Spoof email and web site
sent out on
14th August 2003

This spoof eBay email was distributed on 14th August 2003 and we also have an images of two pages of the spoof web site that it would have sent you to. These are just an images of the originals, so there is absolutely no code included and none of the links or buttons will now work.

While the email alone looks just like something from eBay, the web site is also remarkably convincing. The link in the email is disguised and looks exactly like a genuine eBay link, but you would actually arrive at a spoof web site whose URL is clearly not that of eBay's. In fact, www.e-galcon.com (the actual URL of the spoof web site - see below) was registered in April 2002 to someone in Shizuoka, Japan. The e-galcon domain is, however, hosted by onestop.net, a hosting provider based in Santa Barbara, CA, USA. We emailed onestop and they swiftly responded stating "the domain e-galcon.com has been killed and the account cancelled".

The page that you arrive at from the link in the email is a web form which asks for your Credit/Debit card details, Banking

details, Social Security Number and Driving Licence details. Once entered and the submit button pressed, the information was processed and then sent to the scammer(s) by email with the clever use of some complex Javascript to a user of top.mail.ru (a russian web site). This page had the curious addition of a hidden page counter (provided by top.list.ru - another russian provider), which showed a value of 12,467 visits. One can only hope that that many eBay users have not been convinced to give up their information.

and then the spoof web page, but notice the URL shown in the browser address bar - this is not what you would expect to see with a genuine eBay page...

The fake web page...

On pressing the submit button there, you would arrive at this next page.....