Phishtale

Ooh, those wiley phishers are at it again. This one got past both of my junk mail filters (Postini and the one in Outlook 2003) by posing as aw-confirm@eBay.com. Since we recently made a purchase over eBay, that address is allowed through both filters. Here’s the message:

First reaction: pulse quickens and blood pressure jumps. Somebody’s made a mistake and billed me for something I didn’t buy. I better click on the link and see what’s going on.

And that would be the first step into the scam.

Two things tipped me off. First, the message is to “undisclosed-recipients:”. eBay always sends its messages to the e-mail account on file.

Second thing. I almost never click on a link in an e-mail without first inspecting the link. Right click in the message body, and select “View source”, then when notepad comes up, Ctrl-F to search for “href=” (find all the links). If they aren’t on an eBay server, they’re bogus. The first few links are on eBay, but the money punch is not:

It still looks pretty legit at first glance (it’s complicated enough, isn’t it?), but all you really need to look at is the server name: toons.hu. The TLD (top-level domain) “hu” means that it’s a site somewhere in Hungary — and I bet they can’t wait to sink their teeth into my credit card.