[SC-Help] Ebay phishing links not found on first try?

[David Butler]

http://www.spamcop.net/sc?id=z746918241zcbba29f8580c21475db3799aada25376z

only found the source of this spam, not either the phishing link nor the
"real " ebay links.

Manual parsing found:

Parsing input: pages.ebay.com
host pages.ebay.com (checking ip) = 66.135.192.87
host 66.135.192.87 = pages.ebay.com (cached)
No recent reports, no history available
Routing details for 66.135.192.87
[refresh/show] Cached whois for 66.135.192.87 : network at ebay.com
Using abuse net on network at ebay.com
abuse net ebay.com = spam at ebay.com, postmaster at ebay.com

Parsing input: webopedia.internet.com
host webopedia.internet.com (checking ip) = 63.236.18.21
host 63.236.18.21 = webopedia.com (cached)
No recent reports, no history available
Routing details for 63.236.18.21
[refresh/show] Cached whois for 63.236.18.21 : abuse at qwest.net
Using best contacts abuse-nonverbose at qwest.net

Ran the parse again (same tracker in seperate window...):

and it found those as well as several others...


Re: http://www.ebaycareers.com/ (Administrator of network hosting website
referenced in spam)
   To: abuse at mci.com (Notes)

Re: http://www.ebayorama.com/ (Administrator of network hosting website
referenced in spam)
   To: abuse at verio.net (Notes)

Re: http://www.nsoft.it/scripts/mailform.exe (EXPERTS ONLY: SpamCop deputy
will review this website.)
 no Javascript = no confirmation = no appeal
   To: Internal spamcop handling: (appeals) (Notes)

Re: http://www.paypal.com/ (Administrator of network hosting website
referenced in spam)
   To: spoof#ebay.com at devnull.spamcop.net (Notes)
   To: spam at ebay.com (Notes)
   To: postmaster at ebay.com (Notes)

Re: https://certificates.ebay.com/ (Administrator of network hosting website
referenced in spam)
   To: spoof#ebay.com at devnull.spamcop.net (Notes)
   To: spam at ebay.com (Notes)
   To: postmaster at ebay.com (Notes)

any idea why ?