lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
From: se_cur_ity at (Morning Wood)
Subject: EBAY SPOOF  "Your eBay account Registration Suspension"

Ebay spoof making the rounds....

headers below...

------------------------ snip -----------------------------------

----Original Message Follows----
From: eBay custumers service <>
Subject: Your eBay account Registration Suspension
Date: 25 Nov 2003 15:40:20 -0000
MIME-Version: 1.0
Received: from ([]) by with Microsoft SMTPSVC(5.0.2195.6713); Tue, 25 Nov 2003 
07:45:32 -0800
Received: (qmail 1644 invoked by uid 99); 25 Nov 2003 15:40:20 -0000
X-Message-Info: 6sSXyD95QpXJES60C4uZZPRQIObKA87K
Message-ID: <>
X-OriginalArrivalTime: 25 Nov 2003 15:45:33.0205 (UTC) 

-------------------- snip ----------------------------------

digging a bit we see...

visible url:

real url:
is running a FTP ( wu-2.6.2(1), SSH, HTTPD ( apache 1.3.26 ) and a HTTPS

the IP is that of ( not ebay ) is in Manila, Phillipines (PH ccTLD)

looking at the source we see...

----- snip ------

Auto Maximize Window Script- By Nick Lowe (
For full source code, 100's more free DHTML scripts, and Terms Of Use

------- snip ------

<input type="hidden" name="MfcISAPICommand" 
  <input type="hidden" name="cardselected" value="1">
  <input type="hidden" name="cardnumber" value="4190087719349127">
  <input type="hidden" name="expiryday" value="0">
  <input type="hidden" name="expirymonth" value="10">
  <input type="hidden" name="expiryyear" value="2006">
  <input type="hidden" name="cardholdername" value="Leigh A Wadden">
  <input type="hidden" name="address12" value="3305 EP True Pkwy, Unit 801">
  <input type="hidden" name="address2" value="">
  <input type="hidden" name="city2" value="West Des Moines">
  <input type="hidden" name="state" value="IA">
  <input type="hidden" name="zip2" value="50265">
  <input type="hidden" name="country" value="United States">
  <input type="hidden" name="usage" value="1">

----- snip -------

which is very odd indeed.

Donnie Werner

Secur it today®

Groove on the latest from the hot new rock groups!  Get downloads, videos, 
and more here.
-------------- next part --------------
An embedded message was scrubbed...
From: eBay custumers service <>
Subject: Your eBay account Registration Suspension
Date: 25 Nov 2003 15:40:20 -0000
Size: 8337

Powered by blists - more mailing lists