Just got in a cheery email purporting to be from eBay suspending my account there. As I say purporting since the email address in the message is not the one the email got sent to. elcatan@hotmail.com is NOT my email address, seriously. At the end it has a link that is supposed to take one to eBay's login screen and even when one hovers the mouse cursor over the link, it pops up an information block pointing to eBay. But at the bottom of the email window in AOL it was another matter as it pointed to a pjdcomputer.com link. Being the curious type I opened the link in another window. The image at top is a comparison against the real eBay login page. It all looks legitimate doesn't it? Look up in the browser URL window though and surprise we have been redirected to yet another URL, this one at KulturKonsolt.no.
For all the effort at camouflage and mis-direction, it was all for naught since they used the wrong email address at the start. As I said, stupidly sophisticated.
I used www.godaddy.com and www.uwhois.com to find the following information.
The info for pjdcomputer is as follows:
Registrant:Noppadol Kamwan info@onlinenichost.com
+6.665528199PJDCOMPUTER94/2
Tambol CharoenmuengParn,Chaingrai,TH 57120
Domain Name:pjdcomputer.com
Record last updated at 2005-08-08 08:06:20
Record created on 2004/9/2Record expired on 2006/9/2
Domain servers in listed order:ns1.pjdcomputer.com ns2.pjdcomputer.com
Administrator:name:(Noppadol Kamwan) Email:(info@onlinenichost.com)
tel-- +6.665528199PJDCOMPUTER94/2
Tambol Charoenmueng\rt ParnChaingrai,TH
zipcode:57120
While kulturkonsult.no is:
Domain Name................: kulturkonsult.no
Organization Handle........: LKK2O-NORID
Registrar Handle...........: REG560-NORID
Legal-c Handle.............: SL113P-NORID
Tech-c Handle..............: HOA1R-NORID
Zone-c Handle..............: HOA1R-NORID
Nameserver Handle..........: NS3190H-NORID
Nameserver Handle..........: NS3598H-NORID
Additional information:Created: 2003-01-22
Last updated: 2004-10-20NORID Handle...............: LKK2O-NORID
Organization Name..........: Langfors Kultur Konsult
Organization Number........: 980156133
Post Address...............: Uerlandsgt. 24
Postal Code................: N-0175
Postal Area................: Oslo
Country....................: Norway
Phone Number...............: +47 95 94 64 37
Fax Number.................: Email Address..............: trecs@online.no
Additional information:Last update: 1999-12-14
4 comments:
Yea, Anna, I get at least one of these fake ebay e-mails a day telling me th at my account is going to be shut down or that my product has not been received by a bidder. I haven't gotten one from the Nigerians in a long time, I wonder if they are now using the ebay scam
Andyj
I wonder if the Nigerians all moved to Norway? Wouldn't it be a bit cold up there for them?
These are fairly easy to spot and I usually just foward them on to the abuse/security dept of ebay, paypal or what have you.
I know people who are not very computer savvy, and would naively fall for scams like that.
I think everyone is trying to get into the scam act.
I just wanted to highlight a really stupid example that used sophistacted methods. And by doing so, raise awareness.
Nigerian Norewgians, talk about some cool runnings.
Post a Comment