Did you copy-and-paste the URL or did you click on it? Most of the ones I've seen have the actual URL be something like "http://www.ebay.com:crappassword@realhostname/blah", so it looks a lot like a real ebay url, but is not. Also, it wouldn't be very hard for them to automate taking the username and password you enter and toss it at the real eBay to see if it checks out.