jlw
Rangefinder camera pedant
I've currently got a non-RF item listed for sale on eBay, and today I got a "My Messages" alert about a question from a buyer.
Not trusting links in ANY emails, I logged in to eBay and checked My Messages from the web page. Turns out the email was legit - I did have a new question.
The question was: "Is this item the same one listed on [link to URL sounding vaguely as if it might be a foreign eBay page]?"
Well, I knew I hadn't listed my item on any eBay flavors except the standard U.S. one. Aha, I thought, somebody must have hijacked my lovely item photos and beautifully-written description to use for a different listing. I clicked the link to go look at it... and was presented with an eBay-looking login screen.
Yeah, right, like I'm going to do THAT. The screen had Cyrillic characters at the bottom, suggesting it was trying to simulate a Russian eBay site. I viewed the source code and found the CGI targeted by the form's Submit button -- its URL had "ebay" in its name, but its form didn't look like a real eBay server, and it ended in ".ru", again suggesting a Russian origin.
So, I'm guessing this is just a new bit of social engineering aimed at getting you to give your eBay user ID and password to a Russian phishmonger. The new wrinkles are (1) using a legitimate My Messages message to feed the bait to the seller, and (2) using a question about a suspected duplicate item to pique the seller's interest.
Note that since the message contained no real details about my item (it just asked "Is your item the same as the one listed at...") somebody could have trolled through thousands of listings posting the exact same question, hoping to catch a few phish on their fake login server.
Yes, I forwarded the original message to spoof@ebay.com, so with luck maybe they'll delete all the questions originating from this user ID (which probably was phished as well.)
Not trusting links in ANY emails, I logged in to eBay and checked My Messages from the web page. Turns out the email was legit - I did have a new question.
The question was: "Is this item the same one listed on [link to URL sounding vaguely as if it might be a foreign eBay page]?"
Well, I knew I hadn't listed my item on any eBay flavors except the standard U.S. one. Aha, I thought, somebody must have hijacked my lovely item photos and beautifully-written description to use for a different listing. I clicked the link to go look at it... and was presented with an eBay-looking login screen.
Yeah, right, like I'm going to do THAT. The screen had Cyrillic characters at the bottom, suggesting it was trying to simulate a Russian eBay site. I viewed the source code and found the CGI targeted by the form's Submit button -- its URL had "ebay" in its name, but its form didn't look like a real eBay server, and it ended in ".ru", again suggesting a Russian origin.
So, I'm guessing this is just a new bit of social engineering aimed at getting you to give your eBay user ID and password to a Russian phishmonger. The new wrinkles are (1) using a legitimate My Messages message to feed the bait to the seller, and (2) using a question about a suspected duplicate item to pique the seller's interest.
Note that since the message contained no real details about my item (it just asked "Is your item the same as the one listed at...") somebody could have trolled through thousands of listings posting the exact same question, hoping to catch a few phish on their fake login server.
Yes, I forwarded the original message to spoof@ebay.com, so with luck maybe they'll delete all the questions originating from this user ID (which probably was phished as well.)