www.csv-product.pw Open in urlscan Pro
198.54.126.77 Malicious Activity! Public Scan

URL:
http://www.csv-product.pw/
Submission: On April 25 via manual (April 25th 2020, 2:05:30 pm UTC) from US

Summary HTTP 11 Redirects Links 4 Behaviour Indicators

Summary

This website contacted 8 IPs in 3 countries across 6 domains to perform 11 HTTP transactions. The main IP is 198.54.126.77, located in Los Angeles, United States and belongs to NAMECHEAP-NET, US. The main domain is www.csv-product.pw.

This is the only time www.csv-product.pw was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: eBay (E-commerce)

Domain & IP information

	IP Address	AS Autonomous System
1	198.54.126.77 198.54.126.77	22612 (NAMECHEAP...) (NAMECHEAP-NET)
3	23.210.249.229 23.210.249.229	16625 (AKAMAI-AS) (AKAMAI-AS)
1	151.101.14.133 151.101.14.133	54113 (FASTLY) (FASTLY)
1	66.135.204.237 66.135.204.237	11643 (EBAY) (EBAY)
1	66.135.201.92 66.135.201.92	11643 (EBAY) (EBAY)
1 2	64.4.245.84 64.4.245.84	17012 (PAYPAL) (PAYPAL)
1	23.45.105.205 23.45.105.205	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
11	8

1 198.54.126.77 (Los Angeles, United States)

ASN22612 (NAMECHEAP-NET, US)
PTR: server33-3.web-hosting.com

www.csv-product.pw	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 23.210.249.229 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a23-210-249-229.deploy.static.akamaitechnologies.com

secureir.ebaystatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
securepics.ebaystatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.14.133 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

www.paypalobjects.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 66.135.204.237 (United States)

ASN11643 (EBAY, US)
PTR: sigin.ebay.com

signin.ebay.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 66.135.201.92 (United States)

ASN11643 (EBAY, US)
PTR: srv.ebayrtm.com

srv.main.ebayrtm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 64.4.245.84 (United States) 1 redirects

ASN17012 (PAYPAL, US)

b.stats.paypal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
dub.stats.paypal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.45.105.205 (Netherlands)

ASN20940 (AKAMAI-ASN1, EU)
PTR: a23-45-105-205.deploy.static.akamaitechnologies.com

c.paypal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	paypal.com 1 redirects b.stats.paypal.com dub.stats.paypal.com c.paypal.com	751 B
3	ebaystatic.com secureir.ebaystatic.com securepics.ebaystatic.com	26 KB
1	ebayrtm.com srv.main.ebayrtm.com	326 B
1	paypalobjects.com www.paypalobjects.com	15 KB
1	ebay.com b.stats.ebay.com Failed 1fb769151adsvs23.stats.ebay.com Failed signin.ebay.com
1	csv-product.pw www.csv-product.pw	14 KB
11	6

	Domain	Requested by
2	securepics.ebaystatic.com	www.csv-product.pw
1	c.paypal.com	www.paypalobjects.com
1	dub.stats.paypal.com	www.csv-product.pw
1	b.stats.paypal.com	1 redirects
1	srv.main.ebayrtm.com	www.csv-product.pw
1	signin.ebay.com	www.csv-product.pw
1	www.paypalobjects.com	www.csv-product.pw
1	secureir.ebaystatic.com	www.csv-product.pw
1	www.csv-product.pw
0	1fb769151adsvs23.stats.ebay.com Failed	www.csv-product.pw
0	b.stats.ebay.com Failed	www.csv-product.pw
11	11

This site contains links to these domains. Also see Links.

Domain
www.ebay.com
qu.ebay.com
scgi.ebay.com
pages.ebay.com

Subject Issuer	Validity	Valid
www.ebay.com DigiCert SHA2 Secure Server CA	`2019-07-17` - `2020-08-18`	a year	crt.sh
www.paypalobjects.com DigiCert SHA2 Extended Validation Server CA	`2019-12-09` - `2021-12-13`	2 years	crt.sh
signin.ebay.com DigiCert SHA2 Secure Server CA	`2019-05-23` - `2020-06-12`	a year	crt.sh
srv.ebayrtm.com Sectigo RSA Organization Validation Secure Server CA	`2020-03-02` - `2021-03-02`	a year	crt.sh
b.stats.paypal.com DigiCert SHA2 High Assurance Server CA	`2020-03-13` - `2022-06-03`	2 years	crt.sh
c.paypal.com DigiCert SHA2 Extended Validation Server CA	`2020-01-09` - `2022-01-13`	2 years	crt.sh

This page contains 6 frames:

Primary Page: http://www.csv-product.pw/
Frame ID: D9A96942258BEF55180F9E45A45C0393
Requests: 6 HTTP requests in this frame

Frame: https://www.paypalobjects.com/webstatic/r/fb/fb-all-prod.akamai.pp.min.js
Frame ID: D4D3D9C3BA6151AB4E898F24BC1D688C
Requests: 1 HTTP requests in this frame

Frame: https://signin.ebay.com/t_n.html?org_id=usllpic0&session_id=ad1fb7691510a620e7c0a520ffe1fa74
Frame ID: 397FAAD70FA10325780FD5EFFAB2064B
Requests: 1 HTTP requests in this frame

Frame: https://srv.main.ebayrtm.com/rtm?RtmGetCapJs&p=18&rqid=ad1fb7691510a620e7c06c00ffc9dba4&cb=parent.window.updateRtmField
Frame ID: 878A91DFF12FC537542E8CE8983CEC24
Requests: 1 HTTP requests in this frame

Frame: https://dub.stats.paypal.com/v1/counter2.cgi?r=cD1hZDFmNzA3MDE1MTBhNjI1NzBiMjU2YmVmZmYyMzg1OCZpPTE3OC4xMzguMzQuNjUmdD0xNDUwMzA4NTE1JmE9MjD1SycoNZo04nZkzf5qElakr1EL2A==
Frame ID: D330B6141E16D16065DA277EBD2C05B2
Requests: 1 HTTP requests in this frame

Frame: https://c.paypal.com/v1/r/d/i?js_src=https://www.paypalobjects.com/webstatic/r/fb/fb-all-prod.akamai.pp.min.js
Frame ID: 0813A55DBA071514F5C04102AAFD22A8
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

11
Requests

73 %
HTTPS

0 %
IPv6

6
Domains

11
Subdomains

8
IPs

3
Countries

56 kB
Transfer

120 kB
Size

3
Cookies

4 Outgoing links

These are links going to different origins than the main page.

URL: http://www.ebay.com/
Title: eBay

Search URL Search Domain Scan URL

URL: http://qu.ebay.com/survey?srvName=signin+(si-US)
Title: Comments?

Search URL Search Domain Scan URL

URL: https://scgi.ebay.com/ws/eBayISAPI.dll?FYPShow&_trksid=p4853.m2379.l4061&ru=http%3A%2F%2Fwww.ebay.com%2F
Title: Forgot your password?

Search URL Search Domain Scan URL

URL: http://pages.ebay.com/help/policies/user-agreement.html
Title: User Agreement

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 8

https://b.stats.paypal.com/v1/counter.cgi?r=cD1hZDFmNzA3MDE1MTBhNjI1NzBiMjU2YmVmZmYyMzg1OCZpPTE3OC4xMzguMzQuNjUmdD0xNDUwMzA4NTE1JmE9MjD1SycoNZo04nZkzf5qElakr1EL2A== HTTP 302
https://dub.stats.paypal.com/v1/counter2.cgi?r=cD1hZDFmNzA3MDE1MTBhNjI1NzBiMjU2YmVmZmYyMzg1OCZpPTE3OC4xMzguMzQuNjUmdD0xNDUwMzA4NTE1JmE9MjD1SycoNZo04nZkzf5qElakr1EL2A==

11 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
www.csv-product.pw/ 47 KB
14 KB 583ms
331ms Document
text/html 198.54.126.77
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: http://www.csv-product.pw/
Protocol: HTTP/1.1
Server: 198.54.126.77 Los Angeles, United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: server33-3.web-hosting.com
Software: Apache /
Resource Hash: 2d95ddb12549645bbb5e270ec7153c0b40c40c0edb1b780b4246437ec1376689

Request headers

Host: www.csv-product.pw
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Sat, 25 Apr 2020 14:05:04 GMT
Server: Apache
Last-Modified: Fri, 24 Apr 2020 18:36:06 GMT
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 13696
Content-Type: text/html

GET
H2 200 fxxj3ttftm5ltcqnto1o4baovyl.png
secureir.ebaystatic.com/rs/v/ 5 KB
5 KB 99ms
32ms Image
image/png 23.210.249.229
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secureir.ebaystatic.com/rs/v/fxxj3ttftm5ltcqnto1o4baovyl.png
Requested by: Host: www.csv-product.pw
URL: http://www.csv-product.pw/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.210.249.229 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-249-229.deploy.static.akamaitechnologies.com
Software: ebay server /
Resource Hash: 5440e48584e47738479ccd905576e9ddf2097d07b6c7ba81dda6eeb13b1d4af0

Request headers

Referer: http://www.csv-product.pw/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 25 Apr 2020 14:05:04 GMT
x-cache-lookup: HIT from lvsincludecache-2522847:80
status: 200
x-ebay-c-version: 1.0.0
content-length: 4820
last-modified: Wed, 29 Oct 2014 18:09:24 GMT
server: ebay server
access-control-allow-methods: GET
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000, immutable
rlogid: t6q%60utuf%3C%3Dosuufvuq%60%284%3F36%3F%3E2-16707f5d3cb-0xe1
x-ebay-request-id: 16707f5d-3cb0-ad4e-19f3-bb01ff7faa17![]
access-control-allow-headers: *
warning: 113 lvsincludecache-2522847 (squid) This cache hit is still fresh and more than 1 day old
expires: Sun, 25 Apr 2021 14:05:04 GMT

GET eBayISAPI.dll
b.stats.ebay.com/ws/ 0
0

GET eBayISAPI.dll
1fb769151adsvs23.stats.ebay.com/ws/ 0
0

GET
H2 200 imgbg.jpg
securepics.ebaystatic.com/aw/pics/cmp/ds3/ 1 KB
2 KB 94ms
30ms Image
image/jpeg 23.210.249.229
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepics.ebaystatic.com/aw/pics/cmp/ds3/imgbg.jpg
Requested by: Host: www.csv-product.pw
URL: http://www.csv-product.pw/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.210.249.229 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-249-229.deploy.static.akamaitechnologies.com
Software: eBay Server /
Resource Hash: b054c21c769e6e73a3f3f2e51ff27783043d87f8c4cb963c0554b33010fa3efc

Request headers

Referer: http://www.csv-product.pw/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 25 Apr 2020 14:05:04 GMT
last-modified: Tue, 30 May 2017 20:58:47 GMT
server: eBay Server
etag: "570-550c411e57d01"
content-type: image/jpeg
status: 200
cache-control: max-age=2049010
accept-ranges: bytes
content-length: 1392
expires: Tue, 19 May 2020 07:15:14 GMT

GET
H2 200 sprSignIn3.png
securepics.ebaystatic.com/aw/pics/register/ 19 KB
20 KB 94ms
31ms Image
image/png 23.210.249.229
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://securepics.ebaystatic.com/aw/pics/register/sprSignIn3.png

Requested by

Host: www.csv-product.pw
URL: http://www.csv-product.pw/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

23.210.249.229 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-210-249-229.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

e2192eadf7564ceb9202cb5b5ddcfb244c4a2627ffd46b7292855972181623ec

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: http://www.csv-product.pw/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 25 Apr 2020 14:05:04 GMT
x-cache-lookup: HIT from slcpicscache-1939226:80
last-modified: Tue, 30 May 2017 21:02:38 GMT
server: Apache
etag: "4de3-550c41fb00e9b"
content-type: image/png
status: 200
cache-control: max-age=3607530
accept-ranges: bytes
content-length: 19939
x-xss-protection: 1; mode=block
expires: Sat, 06 Jun 2020 08:10:34 GMT

GET
H2 200 fb-all-prod.akamai.pp.min.js Show response
www.paypalobjects.com/webstatic/r/fb/ Frame D4D3 48 KB
15 KB 84ms
25ms Script
application/x-javascript 151.101.14.133
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypalobjects.com/webstatic/r/fb/fb-all-prod.akamai.pp.min.js

Requested by

Host: www.csv-product.pw
URL: http://www.csv-product.pw/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.14.133 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

Apache /

Resource Hash

8a7b0ef0042a25ed17ab7aa1294d453ed4072ce3146368cbe8d78f4b17e73817

Security Headers

Name	Value
Strict-Transport-Security	max-age=31557600
X-Content-Type-Options	nosniff

Request headers

Referer: http://www.csv-product.pw/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 25 Apr 2020 14:05:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2717082
x-cache: HIT, HIT, HIT
status: 200
surrorage-key: /webstatic/r/fb/fb-all-prod.akamai.pp.min.js /webstatic/r/fb/fb-all-prod.akamai.pp.min.js /webstatic/r/fb/fb-all-prod.akamai.pp.min.js /webstatic/r/fb/fb-all-prod.akamai.pp.min.js /webstatic/r/fb/fb-all-prod.akamai.pp.min.js /webstatic/r/fb/fb-all-prod.akamai.pp.min.js /webstatic/r/fb /webstatic/r /webstatic
vary: Accept-Encoding
content-length: 15275
x-served-by: cache-sjc10033-SJC, cache-dfw18650-DFW, cache-fra19175-FRA
last-modified: Tue, 24 Sep 2019 01:11:33 GMT
server: Apache
x-timer: S1587823505.647414,VS0,VE1
strict-transport-security: max-age=31557600
content-type: application/x-javascript
via: 1.1 varnish, 1.1 varnish, 1.1 varnish
cache-control: max-age=3600
accept-ranges: bytes
x-cache-hits: 1, 1, 1

GET
H/1.1 200
OK t_n.html
signin.ebay.com/ Frame 397F 0
0 700ms
168ms Document
text/html 66.135.204.237
EBAY

General

Check archive.org

Show headers Download Go to

Full URL

https://signin.ebay.com/t_n.html?org_id=usllpic0&session_id=ad1fb7691510a620e7c0a520ffe1fa74

Requested by

Host: www.csv-product.pw
URL: http://www.csv-product.pw/

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_128_GCM

Server

66.135.204.237 , United States, ASN11643 (EBAY, US),

Reverse DNS

sigin.ebay.com

Software

Apache-Coyote/1.1 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age= 31536000

Request headers

Host: signin.ebay.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: http://www.csv-product.pw/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: http://www.csv-product.pw/

Response headers

Server: Apache-Coyote/1.1
last-modified: Thu, 26 Mar 2020 20:13:00 GMT
Content-Type: text/html
Content-Length: 3459
Date: Sat, 25 Apr 2020 14:05:04 GMT
Strict-Transport-Security: max-age= 31536000

GET
H/1.1 200 rtm Show response
srv.main.ebayrtm.com/ Frame 878A 56 B
326 B 771ms
237ms Script
application/x-javascript 66.135.201.92
EBAY

General

Check archive.org

Show headers Download Go to

Full URL: https://srv.main.ebayrtm.com/rtm?RtmGetCapJs&p=18&rqid=ad1fb7691510a620e7c06c00ffc9dba4&cb=parent.window.updateRtmField
Requested by: Host: www.csv-product.pw
URL: http://www.csv-product.pw/
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 66.135.201.92 , United States, ASN11643 (EBAY, US),
Reverse DNS: srv.ebayrtm.com
Software: /
Resource Hash: efd2bd5237dc50a234f9f80e4167135da2f1cc535974c1cd8d55d7055b9f864c

Request headers

Referer: http://www.csv-product.pw/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Sat, 25 Apr 2020 14:05:04 GMT
RlogId: t6ndbulkgb%7Bq%3C%3Dosujbathmdc%7Fw%285650255-171b1a7ef2d-0x1e93c
Down-RlogIds: MadronaExt-To-MadronaExt=empty;
Content-Length: 56
Content-Type: application/x-javascript;charset=UTF-8

GET
H/1.1

200
OK

counter2.cgi
dub.stats.paypal.com/v1/ Frame D330
Redirect Chain

https://b.stats.paypal.com/v1/counter.cgi?r=cD1hZDFmNzA3MDE1MTBhNjI1NzBiMjU2YmVmZmYyMzg1OCZpPTE3OC4xMzguMzQuNjUmdD0xNDUwMzA4NTE1JmE9MjD1SycoNZo04nZkzf5qElakr1EL2A==
https://dub.stats.paypal.com/v1/counter2.cgi?r=cD1hZDFmNzA3MDE1MTBhNjI1NzBiMjU2YmVmZmYyMzg1OCZpPTE3OC4xMzguMzQuNjUmdD0xNDUwMzA4NTE1JmE9MjD1SycoNZo04nZkzf5qElakr1EL2A==

42 B
299 B

149ms
48ms

Image
image/jpeg

64.4.245.84
PAYPAL

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dub.stats.paypal.com/v1/counter2.cgi?r=cD1hZDFmNzA3MDE1MTBhNjI1NzBiMjU2YmVmZmYyMzg1OCZpPTE3OC4xMzguMzQuNjUmdD0xNDUwMzA4NTE1JmE9MjD1SycoNZo04nZkzf5qElakr1EL2A==
Requested by: Host: www.csv-product.pw
URL: http://www.csv-product.pw/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 64.4.245.84 , United States, ASN17012 (PAYPAL, US),
Reverse DNS
Software: PayPal-B.Stats/1.0 /
Resource Hash: 47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292

Request headers

Referer: http://www.csv-product.pw/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Sat, 25 Apr 2020 14:05:04 GMT
Server: PayPal-B.Stats/1.0
Connection: close
Content-Length: 42
Content-Type: image/jpeg

Redirect headers

Location: https://dub.stats.paypal.com/v1/counter2.cgi?r=cD1hZDFmNzA3MDE1MTBhNjI1NzBiMjU2YmVmZmYyMzg1OCZpPTE3OC4xMzguMzQuNjUmdD0xNDUwMzA4NTE1JmE9MjD1SycoNZo04nZkzf5qElakr1EL2A==
Date: Sat, 25 Apr 2020 14:05:04 GMT
Server: PayPal-B.Stats/1.0
Connection: close
Content-Length: 0
Content-Type: application/octet-stream

GET
H/1.1 200
OK i
c.paypal.com/v1/r/d/ Frame 0813 0
0 96ms
30ms Document
text/html 23.45.105.205
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://c.paypal.com/v1/r/d/i?js_src=https://www.paypalobjects.com/webstatic/r/fb/fb-all-prod.akamai.pp.min.js

Requested by

Host: www.paypalobjects.com
URL: https://www.paypalobjects.com/webstatic/r/fb/fb-all-prod.akamai.pp.min.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.45.105.205 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a23-45-105-205.deploy.static.akamaitechnologies.com

Software

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Host: c.paypal.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: http://www.csv-product.pw/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: http://www.csv-product.pw/

Response headers

CORRELATION-ID: e639cf4364035
Content-Security-Policy-Report-Only: default-src 'self' https://*.paypal.com https://*.paypalobjects.com; script-src 'self' https://*.paypal.com https://*.paypalobjects.com https://www.facebook.com 'unsafe-eval' 'unsafe-inline' blob:; connect-src 'self' https://*.paypal.com; style-src 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline'; font-src 'self' https://*.paypal.com https://*.paypalobjects.com data:; img-src 'self' https: data:; form-action 'self' https://*.paypal.com; base-uri 'self' https://*.paypal.com; object-src 'self' https://*.paypal.com https://*.paypalobjects.com; report-uri https://www.paypal.com/csplog/api/log/csp
Content-Type: text/html;charset=UTF-8
Paypal-Debug-Id: e639cf4364035
X-Content-Type-Options: nosniff
X-Xss-Protection: 1; mode=block
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 168
Cache-Control: no-cache, no-store, must-revalidate
Date: Sat, 25 Apr 2020 14:05:04 GMT
Connection: keep-alive

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: b.stats.ebay.com
URL: https://b.stats.ebay.com/ws/eBayISAPI.dll?V4AppCounter&r=imKBAat_g3AehvIgki2vmZntDU7NNzD-xIRUVQ_h89vhA0a_Sbx2iKsamPu_lnk9bSBb6Ii9SDT7bDakroxpK9wpZnUhIhjog26ausWBPACZQ54kOj0y3xDBT-PCLSJFhfY_oA**&seq=1

Domain: 1fb769151adsvs23.stats.ebay.com
URL: https://1fb769151adsvs23.stats.ebay.com/ws/eBayISAPI.dll?V4AppCounter&r=imKBAat_g3AehvIgki2vmZntDU7NNzD-xIRUVQ_h89vhA0a_Sbx2iKsamPu_lnk9bSBb6Ii9SDT7bDakroxpK9wpZnUhIhjog26ausWBPACZQ54kOj0y3xDBT-PCLSJFhfY_oA**&seq=2

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: eBay (E-commerce)

15 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.paypal.com/	1970-01-26 16:15:43	Name: KHcl0EuY7AKSMgfvHl7J5E7hPtK Value: d0hLEtFYVXhQkSpCzx0O8WoGNNWr3gJqYkc-G0eGmngLRpMvyEPdjv9LdGi6xxdTbhZgOBebQNo-bboU
.c.paypal.com/	1970-01-21 04:51:43	Name: sc_f Value: CSUPN0TX0c0NOhEqcTx16J2-M18SSiKq-Rn9pERDrXtHMgloTjolAWAd1H9Xe8lXY3cq_bxM7f1huSk-6qKvMjohzP3Oa0SZl9ACt0
c.paypal.com/	1969-12-31 23:59:59	Name: PP-Corr-Id Value: EBAY_SIGNIN:ad1f70701510a62570b256befff23858

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

1fb769151adsvs23.stats.ebay.com
b.stats.ebay.com
b.stats.paypal.com
c.paypal.com
dub.stats.paypal.com
secureir.ebaystatic.com
securepics.ebaystatic.com
signin.ebay.com
srv.main.ebayrtm.com
www.csv-product.pw
www.paypalobjects.com
1fb769151adsvs23.stats.ebay.com
b.stats.ebay.com
151.101.14.133
198.54.126.77
23.210.249.229
23.45.105.205
64.4.245.84
66.135.201.92
66.135.204.237
2d95ddb12549645bbb5e270ec7153c0b40c40c0edb1b780b4246437ec1376689
47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292
5440e48584e47738479ccd905576e9ddf2097d07b6c7ba81dda6eeb13b1d4af0
8a7b0ef0042a25ed17ab7aa1294d453ed4072ce3146368cbe8d78f4b17e73817
b054c21c769e6e73a3f3f2e51ff27783043d87f8c4cb963c0554b33010fa3efc
e2192eadf7564ceb9202cb5b5ddcfb244c4a2627ffd46b7292855972181623ec
efd2bd5237dc50a234f9f80e4167135da2f1cc535974c1cd8d55d7055b9f864c

www.csv-product.pw Open in urlscan Pro 198.54.126.77 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

11 Requests

73 %HTTPS

0 %IPv6

6 Domains

11 Subdomains

8 IPs

3 Countries

56 kBTransfer

120 kBSize

3 Cookies

4 Outgoing links

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

15 JavaScript Global Variables

3 Cookies

Indicators

www.csv-product.pw Open in urlscan Pro
198.54.126.77 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

73 %
HTTPS

0 %
IPv6

6
Domains

11
Subdomains

8
IPs

3
Countries

56 kB
Transfer

120 kB
Size

3
Cookies

11 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!