eBay spoof email

Taras · Post by **Taras** » April 27th, 2005, 3:01 am

Everyone, please be warned. This is what I got in my email today. Obviously, do not reply to this or login to your eBay account through the page that it directs you to. Clicking on the links within the email will get you to the same page that looks like an eBay login page but at this address: http://www.authebay.net/ Definitely a spoof. I had no probs with eBay and have not been on there for a while. It was also sent my other email that I do not use for eBay. And of course I have reported it to eBay.

{quoted}
Subject: [Shaw Suspected Junk Email] Your eBay account
From: noreply@ebay.com
Date: 26/04/2005 8:17 AM

eBay Case ID number: PP 678-143-712

Recently, our Account Review Team identified some unusual activity in your account.
In accordance with eBay User Agreement and to ensure that your account has not been compromised, access to your account was limited.
Your account access will remain limited until this issue has been resolved. Protecting the security of your eBay account is our primary concern, and we apologize for any inconvenience this may cause.

In order to secure your account and quickly restore full access, we may require some specific information from you. To restore your account to its regular status, you must complete the following steps:

1. Verify your primary e-mail address by clicking the verification link
2. Confirm your identity by completing the account verification process

Once you have updated your account records, your eBay session will not be interrupted and will continue as normal.

To verify your eBay records ,click on the following link:

http://my.ebay.com/ws/eBayISAPI.dll?Mye Bay&ssPageName=h:h:mebay:UK

We encourage you to log in and restore full access as soon as possible. Should access to your account remain limited for an extended period of time, it may result in further limitations on the use of your account or may result in eventual account closure.

Thank you for your prompt attention to this matter. Please understand that this is a security measure meant to help protect you and your account.
We apologize for any inconvenience.

Sincerely,
eBay Account Review Department

Accounts Management As outlined in our User Agreement, eBay will periodically send you information about site changes and enhancements.

Visit our Privacy Policy and User Agreement if you have any questions. E-mail ID: 4492
{/quoted}

nope-mx3 · Post by **nope-mx3** » April 27th, 2005, 3:29 am

This is nothing new

I`ve gotten a couple that was worse, paypal spoof.

not a good thing to login to a fake paypal page, then they get your info and everything they need to shop via your creditcard on paypal.
Never click on authentication/re-authentication links for ebay and paypal in mails. always type the adress manually in your webbrowser.

nope-mx3

93SOHC · Post by **93SOHC** » April 27th, 2005, 1:19 pm

Good eye Taras, got the "exact same" email yesterday. I also contacted ebay regaurding this

Tunes67 · Post by **Tunes67** » April 27th, 2005, 1:27 pm

You guys should run a virus & spyware check on your computers.. I bet you find more than a few spyware bots at the least. HijackThis is a excellent little program at finding spyware and other little pests that run in the background on your computer.. you will need to be relatively familiar with most of the processes on your machine.. but if you find a process you dont recognize.. google it and usually you can find out whether its a valid process or if its spyware.. Then you can just track it down and delete it. Adaware & Spybot are also useful tools for getting rid of spyware, but often miss the newer spyware programs and I have seen spyware programs written specifically to hide from Adaware. Just a heads up.. but for you to get a e-mail like that.. someone has to have been in your machine to have been aware that you even use e-bay to begin with and to have gotten your e-mail addresses (especially the e-mail addresses that havent been used in conjunction with e-bay). Best of luck.

Tunes67.

93SOHC · Post by **93SOHC** » April 27th, 2005, 1:41 pm

I am currently running adawre and spybot. Nothing found lately here.

Tunes67 · Post by **Tunes67** » April 27th, 2005, 1:52 pm

Check with HijackThis.. It does a thorough scan of all processes that are running and have run since the computer was booted into windows... Its not as easy to decipher.. but its a lot more accurate.

Tunes67

Tunes67 · Post by **Tunes67** » April 27th, 2005, 1:55 pm

And if you guys run across something you dont recognize.. or cant find a reference to when you seach google for it.. let me know the name of the suspect process and I will help you determine if its valid or not. Best of luck.

Tunes67

Post by **Custommx3** » April 27th, 2005, 3:37 pm

Naa, Hijackthis! wont help, its just a phishing scam/spam. I got it a few weeks ago.

If you looked @ the source of the email, you'll see that the link is actually not the one in the email, its to an alternate site, just using the proper link as the text of the scam link.

Tunes67 · Post by **Tunes67** » April 27th, 2005, 3:43 pm

Not sure what you mean about a Phishing scam.. but I have been using a free version of Hijackthis for over a year.. All it does is show a complete list of all processes that are running on your computer at the time your run it and it shows processes that ran during bootup. It doesnt tell you what any of the processes are.. its just a list. Its up to the computer user to determine if the processes are valid or are suspect programs.

Tunes67

Tunes67 · Post by **Tunes67** » April 27th, 2005, 3:45 pm

Well it also shows the location of the process (the path to the location of the program either in windows registry or the physical location on the hard drive)

Tunes67

Post by **Custommx3** » April 27th, 2005, 3:50 pm

http://www.webopedia.com/TERM/p/phishing.html

I use Hijackthis! as well but its usless in this case. Its great for alot of spyware that some of the programs wont detect.

Tunes67 · Post by **Tunes67** » April 27th, 2005, 7:09 pm

Ahh I see to what you are referring to.. Not sure it would be useless in this application though.. How were their e-mail addresses attained in the first place? I suppose e-bay could have been hacked and their e-mail addresses gained from there.. but Taras said that he received the same e-mail on a e-mail address that he doesnt use for e-bay.. To me.. this indicates his computer may have been compromised and his e-mail addresses sent back to the originator of the spoof e-mail.. there are lots of spyware, viruses, malware and trojan horse type programs that gather up this information and send it out.. Thats the reason I recommended using a virus scanner and taking a look at what processes are running.. to make sure one of these information gathering programs is not currently running on their computers.

Tunes67

Post by **Custommx3** » April 27th, 2005, 8:09 pm

if you get spam at all, someone sold your email address and most likely its on a spam list.

Tunes67 · Post by **Tunes67** » April 27th, 2005, 8:14 pm

Very likely.. I agree.. its the private e-mail address that Taras has that caught my attention.. I have a private e-mail address as well that I only use for friends and family.. I have had it for a couple of years now and so far.. it hasnt ended up on any spammers list.. (but I took special care in how I generated the name too) .. So my thoughts were along the lines that if that was the same kind of e-mail address that the spam came in on.. usually.. its because spyware got onto the machine and sent out the information. Thats what just sorta made my eyebrow shoot up anyway

Tunes67

ghandi1492 · Post by **ghandi1492** » May 2nd, 2005, 1:31 pm

thanks for the help i just got this......