This is another FAKE EBAY SCAM running around

Stuka Stunt Main Forum · 4 of 4 known posts recovered

Bill Sawyer · Apr 03, 2004 04:39 PM

LAST EDITED ON Apr-03-04 AT 04:43 PM (CDT)

If you get this "Forward" it to [email protected].
DO NOT OPEN THE LINK OR ANSWER QUESTIONS
There is more to this than what I posted.

Dear eBay member,
We recently noticed one or more attempts to log in to your eBay account from a foreign IP address and we have reasons to believe that your account was used by a third party without your authorization. If you recently accessed your account while traveling, the unusual login attempts may have been initiated by you.

The login attempt was made from:
IP address: 172.25.210.66
ISP Host: cache-66.proxy.aol.com

By now, we used many techniques to verify the accuracy of the information our users provide us when they register on the Site. However, because user verification on the Internet is difficult, eBay cannot and does not confirm each user's purported identity. Thus, we have established an offline verification system o help you evaluate with who you are dealing with. The system is called ebay PowerSafe and it's the most secure eBay wallet so far.

If you are the rightful holder of the account, click on the link below, fill the form and then submit as we will verify your identity and register you to ebay PowerSafe.

Howard Rush · Apr 03, 2004 05:01 PM

#1 source

"with who you are dealing with" is a dead giveaway. People who write like that are criminals for sure.

cyberflyer · Apr 03, 2004 05:35 PM

Helping the anti-Spoofers#2 source

LAST EDITED ON Apr-03-04 AT 05:37 PM (CDT)

>If you get this "Forward" it to [email protected].

Be sure to set your mail browser to "Show All Headers", or whatever is the equivelant command so that the mail message you are looking at includes all the gobbldy-gook that is normally hidden BEFORE you forward the message to the ebay spoof control address.

The good guys need to see the headers of the message that came to you, not your message to them and the only way they can do so is if you expand the headers so you can see them before you do the forward. Some mail programs have an option to "Show Source" which is as good.

You need to see something like this:

---

From: [email protected]
Subject: Xãnax for less
Date: April 3, 2004 3:03:59 PM MST
Return-Path: <[email protected]>
Received: from mx2.neospire.net (66.111.111.16) by airspacemag.com with SMTP (Eudora Internet Mail Server 3.2.2) for <(me)>; Sat, 3 Apr 2004 15:05:58 -0700
Received: (qmail 19775 invoked by uid 0); 3 Apr 2004 22:05:56 -0000
Received: from unknown (HELO c-24-19-118-94.client.comcast.net) (24.19.118.94) by mx2.neospire.net with SMTP; 3 Apr 2004 22:05:56 -0000
Received: from inestimable-l86.riotous.aol.com (<43.96.194.131>) by az3-h90.hotmail.com with Microsoft SMTPSVC(5.0.2195.6824); Sat, 03 Apr 2004 15:57:59 -0600
X-Message-Info: MBIFuZB39qDHl/mOpUEruFwNamgyGq4M
Message-Id: <[email protected]>
Mime-Version: 1.0
Content-Type: multipart/alternative; boundary="--33691481885275447261"

---

That is the info that will help them track down the bad guys.

The Cat Whisperer

Bill Sawyer · Apr 03, 2004 07:47 PM

RE: This is Ebay's reply to me#3 source

Hello,

Thank you for contacting eBay's Trust and Safety Department about email
solicitations that are falsely made to appear to have come from eBay.
These emails, commonly referred to as "spoof" messages, are sent in an
attempt to collect sensitive personal information from recipients who
reply to the message or click on a link to a Web page requesting this
information.

The email you reported did not originate from, nor is it endorsed by,
eBay. We are very concerned about this problem and are working
diligently to address the situation. We are currently investigating the
source of this email to take further action. You may rest assured that
your account standing has not changed and that your listings have not
been affected.