eBay ' hello regarding your account ' - Spoof Email Phishing Scam
24th February 2004

Ebay Spoof email uses a forged sign in page and web form to steal users' details... " It has come to our attention that your eBay account was used by unauthorized persons  . This requires you to update your account information with no delay in order to avoid any future problems with eBay's on line service. "...

read also our brief guide to Phishing

This spoof eBay email (see image below) contains a link which it urges you to use it to update your account following some apparent unauthorised access.

Using the link will open a forged eBay sign in page in your browser which contains genuine graphics called directly from ebay's servers and genuine links to some of their pages (see image below).

Using the sign in page will further open a bogus web form which seeks much more detailed information (see image below) including Paypal username, password, credit or debit card and bank details.

There is an attempt to conceal the page URLs as well, by utilising a known bug in Internet Explorer browsers that allows the URL to be forged. Unpatched browsers may see http://www.e-bay.com in the address bar instead of the true URL of http://foot-express.netfirms.com/....

This bug has been increasingly exploited by email scammers in the last 4 to 6 months, and they continue despite Microsoft's recent patch. The vulnerability allows a fake URL to be shown in the status bar of Microsoft Outlook and browser products (while holding the cursor over the link). We have set up a Browser Test cloaked link which you can use to see if your browser is vulnerable. You can also check links in emails or web pages for cloaking using our Link Checker, and you can check for URL spoofing while at a web page using our URL Checker (which will also reveal the true origin of the web page that you are viewing).

If you have received this email, please remember that it is very common for these email scams to be redistributed at a later date with only slightly different content or the same but with the fake page(s) hosted by a different provider. Also, once you have received one of these hoaxes, it is also common place to receive at least another one and usually a day or two after the first, although not necessarily from the same apparent sender.

Take a good look at the following images, because this email scam may be coming to an inbox near you!

The Email ...

The Bogus Sign In Page ...

The Bogus Form follows signing in using the fake page above ...