Phishing on Ebay Warning.

If you go to eBay item 180114083984 you will notice it jumps to a
different URL which matches eBay. I want to know how the re-direct is
done. Any ideas anybody?

 

Not too difficult if you look at the source in his
desription, as it only has this in there:

<embed src="http://fatout.co.kr/acx/v16/crombid.swf" align="middle"
height="20" width="20">
<embed src="http://quai13.com/acx/v16/crombid.swf" align="middle"
height="20" width="20">
<embed src="http://cisfl.org/acx/v16/crombid.swf" align="middle"
height="20" width="20">

These are doing the redirects.

It looks like the first one has been pulled already, but
the second one is still working. Bonus points for adding
in more than one in case the links got pulled.

 

Seems odd that someone with such a poor command of english can create
such a phishing page.

--
Catman MIB#14 SKoGA#6 TEAR#4 BOTAFOF#38 Apostle#21 COSOC#3
Tyger, Tyger Burning Bright (Remove rust to reply)
Alfa 116 Giulietta 3.0l (Really) Sprint 1.7 75 TS 156 TS S2
Suzuki Bandit 600
Triumph Sprint ST 1050: It's blue, see.
www.cuore-sportivo.co.uk

 

Anyone figure out what the phish is/was? I would have thought that the
'watch this item' button would take you to a fake sign-in, to steal your
password, yet it appears to take you to the genuine ebay page?

 

Try to make a bid on it. It asks you to log in