Spoof Email and Fake Web Site
7th September 2003

This spoof eBay email was distributed on 7th September 2003 and we also have images of the spoof web pages that it would have sent you to. These are just images of the originals, so there is absolutely no code included and none of the links or buttons will now work. The images shown have been reduced 80% of the original size.

The email hoax...

The spoof email states that eBay have attempted to take a payment from your card which has been refused and requests that you resubmit your credit card information to them by using the link provided in that email (the link is disguised to look like a genuine eBay link.

If you use the link in that email, you would arrive at a spoofed eBay web page that requests your eBay ID and password, and credit/debit card information. This page is a spoof which has been constructed using code from eBay's own servers. It is clearly apparent that the page is spoofed

when you see the URL/web address in your browser's address bar - 'http://www.salala.go.ro/.....' has absolutely nothing to do with eBay whatsoever, but is actually a sub-domain located on go.ro's servers, who are located in Bucharest, Romania.

If you had entered the information into that form and submitted it, the information would be sent to the scammers using an online web form processing service provided by sparklit.com, after which you are presented with a confirmation page.

The bogus web page...

If you use the link in that email, you will then arrive at the spoof eBay page, but notice the URL shown in the browser address bar - this is not what you would expect to see with a genuine eBay page...