Another lame eBay phish e-mail floating around

[her209]

Thank goodness for Outlook 2003

DO NOT FILL OUT THE FORM.

<http://www.groovyshades.com/silvia.gif>

Dear ?Bay Customer

Thank you for submitting the requested information about your account. We have compared the information that you have supplied and the ATM Pin number is not the same as the one in our records.

To ensure that your account is not compromised please login to Account by clicking this link, verify your identity, your account information and supply a valid ATM Pin number in order to get your acount reactivated by our system.

Click Here <http://www.groovyshades.com/groo.htm>

- Enter your personal information and supply a valid ATM Pin number.
- Verify your identity with Eb?y Service

If at any time you require assistance, please contact our Online Account Services customer hotline at 1-800-984-6558 24 hours a day, 7 days a week.

Thank you for using Eb?y Account .

Sincerely,
Genevieve Smith - Security Department

The Eb?y Team

© Copyright 2005,Eb?y , Inc. All Rights. Reserved.

It looks like the second link goes to this address (note the IP address in the URL):

http://67.18.75.101/buttcam/Resources/index.htm

A quick look at the HTML source code gives up a form that has an action of:

• action="SecurityMeasures.php"

A quick look at the next HTML source code gives us a form that has an action of:

• action="http://passwords69.com/ebay.php"

An nslookup on the IP address turns this up:

• C:\>nslookup 67.18.75.101
  *** Can't find server name for address 192.168.0.1: Non-existent domain
  *** Default servers are not available
  Server: UnKnown
  Address: 192.168.0.1
  
  Name: 101.67-18-75.reverse.theplanet.com
  Address: 67.18.75.101

 

[LtPage1]

yeesh.

 

[Twista]

http://www.groovyshades.com/groo.htm is a porn site! Thanks! free fappppppppp

 

[her209]

Originally posted by: Twista
http://www.groovyshades.com/groo.htm is a porn site! Thanks! free fappppppppp

Really? :Q

Looks like the front page was hacked.

 

[wedi42]

4444333322221111 is a valid test credit card number.
if everyone enter some BS name and password, we can atleast make these jerks look through a lot of junk to get a few good numbers.

 

[her209]

^^^ Updated with some info.

 

[Landroval]

I got one that said my acocunt was suspended for some reason. I looked carefully at the URL and the email address and they appeared identical to the ones ebay says are "ok" on their fraud page.

 

[Doboji]

gotta love the nigerians🙂