This is a fresh phish case, which uses a 'hijacked' domain - i.e. the phishers have obtained remote access to a legitimate site and placed the phish site there. This way they can use the whitelist entries for the legitimate domain, and get through a URL blacklist filter.

The email looks quite persuasive:

The phish site opens up with a page that is an exact replica of the eBay login page, with only a couple of differences:

• The URL in the address bar is different (i.e. not an ebay.com derivate);
• The page is a 'http' one (unsecured). The legitimate page is on a 'https' secured site.

The site will check whether the fields are filled, and will check the credit card number using the Luhn formula. It is a simple mathematical formula, typically used for a first stage CC verification (i.e. - before connectiong to a CC server). The function of this check is to reject a random bogus number, thus to imply legitimacy of the site. It will, of course, accept a bogus number conforming to the Luhn formula rule.

After accepting the information, a standard looking logout page is displayed: