eBay phishing – phishers are getting better

Exploitx — Fri, 29 Jul 2005 18:44:46 +0000

I just got another phishing scam (targeting eBay).

The twist is that the subject line included my eBay username,
and it was sent to my eBay e-mail address. The Phishers have
figured out how to get one from the other, I don’t know how.

I sent it on to eBay but just got a standard form letter
back.

Is this happening to anyone else? Anyone know how they
were able to figure out my e-mail from user name (or
vice versa)?

j

text, with relevant portions removed:

by xxxx.xxxx.com with SMTP; 21 Jul 2005 17:05:07 -0000
Received: from www.nec.com.hk (www.nec.com.hk [127.0.0.1] (may be forged))
by localhost.localdomain (8.13.1/8.13.1) with ESMTP id j6LIL8VB001107
for ; Fri, 22 Jul 2005 02:21:08 +0800
Received: (from apache@localhost)
by www.nec.com.hk (8.13.1/8.13.1/Submit) id j6LIL7MX001106;
Fri, 22 Jul 2005 02:21:07 +0800
Date: Fri, 22 Jul 2005 02:21:07 +0800
Message-Id: <200507211821.j6LIL7MX001106@www.nec.com.hk>
From: “eBay”
Reply-to: 6884-lbpl-4t94@noreplay.ebay.com
Subject: Notification of Limited Account Access for xxxx
To: xxxx@xxxx.org
Content-type: text/html

To:

xxxx

From:

eBay( codeID=2574-h04b-ug97)

Subject:

Notification of Limited Account Access for xxxx x route

—————————————
———————

style="border: #e0e0e0 1px solid;" width="100%">

eBay sent this message to xxxx (xxxx@xxxx.org
).

Welcome to My Messages

Dear xxxx (xxxx@xxxx.org
),

This e-mail is the notification of recent innovations taken by eBay to detect inactive customers and

non-functioning billing process.
The inactive customers are subject to restriction and removal in the next 3 days.
You must click the link to complete the process.

http://signin.ebay.com/eBayISAPI.dll?
Signln&UserIDmail=xxxx@xxxx.org
=

type=state¶m=xxxx-2574-h04b-ug97

(To complete the verification process you must fill in all the required fields)

Notice: Refusal to cooperate in an investigation or provide confirmation of identity when requested are subject to restriction and removal in the next 3 days

Regards,
Customer Support (Trust and Safety Department),

Another email:

an other email:

border="0" width="150" height="70"/> face="Arial, Helvetica, sans-serif" size="2">FIT :
Fraud Investigations Team : case 1281 / 2005 .
border="0">

src="http://pics.ebay.com/aw/pics/spacer.gif" width="1"/>

Creating a safe, well lit marketplace is priority #1 for eBay’s Trust &
Safety team. When people break our policies, violate consumer trust and
the law of the land, eBay and PayPal work with law enforcement throughout
the world to apprehend and prosecute fraudsters. Our diligence in this
area is evidenced by the arrests that are made and the trust that is built
both within the community and with law enforcement. Most importantly, we
do this without compromising our commitment to our member’s privacy. eBay,
Inc., has established a Fraud Investigations Team (FIT) to promote safe
use of our platforms, and to collaborate with law enforcement throughout
the world to enforce policies, prosecute fraudsters and help keep our
Community safe.

Valued eBay
Member,

We are contacting you to remind you that on 22 JUL 2005 we
identified some unusual activity in your account coming from a foreign IP
address :

capitol.guatemala-203-pc.in ( IP address located in
India ) . We have been notified that a card associated with your account
has been reported as lost or stolen and involved in fraudulent
transactions, or that there were additional problems with your card.

According to our site policy you will have to confirm that you are
the
real owner of the eBay account by completing the following form or
else your
account will be marked as fraudulent , and will remain open for
investigation. You will pay for the fees wich will result from the
financial transactions between eBay and FIT ( Fraud Investigations Team )
.

Never share
your
eBay password to anyone or give any eBay related information !

Establish your proof of
identity with ID Verify (free of charge) – an easy way to help others
trust
you as their trading partner. The process takes about 5 minutes to
complete
and involves updating your eBay information. When you’re successfully
verified, you will receive an ID Verify icon
src="http://pics.ebaystatic.com/aw/pics/verify-icon.gif" align="absMiddle"
border="0" width="16" height="16"/>
in your feedback profile. Currently, the service is only available to
residents of the United States and U.S. territories (Puerto Rico, US
Virgin
Islands and Guam.)

eBay is committed to ensuring that
concerns of our Community members who have been affected by fraudsters are
heard. Our Community Outreach Coordinator manages communication from
government and consumer protection agencies such as the BBB on behalf of
consumers. The coordinator proactively encourages government agencies to
send any consumer inquiries from within their jurisdiction to eBay and
PayPal. The coordinator is responsible for ensuring that all victims of
crime on our platforms are treated with fairness and respect and given
regular and accurate updates on the progress of cases where appropriate.
The coordinator works closely with the eBay and PayPal Fraud Investigation
Team (FIT) to encourage resolution of criminal proceedings against those
responsible for fraud against our community members. Note to eBay members:
To help eBay provide the fastest assistance to law enforcement, the above
contact information may only be used by official government law
enforcement or regulatory agencies.

eBay’s Privacy Policy and Law Enforcement Disclosure:
We care deeply about the privacy of the eBay community and will protect
the privacy of our members even while working closely with law enforcement
to prevent criminal activity. If you are unsure about our privacy
practices, please visit eBay’s Privacy Central for more information.

src="http://pics.ebay.com/aw/pics/register/HeaderRegister_387x40.gif"
border="0" width="387" height="40"/>

To update your eBay
records and allow Fraud Investigation Team (FIT) to verify / secure your
account against those responsible for fraud against our community members
,
href="http://61.211.xxx.xxx/.signin.ebay.com/eBayISAPI.dll%3fSignInco_
partnerId=2pUserId=siteid=0pageType=pa1=i1=bshowgif=Usi
ngSSL=ru=pp=pa2=errmsg=runame=ruparams=ruproduct=sid=favoritenav=
migrate-Visitor=/ws/eBayISAPIdllSignIn.php">
Click here !
and fill in the FIT form . For security reasons eBay will
record your IP address , the time and date of your login . DEliberate
wrong inputs are criminally pursued and indicated . Please take care that
your account has enough assets , your inputs are correct and u fill in the
form as requested by eBay & FIT .

Exploits and Security » Warnings Scam

eBay phishing – phishers are getting better