New Phish - Warning

Web | 2/1/06

[pabianice]

Got a new, sophisticated phish yesterday:

===========================================

eBay sent this message!

Your registered name is included to show this message originated from eBay. Learn more.

Question from eBay Member -- Respond Now

eBay sent this message on behalf of an eBay member via My Messages. Responses sent using email will not reach the eBay member. Use the Respond Now button below to respond to this message.

Question from user

We are contacting you about the following item: Toshiba rd-xs54 dvd Recorder w 250 gig hard drive (#5856334211)

The seller, lkaroll tells us you have mutually agreed not to complete the transaction (e.g. because you returned or are returning the item for a refund or because there was a misunderstanding) and has requested a credit for their eBay fees.

Please respond by 28-Feb-2006 so eBay knows whether you have agreed.

Best Regards.

Respond to this question in My Messages.

Thank you for using eBay http://www.ebay.com/

=================================================

Clicking on the mail brings you to a page that looks like the ebay sign-in page, asking you for your member ID and password. However, when you enter your password, the page does not, as usual, finish entering it and then automatically enter your password asa is the case with ebay. Strange. I hesitated.

I did not remember buying or bidding on this item. A check of the entire header using "options" revealed the following header:

Return-Path: pwrchute@pslx.org Received: from mxsf22.cluster1.charter.net ([10.20.201.222]) by mtai02.charter.net (InterMail vM.6.01.05.04 201-2131-123-105-20051025) with ESMTP id 20060131234749.MTFY24101.mtai02.charter.net@mxsf22.cluster1.charter.net for ; Tue, 31 Jan 2006 18:47:49 -0500 Received: from mxip11a.cluster1.charter.net (mxip11a.cluster1.charter.net [209.225.28.141]) by mxsf22.cluster1.charter.net (8.12.11/8.12.11) with ESMTP id k0VNlhhH007670 for ; Tue, 31 Jan 2006 18:47:49 -0500 Received: from www.pslx.org (HELO pslx.org) (202.32.143.132) by mxip11a.cluster1.charter.net with SMTP; 31 Jan 2006 18:47:39 -0500 X-IronPort-AV: i="4.01,242,1136178000"; d="scan'208"; a="2085161982:sNHT49858556" Received: (qmail 26983 invoked by uid 518); 1 Feb 2006 09:04:50 +0900 Date: 1 Feb 2006 09:04:50 +0900 Message-ID: 20060201000450.26980.qmail@pslx.org To: Subject: Message from eBay Member From: "member@ebay.com" member@ebay.com Content-Type: text/html

This definitely does not look like a real message from ebay.

Beware.

[Diana in Wisconsin]

"Should they be reported to Homeland Security or to the FBI?"

I just report them back to Amazon. They have a team of highly trained hackers on their trail, LOL!

Otherwise, I think the citizenry can handle them. A dark rain-wet alley, a broken beer bottle...you know the drill. ;)