thoocan.com link for Halifax phishing fraud email. Source of phishing scam from User of IP located in Missoula,MT, USA. Link actually takes you to thoocan.com/blog/personal/logon (DO NOT CLICK ON LINK) X-Message-Info: xs4t2aw5kdIkYqJHv3RzMUfft1bpaVLbanHFclQSaxJ+ppNOOpSqKzX5TBIaNBAYD/I8ErnRso6zz0O6IhWbWqtI0z1YYi/8Yd8XIlX5avJrk3hwvtBEIUmar0Ue0am8AsQvaRh+pOP1ubNMsEif9g== Received: from p02c11o142.mxlogic.net ([208.65.144.75]) by SNT0-MC1-F24.Snt0.hotmail.com with Microsoft SMTPSVC(6.0.3790.4900); Thu, 17 May 2012 06:05:15 -0700 Received: from unknown [184.82.171.110] (EHLO eithanhahn.com) by p02c11o142.mxlogic.net(mxl_mta-6.14.0-1) over TLS secured channel with ESMTP id c77f4bf4.0.58164.00-388.115437.p02c11o142.mxlogic.net (envelope-from <halifax@helpdesk.co.uk>); Thu, 17 May 2012 07:05:15 -0600 (MDT) X-MXL-Hash: 4fb4f78b277d497b-0a9126787fc9ad0278d645496cbc7c4938358bef Received: from User ([208.98.22.106]) by soceus.com with MailEnable ESMTP; Thu, 17 May 2012 09:01:53 -0400 From: halifax@helpdesk.co.uk Subject: Security Message Alert
Please help us keep Internet safer and cleaner by leaving a descriptive comment about 208.98.22.106 IP address
- Hacked Gmail accounts
- WordPress Hacking Attempts
- SSH Hacking Attempts
- Why Can't I See The Exact Address?
DNSBL* - is a list of IP addresses published through the Internet Domain Name Service (DNS) either as a zone file that can be used by DNS server software, or as a live DNS zone that can be queried in real-time. DNSBLs are most often used to publish the addresses of computers or networks linked to spamming; most mail server software can be configured to reject or flag messages which have been sent from a site listed on one or more such lists.
WHOIS** - is a query/response protocol that is widely used for querying databases in order to determine the registrant or assignee of Internet resources, such as a domain name, an IP address block, or an autonomous system number. WHOIS lookups were traditionally performed with a command line interface application, and network administrators predominantly still use this method, but many simplified web-based tools exist. WHOIS services are typically communicated using the Transmission Control Protocol (TCP). Servers listen to requests on the well-known port number 43.
** Approximate Geographic Location - This is NOT the exact geographical location of the person/organization with the given IP address. However, this should still give you a good idea about the area/region where this person/orgranization is located.