News for hackers. Stuff that matters.

A comment on Ask HN: I think I've been scammed - what now?. Parent comment

Re:Ask HN: I think I've been scammed - what now? by profquail on Sunday January 30, 2011 @10:41PM (#2160180)
If you examine the DNS records for wikizu.com, you'll find:

    wikizu.com		SOA	
    server:	ns1.linode.com
    email:	[email protected]
    serial:	2010102781
    refresh:	14400
    retry:	14400
    expire:	1209600
    minimum ttl:	86400
        86400s
    wikizu.com		NS	ns4.linode.com	86400s
    wikizu.com		NS	ns1.linode.com	86400s
    wikizu.com		NS	ns2.linode.com	86400s
    wikizu.com		NS	ns5.linode.com	86400s
    wikizu.com		NS	ns3.linode.com	86400s
    wikizu.com		MX	
        preference:	10
        exchange:	mail.wikizu.com
        86400s
    wikizu.com		A	69.164.209.157	86400s
So, that gives you an email address (maybe). Then, if you lookup which domains are hosted on the same IP as the mail server there (the MX record), you'll find:

  * crushtease.com
  * earcavity.com
  * seoette.com
  * sinkfloat.com
  * wikizu.com
Two of those we haven't seen yet. I'm not going to post anyone's personal info here...but if you're the kind of person that likes to do whois searches (and who isn't!), you'd find some relevant contact info. You might also then search DDG for the site name and look at a few of the top results.
[ Parent | on HN ]

There are no comments on this comment yet.