Welcome to Guru Will Sellit's Home on the Web!

Part of the Sun Surplus Group of Organisations

www.one4sun.net.au


Account Login Confirmation Scam - Initial Email Received on Wednesday, February 18, 2004

The first email message received which alerted me to the scammers activity is reproduced in full below (minus all the HTML encapsulation).


From security@ebay.com  Wed Feb 18 06:18:25 2004
Return-Path: <security@ebay.com>
X-Original-To: one4sun@lios.apana.org.au
Delivered-To: one4sun@lios.apana.org.au
Received: by lios.apana.org.au (Postfix, from userid 23)
	id A63F5384B5; Wed, 18 Feb 2004 06:18:24 +1100 (EST)
Received: from secure.digital-forever.com (secure.digital-forever.com [216.127.94.102])
	by lios.apana.org.au (Postfix) with ESMTP id B9DDB384AE
	for ; Wed, 18 Feb 2004 06:17:54 +1100 (EST)
Received: from localhost (localhost.localdomain [127.0.0.1])
	by secure.digital-forever.com (8.11.6/8.11.6) with SMTP id i1HJCo302698
	for ; Tue, 17 Feb 2004 13:12:55 -0600
Message-Id: <200402171912.i1HJCo302698@secure.digital-forever.com>
From: <security@ebay.com>
To: <one4sun@lios.apana.org.au>
Subject: eBay account information update
Date: Tue, 17 Feb 2004 13:12:50 -0600
X-Mailer: sendEmail-1.40
X-Spam-Level: *
X-Spam-Status: No, hits=1.6 required=5.0 tests=HTML_60_70,HTML_IMAGE_ONLY_10,
	HTML_MESSAGE,MIME_HTML_ONLY,NO_REAL_NAME autolearn=no version=2.63
X-Sanitizer: Advosys mail filter
MIME-Version: 1.0
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Status: R
X-Status: 
X-Keywords:                  

Dear valued eBay member, 


It has come to our attention that your eBay billing information
records are out of date . This requires you to update your billing information 
with no delay in order to avoid any future problems with eBay's online service.

Please click here to update your billing records.


Once you have updated your account records, your eBay session will not 
be interrupted and will continue as normal. However failure to update may result in
cancellation of service, Terms of Service (TOS) violations or future billing problems.


Thank you for your time!

Marry Kimmel,

eBay Billing Department team.
Now that you've read the email text, what do you think? This is just one example of the massive number of scams trying to steal login information for online banking, auction, and other financial transaction sites...

As you can see from the headers, the email didn't come from Ebay at all, and the URL which the email asks you to go to isn't at an Ebay site either! The URL isn't even masked like it is in some emails, but in case you didn't realise that it's fake, it's reproduced below:

http://nivs.lv/secure/eBayISAPI.dllSecurity=UsingSSL=0pUserId=ru=http3A2F2Fcgi1.ebay.com2Faw-cgi2FeBayISAPI.dll3FMyEbayLogin26pass3D7B_pass7D26userid3Dpp=check/eBayISAPI.php?VerifyInfo&ssPageName=h:h:sin:US

You can also read the complete email with the full HTML-encoded content that was embedded in it.

You're visitor # . Current time is on .

If there's something you'd like to ask me, or you'd just like to say hello, please send me some email. Note that the email address has been 'poisoned'.


Return to the February 2004 Ebay Account Login Confirmation Scam Page