{"id":8037,"date":"2006-02-09T17:38:00","date_gmt":"2006-02-09T22:38:00","guid":{"rendered":"https:\/\/nuxx.net\/blog\/2006\/02\/09\/ebay-phishing-scheme\/"},"modified":"2026-07-01T11:34:08","modified_gmt":"2026-07-01T15:34:08","slug":"ebay-phishing-scheme","status":"publish","type":"post","link":"https:\/\/nuxx.net\/blog\/2006\/02\/09\/ebay-phishing-scheme\/","title":{"rendered":"eBay Phishing Scheme"},"content":{"rendered":"

Upon sitting down at my desk just now it appeared that I had email from an eBay user named ‘yuki668’ asking simply “Hello,do you accept PayPal?”. This seemed a bit fishy, so I decided to dig into it a little bit.<\/p>\n

Come to find out, it’s the best made phishing scheme that I’d not yet seen. It appears to look like valid email from eBay, takes you to a look-alike login page, allows one to compose a reply, and even appears to send the message, then offering to redirect the user to My eBay and various other pages.<\/p>\n

Here are some screenshots of this message and the hosted false pages:<\/p>\n

· Original email from ‘yuki668’ asking a ‘question’.<\/a>
\n· Fake eBay login page.<\/a>
\n· Fake message composition page.<\/a>
\n· Fake sent message confirmation.<\/a><\/p><\/blockquote>\n

I have to say, with my actively selling something on eBay, this almost<\/em> fooled me. The way I knew it not to be right, is the original email message was sent, it didn’t say that it was a question about a particular item…<\/p>\n

Anyway, here is the full header if the email, if you are curious: <\/p>\n

X-Spam-Checker-Version: SpamAssassin 3.1.0 (2005-09-13) on rez.nuxx.net
\nX-Spam-Level: *
\nX-Spam-Status: No, score=1.3 required=5.0 tests=HTML_FONT_BIG,HTML_MESSAGE,
\n\tHTML_TAG_EXIST_TBODY,MIME_HEADER_CTYPE_ONLY,MIME_HTML_ONLY,
\n\tUNDISC_RECIPS autolearn=no version=3.1.0
\nReceived: (qmail 33525 invoked by uid 89); 9 Feb 2006 22:19:28 -0000
\nDelivered-To: nuxx.net-ebay@nuxx.net
\nReceived: (qmail 33523 invoked from network); 9 Feb 2006 22:19:27 -0000
\nReceived: from unknown (HELO nj.jtbusa.com) (209.113.224.178)
\n by bornslippy.nuxx.net with SMTP; 9 Feb 2006 22:19:27 -0000
\nReceived: from net1.nj.jtbusa.com (localhost.nj.jtbusa.com [127.0.0.1])
\n\tby nj.jtbusa.com (8.12.9p2\/8.11.6) with ESMTP id k19MHhcV051714
\n\tfor ; Thu, 9 Feb 2006 17:17:44 -0500 (EST)
\n\t(envelope-from root@net1.nj.jtbusa.com)
\nReceived: (from root@localhost)
\n\tby net1.nj.jtbusa.com (8.12.9p2\/8.12.9\/Submit) id k19MHg6Q051713
\n\tfor ebay@nuxx.net; Thu, 9 Feb 2006 17:17:42 -0500 (EST)
\n\t(envelope-from root)
\nDate: Thu, 9 Feb 2006 17:17:42 -0500 (EST)
\nMessage-Id: <200602092217.k19MHg6Q051713@net1.nj.jtbusa.com>
\nFrom: \"eBay Member: yuki668\"
\nSubject: Message from eBay Member
\nContent-Type: text\/html
\nTo: undisclosed-recipients:;<\/tt><\/p><\/blockquote>\n

So, yeah… You might want to keep an eye out for something like this. Additionally, I’m not sure how easy it’ll be to filter, because except for eBay’s inclusion of a plain text copy of the message, and the phishing message’s proper formatting of the raw HTML (eBay’s isn’t like this) the messages appear to be quite similar.<\/p>\n","protected":false},"excerpt":{"rendered":"

Upon sitting down at my desk just now it appeared that I had email from an eBay user named ‘yuki668’ asking simply “Hello,do you accept PayPal?”. This seemed a bit fishy, so I decided to dig into it a little bit. Come to find out, it’s the best made phishing scheme that I’d not yet\u2026<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[13,34],"tags":[],"class_list":["post-8037","post","type-post","status-publish","format-standard","hentry","category-computers","category-moved-from-livejournal"],"_links":{"self":[{"href":"https:\/\/nuxx.net\/blog\/wp-json\/wp\/v2\/posts\/8037","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/nuxx.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/nuxx.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/nuxx.net\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/nuxx.net\/blog\/wp-json\/wp\/v2\/comments?post=8037"}],"version-history":[{"count":1,"href":"https:\/\/nuxx.net\/blog\/wp-json\/wp\/v2\/posts\/8037\/revisions"}],"predecessor-version":[{"id":13592,"href":"https:\/\/nuxx.net\/blog\/wp-json\/wp\/v2\/posts\/8037\/revisions\/13592"}],"wp:attachment":[{"href":"https:\/\/nuxx.net\/blog\/wp-json\/wp\/v2\/media?parent=8037"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/nuxx.net\/blog\/wp-json\/wp\/v2\/categories?post=8037"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/nuxx.net\/blog\/wp-json\/wp\/v2\/tags?post=8037"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}