As you see from the screenshot, the page is a replica of the eBay login screen. However, the URL is not on the ebay.com domain. The status bar indication is spoofed.
The site acts as a 'man-in-the-middle' between the potential victim and the real ebay.com. It would pass the entered information to the legitimate site and will attempt a login. If the login fails, ebay.com it will return an error, and the phish site will display an error message. If the login succeeds, the phish site will save the login information and will redirect the browser window to the ebay.com account opened. To the outside user, this procedure creates an immitation of an ebay.com login, but the username and password are intercepted by the scammers - that's why it's dangerous.
Here is the WHOIS data of the phish site itself: |
