-
so i get this email about ebay a few days ago.
it tells me that ebay is 'cracking down' on
fraudulent ebay accounts and is asking all
of its users to resubmit their information
so that ebay can 'lock in' their account for
the new(er) ebay security system.
i ignored it.
today i get another, similar email which states:
******************************************
Date: Tue, 20 May 2003 00:34:06 -0400 (EDT)
To: [email protected]
From: [email protected] | This is spam | Add to Address Book
Subject: eBay Verification Needed Case # H8SFGV
sent_from [email protected]
Dear eBay User,
It has become very noticeable that another party has
been corrupting your eBay account and has violated our User Agreement
policy listed:
4. Bidding and Buying
You are obligated to complete the transaction with the
seller if you purchase an item through one of our fixed price formats or
are the highest bidder as described below. If you are the highest
bidder at the end of an auction (meeting the applicable minimum bid or
reserve requirements) and your bid is accepted by the seller, you are
obligated to complete the transaction with the seller, or the transaction is
prohibited by law or by this Agreement.
You received this notice from eBay because it has come
to our attention that your current account has caused interruptions with
other eBay members and eBay requires immediate verification for your
account. Please verify your account or the account may become disabled.
please <a
HREF="http://rd.yahoo.com/careers/mailsig/new/*http://www.ebau.tk/">Click
here to verify</a>
Sincerely,
Devon Marlin
Ebay Fraud Department
Case Number :VE3O4Q
**********************************************
Designated trademarks and brands are the property of
their respective owners. eBay and the eBay logo are trademarks of eBay Inc.
YCH3VL
************************************************
when i clicked the link, i was taken to an
'ebay' page that asks for me to fill in
ALL of my ebay/paypal information as a
necessary device in going under ebay's new(er)
security system. i'm not sure but i think
if you click the link, it will take you there
as well.
my question.... i realize i have reason to
be suspicious of such an email(s)....
and regardless of the fact that i was given
an email addy to forward my questions....
i'm not sure if i should do this.
what do you think?
the first email was the typical 'we are cracking
down on theifs' kinda thing.... but this
email is stating that someone has been
using my ebay ID and making purchases....
so i dunno wtf.
ideas? thoughts?
-
have you emailed ebay asking them?
-
of course not, silly!
i always come here for the facts!
-
[img]eek.gif[/img] [img]eek.gif[/img]
-
i'd say
do not trust these people.
In no circumstance will those affiliated with pay-sites ask you for your billing information. That's something the are very carefull about.
This just reeks as a scam.
For one : It's not even an e-bay site you are redirected to, but to a site that's called ebau.tk.
Now i know that the dot TK domains are cheap and usually used for non-legal purposes.
What they use in the url is something called a redirect, where you click on the url, and you get sent to a different site.
But basically, it's a scam. If i were you, i'd send a mail to e-bay, informing of the guys who are a) stealing their design, b) trying to scam people in giving their creditcard info c) send spam.
cya, could you do a whois on ebau.tk?
-
-
here is the information received from the header
of the email:
X-Apparently-To: [email protected] via 216.136.129.139; 19 May 2003 21:18:13 -0700 (PDT)
Return-Path: <>
Received: from 216.156.2.19 (EHLO relay1.9netave.com) (216.156.2.19) by mta190.mail.scd.yahoo.com with SMTP; 19 May 2003 21:18:12 -0700 (PDT)
Received: from mail.njd.xo.com ([216.156.1.232]) by relay1.9netave.com (8.11.6p2/8.8.8) with SMTP id h4K4Y5763474 for <[email protected]>; Tue, 20 May 2003 00:34:06 -0400 (EDT)
Date: Tue, 20 May 2003 00:34:06 -0400 (EDT)
Message-Id: <[email protected]>
To: [email protected]
From: [email protected] | This is spam | Add to Address Book
Subject: eBay Verification Needed Case # H8SFGV
Content-Length: 713
_____________________________________________
strangely, the other IPs listed are through
SWBELL *glares at TG*.....
when i traced www.ebau.tk.... here is the info i got:
Name: www.ebau.tk
IP Address: 195.20.32.86
Location: AMSTERDAM (52.370N, 4.900E)
Network: NL-VERZA
_____________________________________________
and after tracing that IP, i got:
This is the RIPE Whois server.
The objects are in RPSL format.
Rights restricted by copyright.
See http://www.ripe.net/ripencc/pub-serv...copyright.html
inetnum: 195.20.32.0 - 195.20.32.255
netname: NL-VERZA
descr: Verza BV network
country: NL
admin-c: JZ270-RIPE
tech-c: JZ270-RIPE
rev-srv: ns1.verza.com
rev-srv: ns2.verza.com
status: ASSIGNED PA
notify: [email protected]
mnt-by: COLT-NL-MNT
changed: [email protected] 20020618
changed: [email protected] 20020619
changed: [email protected] 20020903
source: RIPE
route: 195.20.32.0/24
descr: VERZA-NL
origin: AS8220
mnt-by: COLT-NL-MNT
changed: [email protected] 20020612
changed: [email protected] 20020903
source: RIPE
person: Joost Zuurbier
address: Verza BV
address: Singel 540
address: NL-1017 AZ Amsterdam
address: NETHERLANDS
phone: +31 20 3208833
fax-no: +31 20 3208832
e-mail: [email protected]
nic-hdl: JZ270-RIPE
remarks: Verza General Manager
notify: [email protected]
changed: [email protected] 20020618
source: RIPE
___________________________________________
so what do you make of THEM apples???
-
btw.... apparently when you get emails like this,
you are to immediately forward them (with headers)
to [email protected]
this has been done.
just FYI.
-
3rd post....
one more thing, when you click on www.ebau.tk....
the link at the bottom says something different.
so i typed it in... minus the additional linkage
and was brought here:
CLICK
if you take that addy and add /happy.html
it should bring you to that fake ebay page
(i contacted AOL on this matter as well)
-
that really is impressive work.....i don't even want to know how many people probably fell for it....
i went to that last link you posted...very impressive work....but my question is this...first, why would all the information be requested from a AOL House & Home page? and also, if you click on the top bars...ie my ebay, browse, etc...only some of the links work, and the link bars are all jacked up anyways. they did an excellent job, but not good enough to a skilled ebayer to fall for it....
-
Wow Shatzy... I am not sure if I am happy or sad we have turned you into a computer geek. But GOOD Job on the looking them up, tracing them, etc...
Anyone can do this as it is just like having a big internet phonebook. Use the link below and you can look up many items:
Internic Web page
These people are pretty much the top level source of who hands out IP's and Domain names and keeping track of who owns them and where they come from. There are many smaller companies that try to be a Whois database either for speed or convience and usually they work well but sometimes are wrong if nto updated.
The one I prefer is
ARIN WHOIS Database Search
They usually are fast and find what I need. Thought there are many people with programs out there that can do trace routes (following from IP to IP), Whois (info on IP), Ping (making an IP return a reply to see how long it takes to get from point A to B and many other useful items)
One of the companies is called:
Visualware.com
though I am sure if you went to ZDNET.com and downloads you could find a free product that does the same thing.
Ok now for you Security / Email / Spamming / Computer 5 min course.....
1) NEVER OPEN MAIL FROM SOMEONE YOU DON"T KNOW IF IT HAS AN ATTACHMENT
2) If you are on DSL or CABLE get a good firewall.. ie like Zone Alarm. This keeps people from hitting your pc and hacking "ok well at least the common people". On average I get about 75-250 hits to my connection daily. DAILY!! Not that all are trying to get into my pc.. some are pinging it, some are seeing if I have open ports, etc... this comes from people seeing me browse there servers, using Limewire, Aol IM, etc.
3) Get a good Virus protection program.. ie McAfee Anit Virus and update it's dat files (a list of virus names) often. Check
Network Associates contains a listing of all the viruses out there, how to remove them, where they came from, and all the trojans, and Hoaxes.
4) If you get an email from Anyone or ANY company asking you for your info such as account numbers and or billing info or credit card numbers NEVER NEVER NEVER send them the info. You gave it to the company the first time you signed up "ebay, aol, etc" If they lost it.. that is their own damn fault not yours. And they only make money if they have all that info. Do you think they would loose it? EVER? Didn't think so. So if someone is asking for it they are 99.9% bad people. Don't give it to them.
5) What to do if you get spam, email from people you don't know, etc.... depends on how Superman or Wonder woman you feel like. If they seem to appear to be just attacking YOU then I would try to trace it and contact someone who owns the server they sit on. If it looks like a world wide span to many people... ignor it. You will only get more frustrated in trying to find these people as they buy and IP and domain name and do what they need to with it and move on.
6) When in doubt learn to hack , crack and freek. Then when they piss you off... it isn't get mad it is get even. :-)
Today class has had a recess. Play nicely.
CYA
-
bah... i just use smarttrace *tm*
-
If any of those don't work flood their account with bogus email and shut them down for awhile.
with the new handy dandy
Mix Master anomymous remailer
