phishing websites? Fake websites
from AntBlog701

phishing websites? Fake websites

A phishing website is where you are sent to page that looks like an official site, but the site really is just designed to steal personal data.

Today, I received one fake email said from eBay.com (the email was sent from IP address 218.154.70.10) with title "Your account at eBay has been suspended".

Without a thought, I knew it was a fake and wanting to steal my data.

So I decided to investigate it.

screenshot of the email

The email asked me to click
http://signin.ebay.com/aw-cgi/eBayISAPI.dll?Verify
But if I click that the actual link would be
http://signin_ebay_com_account.rndsystems.co.kr:7308/ebay.htm
BINGO

screenshot of the raw source with highlighted on the link

The real website is rndsystems.co.kr with subdomain signin_ebay_com_account and using an unusual port number 7308. (the usual web pages use port 80)

Now, I am pretty sure it wanted to steal my credit card number, I decided to make a further investigation.

So I went to that URL (with port number 7308), exact link.
And I got following screen...

I decided to use a fake account, and BINGO, it works, as expected.

Let's see what's inside...

Asking me my alternative password?

And as expected, asking me my credit card and even bank card number?

So, if I use my real eBay account information with real password (and all the information they asked for), it is not hard to figure out what would happen.

1. They will use my supplied password to change my password in eBay, and hence, as indicated in the email, "until we can verify your identify no further access to your account will be allowed".

2. you know what will happened to my credit card and even my bank accounts.

My recommendation about those worrying emails... check the raw format (source code OR view source), and look careful, you will see the actual problem.

Additional Information:
When I register an account with eBay, eBay does not ask for my credit card number or bank account number. It is clearly a phishing website.

My advice: Check the source of any questionable emails.

SillyDog701 Message Centre has a discussion on this issue.