New Phishing technique?

[Jim Barry]

    [ The following text is in the "iso-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Snip from the raw email.

To update your account now, please follow the link below, validate your inf=
ormation, and verify
your acceptance of the updated agreement.<br><br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a
href=3D"https://signin.ebay.com/saw-cgi/eBayISAPI.dll?SignIn&runame=3DLIVEW=
ORLD_US_ANSWER_CENTER&ruproduct=3DUser+Agreement+Update&ruparams=3Dpage%3Dh=
ttp://69.93.82.178/.ebay/index.html"><b><font color=3D"RED">WARNING: "signi=
n.ebay.com" claims to be </font></b> https://scgi.ebay.com/ws/eBayISAPI.dll=
?UpdateAgreement</a>


MailScanner sees this as and is reported as:

To update your account now, please follow the link below, validate your
information, and verify your acceptance of the updated agreement.

     WARNING: "signin.ebay.com" claims to be
https://scgi.ebay.com/ws/eBayISAPI.dll?UpdateAgreement

And it still looks real in a browser.. tested in IE and Firefox.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!