[SpamCop-List] Re: Active eBay phishing sites beyond the radar
SCNews.5.myspamgobbler at spamgourmet.com
Sat Feb 5 11:10:01 EST 2005
George Langford, Sc.D. wrote:
> Hello eBay:
> The following site has been active since October 30, 2004:
> http://188.8.131.52/.ls/ for which the Spamcop tracker is:
> This one has been reported to: padkla at aviso.ci, assied at aviso.ci, and
> postmaster at opentransit.net, apparently to no avail.
> It gets worse. The guy appears to be getting set to do it again:
> http://184.108.40.206/cetig/.images/index.html (returns a blank screen
> but the HTML code is still there ... ?). However, read on; there's more.
> The Spamcop tracker for one of the three emails originally received is:
> See also: http://220.127.116.11/cetig/index2.htm but the following is
> the actual eBay phishing source is now in a new index file:
> This sourcecode has been changed since I last reported the site. Note that
> the IP address is the same as the site at the top of this page. I reported
> this site to assied at aviso.ci and j.zano at aviso.ci, clearly to no avail.
> The following site also remains active:
> For which the Spamcop tracker is:
> This site was reported to: hjs123 at kt.co.kr, kren at snu.ac.kr, and mail-abuse at yahoo-inc.com. I am
> now reporting it also to slurp at inktomi.com.
> What's a concerned citizen to do ?
> George Langford, Sc.D.
> amenex at amenex.com
One of the things that I do is notify eTrust when I see their logo on
bogus sites. I did file a report.
Same with Verisign
I'm not sure that this does any good, but I would think it may help to
bring in some 'big guns'
I also found jefpro at nic.ci - hmmm, that's interesting because that is
not the address shown. This may be the perp's email address. Down at the
very bottom of 18.104.22.168 it shows an email address of
ahissi at nic.ci but the address is actually jefpro and on checking, this
is a valid address according to CentralOps.
Digging further, nic.ci is Network Information Center Côte d'Ivoire.
They show a support at nic dot ci address that may be useful. No abuse
addy listed with abuse.net.
http://www.nic.ci/presta_net.htm may be helpful. This may be the place
More information about the SpamCop-List