BadBuyerList.org

« Back to home page

Bad Buyer: juanlinda225@gmail.com

Details

Purchase date:July 2017
Buyer's name:Linda Juan
Buyer's username:n/a
E-mail:juanlinda225@gmail.com
Phone number:216-234-5678
Buyer's address24 Cyprus Rd, Hiram, OH 44234
Store:other
Buyer's country:United States
Payment method:Credit Card
Category:Everything Else
Details:

Cross site scripting attempt in form address fields. Given address does not exist for that ZIP code. Buyer's IP comes back to Hong Kong.

Buyer's IP address:43.255.107.136
Reported at:
Reporter:162.158.X.X
« Back to home page

Similar reports

Name/Username E-mail Phone Reported at
Linda Juan juanlinda225@gmail.com 2162345678 2017-07-17
Linda juanlinda225@gmail.com 216-234-5678 2017-08-02
Linda Juan juanlinda225@gmail.com 2162345678 2017-10-12
Juan Linda juanlinda225@gmail.com 2162345678 2017-11-08
Linda Juan juanlinda225@gmail.com 2162345678 2017-11-17

Comments

I forgot to add that it's also a bad email address.


Posted over 7 years ago by 162.158.X.X Report as SPAM

I also got an order with this same information on it. User attempted an XSS attack by including script within the name and address fields. IP indicates that the order was placed from a VPS in Los Angeles.


Posted over 7 years ago by 162.158.X.X Report as SPAM

Got an order with the same info. IP is from VPS in LA. Also tried a script in address and name fields.


Posted over 7 years ago by 162.158.X.X Report as SPAM

Also received on order with this information and XSS attack. It was placed on 08/11/2017.


Posted over 7 years ago by 108.162.X.X Report as SPAM

Yup, just had him order something from my website, I sent him the products, they were delivered/rerouted/lost in the mail, and the financial institution took the money back from me and from paypal. SCAM.


Posted about 7 years ago by 172.68.X.X Report as SPAM

I also got an order. Here is what the script in the address field used looks like.

Linda Juan
24 Cyprus RD">
Hiram">, OH 44234

Credit Card Type:
Visa
Name on Account:
Linda Juan
Credit Card Number:
xxxx-xxxx-xxxx-8412
Expiration Date:
10-18


Posted about 7 years ago by 162.158.X.X Report as SPAM

This person has struck again, trying to place an order from my site with a SQL injection attack in it on 10/10/2017. I would have charitably assumed that they had a virus except for the fact that I googled their address and it was nonexistent.


Posted about 7 years ago by 162.158.X.X Report as SPAM

Same here. No such address.


Posted about 7 years ago by 108.162.X.X Report as SPAM

Caught this buyer today. Shipping address when you remove the script doesn't even exist.

Here is about what it looks like, with the script urls removed

Linda Juan
">
24 Cyprus RD">
Hiram">, WV 25530

Credit Card Type:
MasterCard
Name on Account:
Linda Juan
Credit Card Number:
xxxx-xxxx-xxxx-6902
Expiration Date:
08-19


Posted about 7 years ago by 162.158.X.X Report as SPAM

I got an order from this same person on my site as well back on 9/24/17. Credit card company is trying to reclaim the funds right now. :( I had the same issue with the order being delivered/rerouted/lost in the mail.

Bill To:
Linda Juan">
">
24 Cyprus RD">
Hiram">, Ohio 44234
United States
Daytime Phone: 2162345678
juanlinda225@gmail.com

Payment Method
Visa XXXXXXXXXXXX3289


Posted about 7 years ago by 172.68.X.X Report as SPAM

Same, just received today. The 'script' issue made me look up address. This time it was in 'Arizona'. Order not going to be completed!!


Posted about 7 years ago by 198.41.X.X Report as SPAM

Just received an order on 12/11/2017 tried to contact email juanlinda123@gmail.com but doesn’t exist. Wondrrd why email was returned twice so googled the delivery address 24 Cyprus Rd, Hiram USA and saw all these comments

Item won’t be delivered!! Thank you for free cash!!


Posted about 7 years ago by 162.158.X.X Report as SPAM

Had same person try this twice in past month. I have full security options turned on for Paypal (Paypal Advanced), this one had both an invalid address and invalid CSC -- yet Paypal still approved the payment for some stupid reason. Promptly cancelled and refunded money to CC.
To those that are using Paypal - don't count on them to properly filter out bad payments based on AVS and CSC verification.
To the last person who said "Thank you for free cash!!". Um... it is only free until the CC company comes back for it.


Posted about 7 years ago by 108.162.X.X Report as SPAM

Same here. I'll cancel the order and refund. Happy that I have googled up.


Posted about 7 years ago by 141.101.X.X Report as SPAM

Order placed 11/25/17 00:55:18 EST. Fortunately, our online merchant requests the 3-digit security code to verify the transaction. Generally, we go ahead and start the order knowing that the customer will want something they ordered "custom" but this one looked suspicious. When we emailed and called, the email was rejected and the phone number was busy. We cannot believe someone would scam us for $30 but I guess it adds up eventually. The order included src script info. The credit card ended with #4572 and expired 1/19 with the following info:
Linda Juan
juanlinda123@gmail.com
8139402930
Linda1986
24 Cyprus RD
Hiram OH 44234
U.S.

-------------------------------------------------------------------------------------------
Mousepad-CustomMousepad Custom Image 1 $18.00 $18.00


Posted about 7 years ago by 172.69.X.X Report as SPAM

It's more devious than trying to scam you out of $30 and anything you sent would have been rejected at the post office at the time of sending as the address does not exist. You will find that what they are trying to do is inject XSS code into your fields in the hope of getting in to your financial system.


Posted about 7 years ago by 162.158.X.X Report as SPAM

Received an order from same address/person. will not ship. Ordered a $2 item and paid $7 to ship. Looked suspicious and address non existent and phone busy. thanks


Posted almost 7 years ago by 108.162.X.X Report as SPAM

Received an order on our wholesale website which does not take money from customers as we then ask our resellers to look after the "order" and take them on board as customer. Exact same address but listed as Sydney 2000 - that address does exist in Sydney but in a suburb called St Marys. Email bounces, phone number not connected - so it is ignored.

GARY LE
24 Cyprus RD>
Sydney, New South Wales 2000
Australia
Phone: 0482737472
Email: juanlinda888@gmail.com
Company: Linda1986


Posted almost 7 years ago by 108.162.X.X Report as SPAM

Further - I googled the address and this badbuyerlist came up as first results. I recommend to always google addresses when things don't add up like matching post code / zip code / city / suburb, etc... Another common scam I have encountered is the use of vacant properties for delivery addresses where the fraudster waits for the delivery at the vacant property, receives the item and goes.


Posted almost 7 years ago by 108.162.X.X Report as SPAM

Received an order from the same person with Sydney address, phone is disconnected and email bounced back.


Posted almost 7 years ago by 162.158.X.X Report as SPAM

Thank you to all of you have listed above. I just got an order from them today and Googled their address and this page popped up, so I won't be sending the goods. Thnx. :-)


Posted almost 7 years ago by 108.162.X.X Report as SPAM

Our turn today. Visa ended in 2375. Thanks to everyone above.


Posted almost 7 years ago by 162.158.X.X Report as SPAM

Same thing here:

Order Number #52439
Order Date January 15, 2018
Shipping Address
Linda Juan">
Linda1986
24 Cyprus RD">
Hiram, OH 44234
Phone: 813-940-2930
Email: juanlinda666@gmail.com
Billing Address
Linda Juan">
Linda1986
24 Cyprus RD">
Hiram, OH 44234
Phone: 813-940-2930
Email: juanlinda666@gmail.com

Payment Details
Visa ************8590 $200.04


Posted almost 7 years ago by 162.158.X.X Report as SPAM

Also had an order from "linda Juan" that looked like an attack.
BE CAREFUL


Posted almost 7 years ago by 162.158.X.X Report as SPAM

Just got an order from them today online for $23.74....would never have known other than the address did not compute on the shipping system. Thank you for this website!!!!!!!!!!!!!!!!!!!!!!!!!!!


Posted almost 7 years ago by 108.162.X.X Report as SPAM

Got an order from Linda Juan- same story - no such address or phone.
First Transaction failed (badcard)
2nd one succeeded - money is in the bank $74.26 (so far) ...
Interesting that gateway processed the transaction w/o correct address or ZIP - neiter one matched - I thought this would not happen???

CC# xxxxxxxxxxxx0629


Posted almost 7 years ago by 172.68.X.X Report as SPAM

Still happening. Order came in and went through bank January 18. Shipped and returned from USPS - "No such address". I expect the bank will get their funds back soon. Need to check on the script though - if it infected the website or went for the banks.


Posted almost 7 years ago by 162.158.X.X Report as SPAM

Got an order last night. Last four digits 2322. Strange script was inserted into their name. Thank you so much for reporting this, it is helpful!


Posted almost 7 years ago by 172.69.X.X Report as SPAM

ship to:
Linda Juan
Linda1986
24 Cyprus RD
Hiram, Ohio 44234

billing:

KEN FRANCIS
Linda1986
5695 VISTA LUNA DR
SPARKS, Nevada 89436

Item returned back to me for bad address, phone number is busy (8139402930) and email bounces back (juanlinda678@gmail.com). Code also included in billing and shipping fields. Charge blocked the first time by credit card company for failing street and zip check (tried using the Hiram, OH address). Passed the second try using the Nevada address.


Posted almost 7 years ago by 162.158.X.X Report as SPAM

So lucky to find those information here, got an order like this:
Linda Juan
24 Cyprus RD"__script src=//zs.mk/b__/script_
Hiram, OH 44234
United States

Paid by Credit card, ignore it.

Thank you for all reports.

Mike


Posted almost 7 years ago by 162.158.X.X Report as SPAM

This is the second time this has been attempted thru our website. This time the e-mail address used is: juanlinda666@gmail.com


Posted almost 7 years ago by 172.68.X.X Report as SPAM

Received the same XSS attack, name, address here, with a different non-functioning email. Thanks to these comments I cancelled the order and informed the credit card issuer.


Posted almost 7 years ago by 162.158.X.X Report as SPAM

Also received an Order for a Linda Juan. Billing address was 24 Cyprus Rd, Ohio and Shipping address was 24 Cyprus Rd, NSW however order was placed from Hong Kong. We have received the money but have not been contacted as to how to proceed.


Posted over 6 years ago by 172.69.X.X Report as SPAM

Same order. Same code attack. 24 Cyprus RD.


Posted over 6 years ago by 172.69.X.X Report as SPAM

We sent an order to Linda Juan, 24 Cyrus Rd, Ohio 44234 a month ago which was just returned as the address does not exist... Should have googled the address went it came up weird in our system.


Posted over 6 years ago by 172.69.X.X Report as SPAM

5th order of ShortSniffer electrical short circuit locator in 3 months. We are using BrainTree order processing.

Linda Juan">
Linda1986
24 Cyprus RD">
OCCIDENTAL, CA 95465
8139402930
2juanlinda666@gmail.com


Posted over 6 years ago by 172.68.X.X Report as SPAM

Same here, uses these emailadresses:

juanlinda123 gmail com
juanlinda124 gmail com
2juanlinda666 gmail com


Posted over 6 years ago by 162.158.X.X Report as SPAM

Just got an order from this person and Googled the address because of the script, it was incomprehensible. I am so glad I found this. Order cancelled.


Posted over 6 years ago by 172.68.X.X Report as SPAM

Same as above, tried to purchase a gift card for $25, phone # disconnected and email bounced back, juanlinda123@gmail.com. Address search brought up this page, 24 Cyprus Road Hiram, OH 44234. Order not processed.


Posted over 6 years ago by 172.68.X.X Report as SPAM

Holy shit. Just ordered something from my site that I do not even offer anymore. The page was still valid but it is in a subfolder that is not linked from the site. No clue how they found it. Plus this is exactly how the data appeared on the receipt. Had a problem with the address and found this page. Guess I ain't shipping anything.
Billing Information
Name: Linda Juan">
Address: 24 Cyprus RD">
SOLANA BEACH, CA 92075
United States
Payment By: MasterCard
CC Number: ************7122
Expiration: 31/08/18 (D/M/Y)
Status: APPROVED - 082929
Day Phone: (813) 940-2930
Night Phone: (813) 940-2930
Email: 2juanlinda666@gmail.com


Posted over 6 years ago by 172.68.X.X Report as SPAM

We shipped an order to this "customer" (whoops)
Linda Juan
24 Cyprus RD
NEW ORLEANS, LA 70115
juanlinda123@gmail.com
813-948-2638

Luckily FedEx notified us of the bad address, so we will get our +$200 product back.


Posted over 6 years ago by 172.69.X.X Report as SPAM

My hit was for $14.95. Not only was it free freight, but I sent an employee to the post office to buy a $6.99 padded envelope and postage to ship it.

Fast forward 5/15/18: The charge was disputed and the bank charged me an additional $15, total $29.95 and reversed the charge.
I tracked the package as undeliverable and returned to sender (us). The package, however, was never received by us.

I researched her address and phone number and found this site. Thanks for the costly lesson!

I'm telling you this in the event you see something weird like this from your clients. Maybe it's best to call all of the orders that come in to confirm/verify validity as well as address. We should have checked it out when the address was encrypted:

Linda Juan">
24 Cyprus RD">
Hiram, Ohio, 44234
United States
T: 8139402930

I doubt I will see the product or the money at this point...


Posted over 6 years ago by 172.68.X.X Report as SPAM

This buyer is still at it on 6/18

Billing Address:

Linda Juan
24 Cyprus Rd
">
Hiram OH 44234
813-947-2738
juanlinda678@gmail.com

ip address: 45.63.48.18

Shipping address contained another script:


Posted over 6 years ago by 173.245.X.X Report as SPAM

Any ideas on what the script does? The script they tried to include in the order through my site was jb[dot] gy/9


Posted over 6 years ago by 108.162.X.X Report as SPAM

Report them to ICE under the cyber crime category.


Posted over 6 years ago by 172.68.X.X Report as SPAM

Just received an order from her/them?? The email address given was 2juanlinda666@gmail.com Billing was to Linda Juan">
24 Cyprus RD Hiram, FL 44234


Posted over 6 years ago by 162.158.X.X Report as SPAM

received an order from this person/ address on 07/16/2018. We didn't know this is a fake address until the mail got returned to back due to address does not exist. Order placed by 2juanlinda666@gmail.com, address as below:

Mr. Linda Juan">
, 24 Cyprus RD">
Hiram, OH, 44234, United States of America


Posted over 6 years ago by 108.162.X.X Report as SPAM

I also got an order with this same information on it. User attempted an XSS attack by including script within the name and address fields. IP indicates that the order was placed from a VPS in Los Angeles. http://123dressupgames.net/halloween-dress-up-games.html


Posted about 6 years ago by 172.69.X.X Report as SPAM

I'm telling you this in the event you see something weird like this from your clients. Maybe it's best to call all of the orders that come in to confirm/verify validity as well as address. We should have checked it out when the address was encrypted https://123gamesfree.com/game-free-motorcycle/


Posted about 6 years ago by 172.69.X.X Report as SPAM

Got an order on 12/26 from the 'customer' below:
Linda Juan
24 Cyprus RD
Hiram, OH 44234

Each field in the address had "">


Posted almost 6 years ago by 172.68.X.X Report as SPAM

They’re back! Received this order today from them.
Order Details - Order Date:12/08/20

Customer Name: Linda LindaJuan
Customer Email: juanlinda555@hotmail.com
Customer Phone: 761251354
Billing Address:
24 Cyprus RD">

Attleborough
Norfolk
NR17 2DY
United Kingdom

Delivery Address:

Customer Comment:
'">
*********** Payment Details ***********

Payment Method: Cheque Card No/Ref:
Start Date: End Date:
Security No: 46 Issue No:
Currency Used: CAD


Posted over 4 years ago by 162.158.X.X Report as SPAM

She also uses this email address: juanlinda777@hotmail.com


Posted over 3 years ago by 162.158.X.X Report as SPAM

Linda Juan">
444 Rollins St"> '"> Missoula
Montana
59801
United States
Telephone: 3059707467
juanlinda666@hotmail.com

Did not get past PayPal paywall.


Posted over 3 years ago by 162.158.X.X Report as SPAM

^ same info ^
just ordered a bottle of wine from my winery... Billing address was 3263 Parks Ave Tulare, CA 93274


Posted over 3 years ago by 162.158.X.X Report as SPAM

This attack is still doing the rounds, my site was attempted to hack today from this IP in Hong Kong 47.240.73.196

Same pseudo script crap in the address fieldfrom Linda Juan ">


Posted over 2 years ago by 78.150.X.X Report as SPAM
Your comment cannot be longer than 1000 characters, or contain more than 2 URLs. All HTML tags will be removed. In order to prevent SPAM, some words are not permitted in comments.

Random bad buyers

Name/Username E-mail Phone Reported at Comments
fay neiman tunatuna98@gmail.com 929-441-0000 2018-12-12 0
Eka Abdulla elgun121@gmail.com +994 55 743 95 45 2018-10-20 1
Jean F 450-888-8888 2021-01-20 3
marco gallardo kristinanarvaez@rocketmail.com 310 462 9089 2014-01-07 0
Solange Croaker 1m8vxy6y8j8x6t7+A0012939YA8NR95W6H9N@marketplace.amazon.ca 647-286-0617 2021-01-21 0