Phishers target South Africa's BidorBuy auction website

Filed Under: Phishing, Spam

South African internet users should be on their guard as a wave of phishing emails have been spammed out pretending to be from the country's largest internet auction website.

Emails intercepted by Sophos pretend to be from BidorBuy, and claim that the recipient's account details have been stolen:

Bidorbuy phishing email

Attention! Your BidorBuy account was stolen!
This is a must to ensure that only you have access and use of your BidorBuy account and to ensure a safe BidorBuy experience.

You can well understand that people might be alarmed if they receive a message saying their account has been stolen - imagining that someone else might be purchasing goods in an online auction using their details.

Clicking on the link, however, doesn't take you to the real BidorBuy website but instead takes you to a phishing page set up on a Russian webserver.

It's worth everybody remembering that phishing gangs and cybercriminals don't just target users of multinational global brands such as eBay, PayPal and iTunes. They can also launch attacks targeted on local websites - hoping to make rich pickings if computer users aren't wary enough.

, , ,

You might like

3 Responses to Phishers target South Africa's BidorBuy auction website

  1. Phishing is a common problem across many ecommerce sites. At bidorbuy we have educated our users for the last few years about phishing scams via our blog and weekly newsletters -

    Users of our site should know, that logins are always served via SSL and show the green bidorbuy logo in the address bar as we use Thawte Extended Verification SSL certificates.

    Our email is digitally signed via DKIM and DK and GMail/Yahoo will actually display that email is sent from a trusted sender (= bidorbuy).

    It would be great if security products and their email client plugins would honor and validate digital email certificates and half the phishing problem would be a non-issue. Google and Yahoo can do it, it's quite puzzling that your Security suites are not capable of marking forged email based on DKIM signatures.

  2. T.Anne · 1654 days ago

    I've seen these types of emails too - I think it's wise for people (scared by the email or not) to go to the site directly, log in and see if they find anything. Clicking the link is always wrong - if it's legit, you'll see something when you log in directly.

  3. candy2011 · 393 days ago

    I don't blame people for hacking bidorbuy.. how else could you vow concerns/dissatisfaction?
    They act like dictators.. they alone are right.. If you dare to differ from them, they block/blacklist you..

    I do not encourage hacking, but fully understand why these individuals did this.

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

About the author

Graham Cluley runs his own award-winning computer security blog at, and is a veteran of the anti-virus industry having worked for a number of security companies since the early 1990s. Now an independent security analyst, he regularly makes media appearances and gives computer security presentations. Follow him on Twitter at @gcluley