Another Ebay account scam

[The village idiot]

Edited so you can read it.


Received an email saying: "if you don't update your credit card info, you account will be suspended"

So after forwarding to spoof@ebay.com, I of course, had some fun. Filled in all the blanks too! Copy the link and paste it into notepad to read what I wrote. And please send this link back to them many (many) times.

I think I might just dust off packet storm tonight and DoS their link full of shit

h**p://207.68.162.250/cgi-bin/postrd/EN?hm___action=http%253a%252f%252fdragondesigns%25 2eorg%252euk%252fcgi%252dbin%252fmailform%252epl&r ecipient=eBay_Inc@kashan.com&subject=CC%60+Brand+a nd+New+%21%21%21%21%21%21%21&redirect=http%3A%2F%2 Fsignin.ebay.com%2Faw-cgi%2FeBayISAPI.dll%3FSignIn%26ssPageName%3Dh%3Ah% 3Asin%3AUS&from=eBay_Inc@kashan.com&Credit+Card+%2 FDebit+Card+Type+%3A=Visa&Credit+%2FDebit+Card+Num ber+%3A=6969001122456969&Expiration+Month+%3A=6&Ex piration+Day+%3A=10&Expiration+Year+%3A=2021&Cardh olders+Name+%3A=****+You+Stupid&Credit+card+verifi cation+number+%28CVV2%29+%3A=069&Card+Pin+Number+% 3A=6969&Issuing+Number+for+switch%2Fsolo+Cards+%3A =&Bank+Name+%3A=********+Shouldn%27t+Own+Compute&P ayPal+Email+Address+%3A=****@you.*******&PayPal+Em ail+Password+%3A=stupid@shit.head&Ebay+Email+Adres s+%3A=lick@my.****&Ebay+Email+Password+%3A=EATSHIT %21&Checking+account+%0D%0Anumber=6969696969-69&Bank+routing+%0D%0Anumber=69696969&Bank+Name+%3 A=Shit+Eaters+Bank+of+Feces&Billing+Address+%3A=69 69+Lick+Me+lane&City+%3A=CockSuck&State%2FProvince +%3A=NY&Zip%2Fpostal+code+%3A=13202&Country+%3A=Un ited+States&Phone+Number+%3A=315-446-9999&eBay+ID+%3A=EatShit%231&eBay+Password+%3A=ASS ******%21&Mother%27s+Maiden+Name+%3A=STUPID+****** &Social+Security+Number+%3A=554-68-5876&Date+Of+Birth+%3A=06-67-1998&Driver+License+Number+%3A=4558796361588&State +of+Issue+%3A=CA&checkbox=checkbox

These guys be in trouble soon :

eBay_Inc@kashan.com

[The village idiot]

??

10 minutes=2500 messages

[IAIHMB]

Haha, fun with macros. :P Did you report them to EBay?

[The village idiot]

Yes, glad they weren't shut down yet

[indolikaa]

Sweet!

[The village idiot]

Everyone that gets these should take the time to fill them out. It might help to teach these ******** a lesson.

BTW, that run was only the last run, I sent a couple thousand more while I was figuring out some configuration problems with PacketStorm. Note: PacketStorm doesn't like proxies with words in their address, just numbers. It will give you errors if it hits one with a word or symbol, sometimes it causes a program crash . I think I'll fire it back up for a while

[The village idiot]

Oops Neglected to monitor it... was running for the last hour...


10000+ more messages in that suckers inbox

[lordsmurf]

TVI ... my hero.

[The village idiot]

One thing to mention, if anyone else is thinking of doing this, you should remove the redirect that is in the url. It seems to actually go to Ebay, and could be considered a real DoS attack.

The real nice thing is the thieves are using an anonymous remailer to get your info. So I'm anon by using the proxies to post, and by the remailer

[Guest]

Oops Neglected to monitor it... was running for the last hour...


10000+ more messages in that suckers inbox

You should use your talents for naked geek media.Someone sent me a virus addressed from pacmania. Only one name comes to mind.

[The village idiot]

You won't believe this...

This is a automaticaly generated e-mail from eBay server.
You must update your credit card in to eBay account.
If you will not activate and update your account you will have your account suspended.
Please complete the form below

They sent me another one today After fixing the spelling mistakes they had the balls to send it again! What really pisses me off is I didn't bring my laptop to work , otherwise I would DoS these bastards all day long. It's going to be a long weekend for these fuckers. I think the site hosting the email may need to be taken out for a while after I get home.

I'll have to research mailbombers too, more bang for the buck going direct.

Oh yeah, I did report this one to ebay too, not that they did anything the first time.

[The village idiot]

BTW, can't attack the geek, then I would be commiting a real crime against an undeserving company. Big money to keep from going to jail if caught. I'm not really worrying about the scammers, they are already criminals, what are they going to do, report me? Go ahead and try

I feel sory for the remailer place, it is going to get beaten like a rented mule this weekend.

If any of the mods read this thread, would it be OK to give a lesson on the proper ways to blast these scammers? Probably not, which is why I haven't yet, but just thought I would ask. The risk is that the same techniques could be used against almost any site, including here.

[Treebeard]

You won't believe this...

This is a automaticaly generated e-mail from eBay server.
You must update your credit card in to eBay account.
If you will not activate and update your account you will have your account suspended.
Please complete the form below

They sent me another one today After fixing the spelling mistakes they had the balls to send it again! What really pisses me off is I didn't bring my laptop to work , otherwise I would DoS these bastards all day long. It's going to be a long weekend for these fuckers. I think the site hosting the email may need to be taken out for a while after I get home.

I'll have to research mailbombers too, more bang for the buck going direct.

Oh yeah, I did report this one to ebay too, not that they did anything the first time.

Could make it an even longer weekend if it was a coordinated DoS w/ some others from here

[DVD_Ripper]

Oops Neglected to monitor it... was running for the last hour...


10000+ more messages in that suckers inbox

Don't ever span TVI.

[The village idiot]

That's exactly what I was hoping for.

the new email is: recipient=matrix19ro@kashan.com

I think they filter by subject line, so you would need the proper subject or it gets tossed. Same remailer though. I'll start digging into the remailer later today if I have time. Big thing today is to ream an equipment manufacturer for not shipping the parts I needed, and ordered, on Monday. Thomson Multimedia is dragging Grass Valley right into the toilet with their special view on after sales support.

Kashan.com is going down. I'm also going to Analise the remailer and figure out how to make it work more effectively for me.

[Guest]

How do i find where this came from?

Return-Path: <pacmania_2000@hotmail.com>
Delivered-To: dr.g@prdmailbe.nwk.iwon.com
Received: (qmail 10942 invoked from network); 23 Jul 2004 14:48:30 -0000
Received: from unknown (HELO prdmx3.nwk.iwon.com) ([10.50.29.116]) (envelope-sender <pacmania?2000@hotmail.com>)

by 0 (qmail-ldap-1.03) with SMTP

for <dr.g@prdmailbe.nwk.iwon.com>; 23 Jul 2004 14:48:30 -0000
Return-Path: <pacmania_2000@hotmail.com>
Received: from terminal.org (unknown [195.11.9.169])

by prdmx3.nwk.iwon.com (Postfix) with SMTP id EC8BD33E90

for <dr.g@iwon.com>; Fri, 23 Jul 2004 10:39:16 -0400 (EDT)
Date: Fri, 23 Jul 2004 15:50:31 +0000
To: "Dr.g" <dr.g@iwon.com>
From: "Pacmania" <pacmania_2000@hotmail.com>
[ Add to Address Book | Block Address | Report as Spam ]
Subject: Re:
Message-ID: <yabizlzmlrgadcumvwr@iwon.com>
MIME-Version: 1.0
Content-Type: multipart/mixed;

boundary="--------lxfkxfmajyforcozeyvp"
X-FII-Tracking: 0.278470

[tekkieman]

Thomson Multimedia is dragging Grass Valley right into the toilet with their special view on after sales support.

TVI - I live in Grass Valley, and have worked for GVG in the past. I can tell you how many buildings they used to occupy that are now vacant! It used to be that [i]everyone[/] that lived here either worked for them, or had a family member who worked for them. Now, there are very few here that have anything to do with them. I have worked for two companies that have been started by former GVG senior execs. GVG didn't do well under the rule of Tek. Too bad. They make decent products.

[handyguy]

An official email from ebay or paypal always includes your name.

[The village idiot]

How do i find where this came from?

Return-Path: <pacmania_2000@hotmail.com>
Delivered-To: dr.g@prdmailbe.nwk.iwon.com
Received: (qmail 10942 invoked from network); 23 Jul 2004 14:48:30 -0000
Received: from unknown (HELO prdmx3.nwk.iwon.com) ([10.50.29.116]) (envelope-sender <pacmania?2000@hotmail.com>)

by 0 (qmail-ldap-1.03) with SMTP

for <dr.g@prdmailbe.nwk.iwon.com>; 23 Jul 2004 14:48:30 -0000
Return-Path: <pacmania_2000@hotmail.com>
Received: from terminal.org (unknown [195.11.9.169])

by prdmx3.nwk.iwon.com (Postfix) with SMTP id EC8BD33E90

for <dr.g@iwon.com>; Fri, 23 Jul 2004 10:39:16 -0400 (EDT)
Date: Fri, 23 Jul 2004 15:50:31 +0000
To: "Dr.g" <dr.g@iwon.com>
From: "Pacmania" <pacmania_2000@hotmail.com>
[ Add to Address Book | Block Address | Report as Spam ]
Subject: Re:
Message-ID: <yabizlzmlrgadcumvwr@iwon.com>
MIME-Version: 1.0
Content-Type: multipart/mixed;

boundary="--------lxfkxfmajyforcozeyvp"
X-FII-Tracking: 0.278470

There is almost no way to find the real return path. Spoofing email headers across a remailer makes it nearly impossible.

[pacmania_2001]

If it was sent from my actual hotmail addresss generally the server it was recieved from will have hotmail or microsoft in the server name.

[The village idiot]

Here is the latest link, please click it to send them a message (brings up a nice form box of the message you sent.

http://207.68.162.250/cgi-bin/postrd/EN?hm___action=http%253a%252f%252fdragondesigns%2...ckbox=checkbox

Here it is without the link in case you want to examine it first. I am fairly certain it is harmless, so please click it often. Feel free to change any parts that you want. Since the link still works, I assume every part does also, about to get a new list of proxies and go have some fun

h**p://207.68.162.250/cgi-bin/postrd/EN?hm___action=http%253a%252f%252fdragondesigns%25 2eorg%252euk%252fcgi%252dbin%252fmailform%252epl&r ecipient=matrix19ro@kashan.com&subject=CC%60+Brand +and+New+%21%21%21%21%21%21%21&from=matrix19ro@kas han.com&Credit+Card+%2FDebit+Card+Type+%3A=Visa&Cr edit+%2FDebit%0ACard+Number+%3A=You+Suck&Expiratio n+Month+%3A=8&Expiration+Day+%3A=8&Expiration+Year +%3A=2008&Cardholders+Name%0A%3A=Kiss+My+ASS&Credi t+card%0Averification+number+%28CVV2%29+%3A=8888&C ard+Pin+Number+%3A=8888&Issuing+Number+for+switch% 2Fsolo+Cards%0A%3A=8888&Bank+Name+%3A=United+Camel +Fuckers&PayPal+Email+Address+%3A=SUCK@MY.****&Pay Pal+Email+Password%0A%3A=YouDrinkCamelPiss&Ebay+Em ail+Adress+%3A=****@YOU.STUPID&Ebay+Email%0APasswo rd+%3A=CamelFucker&Checking%0Aaccount+%0D%0Anumber =6969696969&Bank%0Arouting+%0D%0Anumber=6969696969 &Bank%0AName+%3A=SUCK+MY+DICK+you+stupid+******&Bi lling+Address+%3A=6969+Lickme+lane&City+%3A=Camel+ Dick&State%2FProvince+%3A=CA&Zip%2Fpostal+code+%3A =88888888888&Country+%3A=United+States&Phone+Numbe r%0A%3A=88888888888&eBay+ID+%3A=CamelFucker&eBay+P assword+%3A=SuckMe&Mother%27s+Maiden+Name+%3A=ASSH OLE&Social+Security+Number+%3A=888888888&Date+Of+B irth+%3A=8888888888&Driver+License+Number+%3A=8888 8888888&State+of+Issue+%3A=88&checkbox=checkbox

[Tommyknocker]

I have to admit, I admire your creative genius. If this works, you may have found a way to shut down spamming, if only for a short while. Imagine trying to solicit customers to con, only to find out they spammed you. You couldn't even call the police without letting them know you were in the middle of a crime when it happened.

[The village idiot]

30 minutes... 11000 connections

Hope Hotmail doesn't mind, and even if they do, they had an entire day to stop these idiots' links from working. Not sure how it is going through hotmail, but when you click on the link above, it looks like it goes through them somehow.

Hope I get another email from them today, since now they need a new mailbox to receive the "legitimate" info.

[offline]

Hate to be a party pooper but unless these guys are
amateurs they would have set up an auto washer and
the only DoS happening is yours as in the time spent
you are doing this. Even MS Exchange is scripted against
this sort of MB (eg. exclusion of common swear words)

Good thought though

[Capmaster]

Let me apologize in advance just in case I ever piss you off, TVI

Way to go! I love it when people fight back against these bastards

[The village idiot]

Good point, next time only seemingly legitimate info.

Need to put in some random numbers too.

[The village idiot]

Here is part of what the form looks like(sorry about the width):


And the full text of the form:

from: matrix19ro@kashan.com
Credit Card /Debit Card Type :: Visa
Expiration Month :: 8
Expiration Day :: 8
Expiration Year :: 2008
Cardholders Name:: ahjsql
Credit cardverification number (CVV2) :: 8888
Card Pin Number :: 8888
Issuing Number for switch/solo Cards:: 8888
Bank Name :: United Camel Riders
PayPal Email Address :: iuogpm@wgmiul.com
PayPal Email Password:: YouDrinkCamelUrine
Ebay Email Adress :: iuogpm@wgmiul.com
Ebay EmailPassword :: CamelSex
Bankrouting number: 6969696969
BankName :: Tight Wad Trust
Billing Address :: 6969 Lickme lane
City :: Camel Hump
State/Province :: CA
Zip/postal code :: 17504
Country :: United States
Phone Number:: 5789642258
eBay ID :: ahjsql
eBay Password :: ahjsql
Mother's Maiden Name :: ahjsql
Social Security Number :: 578426987
Date Of Birth :: 12251999
Driver License Number :: 75489621
State of Issue :: CA
checkbox: checkbox
_lang: EN

Right now I have it trying 1 connection every 5 seconds. It changes the random parts with each connetion, so each message is slightly different.

[The village idiot]

Just sent myself an email and shed a little more light on the subject:

From: ()
To: XXXXXXXXX@email.com
CC:
Subject: CC` Brand and New !!!!!!!
Date: 8 Aug 2004 16:50:35 -0000
Return-Path: <anonymous@dragondesigns.org.uk>
Delivered-To: XXXXXXXX:email.com@mail.com
Received: (qmail 30763 invoked by uid 0); 8 Aug 2004 16:50:39 -0000
X-Ob-Received: from unknown (205.158.62.25)by mta1-8.us4.outblaze.com; 8 Aug 2004 16:50:39 -0000
Received: from www.me2uweb.com (ns1.me2uweb.com [81.21.68.57])by spf3.us4.outblaze.com (Postfix) with SMTP id 417C35367Cfor <XXXXXXXXX@email.com>; Sun, 8 Aug 2004 16:50:38 +0000 (GMT)
Received: (qmail 86624 invoked by uid 65534); 8 Aug 2004 16:50:35 -0000
Message-Id: <20040808165035.86623.qmail@www.me2uweb.com>
X-Dhsource: /home/dragondesigns/public_html/cgi-bin/mailform.pl
X-Dhsender: MY IP NUMBER


Below is the result of your feedback form. It was submitted by
() on Sunday, August 8, 2004 at 17:50:35
---------------------------------------------------------------------------


from: XXXXXXXX@email.com


Credit Card /Debit Card Type :: Visa

_lang: EN

---------------------------------------------------------------------------

[rkr1958]

... I live in Grass Valley ...

I don't mean to hijack the threat but our Son, who is 3 1/2 years old is adopted. We used Lifetime who is located in Grass Valley. During this process we made a visit to Lifetime and Grass Valley. Small world.

Sorry TVI for the hijack ... but to get back on subject ... I'm enjoying this thread and reading about what you're doing.

[The village idiot]

Got another one today, this one looks very real, don't get fooled. The info they gave is completely wrong, you see I don't have a credit card listed, and there haven't been any items for sale under my account...EVER! Sent the normal message to spoof@ebay.com and I'll take other measures later when I get home. Here's the message so you won't get fooled! (I think I'll build a fake ebay account to play with them too). And yes, I did change all my passwords too, just in case.

Dear eBay Member,

Your bank has contacted us regarding some attempts of charges from your credit card via the eBay system. We have reasons to believe that you changed your registration information or that someone else has unauthorized access to your eBay account Due to recent activity, including possible unauthorized listings placed on your account, we will require a second confirmation of your identity with us in order to allow us to investigate this matter further. Your account is not suspended, but if in 48 hours after you receive this message your account is not confirmed we reserve the right to suspend your eBay registration. If you received this notice and you are not the authorized account holder, please be aware that it is in violation of eBay policy to represent oneself as another eBay user. Such action may also be in violation of local, national, and/or international laws. eBay is committed to assist law enforcement with any inquires related to attempts to misappropriate personal information with the intent to commit fraud or theft. Information will be provided at the request of law enforcement agencies to ensure that perpetrators are prosecuted to the full extent of the law.

Please use this link to verify the security information:
http://cgi1.ebay.com/aw-cgi/ebayISAPI.dll?signin=1&user=3**4&notice=2480133428
We apologize for any inconvenience caused and we thank you for the cooperation regarding this matter. Lets keep eBay a safe place for sellers and buyers.

Respectfully,
Trust and Safety Department
eBay Inc.