I was surfing eBay looking at second gen Camaro's and ran across a new exploit. New to me at least.

There was a red '70 model that looked pretty nice with a starting bid of $4,851. When I clicked on it, the eBay login page popped up. It looked exactly like eBay's login page, but I was immediately suspicious because I've never had to login in order to view auctions. I hit "back" a couple of times and the browser couldn't leave the fake login page. I closed Internet Explorer and my anti-virus software picked up a trojan!

Apparently some ^&*(@#$ hacker wannabe had embedded a javascript URL redirect trojan in their auction text. I presume the intent was to steal eBay uid's and pw's and place orders or try to hack the associated PayPal accounts. I sent the particulars (auction id, trojan name, and Symantec's breakdown of the impact) to eBay's fraud department and they had the auction removed within an hour.

Moral of the story; run good firewall and anti-virus programs with up-to-date definitions.

Here are some details on this particular one from Symantec.
JS.Trojan.Blinder - is an embedded JavaScript Trojan horse that spoofs the URL displayed in the browser address bar. The page displayed is a form that requests personal banking and ATM information. This may lead a user to believe that they are visiting a trusted Web site, when they are actually browsing a malicious Web site.

Apparently this has been around a while; here's a link (http://www.infectionvectors.com/vectors/phishing_lures.htm) from April of 2005 with some info.

I just ran across the same thing, asking me to log in, but the url changed to http://www.vreausaict.net.ms/

Happened to me yesterday it seemed the login page was floating...crash

Happened to me yesterday it seemed the login page was floating...crash

http://www.vreausaict.net.ms/ Nice catch! Did you send this to eBay's fraud group? Hopefully they'll put a filter in the script they use to generate the auctions that will cull this mess.

o snap.....i think i goofed. I need to be more careful.

I know this is an old thread, but ebay has permitted this phishing technique to go on for more than a year, so beware. For example:

http://cgi.ebay.com/ebaymotors/1969-Chevrolet-Camaro-Victory-Red_W0QQitemZ180122260881QQihZ008QQcategoryZ6161QQ rdZ1QQcmdZViewItem

will redirect to an authentic looking, but fake ebay page.

Ebay needs to get its act together.

Another one I ran across recently was in the Q&A section for an auction. A bidder was basically accusing the seller of fraudulent activity (listing the item for sale on multiple sites) and pasted a URL that looked to be a scammer list as part of his question. When I checked the URL it asked me to log in (ebay). I did; doh! but immediately realized the blunder and changed my password. About four days later I received a TKO notice from ebay indicating I had tried to log in three or four times with the wrong password so ebay locked my account. Frickin' hackers were trying to get into my ebay account. Caveat emptor indeed.