REPORT SUMMARY
Date Reported
9th September 2003
Apparent
Sender
eBay
Subject
not supplied
Senders Address (spoofed)
not supplied
Content
text with cloaked
link to fake eBay
web page
(see image)
Spoofed Web page/site?
Yes
Web page/site
content
fake or forged
eBay sign in page
Web page/site origin
URL
http://
207.32.240.71:
12123/.....
SEE TEXT FOR THE FULL URLs
Identity Theft method
Web form information
is captured with CGI
script while you are
sent to eBay.com
home page
More...
Latest
email
scam
Latest
Bank Email Scam
See our guide to
email scams
Other
Resources...
See our guides to
Free Utilities...
List of
Auction Sites
Spoof Email and Fake Web Site
9th September 2003
This spoof eBay email was distributed on 9th September 2003 and we also have images of the spoof web pages that it would have sent you to. These are just images of the originals, so there is absolutely no code included and none of the links or buttons will now work. The images shown have been reduced 80% of the original size.
The email hoax...
The spoof email states that eBay has awarded you an 'Orange Star' in view of your 'feedback points' earned, and it offers you a 30% discount on all eBay expenses for the next 3 months, but you have to use the link provided to activate the offer. The link is dsguised to look like a genuine eBay link, but it will in fact send you to a spoofed eBay web page. And, 0f-course, there is no such an award, let alone an Orange Star, at eBay.
PLEASE SEND US YOUR
EMAIL HOAX SCAMS
click here to
use our online
report form
The spoof web page looks exactly like the genuine eBay sign in page and has been constructed using code from eBay's own servers. It is clearly apparent that the page is spoofed when you see the URL/web address in your browser's address bar - 'http://207.32.240.71:12123/community/recognition/Sign%20In.htm' has absolutely nothing to do with eBay whatsoever, and is in fact an IP address registered to Elkhart.net in Elkhart, Indiana, USA.
This forged eBay web page asks for your eBay user name and password. Once completed and the "Sign In" button is pressed, any information you have entered on this page is relayed to the scammer(s) utilising CGI script located on the same server, while you are sent to the next spoofed web page which requests the 'activation code' mentioned in the spoofed email . After submitting that code on the form, you are then diverted to the genuine eBay.com sign in page.
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
|
 |
 |
 |
 |
 |
|
 |
 |
 |
 |
 |
|
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
|
 |
 |
 |
 |
 |
The bogus web page...
If you use the link provided within that email, you will then arrive at the spoof eBay sign in page, but notice the URL shown in the browser address bar - this is not what you would expect to see with a genuine eBay page...
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
|
 |
 |
 |
 |
 |
|
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
|
 |
 |
 |
 |
 |
On signing in here, you would be sent to the next spoofed web page, while your log in information is sent to the scammers usitlising CGI script...
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
|
 |
 |
 |
 |
 |
|
 |
 |
 |
 |
 |
|
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
|
 |
 |
 |
 |
 |
|
 |
 |
 |
 |
 |
|
 |
 |
 |
 |
 |
|
Once you've entered the code and submitted here, you would be then be diverted to the genuine eBay.com sign in page.
