Become a part of the TranceAddict community!Frequently Asked Questions - Please read this if you haven'tSearch the forums
TranceAddict Forums > Main Forums > Chill Out Room > eBay Phishing Scams..for those that aren't aware.
  Last Thread   Next Thread
Share
Author
Thread    Post A Reply
placebo
501xx



Registered: Jun 2003
Location: Somewhere
eBay Phishing Scams..for those that aren't aware.

Hello, I'm sure most people on this board are aware of eBay/PayPal phishing scams (among other companies), however I know alot of people are uninfored, I personally know some people have actually fallen for these. I get them on a daily basis, probably about 10+ per day. Anyways, here are some screen shots of one I got today. This one is pretty obvious, due to alot of factors. For one, when does eBay use exclamation points in the subjects of emails? And the URL is a dead giveaway of a scam.





















WHOIS LOOKUP
Here is the whois info for the domain:

quote:

WHOIS results for 63.195.107.221
Generated by www.DNSstuff.com

Location: United States [City: Plano, Texas]

NOTE: More information appears to be available at NET-63-195-107-216-1.

Using 0 day old cached answer (or, you can get fresh results).
Hiding E-mail address (you can get results with the E-mail address).

SBC Internet Services SBCIS-SIS80 (NET-63-192-0-0-1)
63.192.0.0 - 63.207.255.255
Sameh Michaiel-040804134921 SBC06319510721629040804134925 (NET-63-195-107-216-1)
63.195.107.216 - 63.195.107.223

# ARIN WHOIS database, last updated 2006-06-28 19:10
# Enter ? for additional hints on searching ARIN's WHOIS database.


I went to the root IP address of the site:

http://63.195.107.221/wioteladmin/

Some page called "wiotel". I googled that page and came back with the actual wiotel site, then I did a WHOIS lookup on that. Registered to the same guy, but different locations. Also, on the wiotel admin page, a link references "tools.wiotel.com" if you ping that, it comes back with the same IP as the phishing site, but if you ping www.wiotel.com, you get a different IP.

quote:

Registrant:
Wiotel

4229 Littelworth way
San Jose, California 95135
United States

Registered through: GoDaddy.com, Inc. (http://www.godaddy.com)
Domain Name: WIOTEL.COM
Created on: 01-Dec-02
Expires on: 01-Dec-06
Last Updated on: 22-May-06

Administrative Contact:
Michaiel, Sameh [email protected]
Wiotel
4229 Littelworth way
San Jose, California 95135
United States
408 238 2211

Technical Contact:
Michaiel, Sameh [email protected]
Wiotel
4229 Littelworth way
San Jose, California 95135
United States
408 238 2211

Domain servers in listed order:
NS7.ZONEEDIT.COM
NS14.ZONEEDIT.COM


Registry Status: REGISTRAR-LOCK
Registry Status: clientDeleteProhibited
Registry Status: clientRenewProhibited
Registry Status: clientTransferProhibited
Registry Status: clientUpdateProhibited


Looks like the same guy has the eBay phishing site on his server. Doesn't mean he set it up, someone else could have hijacked his server and put that on there. Especially since that IP is in Plano, TX and his domain is in San Jose, CA.


___________________
"We did not choose to become robots. There was an accident in our studio. We were working on our sampler, and at exactly 9:09 a.m. on September 9, 1999, it exploded. When we regained consciousness, we discovered that we had become robots."

Last edited by placebo on Jun-29-2006 at 15:45

Old Post Jun-29-2006 14:20  United States
Click Here to See the Profile for placebo Click here to Send placebo a Private Message Add placebo to your buddy list Report this Post Reply w/Quote Edit/Delete Message
Sunsnail
Global Moderator



Registered: Sep 2004
Location:

lol funny. I too noticed the exclamation points... This would work on someone like my grandmother..

Old Post Jun-29-2006 14:25 
Click Here to See the Profile for Sunsnail Click here to Send Sunsnail a Private Message Add Sunsnail to your buddy list Report this Post Reply w/Quote Edit/Delete Message
KilldaDJ
birth.school.trance.death



Registered: Sep 2001
Location: tranceaddict wants to know your location

ya rly


___________________


Found Atlantis - Mixography [mix archive/mokumentary/my soul]?
i writed a song.

Old Post Jun-29-2006 14:27 
Click Here to See the Profile for KilldaDJ Click here to Send KilldaDJ a Private Message Visit KilldaDJ's homepage! Add KilldaDJ to your buddy list Report this Post Reply w/Quote Edit/Delete Message
placebo
501xx



Registered: Jun 2003
Location: Somewhere

When you go to the root URL it's even better:

http://63.195.107.221/wioteladmin/


___________________
"We did not choose to become robots. There was an accident in our studio. We were working on our sampler, and at exactly 9:09 a.m. on September 9, 1999, it exploded. When we regained consciousness, we discovered that we had become robots."

Old Post Jun-29-2006 14:30  United States
Click Here to See the Profile for placebo Click here to Send placebo a Private Message Add placebo to your buddy list Report this Post Reply w/Quote Edit/Delete Message
placebo
501xx



Registered: Jun 2003
Location: Somewhere

After I reported the site to eBay, AntiPhishing.org, and the abuse contact at their ISP, looks like it got taken down...haha.


___________________
"We did not choose to become robots. There was an accident in our studio. We were working on our sampler, and at exactly 9:09 a.m. on September 9, 1999, it exploded. When we regained consciousness, we discovered that we had become robots."

Old Post Jun-29-2006 20:42  United States
Click Here to See the Profile for placebo Click here to Send placebo a Private Message Add placebo to your buddy list Report this Post Reply w/Quote Edit/Delete Message
sothis
Cyborg Queen



Registered: Aug 2001
Location: seattle, washington

ive been receiving a weird new approach recently.. here's the copied text from the forum i posted it on:

--------------------------

ive been getting this fairly recently and havent heard anyone else talk about it, so i thought id give a heads up.

the first one of these i got, i was almost fooled. it looks EXACTLY like a "ask the seller a question" emails you'd get if you were selling something.



i think ive received about 5 of these now in a few weeks, all from "minidigitalis". the first thing i did was check the auction ID number... it was legit (though it isnt anymore, yet i still get these emails about this same item, ha). i then was a little concerned that maybe someone had put my email address as the contact, so they could scam the person out of their item (in this case, a computer). but, their email address was definitely not mine.

i moused over the links. all of them were legit... EXCEPT ONE, which ultimately tipped me off. in this case, it was the top most "learn more" link, which led to some other weird site. the other way they fucked up is that the email subject says its from "digitalis" while the member id in the email is "minidigitalis". honestly, i have no idea what this scam is even trying to do... but clearly its up to something.

i just noticed that now, even that "learn more" link appears to lead to a legitimate page.. so they must have caught on to their mistake.

so yeah. not sure what it's trying to accomplish, but almost fooled me. be careful if you see one of these.

Old Post Jun-29-2006 22:21  United States
Click Here to See the Profile for sothis Click here to Send sothis a Private Message Visit sothis's homepage! Add sothis to your buddy list Report this Post Reply w/Quote Edit/Delete Message
Sunsnail
Global Moderator



Registered: Sep 2004
Location:

quote:
Originally posted by sothis

so yeah. not sure what it's trying to accomplish, but almost fooled me. be careful if you see one of these.


conspiracy!

Old Post Jun-29-2006 22:26 
Click Here to See the Profile for Sunsnail Click here to Send Sunsnail a Private Message Add Sunsnail to your buddy list Report this Post Reply w/Quote Edit/Delete Message
Boomer187
Spicy Hotdog



Registered: Aug 2001
Location: USA

lol, any email asking you to click a link is not good. Never click em :P



unless you fill em out with aplz info.

Old Post Jun-29-2006 22:37  United States
Click Here to See the Profile for Boomer187 Click here to Send Boomer187 a Private Message Visit Boomer187's homepage! Add Boomer187 to your buddy list Report this Post Reply w/Quote Edit/Delete Message
optik
Supreme tranceaddict



Registered: Jun 2004
Location: oxford

if you do get caught - your course of action should be (I know of someone who reponded to the request for info one):

log into ebay and change your password ASAP - to something completely different.

email the ebay fraud department (via their website) they will monitor your account, and check for fraudulent activity.

pray.


___________________
If I've been helpful and you have a spare minute, check out my soundcloud; clubshark soundcloud
http://www.clubsharkrecords.com

Old Post Jun-30-2006 00:03  United Kingdom
Click Here to See the Profile for optik Click here to Send optik a Private Message Visit optik's homepage! Add optik to your buddy list Report this Post Reply w/Quote Edit/Delete Message
CleverName
mep



Registered: Dec 2004
Location: home

heh nice [fake] SSN you entered...oblig simpsons quote:
quote:
Mr. Burns: [after being asked his SSN] Null null null, null null, null null null TWO. Damn you roosevelt!"


___________________

Old Post Jun-30-2006 03:08  United States
Click Here to See the Profile for CleverName Click here to Send CleverName a Private Message Add CleverName to your buddy list Report this Post Reply w/Quote Edit/Delete Message
placebo
501xx



Registered: Jun 2003
Location: Somewhere

quote:
Originally posted by sothis
ive been receiving a weird new approach recently.. here's the copied text from the forum i posted it on:

--------------------------

ive been getting this fairly recently and havent heard anyone else talk about it, so i thought id give a heads up.

the first one of these i got, i was almost fooled. it looks EXACTLY like a "ask the seller a question" emails you'd get if you were selling something.



i think ive received about 5 of these now in a few weeks, all from "minidigitalis". the first thing i did was check the auction ID number... it was legit (though it isnt anymore, yet i still get these emails about this same item, ha). i then was a little concerned that maybe someone had put my email address as the contact, so they could scam the person out of their item (in this case, a computer). but, their email address was definitely not mine.

i moused over the links. all of them were legit... EXCEPT ONE, which ultimately tipped me off. in this case, it was the top most "learn more" link, which led to some other weird site. the other way they fucked up is that the email subject says its from "digitalis" while the member id in the email is "minidigitalis". honestly, i have no idea what this scam is even trying to do... but clearly its up to something.

i just noticed that now, even that "learn more" link appears to lead to a legitimate page.. so they must have caught on to their mistake.

so yeah. not sure what it's trying to accomplish, but almost fooled me. be careful if you see one of these.


You're not alone, I get those all the time too...and I am an eBay seller, so the first time I got one, I was like, WTF? I don't have that item for sale? Took me about 20 seconds to realize it was a phishing email.


___________________
"We did not choose to become robots. There was an accident in our studio. We were working on our sampler, and at exactly 9:09 a.m. on September 9, 1999, it exploded. When we regained consciousness, we discovered that we had become robots."

Old Post Jun-30-2006 14:04  United States
Click Here to See the Profile for placebo Click here to Send placebo a Private Message Add placebo to your buddy list Report this Post Reply w/Quote Edit/Delete Message

TranceAddict Forums > Main Forums > Chill Out Room > eBay Phishing Scams..for those that aren't aware.
Post New Thread    Post A Reply

 
Last Thread   Next Thread
Click here to listen to the sample!Pause playbackTrack #1 Under Sun - The Sound Of Scandinavia 023 03-08-07 [2008] [0]

Click here to listen to the sample!Pause playbackAlex Morph & Rank 1 - "Life Less Ordinary" [2006]

Show Printable Version | Subscribe to this Thread
Forum Jump:

All times are GMT. The time now is 00:10.

Forum Rules:
You may not post new threads
You may not post replies
You may not edit your posts
HTML code is ON
vB code is ON
[IMG] code is ON
 
Search this Thread:

 
Contact Us - return to tranceaddict

Powered by: Trance Music & vBulletin Forums
Copyright ©2000-2026, Jelsoft Enterprises Ltd.
Privacy Statement / DMCA
Support TA!