Spammer knew my customer was on eBay at 4AM. How?

[ComputerRepairTech]

because if i have an image loading from my server like img src=http://computerrepairtech.com/image.bmp then the customers browser has to pull the image from my server and id be able to see that.

 

[nlinecomputers]

because if i have an image loading from my server like img src=http://computerrepairtech.com/image.bmp then the customers browser has to pull the image from my server and id be able to see that.

But all that will tell you is your IP. You will still have to figure out the location of the IP and manage to get enough info to put together at least a phone number and so on. Better odds on the lotto. Though some such photos could have malware that could be injected into a system but the OP's client comes up clean.

I still say that the client is misrecalling it. The caller never said a time of day to her. She put that into the memory herself because she normally isn't insomnia eBaying at 4am. The oddness of that added with the oddness of the call caused her to link the events in her mind. It is a very common logical fallacy called "Post hoc ergo propter hoc" / "after this, therefore because of this"

 

[Mick]

Slim chance of a browser hi-jack? She thought she was on E-Bay, but actually.....

 

[ComputerRepairTech]

But all that will tell you is your IP. You will still have to figure out the location of the IP and manage to get enough info to put together at least a phone number and so on. Better odds on the lotto. Though some such photos could have malware that could be injected into a system but the OP's client comes up clean.

I still say that the client is misrecalling it. The caller never said a time of day to her. She put that into the memory herself because she normally isn't insomnia eBaying at 4am. The oddness of that added with the oddness of the call caused her to link the events in her mind. It is a very common logical fallacy called "Post hoc ergo propter hoc" / "after this, therefore because of this"

Remember I said if they purchased from the seller they would have the information and be able to associate it to the IP. Its just a possibility I mentioned its certainly not something i've heard of happening.

 

[nlinecomputers]

Last time I checked eBay doesn't give you the IP of the person that buys from you. Other than a list of IPs of those PCs that viewed your pic there is no way to associate that with activity on eBay. And that still doesn't give you a phone number.

 

[trevm999]

A seller would be able to match my information pretty easily doing this

 

[ComputerRepairTech]

Last time I checked eBay doesn't give you the IP of the person that buys from you. Other than a list of IPs of those PCs that viewed your pic there is no way to associate that with activity on eBay. And that still doesn't give you a phone number.

Yeah thats what I said earlier would be easy enough to match ip with the seller and unless they changed something in the last few years buyers phone number is available in the system. I haven't sold on ebay in a long time so i'm not sure if the system has changed for phone numbers.

I'm sure the real issue is something less unique.

 

[Larry Sabo]

Quick update: DNS in adapter settings and router were not compromised; HOSTS file was empty. d7 MalwareScan found just a couple of out-of-place files and a couple of crapware items/search scopes. ADWCleaner removed a little (typical) junk, nothing serious. KIS UI wasn't active at one point and said there was an update available. After installing the KIS program update and re-activating it, it found a few threats (my old AmmyyAdmin app and some minor crapware). A scan with BD Rescue disk came up clean. So, I'm none the wiser.

 

[glennd]

Quick update: DNS in adapter settings and router were not compromised; HOSTS file was empty. d7 MalwareScan found just a couple of out-of-place files and a couple of crapware items/search scopes. ADWCleaner removed a little (typical) junk, nothing serious. KIS UI wasn't active at one point and said there was an update available. After installing the KIS program update and re-activating it, it found a few threats (my old AmmyyAdmin app and some minor crapware). A scan with BD Rescue disk came up clean. So, I'm none the wiser.

I reckon it was pure fluke. If you call enough people and mention ebay you're gonna get lucky eventually and probably sooner rather than later. Of course you have to go through the motions of checking out the system but because the customer figured out it was a scam and hung up, nothing bad happened.

 

[Markverhyden]

Quick update: DNS in adapter settings and router were not compromised; HOSTS file was empty. d7 MalwareScan found just a couple of out-of-place files and a couple of crapware items/search scopes. ADWCleaner removed a little (typical) junk, nothing serious. KIS UI wasn't active at one point and said there was an update available. After installing the KIS program update and re-activating it, it found a few threats (my old AmmyyAdmin app and some minor crapware). A scan with BD Rescue disk came up clean. So, I'm none the wiser.

Remember that Ammyy Admin was breached. But no one really knows for sure how long it was.

https://securelist.com/blog/research/75384/lurk-a-danger-where-you-least-expect-it/

 

[Larry Sabo]

Remember that Ammyy Admin was breached. But no one really knows for sure how long it was.

I believe that was long after I downloaded and customized Ammyy, assigning a password during customization. I don't know whether that would affect vulnerability or not but I hope is was still secure. I have yet to receive any concerns from my clients for whom I installed Ammyy and left it as a back-up to AnyDesk.

 

[katz]

I suppose AMMYY has never addressed the issue? Or their issue with AV flagging them? Their site has a date of 2015 at the bottom... seems like they aren't in a hurry to keep their products updated.

 

[Larry Sabo]

I suppose AMMYY has never addressed the issue? Or their issue with AV flagging them?

I don't know. I gave up on Ammyy long ago, other than leaving it installed as a back-up. I'm now removing those back-ups, too. In many cases, it's already been neutered by their AV anyway.