Le site 163.com est-il sûr ?

I made a mistake and bought (or rather, tried to buy) something via PayPal which payment ended up being sent to youlinlan11@163.com. I know better, but I belatedly did my research afterward, when I received NO acknowledgement of my purchase, no receipt, no tracking number, nada. Found out that the site itself, 163.com, is legitimate. But it is also a provider of free email addresses to over a billion people in China. So ... looks like they provided this scammer with a free email address. I will definitely be more careful in future, and will be seeking redress from PayPal for money sent but no product received. Watch out for this one!

Return-Path: <wscvpuhfn@*****> X-YahooFilteredBulk: ***** Received-SPF: none (domain of ***** does not designate permitted sender hosts) X-Originating-IP: [153.92.0.96] Authentication-Results: ***** from=ezrtc.com; domainkeys=neutral (no sig); from=163.com; dkim=neutral (no sig) Received: from ***** (EHLO *****) (153.92.0.96) by ***** with SMTPS; Tue, 30 May 2017 10:02:09 +0000 Received: from ***** (localhost [127.0.0.1]) by ***** ([000webhost.com Mail System]) with SMTP id 2C59A404AF8E for ; Tue, 30 May 2017 10:02:09 +0000 (UTC) X-Fuglu-Suspect: 12e70bd863b646faac9cca7de4d69732 Received: from ezrtc.com (unknown [180.123.147.42]) by us-imm-postfix1.000webhost.io ([000webhost.com Mail System]) with ESMTP id C447E404AF8D for ; Tue, 30 May 2017 10:02:07 +0000 (UTC) Received: from vps5794 ([127.0.0.1]) by localhost via TCP with ESMTPA; Tue, 30 May 2017 18:01:22 +0800 MIME-Version: 1.0 From: Sally <xuan65928399144@163.com> Sender: Sally <wscvpuhfn@ezrtc.com> Reply-To: Sally <xuan65928399144@163.com> Date: 30 May 2017 18:01:22 +0800 Subject: =?utf-8?B?UmU6RGVlcCBDeWNsZSBCYXR0ZXJ5IE1hbnVmYWN0dXJlciAvIFNVTlNUT05FIFBPV0VS?= Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: base64 Message-Id: <20170530100209.2C59A404AF8E@us-imm-postfix1.000webhost.io> Content-Length: 1521

Is sending spambots, "Found 1000 entries for "@163.com"" ***** It is not that they have been abused by some spam bots, they are a source of spam bots, and they allow them to use their service/site. That is what they are there for.

From the header of a spam message: m13-97.163.com ([220.181.13.97]). "Brigida_summary 4249" with .doc attachment reportedly a resume (not). IP is traced to "ChinaNet Beijing Province Network", Beiging, China. Domain lookup indicates that the Registrar is "Markmonitor, Inc.", and the Contact is "Netease". Check out all of the comments, I'll leave it at that. Bad. More spam: "FedEx Shipment ***** Address Change Required for Jerry Li". Message header: m13-97.163.com ([220.181.13.97]). More of the same with a suspicious attachment. They do not give up: "FedEx Signature Proof of Delivery Letter 11346685". Message header: m13-144.163.com ([220.181.13.144]) . Blocking the entire address range.

Hosts spammers reply addresses. NEVER trust a spammer NEVER buy from spammers (High fraud risks) NEVER visit spammed web sites (High malware risks) ***** *****