Ebay Fraud

[peterchurch]

Hi,
can any one take a look at this mail header and tell me if its come out of a real ebay mailserver? The farther in law got scanked by some hackers and this was one of the headers from a mail he was sent ...

It looks odd to me in comparison to a real one from the fraud department ...

FAKE ????

Return-Path: <[email protected]>
Received: from rly-ye04.mx.aol.com (rly-ye04.mail.aol.com [172.18.204.36]) by air-ye01.mail.aol.com (vx) with ESMTP id MAILINYE13-248427a5e172a9; Thu, 05 May 2005 13:55:51 -0400
Received: from mx40.sjc.ebay.com (mxpool16.ebay.com [66.135.197.22]) by rly-ye04.mx.aol.com (v105.26) with ESMTP id MAILRELAYINYE44-248427a5e172a9; Thu, 05 May 2005 13:55:36 -0400
Received: from rc-v3scgia004 (rc-v3scgia004.smf.ebay.com [10.8.77.64])
by mx40.sjc.ebay.com (8.12.3/8.12.3) with ESMTP id j45HtZbG011892
for <MAIL PROTECTED>; Thu, 5 May 2005 10:55:35 -0700
Date: Thu, 5 May 2005 10:55:35 -0700
Message-ID: <822958465.1115315735772.JavaMail.ebayapp@rc-v3scgia004>
From: [email protected]
To: MAIL PROTECTED
Subject: Change password confirmation
Mime-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
X-eBay-MailTracker: 10028..0.0
X-AOL-IP: 66.135.197.22

REAL !!!

Return-Path: <[email protected]>
Received: from rly-ye03.mx.aol.com (rly-ye03.mail.aol.com [172.18.204.35]) by air-ye04.mail.aol.com (v105.26) with ESMTP id MAILINYE43-23f4278ba072b; Wed, 04 May 2005 08:03:36 -0400
Received: from mx11.sjc.ebay.com (mxpool06.ebay.com [66.135.197.12]) by rly-ye03.mx.aol.com (v105.26) with ESMTP id MAILRELAYINYE35-23f4278ba072b; Wed, 04 May 2005 08:03:19 -0400
Received: from smf-klm-01.corp.ebay.com (smf-klm-01.corp.ebay.com [10.108.116.100])by mx11.sjc.ebay.com (8.12.3/8.12.3) with ESMTP id j44C3JvQ023239for <MAIL PROTECTED>; Wed, 4 May 2005 05:03:19 -0700
Received: from [66.135.215.172] (HELO smf-kas-10.corp.ebay.com)by smf-klm-01.corp.ebay.com (CommuniGate Pro SMTP 4.1.5)with SMTP id 87306519 for [email protected]; Wed, 04 May 2005 05:03:19 -0700
Precedence: bulk
Auto-Submitted: auto-replied
Date: 4/5/2005 1:03:18 pm GMT Daylight time
To: <MAIL PROTECTED>
Subject: Thank You for Your Report (SafeHarbor) (KMM167044136V8180L0KM)
From: eBay Customer Support <[email protected]>
Reply-To: eBay Customer Support <[email protected]>
MIME-Version: 1.0
Content-Type: text/plain; charset = "us-ascii"
Content-Transfer-Encoding: 7bit
X-Mailer: KANA Response 6.5.0.309
Message-ID: <[email protected]>

Thanks

Peter

 

[Madferrit]

I'm no expert, (i hope someone can examine in more detail and reply) but as a rule, i don't reply to any corespondence form ebay telling me that my account is messed up or i need to confirm somethind etc. The same goes with PayPal.

I have noticed some odd looking ebay emails coming into my inbox. Some of which seem to have an enlarged ebay logo at the top, which distorts the actual image. So, my thinking is, that i know my ebay account in active as i log in every other day or so... and therefore i'm sure the ebay servers must be aware of my activities and that my account is still live. If there is a problem i'm certain they would lock me out.. after which i would try to take action.

Bottom line: You have to beware, lots of scams out there and many people are not clued up to how these fraudsters work. Hope you get it all sorted out.

 

[stwat]

Ebay do not email people about changing passwords or asking obout any kind of information like this.

If in doubt pass this on to ebay and ask them if its genuine or not.

Stu

 

[SEM]

I've used a whois or ip checker in the past to track some the dodgy emails.

as stwat says Ebay do not contact you about changing passwords

http://www.millersmiles.co.uk/identitytheft/071704-aw-confirm-ebay-com.php
http://www.fraudwatchinternational.com/fraud_alerts/040103_ebay.htm

 

[peterchurch]

Thats what I thought these were on the head of a password change confirmation...

They seem to be coming out of ebay but ebay confirmed they were fake !!!

all I can do now is watch the account

 

[Thmsshaun]

I have had a few similar emails and just send them all back to ebay. Saying something along the lines of what the f K???

Then I usually just get the standard reply of thnkyou for forwarding to Ebay blah blah blah. Its a shame how common this seems to be.

 

[Spinal]

[email protected]
Usually sends an automated reply with an automated check of the headers...

 

[SilverSaloon]

whatever emails you get thru ebay regarding security, billing, invoicing, passwords, accounts etc - just open a new browser and type in www.ebay.co.uk and then go to "my ebay". if u need to do anything then it will be showing in there anyway.

 

[peterchurch]

Cheers guys

 

[grasmere]

as an aside - I have stopped reporting these spoof emails to ebay and the banks (Lloyds doing the rounds at the moment).

I get an automated response and nothing more. There must be gaggles of people reporting similar messages so I just delete without even reading it all.

You can see the style: "we are checking your security", "we are verifying your account details" etc etc DELETE - gone, next

 

[mobeyone]

i am also a member on a bang & olufsen forum and we have gone into a lot of detail on the scams involving ebay.
Any email requesting information or asking you to be directed to a website to verify your details is a scam.
The email address is usually an alias - you can check this by copying the link or email address - click right and select copy shortcut and then paste into the subject field of an email - tells you the true identity of the link/email
Paypal emails are also very common and use similiar methods
I recently sold a remote which was won by a scammer. He had bidded on numerous high value items within a day of opening an ebay account. Wrote me an email asking to pay via western union - told him where to go!! He asked for my bank details etc and address!!
I spotted one scam once where a cl55 was being sold at £8995 buy it now... he had hijacked an ebay account probably by sending an email asking someone to update their ebay details and then used that account to try and sell an item. Very easily done and ebay is rampant with this. Be very carefull.

 

[AKA CARS]

FORWARD THIS TO [email protected] AND IF ITS FAKE THEY WILL TELL YOU IT HAS HAPPENED TO ME ALL I DO IS FORWARD IT TO [email protected] SO THEY TELL U WHATS FAKE AND WHATS NOT

 

[PJH]

I recently received an e-mail from eBay with the following details

Received: from smf-camp11.smf.ebay.com (66.135.215.240)

Received: from [10.108.161.73] (dooby4-snat.smf.ebay.com [10.108.160.73] (may be forged))
From: "eBay" <[email protected]>
Reply-to: [email protected]

 

[Spinal]

I recently received an e-mail from eBay with the following details

Received: from smf-camp11.smf.ebay.com (66.135.215.240)

Received: from [10.108.161.73] (dooby4-snat.smf.ebay.com [10.108.160.73] (may be forged))
From: "eBay" <[email protected]>
Reply-to: [email protected]

Seems legitimate, the IP address 66.135.215.240 registers too:
Lookup Host Name: smfcamppool11.emailebay.com

Lookup Internet Service Provider (ISP): eBay (or possibly Ebay Inc)
Lookup IP Address belongs to (Organization): eBay (or possibly Ebay Inc)
eBay IP Address Range(s)...66.77.136.0 - 66.77.136.25566.124.78.104 - 66.124.78.11166.125.76.72 - 66.125.76.7966.135.192.0 - 66.135.223.255

So it seems legit... Thing is, many times messages airect you to eBay.COM (American eBay) so if you have only a UK account (eBay.co.uk) be EXTREMELY suspicious of anything from a ebay.com email...

EDIT: on the other hand... 10.108.161.73 comes up with this that seems rather fishy:
10.108.161.73
10.0.0.0 - 10.255.255.255
Internet Assigned Numbers Authority
4676 Admiralty Way, Suite 330
Marina del Rey, CA
US
Internet Corporation for Assigned Names and Number
[email protected]
+1-310-301-5820

 

[Chris Murray]

PayPal will email you as your credit card approaches expiry.. but they ask you to log into your account etc, not with a link. It's slightly different with ebay selling account - especially of they mess up the direct debit (again and again)...

 

[peterchurch]

FORWARD THIS TO [email protected] AND IF ITS FAKE THEY WILL TELL YOU IT HAS HAPPENED TO ME ALL I DO IS FORWARD IT TO [email protected] SO THEY TELL U WHATS FAKE AND WHATS NOT

He did that straight away and was told the original mail was a fake (it was! and a very clever one as well...) The trouble is that he then changed his password and got the confirmation email. That had the same email address as the spoof (the spoof had modded its account address to be [email protected]) and that worried him so he sent the email to spoof and they said it was spoof !!!! (despite the fact that the "spoof" and the real ebay message cam out of the same place!) thus I popped the same two headers here and asked the question

 

[lil.smartie]

We don't bother reporting them either since we reported a Paypal one and they blocked our paypal account for a week! We had to wait for a letter with a security code to be sent so we could re activate it! Very customer un-friendly!

Kate