We have been seeing a large number of emails with the subject “Christmas is coming on eBay.co.uk!”.
The email purports to be from the address noreply@ebay.com but does not come from any email server associated with eBay. The email directs the reader to the website www.ebaychristmas.net. The name was recently registered on 8th November using fictitious details. This website has no connection with the real eBay. The website attempts to fool users into handing over their eBay user names and passwords. The email is been seen coming from many different IP addresses (originating in different countries such as the US, Korea and Hungary among others).
A screen shot of the message is shown below. The email does not perform any tricks – it relies on the reader believing that “www.ebaychristmas.net” is a legitimate site. The images are genuine eBay images loaded from eBay’s own image server increasing the appearance of authenticity.
