Date Reported 18th January 2005
Apparent Sender eBay
Return Address Safe Harbor Department < aw-confirm@ebay.com >
Subject TKO NOTICE: eBay Account SUSPENDED ( Unauthorized Access )
Format HTML
Method Spoof email links to a spoof webpage where victim is prompted to enter their details believing the site is genuine. Details are then forwarded to a local script and captured.
Bogus Web Content? Yes
URL of web content http://signin.ebay.com.sawcgi.us/ws/eBayISAPI.dll?SignIn=1
RISK LEVEL MEDIUM
WARNINGS 1. Email claims to be from eBay asking you to confirm your account data by clicking on the link. You will be taken to a spoof login page where your details will be captured by the phishers.
2. eBay never send users emails requesting details in this way.
3. URL disguised as http://signin.ebay.com/aw-cgi/eBayISAPI.dll?VerifyIdentity&ssPageName
4. Website traced to St George, Utah, USA.
" Dear eBay member We recently noticed more attempts to log in to your eBay account from a foreign IP address "
If you have received this email, please remember that it is very common for these email scams to be redistributed at a later date with only slightly different content or the same but with the fake page(s) hosted by a different provider. Also, once you have received one of these hoaxes, it is also common place to receive at least another one and usually a day or two after the first, although not necessarily from the same apparent sender.
The Spoof Email ...
Dear eBay member
We recently noticed more attempts to log in to your eBay account from a
foreign IP address and we have reasons to belive that your account was compromised
by a third party without your authorization.
If you recently accessed your account while traveling,the unusual log in attempts
may have been initiated by you.
However,if you are the account holder please verify that, clicking on the link below,
fill the form and then submit. In this way we will verify your identity.
http://signin.ebay.com/aw-cgi/eBayISAPI.dll?VerifyIdentity&ssPageName
The log in attempt was made from:
IP address: 184.158.158.98
ISP host: 184.158.158.98
If you choose to ignore our request , your account will be suspended until you will verify your identity
We ask that you allow at least 72 hours for the case to be investigated and we
strongly recommend not to make any changes to your account in that time.
If you received this notice and you are not the authorized account
holder, please be aware that it is in violation of eBay policy to represent
oneself as another eBay user. Such action may also be in violation of
local, national, and/or international law. eBay is committed to assist
law enforcement with any inquires related to attempts to misappropriate
personal information with the intent to commit fraud or theft.
Information will be provided at the request of law enforcement agencies to
ensure that perpetrators are prosecuted to the full extent of the law.
*Please do not respond to this e-mail as your reply will not be received.
Thanks for your patience as we work together to protect your account.
Regards,
Safeharbor Department
eBay Inc.
The Spoof Website ...
Website not online at time of report, but likely to closely resemble the real eBay login page when online.
|
