eBay users who add a new email address to their account are being targetted by phishers...

The site user who reported this spoof email was very concerned ... not only had she added a new email address to her eBay account in the last few days, she had also already confirmed it a few hours later, and then she received this spoof eBay email a few days later. While we have no means of ascertaining that this email is in direct response to the addition of the email address, but the coincidence is quite remarkable.

The URL shows that the page is not located on eBay's servers, in fact aplus.net is a US hosting company which rents server space from Abacus America Inc. Given that the page has not been removed quickly, we can only suppose that the bogus content may well be being used selectively to ensnare victims who have recently added an email address to their eBay account.

The first bogus page, which opens when you use the disguised link in the email, is followed by a bogus sign in page, and then a redirection to the genuine ebay.com sign in page. Any data entered into the bogus pages, is captured using code and script located at the same URL.

If you have received this email, please remember that it is very common for these email scams to be redistributed at a later date with only slightly different content or the same but with the fake page(s) hosted by a different provider. Also, once you have received one of these hoaxes, it is also common place to receive at least another one and usually a day or two after the first, although not necessarily from the same apparent sender.

The Spoof Email ...

Dear customer,

PLEASE READ THIS MESSAGE IN ORDER TO CONFIRM YOUR E-MAIL ADDRESS!

YOU MUST ENTER THE CONFIRMATION CODE CONTAINED IN THIS MESSAGE IN
OUR CONFIRMATION FORM IN ORDER TO CONFIRM LIKE THIS E-MAIL IS ATTACHED

TO YOUR E-BAY ACCOUNT .

Please access the following form to confirm your e-mail:

  http://cgi3.ebay.com/aw-cgi/eBayISAPI.dll?ConfirmEmailAddress&bpuser=0

You will be asked for the Confirmation Code, which you
must type EXACTLY as it appears below:

Confirmation code:  14349

Confirmation of E-mail address request was made from:
    IP Address:    66.135.192.87
    ISP Host:    ebay.com

Thank you for using eBay!
http://www.ebay.com

The first bogus web page ...