000lk3v.wcomhost.com
Open in
urlscan Pro
206.188.193.109
Malicious Activity!
Public Scan
Submission: On March 20 via automatic, source phishtank
Summary
This is the only time 000lk3v.wcomhost.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: eBay (E-commerce)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 | 206.188.193.109 206.188.193.109 | 55002 (DEFENSE-NET) (DEFENSE-NET - Defense.Net) | |
| 4 | 2.18.234.107 2.18.234.107 | 16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies) | |
| 5 | 3 |
ASN55002 (DEFENSE-NET - Defense.Net, Inc, US)
PTR: vux.netsolhost.com
| 000lk3v.wcomhost.com |
ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
| secureir.ebaystatic.com | |
| securepics.ebaystatic.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 4 |
ebaystatic.com
secureir.ebaystatic.com securepics.ebaystatic.com |
28 KB |
| 1 |
wcomhost.com
000lk3v.wcomhost.com |
14 KB |
| 0 |
Failed
function sub() { [native code] }. Failed |
|
| 5 | 3 |
| Domain | Requested by | |
|---|---|---|
| 2 | securepics.ebaystatic.com |
000lk3v.wcomhost.com
|
| 2 | secureir.ebaystatic.com |
000lk3v.wcomhost.com
|
| 1 | 000lk3v.wcomhost.com | |
| 0 | truncated Failed |
000lk3v.wcomhost.com
|
| 5 | 4 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| www.ebay.co.uk |
| qu.ebay.co.uk |
| scgi.ebay.co.uk |
| pages.ebay.co.uk |
| cgi6.ebay.co.uk |
| trustsealinfo.websecurity.norton.com |
| www.symantec.com |
| Subject Issuer | Validity | Valid |
|---|
This page contains 1 frames:
Primary Page:
http://000lk3v.wcomhost.com/ws/newSignIn.php?email=
Frame ID: 64998780B16CD1B75CE276B07108A442
Requests: 6 HTTP requests in this frame
Screenshot
Detected technologies
PHP
(Programming Languages)
Expand
Detected patterns
- url /\.php(?:$|\?)/i
Lua
(Programming Languages)
Expand
Detected patterns
- headers server /openresty(?:\/([\d.]+))?/i
Nginx
(Web Servers)
Expand
Detected patterns
- headers server /openresty(?:\/([\d.]+))?/i
OpenResty
(Web Servers)
Expand
Detected patterns
- headers server /openresty(?:\/([\d.]+))?/i
Page Statistics
9 Outgoing links
These are links going to different origins than the main page.
Title: eBay
Search URL Search Domain Scan URL
Title: Comments?
Search URL Search Domain Scan URL
Title: Forgot your password?
Search URL Search Domain Scan URL
Title: User Agreement
Search URL Search Domain Scan URL
Title: Privacy
Search URL Search Domain Scan URL
Title: Cookies
Search URL Search Domain Scan URL
Title: AdChoice
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Title: About SSL Certificates
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
5 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
newSignIn.php
000lk3v.wcomhost.com/ws/ |
43 KB 14 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET S |
fxxj3ttftm5ltcqnto1o4baovyl.png
secureir.ebaystatic.com/rs/v/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET S |
imgbg.jpg
securepics.ebaystatic.com/aw/pics/cmp/ds3/ |
1 KB 2 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET S |
sprSignIn3.png
securepics.ebaystatic.com/aw/pics/register/ |
19 KB 20 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET S |
seal.gif
secureir.ebaystatic.com/pictures/aw/pics/globalHeader/ |
2 KB 2 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
truncated
/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- truncated
- URL
- data:truncated
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: eBay (E-commerce)0 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
000lk3v.wcomhost.com
secureir.ebaystatic.com
securepics.ebaystatic.com
truncated
truncated
2.18.234.107
206.188.193.109
5440e48584e47738479ccd905576e9ddf2097d07b6c7ba81dda6eeb13b1d4af0
9329e47d8f7f88e1b452b8520dbe8187523f2e109a98601376bb000e7806f418
a52bbeb9137b30d7495316ec12fc816abae0fc3e7c863604c5cd0229e9869d06
b054c21c769e6e73a3f3f2e51ff27783043d87f8c4cb963c0554b33010fa3efc
e2192eadf7564ceb9202cb5b5ddcfb244c4a2627ffd46b7292855972181623ec