eBay email hoax and web page
in distribution from 15th September to Present
STILL ACTIVE!!!

This hoax eBay email has been in distribution from 15th September 2003 to 8th January 2004 (a real persistent offender!) and we have an images of the email and hoax web page that it sends you to. These are just images of the originals, so there is absolutely no code included and none of the links or buttons will now work. The images shown have been reduced to 80% of the original size

The hoax email...

The hoax email requests that you update and verify your account information. The email shows a link, but the whole thing is in actual fact an image, which when clicked on will lead you to a bogus web page. The code behind the image usually contains null characters which are used to exploit a known bug in Internet Explorer browsers. This will cause 'http://www.ebay.com' to be incorrectly displayed in the address bar if your browser is affected by this vulnerability (you will NOTY be at the ebay.com site). See our article for more on the Cloaked URL bug and use our Link Checker to test links within emails or our Spoof URL Checker to check address bar entries.

The hoax web page...

The hoax web page looks like a genuine eBay page. It is clearly apparent that the page is spoofed when you see the URL/web address in your browser's address bar. However, you may see http://www.ebay.com/... in your browser address bar with this fake pages, if your browser is vulnerable to the URL spoofing discussed above.

The copy sent out on the 15th September 2003 had the following URL
http://211.33.209.145:4972/
which is hosted by kornet.ne.kr in Keumjung-gu, Korea.

The copy that was distributed on the 16th and 18th September 2003 has the following URL
http://211.44.215.237:491/
which is hosted by thrunet.com in Kangnam-Gu, Seoul, Korea.

The copy sent out on the 19th Sept. to 2nd Oct. 2003 had the following URL
http://211.217.224.102:4901/
which is hosted by kornet.net (Korean Telecom) in Seoul, Korea.

The copy sent out on the 3rd October 2003 has the following URL
http://211.170.97.202:5801/
OR
http://211.170.186.104:8089/
which are hosted by bora.net in Korea.

The copy sent out on the 5th to 17th October 2003 had the following URL
http://211.47.191.125:199/
which is hosted by HAN Internet (haninternet.co.kr) in Gangnam-gu, Korea.

The copy sent out on the 8th to 21st October 2003 had the following URL
http://211.35.244.54:199/
which is hosted by kornet.net (Korean Telecom) in Seoul, Korea.

The copy sent out on the 11th to 19th October 2003 had the following URL
http://211.142.226.167:4987/
which is hosted by China Mobile Communications Corporation (in China, obviously).

The copy sent out on the 15th to 17th October 2003 had the following URL
http://211.142.226.167:4987/.....
which is also hosted by China Mobile Communications Corporation

The copy sent out on the 9th December 2003 had the following URL
http://61.157.166.133:3791/.....
which is also hosted by China Net (in China, obviously)

The copy sent out on the 23rd December 2003 had the following URL
http://61.55.145.71:2805/.....
which is also hosted by China Net (in China, obviously)

The copy sent out on the 2nd January 2004 had the following URL
http://61.55.145.71:2805/.....
which is also hosted by China Net (in China, obviously)

The copy sent out on the 8th January 2004 had the following URL
http://61.32.53.142:1705/.....
which resolves to Dacom Boranet (in Korea)

The copy sent out on the 16th January 2004 had the following URL
http://4check.info/sgi/index.htm.....
which resolves to an Individual in the Ukraine

This hoax eBay web page contains a form for you to provide your eBay user ID and password, credit card information, etc. Remember that you may see 'http://www.ebay.com' in your browser address bar - this is known as a spoofed or cloaked URL and is a recognised bug affecting Internet Explorer browsers (see Cloaked URL bug for more).

If you provide this information and submit it, it is captured by the scammers with the use of PHP script (which is a common process in recent hoaxes) while you are sent to the genuine eBay.com home page.