Thread by @arborbytes

My parents have been looking to buy an RV and this evening my Mom found an oddly cheap RV on an "RV Trader" website. I'm pretty sure it's a scam - come with me while I investigate and use some #OSINT along the way! #ThreatIntel #SCAM #infosec

The link my mom sent was for a 2005 Airstream Bambi, for 9,800 dollars - wait, that seems way too cheap!

First red flag, the website doesn't seem to give you any information....you need to click "request more info" which prompts for your contact information.

Reviewing the site's #whois record reveals more red flags...The website registration date was 2021-11-23 (that's pretty recent), the registrant mailing address is: Kalkofnsvegur 2, Reykjavik, Capital Region, 101, IS - which is in Iceland 🤨

Googling that address gets me to a Reddit thread - apparently at one time another domain (coinbase-use.com) was also registered with that address. This is looking like a #Scam!

Going back to the website, I noticed a contact address: 116 MARKET Pl, ESCONDIDO, 92029, United States. Let's google that address to see if it's actually our elusive RV trading company!

Google tells me this is the address for Trivista Commercial Contractors, definitely not an RV trading company.

Let's dig deeper! There are a lot of RV's listed on this website, surely they are scraping this information from somewhere else. Let's take the description text for one of the RV's and google it.

And just like that, we have a match! These RV's are being pulled from rvtrader.com and posted to our scammer site.

At this point I better text my mom and warn her not to add any of her information to the website boatsandrvsmarketplace[dot]com - interestingly this website doesn't show up as a scam site on Google, so it's flew under the radar so far.

Thanks for reading folks! Last but not least, I'll report this scam site to NameCheap so they can take it down (hopefully) @Namecheap - bump!

Effective #OSINT is all about knowing where to look, in this case, @Google was my hero.

Thanks for reading folks!

A bonus tweet - I talked to my mom and she didn’t submit her info in the site! What do you all think the scammers would have said if she made contact? My bet is on some type of down payment or something - scamming money from unsuspecting people.