That link has some sort of tracker in it. When I clicked on it I was not taken to the message/link you described but to a previous eBay website I had visited previously with a message saying the seller had a private message for me.... I deleted immediately.

 

Have you looked at that link? I'm not sure its something safe to click on.

 

It took me to a website that looked exactly like an eBay second chance offer page with the car and description. The BIN was $15k and knew that was bull**** since the car has been sold.

Here's the email address it came from : bounce-cgi-glo.key00l1@eigbox.net

Here's everything else for you computer savoy folks:

Return-Path: bounce-cgi-glo.key00l1@eigbox.net
Received: from spam01.embarq.synacor.com (LHLO smtpout01.embarq.synacor.com)
(10.50.1.1) by md13.embarq.synacor.com with LMTP; Mon, 6 Jul 2009 16:39:14
-0400 (EDT)
Return-Path: <bounce-cgi-glo.key00l1@eigbox.net>
X-BINDING: md13.embarq.synacor.com
X-Spam-Rating: None
X_CMAE_Category: 0,0 Undefined,Undefined
X-CNFS-Analysis: v=1.0 c=1 a=29CDObagRtgA:10 a=pwIP7ZobAAAA:8 a=pjdaNNIBAAAA:8 a=tygzqC31AAAA:8 a=1oqGTYSLAAAA:8 a=vsoQSRITZN0b0fM093IA:9 a=_F4-lyaoMmqhFU2CHxEA:7 a=ymeI5QDwnHnQPVgJrW1mhBII_AgA:4 a=CUAj1EnapdYA:10 a=zuRykA-UsXsA:10 a=G9sjiJ229_IA:10 a=koFZcFhfEFkA:10 a=IMkWLUS_yO0A:10 a=9maWdmVXNeAA:10 a=peoA0pe4ZCcA:10 a=vwhBCz9viwIA:10 a=cvn8laQl214A:10 a=MUP_5pyeRPlpvY4H:21 a=41I_cKt8ktxsAOFo:21
X-CM-Score: 0
X-Scanned-by: Cloudmark Authority Engine
Authentication-Results: spam01.embarq.synacor.com smtp.mail=bounce-cgi-glo.key00l1@eigbox.net; spf=pass
Received-SPF: pass (spam01.embarq.synacor.com: domain eigbox.net designates 66.96.190.9 as permitted sender)
Received: from [66.96.190.9] ([66.96.190.9:55063] helo=bosmailout09.eigbox.net)
by smtp.embarq.synacor.com (envelope-from <bounce-cgi-glo.key00l1@eigbox.net>)
(ecelerity 2.2.2.36 r(27513/27514)) with ESMTP
id 43/37-00608-2F0625A4; Mon, 06 Jul 2009 16:39:14 -0400
Received: from bosmailscan25.eigbox.net ([10.20.15.25])
by bosmailout09.eigbox.net with esmtp (Exim)
id 1MNuy1-0004fi-Sz
for hawkdaddy138@embarqmail.com; Mon, 06 Jul 2009 16:39:13 -0400
Received: from bosimpout01.eigbox.net ([10.20.55.1])
by bosmailscan25.eigbox.net with esmtp (Exim)
id 1MNuy1-000360-Q6
for hawkdaddy138@embarqmail.com; Mon, 06 Jul 2009 16:39:13 -0400
Received: from boscgi2302.eigbox.net ([10.20.12.223])
by bosimpout01.eigbox.net with NO UCE
id Ckcj1c00h4okbCA0000000; Mon, 06 Jul 2009 16:36:43 -0400
X-EN-OrigOutIP: 10.20.12.223
X-EN-IMPSID: Ckcj1c00h4okbCA0000000
Received: from glo.key00l1 by boscgi2302.eigbox.net with local (Exim)
id 1MNuxO-0007qx-NE
for hawkdaddy138@embarqmail.com; Mon, 06 Jul 2009 16:38:34 -0400
X-EN-Info: U=glo.key00l1 P=/stats/pme.php
X-EN-CGIUser: glo.key00l1
X-EN-CGIPath: /stats/pme.php
X-EN-OrigIP: 172.129.231.202
Message-Id: 1246912714-171-glo.key00l1@boscgi2302.eigbox.net
To: hawkdaddy138@embarqmail.com
Subject: You have a second chance offer
MIME-Version: 1.0
Content-type:text/html;charset=iso-8859-1
From: eBay <SecondChanceOffer@ebaymotors.com>
Reply-To: SecondChanceOffer@ebaymotors.com
X-EN-Timestamp: Mon, 06 Jul 2009 16:38:34 -0400
Date: Mon, 06 Jul 2009 16:38:34 -0400
Sender: eBay <SecondChanceOffer@ebaymotors.com>

 

When I clicked on it, it took me to the eBay home page... with my eBay user name and recently viewed auctions displayed -as normal.

What do you see that makes you think it isn't safe Mike?

 

The actual link isn't what it appears to be. Spaces added to make it not a link and show the whole mess. Anybody know how paranoid I should be after clicking that link, then immediately closing the page?

http:// jbrlsr.com /?aid=5336118867&bid=3196529&url=http%3A%2F%2Fcgi.ebay.com.ebaymotors.ws. ebayisapi.dll.copartnerid2.w0qqcmdztrkparms.sitepagetype.w0qqitemz.hds65 .co.cc%2Fsw.php%3FViewItem%26item%3D345402691353

 

David... there may be a problem in the embarq system, which I notice you are a client of (references in blue), and that it is somehow noted as spam mail (in red).

Also, it appears to have bounced back and forth between several IP addresses in the eigbox.net system to prevent tracking (in green). Without any further training in this... it would appear that the bosmail or boscgi and how it states bounce occasionally, that this has perhaps originated in Bosnia.

Just a theory.

 

Mike... when a URL is shown on a post, it has a lot of spaces or "..." because they are usually very long. It is condensed automatically.

Another clue to source may be the beginning of the link: http:// jbrlsr.com /? -I now see the spaces you were talking about.

If your anti-virus, anti-spyware & firewall are all up-to-date, then you should be fine! I'm crossing my fingers, too!

 

Damn, that's clever. It's safe until you click on one of the links on the fake site. I will report to EBay tonight.

Joe

 

Some of you folks are way yonder smarter than me.

I have no idea of what you just said, sounded good though.

 

That's a scam guys, called phishing. You're looking at a relay link to an outside fake site designed to do one thing, harvest credit information leading to identity theft. Check the root urls (jbrlsr DOT com and hds65 DOT co DOT cc), while they have the word 'ebay' in them they don't refer to that domain at all. That's called a 'cloaked' URL. Those sites can harvest a TON of information even if you don't actively type in something, and they will leave footprints. Run away quickly.

If you clicked on that link it's a given you have a tracking cookie on your system at a minimum, possibly more. Be very careful what you type in online now, I'm not kidding. Get a good spyware scan on your system right away and for heaven's sake DON'T buy anything online until you are sure you are clean.

 

Joe, you should edit your OP and take out the link, if what I am reading is true.

 

OMG... I feel dirty and violated.. I can still smell the faint aroma of old whiskey on the back of my neck.. U..Uh..U..Uncle Cleatus..is that you again.. I need a shower...

 

Screw it, I hit the BIN for $15k, Joe I'll be there by Friday to drive my GTS home.

 

Just got back up after being infected with some virus ealrier today when I clicked on that link. Took hours and hours to get back up to speed. Now I am paranoid to perform any online banking activities to include PayPal. Another vote to move to a Mac.

 

David it's the link you posted, not Joe's original auction. You should edit and delete the link...and anyone else who quoted it should too.