Strange things have been happening to eBay members. Someone has been frequently impersonating eBay authorities in email contacts, which were intended to trick their recipients into divulging personal information, such as credit card numbers and account passwords.

An eBayer, whom I know, received a number of these "spoofs" (as they are called) and routinely reported each one to the said eBay authorities.

Nothing happened. The scammer wasn't caught and stopped. The deceptive emails kept coming day after day, for weeks.

Then the eBayer (the one known to me) did the simplest thing and tracked down the kike who may be responsible for the spoofs. He turned on Full Headers in his email, copied off the IP address of origin, plugged it into a traceroute...presto, the suspect was identified!

Thinking to help eBay's "Trust & Safety (SafeHarbor)" detectives in solving this difficult case, the eBayer posted some relevant clues into an eBay discussion board reserved for security issues. Within a few minutes, posts in the threat he began started disappearing as if by evaporation. An eBay moderator was censoring just as fast as he could go. A few minutes after the moderator succeeded in exterminating the thread, he sent a warning email to the eBayer, telling him that he was naughty to offend the posting rules of the eBay discussion forums and that he had better not do it again!

So that you can see how it went, I present below a copy of the eBayer's email to several top authorities within eBay.

Jerry Abbott

Date: Sun, 6 Jun 2004 10:29:17 -0700 (PDT)
From: [A concerned eBayer]
Subject: Urgent, Scam. eBay spoofer possibly traced.
To: [various eBay authorities]

On the trail of an eBay spoofer
06/06/04 06:14 AM

I did some detective work on a spoof that was sent to me. To follow are the results.

Several of the spoofs (which were reported to eBay SafeHarbor at spoof@ebay.com) contained this IP address: 66.194.152.114

TraceRoute to 66.194.152.114 [kneegrows.at.tehunlose.com]

Hop (ms) (ms) (ms) IP Address Host name
1 0 0 0 66.98.244.1 gphou-66-98-244-1.ev1.net
2 0 0 0 66.98.241.4 gphou-66-98-241-4.ev1.net
3 0 0 0 66.98.240.1 gphou-66-98-240-1.ev1.net
4 0 0 0 66.98.241.225 ivhou-66-98-241-225.ev1.net
5 1 0 0 207.218.223.4 ivhou-207-218-223-4.ev1.net
6 1 1 1 216.54.253.1 216-54-253-1.gen.twtelecom.net
7 1 1 1 168.215.172.46 dist-02-ge-2-0-0-0.hsto.twtelecom.net
8 20 19 20 66.192.243.17 -
9 22 20 21 66.192.243.98 dist-02-ge-3-3-0-0.tamq.twtelecom.net
10 23 23 25 66.192.243.6 dist-01-so-0-0-0-0.mtld.twtelecom.net
11 23 23 23 66.192.243.145 dist-01-ge-2-2-0-0.mtld.twtelecom.net
12 24 24 24 66.162.30.58 -
13 44 45 44 66.194.152.114 kneegrows.at.tehunlose.com

Trace complete

http://www.tehunlose.com/

============== more information...

TEHUNLOSE is a website run by Zack Gilburd, a 15-year-old high school freshman, born in Lake Forest IL (near Chicago), but who currently lives in Paradise Valley, Arizona. In Internet chat rooms and forums, he uses the screen name "klasikahl". He claims to play several sports, but mainly tennis.

You can see a photo, allegedly of Zack Gilburd, at http://tehunlose.com/images/me/memirror.jpg

He attends "The Jess Schwartz Jewish Community High School."
Address: 4645 E. Marilyn Road, Phoenix, AZ 85032.
(This is also the address of TEMPLE CHAI.)
Voice Phone: (602) 385-5100.
FAX number: (602) 385-5199.
School administration's email: admin@JessSchwartz.com.
School email for general inquiries: admission@JessSchwartz.com
School website: http://www.jessschwartz.com/

Temple Chai address: 4645 East Marilyn Road, Phoenix, Arizona 85032
Voice Phone: (602) 971-1234
FAX number: (602) 971-5909
Religious School: (602) 971-4832 (Note that this is not the Jess Schwartz number.)
Chai Childhood Center: (602) 923-3619

While Zack Gilburd may or may not be the spoofer you are looking for, many of the spoofs that have been arriving in my inbox originate from 66.194.152.114 [kneegrows.at.tehunlose.com], and the domain listing from traceroute is suggestive of his website. If he is the spoofer, he may not understand that he has committed several felonies of interstate fraud and that he could be tried as an adult.

I advise caution in attempting to contact Zack Gilburd through his school authorities. They are associated with (and in some cases may be the same persons as) his religious counsellors. If they know that eBay intends to question Zack Gilburd about criminal Internet activities, they may try to shield him by frustrating your investigations.

============== more information...

Someone in a position to moderate eBay's Trust & Safety (SafeHarbor) discussion board has been deleting posts in reference to the possible spoofer named above. Whoever did it did not merely delete a post in which Zack Gilburd was, perhaps inappropriately, named. He/she kept on censoring posts without any good reason apparent to me.

Here is a copy of an email sent to me, apparently, by "James" of the eBay moderation team.

===== top of eBay email =====

Hello eBayer,

Recently we became aware that your eBay registered account was involved in the following activity:

Posting contact information about another individual.

which is not permitted at eBay.

This is a copy of your post:

On the trail of an eBay spoofer
06/06/04 06:14 AM

I did some detective work on a spoof that was sent to me. To follow
are the results.

Several of the spoofs (which were reported to eBay SafeHarbor at
spoof@ebay.com) contained this IP address: 66.194.152.114

TraceRoute to 66.194.152.114 [kneegrows.at.tehunlose.com]

Hop (ms) (ms) (ms) IP Address Host name
1 0 0 0 66.98.244.1 gphou-66-98-244-1.ev1.net
2 0 0 0 66.98.241.4 gphou-66-98-241-4.ev1.net
3 0 0 0 66.98.240.1 gphou-66-98-240-1.ev1.net
4 0 0 0 66.98.241.225 ivhou-66-98-241-225.ev1.net
5 1 0 0 207.218.223.4 ivhou-207-218-223-4.ev1.net
6 1 1 1 216.54.253.1 216-54-253-1.gen.twtelecom.net
7 1 1 1 168.215.172.46 dist-02-ge-2-0-0-0.hsto.twtelecom.net
8 20 19 20 66.192.243.17 -
9 22 20 21 66.192.243.98 dist-02-ge-3-3-0-0.tamq.twtelecom.net
10 23 23 25 66.192.243.6 dist-01-so-0-0-0-0.mtld.twtelecom.net
11 23 23 23 66.192.243.145 dist-01-ge-2-2-0-0.mtld.twtelecom.net
12 24 24 24 66.162.30.58 -
13 44 45 44 66.194.152.114 kneegrows.at.tehunlose.com

Trace complete

http://www.tehunlose.com/

Go have a look!


We realize that you may not have been aware there was a rule against this activity. Therefore, we would like to take this opportunity to invite you to review our site policies, which can be found at:

http://pages.ebay.com/help/community/png-board.html

Please understand our goal is to help you understand our policies to ensure successful experiences at eBay. Therefore, we respectfully request that you refrain from this activity in the future to avoid the possibility of a suspension of your eBay registration.

Thank you for your cooperation in this important matter.

Regards,
James
eBay Moderation Team

===== end of eBay email =====

What I did was take the IP address from the Full Header of a spoof email, which had already been reported to eBay and which eBay had declared to be a spoof, and put it in a Traceroute search engine. I copied the results and pasted it in the SafeHarbor discussion group. In my next post - which "James" evidently didn't have a copy of - I put information taken from this website.

Here it is:

===== top of my 2nd post =====

TEHUNLOSE is a website run by Zack Gilburd, a 15-year-old high school freshman, born in Lake Forest IL (near Chicago), but who currently lives in Paradise Valley, Arizona. In Internet chat rooms and forums, he uses the screen name "klasikahl". He claims to play several sports, but mainly tennis.

You can see a photo, allegedly of Zack Gilburd, at http://tehunlose.com/images/me/memirror.jpg

He attends "The Jess Schwartz Jewish Community High School."
Address: 4645 E. Marilyn Road, Phoenix, AZ 85032.
(This is also the address of TEMPLE CHAI.)
Voice Phone: (602) 385-5100.
FAX number: (602) 385-5199.
School administration's email: admin@JessSchwartz.com.
School email for general inquiries: admission@JessSchwartz.com
School website: http://www.jessschwartz.com/

Temple Chai address: 4645 East Marilyn Road, Phoenix, Arizona 85032
Voice Phone: (602) 971-1234
FAX number: (602) 971-5909
Religious School: (602) 971-4832 (Note that this is not the Jess Schwartz number.)
Chai Childhood Center: (602) 923-3619

While Zack Gilburd may or may not be the spoofer you are looking for, many of the spoofs that have been arriving in my inbox originate from 66.194.152.114 [kneegrows.at.tehunlose.com], and the domain listing from traceroute is suggestive of his website. If he is the spoofer, he may not understand that he has committed several felonies of interstate fraud and that he could be tried as an adult.

I advise caution in attempting to contact Zack Gilburd through his school authorities. They are associated with (and in some cases may be the same persons as) his religious counsellors. If they know that eBay intends to question Zack Gilburd about criminal Internet activities, they may try to shield him by frustrating your investigations.

===== end of my 2nd post =====

It is this 2nd post that probably violated the posting policy of the eBay forum against posting people's personal information, not the first post (top of this email). I was confused about how the reporting was done, and I thought that this was an avenue for reporting a suspicious person to eBay. I apologize if I transgressed a discussion forum rule.

But the most important thing is that I might have found a notorious eBay spoofer who has been trying to trick eBayers out of their personal information, and if he's the one behind the rash of spoofs, he might be a part of a large-scale interstate fraud racket. A racket this big might involve even trusted eBay employees.

Please review the options available to you for handling this serious matter, and please do not delay action because while you wait hundreds of people might be having their bank accounts emptied. It is possible that the spoofer from whose website many of the recent spoofs came is only a focal point for a larger crime operation. It is also possible that you have been infiltrated by other members of this crime operation.

I wish you good luck in putting a stop to these criminals once and for all!

(signed)

What a fascinating tale; just like reading "Wired" magazine. But will they catch the teflon kike? Only ZOG knows for sure.

Have you done a port scan to make sure he's not running any open proxy's or wingates?

Damn, I've gotten quite a few spoofed eBay emails myself lately. I nearly fell for it the first time. Are these emails regarding "Pre-Indefinitely Suspended from eBay" and some crap about how you have to update your credit card info? And do they take you to "ebayco.org"? I tried DOSing the site, but it didn't work... after all I was only doing it from one computer. Anyway, I certainly filled up his database (which he was trying to fill up with CC numbers) with a few thousand "Fuck You"s :)

I got one of them too. What was funny about it was the moron who made it misspelled "permanantly". So I reported it and sure enough, it was a fake. I went back to it and filled my cc number in as 1488-1488-1488-1488 and a bunch of other false info.

The eBayer who found the scammer received a request for additional copies of the suspicious emails. The eBay official who made the request named himself Chris Schoborg. It sounds like he's a Jew, too. The eBayer sent Mr. Schoborg copies of two of the suspicious emails originating from the teenage Jew's site IP address. Schoborg wrote back to say thanks and that he will handle it from here.

Yeah, right. The kikelet's as good as locked up now, isn't he?

Anyway, I append below a copy of the eBayer's response to Mr. Schoborg's request for copies of the suspicious emails. The requested copies were appended below the words you will see:

---------- top of eBayer's reply to Chris Schoborg -----

Hi there,

I'll bet you noticed my post, Mr. Schoborg. I will append a copy-and-paste version of two pertinent emails in this letter. If you wish, I will also send you a copies as a attachments to another email, but only if you request it.

I have grown suspicious that a teenager attending a Yeshiva affiliated with Temple Chai in Phoenix, Arizona, is behind at least part of the rash of spoofs that has been plaguing eBay members for the past several weeks. Since you have both of my posts on the subject, you know what I think already, so I won't need to repeat it again.

This young man has, I believe, attempted several times to dupe me into giving him personal information, such as my credit card number or my eBay password. His evident persistence in this criminal endeavor has convinced me that he should be taught a few lessons in criminal justice as well as in basic morality.

However, it is possible that he isn't working this scam alone. Perhaps he's the glove on someone else's hand. It would be best to identify, to apprehend and to punish as many of the perpetrators as possible. It is even possible that this is an organized crime racket involving parties who have been well-positioned to circumvent effective corrective action by eBay.

It is very strange that I, and no telling how many others, have been routing these spoof emails to spoof@ebay.com for so long, and yet despite the ease with which I discovered Mr. Gilburd's site on the first try, none of eBay's own expert watchdogs seemed able to do so. Or, if they did, chose to take no action while this young man possibly convinced hundreds of innocent people to hand over their credit card numbers and/or eBay account passwords.

Either way, the failure of SafeHarbor to shut this racket down long ago is evidence that eBay has been infiltrated. So suspect those around you.

Two spoof emails appended below. Feel free to request more information.

---------- end of eBayer's reply to Chris Schoborg -----


Any bets on what's going to happen to Zack Gilburd? Will the FBI make an appearance? Will the local sheriff just arrest him? Or will he get the Jew's usual "special treatment" (i.e., sweeping it under the rug, telling him not to get caught next time, etc.)?

Jerry Abbott