Search our Spoof Library...
Another Spoof Email and Phishing Scam report by - click this image to go to our home page.

TKO NOTICE: Pay your fees to
27th May 2004

please forward any scams you've received to


Report Summary
Date Reported
23rd April & 27th May 2004
Apparent Sender
Return Address
TKO NOTICE: Pay your fees to
disguised link leads to bogus web content
Bogus Web Content?
URL of web content
23rd April version -
27th may version -

1. In the first report this spoof links to a page whose URL has been constructed to appear to be a genuine eBay domain. If you must visit a site from a link in an email, look carefully at the URL fo the page before proceeding.


Spoofed eBay email links to a forged page which has a domain name similar to ...


This convincing looking eBay email is a spoof which links to a forged sign in page. The URL of the forged eBay sign in page is a concern here, and relies on users' understanding how domain names can be constructed...

In the first report the URL shows and you must look for the actual domain which is (highlighted in bold), anything to the left of that is there just to give the impression that it is an domain which it is not. The part is simply a sub domain of and this method of creating URLs which look genuine has been often used in these phishing scams. resolves to a Yahoo users' web space and any information submitted is captured by a script located on the same server as the forged sign in page.

In the second report, we see a completely different URL in use - - which yielded some unusual results during tracing - its nameservers are set as and they are assigned to an IP address ( owned by Whilst the site would not tracert with this information, it may well be that the perpetrators set the domain's DNS settings like this just to add a sense of authenticity in a DNS lookup. Help stop phishing dot com is a parked domain - not an active site and parked at who handle the whois info for it - and it would appear that these settings have been created in the local DNS zone for the domain (which is normally only available for editing in reseller hosting packages).

If you have received this email, please remember that it is very common for these email scams to be redistributed at a later date with only slightly different content or the same but with the fake page(s) hosted by a different provider. Also, once you have received one of these hoaxes, it is also common place to receive at least another one and usually a day or two after the first, although not necessarily from the same apparent sender.


The Spoof Email ...

TKO NOTICE: Pay your fees to spoofed email.


The bogus web page ...

TKO NOTICE: Pay your fees to forged sign in page.


Stay informed of the latest Spoof Email Phishing Scams with either of our FREE alert services...

Stay informed of the latest Spoof Email Phishing Scams with either of our FREE alert services...

Email Alerts
Add your email address to our email alert service...

Privacy Policy

RSS News Feed
Tap into our Scam Alert service using your News Reader or Aggregator (including My Yahoo!).
Scam Alert News Feed

You can even put the latest alerts on your own web site.

Click here to learn more about RSS News Feeds and our Scam Alert Service!

Resources links - use one of the links below to access more information on Spoof Email & Phishing Scams.

Library of Spoof Email Phishing Scams

Brief guide to Phishing

Full article on spoof email scams

Spoof URL Checker

Link Checker

Browser URL Spoofing Vulnerability Check

Latest browser bug aids Phishing Scams - beware!

Destinations - other resources available on the web site.

Click the arrow to return to previous page



Book Terminology

How to identify a first edition book

Auction Watcher

List of the main Auction Sites world wide