Ask HN: Tracking down fake Airbnb owner

8 pointsasdojasdosadsa6y ago10 comments

Case: Not so technical colleague got scammed for 2 months rent. What can he do?

Steps: 1. He found apartment listing on immobiliare.it

2. Some emails were exchanged

3. He receives the link to the _real_ airbnb listing

4. He cant find it there, and the scammer sends the phishing page[1] (from @expertdesigner.eu)

5. Soon after he receives another email saying that the database is down from @airbnb.sa.com and he should meanwhile move the money using transferwise.com

6. Payment done

7. Scammer replies: Payment received

The login page was quite well made, and I think most of non technical people might get fooled

[1] The URL: https://airbnb.com-itinerary.app/rooms/762837232/files/login.php?id=572465&locale=en&sale=203&

Thoughts?

10 comments

gus_massa6y ago

The title is slightly confusing. Note that it is a ((fake Airbnb) owner), not a (fake (Airbnb owner)).

BoorishBears6y ago

Literally makes no difference. Both convey the same problem.

In fact if anything, the story is about a (fake) AirBnb owner. The AirBnB was real, the “owner” was fake.

Both are accurate unless you somehow imagined this would be a story about a fake founder of AirBnB (in which case I’d say the confusion is more of a personal problem).

nwsm6y ago

I don't have any advice but I hope they are able to recover their money. Shitty people like that are why some US states like Massachusetts now require all renters to find apartments through a registered broker. Sounds nice and safe but it ended up in me paying 4 months rent to get a new apartment. (2 months rent + security deposit + broker fee which was over a month's rent)

dfyr6y ago

There's more to it, more php machinery, but in short:

Basic Info

- username at home dir: comitin1 - LiteSpeed server - SERVER_ADMIN=webmaster@airbnb.com-itinerary.app - English not first language

- Sends over location, victim ip-port pair, protocol, client, TLS encryption suite

Client (Victim):

From main.html:

POST /transaction.php?id=1 --> transaction.html

POST /transaction-process.php --> attacker no longer cares...empty response body

Admin

https://airbnb.com-itinerary.app/rooms/762837232/files/manag...

There is a whole interface for easy management of properties, with its own UI! It does proper client and server-side validation of inputs, uses a set of images of houses and hosters.

POST /process-data.php

POST /send-discount.php for a particular property id

POST /edit-discount-process.php

sonicxxg6y ago

Is "Not so technical" euphemism for naive? This sucks, but also seems like a low effort scam.

asdojasdosadsaOP6y ago

Well, I have seen quite many phishing pages and scams, and this was not that low effort scam - probably setting up all the domains and phishing pages etc has taken a bit of work and technical skills

philpem6y ago

This is gonna sound a bit granny-suck-eggs... but I hope your friend reported it to the police?

asdojasdosadsaOP6y ago

Yes, reported to :

- The police

- https://reportphishing.net/airbnb/

- Airbnb report on the listing page - but now to think about it, we can't be sure the listing itself is connected to the scam. The host of the listing is a superhost (whatever that means)

Also the police said, there's not much they can do

gameofcode6y ago

Report to TransferWise as well, I've never used them but have heard their support is decent - that's not to say they'll be able to help you but it's worth doing for sure.

1 more reply

j / k navigate · click thread line to collapse

Ask HN: Tracking down fake Airbnb owner

8 pointsasdojasdosadsa6y ago10 comments

Case: Not so technical colleague got scammed for 2 months rent. What can he do?

Steps: 1. He found apartment listing on immobiliare.it

2. Some emails were exchanged

3. He receives the link to the _real_ airbnb listing

4. He cant find it there, and the scammer sends the phishing page[1] (from @expertdesigner.eu)

5. Soon after he receives another email saying that the database is down from @airbnb.sa.com and he should meanwhile move the money using transferwise.com

6. Payment done

7. Scammer replies: Payment received

The login page was quite well made, and I think most of non technical people might get fooled

[1] The URL: https://airbnb.com-itinerary.app/rooms/762837232/files/login.php?id=572465&locale=en&sale=203&

Thoughts?

10 comments

gus_massa6y ago

The title is slightly confusing. Note that it is a ((fake Airbnb) owner), not a (fake (Airbnb owner)).

BoorishBears6y ago

Literally makes no difference. Both convey the same problem.

In fact if anything, the story is about a (fake) AirBnb owner. The AirBnB was real, the “owner” was fake.

Both are accurate unless you somehow imagined this would be a story about a fake founder of AirBnB (in which case I’d say the confusion is more of a personal problem).

nwsm6y ago

dfyr6y ago

There's more to it, more php machinery, but in short:

Basic Info

- username at home dir: comitin1 - LiteSpeed server - SERVER_ADMIN=webmaster@airbnb.com-itinerary.app - English not first language

- Sends over location, victim ip-port pair, protocol, client, TLS encryption suite

Client (Victim):

From main.html:

POST /transaction.php?id=1 --> transaction.html

POST /transaction-process.php --> attacker no longer cares...empty response body

Admin

https://airbnb.com-itinerary.app/rooms/762837232/files/manag...

There is a whole interface for easy management of properties, with its own UI! It does proper client and server-side validation of inputs, uses a set of images of houses and hosters.

POST /process-data.php

POST /send-discount.php for a particular property id

POST /edit-discount-process.php

sonicxxg6y ago

Is "Not so technical" euphemism for naive? This sucks, but also seems like a low effort scam.

asdojasdosadsaOP6y ago

Well, I have seen quite many phishing pages and scams, and this was not that low effort scam - probably setting up all the domains and phishing pages etc has taken a bit of work and technical skills

philpem6y ago

This is gonna sound a bit granny-suck-eggs... but I hope your friend reported it to the police?

asdojasdosadsaOP6y ago

Yes, reported to :

- The police

- https://reportphishing.net/airbnb/

- Airbnb report on the listing page - but now to think about it, we can't be sure the listing itself is connected to the scam. The host of the listing is a superhost (whatever that means)

Also the police said, there's not much they can do

gameofcode6y ago

Report to TransferWise as well, I've never used them but have heard their support is decent - that's not to say they'll be able to help you but it's worth doing for sure.

1 more reply

j / k navigate · click thread line to collapse