Nanuq Posted September 23, 2007 Report Share Posted September 23, 2007 I have been, in the last 24 hours, the target of a VERY clever scam on the internet. I received notice from Ebay that a claim has been opened against me for non-payment of a specific, expensive item over the last few weeks. The email headers looked to be genuine and the links in the email took me to what appeared to be Ebay sites for proving that I had indeed paid for the item. I admit I did not deobfuscate the URLs to IP addresses before I clicked. My bad. Subsequent contact with the seller reveals he did not open a claim against me. People, I do electronic security for a living, I deal with the intricacies of the web and all forms of electronic communications in ways I cannot even divulge. And this took me for a ride. It was clever and extremely well prepared. The only places I have posted photos of my purchase are here, RWG1 and Timezone. The only link back to my purchase is by the url to the original auction photos, which *could* lead to the seller, which could lead to the buyer, which could lead to me. The scammers are active on one of those three sites. I took steps last night to isolate my business dealings on the web, changed ALL passwords, and verified this morning there have been no intrusions. However my server has been slammed by access attempts from overseas. I am logging this. Gents and ladies, PROTECT YOURSELVES. There are some extremely sophisticated persons attempting financial gain through scams and this last one took me by surprise... and that's a very hard thing to do. PROTECT YOURSELVES. It's time to change all sensitive passwords and to monitor your finances for a few weeks. In a week change the passwords again. Cheers, -Nanuq Quote Link to comment Share on other sites More sharing options...
Chronus Posted September 23, 2007 Report Share Posted September 23, 2007 Thanks for the info, and hope things have turned out safe for you. Quote Link to comment Share on other sites More sharing options...
Stephane Posted September 23, 2007 Report Share Posted September 23, 2007 Wow, that is a coincidence. I changed all my PWs since a week now... Quote Link to comment Share on other sites More sharing options...
KB Posted September 23, 2007 Report Share Posted September 23, 2007 Indeed to this end I never click any links to eBay, PayPal, my Online Banking etc etc...... If I get anything that looks official I always close it and go through my normal log in to the site in question, if I then find nothing in relation to the topic I go back and send the whole E-mail to the sites spoof or security site, yes I know many feel that they don't follow it up but in fact if they receive enough complaints it will be looked into and they do catch these people from time to time. Ken Quote Link to comment Share on other sites More sharing options...
abat Posted September 23, 2007 Report Share Posted September 23, 2007 Indeed to this end I never click any links to eBay, PayPal, my Online Banking etc etc...... Me neither, I always type paypal, ebay, online banking etc rather than click links. Quote Link to comment Share on other sites More sharing options...
TeeJay Posted September 23, 2007 Report Share Posted September 23, 2007 There are some scary and sophisticated people on the net. I've seen people have private details looked up and posted for other's amusement, IPs traced so someone can then work out where a person works and post pictures of that online... Having seen that, nothing on the net surprises me anymore... Thanks for bringing this to our attention Quote Link to comment Share on other sites More sharing options...
rkdk Posted September 23, 2007 Report Share Posted September 23, 2007 i must admit i love writing fake emails, and passwords that make out swears when i get these phishing mails. For instance my last paypal scam login was whatamianidiot@kissmyass.com and my pass was youdirtyrottenscammer i really enjoy these small moments of retaliation. I can just see the face of the nigerian hustler getting my precious login details, hi hi. Quote Link to comment Share on other sites More sharing options...
JJFlash Posted September 23, 2007 Report Share Posted September 23, 2007 If I get anything that looks official I always close it and go through my normal log in to the site in question, if I then find nothing in relation to the topic I go back and send the whole E-mail to the sites spoof or security site, yes I know many feel that they don't follow it up but in fact if they receive enough complaints it will be looked into and they do catch these people from time to time. Ken This is the correct way to deal with emails that involve any type of money matters. Quote Link to comment Share on other sites More sharing options...
Pugwash Posted September 23, 2007 Report Share Posted September 23, 2007 i really enjoy these small moments of retaliation. I can just see the face of the nigerian hustler getting my precious login details, hi hi. Sorry, it's all automated. No-one ever gets to see your joke unless it validates. Quote Link to comment Share on other sites More sharing options...
Pugwash Posted September 23, 2007 Report Share Posted September 23, 2007 When you "mouse over" a URL the direction for the link usually appears in your status bar... that should be a nominative, not a numeric. In this case it WAS nominative, it had a word I won't divulge prepended to the word "ebay" followed by .com Very clever indeed. Someone registered some domains to spoof the appearance of ebay even by DNS lookups. If you're quick, you can get a few white hats to take the site down. Nothing says scammer like a DDoS or bandwidth hogger. Another method we ... um, I've heard about, is writing a perl-script that posts seemingly real data to the site every 3 seconds. If they have your address in a database, bury it in trash. Quote Link to comment Share on other sites More sharing options...
rkdk Posted September 23, 2007 Report Share Posted September 23, 2007 Sorry, it's all automated. No-one ever gets to see your joke unless it validates. dammit. well it was fun while it lasted Quote Link to comment Share on other sites More sharing options...
Dizzy Posted September 24, 2007 Report Share Posted September 24, 2007 i just recently changed all my passwords again. Im always getting those spoof emails but this one sounds serious... good find nanuq, I'll for sure keep my eyes open. Lonnie Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.