Hacker News Reader

Doesn't work if they use any transactional mail service.

It does if you use a service's SMTP relay. For example, this header is from an email sent via Mailgun SMTP from Hetzner (digits replaced with ):

Received: from hetzner-dc-ex-* (static.....clients.your-server.de [...]) by mxa.mailgun.org with ESMTP id *; Thu, 06 Feb 2020 17:27:22 -0000 (UTC)

This is the easy way.

A more effective way is to ask CloudFlare for MX records, or to look at IP address history for the domain name, but it's less easy (especially for nontechnical people).

Signing up for an account and looking at email headers, then typing their IP address into a WHOIS service to get the web hosting company to file abuse reports with? You can do that without ever touching a command line interface.

If they use a third party mail provider like Gsuite or Fastmail that won't work. If they really want to hide their IP they would do this or entirely avoid MX records.

Most open source PHP eCommerce platforms don't have out-of-the-box support for the specific providers you're thinking of, and most scam operations like this are low-effort.

Reply on news.ycombinator.com