veryfied-paypal.com Open in urlscan Pro
2606:4700:30::6818:7910 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://veryfied-paypal.com/Account/signin/
Submission: On August 12 via automatic, source phishtank (August 12th 2019, 10:49:41 am UTC)

Summary HTTP 14 Redirects Links 7 Behaviour Indicators

Summary

This website contacted 6 IPs in 4 countries across 6 domains to perform 14 HTTP transactions. The main IP is 2606:4700:30::6818:7910, located in United States and belongs to CLOUDFLARENET - Cloudflare, Inc., US. The main domain is veryfied-paypal.com.

This is the only time veryfied-paypal.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: eBay (E-commerce)

Domain & IP information

	IP Address	AS Autonomous System
5	2606:4700:30:... 2606:4700:30::6818:7910	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
2	2.21.38.12 2.21.38.12	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2a00:1450:400... 2a00:1450:4001:816::2001	15169 (GOOGLE) (GOOGLE - Google LLC)
2	23.210.248.226 23.210.248.226	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
1	209.140.144.202 209.140.144.202	11643 (EBAY) (EBAY - eBay)
14	6

5 2606:4700:30::6818:7910 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

veryfied-paypal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2.21.38.12 (France)

ASN20940 (AKAMAI-ASN1, US)
PTR: a2-21-38-12.deploy.static.akamaitechnologies.com

ir.ebaystatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:816::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

yahyazarir.blogspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.210.248.226 (Netherlands)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a23-210-248-226.deploy.static.akamaitechnologies.com

c.paypal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 209.140.144.202 (United States)

ASN11643 (EBAY - eBay, Inc, US)
PTR: srv.ebayrtm.com

srv.main.ebayrtm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	veryfied-paypal.com veryfied-paypal.com	91 KB
2	paypal.com c.paypal.com	18 KB
2	ebaystatic.com ir.ebaystatic.com secureir.ebaystatic.com Failed	15 KB
1	ebayrtm.com srv.main.ebayrtm.com	339 B
1	blogspot.com yahyazarir.blogspot.com
0	ebay.com Failed rover.ebay.com Failed signin.ebay.com Failed
14	6

	Domain	Requested by
5	veryfied-paypal.com	veryfied-paypal.com
2	c.paypal.com	veryfied-paypal.com c.paypal.com
2	ir.ebaystatic.com	veryfied-paypal.com
1	srv.main.ebayrtm.com	veryfied-paypal.com
1	yahyazarir.blogspot.com	veryfied-paypal.com
0	signin.ebay.com Failed	veryfied-paypal.com
0	secureir.ebaystatic.com Failed	veryfied-paypal.com
0	rover.ebay.com Failed	veryfied-paypal.com
14	8

This site contains links to these domains. Also see Links.

Domain
www.ebay.com
scgi.ebay.com
pages.ebay.com
cgi6.ebay.com
trustsealinfo.websecurity.norton.com

Subject Issuer	Validity	Valid
	`1970-01-01` - `1970-01-01`	a few seconds	crt.sh
www.ebay.com DigiCert SHA2 Secure Server CA	`2019-07-17` - `2020-08-18`	a year	crt.sh
www.paypal.com DigiCert SHA2 Extended Validation Server CA	`2018-08-14` - `2020-08-18`	2 years	crt.sh
srv.ebayrtm.com DigiCert SHA2 Secure Server CA	`2019-03-27` - `2020-03-27`	a year	crt.sh

This page contains 4 frames:

Primary Page: http://veryfied-paypal.com/Account/signin/
Frame ID: CA15FC1069BF0A828106FD58127722CB
Requests: 10 HTTP requests in this frame

Frame: https://c.paypal.com/da/r/fb-all-prod.pp.min.js
Frame ID: B230A66433E95843783A9DD96AF2A012
Requests: 2 HTTP requests in this frame

Frame: https://signin.ebay.com/t_n.html?org_id=usllpic0&session_id=4f7d134b15b0a84d0652cc12fff854d3
Frame ID: F65DF665EC0D837F6377288BDC0CBBDF
Requests: 1 HTTP requests in this frame

Frame: https://srv.main.ebayrtm.com/rtm?RtmGetCapJs&p=18&rqid=4f7d134b15b0a84d06510731ffd62469&cb=parent.window.updateRtmField
Frame ID: 9D95751037307480E08833642FC54C27
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Page Statistics

14
Requests

36 %
HTTPS

40 %
IPv6

6
Domains

8
Subdomains

6
IPs

4
Countries

124 kB
Transfer

360 kB
Size

0
Cookies

7 Outgoing links

These are links going to different origins than the main page.

URL: http://www.ebay.com/
Title: eBay

Search URL Search Domain Scan URL

URL: https://scgi.ebay.com/ws/eBayISAPI.dll?FYPShow&_trksid=p4853.m2379.l4061&otpFyp=1&signInUrl=https%3A%2F%2Fsignin.ebay.com%3A443%2Fws%2FeBayISAPI.dll%3FSignIn%26ru%3Dhttp%3A%2F%2Fwww.ebay.com%2Fsl%2Fsell&ru=http%3A%2F%2Fwww.ebay.com%2Fsl%2Fsell
Title: Forgot your password?

Search URL Search Domain Scan URL

URL: http://pages.ebay.com/help/policies/user-agreement.html
Title: User Agreement

Search URL Search Domain Scan URL

URL: http://pages.ebay.com/help/policies/privacy-policy.html
Title: Privacy

Search URL Search Domain Scan URL

URL: http://pages.ebay.com/help/account/cookies-web-beacons.html
Title: Cookies

Search URL Search Domain Scan URL

URL: http://cgi6.ebay.com/ws/eBayISAPI.dll?AdChoiceLandingPage&partner=0
Title: AdChoice

Search URL Search Domain Scan URL

URL: https://trustsealinfo.websecurity.norton.com/splash?form_file=fdf/splash.fdf&dn=www.ebay.com&lang=en
Title: Norton Secured - powered by Verisign

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request Cookie set / Show response veryfied-paypal.com/Account/signin/	185 KB 50 KB	21033ms 21026ms	Document text/html	2606:4700:30::6818:7910 Cloudflare
General Check archive.org Show headers Download Go to Full URL http://veryfied-paypal.com/Account/signin/ Protocol HTTP/1.1 Server 2606:4700:30::6818:7910 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `13f679162b10f2e7ad3c940f6934420b47eb5400d77bd8954619a508c85b4f27` Request headers Host veryfied-paypal.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3 Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Mon, 12 Aug 2019 10:49:27 GMT Content-Type text/html; charset=UTF-8 Transfer-Encoding chunked Connection keep-alive Set-Cookie __cfduid=d1c9514110864fdd6b3532c30510b80221565606946; expires=Tue, 11-Aug-20 10:49:06 GMT; path=/; domain=.veryfied-paypal.com; HttpOnly PHPSESSID=05u5pugcm2jcpnf1io5h45l875; path=/ Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate Pragma no-cache Vary Accept-Encoding Server cloudflare CF-RAY 5051e176ec24dfad-FRA Content-Encoding gzip
GET H/1.1	200 OK	roverlv.js Show response veryfied-paypal.com/Account/js/	63 KB 18 KB	21ms 15ms	Script application/javascript	2606:4700:30::6818:7910 Cloudflare
General Check archive.org Show headers Download Go to Full URL http://veryfied-paypal.com/Account/js/roverlv.js Requested by Host: veryfied-paypal.com URL: http://veryfied-paypal.com/Account/signin/ Protocol HTTP/1.1 Security , , Server 2606:4700:30::6818:7910 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `f6d2cd9e0f8bafa09c4b561dce45b477739321aab874e50b1c00e7413c3246c2` Request headers Referer http://veryfied-paypal.com/Account/signin/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Mon, 12 Aug 2019 10:49:27 GMT Content-Encoding gzip CF-Cache-Status HIT Last-Modified Sat, 08 Apr 2017 21:50:00 GMT Server cloudflare Age 3734 ETag "fa01-54caeb946d200-gzip" Vary Accept-Encoding Content-Type application/javascript Cache-Control public, max-age=14400 Connection keep-alive Accept-Ranges bytes CF-RAY 5051e1fa9b35d721-FRA Content-Length 17588 Expires Mon, 12 Aug 2019 14:49:27 GMT
GET H2	200	fxxj3ttftm5ltcqnto1o4baovyl.png ir.ebaystatic.com/rs/v/	5 KB 5 KB	3400ms 41ms	Image image/png	2.21.38.12 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://ir.ebaystatic.com/rs/v/fxxj3ttftm5ltcqnto1o4baovyl.png Requested by Host: veryfied-paypal.com URL: http://veryfied-paypal.com/Account/signin/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2.21.38.12 , France, ASN20940 (AKAMAI-ASN1, US), Reverse DNS a2-21-38-12.deploy.static.akamaitechnologies.com Software ebay server / Resource Hash `5440e48584e47738479ccd905576e9ddf2097d07b6c7ba81dda6eeb13b1d4af0` Request headers Sec-Fetch-Mode no-cors Referer http://veryfied-paypal.com/Account/signin/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 12 Aug 2019 10:49:30 GMT x-cache-lookup HIT from phxincludecache-2412621:80 status 200 x-ebay-c-version 1.0.0 content-length 4820 last-modified Wed, 29 Oct 2014 18:09:24 GMT server ebay server access-control-allow-methods GET content-type image/png access-control-allow-origin * cache-control public, max-age=31536000, immutable rlogid t6q%60utuf%3C%3Dsm%7Eufvuq%60%284%3F33%3E23-16711732b49-0xb5 x-ebay-request-id 16711732-b490-ac1c-6833-c40effeec1ac![] access-control-allow-headers * warning 113 phxincludecache-2412621 (squid) This cache hit is still fresh and more than 1 day old expires Tue, 11 Aug 2020 10:49:30 GMT
GET		/ rover.ebay.com/roversync/	0 0

GET H/1.1	404 Not Found	/ yahyazarir.blogspot.com/	0 0	230ms 210ms	Stylesheet text/html	2a00:1450:4001:816::2001 Google LLC
General Check archive.org Show headers Download Go to Full URL http://yahyazarir.blogspot.com/ Requested by Host: veryfied-paypal.com URL: http://veryfied-paypal.com/Account/signin/ Protocol HTTP/1.1 Security , , Server 2a00:1450:4001:816::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software / Resource Hash Request headers Referer http://veryfied-paypal.com/Account/signin/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers
GET H/1.1	200 OK	imgbg.jpg veryfied-paypal.com/Account/img/	1 KB 2 KB	351ms 351ms	Image image/jpeg	2606:4700:30::6818:7910 Cloudflare
General Check archive.org Show headers Download Go to Show image Full URL http://veryfied-paypal.com/Account/img/imgbg.jpg Requested by Host: veryfied-paypal.com URL: http://veryfied-paypal.com/Account/signin/ Protocol HTTP/1.1 Security , , Server 2606:4700:30::6818:7910 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `b054c21c769e6e73a3f3f2e51ff27783043d87f8c4cb963c0554b33010fa3efc` Request headers Referer http://veryfied-paypal.com/Account/signin/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Mon, 12 Aug 2019 10:49:27 GMT CF-Cache-Status HIT Last-Modified Sat, 08 Apr 2017 21:55:20 GMT Server cloudflare Age 3733 ETag "570-54caecc59a200" Vary Accept-Encoding Content-Type image/jpeg Cache-Control public, max-age=14400 Connection keep-alive Accept-Ranges bytes CF-RAY 5051e1fadc18d721-FRA Content-Length 1392 Expires Mon, 12 Aug 2019 14:49:27 GMT
GET H/1.1	200 OK	sprSignIn3.png veryfied-paypal.com/Account/img/	19 KB 20 KB	42ms 37ms	Image image/png	2606:4700:30::6818:7910 Cloudflare
General Check archive.org Show headers Download Go to Show image Full URL http://veryfied-paypal.com/Account/img/sprSignIn3.png Requested by Host: veryfied-paypal.com URL: http://veryfied-paypal.com/Account/signin/ Protocol HTTP/1.1 Security , , Server 2606:4700:30::6818:7910 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `e2192eadf7564ceb9202cb5b5ddcfb244c4a2627ffd46b7292855972181623ec` Request headers Referer http://veryfied-paypal.com/Account/signin/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Mon, 12 Aug 2019 10:49:27 GMT CF-Cache-Status HIT Last-Modified Sat, 08 Apr 2017 21:54:28 GMT Server cloudflare Age 3732 ETag "4de3-54caec9402d00" Vary Accept-Encoding Content-Type image/png Cache-Control public, max-age=14400 Connection keep-alive Accept-Ranges bytes CF-RAY 5051e1facd589796-FRA Content-Length 19939 Expires Mon, 12 Aug 2019 14:49:27 GMT
GET		aaa5p3nkya2onh2wvw0vhpasj.js secureir.ebaystatic.com/v4js/z/yy/	0 0

GET H2	200	dw5a31rmxmzjfazlcvx4wnwylmt.js Show response ir.ebaystatic.com/rs/v/	31 KB 10 KB	3316ms 43ms	Script application/x-javascript	2.21.38.12 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://ir.ebaystatic.com/rs/v/dw5a31rmxmzjfazlcvx4wnwylmt.js Requested by Host: veryfied-paypal.com URL: http://veryfied-paypal.com/Account/signin/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2.21.38.12 , France, ASN20940 (AKAMAI-ASN1, US), Reverse DNS a2-21-38-12.deploy.static.akamaitechnologies.com Software ebay server / Resource Hash `391f1eb710e4c55cd679045b3fa1f78a090fd4678f8b49b6f0c72a6d645bdee2` Request headers Sec-Fetch-Mode no-cors Referer http://veryfied-paypal.com/Account/signin/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 12 Aug 2019 10:49:30 GMT content-encoding gzip x-cache-lookup HIT from rnoincludecache-970418:80 rlogid t6q%60utuf%3C%3Dpieufvuq%60%284%3F1246%3B-16b1743e94f-0xe2 status 200 x-ebay-c-version 1.0.0 content-length 9454 last-modified Thu, 26 Jan 2017 12:39:07 GMT server ebay server vary Accept-Encoding access-control-allow-methods GET content-type application/x-javascript;charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, immutable warning 113 rnoincludecache-970418 (squid) This cache hit is still fresh and more than 1 day old x-ebay-request-id 16b1743e-94f0-a99b-2fb7-0faffdc8e26a![] access-control-allow-headers * expires Tue, 11 Aug 2020 10:49:30 GMT
GET H/1.1	200 OK	fb-all-prod.pp.min.js Show response c.paypal.com/da/r/ Frame B230	55 KB 17 KB	100ms 26ms	Script application/x-javascript	23.210.248.226 Akamai Technologies
General Check archive.org Show headers Download Go to Full URL https://c.paypal.com/da/r/fb-all-prod.pp.min.js Requested by Host: veryfied-paypal.com URL: http://veryfied-paypal.com/Account/signin/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 23.210.248.226 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a23-210-248-226.deploy.static.akamaitechnologies.com Software Apache / Resource Hash `6a9e8f2089bfb54a69cca47cc0ae3a17df0aefbe0b939d6da4a74bdcea52a273` Request headers Sec-Fetch-Mode cors Referer http://veryfied-paypal.com/Account/signin/ Origin http://veryfied-paypal.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Mon, 12 Aug 2019 10:49:27 GMT X-Pad avoid browser bug Vary Accept-Encoding Connection keep-alive Content-Encoding gzip Content-Length 17296 Last-Modified Mon, 30 Jan 2017 17:58:30 GMT Server Apache Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET Content-Type application/x-javascript Access-Control-Allow-Origin * Cache-Control max-age=86400 Access-Control-Allow-Credentials false Accept-Ranges bytes Expires Tue, 13 Aug 2019 10:49:27 GMT
GET		t_n.html signin.ebay.com/ Frame F65D	0 0

GET H/1.1	200	rtm Show response srv.main.ebayrtm.com/ Frame 9D95	56 B 339 B	1755ms 180ms	Script application/x-javascript	209.140.144.202 eBay
General Check archive.org Show headers Download Go to Full URL https://srv.main.ebayrtm.com/rtm?RtmGetCapJs&p=18&rqid=4f7d134b15b0a84d06510731ffd62469&cb=parent.window.updateRtmField Requested by Host: veryfied-paypal.com URL: http://veryfied-paypal.com/Account/signin/ Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_256_CBC Server 209.140.144.202 , United States, ASN11643 (EBAY - eBay, Inc, US), Reverse DNS srv.ebayrtm.com Software / Resource Hash `efd2bd5237dc50a234f9f80e4167135da2f1cc535974c1cd8d55d7055b9f864c` Request headers Sec-Fetch-Mode no-cors Referer http://veryfied-paypal.com/Account/signin/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Mon, 12 Aug 2019 10:49:29 GMT content-encoding gzip RlogId t6ndbulkgb%7Bq%3C%3Dqkijbathmdc%7Fw%287600130-16c85728008-0x92 Transfer-Encoding chunked Content-Type application/x-javascript;charset=UTF-8
GET H/1.1	200 OK	f5uxsy10bmz05dtrtrqybl5qquv.png veryfied-paypal.com/Account/img/	994 B 2 KB	15ms 10ms	Image image/png	2606:4700:30::6818:7910 Cloudflare
General Check archive.org Show headers Download Go to Show image Full URL http://veryfied-paypal.com/Account/img/f5uxsy10bmz05dtrtrqybl5qquv.png?e Requested by Host: veryfied-paypal.com URL: http://veryfied-paypal.com/Account/signin/ Protocol HTTP/1.1 Security , , Server 2606:4700:30::6818:7910 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `7e0f4cd0590e2cf36c094d4226d70ccf2bc12107c46f3aeb8b3b5801396b44b0` Request headers Referer http://veryfied-paypal.com/Account/signin/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Mon, 12 Aug 2019 10:49:27 GMT CF-Cache-Status HIT Last-Modified Sat, 08 Apr 2017 21:56:48 GMT Server cloudflare Age 3732 ETag "3e2-54caed1986800" Vary Accept-Encoding Content-Type image/png Cache-Control public, max-age=14400 Connection keep-alive Accept-Ranges bytes CF-RAY 5051e1fc283ed721-FRA Content-Length 994 Expires Mon, 12 Aug 2019 14:49:27 GMT
GET H/1.1	200 OK	e Show response c.paypal.com/v1/r/d/b/ Frame B230	18 B 284 B	4038ms 433ms	Script application/json	23.210.248.226 Akamai Technologies
General Check archive.org Show headers Download Go to Full URL https://c.paypal.com/v1/r/d/b/e?e=Uncaught%20TypeError:%20Cannot%20read%20property%20%27removeItem%27%20of%20null20170126 Requested by Host: c.paypal.com URL: https://c.paypal.com/da/r/fb-all-prod.pp.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 23.210.248.226 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a23-210-248-226.deploy.static.akamaitechnologies.com Software / Resource Hash `38b69e3b3bff3cfecfd24783700c41a742a09e2100e9e9f56b947d21ef03fadc` Request headers Sec-Fetch-Mode no-cors Referer http://veryfied-paypal.com/Account/signin/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Mon, 12 Aug 2019 10:49:31 GMT CORRELATION-ID 3a68de88bfdfc Cache-Control max-age=0, no-cache, no-store, must-revalidate Content-Type application/json Paypal-Debug-Id 3a68de88bfdfc X-N S Connection keep-alive Content-Length 18

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: rover.ebay.com
URL: https://rover.ebay.com/roversync/?site=0&stg=1&mpt=1491687248715

Domain: secureir.ebaystatic.com
URL: https://secureir.ebaystatic.com/v4js/z/yy/aaa5p3nkya2onh2wvw0vhpasj.js

Domain: signin.ebay.com
URL: https://signin.ebay.com/t_n.html?org_id=usllpic0&session_id=4f7d134b15b0a84d0652cc12fff854d3

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: eBay (E-commerce)

56 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

c.paypal.com
ir.ebaystatic.com
rover.ebay.com
secureir.ebaystatic.com
signin.ebay.com
srv.main.ebayrtm.com
veryfied-paypal.com
yahyazarir.blogspot.com
rover.ebay.com
secureir.ebaystatic.com
signin.ebay.com
2.21.38.12
209.140.144.202
23.210.248.226
2606:4700:30::6818:7910
2a00:1450:4001:816::2001
13f679162b10f2e7ad3c940f6934420b47eb5400d77bd8954619a508c85b4f27
38b69e3b3bff3cfecfd24783700c41a742a09e2100e9e9f56b947d21ef03fadc
391f1eb710e4c55cd679045b3fa1f78a090fd4678f8b49b6f0c72a6d645bdee2
5440e48584e47738479ccd905576e9ddf2097d07b6c7ba81dda6eeb13b1d4af0
6a9e8f2089bfb54a69cca47cc0ae3a17df0aefbe0b939d6da4a74bdcea52a273
7e0f4cd0590e2cf36c094d4226d70ccf2bc12107c46f3aeb8b3b5801396b44b0
b054c21c769e6e73a3f3f2e51ff27783043d87f8c4cb963c0554b33010fa3efc
e2192eadf7564ceb9202cb5b5ddcfb244c4a2627ffd46b7292855972181623ec
efd2bd5237dc50a234f9f80e4167135da2f1cc535974c1cd8d55d7055b9f864c
f6d2cd9e0f8bafa09c4b561dce45b477739321aab874e50b1c00e7413c3246c2

veryfied-paypal.com Open in urlscan Pro 2606:4700:30::6818:7910 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

14 Requests

36 %HTTPS

40 %IPv6

6 Domains

8 Subdomains

6 IPs

4 Countries

124 kBTransfer

360 kBSize

0 Cookies

7 Outgoing links

Redirected requests

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

56 JavaScript Global Variables

0 Cookies

Indicators

veryfied-paypal.com Open in urlscan Pro
2606:4700:30::6818:7910 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

14
Requests

36 %
HTTPS

40 %
IPv6

6
Domains

8
Subdomains

6
IPs

4
Countries

124 kB
Transfer

360 kB
Size

0
Cookies

14 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!