Here we go again ... Oboy! Another message from eBay! eBay is inviting you to “Join us as a power seller.” What could possibly be cooler?

Oboy! Another message from eBay! eBay is inviting you to “Join us as a power seller.” What could possibly be cooler?

Whaddaya mean it might not be from eBay? It says its from aw-confirm@eBay.com, right there on the From line.

Nevertheless, something doesn’t feel quite right.

When you open the message, From: reads aw-confirm@eBay.com[user@isp.com]. The first part is the Display name. The portion in brackets, [user@isp.com], is the e-mail address for the presumptive sender.
Although the thing is replete with eBay graphics, a quick gander turns up childish gaffs, including missing periods and Tarzanish grammer like “Why you become a PowerSeller?”
Stupid un-eBayish promises: “Become an eBay PowerSeller withing 48 hours.” Since when does eBay do anything on your schedule?
So you right click on [Edit Source]. Search for href= in the code, you turn up href=”http://www.e-agricultura.ro/ .signin.ebay.com/ws/ eBayISAPIdllSignIn.php” > Become an eBay PowerSeller.

Translation: If you click to… Become an eBay PowerSeller… eBay is sending you to Romania. Hmmm. Now you’re starting to get a bit suspicious.

Closing the message, you highlight it again in Outlook. Right click on [Options]. Scrolling down, you find Received: from 82-76-123-5.rdsnet.ro (HELO tuk.datasolutions.ro) (82.76.123.5).

If you’re still not convinced it’s not from eBay, you oughta consider taking the first exit off the Information Highway. Anybody this Romanian phisher nets almost deserves it.

Of course, those who are properly protected by smart filtration systems rarely see this nonsense.