ebay.co.uk-itm.neil.gknu.com

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 5 HTTP transactions. The main IP is 67.227.154.84, located in Aurora, United States and belongs to LIQUIDWEB, US. The main domain is ebay.co.uk-itm.neil.gknu.com.

This is the only time ebay.co.uk-itm.neil.gknu.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: eBay (E-commerce)

Domain & IP information

	IP Address	AS Autonomous System
1	67.227.154.84 67.227.154.84	32244 (LIQUIDWEB) (LIQUIDWEB)
2	152.199.23.155 152.199.23.155	15133 (EDGECAST) (EDGECAST)
2	2.18.234.107 2.18.234.107	16625 (AKAMAI-AS) (AKAMAI-AS)
5	3

1 67.227.154.84 (Aurora, United States)

ASN32244 (LIQUIDWEB, US)
PTR: host3.gknu.com

ebay.co.uk-itm.neil.gknu.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 152.199.23.155 (United States)

ASN15133 (EDGECAST, US)

ir.ebaystatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2.18.234.107 (Ascension Island)

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-234-107.deploy.static.akamaitechnologies.com

securepics.ebaystatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	ebaystatic.com ir.ebaystatic.com securepics.ebaystatic.com	28 KB
1	gknu.com ebay.co.uk-itm.neil.gknu.com	49 KB
5	2

	Domain	Requested by
2	securepics.ebaystatic.com	ebay.co.uk-itm.neil.gknu.com
2	ir.ebaystatic.com	ebay.co.uk-itm.neil.gknu.com
1	ebay.co.uk-itm.neil.gknu.com
5	3

This site contains links to these domains. Also see Links.

Domain
www.ebay.co.uk
goo.gl

Subject Issuer	Validity	Valid
ir.ebaystatic.com DigiCert SHA2 Secure Server CA	`2019-07-12` - `2021-03-23`	2 years	crt.sh
www.ebay.com DigiCert SHA2 Secure Server CA	`2019-07-17` - `2020-08-18`	a year	crt.sh

This page contains 1 frames:

Primary Page: http://ebay.co.uk-itm.neil.gknu.com/index.php/false/py1n.html/discovercard.com/dfs/accounthome/summary/-www.schwab.com/secure.accurint.com/unfcu2.org/login1
Frame ID: 2FE0302A6437046A62B85F3A57165A34
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

OpenSSL (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i

Page Statistics

5
Requests

80 %
HTTPS

0 %
IPv6

2
Domains

3
Subdomains

3
IPs

2
Countries

77 kB
Transfer

75 kB
Size

0
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://www.ebay.co.uk/
Title: eBay

Search URL Search Domain Scan URL

URL: http://goo.gl/ZM6zkW
Title: Forgot your password?

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request login1 Show response
ebay.co.uk-itm.neil.gknu.com/index.php/false/py1n.html/discovercard.com/dfs/accounthome/summary/-www.schwab.com/secure.accurint.com/unfcu2.org/ 49 KB
49 KB 648ms
392ms Document
text/html 67.227.154.84
LIQUIDWEB

General

Check archive.org

Show headers Download Go to

Full URL: http://ebay.co.uk-itm.neil.gknu.com/index.php/false/py1n.html/discovercard.com/dfs/accounthome/summary/-www.schwab.com/secure.accurint.com/unfcu2.org/login1
Protocol: HTTP/1.1
Server: 67.227.154.84 Aurora, United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS: host3.gknu.com
Software: Apache/2.4.41 (cPanel) OpenSSL/1.1.1d mod_bwlimited/1.4 /
Resource Hash: a773c014d226ebf59d110aa8efff17946a6350634ad7721cf72649df04452a9c

Request headers

Host: ebay.co.uk-itm.neil.gknu.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 12 Mar 2020 00:47:22 GMT
Server: Apache/2.4.41 (cPanel) OpenSSL/1.1.1d mod_bwlimited/1.4
Upgrade: h2,h2c
Connection: Upgrade, Keep-Alive
Cache-Control: max-age=600
Expires: Thu, 12 Mar 2020 00:57:22 GMT
Vary: User-Agent
Keep-Alive: timeout=5, max=200
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H2 200 fxxj3ttftm5ltcqnto1o4baovyl.png
ir.ebaystatic.com/rs/v/ 5 KB
5 KB 50ms
7ms Image
image/png 152.199.23.155
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ir.ebaystatic.com/rs/v/fxxj3ttftm5ltcqnto1o4baovyl.png
Requested by: Host: ebay.co.uk-itm.neil.gknu.com
URL: http://ebay.co.uk-itm.neil.gknu.com/index.php/false/py1n.html/discovercard.com/dfs/accounthome/summary/-www.schwab.com/secure.accurint.com/unfcu2.org/login1
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.23.155 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/8F28) /
Resource Hash: 5440e48584e47738479ccd905576e9ddf2097d07b6c7ba81dda6eeb13b1d4af0

Request headers

Referer: http://ebay.co.uk-itm.neil.gknu.com/index.php/false/py1n.html/discovercard.com/dfs/accounthome/summary/-www.schwab.com/secure.accurint.com/unfcu2.org/login1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 12 Mar 2020 00:47:23 GMT
via: 1.1 lvsincludecache-2522849 (squid)
x-cache-lookup: HIT from lvsincludecache-2522849:80
age: 9412713
x-cache: HIT
status: 200
x-ebay-c-version: 1.0.0
content-length: 4820
last-modified: Wed, 29 Oct 2014 18:09:24 GMT
server: ECAcc (frc/8F28)
access-control-allow-methods: GET
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
rlogid: t6q%60utuf%3C%3Dpieufvuq%60%2847%3A0%3F02-167efeafd16-0xc6
x-ebay-request-id: 167efeaf-d160-a993-b456-87d3fede16e0![]
accept-ranges: bytes
access-control-allow-headers: *
warning: 113 lvsincludecache-2522849 (squid) This cache hit is still fresh and more than 1 day old
expires: Fri, 12 Mar 2021 00:47:23 GMT

GET
H2 200 imgbg.jpg
securepics.ebaystatic.com/aw/pics/cmp/ds3/ 1 KB
2 KB 76ms
22ms Image
image/jpeg 2.18.234.107
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepics.ebaystatic.com/aw/pics/cmp/ds3/imgbg.jpg
Requested by: Host: ebay.co.uk-itm.neil.gknu.com
URL: http://ebay.co.uk-itm.neil.gknu.com/index.php/false/py1n.html/discovercard.com/dfs/accounthome/summary/-www.schwab.com/secure.accurint.com/unfcu2.org/login1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2.18.234.107 , Ascension Island, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-107.deploy.static.akamaitechnologies.com
Software: eBay Server /
Resource Hash: b054c21c769e6e73a3f3f2e51ff27783043d87f8c4cb963c0554b33010fa3efc

Request headers

Referer: http://ebay.co.uk-itm.neil.gknu.com/index.php/false/py1n.html/discovercard.com/dfs/accounthome/summary/-www.schwab.com/secure.accurint.com/unfcu2.org/login1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 12 Mar 2020 00:47:23 GMT
last-modified: Tue, 30 May 2017 20:58:47 GMT
server: eBay Server
etag: "570-550c411e57d01"
content-type: image/jpeg
status: 200
cache-control: max-age=2458177
accept-ranges: bytes
content-length: 1392
expires: Thu, 09 Apr 2020 11:37:00 GMT

GET
H2 200 sprSignIn3.png
securepics.ebaystatic.com/aw/pics/register/ 19 KB
20 KB 76ms
23ms Image
image/png 2.18.234.107
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://securepics.ebaystatic.com/aw/pics/register/sprSignIn3.png

Requested by

Host: ebay.co.uk-itm.neil.gknu.com
URL: http://ebay.co.uk-itm.neil.gknu.com/index.php/false/py1n.html/discovercard.com/dfs/accounthome/summary/-www.schwab.com/secure.accurint.com/unfcu2.org/login1

Protocol

H2

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2.18.234.107 , Ascension Island, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-234-107.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

e2192eadf7564ceb9202cb5b5ddcfb244c4a2627ffd46b7292855972181623ec

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: http://ebay.co.uk-itm.neil.gknu.com/index.php/false/py1n.html/discovercard.com/dfs/accounthome/summary/-www.schwab.com/secure.accurint.com/unfcu2.org/login1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 12 Mar 2020 00:47:23 GMT
x-cache-lookup: HIT from rnopicscache-16128:80
last-modified: Tue, 30 May 2017 21:02:38 GMT
server: Apache
etag: "4de3-550c41fb00e9b"
content-type: image/png
status: 200
cache-control: max-age=458428
accept-ranges: bytes
content-length: 19939
x-xss-protection: 1; mode=block
expires: Tue, 17 Mar 2020 08:07:51 GMT

GET
H2 200 f5uxsy10bmz05dtrtrqybl5qquv.png
ir.ebaystatic.com/rs/v/ 994 B
1 KB 9ms
9ms Image
image/png 152.199.23.155
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ir.ebaystatic.com/rs/v/f5uxsy10bmz05dtrtrqybl5qquv.png?e
Requested by: Host: ebay.co.uk-itm.neil.gknu.com
URL: http://ebay.co.uk-itm.neil.gknu.com/index.php/false/py1n.html/discovercard.com/dfs/accounthome/summary/-www.schwab.com/secure.accurint.com/unfcu2.org/login1
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.23.155 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/8F29) /
Resource Hash: 7e0f4cd0590e2cf36c094d4226d70ccf2bc12107c46f3aeb8b3b5801396b44b0

Request headers

Referer: http://ebay.co.uk-itm.neil.gknu.com/index.php/false/py1n.html/discovercard.com/dfs/accounthome/summary/-www.schwab.com/secure.accurint.com/unfcu2.org/login1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 12 Mar 2020 00:47:23 GMT
via: 1.1 slcincludecache-1959349 (squid)
x-cache-lookup: HIT from slcincludecache-1959349:80
age: 17116371
x-cache: HIT
status: 200
x-ebay-c-version: 1.0.0
content-length: 994
last-modified: Fri, 12 Feb 2016 00:01:35 GMT
server: ECAcc (frc/8F29)
access-control-allow-methods: GET
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000
rlogid: t6q%60utuf%3C%3Dqkiufvuq%60%28755454%3B-16ccffeb9d2-0xb1
x-ebay-request-id: 16ccffeb-9d20-ad3d-d3c7-06c1ffbca252![
accept-ranges: bytes
access-control-allow-headers: *
warning: 113 slcincludecache-1959349 (squid) This cache hit is still fresh and more than 1 day old
expires: Fri, 12 Mar 2021 00:47:23 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: eBay (E-commerce)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ebay.co.uk-itm.neil.gknu.com
ir.ebaystatic.com
securepics.ebaystatic.com
152.199.23.155
2.18.234.107
67.227.154.84
5440e48584e47738479ccd905576e9ddf2097d07b6c7ba81dda6eeb13b1d4af0
7e0f4cd0590e2cf36c094d4226d70ccf2bc12107c46f3aeb8b3b5801396b44b0
a773c014d226ebf59d110aa8efff17946a6350634ad7721cf72649df04452a9c
b054c21c769e6e73a3f3f2e51ff27783043d87f8c4cb963c0554b33010fa3efc
e2192eadf7564ceb9202cb5b5ddcfb244c4a2627ffd46b7292855972181623ec

ebay.co.uk-itm.neil.gknu.com Open in urlscan Pro 67.227.154.84 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

5 Requests

80 %HTTPS

0 %IPv6

2 Domains

3 Subdomains

3 IPs

2 Countries

77 kBTransfer

75 kBSize

0 Cookies

2 Outgoing links

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

0 Cookies

Indicators

ebay.co.uk-itm.neil.gknu.com Open in urlscan Pro
67.227.154.84 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

80 %
HTTPS

0 %
IPv6

2
Domains

3
Subdomains

3
IPs

2
Countries

77 kB
Transfer

75 kB
Size

0
Cookies

5 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!