13 Apr
2013
13 Apr
'13
5:08 p.m.
Folks, I was an underbidder on the System/360 panel that recently went on
ebay.
This morning I received an obviously fake 'second chance' offer email.
The interesting part is that the sender had clearly done some research, as
ebay has not exposed your email address for many years, precisely to
prevent scams like this. Since my ebay ID is 'corestore_org' it's not too
hard to google and find an email address for me; they clearly did so, as
the email correctly associated my email address with my account name,
exactly as a genuine ebay email would.
I don't think anyone here would be taken in by such for an instant, but be
warned all the same; someone is being 'active' with scams tailored to our
interests. The email claimed to originate from 'ebay at ebay.joe211.info' and
sought a reply to 'jrengineer70 at gmail.com'.
EDIT a google reveals several other scam emails using this email address.
It never struck me before, but of course ebay doesn't even show underbidder
*account names* any more; they splash them with asterisks and display them
as x******x. Yet the scammer knew my full ebay ID, my correct email
address, AND the amount of my underbid. Someone *must* have cracked the
ebay database...
Mike
http://www.corestore.org
'No greater love hath a man than he lay down his life for his brother.
Not for millions, not for glory, not for fame.
For one person, in the dark, where no one will ever know or see.'
14 Apr
14 Apr
2:35 p.m.
The ebay seller could have had a shill bidding you up also against ebay
rules, he would therefore know your bids and email
Dave Caroline
On Sat, Apr 13, 2013 at 10:08 PM, Mike Ross <tmfdmike at gmail.com> wrote:
Folks, I was an underbidder on the System/360 panel
that recently went on
ebay.
This morning I received an obviously fake 'second chance' offer email.
The interesting part is that the sender had clearly done some research, as
ebay has not exposed your email address for many years, precisely to
prevent scams like this. Since my ebay ID is 'corestore_org' it's not too
hard to google and find an email address for me; they clearly did so, as
the email correctly associated my email address with my account name,
exactly as a genuine ebay email would.
I don't think anyone here would be taken in by such for an instant, but be
warned all the same; someone is being 'active' with scams tailored to our
interests. The email claimed to originate from 'ebay at ebay.joe211.info' and
sought a reply to 'jrengineer70 at gmail.com'.
EDIT a google reveals several other scam emails using this email address.
It never struck me before, but of course ebay doesn't even show underbidder
*account names* any more; they splash them with asterisks and display them
as x******x. Yet the scammer knew my full ebay ID, my correct email
address, AND the amount of my underbid. Someone *must* have cracked the
ebay database...
Mike
http://www.corestore.org
'No greater love hath a man than he lay down his life for his brother.
Not for millions, not for glory, not for fame.
For one person, in the dark, where no one will ever know or see.'
8:01 p.m.
The same guy seems to be popping up in other places as well:
http://forums.collectors.com/messageview.cfm?catid=11&threadid=886180
I'd let eBay know that they'd better do something to plug the leak,
because clearly, they've got ont.
--Chuck
8:12 p.m.
Someone *must* have cracked the
ebay database...
A snipe service database also could have been compromised. It seems to
me that they get your Ebay name and password for the sniping process -
but if someone gets their hands on that data, they can get into
sellers accounts and see who the underbidders are for higher ticket
items.
My account was hacked years ago - what a pain in the ass. No damage,
other than being out of business for a week ro so. These crooks are
clever...
--
Will
8:30 p.m.
On 4/14/2013 5:12 PM, William Donzelli wrote:
Could be a seller using another account to get more money. Use the other
account to bid some crazy high amount. Cancel the the sale then contact
the person who lost and offer it at their max bid. Always get max bid
that way. The fact this guy seems to always use the same email address
is odd for someone just trying to straight up rip people off.
Someone *must*
have cracked the
ebay database...
A snipe service database also could have been compromised. It
seems to
me that they get your Ebay name and password for the sniping process -
but if someone gets their hands on that data, they can get into
sellers accounts and see who the underbidders are for higher ticket
items.
9:20 p.m.
On 4/14/2013 5:30 PM, mc68010 wrote:
On 4/14/2013 5:12 PM, William Donzelli wrote:
Could be a seller using another account to get more money. Use the
other account to bid some crazy high amount. Cancel the the sale then
contact the person who lost and offer it at their max bid. Always get
max bid that way. The fact this guy seems to always use the same email
address is odd for someone just trying to straight up rip people off.
THey can contact me if they can guess my ebay id. but it is worlds away
Someone
*must* have cracked the
ebay database...
A snipe service database also could have been compromised. It
seems to
me that they get your Ebay name and password for the sniping process -
but if someone gets their hands on that data, they can get into
sellers accounts and see who the underbidders are for higher ticket
items.
from anything i use for email. I think MIke's
point was it was an ebay
looking approach @ his email address. I get my email from
ebay thru a
distantly related oddball server and then respond thru ebay messages.
Unless i reply thru there or send my email address by replying to a
message from my main email I will never get email there that is legit.
The other way to discover ID's by the way which I'm using is to watch
feedback to sellers who don't like. BUt that still only gives an ebay
ID unless you happen to associate your ebay ID with an email address
somewhere.
jim
10:01 p.m.
On Apr 14, 2013, at 9:20 PM, Jim Stephens <jws at jwsss.com> wrote:
On 4/14/2013 5:30 PM, mc68010 wrote:
> On 4/14/2013 5:12 PM, William Donzelli wrote:
>>> Someone *must* have cracked the
>>> ebay database...
THey can contact me if they can guess my ebay id. but
it is worlds away from anything i use for email. I think MIke's point was it was an
ebay looking approach @ his email address. I get my email from ebay thru a distantly
related oddball server and then respond thru ebay messages. Unless i reply thru there or
send my email address by replying to a message from my main email I will never get email
there that is legit.
The other way to discover ID's by the way which I'm using is to watch feedback to
sellers who don't like. BUt that still only gives an ebay ID unless you happen to
associate your ebay ID with an email address somewhere.
It is indeed relatively easy to find people's eBay IDs with some patience, since the
obscured ID still contains two accurate letters (in reverse order, I believe, at least in
all the cases I've found) but an accurate feedback number (which changes, so the delta
can also be checked over time), so looking through feedback for likely buyers/sellers who
might have interacted with them for matching feedback numbers often can un-obscure the
eBay ID. I did that for a while trying to help someone track down where some stuff from
an auctioned storage space went, and just for curiosity to see who keeps winning against
me.
Seems to me that one can avoid even potential scam second chance offers by just going
through the eBay web interface. That won't protect against shill bidding, but would
filter out spoofed emails. I pretty much never interact with eBay emails I get except to
file them away, I just go to the web interface to deal with whatever it was.
-Paul
15 Apr
15 Apr
3:31 a.m.
On Sun, 14 Apr 2013, Paul Hagstrom wrote:
On Apr 14, 2013, at 9:20 PM, Jim Stephens <jws at
jwsss.com> wrote:
The two letters in the obscured userid can be in any order and from
anywhere in the normalized userid and the same letter could even be used
twice.
On 4/14/2013 5:30 PM, mc68010 wrote:
It is indeed relatively easy to find people's eBay IDs with some
patience, since the obscured ID still contains two accurate letters (in
reverse order, I believe, at least in all the cases I've found) but an
accurate feedback number (which changes, so the delta can also be
checked over time), so looking through feedback for likely
buyers/sellers who might have interacted with them for matching feedback
numbers often can un-obscure the eBay ID. I did that for a while trying
to help someone track down where some stuff from an auctioned storage
space went, and just for curiosity to see who keeps winning against me. On 4/14/2013 5:12 PM, William Donzelli wrote:
>> Someone *must* have cracked the ebay database...
THey can contact me if they can guess my ebay id. but it is worlds
away from anything i use for email. I think MIke's point was it was an
ebay looking approach @ his email address. I get my email from ebay
thru a distantly related oddball server and then respond thru ebay
messages. Unless i reply thru there or send my email address by
replying to a message from my main email I will never get email there
that is legit.
The other way to discover ID's by the way which I'm using is to watch
feedback to sellers who don't like. BUt that still only gives an ebay
ID unless you happen to associate your ebay ID with an email address
somewhere.
4150
days inactive
4152
days old
7 comments
8 participants
participants (8)
-
cclist＠sydex.com -
dave.thearchivist＠gmail.com -
jws＠jwsss.com -
mc68010＠gmail.com -
paulhagstrom＠me.com -
tmfdmike＠gmail.com -
tothwolf＠concentric.net -
wdonzelli＠gmail.com