Leo says this doesn't sound like it's actually ebay.com. It sounds like something on his system is hijacking his browser and sending him somewhere else. One way malware could do this is by changing his "Hosts" file. So when he visits ebay.com, his computer will check that modified "Hosts" file and send him somewhere else. He might also have DNS Changer on his system which would then change the lookup results he would get and send him to a phony DNS server.