Thread: EBAY SPOOF
View Single Post
  #1 (permalink)  
Old 05-31-2004, 02:49 AM
mushroom's Avatar
mushroom mushroom is offline
WebProWorld Pro
 
Join Date: Feb 2004
Location: Queen Charlotte B. C. Canada
Posts: 287
mushroom RepRank 0
Default EBAY SPOOF

I recieved an e-mail recently which said eBay Account Suspended header said; From: aw-confirm@eBay.com it had the look and layout of ebay.
The link said /signin.ebay.com BUT went to lmillercc.com/.... Where it tried to install "eBayISPI.dll" on my computer but beening a LINUX machine I was allerted.

On viewing source I found;
Return-path: <apache@ns1.ravenorb.com>
Received: from [12.168.160.130] (helo=ns1.ravenorb.com)
and a java script ..............
<a onmouseover="window.status='http://signin.ebay.com//aw-cgi/eBayISAPI.dll?SignIn&ssPageName=h:h:sin:US';
return true" onmouseout="window.status='http://signin.ebay.com//aw
-cgi/eBayISAPI.dll?SignIn&ssPageName=h:h:sin:US'" href="http://lmillercc.com/images/eBayISAPidlldasSKJE
DFKJSdsalkepoamncjfdsjKKdsjdxcmnzkjsjeLKKLKdsjnxs/ksj
deISJJSjjISSdlldkDKJlLXcdcawerfDEurERRudsksalfkmcx XXl
kdmfldll/LKJDjedssjheflkcgieBaysadkKJEDjdfklluseridLK
SKdskdmxskjdeEEdkjas7837sdkjd/eBaylSAPl.dll"
&gt;<FONT face="Courier New"
size="2">http://signin.ebay.com//aw-
cgi/eBayISAPI.dll?
SignIn&ssPageName=h:h:sin:US</a><font face="Courier New" size="2">...............

I have conacted ebay and my local ISP with full source of the e-mail and am now telling the rest of the world.
__________________
Irony: That for most people the most "trusted" web site on the planet is for a company the has been convicted of criminal activity.

Both Security and SuSe start with "S". www.oldslides.com
Reply With Quote