spammer/fraud used this smtp to send email with fake invoice claiming to be ebay canada. See detail below: Return-Path: <donotreply_billing@ebayexprees.com> Tue, 28 Nov 2017 09:43:27 -0700 (MST) Received: from phx02-17923225.ebayexprees.com (smtp-out-set2-210.dpduk.com [178.32.30.79]) DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=dkim1k; d=ebayexprees.com; h=Date:From:To:Message-ID:Subject:List-Unsubscribe:MIME-Version:Content-Type; i=donotreply_billing@ebayexprees.com; bh=9qEIHShafB40SIRHwqAorwbb2JA=; b=Q1+XDtuKkKGfER2e/vanvnDFuvRBjuPUvvWFcXwoIpxaEnRLRkD8eycmHld6grA1Kfl/tT4wxTHz mYebOEMNuqmtgaTMEey6SE7QnBgZKKtRCFQDH+zouFAckLc1mib6S5zjzsmmgChP3kswwWv2gwh9 2cDbG8K6SzxMQR4wj9I= DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=dkim1k; d=ebayexprees.com; b=QpgydZacn9bVKhYEacDgrnsqKoQA7Mn4Gpw1QouF+cT/50km0QtFKlgiXurwAYfxq8YbsusgoIrW cf1en+iC0IWB6mXD/ysQHNcn9/no9zsuAPVZUToEFeq1/OxDNDjJ7dOLuCLowSQylt/qM1n7fxRg PsOeUX0qkoFEBOddXck=; Date: Tue, 28 Nov 2017 07:47:22 -0800 From: "eBay" <donotreply_billing@ebayexprees.com> To: Message-ID: <4218fccbf-8828bbccf-6456fbfca-6643aafc-896edcfd@phx02-1558916> Subject: Your eBay invoice for November is now ready to view List-Unsubscribe: <mailto:unsubscribe@ebayexprees.com?subject=unsubscribe> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_Part_137571759_1156169556.146480344768"
Please help us keep Internet safer and cleaner by leaving a descriptive comment about 178.32.30.79 IP address
- Hacked Gmail accounts
- WordPress Hacking Attempts
- SSH Hacking Attempts
- Why Can't I See The Exact Address?
DNSBL* - is a list of IP addresses published through the Internet Domain Name Service (DNS) either as a zone file that can be used by DNS server software, or as a live DNS zone that can be queried in real-time. DNSBLs are most often used to publish the addresses of computers or networks linked to spamming; most mail server software can be configured to reject or flag messages which have been sent from a site listed on one or more such lists.
WHOIS** - is a query/response protocol that is widely used for querying databases in order to determine the registrant or assignee of Internet resources, such as a domain name, an IP address block, or an autonomous system number. WHOIS lookups were traditionally performed with a command line interface application, and network administrators predominantly still use this method, but many simplified web-based tools exist. WHOIS services are typically communicated using the Transmission Control Protocol (TCP). Servers listen to requests on the well-known port number 43.
** Approximate Geographic Location - This is NOT the exact geographical location of the person/organization with the given IP address. However, this should still give you a good idea about the area/region where this person/orgranization is located.