000lk3v.wcomhost.com
Open in
urlscan Pro
206.188.193.109
Malicious Activity!
Public Scan
URL:
http://000lk3v.wcomhost.com/ws/newSignIn.php?email=&md5=fdc53ae060fb2b52553f52a5112087ef&dispatched=56&id=957448...
Submission: On March 31 via automatic, source phishtank
Submission: On March 31 via automatic, source phishtank
Summary
This website contacted 3 IPs
in 2 countries
across 3 domains to perform 5 HTTP transactions.
The main IP is 206.188.193.109, located in
Jacksonville, United States and
belongs to DEFENSE-NET - Defense.Net, Inc, US.
The main domain is 000lk3v.wcomhost.com.
This is the only time 000lk3v.wcomhost.com was scanned on urlscan.io!
This is the only time 000lk3v.wcomhost.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: eBay (E-commerce)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 | 206.188.193.109 206.188.193.109 | 55002 (DEFENSE-NET) (DEFENSE-NET - Defense.Net) | |
| 4 | 2.18.234.107 2.18.234.107 | 16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies) | |
| 5 | 3 |
1
206.188.193.109
(Jacksonville, United States)
ASN55002 (DEFENSE-NET - Defense.Net, Inc, US)
PTR: vux.netsolhost.com
ASN55002 (DEFENSE-NET - Defense.Net, Inc, US)
PTR: vux.netsolhost.com
| 000lk3v.wcomhost.com |
4
2.18.234.107
(European Union)
ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
| secureir.ebaystatic.com | |
| securepics.ebaystatic.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 4 |
ebaystatic.com
secureir.ebaystatic.com securepics.ebaystatic.com |
28 KB |
| 1 |
wcomhost.com
000lk3v.wcomhost.com |
14 KB |
| 0 |
Failed
function sub() { [native code] }. Failed |
|
| 5 | 3 |
| Domain | Requested by | |
|---|---|---|
| 2 | securepics.ebaystatic.com |
000lk3v.wcomhost.com
|
| 2 | secureir.ebaystatic.com |
000lk3v.wcomhost.com
|
| 1 | 000lk3v.wcomhost.com | |
| 0 | truncated Failed |
000lk3v.wcomhost.com
|
| 5 | 4 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| www.ebay.co.uk |
| qu.ebay.co.uk |
| scgi.ebay.co.uk |
| pages.ebay.co.uk |
| cgi6.ebay.co.uk |
| trustsealinfo.websecurity.norton.com |
| www.symantec.com |
| Subject Issuer | Validity | Valid |
|---|
This page contains 1 frames:
Primary Page:
http://000lk3v.wcomhost.com/ws/newSignIn.php?email=&md5=fdc53ae060fb2b52553f52a5112087ef&dispatched=56&id=9574486970
Frame ID: 2304CE514E215CBA9795A5E3C9763463
Requests: 6 HTTP requests in this frame
Screenshot
Detected technologies
PHP
(Programming Languages)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- url /\.php(?:$|\?)/i
Lua
(Programming Languages)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /openresty(?:\/([\d.]+))?/i
Nginx
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /openresty(?:\/([\d.]+))?/i
OpenResty
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /openresty(?:\/([\d.]+))?/i
Page Statistics
9 Outgoing links
These are links going to different origins than the main page.
URL: http://www.ebay.co.uk/
Title: eBay
Title: eBay
Search URL Search Domain Scan URL
URL: http://qu.ebay.co.uk/survey?srvName=signin+(si-UK)
Title: Comments?
Title: Comments?
Search URL Search Domain Scan URL
URL: https://scgi.ebay.co.uk/ws/eBayISAPI.dll?FYPShow&_trksid=p4853.m2379.l4061&ru=http%3A%2F%2Fwww.ebay.co.uk%2F
Title: Forgot your password?
Title: Forgot your password?
Search URL Search Domain Scan URL
URL: http://pages.ebay.co.uk/help/policies/user-agreement.html
Title: User Agreement
Title: User Agreement
Search URL Search Domain Scan URL
URL: http://pages.ebay.co.uk/help/policies/privacy-policy.html
Title: Privacy
Title: Privacy
Search URL Search Domain Scan URL
URL: http://pages.ebay.co.uk/help/account/cookies-web-beacons.html
Title: Cookies
Title: Cookies
Search URL Search Domain Scan URL
URL: http://cgi6.ebay.co.uk/ws/eBayISAPI.dll?AdChoiceLandingPage&partner=0
Title: AdChoice
Title: AdChoice
Search URL Search Domain Scan URL
URL: https://trustsealinfo.websecurity.norton.com/splash?form_file=fdf/splash.fdf&dn=www.ebay.co.uk&lang=en
Search URL Search Domain Scan URL
URL: http://www.symantec.com/ssl-certificates
Title: About SSL Certificates
Title: About SSL Certificates
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
5 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
newSignIn.php
000lk3v.wcomhost.com/ws/ |
43 KB 14 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET S |
fxxj3ttftm5ltcqnto1o4baovyl.png
secureir.ebaystatic.com/rs/v/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET S |
seal.gif
secureir.ebaystatic.com/pictures/aw/pics/globalHeader/ |
2 KB 2 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET S |
imgbg.jpg
securepics.ebaystatic.com/aw/pics/cmp/ds3/ |
1 KB 2 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
truncated
/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
|
GET S |
sprSignIn3.png
securepics.ebaystatic.com/aw/pics/register/ |
19 KB 20 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- truncated
- URL
- data:truncated
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: eBay (E-commerce)0 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
000lk3v.wcomhost.com
secureir.ebaystatic.com
securepics.ebaystatic.com
truncated
truncated
2.18.234.107
206.188.193.109
5440e48584e47738479ccd905576e9ddf2097d07b6c7ba81dda6eeb13b1d4af0
9329e47d8f7f88e1b452b8520dbe8187523f2e109a98601376bb000e7806f418
a52bbeb9137b30d7495316ec12fc816abae0fc3e7c863604c5cd0229e9869d06
b054c21c769e6e73a3f3f2e51ff27783043d87f8c4cb963c0554b33010fa3efc
e2192eadf7564ceb9202cb5b5ddcfb244c4a2627ffd46b7292855972181623ec