Ebay Phishing

[Robert Slade]

On Sun, 2005-03-20 at 18:42, Gerard Seibert wrote:
> On Sun, 20 Mar 2005 10:22:23 -0600 Chris <racerx at makeworld.com> wrote:
> ||>
> ||>Robert Slade wrote:
> ||>> Hi all,
> ||>> 
> ||>> Is it just me, but I've had 2 Ebay Phishing e-mails to this e-mail
> ||>> address that I only use for this mail list. Both mails where from
> ||>> Comcast users !!
> ||>> 
> ||>> Rob
> ||>
> ||>Sounds like someone from Comcast is on this list AND using a Windows box
> ||>AND is infected.
> ||>
> ||>Shame on you
> ||>
> ||>-- 
> ||>Best regards,
> ||>Chris
> ||>
> ||>If you have always done it that way, it is probably wrong.
> 
> 
> ********** Reply Separator **********
> Sunday, March 20, 2005 1:35:28 PM
> 
> 1) Did you actually confirm that the email originated from Comcast

Yes:

Received: from c-24-13-45-69.client.comcast.net (HELO 192.168.0.101)
(24.13.45.69)
Direct to my mail server. It is also significant that the sending IP is
listed on a number of blacklists including SORBS.

> 2) Did you report the email to Comcast as well as spoof at ebay.com

Yes, Ebay appear to have done something, Comcast not as the machine is
still sending.

> 3) Why does it have to be a Windows box? Anyone can access this forum
> and harvest email addresses.

Not my comment, but that is the most likely cause. Although there may be
more to it. 

BTW I have just got a spam e-mail to the same address, this one came
from a rr IP. It was advertising a site in ru space and the ebay one
leads back to a ru site too.

Rob