REPORT SUMMARY
Date Reported
3rd September 2003
Apparent
Sender
eBay
Subject
not supplied
Senders Address (spoofed)
not supplied
Content
text with cloaked
link to fake
eBay web page
(see image)
Spoofed Web page/site?
Yes
Web page/site
content
fake or forged
ebay sign in
page
Web page/site origin
URL
https://
211.104.181.166.....
Identity Theft method
form information is
forwarded to the
scammers using
PHP script
while you are
unwittingly diverted
to the genuine
eBay.com home
page
More...
Latest
email
scam
Latest
Bank Email Scam
See our guide to
email scams
Other
Resources...
See our guides to
Free Utilities...
List of
Auction Sites
Spoof Email and Fake Web Site
3rd September 2003
This spoof eBay email was distributed on 3rd September 2003 and we also have images of the spoof web pages that it would have sent you to. These are just images of the originals, so there is absolutely no code included and none of the links or buttons will now work. The images shown have been reduced 80% of the original size.
The email hoax...
The spoof email states that your eBay accounts needs to be updated. The link that is provided in the email, to do this, is disguised to look like a genuine link from eBay.
If you use the link in that email, you would arrive at a sign in page that looks exactly as you would expect to see on eBay. This page is a spoof which has been constructed using code from eBay's own servers. It is clearly apparent that the page is spoofed when you see the URL/web address in your browser's address bar - 'https://211.104.181.166.....' has absolutely nothing to do with eBay whatsoever, and is in fact an IP address registered to Apnic in Seoul, Korea.
PLEASE SEND US YOUR
EMAIL HOAX SCAMS
click here to
use our online
report form
If you then proceed to with the request and click 'Sign In' on that page, you are taken to another spoof web page which contains a web form which requires your credit/debit card and banking details. Once the "Submit" button is pressed, any information you have entered on this page (and the preceding page) is relayed to the scammer(s) utilising PHP code located on the same server, while you are being diverted to a genuine eBay site page.
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
If you use the link in that email, you will then arrive at the first spoof web page, but notice the URL shown in the browser address bar - this is not what you would expect to see with a genuine eBay page...
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
...and after entering you rinformation here,
and clicking 'Sign In>',
you'll arrive at
the next spoofed eBay web page...
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
