viewitem.eday.couk.myb.sum.ws.mary.ay.gbh155985.pmjsm9r3ktjpubsnfspsv7.k9l7d5k8uutps498.rebelyell.agency Open in urlscan Pro
107.180.2.188 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://viewitem.eday.couk.myb.sum.ws.mary.ay.gbh155985.pmjsm9r3ktjpubsnfspsv7.k9l7d5k8uutps498.rebelyell.agency/
Effective URL:
http://viewitem.eday.couk.myb.sum.ws.mary.ay.gbh155985.pmjsm9r3ktjpubsnfspsv7.k9l7d5k8uutps498.rebelyell.agency/Login.php?sslchannel=true&sessionid=fVsGcRFs5GEkWSizBlV62UG1Nc4107f4vqV3ZKFwedYrOIkJlwHeRR2eD8rs...
Submission: On December 07 via manual (December 7th 2020, 8:12:24 pm UTC) from DE

Summary HTTP 11 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 5 IPs in 3 countries across 4 domains to perform 11 HTTP transactions. The main IP is 107.180.2.188, located in Scottsdale, United States and belongs to AS-26496-GO-DADDY-COM-LLC, US. The main domain is viewitem.eday.couk.myb.sum.ws.mary.ay.gbh155985.pmjsm9r3ktjpubsnfspsv7.k9l7d5k8uutps498.rebelyell.agency.

This is the only time viewitem.eday.couk.myb.sum.ws.mary.ay.gbh155985.pmjsm9r3ktjpubsnfspsv7.k9l7d5k8uutps498.rebelyell.agency was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: eBay (E-commerce)

Domain & IP information

	IP Address	AS Autonomous System
2	107.180.2.188 107.180.2.188	26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC)
6	2a04:4e42:3::718 2a04:4e42:3::718	54113 (FASTLY) (FASTLY)
1	2.16.186.25 2.16.186.25	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1 1	64.4.252.11 64.4.252.11	11643 (EBAY) (EBAY)
2	104.75.89.51 104.75.89.51	16625 (AKAMAI-AS) (AKAMAI-AS)
11	5

2 107.180.2.188 (Scottsdale, United States)

ASN26496 (AS-26496-GO-DADDY-COM-LLC, US)
PTR: ip-107-180-2-188.ip.secureserver.net

viewitem.eday.couk.myb.sum.ws.mary.ay.gbh155985.pmjsm9r3ktjpubsnfspsv7.k9l7d5k8uutps498.rebelyell.agency	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a04:4e42:3::718 (Ascension Island)

ASN54113 (FASTLY, US)

ir.ebaystatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.16.186.25 (Ascension Island)

ASN20940 (AKAMAI-ASN1, EU)
PTR: a2-16-186-25.deploy.static.akamaitechnologies.com

include.ebaystatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 64.4.252.11 (United States) 1 redirects

ASN11643 (EBAY, US)
PTR: rover-web-public-1-3-rnoaz01.ebay.com

rover.ebay.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.75.89.51 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a104-75-89-51.deploy.static.akamaitechnologies.com

rover.ebay.co.uk	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	ebaystatic.com ir.ebaystatic.com include.ebaystatic.com	36 KB
2	ebay.co.uk rover.ebay.co.uk	997 B
2	rebelyell.agency viewitem.eday.couk.myb.sum.ws.mary.ay.gbh155985.pmjsm9r3ktjpubsnfspsv7.k9l7d5k8uutps498.rebelyell.agency	16 KB
1	ebay.com 1 redirects rover.ebay.com	806 B
11	4

	Domain	Requested by
6	ir.ebaystatic.com	viewitem.eday.couk.myb.sum.ws.mary.ay.gbh155985.pmjsm9r3ktjpubsnfspsv7.k9l7d5k8uutps498.rebelyell.agency ir.ebaystatic.com
2	rover.ebay.co.uk	viewitem.eday.couk.myb.sum.ws.mary.ay.gbh155985.pmjsm9r3ktjpubsnfspsv7.k9l7d5k8uutps498.rebelyell.agency
2	viewitem.eday.couk.myb.sum.ws.mary.ay.gbh155985.pmjsm9r3ktjpubsnfspsv7.k9l7d5k8uutps498.rebelyell.agency	viewitem.eday.couk.myb.sum.ws.mary.ay.gbh155985.pmjsm9r3ktjpubsnfspsv7.k9l7d5k8uutps498.rebelyell.agency
1	rover.ebay.com	1 redirects
1	include.ebaystatic.com	viewitem.eday.couk.myb.sum.ws.mary.ay.gbh155985.pmjsm9r3ktjpubsnfspsv7.k9l7d5k8uutps498.rebelyell.agency
11	5

This site contains links to these domains. Also see Links.

Domain
reg.ebay.co.uk

Subject Issuer	Validity	Valid
i.ebayimg.com DigiCert SHA2 Secure Server CA	`2020-10-15` - `2021-10-19`	a year	crt.sh
www.ebay.com DigiCert SHA2 Secure Server CA	`2020-05-28` - `2021-05-29`	a year	crt.sh

This page contains 1 frames:

Primary Page: http://viewitem.eday.couk.myb.sum.ws.mary.ay.gbh155985.pmjsm9r3ktjpubsnfspsv7.k9l7d5k8uutps498.rebelyell.agency/Login.php?sslchannel=true&sessionid=fVsGcRFs5GEkWSizBlV62UG1Nc4107f4vqV3ZKFwedYrOIkJlwHeRR2eD8rsP0g9rJCmJBqLtNcrzdITkiv33bXhRUw9nNJlusm6YB8JhiBFGtOlzgucubI4vgosbDwIPu
Frame ID: 1C50B2E12433A04DD2D74B7212498F30
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://viewitem.eday.couk.myb.sum.ws.mary.ay.gbh155985.pmjsm9r3ktjpubsnfspsv7.k9l7d5k8uutps498.rebelyell.agency/ Page URL
http://viewitem.eday.couk.myb.sum.ws.mary.ay.gbh155985.pmjsm9r3ktjpubsnfspsv7.k9l7d5k8uutps498.rebelyell.agency/Login.php?sslchannel=true&sessionid=fVsGcRFs5GEkWSizBlV62UG1Nc4107f4vqV3ZKFw... Page URL

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

11
Requests

73 %
HTTPS

20 %
IPv6

4
Domains

5
Subdomains

5
IPs

3
Countries

53 kB
Transfer

177 kB
Size

1
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://reg.ebay.co.uk/reg/PartialReg?siteid=3&co_partnerId=0&UsingSSL=1&rv4=1&pageType=3984&ru=https%3A%2F%2Fmy.ebay.co.uk%2Fws%2FeBayISAPI.dll%3FMyEbayBeta%26MyEbay%3D%26gbh%3D1%26guest%3D1&signInUrl=https%3A%2F%2Fwww.ebay.co.uk%2Fsignin%3Fsgn%3Dreg%26siteid%3D3%26co_partnerId%3D0%26UsingSSL%3D1%26rv4%3D1%26pageType%3D3984%26ru%3Dhttps%253A%252F%252Fmy.ebay.co.uk%252Fws%252FeBayISAPI.dll%253FMyEbayBeta%2526MyEbay%253D%2526gbh%253D1%2526guest%253D1
Title: create an account

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://viewitem.eday.couk.myb.sum.ws.mary.ay.gbh155985.pmjsm9r3ktjpubsnfspsv7.k9l7d5k8uutps498.rebelyell.agency/ Page URL
http://viewitem.eday.couk.myb.sum.ws.mary.ay.gbh155985.pmjsm9r3ktjpubsnfspsv7.k9l7d5k8uutps498.rebelyell.agency/Login.php?sslchannel=true&sessionid=fVsGcRFs5GEkWSizBlV62UG1Nc4107f4vqV3ZKFwedYrOIkJlwHeRR2eD8rsP0g9rJCmJBqLtNcrzdITkiv33bXhRUw9nNJlusm6YB8JhiBFGtOlzgucubI4vgosbDwIPu Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 6

https://rover.ebay.com/roversync/?site=3&stg=1&mpt=1588957805387 HTTP 301
https://rover.ebay.co.uk/roversync/?site=3&stg=1&cguid=3ed534581760aae909d0da5ff9cbceb9&mpt=1607371928665

11 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Cookie set /
viewitem.eday.couk.myb.sum.ws.mary.ay.gbh155985.pmjsm9r3ktjpubsnfspsv7.k9l7d5k8uutps498.rebelyell.agency/ 254 B
703 B 306ms
286ms Document
text/html 107.180.2.188
AS-26496-GO-DADDY...

General

Check archive.org

Show headers Download Go to

Full URL: http://viewitem.eday.couk.myb.sum.ws.mary.ay.gbh155985.pmjsm9r3ktjpubsnfspsv7.k9l7d5k8uutps498.rebelyell.agency/
Protocol: HTTP/1.1
Server: 107.180.2.188 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS: ip-107-180-2-188.ip.secureserver.net
Software: Apache / PHP/7.3.23
Resource Hash

Request headers

Host: viewitem.eday.couk.myb.sum.ws.mary.ay.gbh155985.pmjsm9r3ktjpubsnfspsv7.k9l7d5k8uutps498.rebelyell.agency
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 07 Dec 2020 20:12:07 GMT
Server: Apache
X-Powered-By: PHP/7.3.23
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Set-Cookie: PHPSESSID=580a2e7e0716b1cc5bce48a706f6cc65; path=/
Upgrade: h2,h2c
Connection: Upgrade, Keep-Alive
Vary: Accept-Encoding,User-Agent
Content-Encoding: gzip
Content-Length: 239
Keep-Alive: timeout=5
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK Primary Request Login.php Show response
viewitem.eday.couk.myb.sum.ws.mary.ay.gbh155985.pmjsm9r3ktjpubsnfspsv7.k9l7d5k8uutps498.rebelyell.agency/ 44 KB
16 KB 324ms
323ms Document
text/html 107.180.2.188
AS-26496-GO-DADDY...

General

Check archive.org

Show headers Download Go to

Full URL: http://viewitem.eday.couk.myb.sum.ws.mary.ay.gbh155985.pmjsm9r3ktjpubsnfspsv7.k9l7d5k8uutps498.rebelyell.agency/Login.php?sslchannel=true&sessionid=fVsGcRFs5GEkWSizBlV62UG1Nc4107f4vqV3ZKFwedYrOIkJlwHeRR2eD8rsP0g9rJCmJBqLtNcrzdITkiv33bXhRUw9nNJlusm6YB8JhiBFGtOlzgucubI4vgosbDwIPu
Requested by: Host: viewitem.eday.couk.myb.sum.ws.mary.ay.gbh155985.pmjsm9r3ktjpubsnfspsv7.k9l7d5k8uutps498.rebelyell.agency
URL: http://viewitem.eday.couk.myb.sum.ws.mary.ay.gbh155985.pmjsm9r3ktjpubsnfspsv7.k9l7d5k8uutps498.rebelyell.agency/
Protocol: HTTP/1.1
Server: 107.180.2.188 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS: ip-107-180-2-188.ip.secureserver.net
Software: Apache / PHP/7.3.23
Resource Hash: bfdc924879f949239156f2070f65ec62f31f99c1d58748935cdb37655bb84c58

Request headers

Host: viewitem.eday.couk.myb.sum.ws.mary.ay.gbh155985.pmjsm9r3ktjpubsnfspsv7.k9l7d5k8uutps498.rebelyell.agency
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://viewitem.eday.couk.myb.sum.ws.mary.ay.gbh155985.pmjsm9r3ktjpubsnfspsv7.k9l7d5k8uutps498.rebelyell.agency/
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Cookie: PHPSESSID=580a2e7e0716b1cc5bce48a706f6cc65
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: http://viewitem.eday.couk.myb.sum.ws.mary.ay.gbh155985.pmjsm9r3ktjpubsnfspsv7.k9l7d5k8uutps498.rebelyell.agency/

Response headers

Date: Mon, 07 Dec 2020 20:12:07 GMT
Server: Apache
X-Powered-By: PHP/7.3.23
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Content-Encoding: gzip
Content-Length: 15567
Keep-Alive: timeout=5
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

GET
H2 200 34wtddjp0q1v1dtu2elv5jwg4yf.css
ir.ebaystatic.com/rs/v/ 4 KB
2 KB 22ms
6ms Stylesheet
text/css 2a04:4e42:3::718
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://ir.ebaystatic.com/rs/v/34wtddjp0q1v1dtu2elv5jwg4yf.css?proc=DU:N
Requested by: Host: viewitem.eday.couk.myb.sum.ws.mary.ay.gbh155985.pmjsm9r3ktjpubsnfspsv7.k9l7d5k8uutps498.rebelyell.agency
URL: http://viewitem.eday.couk.myb.sum.ws.mary.ay.gbh155985.pmjsm9r3ktjpubsnfspsv7.k9l7d5k8uutps498.rebelyell.agency/Login.php?sslchannel=true&sessionid=fVsGcRFs5GEkWSizBlV62UG1Nc4107f4vqV3ZKFwedYrOIkJlwHeRR2eD8rsP0g9rJCmJBqLtNcrzdITkiv33bXhRUw9nNJlusm6YB8JhiBFGtOlzgucubI4vgosbDwIPu
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:3::718 , Ascension Island, ASN54113 (FASTLY, US),
Reverse DNS
Software: ebay server /
Resource Hash: ddd6e288270268de6b427fb4760e0d1384fff8e72a643faa642d4f51203b0efe

Request headers

Referer: http://viewitem.eday.couk.myb.sum.ws.mary.ay.gbh155985.pmjsm9r3ktjpubsnfspsv7.k9l7d5k8uutps498.rebelyell.agency/Login.php?sslchannel=true&sessionid=fVsGcRFs5GEkWSizBlV62UG1Nc4107f4vqV3ZKFwedYrOIkJlwHeRR2eD8rsP0g9rJCmJBqLtNcrzdITkiv33bXhRUw9nNJlusm6YB8JhiBFGtOlzgucubI4vgosbDwIPu
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 07 Dec 2020 20:12:07 GMT
content-encoding: gzip
x-cache-lookup: HIT from lvsaz01includecache-971932:80
age: 18559461
x-cache: HIT from lvsaz01includecache-971932, HIT
x-cache-hits: 102335
x-ebay-c-version: 1.0.0
content-length: 1724
via: 1.1 lvsaz01includecache-971932 (squid), 1.1 varnish
x-served-by: cache-fra19164-FRA
last-modified: Wed, 08 May 2019 00:47:47 GMT
server: ebay server
x-timer: S1607371928.896283,VS0,VE0
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: text/css;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, immutable
rlogid: t6q%60utuf%3C%3Dosuufvuq%60%285610%3F4%3B-171ec9a4e23-0xb9
accept-ranges: bytes
access-control-allow-headers: *
expires: Fri, 07 May 2021 00:47:47 GMT

GET
H2 200 signin-render-uowXfL58.css
ir.ebaystatic.com/rs/c/ 113 KB
18 KB 24ms
7ms Stylesheet
text/css 2a04:4e42:3::718
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://ir.ebaystatic.com/rs/c/signin-render-uowXfL58.css
Requested by: Host: viewitem.eday.couk.myb.sum.ws.mary.ay.gbh155985.pmjsm9r3ktjpubsnfspsv7.k9l7d5k8uutps498.rebelyell.agency
URL: http://viewitem.eday.couk.myb.sum.ws.mary.ay.gbh155985.pmjsm9r3ktjpubsnfspsv7.k9l7d5k8uutps498.rebelyell.agency/Login.php?sslchannel=true&sessionid=fVsGcRFs5GEkWSizBlV62UG1Nc4107f4vqV3ZKFwedYrOIkJlwHeRR2eD8rsP0g9rJCmJBqLtNcrzdITkiv33bXhRUw9nNJlusm6YB8JhiBFGtOlzgucubI4vgosbDwIPu
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:3::718 , Ascension Island, ASN54113 (FASTLY, US),
Reverse DNS
Software: ebay server /
Resource Hash: d6b11659c604d115f446eca7b4cb0416423f5ef47bd7050e03372d4475f22730

Request headers

Referer: http://viewitem.eday.couk.myb.sum.ws.mary.ay.gbh155985.pmjsm9r3ktjpubsnfspsv7.k9l7d5k8uutps498.rebelyell.agency/Login.php?sslchannel=true&sessionid=fVsGcRFs5GEkWSizBlV62UG1Nc4107f4vqV3ZKFwedYrOIkJlwHeRR2eD8rsP0g9rJCmJBqLtNcrzdITkiv33bXhRUw9nNJlusm6YB8JhiBFGtOlzgucubI4vgosbDwIPu
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 07 Dec 2020 20:12:07 GMT
content-encoding: gzip
x-cache-lookup: HIT from include-cache-2:80
age: 106911
x-cache: HIT from include-cache-2, HIT
x-cache-hits: 1
x-ebay-c-version: 1.0.0
content-length: 17811
via: 1.1 include-cache-2 (squid), 1.1 varnish
x-served-by: cache-fra19164-FRA
last-modified: Wed, 06 May 2020 21:01:49 GMT
server: ebay server
x-timer: S1607371928.896359,VS0,VE2
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000, immutable
rlogid: t6q%60utuf%3C%3Dosuufvuq%60%28e%7Dkt0*w%60ut3540-1763875db6e-0xbc
accept-ranges: bytes
access-control-allow-headers: *
expires: Mon, 06 Dec 2021 14:30:16 GMT

GET
H/1.1 200
OK ebay-ns.css
include.ebaystatic.com/css/v/us/legacy/ 1 KB
835 B 461ms
39ms Stylesheet
text/css 2.16.186.25
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: http://include.ebaystatic.com/css/v/us/legacy/ebay-ns.css
Requested by: Host: viewitem.eday.couk.myb.sum.ws.mary.ay.gbh155985.pmjsm9r3ktjpubsnfspsv7.k9l7d5k8uutps498.rebelyell.agency
URL: http://viewitem.eday.couk.myb.sum.ws.mary.ay.gbh155985.pmjsm9r3ktjpubsnfspsv7.k9l7d5k8uutps498.rebelyell.agency/Login.php?sslchannel=true&sessionid=fVsGcRFs5GEkWSizBlV62UG1Nc4107f4vqV3ZKFwedYrOIkJlwHeRR2eD8rsP0g9rJCmJBqLtNcrzdITkiv33bXhRUw9nNJlusm6YB8JhiBFGtOlzgucubI4vgosbDwIPu
Protocol: HTTP/1.1
Server: 2.16.186.25 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS: a2-16-186-25.deploy.static.akamaitechnologies.com
Software: Apache/2.4.29 (Ubuntu) /
Resource Hash: 1cc62d824df3d449c9abc491caf0e43c9dfc89be90b780b5e7243e681d5ab64d

Request headers

Referer: http://viewitem.eday.couk.myb.sum.ws.mary.ay.gbh155985.pmjsm9r3ktjpubsnfspsv7.k9l7d5k8uutps498.rebelyell.agency/Login.php?sslchannel=true&sessionid=fVsGcRFs5GEkWSizBlV62UG1Nc4107f4vqV3ZKFwedYrOIkJlwHeRR2eD8rsP0g9rJCmJBqLtNcrzdITkiv33bXhRUw9nNJlusm6YB8JhiBFGtOlzgucubI4vgosbDwIPu
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 07 Dec 2020 20:12:08 GMT
Content-Encoding: gzip
Last-Modified: Thu, 03 Dec 2020 19:23:31 GMT
Server: Apache/2.4.29 (Ubuntu)
ETag: "430-5b5944b8ef2c0-gzip"
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: max-age=36972
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 461
Expires: Tue, 08 Dec 2020 06:28:20 GMT

GET
H2 200 fxxj3ttftm5ltcqnto1o4baovyl.png
ir.ebaystatic.com/rs/v/ 5 KB
5 KB 22ms
6ms Image
image/png 2a04:4e42:3::718
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ir.ebaystatic.com/rs/v/fxxj3ttftm5ltcqnto1o4baovyl.png
Requested by: Host: viewitem.eday.couk.myb.sum.ws.mary.ay.gbh155985.pmjsm9r3ktjpubsnfspsv7.k9l7d5k8uutps498.rebelyell.agency
URL: http://viewitem.eday.couk.myb.sum.ws.mary.ay.gbh155985.pmjsm9r3ktjpubsnfspsv7.k9l7d5k8uutps498.rebelyell.agency/Login.php?sslchannel=true&sessionid=fVsGcRFs5GEkWSizBlV62UG1Nc4107f4vqV3ZKFwedYrOIkJlwHeRR2eD8rsP0g9rJCmJBqLtNcrzdITkiv33bXhRUw9nNJlusm6YB8JhiBFGtOlzgucubI4vgosbDwIPu
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:3::718 , Ascension Island, ASN54113 (FASTLY, US),
Reverse DNS
Software: envoy /
Resource Hash: 5440e48584e47738479ccd905576e9ddf2097d07b6c7ba81dda6eeb13b1d4af0

Request headers

Referer: http://viewitem.eday.couk.myb.sum.ws.mary.ay.gbh155985.pmjsm9r3ktjpubsnfspsv7.k9l7d5k8uutps498.rebelyell.agency/Login.php?sslchannel=true&sessionid=fVsGcRFs5GEkWSizBlV62UG1Nc4107f4vqV3ZKFwedYrOIkJlwHeRR2eD8rsP0g9rJCmJBqLtNcrzdITkiv33bXhRUw9nNJlusm6YB8JhiBFGtOlzgucubI4vgosbDwIPu
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 07 Dec 2020 20:12:07 GMT
via: 1.1 include-cache-3 (squid), 1.1 varnish
x-cache-lookup: HIT from include-cache-3:80
x-ebay-pop-id: UFES2-SYD-irstatic-1
age: 10073099
rlogid: t6q%60utuf%3C%3Dpieufvuq%60%285620771-173e66dec6d-0xd6
x-cache: HIT from include-cache-3, HIT
x-envoy-upstream-service-time: 152
x-ebay-c-version: 1.0.0
content-length: 4820
x-served-by: cache-fra19164-FRA
last-modified: Wed, 29 Oct 2014 18:09:24 GMT
server: envoy
x-timer: S1607371928.896621,VS0,VE0
access-control-allow-methods: GET
content-type: image/png
access-control-allow-origin: *
expires: Fri, 13 Aug 2021 06:07:10 GMT
cache-control: public, max-age=31536000, immutable
warning: 113 squid "This cache hit is still fresh and more than 1 day old"
accept-ranges: bytes
access-control-allow-headers: *
x-cache-hits: 223468

GET
DATA 200
OK truncated Show response
/ 0
0 Script
text/html

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: http://viewitem.eday.couk.myb.sum.ws.mary.ay.gbh155985.pmjsm9r3ktjpubsnfspsv7.k9l7d5k8uutps498.rebelyell.agency/Login.php?sslchannel=true&sessionid=fVsGcRFs5GEkWSizBlV62UG1Nc4107f4vqV3ZKFwedYrOIkJlwHeRR2eD8rsP0g9rJCmJBqLtNcrzdITkiv33bXhRUw9nNJlusm6YB8JhiBFGtOlzgucubI4vgosbDwIPu
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: text/html;charset=utf-8

GET
H2

200

/
rover.ebay.co.uk/roversync/
Redirect Chain

https://rover.ebay.com/roversync/?site=3&stg=1&mpt=1588957805387
https://rover.ebay.co.uk/roversync/?site=3&stg=1&cguid=3ed534581760aae909d0da5ff9cbceb9&mpt=1607371928665

42 B
611 B

222ms
221ms

Image
image/gif

104.75.89.51
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://rover.ebay.co.uk/roversync/?site=3&stg=1&cguid=3ed534581760aae909d0da5ff9cbceb9&mpt=1607371928665

Requested by

Host: viewitem.eday.couk.myb.sum.ws.mary.ay.gbh155985.pmjsm9r3ktjpubsnfspsv7.k9l7d5k8uutps498.rebelyell.agency
URL: http://viewitem.eday.couk.myb.sum.ws.mary.ay.gbh155985.pmjsm9r3ktjpubsnfspsv7.k9l7d5k8uutps498.rebelyell.agency/Login.php?sslchannel=true&sessionid=fVsGcRFs5GEkWSizBlV62UG1Nc4107f4vqV3ZKFwedYrOIkJlwHeRR2eD8rsP0g9rJCmJBqLtNcrzdITkiv33bXhRUw9nNJlusm6YB8JhiBFGtOlzgucubI4vgosbDwIPu

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.75.89.51 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-75-89-51.deploy.static.akamaitechnologies.com

Software

ebay-proxy-server /

Resource Hash

6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: http://viewitem.eday.couk.myb.sum.ws.mary.ay.gbh155985.pmjsm9r3ktjpubsnfspsv7.k9l7d5k8uutps498.rebelyell.agency/Login.php?sslchannel=true&sessionid=fVsGcRFs5GEkWSizBlV62UG1Nc4107f4vqV3ZKFwedYrOIkJlwHeRR2eD8rsP0g9rJCmJBqLtNcrzdITkiv33bXhRUw9nNJlusm6YB8JhiBFGtOlzgucubI4vgosbDwIPu
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
server: ebay-proxy-server
x-edgeconnect-midmile-rtt: 121
date: Mon, 07 Dec 2020 20:12:08 GMT
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa ADMa DEVa PSDo PSAa OUR SAMo IND UNI COM NAV INT STA DEM PRE"
x-edgeconnect-origin-mex-latency: 64
x-ebay-c-request-id: ri=%2BMIzpQ6VY363,rci=23cf34d04c5167e0
cache-control: private, no-cache
x-envoy-upstream-service-time: 26
rlogid: t6qjpbq%3F%3Ctofthu%60t*010270%3F%29pqtfwpu%29pie%29fgg%7E-fij-1763ed5352d-0x175
content-type: image/gif
x-ebay-chocolate: true
content-length: 42

Redirect headers

Pragma: no-cache
Date: Mon, 07 Dec 2020 20:12:08 GMT, Mon, 07 Dec 2020 20:12:08 GMT
Server: ebay server
P3P: policyref="/w3c/p3p.xml", CP="NOI CURa ADMa DEVa PSDo PSAa OUR SAMo IND UNI COM NAV INT STA DEM PRE"
Strict-Transport-Security: max-age=31536000
Content-Type: image/gif
Location: https://rover.ebay.co.uk/roversync/?site=3&stg=1&cguid=3ed534581760aae909d0da5ff9cbceb9&mpt=1607371928665
X-EBAY-C-REQUEST-ID: ri=3AwArcsdQQJP,rci=74c5326f81900f19
Cache-Control: private,no-cache,no-store
RlogId: t6qjpbq%3F%3Cumjthu%60t*%3Au1s7%28rbpv6710-1763ed53458-0x163
X-EBAY-CHOCOLATE: true
Content-Length: 0

GET
H2 200 9
rover.ebay.co.uk/roverimp/0/0/ 42 B
386 B 248ms
196ms Image
image/gif 104.75.89.51
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://rover.ebay.co.uk/roverimp/0/0/9?imp=2046301&trknvp=cp%3D2487283%26ghi%3D98&1588957807052

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.75.89.51 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-75-89-51.deploy.static.akamaitechnologies.com

Software

ebay-proxy-server /

Resource Hash

6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: http://viewitem.eday.couk.myb.sum.ws.mary.ay.gbh155985.pmjsm9r3ktjpubsnfspsv7.k9l7d5k8uutps498.rebelyell.agency/Login.php?sslchannel=true&sessionid=fVsGcRFs5GEkWSizBlV62UG1Nc4107f4vqV3ZKFwedYrOIkJlwHeRR2eD8rsP0g9rJCmJBqLtNcrzdITkiv33bXhRUw9nNJlusm6YB8JhiBFGtOlzgucubI4vgosbDwIPu
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
server: ebay-proxy-server
date: Mon, 07 Dec 2020 20:12:08 GMT
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa ADMa DEVa PSDo PSAa OUR SAMo IND UNI COM NAV INT STA DEM PRE"
x-ebay-c-request-id: ri=pmf6tF4wHg8o,rci=088474ebe0b635a9
cache-control: private, no-cache
x-envoy-upstream-service-time: 22
rlogid: t6qjpbq%3F%3Ckuvthu%60t*t%3Duog%28rbpv670%3D-1763ed532b2-0x165
content-type: image/gif
content-length: 42

GET
H2 200 sgninui-src-static-images-FB-f-Logo__white_29-Nm8L0bDZ.png
ir.ebaystatic.com/rs/c/ 1 KB
2 KB 6ms
6ms Image
image/png 2a04:4e42:3::718
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ir.ebaystatic.com/rs/c/sgninui-src-static-images-FB-f-Logo__white_29-Nm8L0bDZ.png
Requested by: Host: ir.ebaystatic.com
URL: https://ir.ebaystatic.com/rs/c/signin-render-uowXfL58.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:3::718 , Ascension Island, ASN54113 (FASTLY, US),
Reverse DNS
Software: ebay server /
Resource Hash: 53c410f2864972705c250f8c95f111e583c15f6efce891dae6f902c3490d97bf

Request headers

Referer: https://ir.ebaystatic.com/rs/c/signin-render-uowXfL58.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 07 Dec 2020 20:12:08 GMT
via: 1.1 lvsincludecache-2522848 (squid), 1.1 varnish
x-cache-lookup: HIT from lvsincludecache-2522848:80
age: 6351650
rlogid: t6q%60utuf%3C%3Dosuufvuq%60%2804%3B1%3E5-16d6e7568a3-0xbe
x-cache: HIT from lvsincludecache-2522848, HIT
x-ebay-c-version: 1.0.0
content-length: 1201
x-served-by: cache-fra19164-FRA
last-modified: Tue, 24 Jul 2018 23:37:11 GMT
server: ebay server
x-timer: S1607371928.354427,VS0,VE0
access-control-allow-methods: GET
content-type: image/png
access-control-allow-origin: *
expires: Fri, 25 Sep 2020 16:44:11 GMT
cache-control: public, max-age=31536000, immutable
warning: 113 lvsincludecache-2522848 (squid) This cache hit is still fresh and more than 1 day old
x-ebay-request-id: 16d6e756-8a30-ac7a-e794-932eff078075![
accept-ranges: bytes
access-control-allow-headers: *
x-cache-hits: 23705

GET
H2 200 sgninui-src-static-images-google-logo-icon-PNG-Transparent-Background-Z_TFsqo3.png
ir.ebaystatic.com/rs/c/ 7 KB
7 KB 6ms
6ms Image
image/png 2a04:4e42:3::718
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ir.ebaystatic.com/rs/c/sgninui-src-static-images-google-logo-icon-PNG-Transparent-Background-Z_TFsqo3.png
Requested by: Host: ir.ebaystatic.com
URL: https://ir.ebaystatic.com/rs/c/signin-render-uowXfL58.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:3::718 , Ascension Island, ASN54113 (FASTLY, US),
Reverse DNS
Software: ebay server /
Resource Hash: 56fbf97dc6629d06d83590f3c759381dacd1f6dfcd0f8af956ca3ab15b10e699

Request headers

Referer: https://ir.ebaystatic.com/rs/c/signin-render-uowXfL58.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 07 Dec 2020 20:12:08 GMT
via: 1.1 lvsincludecache-2522846 (squid), 1.1 varnish
x-cache-lookup: HIT from lvsincludecache-2522846:80
age: 10070543
rlogid: t6q%60utuf%3C%3Dosuufvuq%60%28567%3D437-16c91d43148-0xcd
x-cache: HIT from lvsincludecache-2522846, HIT
x-ebay-c-version: 1.0.0
content-length: 6886
x-served-by: cache-fra19164-FRA
last-modified: Tue, 18 Sep 2018 21:23:43 GMT
server: ebay server
x-timer: S1607371928.354887,VS0,VE0
access-control-allow-methods: GET
content-type: image/png
access-control-allow-origin: *
expires: Thu, 13 Aug 2020 20:31:38 GMT
cache-control: public, max-age=31536000, immutable
warning: 113 lvsincludecache-2522846 (squid) This cache hit is still fresh and more than 1 day old
x-ebay-request-id: 16c91d43-1480-aadd-0522-546afff6bee4![
accept-ranges: bytes
access-control-allow-headers: *
x-cache-hits: 24029

GET
DATA 200
OK truncated
/ 725 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1b3c84dc67fbaa659cd41ef4f90978cdc64ee8e7afa4410ee56b55652acd6263

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 f5uxsy10bmz05dtrtrqybl5qquv.png
ir.ebaystatic.com/rs/v/ 994 B
1 KB 6ms
5ms Image
image/png 2a04:4e42:3::718
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ir.ebaystatic.com/rs/v/f5uxsy10bmz05dtrtrqybl5qquv.png
Requested by: Host: ir.ebaystatic.com
URL: https://ir.ebaystatic.com/rs/v/34wtddjp0q1v1dtu2elv5jwg4yf.css?proc=DU:N
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:3::718 , Ascension Island, ASN54113 (FASTLY, US),
Reverse DNS
Software: ebay server /
Resource Hash: 7e0f4cd0590e2cf36c094d4226d70ccf2bc12107c46f3aeb8b3b5801396b44b0

Request headers

Referer: https://ir.ebaystatic.com/rs/v/34wtddjp0q1v1dtu2elv5jwg4yf.css?proc=DU:N
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 07 Dec 2020 20:12:08 GMT
via: 1.1 lvsaz01includecache-971932 (squid), 1.1 varnish
x-cache-lookup: HIT from lvsaz01includecache-971932:80
age: 24501947
rlogid: t6q%60utuf%3C%3Dosuufvuq%60%285610%3F4%3B-1708a6721f5-0xb6
x-cache: HIT from lvsaz01includecache-971932, HIT
x-ebay-c-version: 1.0.0
content-length: 994
x-served-by: cache-fra19164-FRA
last-modified: Fri, 12 Feb 2016 00:01:35 GMT
server: ebay server
x-timer: S1607371928.356463,VS0,VE0
access-control-allow-methods: GET
content-type: image/png
access-control-allow-origin: *
expires: Sat, 27 Feb 2021 06:06:19 GMT
cache-control: public, max-age=31536000, immutable
warning: 113 lvsaz01includecache-971932 (squid) This cache hit is still fresh and more than 1 day old
x-ebay-request-id: 1708a672-1f50-aa13-c415-5af7fc2f520c![
accept-ranges: bytes
access-control-allow-headers: *
x-cache-hits: 198888

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: eBay (E-commerce)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			viewitem.eday.couk.myb.sum.ws.mary.ay.gbh155985.pmjsm9r3ktjpubsnfspsv7.k9l7d5k8uutps498.rebelyell.agency/	1969-12-31 23:59:59	Name: PHPSESSID Value: 580a2e7e0716b1cc5bce48a706f6cc65

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

include.ebaystatic.com
ir.ebaystatic.com
rover.ebay.co.uk
rover.ebay.com
viewitem.eday.couk.myb.sum.ws.mary.ay.gbh155985.pmjsm9r3ktjpubsnfspsv7.k9l7d5k8uutps498.rebelyell.agency
104.75.89.51
107.180.2.188
2.16.186.25
2a04:4e42:3::718
64.4.252.11
1b3c84dc67fbaa659cd41ef4f90978cdc64ee8e7afa4410ee56b55652acd6263
1cc62d824df3d449c9abc491caf0e43c9dfc89be90b780b5e7243e681d5ab64d
53c410f2864972705c250f8c95f111e583c15f6efce891dae6f902c3490d97bf
5440e48584e47738479ccd905576e9ddf2097d07b6c7ba81dda6eeb13b1d4af0
56fbf97dc6629d06d83590f3c759381dacd1f6dfcd0f8af956ca3ab15b10e699
6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93
7e0f4cd0590e2cf36c094d4226d70ccf2bc12107c46f3aeb8b3b5801396b44b0
bfdc924879f949239156f2070f65ec62f31f99c1d58748935cdb37655bb84c58
d6b11659c604d115f446eca7b4cb0416423f5ef47bd7050e03372d4475f22730
ddd6e288270268de6b427fb4760e0d1384fff8e72a643faa642d4f51203b0efe
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

viewitem.eday.couk.myb.sum.ws.mary.ay.gbh155985.pmjsm9r3ktjpubsnfspsv7.k9l7d5k8uutps498.rebelyell.agency Open in urlscan Pro 107.180.2.188 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

11 Requests

73 %HTTPS

20 %IPv6

4 Domains

5 Subdomains

5 IPs

3 Countries

53 kBTransfer

177 kBSize

1 Cookies

1 Outgoing links

Page URL History

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

11 JavaScript Global Variables

1 Cookies

Indicators

viewitem.eday.couk.myb.sum.ws.mary.ay.gbh155985.pmjsm9r3ktjpubsnfspsv7.k9l7d5k8uutps498.rebelyell.agency Open in urlscan Pro
107.180.2.188 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

73 %
HTTPS

20 %
IPv6

4
Domains

5
Subdomains

5
IPs

3
Countries

53 kB
Transfer

177 kB
Size

1
Cookies

11 HTTP transactions
2 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!