Reply to "Another bad email...."

If you run your mouse over the link that these spoofs invariably have, you'll notice that the actual website it links to appears in the email's status bar in Outlook Express.

For example, in one I received yesterday, although the email said:

http://signin.ebay.com/aw-cgi/eBayISAPI.dll?OneTimePayment&ssPageName=h:h:sin:US

it really linked to

http://66.98.224.18/scgi-maintenancesecureform.net/

the former looks legit but the latter is just using an IP address in the hope of being anonymous!

I've also noticed that the TO address is to my ebay address - I use it for nothing else so either they've guessed it (not hard, it's ebay@teddybearsareevil.com) or someone I've upset by questionning their ripoff P&P or PayPal surcharge has entered it on a disreputable website (I sometimes do that with people who p*ss me off! That'll teach 'em!!!!)

These emails come with amazing regularity - I just forward them straight on to spoof@ebay.com, spoof@paypal.com etc and report them via the spamcop report on my Spam filter.

R2