Another Nasty eBay Phishing Scam

Discussion in 'Community Discussion' started by IJ Reilly, May 11, 2006.

  1. IJ Reilly macrumors P6

    IJ Reilly

    Joined:
    Jul 16, 2002
    Location:
    Palookaville
    #1
    Most of these phishing schemes are pretty transparent, and hardly worth mentioning, but this one is remarkable on two counts. First, the e-mail was a dead-on and very convincing copy of an official eBay notice (supposedly from a potential buyer of an item you won). Second, clicking on the item link brings you to an eBay login page (again, very convincing), which if you examine the URL, originates from the Ukrainian Embassy in South Korea. So, either the embassy sever has been hacked, or someone on the staff is running this scam.

    Beware!
     
  2. killuminati macrumors 68020

    killuminati

    Joined:
    Dec 6, 2004
    #2
    :( I think I've seen that same one, or I've seen a very similar one that is spot on. Regardless thanks for the heads up.
     
  3. Saluki Alex macrumors 6502

    Joined:
    Feb 26, 2006
    Location:
    Illinois
    #3
    I've gotten this same email both yesterday and today. I forwarded them to spoof@ebay.com.
     
  4. CanadaRAM macrumors G5

    CanadaRAM

    Joined:
    Oct 11, 2004
    Location:
    On the Left Coast - Victoria BC Canada
    #4
    For whatever reason, South Korean networks , especially their school networks, are notoriously poorly secured. This results in spammers flocking to them to use as open proxies to hide their real IPs. 99% of the mail that you get from a South Korean server is likely to be spam 'bounced' off that server like a good double bank shot in snooker.
     
  5. IJ Reilly thread starter macrumors P6

    IJ Reilly

    Joined:
    Jul 16, 2002
    Location:
    Palookaville
    #5
    Interesting. In this case, it's a complete URL, starting with the domain for the Ukrainian embassy in the ROK. Is it possible to "bounce" a URL? It starts:

    http://www.ukrembrk.com/.signin.ebay.com
     
  6. cb911 macrumors 601

    cb911

    Joined:
    Mar 12, 2002
    Location:
    BrisVegas, Australia
    #6
    hrm - i get a 403 forbidden on that link?

    I have also been caught by ones like this - just rushing once and I actaully input my password in one of those pages. I realised what I'd done and promptly changed my password on eBay, no harm cam to me.

    eBay is full of scams...
     
  7. IJ Reilly thread starter macrumors P6

    IJ Reilly

    Joined:
    Jul 16, 2002
    Location:
    Palookaville
    #7
    It's not eBay's fault. Anyhow, yes, you get a 403 when you try the partial link, which tells me the directory exists on the server but is privileged, which is why I posted it. I deliberately did not post the entire URL.
     
  8. cb911 macrumors 601

    cb911

    Joined:
    Mar 12, 2002
    Location:
    BrisVegas, Australia
    #8
    ahhh! :eek: but I've got to sell my item! :D :p
     

Share This Page