Ebayb email (Fake?) Account Investigation Important Notice

[xfilekr]

Is this a scam? it came from investigation@ebay.com
Account Investigation Important Notice

Dear madseason83 (uturnfilms@atlanticbb.net),

We have strong reason to believe that your eBay account has been recently compromised and it could be used by a third party without your authorization. In order to prevent any fraudulent activity from occurring we are required to open an investigation into this matter. To speed up this process, you are required to verify your eBay informations by following the link below.

http://signin.ebay.com/eBayISAPI.dll?Signln&UserID=madseason83

(To complete the verification process you must fill in all the required fields)

Please Note - If your account informations are not updated within the next 72 hours, then we will assume this account is fraudulent and will be suspended. We apologize for this inconvenience, but the purpose of this verification is to ensure that your eBay account has not been fraudulently used and to combat fraud.

We appreciate your support and understanding, as we work together to keep eBay a safe place to trade.

Thank you for your patience and attention in this important matter.

Regards,

Ian
eBay SafeHarbor
Investigations Team

Do not respond to this e-mail, as your reply will not be received.

Copyright 2004 eBay Inc. All Rights Reserved.
Designated trademarks and brands are the property of their respective owners.
eBay and the eBay logo are trademarks of eBay Inc. is located at Hamilton Avenue, San Jose, CA 95125

[spankasmurf]

Looks like a phisher email.

Is there a ebay customer support line that you can call? or try going to the ebay site WITHOUT clicking on that link in the email.

[edreath]

Total scam. I got the same thing 3 months ago and forwarded it to Ebay. Delete it or forward it.

[xfilekr]

Thanks guys, usually I can find something that proves its fake but this one looked pretty real.

[marty888]

Simply forward to spoof@ebay.com


NEVER - repeat <b><i>NEVER</i></b> follow an email link to provide sensitive information. No legit company will ever ask that you do.

[devynal]

I've received a lot of these emails, and just hover your mouse over the hyperlink - it'll show something totally different, usually an IP address, thus totally fake.

[resinrats]

I guess you could put in fake info in the form:
Password: biteme
Email Address: ebayscammersarenerds@heyretard.com

[eau]

Total scam. I received similar emails at an email address of mine that I never used to sign up with those companies.

[fourizonly]

eBay always address you by your full name. I received similar e-mail a couple of weeks ago and reported to eBay.

[Nabalab]

I got the e-mail today also, and forwarded it to spoof@ebay.com

They replied back saying that the e-mail was indeed a spoof, and they would investigate.

I decided to look into the e-mail (I didn't click on the links!), and from the header, I saw the IP is - 168.226.90.133

When I typed that IP into networksolutions.com, this is what came up -

OrgName: Latin American and Caribbean IP address Regional Registry
OrgID: LACNIC
Address: Potosi 1517
City: Montevideo
StateProv:
PostalCode: 11500
Country: UY

Ebay's IP is 66.135.215.134 (they probably have other IP's too)

OrgName: eBay, Inc
OrgID: EBAY
Address: 2145 Hamilton Ave
City: San Jose
StateProv: CA
PostalCode: 95008
Country: US

Nothing too trivial !!

[shill66]

Originally posted by xfilekr
Thanks guys, usually I can find something that proves its fake but this one looked pretty real.

Nah. Look at these:
"you are required to verify your eBay informations by "
"Please Note - If your account informations are not updated"
"eBay and the eBay logo are trademarks of eBay Inc. is located at Hamilton "

[gcbrowni]

Once upon a time North America 'owned' all of the IP addresses. When the Europeans moaned that the net was too American-biased, we gave RIPE, their version of ARIN, some IP's. Then the Asians complained so we gave APNIC some addresses. Then the rest of the western hemishpere moaned, so we gave some to LATNIC. Recently the Africans have complained; AfriNIC should be up soon.

In essence, each of the groups has a certain range of IP's they can assign to companies & groups in their region, who then further assig the addresses to end-users. Typing the (phishing) IP into ARIN revels that the address block it assigned out of LATNIC. A quick trip to the LATNIC site reveals a telco in Argentina.

inetnum: 168.226/16
status: assigned
owner: Telefonica de Argentina
ownerid: AR-TEAR7-LACNIC
responsible: Marcelo A. Muņoz
address: Defensa, 390, Piso 5
address: 1065 - Buenos Aires - CF
country: AR
phone: +54 11 4-3335509 []
owner-c: TEA
tech-c: TEA
inetrev: 168.226/16
nserver: DNS1.INTERNET-MRSE-SOLUTIONS.COM
nsstat: 20040906 AA
nslastaa: 20040906
nserver: DNS2.INTERNET-MRSE-SOLUTIONS.COM
nsstat: 20040906 AA
nslastaa: 20040906
created: 19940822
changed: 20010927

nic-hdl: TEA
person: TELEFONICA DE ARGENTINA
e-mail: tasamail@TELEFONICA.COM.AR
address: H. Yrigoyen 1556 - 8th floor, 1556,
address: 1089 - Capital Federal - BA
country: AR
phone: +54 11 4332-2364 []
created: 20030618
changed: 20030915