dslreports logo
 
    All Forums Hot Topics Gallery
spc
Search similar:


uniqs
6284
SpectrumDude
join:2002-04-14
Kernersville, NC

SpectrumDude

Member

Ebay Phising Scam

Return-Path:
Received: from ibm05aec.bellsouth.net ([216.219.253.138])
by imf01aec.mail.bellsouth.net
(InterMail vM.5.01.06.11 201-253-122-130-111-20040605) with ESMTP
id
for xxxx@bellsouth.net>; Sat, 26 Mar 2005 14:32:24 -0500
Received: from ams004.ftl.affinity.com ([216.219.253.138])
by ibm05aec.bellsouth.net
(InterMail vG.1.02.00.01 201-2136-104-101-20040929) with ESMTP
id
for ; Sat, 26 Mar 2005 14:32:24 -0500
Received: from [80.97.186.52] ([80.97.186.52]:50695 "HELO
info1@numaivreausatevad.org") by ams004.ftl.affinity.com with SMTP
id S379842AbVCZTcY (ORCPT );
Sat, 26 Mar 2005 14:32:24 -0500
Reply-To: "eBay"
From: "eBay"
To:
Subject: cdman_1@bellsouth.net TKO Notice: Urgent Investigation
Date: Sun, 27 Mar 2005 20:32:44 -0800
MIME-Version: 1.0
Content-Type: text/html;
charset="us-ascii"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1106
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106
Message-Id:
X-NAS-Language: English
X-NAS-Bayes: #0: 0; #1: 1
X-NAS-Classification: 0
X-NAS-MessageID: 796
X-NAS-Validation: {68C8549C-B54C-49C8-AE06-8BBD06069FA8}

***Urgent Fraud Prevention Group Notice***

You have received this email because we have strong reason to believe that your eBay account had been recently compromised. In order to prevent any fraudulent activity from occurring we are required to open an investigation into this matter. To speed up this process, you are required to visit the link provided below and login to your ebay account for a few verification pages..

»62.204.205.136/manual/vh ··· h:sin:US

Please Note: If your account informations are not updated within the next 72 hours, then we will assume this account is fraudulent and will be suspended. We apologize for this inconvenience, but the purpose of this verification is to ensure that your eBay account has not been fraudulently used and to combat fraud.

We appreciate your support and understanding, as we work together to keep eBay a safe place to trade.
Thank you for your attention on this serious matter. We apologize for any delay in resolving this situation.

Regards,

Morris Franklin
eBay SafeHarbor
Investigations Team

--------------------------------------------------------------------------------

Please do not reply to this e-mail as this is only a notification. Mail sent to this address cannot be answered.
eBay treats your personal information with the utmost care, and our Privacy Policy is designed to protect you and your information.
Copyright ) 2004 eBay Inc. All Rights Reserved.
Designated trademarks and brands are the property of their respective owners.
eBay and the eBay logo are trademarks of eBay Inc.
eBay is located at 2145 Hamilton Avenue, San Jose, CA 95125.

This site is still up. I sent email to abuse@ebay.com. Any idea who sent this one?

removed
Premium Member
join:2002-02-08
Houston, TX

removed

Premium Member


inetnum: 80.97.176.0 - 80.97.191.255
netname: TELEMOBIL-SA
descr: Telemobil S.A.
descr: Calea Bucuresti, nr. 2B bis, Balotesti, Ilfov, ROMANIA
country: ro
admin-c: HL525-RIPE
tech-c: HL525-RIPE
status: ASSIGNED PA
mnt-by: AS3233-MNT
mnt-lower: AS3233-MNT
mnt-routes: AS3233-MNT
mnt-routes: TELEMOBIL-MNT
notify: hostmaster@rnc.ro
changed: hostmaster@rnc.ro 20021129
source: RIPE

route: 80.97.186.0/24
descr: TELEMOBIL S.A.
descr: Calea Bucuresti, nr. 2B bis, Balotesti, Ilfov, Romania
origin: AS21220
mnt-by: TELEMOBIL-MNT
changed: honoriu.lazar@telemobil.ro 20040625
source: RIPE

person: Honoriu Lazar
address: TELEMOBIL S.A.
address: Calea Bucuresti 2B Bis
address: Balotesti, Jud Ilfov
address: Romania
phone: +40-788-533111
fax-no: +40-788-533333
e-mail: Honoriu.Lazar@telemobil.ro
nic-hdl: HL525-RIPE
notify: Honoriu.Lazar@telemobil.ro
mnt-by: TELEMOBIL-MNT
changed: Honoriu.Lazar@telemobil.ro 20041015
source: RIPE


Owner of the IP space. Probably a hijacked machine.

hai--hui
@neoplus.adsl.tpnet.p

hai--hui to SpectrumDude

Anon

to SpectrumDude
Hi there. If a scam has its source in Romania, it can be reported at »www.efrauda.ro (once you are there, select the English page)

wifi4milez
Big Russ, 1918 to 2008. Rest in Peace
join:2004-08-07
New York, NY

wifi4milez

Member

Why is it that so many scams come from Romania? Is it simply because they have no law enforcement over there or because they dont have a high tech division of law enforcement? I would say that at least 25% of the ebay items are fake. I emailed this guy about a camera the other day and he wrote back that he was in Romania even though the auction clearly stated he was a US customer. I told him to take a hike!
HOGSONTHEROA
join:2005-04-14
Eastlake, OH

HOGSONTHEROA to SpectrumDude

Member

to SpectrumDude
was dupted out of $7k on a fraud ebay scam last week. working with authorities on tracking down the ip. here is what i got so far.

domain-name: zappmobile.ro
description: Telemobil SA
description: Calea Bucuresti nr. 2B Bis
description: Balotesti, jud. Ilfov, Romania
description: phone: +40-21-4023333
description: fax: +40-21-4023330
admin-contact: HL525-ROTLD
technical-contact: HL525-ROTLD
technical-contact: NS24-ROTLD
zone-contact: HL525-ROTLD
zone-contact: NS24-ROTLD
billing-contact: LF26-ROTLD
nameserver: dns1.zapp.ro 80.97.176.2
nameserver: dns2.zapp.ro 80.97.176.3
info: Register your .ro domain names at »www.rotld.ro/
notify: mailto:domain-admin@listserv.rnc.ro
object-maintained-by: ROTLD-MNT
mnt-lower: ROTLD-MNT
updated: mailto:domain-admin@listserv.rnc.ro 20010824
updated: mailto:flore@rnc.ro 20010824
updated: mailto:hostmaster@rnc.ro 20011019
updated: mailto:hostmaster-cmircea@rotld.ro 20011203
updated: mailto:hostmaster-cmircea@rotld.ro 20011203
updated: mailto:hostmaster-cmircea@rotld.ro 20030114
source: ROTLD
application-date: 20010815
domain-status: active
registration-date: 20010824

person: Honoriu Lazar
address: TELEMOBIL S.A.
address: Calea Balotesti 2B Bis
address: Balotesti, Jud Ilfov
address: Romania
phone: +40-21-4023333
fax-no: +40-21-4024490
e-mail: mailto:Honoriu.Lazar@telemobil.ro
nic-hdl: HL525-ROTLD
notify: mailto:domain-admin@listserv.rnc.ro
object-maintained-by: ROTLD-MNT
updated: mailto:hostmaster@rnc.ro 20010906
source: ROTLD

person: Narcis Suteu
address: TELEMOBIL S.A.
address: Calea Balotesti 2B Bis
address: Balotesti, Jud Ilfov
address: Romania
phone: +40-21-4023333
fax-no: +40-21-4024490
e-mail: mailto:narcis.suteu@telemobil.ro
nic-hdl: NS24-ROTLD
notify: mailto:domain-admin@listserv.rnc.ro
object-maintained-by: ROTLD-MNT
updated: mailto:hostmaster-cmircea@rotld.ro 20011203
source: ROTLD

person: Laura Florescu
address: TELEMOBIL S.A.
address: Calea Balotesti 2B Bis
address: Balotesti, Jud Ilfov
address: Romania
phone: +40-21-4023333
fax-no: +40-21-4024490
e-mail: mailto:laura.florescu@telemobil.ro
nic-hdl: LF26-ROTLD
notify: mailto:domain-admin@listserv.rnc.ro
object-maintained-by: ROTLD-MNT
updated: mailto:hostmaster-cmircea@rotld.ro 20011203
source: ROTLD

bell_s
join:2003-08-22
Romania

1 edit

bell_s to removed

Member

to removed
said by removed:

Owner of the IP space. Probably a hijacked machine.
actually zapp is a cell phone company. and if i'm not mistaking they offer internet access through their phones. it might be the real thing. not a hijacked machine but a moron connecting his computer to the internet and sending the e-mail himself. i'm from Romania and i know there are people doing this kind of stuff... send your info to zapp and see if they can help. but i really don't think it's a hijacked machine. it's not a always on connection.
[Edit]
man i'm so sorry to hear this... it's really sad. i'm planing on going back home this summer and i was hoping i could still buy or sell stuff on e-bay or other places... but i know there is a very slim chance anyone will send anything to that god forsaken country and i know people are going to be deterred in buying anything from that country. well ... i'll have to work hard to create a good rep .. i guess :|
and yes, the law enforcement is really weak. they should have bigger fish to fry since the country is strife with corruption. that and the lack of knoledge by the law enforcement side makes a great place for this type of crimes. i've heared of people going to jail over these scams and i sure hope that guy gets what he deserves. work with the fbi. i know they had some success in working with the romanian authorities in finding some of these low-lifes.
HOGSONTHEROA
join:2005-04-14
Eastlake, OH

HOGSONTHEROA

Member

can someone give me a contact email address to get ahold of someone in ROMANIA that would help me in finding the individual that stole $7k from me. i have no way of getting ahold of someone in Romania to track the guy down. i'm in the u.s. thanks rich

bell_s
join:2003-08-22
Romania

1 edit

bell_s

Member

i believe that fbi should get involved and you can also contact someone at the US embassy in Bucharest. they should be able to provide more answers as to what law enforcement agency can help you best.
proteus_ro
join:2005-07-22
Romania

proteus_ro to HOGSONTHEROA

Member

to HOGSONTHEROA
Hello,

Don't know if you had any progress on this - your original post is rather old, but I only joined this forum today.

In any case, I think the best route - as someone already suggested above - would be to go through FBI. I live in Romania and I know that FBI has good connections with the Romanian authorities (e.g. police) and they are actively working against cybercrime.

The "trail" might be a little cold after so many months, but maybe there is still hope - especially if that scammer didn't do this only as an one-time thing.

Anyway, if there is anything specific that I could do to help, please let me know.

Best regards,
Sebastian