![](/screenshots/906d9d08-62ff-4c9c-9709-f787d69329d6.png)
ebay.com.items-help.chat
Open in
urlscan Pro
2a06:98c1:3120::7
Malicious Activity!
Public Scan
Effective URL: https://ebay.com.items-help.chat/captcha
Submission: On February 15 via manual from US — Scanned from DE
Summary
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on February 14th 2022. Valid for: a year.
This is the only time ebay.com.items-help.chat was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: eBay (E-commerce)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 52.72.49.79 52.72.49.79 | 14618 (AMAZON-AES) (AMAZON-AES) | |
3 | 2a06:98c1:312... 2a06:98c1:3120::7 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
4 | 104.16.168.131 104.16.168.131 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
4 | 104.16.169.131 104.16.169.131 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
11 | 4 |
ASN14618 (AMAZON-AES, US)
PTR: visit.rebrand.ly
help-ebay.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
8 |
hcaptcha.com
hcaptcha.com — Cisco Umbrella Rank: 7981 newassets.hcaptcha.com — Cisco Umbrella Rank: 10830 |
484 KB |
3 |
items-help.chat
ebay.com.items-help.chat |
11 KB |
1 |
help-ebay.com
1 redirects
help-ebay.com |
276 B |
11 | 3 |
Domain | Requested by | |
---|---|---|
5 | newassets.hcaptcha.com |
hcaptcha.com
newassets.hcaptcha.com |
3 | hcaptcha.com |
ebay.com.items-help.chat
newassets.hcaptcha.com |
3 | ebay.com.items-help.chat |
ebay.com.items-help.chat
|
1 | help-ebay.com | 1 redirects |
11 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
items-help.chat Cloudflare Inc ECC CA-3 |
2022-02-14 - 2023-02-13 |
a year | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2021-06-15 - 2022-06-14 |
a year | crt.sh |
This page contains 3 frames:
Primary Page:
https://ebay.com.items-help.chat/captcha
Frame ID: 6257FD16E324348A54D25CE4F0569A21
Requests: 4 HTTP requests in this frame
Frame:
https://newassets.hcaptcha.com/captcha/v1/e61b2d8/static/hcaptcha-challenge.html
Frame ID: 16EFF237F6899AA1E9931738B56D9FC1
Requests: 3 HTTP requests in this frame
Frame:
https://newassets.hcaptcha.com/captcha/v1/e61b2d8/static/hcaptcha-checkbox.html
Frame ID: 12496673CF6AA2DA52F8A1B77DD75C7E
Requests: 4 HTTP requests in this frame
Screenshot
![](/screenshots/906d9d08-62ff-4c9c-9709-f787d69329d6.png)
Page Title
Security measurePage URL History Show full URLs
-
https://help-ebay.com/items/payments/enable
HTTP 301
https://ebay.com.items-help.chat/captcha Page URL
Detected technologies
Detected patterns
- https://hcaptcha.com/([\d]+?)/api.js
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://help-ebay.com/items/payments/enable
HTTP 301
https://ebay.com.items-help.chat/captcha Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
11 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
captcha
ebay.com.items-help.chat/ Redirect Chain
|
4 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
left-logo.png
ebay.com.items-help.chat/static/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
api.js
hcaptcha.com/1/ |
83 KB 27 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cert.png
ebay.com.items-help.chat/static/ |
3 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
hcaptcha-challenge.html
newassets.hcaptcha.com/captcha/v1/e61b2d8/static/ Frame 16EF |
2 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
hcaptcha-checkbox.html
newassets.hcaptcha.com/captcha/v1/e61b2d8/static/ Frame 1249 |
2 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
hcaptcha-checkbox.js
newassets.hcaptcha.com/captcha/v1/e61b2d8/ Frame 1249 |
151 KB 47 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
hcaptcha-challenge.js
newassets.hcaptcha.com/captcha/v1/e61b2d8/ Frame 16EF |
208 KB 60 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame 1249 |
798 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
checksiteconfig
hcaptcha.com/ Frame 1249 |
508 B 858 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H3 |
checksiteconfig
hcaptcha.com/ Frame |
0 0 |
Preflight
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
hsw.js
newassets.hcaptcha.com/c/919a3f58/ Frame 16EF |
919 KB 347 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: eBay (E-commerce)6 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| 1 function| structuredClone number| intervalId object| hcaptcha object| grecaptcha0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ebay.com.items-help.chat
hcaptcha.com
help-ebay.com
newassets.hcaptcha.com
104.16.168.131
104.16.169.131
2a06:98c1:3120::7
52.72.49.79
16b2649c0b15ae3b78dfc8873f5a5c3880127bcaade71078675581c9b72242af
202d124cfbdf21fb5f5d09094c9b9ab6523960595e009145765e24bc4050971c
3a7e9d5385430607054d9ce11f05fe39d8f4feb55483ef04da6fe2b59615fcd7
5440e48584e47738479ccd905576e9ddf2097d07b6c7ba81dda6eeb13b1d4af0
57cafa49fb677c3f09d6e90b051917d10e7bb54e83102a25f3d32b06e8fa59a7
5fdc9046257aaaa253a551ef9fda09596eb7672d885281c8b6b1db6c593b08aa
b2025a8b87bdf281bc3684cdb0063cea5551f047c022266431ad958c45e115be
b595425f7e19ec77512e7203156f0c1d0be7fe9c69ac5d361ec53454814aebe2
bcc4290f7041ce142b6f5142eccb9c47c8ad59c1e8142361b7d40659fcd59f9d
bf2bc83e4340a8be502f3fbcc1ffff593578f9f56e7df819d5f05a90d2e146c1
f392e364e7238ab371a2b028f38e58039a61478eb76af4d3ad683de1e0cf54cb