Bogus eBay email and web page. Click to go to home page.


MORE ON
HOAX EMAIL
SCAMS ...


See more copies
of hoax email
and hoax web
pages or sites

See our article
on Account
Hijacking for
more about
hoaxes

Forward and
report a hoax
email or website
to eBay

Report a hoax
email or website
to Paypal

 

RESOURCES

Home

Try our free
Auction
Watcher!

Worldwide
Currency
Converter

Photographic
Guide to Book
terminology

How to recognise
a first edition
book

Book Size Codes
explained

Book condition
terms explained

Photographic
guide to
common book
defects

Online auction
sites around
the World

Resource Directory

 

   
 

Bogus eBay email and web page

 

First, the email that had the link

This site was linked to in an email requesting users to verify their information after apparently finding that their phone number was incorrect. This is a the email text body...

 

Dear Ebay user,

We regret to inform you that your home phone number had an error on
Ebay Inc. databases.

We use your phone number for your identification purpose only.
If the requested information is not provided to us then we will regret to
inform you that your account will be suspended from our database until
required information is provided.
* Invalid User Information - Our records show that there are some discrepancies
with the information that you registered with on our service. Due to this
violation your account will be suspended indefinitely from the site until valid
information can be provided.*

Due to the suspension of this account, please be advised you are prohibited from
using eBay in any way. This includes the registering of a new account.

  Hoax Email Scam Alert
Your name

Your email


Privacy Policy
 
WE NEED YOU!
PLEASE SEND US YOUR
EMAIL HOAX SCAMS

click here to
use our online
report form
 

Please note that this suspension does not relieve you of your agreed-upon
obligation to pay any fees you may owe to eBay.


To provide us with your phone number, just click the link below and
Please complete this forum.

http://signin.ebay.com/aw-cgi/eBayISAPI.dll?SignIn


Regards,
Ian
eBay SafeHarbor
Investigations Team

 

The link in the email body has been removed for your own sake. You'll notice a spelling mistake just above the link ('forum', where they actually meant 'form') and this is the only immediate give away. The link has been disguised to look like a genuine eBay site page, but in actual fact takes you to another page (see analysis below).

The spoof web page

This is a screenshot of the offending web page...

Go to top of page.

 


Go to top of page.

You can see that there is a shocking amount of financial and very personal information requested on this page - mother's maiden name (a common piece of information used for verification purposes by credit/debit card companies and the like); billing address; phone number; social security number; date of birth; bank and credit/debit card numbers; and of-course your eBay user name and password. With these bits of information, the scammer(s) would easily be able to use your eBay account, as well as your credit/debit cards and bank account.

Analysis

Firstly, and most importantly, the IP address shown in the browser's address bar gives the game away...

 

Bogus eBay email and web page. Bogus eBay email and web page. Bogus eBay email and web page. Bogus eBay email and web page.
Bogus eBay email and web page. Bogus eBay email and web page. Bogus eBay email and web page. Bogus eBay email and web page.
Bogus eBay email and web page. Bogus eBay email and web page. Bogus eBay email and web page. Bogus eBay email and web page.

 

This is not what you should be seeing when at eBay's own website. The IP address 218.36.79.125 is registered to KRLine in Seoul, Korea (www.krline.net) and is definitely NOT owned or part of eBay Inc.

Go to top of page.

Email Header

Examination of the email's header reveals the following...

X-From_: root@mis.co.kr Sat Jul 05 18:01:16 2003
Return-path:
Envelope-to: x
Delivery-date: Sat, 05 Jul 2003 18:01:16 +0100
Received: from [218.36.79.125] (helo=mis.co.kr)
by imailg1.svr.pol.co.uk with esmtp (Exim 4.14)
id 19YqPT-0006Hq-OJ
for x; Sat, 05 Jul 2003 18:01:16 +0100
Received: (from root@localhost)
by mis.co.kr (8.11.6/8.11.6) id h65H89g08185
for x; Sun, 6 Jul 2003 02:08:09 +0900
Date: Sun, 6 Jul 2003 02:08:09 +0900
Message-Id: <2003_________________8185@mis.co.kr>
Subject: NOTICE eBay Obligatory Verifying - Invalid User Information
From: eBay Customer Support
Content-Type: text/html

This shows that the email originated from a user at KRLine.net (at IP address 218.36.79.125), again this is shown to have nothing to do with eBay Inc.


Go to top of page.

 

Bogus eBay email and web page.
© Copyright MillerSmiles.co.uk. All Rights Reserved.
Bogus eBay email and web page. Bogus eBay email and web page. Bogus eBay email and web page. Bogus eBay email and web page. Bogus eBay email and web page. Bogus eBay email and web page.