ebay-issusefix.com Open in urlscan Pro
67.225.242.29 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://ebay-issusefix.com/
Effective URL:
http://ebay-issusefix.com/signin/?cmd=_login&dispatch=885e159277067983e0447bf6a&locale=en_GB
Submission: On September 24 via manual (September 24th 2019, 8:14:26 am UTC) from IE

Summary HTTP 16 Redirects Links 7 Behaviour Indicators

Summary

This website contacted 9 IPs in 5 countries across 7 domains to perform 16 HTTP transactions. The main IP is 67.225.242.29, located in Lansing, United States and belongs to LIQUIDWEB - Liquid Web, L.L.C, US. The main domain is ebay-issusefix.com.

This is the only time ebay-issusefix.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: eBay (E-commerce)

Domain & IP information

	IP Address	AS Autonomous System
1 7	67.225.242.29 67.225.242.29	32244 (LIQUIDWEB) (LIQUIDWEB - Liquid Web)
1	62.210.169.80 62.210.169.80	12876 (AS12876) (AS12876)
1	66.135.214.209 66.135.214.209	11643 (EBAY) (EBAY - eBay)
2	2a00:1450:400... 2a00:1450:4001:814::2001	15169 (GOOGLE) (GOOGLE - Google LLC)
1	2.18.234.107 2.18.234.107	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
1	2.18.234.244 2.18.234.244	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
2	23.210.248.226 23.210.248.226	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
1	66.211.177.111 66.211.177.111	11643 (EBAY) (EBAY - eBay)
1	209.140.145.151 209.140.145.151	11643 (EBAY) (EBAY - eBay)
16	9

7 67.225.242.29 (Lansing, United States) 1 redirects

ASN32244 (LIQUIDWEB - Liquid Web, L.L.C, US)

ebay-issusefix.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 62.210.169.80 (France)

ASN12876 (AS12876, FR)
PTR: 62-210-169-80.rev.poneytelecom.eu

3.top4top.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 66.135.214.209 (United States)

ASN11643 (EBAY - eBay, Inc, US)

rover.ebay.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:814::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

yahyazarir.blogspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.18.234.107 (Ascension Island)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a2-18-234-107.deploy.static.akamaitechnologies.com

secureir.ebaystatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.18.234.244 (Ascension Island)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a2-18-234-244.deploy.static.akamaitechnologies.com

ir.ebaystatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.210.248.226 (Netherlands)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a23-210-248-226.deploy.static.akamaitechnologies.com

c.paypal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 66.211.177.111 (United States)

ASN11643 (EBAY - eBay, Inc, US)

signin.ebay.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 209.140.145.151 (United States)

ASN11643 (EBAY - eBay, Inc, US)
PTR: srv.ebayrtm.com

srv.main.ebayrtm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	ebay-issusefix.com 1 redirects ebay-issusefix.com	91 KB
2	paypal.com c.paypal.com	18 KB
2	ebaystatic.com secureir.ebaystatic.com ir.ebaystatic.com	41 KB
2	blogspot.com yahyazarir.blogspot.com
2	ebay.com rover.ebay.com signin.ebay.com	752 B
1	ebayrtm.com srv.main.ebayrtm.com	340 B
1	top4top.net 3.top4top.net	5 KB
16	7

	Domain	Requested by
7	ebay-issusefix.com	1 redirects ebay-issusefix.com
2	c.paypal.com	ebay-issusefix.com c.paypal.com
2	yahyazarir.blogspot.com	ebay-issusefix.com
1	srv.main.ebayrtm.com	ebay-issusefix.com
1	signin.ebay.com	ebay-issusefix.com
1	ir.ebaystatic.com	ebay-issusefix.com
1	secureir.ebaystatic.com	ebay-issusefix.com
1	rover.ebay.com	ebay-issusefix.com
1	3.top4top.net	ebay-issusefix.com
16	9

This site contains links to these domains. Also see Links.

Domain
www.ebay.com
scgi.ebay.com
pages.ebay.com
cgi6.ebay.com
trustsealinfo.websecurity.norton.com

Subject Issuer	Validity	Valid
*.top4top.net AlphaSSL CA - SHA256 - G2	`2018-03-03` - `2020-04-03`	2 years	crt.sh
rover.ebay.com DigiCert SHA2 Secure Server CA	`2019-09-16` - `2020-09-16`	a year	crt.sh
www.ebay.com DigiCert SHA2 Secure Server CA	`2019-07-17` - `2020-08-18`	a year	crt.sh
www.paypal.com DigiCert SHA2 Extended Validation Server CA	`2019-09-10` - `2020-08-18`	a year	crt.sh
signin.ebay.com DigiCert SHA2 Secure Server CA	`2019-05-23` - `2020-06-12`	a year	crt.sh
srv.ebayrtm.com DigiCert SHA2 Secure Server CA	`2019-03-27` - `2020-03-27`	a year	crt.sh

This page contains 4 frames:

Primary Page: http://ebay-issusefix.com/signin/?cmd=_login&dispatch=885e159277067983e0447bf6a&locale=en_GB
Frame ID: 71D05175FCD4679FE1DD03653D4A218C
Requests: 12 HTTP requests in this frame

Frame: https://c.paypal.com/da/r/fb-all-prod.pp.min.js
Frame ID: 00235C5FF705AE3BB8FF60945BC7422D
Requests: 2 HTTP requests in this frame

Frame: https://signin.ebay.com/t_n.html?org_id=usllpic0&session_id=4f7d134b15b0a84d0652cc12fff854d3
Frame ID: BE9D3CFC1124A36D8F5C739FB24EA9BE
Requests: 1 HTTP requests in this frame

Frame: https://srv.main.ebayrtm.com/rtm?RtmGetCapJs&p=18&rqid=4f7d134b15b0a84d06510731ffd62469&cb=parent.window.updateRtmField
Frame ID: C32F92C9529965E6582C2D7D50D34BB3
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://ebay-issusefix.com/ Page URL
http://ebay-issusefix.com/?ID=1&/signin/login.html?7c75ee4d2f69ed24631d2fad6c6eb4a4&path=/signin/? HTTP 302
http://ebay-issusefix.com/signin/?cmd=_login&dispatch=885e159277067983e0447bf6a&locale=en_GB Page URL

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i

Page Statistics

16
Requests

50 %
HTTPS

11 %
IPv6

7
Domains

9
Subdomains

9
IPs

5
Countries

155 kB
Transfer

461 kB
Size

1
Cookies

7 Outgoing links

These are links going to different origins than the main page.

URL: http://www.ebay.com/
Title: eBay

Search URL Search Domain Scan URL

URL: https://scgi.ebay.com/ws/eBayISAPI.dll?FYPShow&_trksid=p4853.m2379.l4061&otpFyp=1&signInUrl=https%3A%2F%2Fsignin.ebay.com%3A443%2Fws%2FeBayISAPI.dll%3FSignIn%26ru%3Dhttp%3A%2F%2Fwww.ebay.com%2Fsl%2Fsell&ru=http%3A%2F%2Fwww.ebay.com%2Fsl%2Fsell
Title: Forgot your password?

Search URL Search Domain Scan URL

URL: http://pages.ebay.com/help/policies/user-agreement.html
Title: User Agreement

Search URL Search Domain Scan URL

URL: http://pages.ebay.com/help/policies/privacy-policy.html
Title: Privacy

Search URL Search Domain Scan URL

URL: http://pages.ebay.com/help/account/cookies-web-beacons.html
Title: Cookies

Search URL Search Domain Scan URL

URL: http://cgi6.ebay.com/ws/eBayISAPI.dll?AdChoiceLandingPage&partner=0
Title: AdChoice

Search URL Search Domain Scan URL

URL: https://trustsealinfo.websecurity.norton.com/splash?form_file=fdf/splash.fdf&dn=www.ebay.com&lang=en
Title: Norton Secured - powered by Verisign

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://ebay-issusefix.com/ Page URL
http://ebay-issusefix.com/?ID=1&/signin/login.html?7c75ee4d2f69ed24631d2fad6c6eb4a4&path=/signin/? HTTP 302
http://ebay-issusefix.com/signin/?cmd=_login&dispatch=885e159277067983e0447bf6a&locale=en_GB Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

16 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Cookie set /
ebay-issusefix.com/ 117 B
550 B 1433ms
1381ms Document
text/html 67.225.242.29
Liquid Web

General

Check archive.org

Show headers Download Go to

Full URL: http://ebay-issusefix.com/
Protocol: HTTP/1.1
Server: 67.225.242.29 Lansing, United States, ASN32244 (LIQUIDWEB - Liquid Web, L.L.C, US),
Reverse DNS
Software: Apache /
Resource Hash

Request headers

Host: ebay-issusefix.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 24 Sep 2019 08:14:07 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Set-Cookie: PHPSESSID=1b5f35c161360fdb2280e004a4d38040; path=/
Vary: Accept-Encoding,User-Agent
Content-Encoding: gzip
Content-Length: 129
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

GET
H/1.1

200
OK

Primary Request / Show response
ebay-issusefix.com/signin/
Redirect Chain

http://ebay-issusefix.com/?ID=1&/signin/login.html?7c75ee4d2f69ed24631d2fad6c6eb4a4&path=/signin/?
http://ebay-issusefix.com/signin/?cmd=_login&dispatch=885e159277067983e0447bf6a&locale=en_GB

184 KB
50 KB

779ms
779ms

Document
text/html

67.225.242.29
Liquid Web

General

Check archive.org

Show headers Download Go to

Full URL: http://ebay-issusefix.com/signin/?cmd=_login&dispatch=885e159277067983e0447bf6a&locale=en_GB
Protocol: HTTP/1.1
Server: 67.225.242.29 Lansing, United States, ASN32244 (LIQUIDWEB - Liquid Web, L.L.C, US),
Reverse DNS
Software: Apache /
Resource Hash: d5e323431907f1cd296a1024875e90377dcb2bd25a36bd532f62ca4010ff7452

Request headers

Host: ebay-issusefix.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Referer: http://ebay-issusefix.com/
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: http://ebay-issusefix.com/

Response headers

Date: Tue, 24 Sep 2019 08:14:10 GMT
Server: Apache
Cache-Control: max-age=600
Expires: Tue, 24 Sep 2019 08:24:10 GMT
Vary: Accept-Encoding,User-Agent
Content-Encoding: gzip
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

Redirect headers

Date: Tue, 24 Sep 2019 08:14:09 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Location: signin/?cmd=_login&dispatch=885e159277067983e0447bf6a&locale=en_GB
Vary: User-Agent
Content-Length: 0
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK roverlv.js Show response
ebay-issusefix.com/js/ 63 KB
18 KB 226ms
205ms Script
application/javascript 67.225.242.29
Liquid Web

General

Check archive.org

Show headers Download Go to

Full URL: http://ebay-issusefix.com/js/roverlv.js
Requested by: Host: ebay-issusefix.com
URL: http://ebay-issusefix.com/signin/?cmd=_login&dispatch=885e159277067983e0447bf6a&locale=en_GB
Protocol: HTTP/1.1
Server: 67.225.242.29 Lansing, United States, ASN32244 (LIQUIDWEB - Liquid Web, L.L.C, US),
Reverse DNS
Software: Apache /
Resource Hash: f6d2cd9e0f8bafa09c4b561dce45b477739321aab874e50b1c00e7413c3246c2

Request headers

Referer: http://ebay-issusefix.com/signin/?cmd=_login&dispatch=885e159277067983e0447bf6a&locale=en_GB
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 24 Sep 2019 08:14:11 GMT
Content-Encoding: gzip
Last-Modified: Sun, 09 Apr 2017 11:50:00 GMT
Server: Apache
Vary: Accept-Encoding,User-Agent
Content-Type: application/javascript
Cache-Control: max-age=2592000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 17588
Expires: Thu, 24 Oct 2019 08:14:11 GMT

GET
H/1.1 200
OK p_1361wy9wr1.png
3.top4top.net/ 5 KB
5 KB 125ms
40ms Image
image/png 62.210.169.80
AS12876

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://3.top4top.net/p_1361wy9wr1.png

Requested by

Host: ebay-issusefix.com
URL: http://ebay-issusefix.com/signin/?cmd=_login&dispatch=885e159277067983e0447bf6a&locale=en_GB

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

62.210.169.80 , France, ASN12876 (AS12876, FR),

Reverse DNS

62-210-169-80.rev.poneytelecom.eu

Software

HotCores /

Resource Hash

5440e48584e47738479ccd905576e9ddf2097d07b6c7ba81dda6eeb13b1d4af0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains;

Request headers

Sec-Fetch-Mode: no-cors
Referer: http://ebay-issusefix.com/signin/?cmd=_login&dispatch=885e159277067983e0447bf6a&locale=en_GB
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

X-File-ID: x29750546x
Date: Tue, 24 Sep 2019 08:14:10 GMT
Last-Modified: Mon, 23 Sep 2019 21:10:22 GMT
Server: HotCores
ETag: "5d8934be-12d4"
Strict-Transport-Security: max-age=31536000; includeSubdomains;
Content-Type: image/png
Cache-Control: max-age=7200
Content-Disposition: inline; filename="1361wy9wr1.png"
Connection: close
Accept-Ranges: bytes
Content-Length: 4820
Expires: Tue, 24 Sep 2019 10:14:10 GMT

GET
H/1.1 200
OK /
rover.ebay.com/roversync/ 42 B
752 B 639ms
176ms Image
image/gif 66.135.214.209
eBay

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://rover.ebay.com/roversync/?site=0&stg=1&mpt=1491687248715

Requested by

Host: ebay-issusefix.com
URL: http://ebay-issusefix.com/signin/?cmd=_login&dispatch=885e159277067983e0447bf6a&locale=en_GB

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_256_CBC

Server

66.135.214.209 , United States, ASN11643 (EBAY - eBay, Inc, US),

Reverse DNS

Software

ebay server /

Resource Hash

6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Sec-Fetch-Mode: no-cors
Referer: http://ebay-issusefix.com/signin/?cmd=_login&dispatch=885e159277067983e0447bf6a&locale=en_GB
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 24 Sep 2019 08:14:10 GMT, Tue, 24 Sep 2019 08:14:10 GMT
Server: ebay server
P3P: policyref="/w3c/p3p.xml", CP="NOI CURa ADMa DEVa PSDo PSAa OUR SAMo IND UNI COM NAV INT STA DEM PRE"
Strict-Transport-Security: max-age=31536000
Content-Type: image/gif
X-EBAY-C-REQUEST-ID: ri=Adxafm3VpfSR,rci=276eeabacd591aa1
Cache-Control: private, no-cache
RlogId: t6qjpbq%3F%3Ctofthu%60t*0532624%29pqtfwpu%29pie%29fgg%7E-fij-16d6255c348-0x117
X-EBAY-CHOCOLATE: true
Content-Length: 42

GET
H/1.1 404
Not Found /
yahyazarir.blogspot.com/ 0
0 251ms
221ms Stylesheet
text/html 2a00:1450:4001:814::2001
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: http://yahyazarir.blogspot.com/
Requested by: Host: ebay-issusefix.com
URL: http://ebay-issusefix.com/signin/?cmd=_login&dispatch=885e159277067983e0447bf6a&locale=en_GB
Protocol: HTTP/1.1
Server: 2a00:1450:4001:814::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: http://ebay-issusefix.com/signin/?cmd=_login&dispatch=885e159277067983e0447bf6a&locale=en_GB
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

GET
H2 200 aaa5p3nkya2onh2wvw0vhpasj.js Show response
secureir.ebaystatic.com/v4js/z/yy/ 102 KB
31 KB 118ms
42ms Script
application/x-javascript 2.18.234.107
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://secureir.ebaystatic.com/v4js/z/yy/aaa5p3nkya2onh2wvw0vhpasj.js
Requested by: Host: ebay-issusefix.com
URL: http://ebay-issusefix.com/signin/?cmd=_login&dispatch=885e159277067983e0447bf6a&locale=en_GB
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2.18.234.107 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-234-107.deploy.static.akamaitechnologies.com
Software: Apache-Coyote/1.1 /
Resource Hash: 8e27b0403bf1062e5c8df7f76bb053bac530db88e86a3f5b99930b4dc78c69d1

Request headers

Sec-Fetch-Mode: no-cors
Referer: http://ebay-issusefix.com/signin/?cmd=_login&dispatch=885e159277067983e0447bf6a&locale=en_GB
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 24 Sep 2019 08:14:10 GMT
content-encoding: gzip
x-cache-lookup: HIT from lvsincludecache-2522847:80
last-modified: Thu, 20 Sep 2018 08:22:27 GMT
server: Apache-Coyote/1.1
status: 200
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/x-javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, immutable
access-control-allow-headers: *
content-length: 31543
expires: Wed, 23 Sep 2020 08:14:10 GMT

GET
H2 200 dw5a31rmxmzjfazlcvx4wnwylmt.js Show response
ir.ebaystatic.com/rs/v/ 31 KB
10 KB 124ms
49ms Script
application/x-javascript 2.18.234.244
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://ir.ebaystatic.com/rs/v/dw5a31rmxmzjfazlcvx4wnwylmt.js
Requested by: Host: ebay-issusefix.com
URL: http://ebay-issusefix.com/signin/?cmd=_login&dispatch=885e159277067983e0447bf6a&locale=en_GB
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2.18.234.244 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-234-244.deploy.static.akamaitechnologies.com
Software: ebay server /
Resource Hash: 391f1eb710e4c55cd679045b3fa1f78a090fd4678f8b49b6f0c72a6d645bdee2

Request headers

Sec-Fetch-Mode: no-cors
Referer: http://ebay-issusefix.com/signin/?cmd=_login&dispatch=885e159277067983e0447bf6a&locale=en_GB
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 24 Sep 2019 08:14:10 GMT
content-encoding: gzip
x-cache-lookup: HIT from lvsincludecache-2522846:80
rlogid: t6q%60utuf%3C%3Dosuufvuq%60%282%3F1466-16ce2087811-0xc5
status: 200
x-ebay-c-version: 1.0.0
content-length: 9454
last-modified: Thu, 26 Jan 2017 12:39:07 GMT
server: ebay server
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/x-javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, immutable
warning: 113 lvsincludecache-2522846 (squid) This cache hit is still fresh and more than 1 day old
x-ebay-request-id: 16ce2087-8110-ac79-7b06-52cbffa1a9f6![
access-control-allow-headers: *
expires: Wed, 23 Sep 2020 08:14:10 GMT

GET
H/1.1 404
Not Found /
yahyazarir.blogspot.com/ 0
0 227ms
222ms Stylesheet
text/html 2a00:1450:4001:814::2001
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: http://yahyazarir.blogspot.com/
Requested by: Host: ebay-issusefix.com
URL: http://ebay-issusefix.com/signin/?cmd=_login&dispatch=885e159277067983e0447bf6a&locale=en_GB
Protocol: HTTP/1.1
Server: 2a00:1450:4001:814::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: http://ebay-issusefix.com/signin/?cmd=_login&dispatch=885e159277067983e0447bf6a&locale=en_GB
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

GET
H/1.1 200
OK imgbg.jpg
ebay-issusefix.com/img/ 1 KB
2 KB 113ms
112ms Image
image/jpeg 67.225.242.29
Liquid Web

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://ebay-issusefix.com/img/imgbg.jpg
Requested by: Host: ebay-issusefix.com
URL: http://ebay-issusefix.com/signin/?cmd=_login&dispatch=885e159277067983e0447bf6a&locale=en_GB
Protocol: HTTP/1.1
Server: 67.225.242.29 Lansing, United States, ASN32244 (LIQUIDWEB - Liquid Web, L.L.C, US),
Reverse DNS
Software: Apache /
Resource Hash: b054c21c769e6e73a3f3f2e51ff27783043d87f8c4cb963c0554b33010fa3efc

Request headers

Referer: http://ebay-issusefix.com/signin/?cmd=_login&dispatch=885e159277067983e0447bf6a&locale=en_GB
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 24 Sep 2019 08:14:11 GMT
Last-Modified: Sun, 09 Apr 2017 11:55:20 GMT
Server: Apache
Content-Type: image/jpeg
Cache-Control: max-age=2592000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 1392
Expires: Thu, 24 Oct 2019 08:14:11 GMT

GET
H/1.1 200
OK sprSignIn3.png
ebay-issusefix.com/img/ 19 KB
20 KB 112ms
112ms Image
image/png 67.225.242.29
Liquid Web

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://ebay-issusefix.com/img/sprSignIn3.png
Requested by: Host: ebay-issusefix.com
URL: http://ebay-issusefix.com/signin/?cmd=_login&dispatch=885e159277067983e0447bf6a&locale=en_GB
Protocol: HTTP/1.1
Server: 67.225.242.29 Lansing, United States, ASN32244 (LIQUIDWEB - Liquid Web, L.L.C, US),
Reverse DNS
Software: Apache /
Resource Hash: e2192eadf7564ceb9202cb5b5ddcfb244c4a2627ffd46b7292855972181623ec

Request headers

Referer: http://ebay-issusefix.com/signin/?cmd=_login&dispatch=885e159277067983e0447bf6a&locale=en_GB
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 24 Sep 2019 08:14:11 GMT
Last-Modified: Sun, 09 Apr 2017 11:54:28 GMT
Server: Apache
Content-Type: image/png
Cache-Control: max-age=2592000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=97
Content-Length: 19939
Expires: Thu, 24 Oct 2019 08:14:11 GMT

GET
H/1.1 200
OK fb-all-prod.pp.min.js Show response
c.paypal.com/da/r/ Frame 0023 55 KB
17 KB 140ms
42ms Script
application/x-javascript 23.210.248.226
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://c.paypal.com/da/r/fb-all-prod.pp.min.js
Requested by: Host: ebay-issusefix.com
URL: http://ebay-issusefix.com/signin/?cmd=_login&dispatch=885e159277067983e0447bf6a&locale=en_GB
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.210.248.226 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a23-210-248-226.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 6a9e8f2089bfb54a69cca47cc0ae3a17df0aefbe0b939d6da4a74bdcea52a273

Request headers

Sec-Fetch-Mode: cors
Referer: http://ebay-issusefix.com/signin/?cmd=_login&dispatch=885e159277067983e0447bf6a&locale=en_GB
Origin: http://ebay-issusefix.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 24 Sep 2019 08:14:10 GMT
X-Pad: avoid browser bug
Vary: Accept-Encoding
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17296
Last-Modified: Mon, 30 Jan 2017 17:58:30 GMT
Server: Apache
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET
Content-Type: application/x-javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=86400
Access-Control-Allow-Credentials: false
Accept-Ranges: bytes
Expires: Wed, 25 Sep 2019 08:14:10 GMT

GET
H/1.1 200
OK t_n.html
signin.ebay.com/ Frame BE9D 0
0 1540ms
607ms Document
text/html 66.211.177.111
eBay

General

Check archive.org

Show headers Download Go to

Full URL

https://signin.ebay.com/t_n.html?org_id=usllpic0&session_id=4f7d134b15b0a84d0652cc12fff854d3

Requested by

Host: ebay-issusefix.com
URL: http://ebay-issusefix.com/signin/?cmd=_login&dispatch=885e159277067983e0447bf6a&locale=en_GB

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_256_CBC

Server

66.211.177.111 , United States, ASN11643 (EBAY - eBay, Inc, US),

Reverse DNS

Software

Apache-Coyote/1.1 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age= 31536000

Request headers

Host: signin.ebay.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site: cross-site
Referer: http://ebay-issusefix.com/signin/?cmd=_login&dispatch=885e159277067983e0447bf6a&locale=en_GB
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Referer: http://ebay-issusefix.com/signin/?cmd=_login&dispatch=885e159277067983e0447bf6a&locale=en_GB

Response headers

Server: Apache-Coyote/1.1
last-modified: Tue, 20 Aug 2019 00:13:20 GMT
Content-Type: text/html
Content-Length: 3459
Date: Tue, 24 Sep 2019 08:14:11 GMT
Strict-Transport-Security: max-age= 31536000

GET
H/1.1 200 rtm Show response
srv.main.ebayrtm.com/ Frame C32F 56 B
340 B 672ms
165ms Script
application/x-javascript 209.140.145.151
eBay

General

Check archive.org

Show headers Download Go to

Full URL: https://srv.main.ebayrtm.com/rtm?RtmGetCapJs&p=18&rqid=4f7d134b15b0a84d06510731ffd62469&cb=parent.window.updateRtmField
Requested by: Host: ebay-issusefix.com
URL: http://ebay-issusefix.com/signin/?cmd=_login&dispatch=885e159277067983e0447bf6a&locale=en_GB
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 209.140.145.151 , United States, ASN11643 (EBAY - eBay, Inc, US),
Reverse DNS: srv.ebayrtm.com
Software: /
Resource Hash: efd2bd5237dc50a234f9f80e4167135da2f1cc535974c1cd8d55d7055b9f864c

Request headers

Sec-Fetch-Mode: no-cors
Referer: http://ebay-issusefix.com/signin/?cmd=_login&dispatch=885e159277067983e0447bf6a&locale=en_GB
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 24 Sep 2019 08:14:10 GMT
content-encoding: gzip
RlogId: t6ndbulkgb%7Bq%3C%3Dqkijbathmdc%7Fw%28070%3C42-16d6255c5ea-0x4f
Transfer-Encoding: chunked
Content-Type: application/x-javascript;charset=UTF-8

GET
H/1.1 200
OK f5uxsy10bmz05dtrtrqybl5qquv.png
ebay-issusefix.com/img/ 994 B
1 KB 113ms
112ms Image
image/png 67.225.242.29
Liquid Web

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://ebay-issusefix.com/img/f5uxsy10bmz05dtrtrqybl5qquv.png?e
Requested by: Host: ebay-issusefix.com
URL: http://ebay-issusefix.com/signin/?cmd=_login&dispatch=885e159277067983e0447bf6a&locale=en_GB
Protocol: HTTP/1.1
Server: 67.225.242.29 Lansing, United States, ASN32244 (LIQUIDWEB - Liquid Web, L.L.C, US),
Reverse DNS
Software: Apache /
Resource Hash: 7e0f4cd0590e2cf36c094d4226d70ccf2bc12107c46f3aeb8b3b5801396b44b0

Request headers

Referer: http://ebay-issusefix.com/signin/?cmd=_login&dispatch=885e159277067983e0447bf6a&locale=en_GB
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 24 Sep 2019 08:14:11 GMT
Last-Modified: Sun, 09 Apr 2017 11:56:48 GMT
Server: Apache
Content-Type: image/png
Cache-Control: max-age=2592000
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=96
Content-Length: 994
Expires: Thu, 24 Oct 2019 08:14:11 GMT

GET
H/1.1 200
OK e Show response
c.paypal.com/v1/r/d/b/ Frame 0023 18 B
284 B 287ms
197ms Script
application/json 23.210.248.226
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://c.paypal.com/v1/r/d/b/e?e=Uncaught%20TypeError:%20Cannot%20read%20property%20%27removeItem%27%20of%20null20170126
Requested by: Host: c.paypal.com
URL: https://c.paypal.com/da/r/fb-all-prod.pp.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.210.248.226 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a23-210-248-226.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 38b69e3b3bff3cfecfd24783700c41a742a09e2100e9e9f56b947d21ef03fadc

Request headers

Sec-Fetch-Mode: no-cors
Referer: http://ebay-issusefix.com/signin/?cmd=_login&dispatch=885e159277067983e0447bf6a&locale=en_GB
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 24 Sep 2019 08:14:11 GMT
CORRELATION-ID: 995cb5c2358a8
Cache-Control: max-age=0, no-cache, no-store, must-revalidate
Content-Type: application/json
Paypal-Debug-Id: 995cb5c2358a8
X-N: S
Connection: keep-alive
Content-Length: 18

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: eBay (E-commerce)

66 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.ebay.com/	1970-01-19 21:26:24	Name: npii Value: btguid/6255c33d16d0a9ccc9260567f7e55c6c614c3752^cguid/6255c34816d0a9ccc9260567f7e55c65614c3752^

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

3.top4top.net
c.paypal.com
ebay-issusefix.com
ir.ebaystatic.com
rover.ebay.com
secureir.ebaystatic.com
signin.ebay.com
srv.main.ebayrtm.com
yahyazarir.blogspot.com
2.18.234.107
2.18.234.244
209.140.145.151
23.210.248.226
2a00:1450:4001:814::2001
62.210.169.80
66.135.214.209
66.211.177.111
67.225.242.29
38b69e3b3bff3cfecfd24783700c41a742a09e2100e9e9f56b947d21ef03fadc
391f1eb710e4c55cd679045b3fa1f78a090fd4678f8b49b6f0c72a6d645bdee2
5440e48584e47738479ccd905576e9ddf2097d07b6c7ba81dda6eeb13b1d4af0
6a9e8f2089bfb54a69cca47cc0ae3a17df0aefbe0b939d6da4a74bdcea52a273
6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93
7e0f4cd0590e2cf36c094d4226d70ccf2bc12107c46f3aeb8b3b5801396b44b0
8e27b0403bf1062e5c8df7f76bb053bac530db88e86a3f5b99930b4dc78c69d1
b054c21c769e6e73a3f3f2e51ff27783043d87f8c4cb963c0554b33010fa3efc
d5e323431907f1cd296a1024875e90377dcb2bd25a36bd532f62ca4010ff7452
e2192eadf7564ceb9202cb5b5ddcfb244c4a2627ffd46b7292855972181623ec
efd2bd5237dc50a234f9f80e4167135da2f1cc535974c1cd8d55d7055b9f864c
f6d2cd9e0f8bafa09c4b561dce45b477739321aab874e50b1c00e7413c3246c2

ebay-issusefix.com Open in urlscan Pro 67.225.242.29 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

16 Requests

50 %HTTPS

11 %IPv6

7 Domains

9 Subdomains

9 IPs

5 Countries

155 kBTransfer

461 kBSize

1 Cookies

7 Outgoing links

Page URL History

Redirected requests

16 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

66 JavaScript Global Variables

1 Cookies

Indicators

ebay-issusefix.com Open in urlscan Pro
67.225.242.29 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

16
Requests

50 %
HTTPS

11 %
IPv6

7
Domains

9
Subdomains

9
IPs

5
Countries

155 kB
Transfer

461 kB
Size

1
Cookies

16 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!