PSA: New eBay phish in the wild

[unixronin]

There's a new eBay phishing spoof in the wild.  It's not too badly done, and quite convincing at first glance; I'm guessing they're relying on you thinking "This is bullshit!  This idiot hasn't bought anything from me!" and clicking the "Respond" link before you think to actually examine it and see if it's legit.  Social engineering.  If you do stop to examine it, there's several flaws.

• "Your registered name is included to show this message originated from eBay."  Well, actually, now that you mention it ... no, it isn't.  Not anywhere in the message.  "Oops."
• That "Respond" button doesn't go to an eBay URL.  As a matter of fact, it goes to 62.193.212.56, which is vds-381430.amen-pro.com, registered in Paris, France.
• Oh, and all the links in the right-side sidebars, and the "learn more" link?  They aren't.  Links, that is.  They're faked and don't connect to anything.  There's no anchor tag.  Mouse over them and see.
• And did you notice that the "Thank you for using eBay" URL is to ebay.com, but all the other eBay links on the page are ebay.co.uk links?  A little bit inconsistent there, neh?
• And of course, there's the minor problem that it doesn't come from an eBay address, and isn't even convincingly spoofed.  Mine came from "eBay <qezzobvasze@pisem.net>".  The X-mailer header is oddly curious, too:  "pig pen 3095 guardian angels"
• And then there's the actual, non-HTML message body:  "When over marzipan takes a coffee break, cough syrup related to parking lot starts reminiscing about lost glory.When behind ski lodge procrastinates, from movie theater gets stinking drunk.toothaches remain nearest.pocket living with graduated cylinder reads a magazine, but bubble bath from short order cook learn a hard lesson from about pine cone."  Whoa!  Lay off the glue, dude.

Here it is, in all its phishy stench:

---

eBay sent this message to you. Your registered name is included to show this message originated from eBay. Learn more. Question from eBay Member -- Respond Now eBay sent this message on behalf of an eBay member via My Messages. Responses sent using email will go to the eBay member directly and will include your email address. Click the Respond Now button below to send your response via My Messages (your email address will not be included).

Question from jell     I have not received any item from you, what happend, I've sent you the money, now were is my item ? If you don't Respond Now I will contact ebay and I will report you, I will also go to the police !Lett me know, I am not a fool !  Thank you ! Respond to this question in My Messages. Thank you for using eBay http://www.ebay.com/ Marketplace Safety Tip If this message is an offer to sell an item without winning it on the eBay Web site (including Second Chance Offers sent through My Messages) please do not respond to the sender. These external transactions are unsafe and not covered by eBay purchase protection programmes. Never pay for your eBay item through instant wire transfer services such as Western Union or MoneyGram. These payment methods are unsafe when paying someone you do not know. Is this email inappropriate? Does it breach eBay policy? Help protect the community by reporting it. Learn how you can protect yourself from spoof (fake) emails at: http://pages.ebay.co.uk/education/spooftutorial This eBay notice was sent to you on behalf of another eBay member through the eBay platform and in accordance with our Privacy Policy. If you would like to receive this email in text format, change your notification preferences. See our Privacy Policy and User Agreement if you have questions about eBay's communication policies. Privacy Policy: http://pages.ebay.co.uk/help/policies/privacy-policy.html User Agreement: http://pages.ebay.co.uk/help/policies/user-agreement.html Copyright © 2005 eBay, Inc. All Rights Reserved. Designated trademarks and brands are the property of their respective owners. eBay and the eBay logo are registered trademarks or trademarks of eBay, Inc.