www.malwarebytes.com Open in urlscan Pro
192.0.66.233  Public Scan

Form analysis
4 forms found in the DOM

GET https://www.malwarebytes.com/

<form role="search" method="get" class="search-form" action="https://www.malwarebytes.com/">
  <label>
    <span class="screen-reader-text">Search for:</span>
    <input type="search" class="search-field" placeholder="Type to search..." value="" name="s">
  </label>
  <input type="submit" class="search-submit" value="Search">
</form>

GET https://www.malwarebytes.com/

<form role="search" method="get" class="search-form" action="https://www.malwarebytes.com/">
  <label>
    <span class="screen-reader-text">Search for:</span>
    <input type="search" class="search-field" placeholder="Type to search..." value="" name="s">
  </label>
  <input type="submit" class="search-submit" value="Search">
</form>

GET https://www.malwarebytes.com/blog/

<form role="search" method="get" class="search-form" action="https://www.malwarebytes.com/blog/">
  <div class="labs-sub-nav__searchbar-wrap">
    <input class="labs-sub-nav__search-input" type="text" name="s" placeholder="Search Labs">
    <button class="labs-sub-nav__search-button" id="cta-labs-rightrail-search-submit-en" aria-label="Search in Malwarebytes">
      <svg xmlns="http://www.w3.org/2000/svg" width="35px" height="35px" viewBox="0 0 24 24" fill="none">
        <g clip-path="url(#clip0_15_152)">
          <rect width="24" height="24" fill="none"></rect>
          <circle cx="10.5" cy="10.5" r="6.5" stroke="#0d3ecc" stroke-linejoin="round"></circle>
          <path d="M19.6464 20.3536C19.8417 20.5488 20.1583 20.5488 20.3536 20.3536C20.5488 20.1583 20.5488 19.8417 20.3536 19.6464L19.6464 20.3536ZM20.3536 19.6464L15.3536 14.6464L14.6464 15.3536L19.6464 20.3536L20.3536 19.6464Z" fill="#0d3ecc">
          </path>
        </g>
        <defs>
          <clipPath id="clip0_15_152">
            <rect width="24" height="24" fill="#0d3ecc"></rect>
          </clipPath>
        </defs>
      </svg>
    </button>
  </div>
</form>

https://www.malwarebytes.com/newsletter/

<form action="https://www.malwarebytes.com/newsletter/" class="newsletter-form">
  <div class="newsletter-form__inline">
    <label>Email Address</label>
    <input type="email" name="email" id="cta-footer-newsletter-input-email-en" placeholder="Email Address" required="" class="newsletter-form__email">
    <input type="hidden" class="newsletter-form__pageurl" value="https://www.malwarebytes.com/blog/scams/2024/11/large-ebay-malvertising-campaign-leads-to-scams">
    <input name="source" type="hidden" value="">
    <input type="submit" value="Sign Up" class="newsletter-form__btn" id="cta-footer-newsletter-subscribe-email-en">
  </div>
  <div class="newsletter-form__validate hidden">
    <span></span>
  </div>
</form>

Text Content

Skip to content
Search
Search Malwarebytes.com
Search for:
 * Sign In

 * Personal
   
   < Personal
   
   Products
    * Malwarebytes Premium Security >
    * Malwarebytes Privacy VPN >
    * Malwarebytes Identity Theft Protection >
    * Personal Data Remover >
    * Malwarebytes Browser Guard >
    * Malwarebytes for Teams/small offices >
    * AdwCleaner for Windows >
   
   --------------------------------------------------------------------------------
   
   Find the right product
   
   See our plans
   
   Infected already?
   
   Clean your device now
   Solutions
    * Free antivirus >
    * Free virus scan & removal >
    * Windows antivirus >
    * Mac antivirus >
    * Android antivirus >
    * iOS security >
    * Digital Footprint Scan >
   
   See personal pricing
   Manage your subscription
   Visit our support page 
   
 * Business
   
   < Business
   
   BUNDLES
    * ThreatDown Bundles
    * Protect your endpoints with powerfully simple and cost-effective bundles
    * Education Bundles
    * Secure your students and institution against cyberattacks
   
   TECHNOLOGY HIGHLIGHTS
    * Managed Detection & Response (MDR)
    * Deploy fully-managed threat monitoring, investigation, and remediation
    * Endpoint Detection & Response (EDR)
    * Prevent more attacks with security that catches what others miss
    * Explore our portfolio >
   
   Visualize and optimize your security posture in just minutes.
   
   Learn more about Security Advisor (available in every bundle). >

 * Pricing
   
   < Pricing
   
   Personal pricing
   
   Protect your personal devices and data
   
   Small office/home office pricing
   
   Protect your team’s devices and data
   
   Business pricing (5+ employees)
   
   Step up your corporate endpoint security. Save up to 45%
   
   
 * Partners
   
   < Partners
   
   
   Explore Partnerships
   Partner Solutions
    * Resellers
    * Managed Service Providers
    * Computer Repair
    * Technology Partners
    * Affiliate Partners
   
   Contact Us
   
 * Resources
   
   < Resources
   
    * Security terms glossary >
    * Threat Center >
    * Cybersecurity News >
   
    * About Malwarebytes >
    * Press >
    * Careers >
   
   Cybersecurity Resource Center
    * Antivirus >
    * Malware >
    * Ransomware >
    * Phishing >
    * See all articles >

 * Support
   
   < Support
   
   Malwarebytes Personal Support
   
   Malwarebytes and Teams Customers
   
   ThreatDown Business Support
   
   Nebula and Oneview Customers
   
   Community Forums

Free Download
 * Sign In

Search Search
Search Malwarebytes.com
Search for:
SUBSCRIBE rss

Scams


LARGE EBAY MALVERTISING CAMPAIGN LEADS TO SCAMS

Posted: November 6, 2024 by Jérôme Segura

Tech support scammers are targeting eBay customers in the U.S. via fraudulent
Google ads. In a few separate searches, we were able to identify multiple
Sponsored results that were created from at least four different advertiser
accounts.

While most of those ads clearly looked fake, they appeared consistently and
prominently enough to trick the inattentive user into a scam. Victims who
clicked the ad were redirected to bogus websites prompting them to call for
assistance, leading them straight into the scammer’s den.

We have reported the malicious ads to Google and are monitoring for similar
campaigns targeting other brands.


FLURRY OF ADS

A search for ‘ebay phone number‘ or ‘ebay customer service‘ from the U.S. using
Google Chrome returned several ads that were entirely fraudulent. Upon closer
inspection, we found that they were created from four separate advertiser
accounts, some belonging to legitimate entities, some created from scratch.

The first ad shown in the screenshot above is the most deceiving of all since it
uses eBay’s brand name, logo and website. While Google has strict rules about
who may be allowed to do this (i.e. the owner, affiliates), scammers are able to
still “comply” with the rule and yet be total crooks.

All they need to do is ensure the final URL (once you click the ad) is one the
same domain or is a subdomain that matches the one shown in the ad. That’s the
case here, as they are using developer.ebay.com. (part of eBay’s Developers
Program Search) which can technically be claimed as belonging to ebay.com.

Yet, as you can see below, the destination URL is not what one would expect. It
shows a search portal with a printed search result that has eBay’s customer
service phone number (narrator: it is not).

This is a trick we’ve seen recently with various online platforms: you perform a
calculated search query, even if you know no result will be found. What matters
is that your search query will appear on screen, and will be used to fool people
who see it. In the example above, the search query was for
“eBay.Customer-Service +1 (866) 409[-]9281“.

The other ads redirect to fake websites or pages hosted on cloud providers such
as BitBucket claiming to be eBay customer service. Once again, scammers make it
clear and obvious that users should call the phone number displayed on screen.


KEEPING SCAMMERS AT BAY

Calling any of those phone numbers is strongly discouraged, unless of course
your favorite sport is scam baiting. The tried and tested “tech support scam” is
one of the most costly type of crime for American consumers.

From call centres mostly located overseas, young people with a broken English
accent will attempt to trick victims into giving them access to their computer
or phone. The end goal is to steal as much money as they can, by requesting gift
cards or by taking over people’s own bank accounts.

It is important to always double check before calling any phone number,
especially if it came from an ad or an unsolicited email. In doubt, always visit
the source, i.e. ebay.com to access support via live chat or get their official
number.

If you weren’t already, you may want to consider using a browser extension such
as Malwarebytes Browser Guard. Not only does it block ads, it also detects
phishing sites of various kinds.

--------------------------------------------------------------------------------

We don’t just report on threats – we help safeguard your entire digital identity

Cybersecurity risks should never spread beyond a headline. Protect your—and your
family’s—personal information by using identity protection.


INDICATORS OF COMPROMISE

Fake pages

e-bays-24x7support-number[.]vercel[.]app
developer[.]ebay[.]com
e-bay24x7pluscaresupport[.]bitbucket[.]io
upbay[.]online
e-bay24x7customer[.]casterins[.]online
e-bay24x7-customers-services-assist[.]onrender[.]com

Fraudulent phone numbers

1[-]866[-]409[-]9281
1[-]833[-]714[-]3970
1[-]805[-]372[-]1369

SHARE THIS ARTICLE



RELATED ARTICLES

News


A WEEK IN SECURITY (NOVEMBER 4 – NOVEMBER 10)

November 11, 2024 - A list of topics we covered in the week of November 4 to
November 10 of 2024

CONTINUE READING 0 Comments
Cybercrime


HELLO AGAIN, FAKEBAT: POPULAR LOADER RETURNS AFTER MONTHS-LONG HIATUS

November 8, 2024 - The web browser, and search engines in particular, continue
to be a popular entry point to deliver malware to users. While...

CONTINUE READING 2 Comments
News | Privacy


AIR FRYERS ARE THE LATEST SURVEILLANCE THREAT YOU DIDN’T CONSIDER

November 7, 2024 - Consumer group Which? found privacy issues in connected air
fryers. How smart do we want and need our appliances to be?

CONTINUE READING 0 Comments
Personal


MALWAREBYTES ACQUIRES AZIREVPN TO FUEL ADDITIONAL VPN FEATURES AND
FUNCTIONALITIES 

November 7, 2024 - We have great news to share: Malwarebytes has acquired
AzireVPN, a privacy-focused VPN provider.

CONTINUE READING 0 Comments
Podcast


8 SECURITY TIPS FOR SMALL BUSINESSES

November 6, 2024 - Small businesses have the same security problems as big
corporations, but not the budget or staff to match. Here are some tips to help.

CONTINUE READING 0 Comments

ABOUT THE AUTHOR

Jérôme Segura

Sr Director, Research

Contributors

Threat Center

Podcast

Glossary

Scams

Cyberprotection for every one.

COMPUTER SECURITY

 * Rootkit Scanner
 * Trojan Scanner
 * Free Antivirus
 * Free Virus Scan
 * Premium protection

MOBILE SECURITY

 * Antivirus for Android

 * iOS Security and Spam Blocker

PRIVACY PROTECTION

 * Privacy VPN (Virtual Private Network)
 * Digital Footprint Scan
 * Dark Web Monitoring
 * Adware Removal
 * Ad Blocker

IDENTITY PROTECTION

 * Identity Monitoring & Alerts
 * Credit Monitoring & Reporting
 * Identity Recovery & Resolution
 * ID Theft Insurance
 * Personal Data Remover

LEARN ABOUT CYBERSECURITY

 * Blog
 * Social Engineering
 * Phishing
 * Ransomware
 * Malware
 * Antivirus
 * What is a VPN?
 * Doxxing

PARTNER WITH MALWAREBYTES

 * Computer Repair
 * Affiliates

ADDRESS

One Albert Quay
2nd Floor
Cork T12 X8N6
Ireland

3979 Freedom Circle
12th Floor
Santa Clara, CA 95054

ABOUT MALWAREBYTES

 * Careers
 * News and Press
 * Vulnerability Disclosure
 * False Positive Report
 * Forums

GET HELP

 * Help Center
 * Sign in to MyAccount

 * Business Endpoint Security Solutions
 * Managed Service Provider (MSP) Program

 * Twitter
 * Facebook
 * LinkedIn
 * Youtube
 * Instagram


CYBERSECURITY INFO YOU CAN’T LIVE WITHOUT

Want to stay informed on the latest news in cybersecurity? Sign up for our
newsletter and learn how to protect your computer from threats.

Email Address

 * Legal
 * Privacy
 * Terms of Service
 * Accessibility
 * Imprint

© 2024 All Rights Reserved




This website uses cookies to enhance user experience and to analyze performance
and traffic on our website. We also share information about your use of our site
with our social media, advertising and analytics partners.
Do Not Sell or Share My Personal Information



DO NOT SELL MY PERSONAL INFORMATION

When you visit our website, we store cookies on your browser to collect
information. The information collected might relate to you, your preferences or
your device, and is mostly used to make the site work as you expect it to and to
provide a more personalized web experience. However, you can choose not to allow
certain types of cookies, which may impact your experience of the site and the
services we are able to offer. Click on the different category headings to find
out more and change our default settings according to your preference. You
cannot opt-out of our First Party Strictly Necessary Cookies as they are
deployed in order to ensure the proper functioning of our website (such as
prompting the cookie banner and remembering your settings, to log into your
account, to redirect you when you log out, etc.). For more information about the
First and Third Party Cookies used please follow this link.
More information
Allow All


MANAGE CONSENT PREFERENCES

STRICTLY NECESSARY

Always Active

These cookies are necessary for the website to function and cannot be switched
off in our systems. They are usually only set in response to actions made by you
which amount to a request for services, such as setting your privacy
preferences, logging in or filling in forms.    You can set your browser to
block or alert you about these cookies, but some parts of the site will not then
work. These cookies do not store any personally identifiable information.

SALE OF PERSONAL DATA

Sale of Personal Data

this includes Targeting cookies

 * ADVERTISING
   
   Switch Label label
   
   These cookies may be set through our site by our advertising partners. They
   may be used by those companies to build a profile of your interests and show
   you relevant adverts on other sites.    They do not store directly personal
   information, but are based on uniquely identifying your browser and internet
   device. If you do not allow these cookies, you will experience less targeted
   advertising.

Back Button


COOKIE LIST



Search Icon
Filter Icon

Clear
checkbox label label
Apply Cancel
Consent Leg.Interest
checkbox label label
checkbox label label
checkbox label label

Confirm My Choices