The second bogus eBay sign page by email today ...
This phishing scam is similar to an earlier eBay
spoof email of today, but with different graphics (using eBay's new design
and layout) anda different domain involved in capturing submitted information.
In the first report, the form data would be forwarded to the
perpetrators using a PHP script located at http://220.127.116.11/... which resolves
to web space operated by Alabanza in the USA. In the second report on the 31st
March, a different URL was handling the form data - http://18.104.22.168/... which
resolves to web space provided by fastdns.net in the USA. The 24th May version
uses http://ultimatetrue.com/f.php to capture submitted data - resolves to a
Yahoo user's web space (Geocities). The 27th May version sent the data to http://lidarilidari.com/f.php which also resolves to Geocities web space and sent on to email@example.com.
If you have received this email, please remember that it is very
common for these email scams to be redistributed at a later date with only slightly
different content or the same but with the fake page(s) hosted by a different
provider. Also, once you have received one of these hoaxes, it is also common
place to receive at least another one and usually a day or two after the first,
although not necessarily from the same apparent sender.
The Spoof Email ...