14th September 2004

eBay

aw-confirm@ebay.com

Unable to verify or authenticate your credit/debit card information on file...

HTML

Spoof email links to a spoof webpage where victim is prompted to enter details believing the site is genuine. Details are then forwarded to a local script and captured.

Yes

http://saw-ebay.com/aw-cgi/eBayISAPI.dll?SignIn&UsingSSL=1&co_partnerid=2&siteid =0&changeUser=0&pUserId=&pNextPage=&pageType=955&ru=https%3A//arribada.ebay.com/saw- gi/eBayISAPI.dll?PlaceCCInfo&page=0&adult=0&ru=default&BillingAccountType=defau lt&pass={_pass_}&fromsyi=0&userid=&pp=pass&pa1=&pa2=&pa3=&pa4=&pa5=&pa6= &pa7=&pa8=&pa9=&pa10=&pa11=&pa12=&pa13=&pa14=&i1=0&i2=-1&i3=-1&i4=-1&i5=-1&i6=-1&i7=-1&i8=-1&i9=-1&i10=-1&i11=-1&errmsg=-1&runame= &ruparams=&ruproduct=&bshowgif=0

disguised as:

http://signin.ebay.com/aw-cgi/eBayIASPI.dll?PlaceCCInfo&&UserId=ge4mDtry3sy2328XZe

Traced to a server in Orlando, USA.

1. Email informs victim they need to enter correct details on the eBay site for their credit card. However, the provided link does not lead to eBay but to a spoof webpage where details are captured are forwarded to a local script.

2. eBay never send users emails requesting details in this way.