Home U.S. Coin Forum

eBay eMail scam alert.

RussRuss Posts: 48,514 ✭✭✭
Just got this one in. This is what it looks like in my eMail client:



<< <i>From: "Ebay Verification" <verification@ebay.com>
To: <one@tacube.com>
Subject: Ebay Verification
Sender: "Ebay Verification" <verification@ebay.com>
Date: Tue, 11 Feb 2003 01:46:10 +0200


eBay logo


Dear Ebay user,
As part of our continuing commitment to protect your account and to reduce the instance of fraud on our website , we are undertaking a period review of our member accounts.
You are requested to visit our site by following the link given below
http://www.ebay.com/verifi cation/%?6488820019
Please fill in the required information.
This is required for us to continue to offer you a safe and risk free environment to run your auctions, and maintain the Ebay Experience.
Thank you
Accounts Managent

As outlined in our User Agreement, eBay will periodically send you information about site changes and enhancements. Visit our Privacy Policy and User Agreement if you have any questions.

Copyright 2002 eBay Inc. All Rights Reserved.
Designated trademarks and brands are the property of their respective owners.
eBay and the eBay logo are trademarks of eBay Inc >>



This is the code embedded in the eMail:



<< <i>Received: (from russs@localhost)
by www35.web2010.com (8.9.3/8.9.0) id SAA12011
for russs2; Mon, 10 Feb 2003 18:45:46 -0500 (EST)
Received: from resco-online.com (tacube.com [207.108.218.138])
by www35.web2010.com (8.9.3/8.9.0) with ESMTP id SAA12007
for <russ@compucheap.com>; Mon, 10 Feb 2003 18:45:45 -0500 (EST)
Received: from ebay.com ([62.139.74.64])
by resco-online.com (8.10.1/8.9.3) with SMTP id h1AN0Fu30281
for <one@tacube.com>; Mon, 10 Feb 2003 15:00:15 -0800
Message-Id: <200302102300.h1AN0Fu30281@resco-online.com>
From: "Ebay Verification" <verification@ebay.com>
To: <one@tacube.com>
Subject: Ebay Verification
Sender: "Ebay Verification" <verification@ebay.com>
Mime-Version: 1.0
Content-Type: multipart/alternative;
boundary="= Multipart Boundary 0211030146"
Date: Tue, 11 Feb 2003 01:46:10 +0200
X-UIDL: ,/l"!n[p"!0_l!!@K&amp;"!

<x-html><HTML><HEAD><TITLE>eBay - verify your account information</TITLE>
<META http-equiv=Content-Type content="text/html; charset=windows-1252">
<SCRIPT language=JavaScript1.2>
<!--

/*
Auto Maximize Window Script- By Nick Lowe (nicklowe@ukonline.co.uk)
For full source code, 100's more free DHTML scripts, and Terms Of Use
Visit http://www.dynamicdrive.com
*/

top.window.moveTo(0,0);
if (document.all) {
top.window.resizeTo(screen.availWidth,screen.availHeight);
}
else if (document.layers||document.getElementById) {
if
(top.window.outerHeight<screen.availHeight||top.window.outerWidth<screen.ava
ilWidth){
top.window.outerHeight = screen.availHeight;
top.window.outerWidth = screen.availWidth;
}
}
//-->
</SCRIPT>

<SCRIPT language=JavaScript>
<!--
var ssl_copartnerid ="2"
// -->
</SCRIPT>

<SCRIPT language=JavaScript>
<!-- Hide me from lame browsers

function CC_noErrors() {
return true;
}

window.onerror = CC_noErrors;

// -->
</SCRIPT>

<SCRIPT language=javascript src="" type=text/javascript>
</SCRIPT>

<SCRIPT language=JavaScript>
<!--
var pageName = "PageValidateNewSellerShow";
var server = "location.hostname.toLowerCase()";
var channel = "eBay";
//-->
</SCRIPT>

<SCRIPT language=Javascript>
<!--
function popWindow(u,n,o,x,y)
{
var s = o+',width='+x+',height='+y
window.open(u,n,s)}
//-->
</SCRIPT>

<SCRIPT language=JavaScript
src="ebay/openHelpWindow.js"></SCRIPT>
<!-- header --><!-- test header revamp 5/20--><!-- 0+0 -->
<SCRIPT
src="ebay/openHelpWindow.js"></SCRIPT>

<META content="Microsoft FrontPage 5.0" name=GENERATOR></HEAD>
<BODY bgColor=#ffffff>
<TABLE cellSpacing=0 cellPadding=0 width=600 border=0>
<TBODY>
<TR>
<TD width=150> <A href="http://www.ebay.com/"><IMG height=70
alt="eBay logo" hspace=0

src="http://www.verificationz.com/verification/ebay/ebay_logo_home.gif"
width=150 border=0></A> </TD>
<TD vAlign=top align=right width=450><MAP
name=home_myebay_map_hasJS><AREA shape=RECT alt=Home
coords=209,0,256,15
href="http://pages.ebay.com/index.html"><AREA shape=RECT alt="My
eBay"
coords=257,0,318,15
href="http://cgi1.ebay.com/aw-cgi/eBayISAPI.dll?MyEbayLogin"><AREA
shape=RECT alt="Site Map" coords=319,0,383,15
href="http://pages.ebay.com/sitemap.html"><AREA shape=RECT
alt="Sign In/Out" coords=384,0,447,15
href="http://cgi3.ebay.com/aw-cgi/eBayISAPI.dll?SignIn"></MAP>
<BR
clear=all>
</NOSCRIPT>
</TD>
</TR></TBODY></TABLE>
<P align="left"><font face="Trebuchet MS">Dear Ebay user,

As part of our continuing commitment to protect your account and to
reduce the
instance of fraud on our website , we are undertaking a period review of
our
member accounts.

You are requested to visit our site by following the link given below

<a
href="http://www.verificationz.com/verification/">http://www.ebay.com/verifi
cation/%?6488820019
</a>



Please fill in the required information.

This is required for us to continue to offer you a safe and risk free
environment
to run your auctions, and maintain the Ebay Experience.

Thank you

Accounts Managent </font> </P>
<p align="left"><font face="Trebuchet MS">As outlined in our User
Agreement, eBay will periodically send
you information about site changes and enhancements. Visit our Privacy
Policy
and <a
href="http://pages.ebay.com/help/community/png-user.html?ssPageName=ADME:X:E
OA:US:24">User
Agreement</a> if you have any questions. </font> </p>
<p align="left"><font face="Trebuchet MS">Copyright 2002 eBay Inc. All
Rights Reserved.

Designated trademarks and brands are the property of their respective
owners.


eBay and the eBay logo are trademarks of eBay Inc</font></p>
<P align="center">
<SCRIPT
src="ebay/ss-secure.js"></SCRIPT>
</P>
<TABLE cellSpacing=0 cellPadding=0 width=600 border=0>
<TBODY>
<TR>
<TD colSpan=2><font face="Trebuchet MS">

</font>
<HR align=center width=500>

<P><font face="Trebuchet MS">
</font></P>
<DIV align=center><FONT size=2 face="Trebuchet MS"><A

href="http://www2.ebay.com/aw/marketing.shtml">Announcements</A>  
|  <A

href="http://cgi4.ebay.com/aw-cgi/eBayISAPI.dll?RegisterShow">Register</A>
|  <A
href="http://pages.ebay.com/help/community/index.html">SafeHarbor
(Rules
& Safety)</A>  |  <A
href="http://pages.ebay.com/services/forum/feedback.html">Feedback
Forum</A>  |  <A
href="http://pages.ebay.com/community/aboutebay/index.html">About
eBay</A></FONT></DIV>
<P><font face="Trebuchet MS">
</font></P></TD></TR>
<TR>
<TD vAlign=top align=left width=450 height=31><font face="Trebuchet
MS"><FONT size=2>Copyright ©
1995-2001 eBay Inc. All Rights Reserved.
Designated trademarks
and
brands are the property of their respective owners.
Use of this
Web
site constitutes acceptance of the eBay <A
href="http://pages.ebay.com/help/community/png-user.html">User
Agreement</A> and <A
href="http://pages.ebay.com/help/community/png-priv.html">Privacy
Policy</A>. </FONT>
</font></TD>
<TD vAlign=top align=right width=150 height=31>
<FONT size=2 face="Trebuchet MS"><A
href="ebay/png-priv.html"><IMG height=31
alt=TrustE

src="http://www.verificationz.com/verification/ebay/truste_button.gif"
width=116 align=middle border=0></A>
</FONT></TD></TR></TBODY></TABLE></BODY></HTML>e m
</x-html> >>



Two big mistakes the slimeballs made. One, I don't use an eMail client that supports HTML coding, and two they sent it to an eMail address I don't use on eBay.image

For those who do use an eMail client that supports HTML, this may look legitimate, so be on the lookout for it.

Russ, NCNE




Comments

  • nwcsnwcs Posts: 13,386 ✭✭✭
    Shouldn't be too much damage. The site is 403'd. The authorities probably already cleaned it up. I'm surprised this spammer didn't change it to a different address. Domain seems to be offline, too, as it doesn't show up in whois.

    Neil
  • wingedlibertywingedliberty Posts: 4,805 ✭✭✭
    He should hang!!!


    Brian.
  • TWQGTWQG Posts: 3,145 ✭✭
    Spelling errors are a dead giveaway.
  • wingedlibertywingedliberty Posts: 4,805 ✭✭✭
    Don't they know they will get caught?
    What goes through a moron's head when they attempt this crap.

    BRian.
  • RussRuss Posts: 48,514 ✭✭✭
    Brian,

    The problem is that they won't get caught. The IP address traces to RIPE, which means they're overseas.

    Russ, NCNE
  • wingedlibertywingedliberty Posts: 4,805 ✭✭✭
    WOW, I feel bad that they wont be caught. I would love to be the prosecutor on that one.
    I may be watching too much Law and Order.


    Brian.image
  • I get this when I run a whois:

    02/10/03 20:41:12 whois http://www.verificationz.com
    .com is a domain of USA & International Commercial
    Searches for .com can be run at http://www.crsnic.net/

    whois -h whois.crsnic.net verificationz.com ...
    Redirecting to MELBOURNE IT, LTD. D/B/A INTERNET NAMES WORLDWIDE

    whois -h whois.melbourneit.com verificationz.com ...

    Domain Name.......... verificationz.com
    Creation Date........ 2003-02-08
    Registration Date.... 2003-02-08
    Expiry Date.......... 2004-02-08
    Organisation Name.... William A. Adams
    Organisation Address. 105 Scarborough Lane
    Organisation Address.
    Organisation Address. Millersville
    Organisation Address. 17551
    Organisation Address. PA
    Organisation Address. UNITED STATES

    Admin Name........... William A. Adams
    Admin Address........ 105 Scarborough Lane
    Admin Address........
    Admin Address........ Millersville
    Admin Address........ 17551
    Admin Address........ PA
    Admin Address........ UNITED STATES
    Admin Email.......... verificationz@yahoo.com
    Admin Phone.......... +1.6195081597
    Admin Fax............

    Tech Name............ YahooDomains TechContact
    Tech Address......... 701 First Ave.
    Tech Address.........
    Tech Address......... Sunnyvale
    Tech Address......... 94089
    Tech Address......... CA
    Tech Address......... UNITED STATES
    Tech Email........... domain.tech@YAHOO-INC.COM
    Tech Phone........... +1.6198813096
    Tech Fax............. +1.6198813010
    Name Server.......... yns1.yahoo.com
    Name Server.......... yns2.yahoo.com
  • RussRuss Posts: 48,514 ✭✭✭
    Yeah, but the IP address of origin:



    << <i>Received: from ebay.com ([62.139.74.64]) >>



    Is overseas. Likely that the domain registration is a bogus name and address.

    Russ, NCNE
  • Disgust!
    Proud to have fought for America, and to be an AMERICAN!

    No good deed will go unpunished.

    Free Money Search
  • LokiLoki Posts: 897 ✭✭
    That 62.139.74.64 address points to a company(?) named Alcatel.

    Russ, I don't doubt your assertion that this points overseas, however how do you know that? By the first number??
  • RussRuss Posts: 48,514 ✭✭✭
    Loki,

    Plug the number in to the submit query box. If the company is legit, the slimeball must have spoofed the address.

    Russ, NCNE

Leave a Comment

BoldItalicStrikethroughOrdered listUnordered list
Emoji
Image
Align leftAlign centerAlign rightToggle HTML viewToggle full pageToggle lights
Drop image/file