The second bogus eBay sign page by email today ...

This phishing scam is similar to an earlier eBay spoof email of today, but with different graphics (using eBay's new design and layout) anda different domain involved in capturing submitted information.

In the first report, the form data would be forwarded to the perpetrators using a PHP script located at http://64.177.105.172/... which resolves to web space operated by Alabanza in the USA. In the second report on the 31st March, a different URL was handling the form data - http://69.94.17.184/... which resolves to web space provided by fastdns.net in the USA. The 24th May version uses http://ultimatetrue.com/f.php to capture submitted data - resolves to a Yahoo user's web space (Geocities). The 27th May version sent the data to http://lidarilidari.com/f.php which also resolves to Geocities web space and sent on to jasonr@kricket.net.

If you have received this email, please remember that it is very common for these email scams to be redistributed at a later date with only slightly different content or the same but with the fake page(s) hosted by a different provider. Also, once you have received one of these hoaxes, it is also common place to receive at least another one and usually a day or two after the first, although not necessarily from the same apparent sender.

The Spoof Email ...