Another eBay scam!

[mwalters]

I got this email today and I didn't see anyone post about it yet:

Dear Ebay Member,
Recently we attempted to authorize payment from your credit card we have on file for you, but it was declined.
For security purposes, our system automatically removes credit card information from an account when there
is a problem or the card expires.
Please resubmit the credit card, and provide us with new and complete information.
To resubmit credit card information via our secure server, click the following link,
login to your account and resubmit your information:
http://cgi3.ebay.com/aw-cgi/eBayISAPI.dll?SignIn

This is the quickest and easiest method of getting credit card information to us.
Using the secure server will ensure that the credit card will be placed on account within 24 hours.

I checked my card on eBay (through normal login) and it expires in 2005. If you click on the link (not active in post), you go to this invalid page:
http://http//200.189.184.180/~e3baycgi/

But, if you take out the second http// , you land on a page that looks just like eBay's login page! I did a search on SmatWhois for the IP and this is what I found:

OrgName: Latin American and Caribbean IP address Regional Registry
OrgID: LACNIC
Address: Potosi 1517
City: Montevideo
StateProv:
PostalCode: 11500
Country: UY

NetRange: 200.0.0.0 - 200.255.255.255
CIDR: 200.0.0.0/8
NetName: LACNIC-200
NetHandle: NET-200-0-0-0-1
Parent:
NetType: Allocated to LACNIC
NameServer: ARROWROOT.ARIN.NET
NameServer: BUCHU.ARIN.NET
NameServer: CHIA.ARIN.NET
NameServer: DILL.ARIN.NET
NameServer: NS.LACNIC.ORG
NameServer: NS.DNS.BR
NameServer: NS2.DNS.BR
Comment: This IP address range is under LACNIC responsibility for further
Comment: allocations to users in LACNIC region.
Comment: Please see http://www.lacnic.net/ for further details, or check the
Comment: WHOIS server located at whois.lacnic.net
RegDate: 2002-07-27
Updated: 2002-12-12

TechHandle: LACNIC-ARIN
TechName: LACNIC Hostmaster
TechPhone: (+55) 11 5509-3525
TechEmail: hostmaster@lacnic.net

OrgTechHandle: LACNIC-ARIN
OrgTechName: LACNIC Hostmaster
OrgTechPhone: (+55) 11 5509-3525
OrgTechEmail: hostmaster@lacnic.net



OBVIOUSLY NOT EBAY....STAY AWAY!
:|

 

[Leejai]

^ for the heads up

 

[mhoepfin]

Whenever I get something like this that may be questionable, I always go to the site manually rather than using any links provided, exactly how you did. Kind of like the old rule with telemarketers, which is not to give out any personal information unless you are the one that initiated the call.

 

[SafetyDance]

I don't even go that far. That's what the delete key is for!

Mike

 

[vimkgt]

I actually fell prey to one of these eBay scams once and realized it right after I gave them my password. Good thing I noticed too and went to the real eBay site and changed my password right away hehehe... fortunately it was a different password than I use for everything else. I get a lot of PayPal scams like this too and hotmail scams, but they are so obvious with poor grammar everywhere.

 

[nealr]

isn't http://cgi3.ebay.com/aw-cgi/eBayISAPI.dll?SignIn a valid ebay url?

 

[SoylentGreen]

Only tards fall for these things.

 

[luv2chill]

I also got one of these scam e-mails a few weeks ago. I put up a web page with details about what the e-mail and fake ebay web page looked like. As you can see it's pretty authentic looking. The only thing that tipped me off was how much information they were asking for.

Check it out, and spread the word about this!

Ebay Scam

l2c

 

[DrPizza]

Hey, since I always hit delete when I see ebay. (I really don't need updates about what's on sale or whatever their emails contain), I was just wondering....

Does ebay *ever* send out these types of emails requesting information??

 

[Johneverd]

Originally posted by: nealr
isn't http://cgi3.ebay.com/aw-cgi/eBayISAPI.dll?SignIn a valid ebay url?

I agree, this could very well be real. When I copy/pasted it in to Internet Explorer, 5 other links dropped down on my browser that had the exact same text (they all started the same as mwalters's link, but had more data afterwords), and they are real login links. Also, when I tried putting in a fictious name/password it got kicked out as not a valid username/password. A fraudulant site would not know that I input a fake ebay username/password.

mwalters, perhaps you should contact eBay and see if there really is a problem with your card. Go to My Ebay and check your account status, or just call or email them. Please let us know what they say.

 

[Analog]

Originally posted by: Kiyup
Only tards fall for these things.

yeah!

 

[AbsolutPower]

Originally posted by: Johneverd

Originally posted by: nealr
isn't http://cgi3.ebay.com/aw-cgi/eBayISAPI.dll?SignIn a valid ebay url?

I agree, this could very well be real. When I copy/pasted it in to Internet Explorer, 5 other links dropped down on my browser that had the exact same text (they all started the same as mwalters's link, but had more data afterwords), and they are real login links. Also, when I tried putting in a fictious name/password it got kicked out as not a valid username/password. A fraudulant site would not know that I input a fake ebay username/password.

mwalters, perhaps you should contact eBay and see if there really is a problem with your card. Go to My Ebay and check your account status, or just call or email them. Please let us know what they say.

I think the point was that in the email, the text of the link pointed to a real ebay page, but the real link itself (where it goes if you click on it) goes to the fraudulent page.

 

[abfpat]

I never give out personal information, unless I initiate the call or the order.

 

[mytran]

Going to http://200.189.184.180/ shows that they're running a Russian Apache server.

Everyone log in with a fake name and info....

 

[mwalters]

Just to be clear:
If you copy and past the URL into your browser - that's the real eBay login page. If you click the hyperlink, you are taken to the invalid page, and then if you fix the obvious error in the URL (the second http//), then you go to the scam page.

The actual text in the email is valid, it's the underlying hyperlink that is bad.

 

[a2k]

Originally posted by: Kiyup
Only tards fall for these things.

...and people who don't spend their entire day in front of computers, like most of us. Someone like your grandmother, perhaps...

Anyway, thanks for the heads-up. This is a good reminder to tell your grandmother (or someone else) about the dangers of online fraud.

-a2k

 

[Phil938]

Ugh... is it just me or do these PayPal and eBay scams seem more common than a year ago?

 

[yumyum]

Originally posted by: nealr
isn't http://cgi3.ebay.com/aw-cgi/eBayISAPI.dll?SignIn a valid ebay url?

This could be a valid ebay url, but the HYPERLINK to this url points you to a different site. A very big difference.

 

[LiLxJohnny]

Thanks for the info ..

 

[Johneverd]

My bad. Yes, it is a scam. Thanks for the heads up.

 

[pspada]

I hear that ebay has Nigerian Minsters for cheap!

 

[DannyLove]

Originally posted by: Kiyup
Only tards fall for these things.

what he said

 

[ReiAyanami]

the problem is when the russians spam AOL with this, they get 23 million responses...

 

[magnux]

http://www.microsoft.com/ <- Fake URL. See? The text says Microsoft but the link points to AnandTech.

 

[Yobbo]

honestly I dont think I would fall for one, but someone who isnt as computer literate (my parents, for example) could easily fall for this...