Spoof email links to a spoof webpage where victim is prompted to enter details believing the site is genuine. Details are then forwarded to a local script and captured.

http://62.117.78.34:5250/Sign In.html

Traced to a server in Moscow, Russia.

Disguised as http://scgi.ebay.com/verify_id=ebay&user=14626654

1. Email informs victim their eBay account has been compromised and they need to 'verify their details'. Link leads to spoof webpage where details are captured are forwarded to a local script.

2. eBay never send users emails requesting details in this way.