random users from sythe for an experiment, I first skype resolved every user out of the 20 peoples skype individually, wrote down the results for each, i then went back and tried to match even one of the skype resolve results to another user, which i came up empty handed. I then took divica.sales- and divica.sales resolved them multiple times with multiple resolvers to ensure there was no mistake, What i found is that each time you resolve both of the skypes it shows that both divica.sales- and divica.sales resolve to the following, 83.83.243.60 and 168.62.23.92, now as i said before yes they would obviously have been smart enough not to make a post on sythe while using the proxy that they use to imposter them selves with, but they made the mistake of logging into their real skype while on the same proxy ip that the imposter uses, Not only with one proxy ip 83.83.243.60 but with a second ip that also matches back to both the imposter and divicas real skype 168.62.23.92. Now i realize it's not the IP they use for sythe, but There is no way you take two completly random skype accounts, resolve them and they both come back with not one same proxy ip but two different proxys from completely different parts of the world (one from Netherlands other from US) and both the imposter and the real account matched for both the proxys.

Think about it, why would they both resolve to the same ips? even if its not the ip they use for sythe it is proof that the imposter logged in on the ip above from netherlands and the other ip from above from the US, and the real divica skype also logged in with the same ip from netherlands and same ip from US. Now i agree this is not 100% concrete proof because it is skype resolve but if you look at the facts, and think it over logically, it's just too coincidental that two completly random skype names come back to not one but two of the same Proxy Ips, even if there was some sort of error which i highly doubt, others would be matching back to others as well, but thats not the case out of the 20 people i used for an experiment none except for divica.sales- and divica.sales matched.


As well in divicas "re divica" thread they claim it can't be them because their real ip is ect as listed in their thread, but in that same thread they skype resolved them selves, and posted the results for their real skype, which comes back to the same IPS as i said 83.83.243.60 and 168.62.23.92. Look at the image provided in their thread which shows the results they get when they resolve them selves, and this image when you resolve divica.sales- the imposter, it gives the same results, not for one proxy but for the same two it's too coincidental for me to believe it's not them.


direct resolve of actual account on their thread.
direct resolve of the imposter below.
you'll notice they both have logged into skype with two completely different ips from two completely different countries and they match for both accounts, now how is that possible if it's not them.

 

168.62.23.92 is a Microsoft IP, most people's skype will match it at some point. Thanks for adding on though, looking for another opinion as I, personally, don't trust resolvers to be spot on.

 

The following has been provided by another sythe user and does not necessarily express my views or opinions.

copied and pasted


More Information 'DivicaSales = 'Buys Scammed/Stolen Goods'
Divica has purchased scammed goods many times now.


Rockafella32 scams here;
http://www.sythe.org/report-scammer-archive/1608352-rockafella32-scammer.html
Divica buys the stolen goods here;
http://www.sythe.org/12586805-post376.html
Divica reports Rockafella32 INSTANTLY after here:
http://www.sythe.org/report-scammer-archive/1610749-vader-vading-shady395.html

Divica's Response:
'I found out they were a ban evader mid trade, only did it to find the sythe account he was using'

other sythe users response
He said in the skype chat that he was going to lure him, the time shown actually proves that he knew it was stolen goods as he knew shady350 was evading.
http://i.imgur.com/qE08mlt.png

Other shifty behavior includes:
After a conversation he had with him about how a person he just traded with was a self voucher (later found to be also an evader). Divica seemed to not care that who they were dealing with was a scammer, aslong as they got the trade from them it hadn't mattered.

http://i.imgur.com/lpfdIWd.png
http://i.imgur.com/Pb80vZo.png
What was said next was also very dodgy:
http://i.imgur.com/eK6FTcR.png

 

Regarding Rockafella32:
Did I know the goods where scammed? No I didn't. Is there physical proof of a scam happening in that report no it hasn't been closed with the resolution that he had scammed. The user approched me from Powerbot, not from Sythe. Mid trade I knew he has been banned on Sythe simpley because he was selling 07GP on another account called Shady350 and I saw his skype name matched. In my opinion it would have been worse if I didn't attempt to his his new Sythe account. I didn't know the previous report until I saw Lazy23 post about it in the Spam Forum.

EDIT: Yes I had already made the thread for him being a vader, all I had to do was add his profile link.


'other shifty behaviors'
I personally can't say I do a back checks on ever member I deal with on sythe. IP matches have never been enough to get someone banned. It was almost 3am, I was going to bed. There was no proof that he was a scammer, only when TPM told me the next day that he was banned for Vading? The Sythe account the user was using was about 6years old, can't say I thought a Vader would have a 6year old account. Regarding the self vouching, once again he was going on a IP match, and they aren't always accurate. People user WIFI hotspots, vpns, proxys and many other shared local networks all the time.



Edit; It clearly shows that Leanbean is taking any little thing he can and twisting it to make it look worse then it actually is. I had already made the post all I needed was Rockafellas profile link to report him. He came from Powerbot not from sythe.

As or buying stolen goods; if you honestly think about it.. Most of the gold that's sold to gold sellers is probably not legitimately obtained?

 

In the statement they just made they claim they didn't know it was stolen or that it was a Vader but clearly from the Skype convo they knew he was a Vader and lured him so they could report him. On top of that the time the other user vouches for them is less than 30 seconds before divica reported them for evading. But they claim they didn't know he Vaded or that it was stolen till the next day even though they reported him 30 seconds after he vouched them, Regardless if the report for that is still open or not, chances are since he was vading he really did steal the 30m from the other user, the other user was just too new to properly report. But this report is about the fact that they were caught self impersonating i simply added the last bit of info as requested by another sythe user.

 

The VPN matches a serial impersonator/vader from Holland, and Divica is in the UK. It might just be chance that they happened to match and used the same proxy. I'm pretty sure if Divica were this person, we'd know by now.