Home  >  Community  >  The eBay Outlook  >  Spam e-mail?


<< previous topic post new topic post reply next topic >>
 upriver
 
posted on August 10, 2004 10:30:58 AM
Got this one today, new to me. Spam or authentic?

Here's the e-mail:

Dear eBay Member,


Your bank has contacted us regarding some attempts of charges from your credit card via the eBay system.
We have reasons to believe that you changed your registration information or that someone else has
unauthorized access to your eBay account Due to recent activity, including possible unauthorized listings
placed on your account, we will require a second confirmation of your identity with us in order to allow us
to investigate this matter further. Your account is not suspended, but if in 48 hours after you receive this
message your account is not confirmed we reserve the right to suspend your eBay registration. If you
received this notice and you are not the authorized account holder, please be aware that it is in violation
of eBay policy to represent oneself as another eBay user. Such action may also be in violation of
local, national, and/or international laws. eBay is committed to assist law enforcement with any inquires
related to attempts to misappropriate personal information with the intent to commit fraud or theft.
Information will be provided at the request of law enforcement agencies to ensure that perpetrators are
prosecuted to the full extent of the law.

Please use the link below to verify the security information:
http://cgi1.ebay.com/aw-cgi/ebayISAPI.dll?signin=1&user=3124&notice=2480133428

After responding to the message, we ask that you allow at least 72 hours for the case to be investigated.
Emailing us before that time will result in delays.
We apologize in advance for any inconvenience this may cause you and we would like to thank you for
your cooperation as we review this matter.




Respectfully,
Trust and Safety Department
eBay Inc.


The originating IP was: 216.205.150.91

I did a trace but don't quite know how to read them yet, any help?

Trace results:

66.98.244.1 gphou-66-98-244-1.ev1.net

66.98.241.4 gphou-66-98-241-4.ev1.net

129.250.10.105 ge-0-1-0-50.r00.hstntx01.us.bb.verio.net

129.250.2.50 p16-0-1-3.r20.dllstx09.us.bb.verio.net

144.232.8.121 sl-st20-dal-14-2-1620xt1.sprintlink.net

144.232.9.137 sl-bb27-fw-5-0.sprintlink.net

144.232.11.34 sl-bb22-fw-12-0.sprintlink.net

144.232.18.22 sl-bb20-atl-11-1.sprintlink.net

144.232.19.150 sl-dr20-atl-15-0.sprintlink.net

65.168.93.138

65.168.94.147

209.196.20.6 atl-z5.dellhost.com

216.205.150.91 91-216.205.150.dellhost.com



 
 iareateacher
 
posted on August 10, 2004 10:48:30 AM
Doing a traceroute won't help much.

Traceroute is mainly a network debugging tool.

I could tell you a lot more about it but it's only interesting to geeks.

What you needed to look at is here:

--
Please use the link below to verify the security information:
http://cgi1.ebay.com/aw-cgi/ebayISAPI.dll?signin=1&user=3124&notice=2480133428
--

WHAT DOES THAT LINK POINT TO?

If you put your cursor over that link (don't click!) what does it say (if anything) at the bottom of your browser?

Or, look at the HTML source of the message. What is this link a reference for? The real URL will be very close to it.

THAT'S how you tell whether or not the email is phony.

I'm going to keep pointing this out until there is some evidence that someone somewhere understands it.

--



 
 upriver
 
posted on August 10, 2004 11:00:29 AM
Hello uareateacher:

This is what showed up at bottom:

http://216.238.11.49/aw-cgi/Signin.html

 
 iareateacher
 
posted on August 10, 2004 11:22:58 AM
It's phony.

If you assume that any URL that starts with an IP address is indicative of phishing, you won't go far wrong.

Easy, right?

Yep!

Congratulations! Now you have the tool you need to phoil the phishers.

--


 
 aintrichyet
 
posted on August 10, 2004 12:56:17 PM
also, ebay will not ask you to "use the link below" ... and they will not open it with "dear ebay member" they will use your name, instead.

 
 iareateacher
 
posted on August 10, 2004 01:47:34 PM
I've received two verified genuine eBay communications in the last month that started with "Dear (my email address here)"

One was a notice that they were about to suspend my account. And it was for real.

I'm guessing here, but I imagine most eBayers don't want to write that one off as a forgery.

Don't use unreliable methods to detect phishing. Figure out what the sender is trying to get you to do.


--

 
 pelorus
 
posted on August 10, 2004 02:22:27 PM
Here is the host name for 216.238.11.49 --

palace.hemispherebio.com.

Obtained from http://whatismyipaddress.net/


 
 pelorus
 
posted on August 10, 2004 02:59:53 PM
100% fake. Almost all these eBay fraud emails are characterized by poor grammar and sentence structure, such as in the sentence beginning "We have reasons to believe..."

It's a dead giveaway. I don't know if the bad writing is because they are foreigners, teenagers, or just dumb. Or maybe they are dumb foreign teenagers.

Sure wish there were more news stories about these guys getting thrown in the slammer.

 
 iareateacher
 
posted on August 10, 2004 05:44:43 PM
Almost all these eBay fraud emails are characterized by poor grammar and sentence structure

Pelorus luv,

You are assuming that any given recipient of said fraud email can detect poor grammar and sentence structure.

True for some but most assuredly not true for others.

--

 
 
<< previous topic post new topic post reply next topic >>

Jump to

All content © 1998-2025  Vendio all rights reserved. Vendio Services, Inc.™, Simply Powerful eCommerce, Smart Services for Smart Sellers, Buy Anywhere. Sell Anywhere. Start Here.™ and The Complete Auction Management Solution™ are trademarks of Vendio. Auction slogans and artwork are copyrights © of their respective owners. Vendio accepts no liability for the views or information presented here.

The Vendio free online store builder is easy to use and includes a free shopping cart to help you can get started in minutes!