Spoof Email and Fake Web Site
29th August 2003

This spoof eBay email was distributed on 29th August 2003 and we also have images of the spoof web pages that it would have sent you to. These are just images of the originals, so there is absolutely no code included and none of the links or buttons will now work. The images shown have been reduced 80% of the original size.

The email hoax...

We've shown the forged email in both formats - plain text and HTML so you can see the differences (please take note that the plain text email is much easier to spot as a spoof). The HTML email does not contain text as it would appear, the text area is in fact an image with a hyperlink (so when you click on it, you arrive at the spoofed web page). In the plain text email, you'll see that the link is clearly not related to eBay at all. The IP address 211.217.224.102 is actually registered to Korea Telecom (this is the address which has the spoofed web page.

The spoofed web page that you arrive at from the link in the email is a web form. Once the "Submit" button is pressed, any information you have entered is secretly relayed to the scammer(s) via an online web form processing service while you are redirected to the genuine eBay.com home page.

First, let's look at the email in plain text format...

...and now the email in HTML format...

and then the spoof web page, but notice the URL shown in the browser address bar - this is not what you would expect to see with a genuine eBay page...