eBay Spoof email and web page scam
11th November 2003

This eBay scam follows the format of many of its predecessors, by taking the form of an email which suggests that eBay are undertaking some form of maintenance to improve account usage and/or security. And that the recipient should use a link to rectify or comply with any such request. The link then goes on to introduce the recipient to one or more fake pages.

This spoof email comes in the form of text with genuine eBay graphics (referenced from eBay's own servers) together with a cloaked link (a disguised link - and one which is made to look as if it will direct you to a genuine eBay page, when it will actually direct you to forged eBay pages hosted at a location which has nothing to do with eBay at all.

This cloaked link takes to you a fake eBay sign in page which is located at 'http://66.226.68.228/eBayISAPI.dll?..........' This fake eBay sign in page is constructed by calling genuine eBay graphics from their own servers. An IP whois search will reveal that this address (66.226.68.228) is actually part of web space operated by Abacus America Inc.

Once the scammers have this infomation, they will most likely use it to take control of your eBay account (when it is common for the scammers to list high value items, take payments from unsuspecting buyers, but not send the goods). They may additionally utilise your financial information (including credit or debit card and bank account) to make purchases and/or open furtehr credit facilities or other online accounts for them to use. This kind of action is sometimes referred to as Phishing and constitutes a form of online Identity Theft, and one which has been rapidly on the increase over the last few years.

Any data that is entered into that fake sign in page is captured using PHP script (once the 'Sign In>') button is pressed and you are then directed to another fake eBay page. This time it is a much larger 'web form' which requests more information, including name, address, credit or debit card, bank and social security number details. Again, this information is cpatured using PHP script but, this time you would be sent to the genuine eBay.com sign in page, once that information is submitted.

Most reputable online services will make some statement that they 'will never ask you to provide your user name, password and/or personal information in an email'. Sounds great, but it does not preclude them asking you to visit their site and sign in so that you can interact or complete a process indicated within the email. eBay for instance frequently provides links to their site which require you to sign in to complete an action indicated within the email, such as (but not limited to) relisting an item that has not sold.

The best possible advice is to read any such email, and then enter the site manually - by typing the URL (www.ebay.com in this case) directly into your browser address bar. Then interact with the site once there (you can at least be better assured that you are at the right place). In other words do NOT use any links provided in an email if you want to be assured that you are not going to be conned.

eBay could easily take action to reduce the authentic look and feel of these many, many spoof emails which target their customers on a global and near daily basis. There is something called 'hot link protection' and this is something that can be deployed on a server to prevent external web sites, pages and emails from calling up their graphics from their servers. It would not prevent these kind of email scams from appearing, but it would certainly make it much less easy to create such convincing hoaxes.

Let's now take a look at the images of the email and offending fake eBay web pages .....

The cloaked link provided within that email will take you to the following fake eBay page .....