Web Hosting Talk







View Full Version : Bogus Email


jmc67
11-06-2002, 12:19 PM
Since some of you use ebay, I thought I post this here. This is an email I received which is definitely bogus. I will blank out my email address with xxxx for privacy reasons.

Actual email:
Dear eBay member,

As we announced at the end of February, our User Agreement and Privacy Policy have been updated. The User Agreement, in Section 9, allows eBay to deactivate users if they are not using eBay user ID for selling or bidding for more then 60 days. These changes were made to deactivate non-working eBay members and to better serve the needs of eBay community by providing a more comprehensive trading environment.

----------------------------------------------------------
If you use your eBay user ID less then every 60 days please follow the link to confirm that you want to use it in the future, otherwise your eBay user ID will be deactivated:

http://cgi6ebay.com/aw-cgi/eBayISAPI.dllSignIn
----------------------------------------------------------

If you use your eBay ID more often then 60 days please disregard this email.

Thank you to all for your cooperation and for making eBay a better place to shop!

Regards,
eBay
==========================================

Below is the header information: (xxx = my email address removed)
------------------------------
Return-path: <bbbb@212.179.112.170>
Return-path: <bbbb@212.179.112.170>
Received: from mta11.srv.hcvlny.cv.net (mta11.srv.hcvlny.cv.net [167.206.5.46])
by mstr5.srv.hcvlny.cv.net
(iPlanet Messaging Server 5.2 HotFix 0.8 (built Jul 12 2002))
with ESMTP id <0H55002STV1SL4@mstr5.srv.hcvlny.cv.net> for xxxx@ims-ms-daemon
(ORCPT xxxx@xxxxxx.net); Wed, 06 Nov 2002 10:29:52 -0500 (EST)
Received: from web.beepme.co.il (bzq-112-170.bezeqint.net [212.179.112.170])
by mta11.srv.hcvlny.cv.net
(iPlanet Messaging Server 5.2 HotFix 1.02 (built Sep 16 2002))
with SMTP id <0H5500LN2V1S3F@mta11.srv.hcvlny.cv.net> for xxxx@xxxxxx.net
(ORCPT xxxx@xxxxxx.net); Wed, 06 Nov 2002 10:29:55 -0500 (EST)
Received: from tggz.net ([205.136.164.80]) by web.beepme.co.il with Microsoft
SMTPSVC(5.0.2195.5329); Wed, 06 Nov 2002 16:42:04 +0200
Date: Wed, 06 Nov 2002 16:42:04 +0200
From: support@ebay.com
Subject: Important information regarding your eBay account
To: mradell@comcast.net
Message-id: <WEBf6IH2fbo21xKQv2G00000f0f@web.beepme.co.il>
MIME-version: 1.0
X-MIMEOLE: Produced By Microsoft MimeOLE V5.00.2919.6700
X-Mailer: Microsoft Outlook Express 5.00.2919.6700
Content-type: multipart/mixed; boundary="Boundary_(ID_zV5WlQVjcUjItFXM3+ONJA)"
X-Priority: 3
X-MSMail-priority: Normal
X-OriginalArrivalTime: 06 Nov 2002 14:42:04.0500 (UTC)
FILETIME=[AC7F1140:01C285A2]

------------------------------------------------------------
whois on the domain: cgi6ebay.com

WhoIs Result For cgi6ebay.com @ whois.melbourneit.com
Domain Name cgi6ebay.com
Creation Date 2002-10-27
Registration Date 2002-10-27
Expiry Date 2003-10-27
Organisation Name Faisal Al-adwani
Organisation Address P.O Box 18786
Baton Rouge
70893
LA
UNITED STATES
Admin Name Al-adwani Faisal
Admin Address P.O Box 18786
Baton Rouge
70893
LA
UNITED STATES
Admin Email eniki02@yahoo.com
Admin Phone +1.2257096931
Tech Name YahooDomains TechContact
Tech Address 701 First Ave.
Sunnyvale
94089
CA
UNITED STATES
Tech Email domain.tech@YAHOO-INC.COM
Tech Phone +1.6198813096
Tech Fax +1.6198813010
Name Server yns1.yahoo.com
yns2.yahoo.com

----------------------------------------------

DaveMc
11-06-2002, 12:46 PM
that is odd. Definately since Ebay would have something about that on their frontpage I would think. I haven't gotten that email yet, and I certainly haven't bought anything on there in the last 60 days!

Of course, they could move to a membership fee based environment, and want to clear out the riff raff, which may have been cool back in the day when I bought a Sparkstation on there for 80 bucks :D (1997).
ah...the good 'ol days...

GandalfDDUK
11-06-2002, 01:09 PM
Whats ebay have to say about it?

Darth
11-06-2002, 01:14 PM
Has anyone reported it?

jmc67
11-06-2002, 01:21 PM
I did report it. Go to the site and enter garbage into the username/pass and you get a thank you for your cooperation page.

The link starts out with http://cgi6ebay.com/aw-cgi/eBayISAPI.dllSignIn


The return link after submitting is http://cgi6ebay.com/eBayISAPI.php

I've been with ebay for a number of years and never from my knowledge have they used php for pages.


Typing this link gets you an error (actual ebay site)http://cgi6.ebay.com/aw-cgi/eBayISAPI.dll

Hmm. what do you think ==> http://cgi6ebay.com/

exploiter
11-06-2002, 08:08 PM
We're sorry, but this page is currently unavailable for viewing.
I guess they sorted it :)

susannad
11-06-2002, 08:10 PM
error

F.N
11-07-2002, 03:13 AM
My stab in the dark is that this site with their bogus login is basically there to steal your ebay logins. What will they do with these stolen accounts...:eek:

jmc67
11-07-2002, 11:15 AM
Looks like ebay took care of the problem. Here is the email I got from them. Anyone who fell victim of this will need to have their password changed.

Hello,

Thank you for writing regarding the email you received. We will be happy to address your concerns.

The message you received was not sent by eBay nor was it endorsed by us in any way. By altering the reply-to address for this email, it appears to have come from an eBay email address, when it actually came from an external email address. This also means that hitting the reply to button will send the message to the altered email address in the reply to field. In this case ebay-tehnical@ebay.com. This process is commonly referred to as "Spoofing".
Please rest assured that your account standing has not changed and that your auctions have not been affected. We are currently investigating the source of the email. Although we are unable to provide specific information regarding the result of our investigation, we do take these offenses very seriously and will make sure that appropriate action is taken against those responsible.

Please remember that eBay will never ask you for your private
information, including credit card information or password, in an email. Also, eBay will never send you any request or solicitation from a non-eBay email account, or provide a link outside of eBay for entering credit card or other private information. If you ever need to give us information, it is suggested that going to the main website and following links there to the site map or any other place you may need to give information, is best. You will know for certain that you are on eBay.

If you have entered your user ID in the email message provided you will wish to change your password following the steps below:
* Click on the site map link (located at the top of any eBay page)
* Scroll through the 'Services' section
* Click on the link 'Change my password'
Then once you are on the Change your password page, follow the instructions that appear on that page.

In the future if you receive a similar email, do not respond to it, and contact us through the Rules and Safety Support at the following URL:
http://pages.ebay.com/help/basics/select-RS.html
We apologize for any confusion this message created for you and we appreciate your efforts in helping keep eBay a safe trading place.

Regards,

Brianna
eBay SafeHarbor
Investigations Team