justified paranoia??

[SHATOUSHKA]

so i get this email about ebay a few days ago.

it tells me that ebay is 'cracking down' on
fraudulent ebay accounts and is asking all
of its users to resubmit their information
so that ebay can 'lock in' their account for
the new(er) ebay security system.

i ignored it.

today i get another, similar email which states:

******************************************


Date: Tue, 20 May 2003 00:34:06 -0400 (EDT)
To: [email protected]
From: [email protected] | This is spam | Add to Address Book
Subject: eBay Verification Needed Case # H8SFGV




sent_from [email protected]
Dear eBay User,

It has become very noticeable that another party has
been corrupting your eBay account and has violated our User Agreement
policy listed:

4. Bidding and Buying

You are obligated to complete the transaction with the
seller if you purchase an item through one of our fixed price formats or
are the highest bidder as described below. If you are the highest
bidder at the end of an auction (meeting the applicable minimum bid or
reserve requirements) and your bid is accepted by the seller, you are
obligated to complete the transaction with the seller, or the transaction is
prohibited by law or by this Agreement.

You received this notice from eBay because it has come
to our attention that your current account has caused interruptions with
other eBay members and eBay requires immediate verification for your
account. Please verify your account or the account may become disabled.
please <a
HREF="http://rd.yahoo.com/careers/mailsig/new/*http://www.ebau.tk/">Click
here to verify</a>


Sincerely,
Devon Marlin
Ebay Fraud Department
Case Number :VE3O4Q
**********************************************

Designated trademarks and brands are the property of
their respective owners. eBay and the eBay logo are trademarks of eBay Inc.
YCH3VL

************************************************

when i clicked the link, i was taken to an
'ebay' page that asks for me to fill in
ALL of my ebay/paypal information as a
necessary device in going under ebay's new(er)
security system. i'm not sure but i think
if you click the link, it will take you there
as well.

my question.... i realize i have reason to
be suspicious of such an email(s)....
and regardless of the fact that i was given
an email addy to forward my questions....
i'm not sure if i should do this.

what do you think?

the first email was the typical 'we are cracking
down on theifs' kinda thing.... but this
email is stating that someone has been
using my ebay ID and making purchases....
so i dunno wtf.

ideas? thoughts?

[diluted]

have you emailed ebay asking them?

[SHATOUSHKA]

of course not, silly!

i always come here for the facts!

[diluted]

[img]eek.gif[/img] [img]eek.gif[/img]

[zelazny]

i'd say
do not trust these people.
In no circumstance will those affiliated with pay-sites ask you for your billing information. That's something the are very carefull about.

This just reeks as a scam.
For one : It's not even an e-bay site you are redirected to, but to a site that's called ebau.tk.
Now i know that the dot TK domains are cheap and usually used for non-legal purposes.

What they use in the url is something called a redirect, where you click on the url, and you get sent to a different site.

But basically, it's a scam. If i were you, i'd send a mail to e-bay, informing of the guys who are a) stealing their design, b) trying to scam people in giving their creditcard info c) send spam.

cya, could you do a whois on ebau.tk?

[zelazny]

so it's justified!

[SHATOUSHKA]

here is the information received from the header
of the email:

X-Apparently-To: [email protected] via 216.136.129.139; 19 May 2003 21:18:13 -0700 (PDT)
Return-Path: <>
Received: from 216.156.2.19 (EHLO relay1.9netave.com) (216.156.2.19) by mta190.mail.scd.yahoo.com with SMTP; 19 May 2003 21:18:12 -0700 (PDT)
Received: from mail.njd.xo.com ([216.156.1.232]) by relay1.9netave.com (8.11.6p2/8.8.8) with SMTP id h4K4Y5763474 for <[email protected]>; Tue, 20 May 2003 00:34:06 -0400 (EDT)
Date: Tue, 20 May 2003 00:34:06 -0400 (EDT)
Message-Id: <[email protected]>
To: [email protected]
From: [email protected] | This is spam | Add to Address Book
Subject: eBay Verification Needed Case # H8SFGV
Content-Length: 713

_____________________________________________

strangely, the other IPs listed are through
SWBELL *glares at TG*.....


when i traced www.ebau.tk.... here is the info i got:

Name: www.ebau.tk
IP Address: 195.20.32.86
Location: AMSTERDAM (52.370N, 4.900E)
Network: NL-VERZA
_____________________________________________

and after tracing that IP, i got:

This is the RIPE Whois server.
The objects are in RPSL format.

Rights restricted by copyright.
See http://www.ripe.net/ripencc/pub-serv...copyright.html

inetnum: 195.20.32.0 - 195.20.32.255
netname: NL-VERZA
descr: Verza BV network
country: NL
admin-c: JZ270-RIPE
tech-c: JZ270-RIPE
rev-srv: ns1.verza.com
rev-srv: ns2.verza.com
status: ASSIGNED PA
notify: [email protected]
mnt-by: COLT-NL-MNT
changed: [email protected] 20020618
changed: [email protected] 20020619
changed: [email protected] 20020903
source: RIPE

route: 195.20.32.0/24
descr: VERZA-NL
origin: AS8220
mnt-by: COLT-NL-MNT
changed: [email protected] 20020612
changed: [email protected] 20020903
source: RIPE

person: Joost Zuurbier
address: Verza BV
address: Singel 540
address: NL-1017 AZ Amsterdam
address: NETHERLANDS
phone: +31 20 3208833
fax-no: +31 20 3208832
e-mail: [email protected]
nic-hdl: JZ270-RIPE
remarks: Verza General Manager
notify: [email protected]
changed: [email protected] 20020618
source: RIPE

___________________________________________

so what do you make of THEM apples???

[SHATOUSHKA]

btw.... apparently when you get emails like this,
you are to immediately forward them (with headers)
to [email protected]

this has been done.
just FYI.

[SHATOUSHKA]

3rd post....

one more thing, when you click on www.ebau.tk....
the link at the bottom says something different.

so i typed it in... minus the additional linkage
and was brought here:

CLICK

if you take that addy and add /happy.html

it should bring you to that fake ebay page


(i contacted AOL on this matter as well)

[GravyTrain]

that really is impressive work.....i don't even want to know how many people probably fell for it....

i went to that last link you posted...very impressive work....but my question is this...first, why would all the information be requested from a AOL House & Home page? and also, if you click on the top bars...ie my ebay, browse, etc...only some of the links work, and the link bars are all jacked up anyways. they did an excellent job, but not good enough to a skilled ebayer to fall for it....