« BAH

Stupid Ebay Phishing scam

Posted by joy


You know, my first thought when recieving this sad example of an Ebay phishing scam wasn’t “Oh wow, someone is trying to rip me off!”, instead it was “oh how terribly stupid this non-obfuscated tripod based URL looks”.

From MS1699account@ebay.com Tue Aug 10 04:13:10 2004
Return-path: my mailserver
Envelope-to: my email
Delivery-date: Tue, 10 Aug 2004 04:09:46 -0400
Received: from my mailserver with local-bsmtp (Exim 4.34)
id 1BuRhQ-0000Dg-45
for my email; Tue, 10 Aug 2004 04:09:44 -0400
Received: from [145.250.210.4] (helo=ns01.uhbs.ch)
by my mailserver with esmtp (Exim 4.34)
id 1BuRhP-0000DZ-BJ
for my email; Tue, 10 Aug 2004 04:09:35 -0400
Received: from SRWEBW201 (srwebw201.uhbs.ch [145.250.210.11]) by ns01.uhbs.ch with SMTP (Microsoft Exchange Internet Mail Service Version 5.5.2448.0)
id NNKG38CC; Tue, 10 Aug 2004 09:54:55 +0200
X-Mailer: DevMailer v1.5 (c) 2000
Date: Tue, 10 Aug 2004 10:04:03 +0200
From: MS1699account@ebay.com
To: my email
Subject: Ebay Account Updates! DB0ZZL
Mime-Version: 1.0
Content-Type: text/plain; charset=”us-ascii”
Content-Transfer-Encoding: quoted-printable

Below is the result of your feedback form. It was submitted by
(MS1699account@ebay.com) on Tuesday, August 10, 2004 at 10:04:01
—————————————————————————
:
Dear Ebay Member,
We at Ebay are sorry to inform you that we are having problems with the
billing information of your account. We would appreciate it if you would
visit our website
http:r.aol.comcgiredir-complex?url=3Dhttp://ebaybilling.tripod.com/index=
.htm
and fill out the proper information that we are needing to keep you as an
Ebay member.
If you think you have received this email as an error, please visit our
website
http:r.aol.comcgiredir-complex?url=3Dhttp://ebaybilling.tripod.com/index=
.htm
and fill out the neccesary information. That way we can make
sure that everything is up to date! Again here is the link to
our website. Ebay Billing Center

Joe Watson
Ebay Billing Center
Rep ID. 32A
Thank you for your business.
The Ebay Staff. X9N9WD
W6FIOK
—————————————————————————

I’m not a regular Ebay user, but I did report this to the Ebay folks at spoof@ebay.com. Surprisingly enough, Ebay has a simple tutorial on how to spot spoof emails. I was impressed.


Comments are closed.