I have to admit, this phishing attempt is different. It’s coming from a unassuming location. Who would think that a question from a fellow eBayer could be attempt to steal your info? On top of that, only the yellow “Respond Now” button leads to a false location.
For reference…Give them some fake info:
http://alice.ics.nara-wu.ac.jp/~chubo/ebays.html
Return-path:
Received: from spm02 (spm02)
by jem01
(Sun Java System Messaging Server 6.2-5.04 (built Jan 24 2006))
with ESMTP id for ;
Wed, 19 Jul 2006 19:54:09 -1000 (HST)
Received: from mail.digitrain.ac.nz ([203.97.26.98])
by spm02 (8.13.6.20060614/8.13.6) with ESMTP id k6K5s0SX016030
for ; Wed,
19 Jul 2006 19:54:07 -1000 (HST envelope-from donna@digitrain.ac.nz)
Received: by mail.digitrain.ac.nz (Postfix, from userid 1030)
id 6A349199C10D; Thu, 20 Jul 2006 16:16:51 +1200 (NZST)
Date: Thu, 20 Jul 2006 16:16:51 +1200 (NZST)
From: eBay
Subject: Question from eBay Member
To: undisclosed-recipients: ;
Message-id:
MIME-version: 1.0
Content-type: text/html
Content-transfer-encoding: 8bit\r\n
X-PMX-Version: 5.2.0.264296, Antispam-Engine: 2.4.0.264935,
Antispam-Data: 2006.7.19.223932
Original-recipient: rfc822;
X-Perlmx-Spam: Gauge=XXX, Probability=30%, Report=’PHISH_NO_HTML_TAG 1.25,
CTYPE_JUST_HTML 0.848, HTML_MIME_NO_HTML_TAG 0.8, PHISH_SUBJ_LOW 0.5, __CT 0,
__CTE 0, __CTYPE_IS_HTML 0, __HAS_MSGID 0, __MIME_HTML 0, __MIME_HTML_ONLY 0,
__MIME_VERSION 0, __PHISH_FROM 0, __PHISH_FROM2 0, __PHISH_SUBJ_PHRASE1 0,
__RUS_MIME_NO_TEXT 0, __SANE_MSGID 0′