Spoof email and web site
sent out on
7th August 2003

This hoax eBay email has been in distribution from 21st October 2003 and we also have an image of the email. These are just images of the originals, so there is absolutely no code included and none of the links or buttons will now work. The images shown have been reduced to 80% of the original size

This spoof eBay email was distributed on 7th August 2003 and we also have an images of two pages of the spoof web site that it would have sent you to. These are just an images of the originals, so there is absolutely no code included.

While the email alone looks just like something from eBay, the web site is also remarkably convincing. The link in the email is disguised and looks exactly like what you would expect to see, but you would actually arrive at a spoof web page hosted on a server registered to Affinity Internet Inc. That page is a sign in page, exactly as you'd expect to see at eBay itself, and once you press the sign in button provided, you'd arrive at the next page which asks for your Credit/Debit

card details, Banking details, Social Security Number and Driving Licence details. Once entered and the submit button pressed, the information was processed and then sent to the scammer(s) by email with the clever use of PHP and a web form processing service (see below).

This shows the latest twist in the scammers approach - we are now being referred to a spoof web site (i.e. one that has more than one page) and an excellent working knowledge of web design was needed to construct this (the code included the use of PHP, CGI and Java scripts).

and then the spoof web page, but notice the URL shown in the browser address bar - this is not what you would expect to see with a genuine eBay page...

The fake web page...

On pressing the submit button here, the information entered would have been processed and forwarded to the scammer(s) via an account with whiz-mail.cc. Whiz-mail provides a FREE web form processing and forwarding service. The account was shown as being disabled when we looked into it, but who knows how many may have been sent through properly?