Fraudulent e-mail

February 17th, 2005 @ 3:41 PM in Etcetera

Some fucker just tried to scam me by sending an e-mail pretending to be from eBay. I did a traceroute of the IP (204.100.225.253) in the e-mail which was disguised as “signin.ebay.com,” and it was sent from dellhost.com (206.46.170.121). Here are the details:

Email Header:
Return-Path: aw -confirm@ebay.com
Received: from 110-209.196.38.dellhost.com ([206.46.170.121])
by mta006.verizon.net
(InterMail vM.5.01.06.06 201-253-122-130-106-20030910) with ESMTP
id <20050217223102.MGYL12551.mta006.verizon.net@110-209.196.38.dellhost.com
for mhp75 @myisp.net; Thu, 17 Feb 2005 16:31:02 -0600
Received: from 110-209.196.38.dellhost.com (204.100.225.4) by sc008pub.verizon.net (MailPass SMTP server v1.1.1 - 121803235448JY) with SMTP id <4-31518-89-31518-32923-1-1108679455 for mta006.verizon.net; Thu, 17 Feb 2005 16:31:04 -0600
From: “eBay Safeharbor Department” <aw -confirm@ebay.com>
To: mhp75@myisp.net
Subject: Account Suspension Notice - Suspicious Activity
Date: Fri, 18 Feb 2005 02:23:57 +0400
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary=”—7180280891093022″
Message-Id: <20050217223102.MGYL12551.mta006.verizon.net@110-209.196.38.dellhost.com>

Email Body:
eBay Notice (349091293231222) - Confirm your Identity

Dear mhp75@myisp.net,

Your bank has contacted us regarding some attempts of charges from your credit card via the eBay system. We have reasons to believe that you changed your registration information or that someone else has unauthorized access to your eBay account Due to recent activity, including possible unauthorized listings placed on your account, we will require a second confirmation of your identity with us in order to allow us to investigate this matter further. Your account is not suspended, but if in 48 hours after you receive this message your account is not confirmed we reserve the right to suspend your eBay registration. If you received this notice and you are not the authorized account holder, please be aware that it is in violation of eBay policy to represent oneself as another eBay user. Such action may also be in violation of local, national, and/or international law. eBay is committed to assist law enforcement with any inquires related to attempts to misappropriate personal inf! ormation with the intent to commit fraud or theft. Information will be provided at the request of law enforcement agencies to ensure that perpetrators are prosecuted to the full extent of the law.

To confirm your identity with us click here: https://204.100.225.253/aw-cgi/eBayISAPI.dll?OneTimePayment&ssPageName=h:h:sin:US

After responding to the message, we ask that you allow at least 72 hours for the case to be investigated. Emailing us before that time will result in delays. We apologize in advance for any inconvenience this may cause you and we would like to thank you for your cooperation as we review this matter.

Respectfully,
Trust and Safety Department
eBay Inc.
http://www.ebay.com/

I reported this to eBay who responded with the following:

Hello,

Emails such as this, commonly referred to as “spoof” or “phished”
messages and are sent in an attempt to collect sensitive personal or
financial information from the recipients. The email you reported was
not sent by eBay. We have reported this email to the appropriate
authorities.

In the future, we ask that you be very cautious of any email that asks
you to submit information such as your credit card number or your email
password. eBay will never ask you for sensitive personal information
such as passwords, bank account or credit card numbers, Personal
Identification Numbers (PINs), or Social Security numbers in an email.
If you ever need to provide sensitive information to us, please open a
new Web browser, type www.ebay.com into your browser address field, and
click on the “site map” link located at the top the page to access the
eBay page you need.

If you have any doubt about whether an email message is from eBay,
please forward it immediately to spoof@ebay.com. Please do not respond
to it or click any of the links. Also, we ask you not to remove the
original subject line or change the email in any way when you forward it to us.

If you have already entered sensitive financial information or your
password into a Web site based on a request from a spoofed email, you
should take immediate action to protect your identity and all of your
online accounts. We have developed an eBay Help page with valuable
information regarding the steps you should take to protect yourself.
Please visit the page below to learn more:

http://pages.ebay.com/help/confidence/isgw-account-theft-reporting.html

In addition, to keep our community safe, eBay has created a tutorial to
teach our members about spoof emails. To access the tutorial, please
visit the page below:

http://pages.ebay.com/education/spooftutorial/

Regards,

Ande
eBay SafeHarbor
Investigations Team