REPORT SUMMARY
Date Reported
5th October 2003
Apparent
Sender
eBay
Subject
Account Update
Request
Senders Address (spoofed)
not supplied
Content
text with a cloaked
link to fake eBay
web page
(see image)
Spoofed Web page/site?
Yes
Web page/site
content
fake eBay
web forms x2
Web page/site origin
URL
http://
promotiondell.com/
ebay.html
Identity Theft method
Form information
is captured and
relayed to scammers
utilising PHP script
while you are sent
to the genuine
eBay sign in page
More...
Latest
email
scam
Latest
Bank Email
Scam
See our guide to
email scams
Other
Resources...
See our guides to
Free Utilities...
List of
Auction Sites
eBay email scam and bogus web site
5th October 2003
This email scam was in distribution from 5th October 2003 and we images of the scam email and bogus web eBay web pages that it sends you to. These are just images of the originals, so there is absolutely no code included and the links or buttons will not work. The images shown have been reduced to 80% of the original size.
The email hoax...
The email scam states eBay are
upgrading their database servers and subsequently asks you to check and
verify your account information. The email contains a link, which has been
disguised to look like a genuine eBay link which it is NOT. The link takes
you to a hoax web page...
PLEASE SEND US YOUR
EMAIL HOAX SCAMS
click here to
use our online
report form
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
|
 |
 |
 |
 |
 |
|
 |
 |
 |
 |
 |
|
 |
 |
 |
|||
The spoof web page...
The hoax web page looks like a genuine eBay page (see the image of this page here) and has been constructed using code from eBay's own servers. It is clearly apparent that the page is spoofed when you see the URL/web address in your browser's address bar -
http://216.110.131.211/........
which has absolutely nothing to do with eBay whatsoever, and is in fact a the numeric address to a web site /domain named phpmaniax.com (registered on 4th October 2003) and hosted by valueweb.net.
This hoax eBay web page contains a form for you to provide your eBay and email user IDs and passwords. If you provide this information and submit it, it is relayed to the scammers with the use of a PHP script (which is a common process in recent hoax emails) while you are sent to another bogus eBay web page....
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
|||
The second page contains a much lengthier form, which requests your bank, credit/debit card and Social Security number details. Again this information is captured using PHP script, but this time you would be sent to the genuine eBay sign in page (when the 'Submit' button is pressed).........
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
|||||
