To slam a scam

**AhmedBahgat**

Hello all

Today I feel a bit happy despite there is nothing that happened to be happy about, anyway I receive zillions of spam/scam emails every day, my spam filter handles it well, so today I looked at the spam mail and decided to reply to those filthy eBay scammers, normally I empty the spam folder, but today I had some time to waste.

See the URL they sent me to fill in an online confirmation form:

http: //cgi.ebay.com.jiki.com.mx/ws/eBayISAPI.dll/?cfom=9751462430666493026763305259645

Certainly that is not from eBay, for those who don't know how to find out, just look at what comes after eBay.com and if there is no "/" then you should see the domain that those thieves use for their online scam, I have underlined it above, I also added a space after http: so no one can click on the link above for protection, but if you want to visit them and leave them a message as I did, then go for it and fear nothing, of course you will not fill your info as they ask you, you may do something like this:

Thumbnail, click to enlarge.

Imagine the world flood them with such form as I did, you know, we will fill their database with crap like the above

Cheers

**AhmedBahgat**

After you press the submit button, the scammers show you this message:

Thumbnail, click to enlarge.

What a bunch of filthy arseholes, they are telling the dumbs, thank you, now we will direct you to our home page

Then they take you to the real eBay home page:

See the link they sent me to:

And certainly I know that this is the real eBay site, now everyone who read this thread should know, how I knew it?

From the "/" that came straight after http://www.ebay.com/

You can see the forward slash bolded and underlined, now compare the real eBay URL with the fake one they sent me and a child should spot the fake one

This applies to all scam mail that come (as if) from a bank

Salam

**AhmedBahgat**

And if you want to get the scammers IP address too, this is how you do it

Start -> Run

then type CMD

then press <Enter>, this will start MS DOS session (the black screen)

Now we know that fake domain those arseholes use, it is :

cgi.ebay.com.jiki.com.mx

All you need to do is to type the following at the DOS command prompt:

Ping cgi.ebay.com.jiki.com.mx

Then press <Enter>

The above host should be resolved to its IP address through the internet DNS, and ping should come back with a reply (if pinging is allowed at the csammers host), or ping may come out with request time out, however in both cases the above host should resolve to its IP address and you should see it in the ping result, here is what I got:

Thumbnail, click to enlarge.

I have underlined in white where you should see the IP address of the scammers, what comes after that line is irrlevent, i.e. regardless you get a reply (as I did) or you get a request time out, you should still know their IP adfdress from that line

and in ths case the scammers are using an IP address, 89.216.203.197

Now, if you want to know which country those arsehole scammers are working from, easy, go to this web site:

http://www.ip2location.com/

on the right hand side under (Live Product Demo), enter the scammers IP afddress we obtained from the Ping utility and press find location, in this case the arseholes are working from:

Thumbnail, click to enlarge.

Here you have it, we pinpointed the server where such scam is hosted

I wonder why the hell they do not arrest them?