Bogus eBay web page - Identity Theft

Bogus eBay email and web page

First, the email that had the link

This site was linked to in an email requesting users to verify their information after apparently finding that their phone number was incorrect. This is a the email text body...

Dear Ebay user,

We regret to inform you that your home phone number had an error on
Ebay Inc. databases.

We use your phone number for your identification purpose only.
If the requested information is not provided to us then we will regret to
inform you that your account will be suspended from our database until
required information is provided.
* Invalid User Information - Our records show that there are some discrepancies
with the information that you registered with on our service. Due to this
violation your account will be suspended indefinitely from the site until valid
information can be provided.*

Due to the suspension of this account, please be advised you are prohibited from
using eBay in any way. This includes the registering of a new account.

WE NEED YOU!
PLEASE SEND US YOUR
EMAIL HOAX SCAMS
click here to
use our online
report form

Please note that this suspension does not relieve you of your agreed-upon
obligation to pay any fees you may owe to eBay.

To provide us with your phone number, just click the link below and
Please complete this forum.

http://signin.ebay.com/aw-cgi/eBayISAPI.dll?SignIn

Regards,
Ian
eBay SafeHarbor
Investigations Team

The link in the email body has been removed for your own sake. You'll notice a spelling mistake just above the link ('forum', where they actually meant 'form') and this is the only immediate give away. The link has been disguised to look like a genuine eBay site page, but in actual fact takes you to another page (see analysis below).

The spoof web page

This is a screenshot of the offending web page...

You can see that there is a shocking amount of financial and very personal information requested on this page - mother's maiden name (a common piece of information used for verification purposes by credit/debit card companies and the like); billing address; phone number; social security number; date of birth; bank and credit/debit card numbers; and of-course your eBay user name and password. With these bits of information, the scammer(s) would easily be able to use your eBay account, as well as your credit/debit cards and bank account.

Analysis

Firstly, and most importantly, the IP address shown in the browser's address bar gives the game away...

This is not what you should be seeing when at eBay's own website. The IP address 218.36.79.125 is registered to KRLine in Seoul, Korea (www.krline.net) and is definitely NOT owned or part of eBay Inc.

Email Header

Examination of the email's header reveals the following...

X-From_: root@mis.co.kr Sat Jul 05 18:01:16 2003
Return-path:
Envelope-to: x
Delivery-date: Sat, 05 Jul 2003 18:01:16 +0100
Received: from [218.36.79.125] (helo=mis.co.kr)
by imailg1.svr.pol.co.uk with esmtp (Exim 4.14)
id 19YqPT-0006Hq-OJ
for x; Sat, 05 Jul 2003 18:01:16 +0100
Received: (from root@localhost)
by mis.co.kr (8.11.6/8.11.6) id h65H89g08185
for x; Sun, 6 Jul 2003 02:08:09 +0900
Date: Sun, 6 Jul 2003 02:08:09 +0900
Message-Id: <2003_________________8185@mis.co.kr>
Subject: NOTICE eBay Obligatory Verifying - Invalid User Information
From: eBay Customer Support
Content-Type: text/html

This shows that the email originated from a user at KRLine.net (at IP address 218.36.79.125), again this is shown to have nothing to do with eBay Inc.