163/19). eBay - HTML.Phishing.Auction-145

This email targets customers of eBay.

Message Details

Malware Name:HTML.Phishing.Auction-145
Origin: Canada
Date first seen:17/08/2006 02:40:47
From:"eBay InC." <member@eBay.com>
Subject:eBay Item Not Received Dispute Opened for Item #6884608151

Attacker's URLs

The following table shows the details of the URLs used by the attacker. These could either be the fake website of the attack, or a site which redirects to the attackers fake site. Sometimes the attacker will use an additional site for hosting resources such as images.

The table shows the current status of the site: if it is still reachable (), or if it has been shut down (). If the site has not been confirmed as a phishing site it is shown with the symbol . The time when the site was first observed is shown, together with the time that the site was shut down, if applicable. Do not visit the attackers site as it may contain malware. You can get more details on the site by clicking on the symbol.

StatusFirst observedShut DownInternet AddressURL
18/08/2006 13:41:11 01/09/2006 21:43:10 China 220.166.80.245 http://220.166.80.245/config/ebay_usr/ISAPIdllSignIn   
13/08/2006 15:42:06 29/08/2006 13:36:10 Kuwait 168.187.43.37 http://168.187.43.37/images/index.html   
http://220.166.80.245/config/ebay_usr/ISAPIdllSignIn&pUserId=&co_partnerId=2&siteid=0&pageType=-1&pa1=&i1=-1&UsingSSL=1&bshowgif=0&favoritenav=&ru=&pp=&errmsg=8.html

Message Text

The text below shows the message content, rendered in a safe way. It does not show images or HTML formatting, but the text is the same as that contained in the phishing email. Each clickable link is shown as a reference. You can see the way the URL is presented in the main body of the text, while the actual URL activated by the link is shown below the main body.


   eBay Item Not Received Dispute Opened for Item #6884608151 [1][eBayLogo.gif]
   
                                            Dear member :
     shadow69696 has informed eBay that they have not yet received item
   [2]9303607451, K - SWISS Verstad, BRAND NEW, UK Size 9.5, Color NAVY.
  There are many reasons why this might have happened. Perhaps the item is
     still in transit, the payment has not yet cleared, or maybe it was
  accidentally sent to the wrong address. In addition, buyers can sometimes
 have unrealistic expectations about how much time it can take for payment,
 postage and delivery. As a result, no action is being taken by eBay at this
                                   time.
   However, it's important to remember that when you sell an item on eBay
 you're agreeing to a contract between you and the buyer. If you don't send
      an item that a buyer has purchased you may be committing fraud.
   Most Item Not Received disputes can be solved with direct communication
between the buyer and seller, and we encourage you to work with your trading
partner to resolve this situation. Click the link below to view and reply to
                  the information submitted by the buyer.
 [3]If you don't respond by 10-Aug-2006 the buyer may elect to escalate this
                                   matter
    Learn more about eBay's [4]Item Not Received or Significantly Not as
                             Described Process.
You can view the status of this dispute at any time by visiting your Dispute
                     Console, which is accessible here:
[5]http://rebulk.ebay.co.uk/ws/eBayISAPI.dll?ViewDisputeConsole&DisputeType=
                                     3
               Thank you for your patience and co-operation.
                                  Regards,
                                    eBay

References

   1. http://www.ebay.co.uk/
   2. http://220.166.80.245/config/ebay_usr/ISAPIdllSignIn&pUserId=&co_partnerId=2&siteid=0&pageType=-1&pa1=&i1=-1&UsingSSL=1&bshowgif=0&favoritenav=&ru=&pp=&errmsg=8.html
   3. http://168.187.43.37/images/index.html
   4. http://220.166.80.245/config/ebay_usr/ISAPIdllSignIn&pUserId=&co_partnerId=2&siteid=0&pageType=-1&pa1=&i1=-1&UsingSSL=1&bshowgif=0&favoritenav=&ru=&pp=&errmsg=8.html
   5. http://220.166.80.245/config/ebay_usr/ISAPIdllSignIn&pUserId=&co_partnerId=2&siteid=0&pageType=-1&pa1=&i1=-1&UsingSSL=1&bshowgif=0&favoritenav=&ru=&pp=&errmsg=8.html

Functions

Advice