Wednesday, April 26, 2006

Sure. I trust you. Lets fry this clown. mmjd1996

Another email from another eBay customer.
Sure. I trust you. Lets fry this clown..

Here is the text of the scam email :

 Question from mmjd1996
Item: (4629414062)
This message was sent while the listing was active.
mmjd1996 is a potential buyer.
Hi, how much would be shipping to Germany? Thanks

Using I find out our scammers IP address. URL points to:

1393442438 is decimal for

Seems to be a box on some DSL line in Poland..

IP address:
Reverse DNS:
Reverse DNS authenticity: [Verified]
ASN: 5617
ASN Name: TPNET (Polish Telecom's commercial IP network)
IP range connectivity: 2
Registrar (per ASN): RIPE
Country (per IP registrar): PL [Poland]
Country Currency: PLN [Poland Zlotych]
Country IP Range: to

The ISP is Poland Telecom. Here are the ISP contact numbers and email addresses.

role: TP S.A. Hostmaster
address: TP S.A. "POLPAK"
address: ul. Nowogrodzka 47A
address: 00-695 Warszawa
address: Poland
phone: +48 22 6252383
fax-no: +48 22 6225182
remarks: trouble: Network problems:
remarks: trouble: Abuse and spam notification:
remarks: trouble: DNS problems:
remarks: trouble: Routing problems:
admin-c: TK569-RIPE
tech-c: TK569-RIPE
tech-c: JS1838-RIPE
nic-hdl: TPHT
remarks: ! - ! - ! - ! - ! - ! - ! - ! - ! - ! - !
remarks: Please send spam and abuse notification only to
remarks: ! - ! - ! - ! - ! - ! - ! - ! - ! - ! - !
mnt-by: TPNET
changed: 20030122
changed: 20030904
changed: 20060306
source: RIPE

Port scan shows nothing but FTP and SSH. No UDP ports open.

So I shoot a quick email to the boys at Polish Telecom (

I also paste the bougus URL into
(That feeds our "Phisherman" with hundreds of bogus usernames and passwords.)

That should keep him busy for a few days.

Just another day ho hum.


Post a Comment

<< Home