« Kitchen Sink 419er | Main | Résumé Malware »

May 30, 2010

Just saw an eBay phishing message that comes in the guise of a message from a pissed-off buyer. It has all of the images and look-and-feel of an official eBay HTML message. I doubt all the messages in this blast reference the same product, but the one I saw ran as follows:

Subject: You have received a question about eBay BRAND NEW Nikon D300S 12.3 MP Digital SLR Camera Body

Please send me the tracking number as you told me when I paid for the camera. This is my second email and there is no answer from you by now.

Of course you didn't sell anybody this thing, but you will likely be very tempted to click on the link that supposedly lets you view the auction.

DON'T DO IT

All links in the message lead to a URL that begins as http://signin.ebay.com (if you just do a quick mouse rollover) followed by more dots and subdomain gibberish until you reach the actual domain of the link — it's piping hot out of the registration oven today. But the real problem is that the URL (after the domain name) also embeds the email address of the recipient. From all appearances, this technique is being used to validate the email address as being alive, even if you don't fall for the phishing.