New Spam Scheme?

[joseph_liu]

Hey guys--

Can you do me a favor and let me know if the message headers from this email are forged?

I got an email claiming to be from Ebay saying that they need me to verify my username/password. I assume its a spam scheme, but I'm not sure. Can you decifer anthing from these headers?


Return-Path: <suspension@ebay.com>
Received: from frontend2.messagingengine.com (frontend2.internal [10.202.2.151])
by server2.fastmail.fm (Cyrus v2.2.3) with LMTP; Tue, 24 Feb 2004 21:53:01 -0500
X-Sieve: CMU Sieve 2.2
Subject: {SPAM 06.9} TKO NOTICE: Please verify your identity
X-Spam-score: 6.9
X-Spam: spam
X-Spam-hits: BAYES_00, FRONTPAGE, FVGT_u_HAS_2LETTERFLDR, HTML_60_70,
HTML_FONTCOLOR_RED, HTML_MESSAGE, MIME_HTML_ONLY, NORMAL_HTTP_TO_IP,
NO_REAL_NAME, USERPASS
X-Resolved-to: <me>@xsmail.com
X-Delivered-to: <me>@xsmail.com
X-Mail-from: suspension@ebay.com
Received: from jet11.hasweb.com (jet11.hasweb.com [66.193.231.77])
by smtp.us.messagingengine.com (Postfix) with ESMTP id 9515A34452
for <<me>@xsmail.com>; Tue, 24 Feb 2004 21:52:56 -0500 (EST)
Received: from nobody by jet11.hasweb.com with local (Exim 4.24)
id 1AvpAO-0005uo-Pw
for <me>@xsmail.com; Tue, 24 Feb 2004 21:52:56 -0500
To: <me>@xsmail.com
X-Spam-orig-subject: TKO NOTICE: Please verify your identity
MIME-Version: 1.0
Content-type: text/html; charset=iso-8859-1
From: suspension@ebay.com
Message-Id: <E1AvpAO-0005uo-Pw@jet11.hasweb.com>
Date: Tue, 24 Feb 2004 21:52:56 -0500
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - jet11.hasweb.com
X-AntiAbuse: Original Domain - xsmail.com
X-AntiAbuse: Originator/Caller UID/GID - [99 99] / [47 12]
X-AntiAbuse: Sender Address Domain - ebay.com

[541]

I got the same email a couple of months ago. I think it's bogus.

[fhapgood]

Originally posted by joseph_liu
Hey guys--

Can you do me a favor and let me know if the message headers from this email are forged?

It's a famous and exceptionally vicious identity theft scam with lots of victims. Google under 'phishing' for more.

[SusanUKF]

It is terrible though...always another scam happenning every day... Susan.

[mcowger]

See this line:

Received: from jet11.hasweb.com (jet11.hasweb.com [66.193.231.77])

thats where it orginiated....thats not ebay, so its a scam.

[joseph_liu]

Thanks for all your comments everybody! That makes me feel better about just deleting it!

Thanks again,

joseph

[JRobert]

No reputable organization would request your personal information by return open e-mail, and most post this prominently on the site when you register.

It's easy to check it out though: Don't reply to the message, but use their well known web address (which you probably bookmarked when you registered with them) to log into your account and examine the details - i.e., log in the normal way you would to do business with them. Anything unusual? Any trouble logging in? Any flags or messages requesting you to fix something or to contact them? If not (and 99 times out of 100, there won't be) the message was almost certainly a phish.

-jeff-

[fhapgood]

Originally posted by JRobert
No reputable organization would request your personal information by return open e-mail, and most post this prominently on the site when you register.

It's easy to check it out though ...

There's a lot easier way than that: check to see if it is addressed to you personally. If it is addressed to 'customer' go no further.

[jolycu]

If you forward it to Ebay, they will try to track the low-lifes down. Go here for information from Ebay about account identity theft and how to know if something came from Ebay. The last paragraph on the page has a link to the form to use to send it to them.

[joseph_liu]

Thanks again for all the help guys...

I think this might be a disgruntled customer trying to get back at me for his mistake.

Thanks,

joseph

[Mal]

Thanks for the thread and a very useful warning.

I've just followed fhapgood's advice and Google'd for phishing. Had a most enlightening time reading about this email-initialised scam.