eBay Scams

[scottlc]

Recieved a damn eBay scam email today. It wasn't my email account, I'm just glad that I got there first. For those who are interested here is the censored raw email data.

X-Auth-No:
Return-Path: <aw-upd@ebay.com>
Received: from d11249-back.nrs.groxis.com not authenticated [216.205.150.91]
by smtp-send.myrealbox.com with NetMail SMTP Agent $Revision: 1.1.1.1 $ on Novell NetWare;
Thu, 12 Aug 2004 18:26:06 -0600
Received: from localhost (localhost.localdomain [127.0.0.1])
by d11249-back.nrs.groxis.com (8.11.6/8.11.6) with ESMTP id i7CMtfF19543
for <********@myrealbox.com>; Thu, 12 Aug 2004 18:55:41 -0400
Date: Thu, 12 Aug 2004 18:55:41 -0400
Message-Id: <200408122255.i7CMtfF19543@d11249-back.nrs.groxis.com>
To: ********@myrealbox.com
From: eBay Safety Department <aw-upd@ebay.com>
Subject: Safe Harbor Critical Notice
Content-Type: text/html; charset=ISO-8859-1

<div align="justify"><font size="-1" face="Arial, Helvetica, sans-serif ">
Dear eBay Member,<br>
<br>
<br>
Your bank has contacted us regarding some attempts of charges from your credit card via the eBay system.<br>
We have reasons to believe that you changed your registration information or that someone else has<br>
unauthorized access to your eBay account Due to recent activity, including possible unauthorized listings<br>
placed on your account, we will require a second confirmation of your identity with us in order to allow us <br>
to investigate this matter further. Your account is not suspended, but if in 48 hours after you receive this <br>
message your account is not confirmed we reserve the right to suspend your eBay registration. If you<br>
received this notice and you are not the authorized account holder, please be aware that it is in violation <br>
of eBay policy to represent oneself as another eBay user. Such action may also be in violation of <br>
local, national, and/or international laws. eBay is committed to assist law enforcement with any inquires <br>
related to attempts to misappropriate personal information with the intent to commit fraud or theft. <br>
Information will be provided at the request of law enforcement agencies to ensure that perpetrators are <br>
prosecuted to the full extent of the law. <br>&nbsp;</font></div>
<p>
<span class="style1"><font size="2" face="Arial, Helvetica, sans-serif">
Please use the link below to verify the security information: <br>
<a href="http://216.238.11.49/aw-cgi/SignIn.html">http://cgi1.ebay.com/aw-cgi/ebayISAPI.dll?signin=1&amp;user=3124&amp;notice=24 80133428</a></font></span>

<font size="-1" face="Arial, Helvetica, sans-serif ">
<br><br>
</font>
<font face="Arial, Verdana" size="2">After responding to the message, we
ask that you allow at least 72 hours for the case to be investigated. <br>
Emailing us before that time will result in delays. <br>We apologize in
advance for any inconvenience this may cause you and we would like to
thank you for <br>your cooperation as we review this matter.</font>
<br xmlns:x="urn:schemas-microsoft-com:xslt">

<font size="-1" face="Arial, Helvetica, sans-serif ">
<br><br><br><br>Respectfully,<br>
Trust and Safety Department<br>
eBay Inc.
</font>
<br>
</p>

How many eBay emails are sent from a Sprint account?

Request: 216.205.150.91
connected to whois.arin.net [69.25.34.143:43] ...

OrgName: Sprint
OrgID: SPRN
Address: 12502 Sunrise Valley Dr.
City: Reston
StateProv: VA
PostalCode: 20196
Country: US

NetRange: 216.205.144.0 - 216.205.159.255
CIDR: 216.205.144.0/20
NetName: SPRINTLINK-DELLHOST
NetHandle: NET-216-205-144-0-1
Parent: NET-216-0-0-0-0
NetType: Direct Allocation
NameServer: NS1.US.DELLHOST.COM
NameServer: NS2.US.DELLHOST.COM
Comment:
RegDate: 1999-10-26
Updated: 2003-09-03

OrgTechHandle: ARINS-ARIN
OrgTechName: arin-sprint-iprequest
OrgTechPhone: +1-800-232-3458
OrgTechEmail: ip-req@sprint.net

# ARIN WHOIS database, last updated 2004-08-12 20:10
# Enter ? for additional hints on searching ARIN's WHOIS database.

Let's see who owns the HTTP server. Turns out to belong to a hosting company called Clearel Communications, so it's one of thare customers.

Request: 216.238.11.49
connected to whois.arin.net [192.149.252.43:43] ...

OrgName: Caravela Software
OrgID: CASO
Address: 8 Way Road
City: Middlefield
StateProv: CT
PostalCode: 06455
Country: US

NetRange: 216.238.0.0 - 216.238.255.255
CIDR: 216.238.0.0/16
NetName: THEBIZ
NetHandle: NET-216-238-0-0-1
Parent: NET-216-0-0-0-0
NetType: Direct Allocation
NameServer: NS1.THEBIZ.NET
NameServer: NS2.THEBIZ.NET
Comment:
RegDate: 1999-09-08
Updated: 2001-01-17

TechHandle: ZB54-ARIN
TechName: BiznessOnline.com
TechPhone: +1-518-452-5772
TechEmail: ipadmin@thebiz.net

# ARIN WHOIS database, last updated 2004-08-12 20:10
# Enter ? for additional hints on searching ARIN's WHOIS database.

I will soon be reporting this to eBay, Sprint and Cleartel Communications. Though I guess this leaves the question: Have any of you recieved such scams, eBay or otherwise?

__________________
Computer: White MacBook (late 2008) - OS: Mac OS X 10.5.7 - CPU: Intel Core 2 Duo 2.1GHz - Memory: 4GB DDR2 PC2-5300

[MaZa]

I received similar scam from "Citibank", that my creditcard details might have been stolen and i should verify blahblah by clicking the link. Hell, im not even customer of real Citibank etcetera etcetera.

__________________
Athlon XP 2600+ Barton, 1GB 333mhz DDR RAM, NVidia 6800GT, 2x160GB HD + gainward 3d glasses
:fart:

[Boltzmann]

I've received a similar scam, but from a brazilian Bank (many people, including myself, have an account in this Bank, so a naive person would be easily fooled).

They said that they were improving their security policies, so they had to confirm my personal data, including birthdate, account number, social security number and my account *password* (if you followed the link in the mail, you would be redirected to the scam website that mimicked the real bank's website). And believe it or not, some people sent them this data, and had their accounts ripped off.

BTW, the e-mails were all sent from russian addresses (spoofed, of course).

__________________
"Let be be finale of seem.
The only emperor is the emperor of ice-cream."
- Wallace Stevens

Me on Twitter

[dukenukem]

I remeber some **** like this back in the days we were using aol,they sent a scam thing saying we had ordered a $2000 computer but we needed to update our account services including password and whatnot bad thing is back then i felt for it,haven't been scammed since,also parents got new debit cards due to that also.

__________________

1st pc=pentiumd 820 dualcore,250gb sata hdd,intel gma 950,19 inch lcd,lexmark printer,8in1 media card reader.
laptop=hp pavilion dv51099nr
core2 duot 5800,500gb wd 5400rpm hdd,512mb nvidia9600gt mobile gfxcard,15.4 inch 1280x800 screen,8x dvd burner.
2nd pc
am3 phenomIIx4955be(3.8ghz),3gigs of ddr3,500gb samsung spinpoint7200rpm hdd,16x hp dvd burner,zotac eco 9800gt,asrock 870extreme3 mobo,cooler master hyper 212+ cpu cooler.

[Solid_Snake]

I receives spam scams from all of my 3 e-mail acc. by glourista@spymac.com

__________________

[l3illyl3ob]

http://www.p-p-p-powerbook.com/

linked for relavance, and general amusement

[Player-X]

Funny, I just recieved one that claims it's from a refugee from the war between my govement and reble forces, Sorry spamers try going north east or south

[elachys]

lol that is the best prank ever !!!!

[scottlc]

Originally Posted by l3illyl3ob

http://www.p-p-p-powerbook.com/

linked for relavance, and general amusement

I saw that some time ago. Pwned, anyone?

__________________
Computer: White MacBook (late 2008) - OS: Mac OS X 10.5.7 - CPU: Intel Core 2 Duo 2.1GHz - Memory: 4GB DDR2 PC2-5300

[SimonMallion]

Originally Posted by l3illyl3ob

http://www.p-p-p-powerbook.com/

linked for relavance, and general amusement

Thanks, that was a pretty funny read

__________________
http://simonmallion.homedns.org - Home of PSXMemTool