Be very careful with ebay spoof emails.

MissFlora · 12-05-2004, 12:08 PM

I believe a number of np'ers have accounts with ebay and thus would like to remind everyone about spoof emails again. Just received this today..

Dear valued eBay member:
It has come to our attention that your eBay billing informations are
out of order. If you could please take 5-10 minutes out of your
online experience and update your personal records you will not run
into any future problems with the online service. However, failure
to update your records will result in account suspension. Please
update your records by December 7.

Once you have updated your account records your eBay session will not be
interrupted and will continue as normal. Failure to update will result in
cancellation of service, Terms of Service (TOS) violations or future
problems.

To update your eBay records click here:
http://cgi1.ebay.com/aw-cgi/ebayISAPI.dll?UPdate
????: NamePros.com http://www.namepros.com/domain-name-discussion/58325-be-very-careful-ebay-spoof-emails.html

eBay Update team
http://www.ebay.com

To check if it is a spoof email...just get your mouse over the link (without clicking it) and look at the domain name. If it is a spoof, it will not be ebay.com For the above, I have eybay.net which is definitely not eBay. But for most cases, even if you do click the link, it is not infectious with virus so you're still safe UNTIL you really change your ebay billing/password info in the site. So fellow np'ers, please be very careful with all sorts of emails asking you to change your passwords, not only ebay alone. There're many scammers out there and is definitely worth to be careful with them.

Hope this helps,
Flora.

Riceman · 12-05-2004, 05:02 PM

I just delete when I see these. It is bad how often these phishing scremes come out

fx-host · 12-05-2004, 05:06 PM

I received an almost identical email, they said they would suspend my account in three days.

Never happened though.

webdome · 12-05-2004, 05:17 PM

If you have antivirus installed and it is not mark this email as eBay Trojan, would you be so kind to provide the name of antivirus, version and last update date.
Thanks.

MissFlora · 12-06-2004, 02:58 PM

This is not trojan, simply some email scams. If a trojan, it will be in your computer registry. That, you definitely don't want that. (Take hell alot of time to get everything cleaned).

omnia · 12-06-2004, 04:05 PM

This is a phishing expedition, after the unwary, logins and passwords. I've noticed these things seem to come in waves. eBay seems to be flavour of the month at the moment.

yandig · 12-06-2004, 04:11 PM

Thanks, Flora
I haven't got one of these e-mails yet, but I'm sure I will.

vimkar · 12-06-2004, 04:20 PM

Originally Posted by MissFlora

I believe a number of np'ers have accounts with ebay and thus would like to remind everyone about spoof emails again. Just received this today..

Dear valued eBay member:
It has come to our attention that your eBay billing informations are
out of order. If you could please take 5-10 minutes out of your
online experience and update your personal records you will not run
into any future problems with the online service. However, failure
to update your records will result in account suspension. Please
update your records by December 7.

Once you have updated your account records your eBay session will not be
interrupted and will continue as normal. Failure to update will result in
cancellation of service, Terms of Service (TOS) violations or future
problems.

To update your eBay records click here:
http://cgi1.ebay.com/aw-cgi/ebayISAPI.dll?UPdate

eBay Update team
http://www.ebay.com

To check if it is a spoof email...just get your mouse over the link (without clicking it) and look at the domain name. If it is a spoof, it will not be ebay.com For the above, I have eybay.net which is definitely not eBay. But for most cases, even if you do click the link, it is not infectious with virus so you're still safe UNTIL you really change your ebay billing/password info in the site. So fellow np'ers, please be very careful with all sorts of emails asking you to change your passwords, not only ebay alone. There're many scammers out there and is definitely worth to be careful with them.
????: NamePros.com http://www.namepros.com/showthread.php?t=58325

Hope this helps,
Flora.

thanks for the information
great npr

webdome · 12-07-2004, 12:14 AM

Originally Posted by MissFlora

This is not trojan, simply some email scams. If a trojan, it will be in your computer registry. That, you definitely don't want that. (Take hell alot of time to get everything cleaned).

Technically speaking it isn't Trojan, it is mailware. That's why I recommend to use Firefox browser with SpoofStick plug in. However, this type of emails also affect PayPal, you may receive relatively close email about your PayPal account. To make long story short it was decided to mark it as eBay Trojan and now it is recognizable as a Trojan by all major AntiVirus software. Also I can give many examples of Trojans that never insert in the reg. And the main definition of Trojan is "a program that appears desirable but actually contains something harmful" reminder of Tojan Horse

nicholas · 12-07-2004, 04:11 AM

It's phishing all right, and it's gotten thousands of people hoodwinked out of their credit card info.

First it used to be really long URLs that spoofed the target site (eg eBay) at the start of the URL, only to be ended at the far end of the longish URL with the real domain name.

Now they're using the more insidious method as described above where the anchor text of the hyperlink is supposedly a valid domain, but in fact when you look at the actual hyperlink (via a mouseover or worse-- if you fell for it and clicked on it) it was actual somewhere else that gave you the look and feel of the target site but is actually in the criminal's site.

Best never to click on questionable emails like that when asked for a link and instead verifying or doing a copy-and-paste to your browser and the like, and only after verifying if the link is legit.

dgridley · 12-07-2004, 07:35 AM

I get at least one or two of these a month.. many, instead, of using a domain, use an IP address that you can see on mouseover.. I also get spoofs for SunTrust Bank (and I have never had an account there!).

MissFlora · 12-07-2004, 10:23 PM

I don't see any harm just clicking it though, personally. It is not a virus-infected site. Just a page that looks exactly like official eBay's. BUT of course, do not type your info in it. Don't fall for the trap! And pal (webdome), I will be interested to know some trojan that does not affect the registry. Exploring pc virus is one of my hobby, won't hesitate to grab this chance to know more about it from you, hehe.

Sabre · 12-09-2004, 11:37 AM

As soon as i see them i delete them.........

its the best think to do

cerebus · 12-09-2004, 01:13 PM

Searched junkmail box: 41 occurences of suntrust, 12 occurences of ebay, 19 of paypal; and the legit ones do end up in my regular inbox.

ddrassociate · 12-09-2004, 01:19 PM

Oh boy do I get a whole lot of those.

12-05-2004, 12:08 PM	THREAD STARTER #1 (permalink)
MissFlora Epitome.Of.Pulchritude Join Date: Jan 2004 Posts: 3,130	Be very careful with ebay spoof emails. I believe a number of np'ers have accounts with ebay and thus would like to remind everyone about spoof emails again. Just received this today.. Dear valued eBay member: It has come to our attention that your eBay billing informations are out of order. If you could please take 5-10 minutes out of your online experience and update your personal records you will not run into any future problems with the online service. However, failure to update your records will result in account suspension. Please update your records by December 7. Once you have updated your account records your eBay session will not be interrupted and will continue as normal. Failure to update will result in cancellation of service, Terms of Service (TOS) violations or future problems. To update your eBay records click here: http://cgi1.ebay.com/aw-cgi/ebayISAPI.dll?UPdate ????: NamePros.com http://www.namepros.com/domain-name-discussion/58325-be-very-careful-ebay-spoof-emails.html eBay Update team http://www.ebay.com To check if it is a spoof email...just get your mouse over the link (without clicking it) and look at the domain name. If it is a spoof, it will not be ebay.com For the above, I have eybay.net which is definitely not eBay. But for most cases, even if you do click the link, it is not infectious with virus so you're still safe UNTIL you really change your ebay billing/password info in the site. So fellow np'ers, please be very careful with all sorts of emails asking you to change your passwords, not only ebay alone. There're many scammers out there and is definitely worth to be careful with them. Hope this helps, Flora. __________________ %%- 29th May NP Auction at 8pm EDT/5pm PDT/12am UTC %%- Drop-by when you are free: 1-after-1 NP$ .info Auction Toronto Summer 2011: Book NOW! \| For Sale: CrazyScript.com - comes with some traffic!

12-05-2004, 05:06 PM	#3 (permalink)
fx-host NamePros Member Join Date: Feb 2004 Location: Montreal Posts: 197	I received an almost identical email, they said they would suspend my account in three days. Never happened though. __________________ :music: HitZ.ca \| Your #1 Music Station

12-06-2004, 02:58 PM	THREAD STARTER #5 (permalink)
MissFlora Epitome.Of.Pulchritude Join Date: Jan 2004 Posts: 3,130	This is not trojan, simply some email scams. If a trojan, it will be in your computer registry. That, you definitely don't want that. (Take hell alot of time to get everything cleaned). __________________ %%- 29th May NP Auction at 8pm EDT/5pm PDT/12am UTC %%- Drop-by when you are free: 1-after-1 NP$ .info Auction Toronto Summer 2011: Book NOW! \| For Sale: CrazyScript.com - comes with some traffic!

12-06-2004, 04:11 PM	#7 (permalink)
yandig Domain Bagger Join Date: Sep 2004 Location: Coma Berenices Posts: 3,862 Follow @domainbagger	Thanks, Flora I haven't got one of these e-mails yet, but I'm sure I will. __________________ Yandig Available Domains

12-07-2004, 04:11 AM	#10 (permalink)
nicholas NamePros Regular Join Date: Dec 2003 Location: The Beach Posts: 584	It's phishing all right, and it's gotten thousands of people hoodwinked out of their credit card info. First it used to be really long URLs that spoofed the target site (eg eBay) at the start of the URL, only to be ended at the far end of the longish URL with the real domain name. Now they're using the more insidious method as described above where the anchor text of the hyperlink is supposedly a valid domain, but in fact when you look at the actual hyperlink (via a mouseover or worse-- if you fell for it and clicked on it) it was actual somewhere else that gave you the look and feel of the target site but is actually in the criminal's site. Best never to click on questionable emails like that when asked for a link and instead verifying or doing a copy-and-paste to your browser and the like, and only after verifying if the link is legit. __________________ Newsback.com -- Commentary and backstories of the news -----------------------------------------------

	LeadRefs	Forum Sponsorship
	Want to sell your domain? LeadRefs.com finds multiple potential buyers to contact instantly!

12-05-2004, 05:02 PM	#2 (permalink)
Riceman Senior Member Join Date: Sep 2003 Posts: 1,015	I just delete when I see these. It is bad how often these phishing scremes come out

12-05-2004, 05:17 PM	#4 (permalink)
webdome NamePros Member Join Date: Sep 2004 Location: Vancouver not BC, Washington not DC Posts: 188	If you have antivirus installed and it is not mark this email as eBay Trojan, would you be so kind to provide the name of antivirus, version and last update date. Thanks.

12-06-2004, 04:05 PM	#6 (permalink)
omnia Senior Member Join Date: Nov 2004 Location: The Land of Oz Posts: 1,680	This is a phishing expedition, after the unwary, logins and passwords. I've noticed these things seem to come in waves. eBay seems to be flavour of the month at the moment.

12-07-2004, 07:35 AM	#11 (permalink)
dgridley NamePros Legend Join Date: Jul 2004 Location: SW Missouri Posts: 18,396 Follow @davew3b	I get at least one or two of these a month.. many, instead, of using a domain, use an IP address that you can see on mouseover.. I also get spoofs for SunTrust Bank (and I have never had an account there!). __________________ davew3b tumblr blog \| davew3b posterous blog

12-07-2004, 10:23 PM	THREAD STARTER #12 (permalink)
MissFlora Epitome.Of.Pulchritude Join Date: Jan 2004 Posts: 3,130	I don't see any harm just clicking it though, personally. It is not a virus-infected site. Just a page that looks exactly like official eBay's. BUT of course, do not type your info in it. Don't fall for the trap! And pal (webdome), I will be interested to know some trojan that does not affect the registry. Exploring pc virus is one of my hobby, won't hesitate to grab this chance to know more about it from you, hehe. __________________ %%- 29th May NP Auction at 8pm EDT/5pm PDT/12am UTC %%- Drop-by when you are free: 1-after-1 NP$ .info Auction Toronto Summer 2011: Book NOW! \| For Sale: CrazyScript.com - comes with some traffic!

12-09-2004, 11:37 AM	#13 (permalink)
Sabre First Time Poster! Join Date: Aug 2004 Location: Chelmsford, UK Posts: 11,410	As soon as i see them i delete them......... its the best think to do __________________ NamePros Google Panda / Penguin Thread SEO Services \| UK PPC Company \| UK Website Analysis Service Cheap Backpacker Travel Insurance \| Cheap Family Travel Insurance \| Cheap Travel Insurance \| Cheap Holiday Insurance\| UK Dedicated Servers

12-09-2004, 01:13 PM	#14 (permalink)
cerebus NamePros Regular Join Date: Oct 2003 Location: Sweden Posts: 395	Searched junkmail box: 41 occurences of suntrust, 12 occurences of ebay, 19 of paypal; and the legit ones do end up in my regular inbox.

12-09-2004, 01:19 PM	#15 (permalink)
ddrassociate NamePros Regular Join Date: Nov 2004 Location: USA Posts: 516	Oh boy do I get a whole lot of those. __________________ -DDr

Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)