eby-lod.com Open in urlscan Pro
199.188.206.68 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://www.ebay.co.uk.itm3492340384.eby-lod.com/
Effective URL:
http://eby-lod.com/ITM93923017282.html
Submission: On January 17 via automatic, source certstream-suspicious (January 17th 2020, 1:05:12 pm UTC)

Summary HTTP 15 Redirects Links 3 Behaviour Indicators

Summary

This website contacted 7 IPs in 2 countries across 6 domains to perform 15 HTTP transactions. The main IP is 199.188.206.68, located in Los Angeles, United States and belongs to NAMECHEAP-NET - Namecheap, Inc., US. The main domain is eby-lod.com.

This is the only time eby-lod.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: eBay (E-commerce)

Domain & IP information

	IP Address	AS Autonomous System
1 3	199.188.206.68 199.188.206.68	22612 (NAMECHEAP...) (NAMECHEAP-NET - Namecheap)
7	152.199.23.155 152.199.23.155	15133 (EDGECAST) (EDGECAST - MCI Communications Services)
2	51.15.21.205 51.15.21.205	12876 (Online SAS) (Online SAS)
2	23.210.249.229 23.210.249.229	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
1	23.210.248.226 23.210.248.226	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
1	66.135.201.59 66.135.201.59	11643 (EBAY) (EBAY - eBay)
15	7

3 199.188.206.68 (Los Angeles, United States) 1 redirects

ASN22612 (NAMECHEAP-NET - Namecheap, Inc., US)
PTR: server270-3.web-hosting.com

www.ebay.co.uk.itm3492340384.eby-lod.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
eby-lod.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 152.199.23.155 (United States)

ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US)

ir.ebaystatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 51.15.21.205 (Haarlem, Netherlands)

ASN12876 (Online SAS, FR)
PTR: i.postimg.cc

s8.postimg.cc	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.210.249.229 (Netherlands)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a23-210-249-229.deploy.static.akamaitechnologies.com

secureir.ebaystatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
rover.ebay.co.uk	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.210.248.226 (Netherlands)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a23-210-248-226.deploy.static.akamaitechnologies.com

c.paypal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 66.135.201.59 (United States)

ASN11643 (EBAY - eBay, Inc, US)
PTR: srv.ebayrtm.com

srv.gb.ebayrtm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	ebaystatic.com ir.ebaystatic.com secureir.ebaystatic.com	136 KB
3	eby-lod.com 1 redirects www.ebay.co.uk.itm3492340384.eby-lod.com eby-lod.com	18 KB
2	postimg.cc s8.postimg.cc	8 KB
1	ebay.co.uk rover.ebay.co.uk	480 B
1	ebayrtm.com srv.gb.ebayrtm.com	73 B
1	paypal.com c.paypal.com	18 KB
15	6

	Domain	Requested by
7	ir.ebaystatic.com	eby-lod.com
2	s8.postimg.cc	eby-lod.com
2	eby-lod.com	ir.ebaystatic.com
1	rover.ebay.co.uk	ir.ebaystatic.com
1	srv.gb.ebayrtm.com	eby-lod.com
1	c.paypal.com	eby-lod.com
1	secureir.ebaystatic.com	eby-lod.com
1	www.ebay.co.uk.itm3492340384.eby-lod.com	1 redirects
15	8

This site contains links to these domains. Also see Links.

Domain
scgi.ebay.co.uk
pages.ebay.co.uk
trustsealinfo.websecurity.norton.com

Subject Issuer	Validity	Valid
ir.ebaystatic.com DigiCert SHA2 Secure Server CA	`2019-07-12` - `2021-03-23`	2 years	crt.sh
postimg.cc Let's Encrypt Authority X3	`2020-01-07` - `2020-04-06`	3 months	crt.sh
www.ebay.com DigiCert SHA2 Secure Server CA	`2019-07-17` - `2020-08-18`	a year	crt.sh
www.paypal.com DigiCert SHA2 Extended Validation Server CA	`2019-09-10` - `2020-08-18`	a year	crt.sh
srv.ebayrtm.com DigiCert SHA2 Secure Server CA	`2019-03-27` - `2020-03-27`	a year	crt.sh

This page contains 4 frames:

Primary Page: http://eby-lod.com/ITM93923017282.html
Frame ID: 42276F94AFE6BD70FE7A7B5C2456459F
Requests: 13 HTTP requests in this frame

Frame: https://c.paypal.com/da/r/fb.js
Frame ID: 5A8367F6F47D3BB7AFE07CA3E2C1FA48
Requests: 1 HTTP requests in this frame

Frame: https://srv.gb.ebayrtm.com/rtm?RtmGetCapJs&p=18&rqid=d6e8a52a1650aa6fd4b1384cffffffff&cb=parent.window.updateRtmField
Frame ID: FBC2DD695B603DA6FACFCF3FCAC70A6F
Requests: 1 HTTP requests in this frame

Frame: http://eby-lod.com/9
Frame ID: E84D84F1D712F691DE112D5044A7B9FA
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://www.ebay.co.uk.itm3492340384.eby-lod.com/ HTTP 302
http://eby-lod.com/ITM93923017282.html Page URL

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i

Page Statistics

15
Requests

80 %
HTTPS

0 %
IPv6

6
Domains

8
Subdomains

7
IPs

2
Countries

179 kB
Transfer

564 kB
Size

0
Cookies

3 Outgoing links

These are links going to different origins than the main page.

URL: https://scgi.ebay.co.uk/ws/eBayISAPI.dll?FYPShow&_trksid=p4853.m2379.l4061&otpFyp=1&siteid=3&co_partnerId=0&ru=https%3A%2F%2Fwww.ebay.co.uk%2F&signInUrl=https%3A%2F%2Fwww.ebay.co.uk%2Fsignin%3Ffyp%3Dsgn%26siteid%3D3%26co_partnerId%3D0%26ru%3Dhttps%253A%252F%252Fwww.ebay.co.uk%252F
Title: Reset your password

Search URL Search Domain Scan URL

URL: https://pages.ebay.co.uk/help/policies/user-agreement.html
Title: User Agreement

Search URL Search Domain Scan URL

URL: https://trustsealinfo.websecurity.norton.com/splash?form_file=fdf/splash.fdf&dn=www.ebay.co.uk&lang=en
Title: Norton Secured - powered by Verisign

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://www.ebay.co.uk.itm3492340384.eby-lod.com/ HTTP 302
http://eby-lod.com/ITM93923017282.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

15 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request ITM93923017282.html Show response
eby-lod.com/
Redirect Chain

https://www.ebay.co.uk.itm3492340384.eby-lod.com/
http://eby-lod.com/ITM93923017282.html

47 KB
17 KB

487ms
443ms

Document
text/html

199.188.206.68
Namecheap

General

Check archive.org

Show headers Download Go to

Full URL: http://eby-lod.com/ITM93923017282.html
Protocol: HTTP/1.1
Server: 199.188.206.68 Los Angeles, United States, ASN22612 (NAMECHEAP-NET - Namecheap, Inc., US),
Reverse DNS: server270-3.web-hosting.com
Software: Apache /
Resource Hash: 4ff0dddb92d8b524ea6eacfd92d119f625c2e2ad46faa1743e8c69bd23947263

Request headers

Host: eby-lod.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Sec-Fetch-User: ?1

Response headers

Date: Fri, 17 Jan 2020 13:04:53 GMT
Server: Apache
Last-Modified: Fri, 17 Jan 2020 11:38:51 GMT
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 17322
Content-Type: text/html

Redirect headers

status: 302
date: Fri, 17 Jan 2020 13:04:53 GMT
server: Apache
x-powered-by: PHP/7.2.26
location: http://eby-lod.com/ITM93923017282.html
content-length: 0
content-type: text/html; charset=UTF-8

GET
H2 200 3sbepdq10q0dtksnrmgitl41cm0.css
ir.ebaystatic.com/rs/v/ 4 KB
2 KB 77ms
20ms Stylesheet
text/css 152.199.23.155
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://ir.ebaystatic.com/rs/v/3sbepdq10q0dtksnrmgitl41cm0.css?proc=DU:N
Requested by: Host: eby-lod.com
URL: http://eby-lod.com/ITM93923017282.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.23.155 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECAcc (ama/8B48) /
Resource Hash: 05830fdef4ed02fa522186d6b44ff242fbdec217f36fb1fe7a7df98abe05bfd1

Request headers

Referer: http://eby-lod.com/ITM93923017282.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Fri, 17 Jan 2020 13:04:53 GMT
content-encoding: gzip
x-cache-lookup: HIT from lvsincludecache-2522847:80
x-ebay-pop-id: UFES2-SYD-irstatic-1
age: 3126021
x-cache: HIT
status: 200
x-envoy-upstream-service-time: 166
x-ebay-c-version: 1.0.0
content-length: 1711
via: 1.1 lvsincludecache-2522847 (squid)
last-modified: Fri, 20 Jan 2017 22:33:12 GMT
server: ECAcc (ama/8B48)
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: text/css;charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=31536000
rlogid: t6q%60utuf%3C%3Dosuufvuq%60%2856707%3F4-16df7844119-0xb5
x-ebay-request-id: 16df7844-1190-ad4c-6eb2-6d89fe42d0be![
accept-ranges: bytes
access-control-allow-headers: *
expires: Sat, 16 Jan 2021 13:04:53 GMT

GET
H2 200 signin-4a48a6.css
ir.ebaystatic.com/rs/c/ 128 KB
34 KB 80ms
23ms Stylesheet
text/css 152.199.23.155
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://ir.ebaystatic.com/rs/c/signin-4a48a6.css
Requested by: Host: eby-lod.com
URL: http://eby-lod.com/ITM93923017282.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.23.155 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECAcc (ama/8AB1) /
Resource Hash: b34ce5d8182f5fb1dd37b1b28aac22be8342ed92159828d6c31c024bfc415599

Request headers

Referer: http://eby-lod.com/ITM93923017282.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Fri, 17 Jan 2020 13:04:53 GMT
content-encoding: gzip
x-cache-lookup: MISS from rnoincludecache-970415:80
status: 200
x-cache: HIT
nncoection: close
x-ebay-c-version: 1.0.0
content-length: 34886
via: 1.1 rnoincludecache-970415 (squid)
last-modified: Thu, 30 Aug 2018 23:02:13 GMT
server: ECAcc (ama/8AB1)
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
rlogid: t6q%60utuf%3C%3Dosuufvuq%60%28544%3D420-16efaf55aa6-0xb2
x-ebay-request-id: 16efaf55-aa60-ad4a-6950-7673fd3acd8a![
accept-ranges: bytes
access-control-allow-headers: *
expires: Sat, 16 Jan 2021 13:04:53 GMT

GET
H2 200 image.png
s8.postimg.cc/bkgyfbo6d/ 5 KB
5 KB 423ms
382ms Image
image/png 51.15.21.205
Online SAS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s8.postimg.cc/bkgyfbo6d/image.png
Requested by: Host: eby-lod.com
URL: http://eby-lod.com/ITM93923017282.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 51.15.21.205 Haarlem, Netherlands, ASN12876 (Online SAS, FR),
Reverse DNS: i.postimg.cc
Software: nginx /
Resource Hash: 867b6d72925f5d5e164d112dfc5161cc88fe8675daf3613a515774b25a96a427

Request headers

Referer: http://eby-lod.com/ITM93923017282.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Fri, 17 Jan 2020 13:04:54 GMT
last-modified: Fri, 14 Sep 2018 07:22:43 GMT
server: nginx
access-control-allow-origin: *
access-control-allow-methods: GET, OPTIONS
content-type: image/png
status: 200
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 4628
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 0vk0rkyoky1ltm32dhy0hthnxyx.js Show response
secureir.ebaystatic.com/f/ 9 KB
4 KB 373ms
27ms Script
application/x-javascript 23.210.249.229
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://secureir.ebaystatic.com/f/0vk0rkyoky1ltm32dhy0hthnxyx.js
Requested by: Host: eby-lod.com
URL: http://eby-lod.com/ITM93923017282.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.210.249.229 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a23-210-249-229.deploy.static.akamaitechnologies.com
Software: ebay server /
Resource Hash: 374eee0aa2ea3745055a959e8a96c5dcb4716cdd7fe5205d5b34e8666b2582b5

Request headers

Referer: http://eby-lod.com/ITM93923017282.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Fri, 17 Jan 2020 13:04:54 GMT
content-encoding: gzip
x-cache-lookup: HIT from lvsincludecache-2522847:80
status: 200
nncoection: close
x-ebay-c-version: 1.0.0
content-length: 3180
pragma: no-cache
last-modified: Mon, 24 Sep 2018 23:48:32 GMT
server: ebay server
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/x-javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, immutable
rlogid: t6q%60utuf%3C%3Dosuufvuq%60%28404%3C342-1667a9c6b19-0xcf
x-ebay-request-id: 1667a9c6-b190-aa66-1591-5e92fff1428e![]
access-control-allow-headers: *
expires: Sat, 26 Dec 2020 10:50:43 GMT

GET
H2 200 2222.png
s8.postimg.cc/jtsttjmzp/ 3 KB
3 KB 563ms
532ms Image
image/png 51.15.21.205
Online SAS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s8.postimg.cc/jtsttjmzp/2222.png
Requested by: Host: eby-lod.com
URL: http://eby-lod.com/ITM93923017282.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 51.15.21.205 Haarlem, Netherlands, ASN12876 (Online SAS, FR),
Reverse DNS: i.postimg.cc
Software: nginx /
Resource Hash: b550dfe4629c227da0acf1bce2b247ca9578f85cc29ead572faa1dd9486d9462

Request headers

Referer: http://eby-lod.com/ITM93923017282.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Fri, 17 Jan 2020 13:04:54 GMT
last-modified: Fri, 14 Sep 2018 07:29:39 GMT
server: nginx
access-control-allow-origin: *
access-control-allow-methods: GET, OPTIONS
content-type: image/png
status: 200
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 2652
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 signin-963a9d.js Show response
ir.ebaystatic.com/rs/c/ 304 KB
88 KB 37ms
37ms Script
application/x-javascript 152.199.23.155
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://ir.ebaystatic.com/rs/c/signin-963a9d.js
Requested by: Host: eby-lod.com
URL: http://eby-lod.com/ITM93923017282.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.23.155 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECAcc (frc/8F32) /
Resource Hash: 3d805ae05b297de776e6ea47f7f8d6f3ef354ed8ea5593d007df7785f0d5da22

Request headers

Referer: http://eby-lod.com/ITM93923017282.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Fri, 17 Jan 2020 13:04:54 GMT
content-encoding: gzip
x-cache-lookup: MISS from slcincludecache-1959350:80
x-cache: HIT
status: 200
x-ebay-c-version: 1.0.0
content-length: 89462
via: 1.1 slcincludecache-1959350 (squid)
last-modified: Thu, 30 Aug 2018 23:02:25 GMT
server: ECAcc (frc/8F32)
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: max-age=31536000
rlogid: t6q%60utuf%3C%3Dpieufvuq%60%2853%3A5556-16ef90cb4f4-0xe4
x-ebay-request-id: 16ef90cb-4f40-ac3e-31b2-b984ff7448c5![
accept-ranges: bytes
access-control-allow-headers: *
expires: Sat, 16 Jan 2021 13:04:54 GMT

GET
H2 200 10341xh50yz21mhhydueu4m5wad.js Show response
ir.ebaystatic.com/rs/v/ 8 KB
3 KB 23ms
22ms Script
application/x-javascript 152.199.23.155
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://ir.ebaystatic.com/rs/v/10341xh50yz21mhhydueu4m5wad.js
Requested by: Host: eby-lod.com
URL: http://eby-lod.com/ITM93923017282.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.23.155 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECAcc (ama/8B1C) /
Resource Hash: e123f0c91db61c7420316106e7233facfb16217f90c30cbfa837b66a4d4c8ae3

Request headers

Referer: http://eby-lod.com/ITM93923017282.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Fri, 17 Jan 2020 13:04:54 GMT
content-encoding: gzip
x-cache-lookup: HIT from rnoincludecache-970416:80
age: 12236176
x-cache: HIT
status: 200
x-ebay-c-version: 1.0.0
content-length: 3255
via: 1.1 rnoincludecache-970416 (squid)
last-modified: Sat, 03 Mar 2018 03:10:07 GMT
server: ECAcc (ama/8B1C)
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/x-javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=31536000
rlogid: t6q%60utuf%3C%3Dosuufvuq%60%285672004-16cb0015ab6-0xb6
x-ebay-request-id: 16cb0015-ab60-a68c-bae2-cdb5ffdc0a49![
accept-ranges: bytes
access-control-allow-headers: *
expires: Sat, 16 Jan 2021 13:04:54 GMT

GET
H2 200 makeebayfasterscript-src-scripts-body-78a2168a.js Show response
ir.ebaystatic.com/rs/c/ 4 KB
2 KB 19ms
19ms Script
application/x-javascript 152.199.23.155
MCI Communication...

General

Check archive.org

Show headers Download Go to

Full URL: https://ir.ebaystatic.com/rs/c/makeebayfasterscript-src-scripts-body-78a2168a.js
Requested by: Host: eby-lod.com
URL: http://eby-lod.com/ITM93923017282.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.23.155 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECAcc (ama/8A97) /
Resource Hash: 81b9056bc784a4ac2299cb454ba74cc8f1b7732e3a7bfd4f65aec9ba9822686a

Request headers

Referer: http://eby-lod.com/ITM93923017282.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Fri, 17 Jan 2020 13:04:54 GMT
content-encoding: br
x-cache-lookup: MISS from rnoincludecache-970418:80
x-cache: HIT
status: 200
x-ebay-c-version: 1.0.0
content-length: 1640
via: 1.1 rnoincludecache-970418 (squid)
last-modified: Thu, 09 Aug 2018 18:44:15 GMT
server: ECAcc (ama/8A97)
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: max-age=31536000
rlogid: t6q%60utuf%3C%3Dpieufvuq%60%284%3F1246%3B-16b0fa58488-0xe2
x-ebay-request-id: 16b0fa58-4880-a99b-2fb7-0faffdd1c243![]
accept-ranges: bytes
access-control-allow-headers: *
expires: Sat, 16 Jan 2021 13:04:54 GMT

GET
H/1.1 200
OK fb.js Show response
c.paypal.com/da/r/ Frame 5A83 51 KB
18 KB 94ms
28ms Script
application/x-javascript 23.210.248.226
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://c.paypal.com/da/r/fb.js
Requested by: Host: eby-lod.com
URL: http://eby-lod.com/ITM93923017282.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.210.248.226 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a23-210-248-226.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 803b2a9f6bad0794919c893aff445bcca329b3eb5183aa0e482b7b602655e081

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer: http://eby-lod.com/ITM93923017282.html
Origin: http://eby-lod.com

Response headers

Date: Fri, 17 Jan 2020 13:04:54 GMT
X-Pad: avoid browser bug
Access-Control-Max-Age: 86400
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17480
Last-Modified: Thu, 10 Oct 2019 17:38:27 GMT
Server: Apache
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: application/x-javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=86400
Access-Control-Allow-Credentials: false
Accept-Ranges: bytes
Expires: Sat, 18 Jan 2020 13:04:54 GMT

GET
DATA 200
OK truncated
/ 725 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1b3c84dc67fbaa659cd41ef4f90978cdc64ee8e7afa4410ee56b55652acd6263

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 f5uxsy10bmz05dtrtrqybl5qquv.png
ir.ebaystatic.com/rs/v/ 994 B
1 KB 22ms
22ms Image
image/png 152.199.23.155
MCI Communication...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ir.ebaystatic.com/rs/v/f5uxsy10bmz05dtrtrqybl5qquv.png
Requested by: Host: eby-lod.com
URL: http://eby-lod.com/ITM93923017282.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.23.155 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECAcc (ama/8ACB) /
Resource Hash: 7e0f4cd0590e2cf36c094d4226d70ccf2bc12107c46f3aeb8b3b5801396b44b0

Request headers

Referer: https://ir.ebaystatic.com/rs/v/3sbepdq10q0dtksnrmgitl41cm0.css?proc=DU:N
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Fri, 17 Jan 2020 13:04:54 GMT
via: 1.1 slcincludecache-1959350 (squid)
x-cache-lookup: HIT from slcincludecache-1959350:80
x-cache: HIT
status: 200
x-ebay-c-version: 1.0.0
content-length: 994
last-modified: Fri, 12 Feb 2016 00:01:35 GMT
server: ECAcc (ama/8ACB)
access-control-allow-methods: GET
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
rlogid: t6q%60utuf%3C%3Dpieufvuq%60%28uk%60%2875%3A4361-1653e347339-0xc2
x-ebay-request-id: 1653e347-3390-a9cb-3814-cca6ffb1225e![]
accept-ranges: bytes
access-control-allow-headers: *
warning: 113 slcincludecache-1959350 (squid) This cache hit is still fresh and more than 1 day old
expires: Sat, 16 Jan 2021 13:04:54 GMT

GET
H/1.1 200 rtm Show response
srv.gb.ebayrtm.com/ Frame FBC2 0
73 B 958ms
165ms Script
text/plain 66.135.201.59
eBay

General

Check archive.org

Show headers Download Go to

Full URL: https://srv.gb.ebayrtm.com/rtm?RtmGetCapJs&p=18&rqid=d6e8a52a1650aa6fd4b1384cffffffff&cb=parent.window.updateRtmField
Requested by: Host: eby-lod.com
URL: http://eby-lod.com/ITM93923017282.html
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 66.135.201.59 , United States, ASN11643 (EBAY - eBay, Inc, US),
Reverse DNS: srv.ebayrtm.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://eby-lod.com/ITM93923017282.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date: Fri, 17 Jan 2020 13:04:54 GMT
Content-Length: 0

GET
H2 200 sgninui-src-static-images-FB-f-Logo__white_29-366f0bd1.png
ir.ebaystatic.com/rs/c/ 1 KB
1 KB 20ms
19ms Image
image/png 152.199.23.155
MCI Communication...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ir.ebaystatic.com/rs/c/sgninui-src-static-images-FB-f-Logo__white_29-366f0bd1.png
Requested by: Host: eby-lod.com
URL: http://eby-lod.com/ITM93923017282.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.23.155 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software: ECAcc (ama/8B14) /
Resource Hash: 53c410f2864972705c250f8c95f111e583c15f6efce891dae6f902c3490d97bf

Request headers

Referer: https://ir.ebaystatic.com/rs/c/signin-4a48a6.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Fri, 17 Jan 2020 13:04:54 GMT
via: 1.1 lvsincludecache-2522847 (squid)
x-cache-lookup: HIT from lvsincludecache-2522847:80
x-ebay-pop-id: UFES2-SYD-irstatic-1
age: 1332913
x-cache: HIT
status: 200
x-envoy-upstream-service-time: 431
x-ebay-c-version: 1.0.0
content-length: 1201
last-modified: Tue, 24 Jul 2018 23:37:11 GMT
server: ECAcc (ama/8B14)
access-control-allow-methods: GET
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
rlogid: t6q%60utuf%3C%3Dosuufvuq%60%2856%3A67%3E%3A-16c8a1beb98-0xbe
x-ebay-request-id: 16c8a1be-b980-aa66-3393-a8d5fffbef97![
accept-ranges: bytes
access-control-allow-headers: *
warning: 113 lvsincludecache-2522847 (squid) This cache hit is still fresh and more than 1 day old
expires: Sat, 16 Jan 2021 13:04:54 GMT

GET
H/1.1 404
Not Found 9 Show response
eby-lod.com/ Frame E84D 315 B
460 B 196ms
196ms Document
text/html 199.188.206.68
Namecheap

General

Check archive.org

Show headers Download Go to

Full URL: http://eby-lod.com/9
Requested by: Host: ir.ebaystatic.com
URL: https://ir.ebaystatic.com/rs/c/signin-963a9d.js
Protocol: HTTP/1.1
Server: 199.188.206.68 Los Angeles, United States, ASN22612 (NAMECHEAP-NET - Namecheap, Inc., US),
Reverse DNS: server270-3.web-hosting.com
Software: Apache /
Resource Hash: d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

Request headers

Host: eby-lod.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Referer: http://eby-lod.com/ITM93923017282.html
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer: http://eby-lod.com/ITM93923017282.html

Response headers

Date: Fri, 17 Jan 2020 13:04:54 GMT
Server: Apache
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

GET
H2 200 0 Show response
rover.ebay.co.uk/idmap/ 65 B
480 B 247ms
245ms Script
text/json 23.210.249.229
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL

https://rover.ebay.co.uk/idmap/0?footer&cb=TaaSIdMapTrackerObj.handleResponse&cache=0.051511392810965395

Requested by

Host: ir.ebaystatic.com
URL: https://ir.ebaystatic.com/rs/v/10341xh50yz21mhhydueu4m5wad.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

23.210.249.229 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a23-210-249-229.deploy.static.akamaitechnologies.com

Software

ebay server /

Resource Hash

52ea95526bba53580277e26a0793a174840dae5526628b759bb42bb41b3a15a7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: http://eby-lod.com/ITM93923017282.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
server: ebay server
x-edgeconnect-midmile-rtt: 139
x-edgeconnect-cache-status: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa ADMa DEVa PSDo PSAa OUR SAMo IND UNI COM NAV INT STA DEM PRE"
status: 200
x-ebay-c-request-id: ri=PwtZCiXEwaQe,rci=86ff89d9ff2ada85
cache-control: private, no-cache
date: Fri, 17 Jan 2020 13:04:54 GMT
rlogid: t6qjpbq%3F%3Ckuvthu%60t*023151%3F%29pqtfwpu%29osu%29fgg%7E-fij-16fb39b4371-0x120
content-type: text/json;charset=ISO-8859-1
content-length: 65
x-edgeconnect-origin-mex-latency: 27

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: eBay (E-commerce)

56 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

c.paypal.com
eby-lod.com
ir.ebaystatic.com
rover.ebay.co.uk
s8.postimg.cc
secureir.ebaystatic.com
srv.gb.ebayrtm.com
www.ebay.co.uk.itm3492340384.eby-lod.com
152.199.23.155
199.188.206.68
23.210.248.226
23.210.249.229
51.15.21.205
66.135.201.59
05830fdef4ed02fa522186d6b44ff242fbdec217f36fb1fe7a7df98abe05bfd1
1b3c84dc67fbaa659cd41ef4f90978cdc64ee8e7afa4410ee56b55652acd6263
374eee0aa2ea3745055a959e8a96c5dcb4716cdd7fe5205d5b34e8666b2582b5
3d805ae05b297de776e6ea47f7f8d6f3ef354ed8ea5593d007df7785f0d5da22
4ff0dddb92d8b524ea6eacfd92d119f625c2e2ad46faa1743e8c69bd23947263
52ea95526bba53580277e26a0793a174840dae5526628b759bb42bb41b3a15a7
53c410f2864972705c250f8c95f111e583c15f6efce891dae6f902c3490d97bf
7e0f4cd0590e2cf36c094d4226d70ccf2bc12107c46f3aeb8b3b5801396b44b0
803b2a9f6bad0794919c893aff445bcca329b3eb5183aa0e482b7b602655e081
81b9056bc784a4ac2299cb454ba74cc8f1b7732e3a7bfd4f65aec9ba9822686a
867b6d72925f5d5e164d112dfc5161cc88fe8675daf3613a515774b25a96a427
b34ce5d8182f5fb1dd37b1b28aac22be8342ed92159828d6c31c024bfc415599
b550dfe4629c227da0acf1bce2b247ca9578f85cc29ead572faa1dd9486d9462
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
e123f0c91db61c7420316106e7233facfb16217f90c30cbfa837b66a4d4c8ae3
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

eby-lod.com Open in urlscan Pro 199.188.206.68 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

15 Requests

80 %HTTPS

0 %IPv6

6 Domains

8 Subdomains

7 IPs

2 Countries

179 kBTransfer

564 kBSize

0 Cookies

3 Outgoing links

Page URL History

Redirected requests

15 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

56 JavaScript Global Variables

0 Cookies

Indicators

eby-lod.com Open in urlscan Pro
199.188.206.68 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

15
Requests

80 %
HTTPS

0 %
IPv6

6
Domains

8
Subdomains

7
IPs

2
Countries

179 kB
Transfer

564 kB
Size

0
Cookies

15 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!