urlscan.io logo urlscan.io
SecurityTrails logo

ebay.com.productpayment.ga Open in urlscan Pro
2606:4700:30::6818:6834  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://ebay.com.productpayment.ga/?fbclid=IwAR0lB6YZUYY66LwdRaJ4sjRTeJ9_fqX49BMi-hmqyywbkZFhdxrEgaAXYvQ
Submission: On November 28 via automatic, source phishtank
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 8 IPs in 2 countries across 5 domains to perform 17 HTTP transactions. The main IP is 2606:4700:30::6818:6834, located in United States and belongs to CLOUDFLARENET - Cloudflare, Inc., US. The main domain is ebay.com.productpayment.ga.
TLS certificate: Issued by CloudFlare Inc ECC CA-2 on November 25th 2018. Valid for: a year.
This is the only time ebay.com.productpayment.ga was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: eBay (E-commerce)

Domain & IP information

IP Address AS Autonomous System
1 2606:4700:30:... 13335 (CLOUDFLAR...)
10 2.18.234.244 16625 (AKAMAI-AS)
2 2.18.234.107 16625 (AKAMAI-AS)
1 66.135.209.124 11643 (EBAY)
1 2.18.232.222 16625 (AKAMAI-AS)
1 66.135.197.242 11643 (EBAY)
1 66.211.185.34 11643 (EBAY)
17 8
1    2606:4700:30::6818:6834 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
ebay.com.productpayment.ga
10    2.18.234.244 (European Union)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a2-18-234-244.deploy.static.akamaitechnologies.com
ir.ebaystatic.com
2    2.18.234.107 (European Union)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a2-18-234-107.deploy.static.akamaitechnologies.com
secureir.ebaystatic.com
1    66.135.209.124 (Campbell, United States)

ASN11643 (EBAY - eBay, Inc, US)
PTR: ocsrest.ebay.com
ocsrest.ebay.com
1    2.18.232.222 (European Union)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a2-18-232-222.deploy.static.akamaitechnologies.com
c.paypal.com
1    66.135.197.242 (Campbell, United States)

ASN11643 (EBAY - eBay, Inc, US)
PTR: srv.ebayrtm.com
srv.main.ebayrtm.com
1    66.211.185.34 (Campbell, United States)

ASN11643 (EBAY - eBay, Inc, US)
PTR: signin.ebay.com
signin.ebay.com
Domain Requested by
10 ir.ebaystatic.com ebay.com.productpayment.ga
2 secureir.ebaystatic.com ebay.com.productpayment.ga
ocsrest.ebay.com
1 signin.ebay.com ir.ebaystatic.com
1 srv.main.ebayrtm.com ebay.com.productpayment.ga
1 c.paypal.com ebay.com.productpayment.ga
1 ocsrest.ebay.com ebay.com.productpayment.ga
1 ebay.com.productpayment.ga
17 7
Subject Issuer Validity Valid
sni.cloudflaressl.com
CloudFlare Inc ECC CA-2		 2018-11-25 -
2019-11-25		 a year crt.sh
www.ebay.com
DigiCert SHA2 Secure Server CA		 2018-07-09 -
2019-06-06		 a year crt.sh
ocsrest.ebay.com
DigiCert SHA2 Secure Server CA		 2018-06-08 -
2019-06-21		 a year crt.sh
www.paypal.com
DigiCert SHA2 Extended Validation Server CA		 2018-08-14 -
2020-08-18		 2 years crt.sh
srv.ebayrtm.com
DigiCert SHA2 Secure Server CA		 2018-09-06 -
2019-09-07		 a year crt.sh
signin.ebay.com
DigiCert SHA2 Secure Server CA		 2018-06-12 -
2019-06-13		 a year crt.sh

This page contains 4 frames:

Primary Page: https://ebay.com.productpayment.ga/?fbclid=IwAR0lB6YZUYY66LwdRaJ4sjRTeJ9_fqX49BMi-hmqyywbkZFhdxrEgaAXYvQ
Frame ID: 82F2784DE2273F414DEDE215995A1AAE
Requests: 15 HTTP requests in this frame

Frame: https://c.paypal.com/da/r/fb.js
Frame ID: 069DB0646A66D274BE0C3E0F3761959A
Requests: 1 HTTP requests in this frame

Frame: https://srv.main.ebayrtm.com/rtm?RtmGetCapJs&p=18&rqid=8d16a0ab1650abc1dad21657ffffffff&cb=parent.window.updateRtmField
Frame ID: 6E5C51A11825790BB5CB0F5219BAB805
Requests: 1 HTTP requests in this frame

Frame: https://signin.ebay.com/t_n.html?suppressFlash=true&org_id=usllpic0&session_id=8d16a0a91650abc1dadcde21fff422e8
Frame ID: 04DEBBE15F3F4E96B97A026E0F5B4308
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /cloudflare/i
Overall confidence: 100%
Detected patterns
  • env /^jQuery$/i

Page Statistics

17
Requests

100 %
HTTPS

14 %
IPv6

5
Domains

7
Subdomains

8
IPs

2
Countries

245 kB
Transfer

684 kB
Size

4
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

17 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
ebay.com.productpayment.ga/ 		49 KB
18 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ebay.com.productpayment.ga/?fbclid=IwAR0lB6YZUYY66LwdRaJ4sjRTeJ9_fqX49BMi-hmqyywbkZFhdxrEgaAXYvQ
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:30::6818:6834 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / ASP.NET
Resource Hash
645850bf000d7450c0f1059da0dbe177b7dbfe92ce605daa7d3a0ebee9d9b611

Request headers

:method
GET
:authority
ebay.com.productpayment.ga
:scheme
https
:path
/?fbclid=IwAR0lB6YZUYY66LwdRaJ4sjRTeJ9_fqX49BMi-hmqyywbkZFhdxrEgaAXYvQ
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
accept-encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status
200
date
Wed, 28 Nov 2018 14:41:11 GMT
content-type
text/html
set-cookie
__cfduid=d11d9be683834316a0da178cd3a5f323d1543416070; expires=Thu, 28-Nov-19 14:41:10 GMT; path=/; domain=.productpayment.ga; HttpOnly
cache-control
max-age=31536000
last-modified
Sun, 25 Nov 2018 00:27:26 GMT
vary
Accept-Encoding
x-powered-by
ASP.NET
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
480d980b98e5c29c-FRA
content-encoding
gzip
3sbepdq10q0dtksnrmgitl41cm0.css
ir.ebaystatic.com/rs/v/ 		4 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://ir.ebaystatic.com/rs/v/3sbepdq10q0dtksnrmgitl41cm0.css?proc=DU:N
Requested by
Host: ebay.com.productpayment.ga
URL: https://ebay.com.productpayment.ga/?fbclid=IwAR0lB6YZUYY66LwdRaJ4sjRTeJ9_fqX49BMi-hmqyywbkZFhdxrEgaAXYvQ
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2.18.234.244 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-234-244.deploy.static.akamaitechnologies.com
Software
ebay server /
Resource Hash
05830fdef4ed02fa522186d6b44ff242fbdec217f36fb1fe7a7df98abe05bfd1

Request headers

Referer
https://ebay.com.productpayment.ga/?fbclid=IwAR0lB6YZUYY66LwdRaJ4sjRTeJ9_fqX49BMi-hmqyywbkZFhdxrEgaAXYvQ
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 28 Nov 2018 14:41:11 GMT
content-encoding
gzip
x-cache-lookup
HIT from slcincludecache-1959350:80
status
200
x-ebay-c-version
1.0.0
content-length
1711
last-modified
Fri, 20 Jan 2017 22:33:12 GMT
server
ebay server
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
text/css;charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, immutable
rlogid
t6q%60utuf%3C%3Dsm%7Eufvuq%60%284257142-16684561f92-0xbf
x-ebay-request-id
16684561-f920-ab1c-c167-89d9ffced6e4![]
access-control-allow-headers
*
expires
Thu, 28 Nov 2019 14:41:11 GMT
signin-ebd720.css
ir.ebaystatic.com/rs/c/ 		128 KB
34 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://ir.ebaystatic.com/rs/c/signin-ebd720.css
Requested by
Host: ebay.com.productpayment.ga
URL: https://ebay.com.productpayment.ga/?fbclid=IwAR0lB6YZUYY66LwdRaJ4sjRTeJ9_fqX49BMi-hmqyywbkZFhdxrEgaAXYvQ
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2.18.234.244 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-234-244.deploy.static.akamaitechnologies.com
Software
ebay server /
Resource Hash
d755349aad3f4d2f953d90c585067ed9e8fa395d8e2a68c108c34ebadc722617

Request headers

Referer
https://ebay.com.productpayment.ga/?fbclid=IwAR0lB6YZUYY66LwdRaJ4sjRTeJ9_fqX49BMi-hmqyywbkZFhdxrEgaAXYvQ
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 28 Nov 2018 14:41:11 GMT
content-encoding
gzip
x-cache-lookup
HIT from lvsincludecache-2522848:80
status
200
x-ebay-c-version
1.0.0
content-length
34833
last-modified
Fri, 24 Aug 2018 20:13:43 GMT
server
ebay server
x-edgeconnect-cache-status
1
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000, immutable
rlogid
t6q%60utuf%3C%3Dosuufvuq%60%284162146-16687f86fe0-0xb5
x-ebay-request-id
16687f86-fe00-ad4d-7c70-da34ffc9750c![]
access-control-allow-headers
*
expires
Thu, 28 Nov 2019 14:41:11 GMT
0vk0rkyoky1ltm32dhy0hthnxyx.js
secureir.ebaystatic.com/f/ 		9 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://secureir.ebaystatic.com/f/0vk0rkyoky1ltm32dhy0hthnxyx.js
Requested by
Host: ebay.com.productpayment.ga
URL: https://ebay.com.productpayment.ga/?fbclid=IwAR0lB6YZUYY66LwdRaJ4sjRTeJ9_fqX49BMi-hmqyywbkZFhdxrEgaAXYvQ
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2.18.234.107 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-234-107.deploy.static.akamaitechnologies.com
Software
ebay server /
Resource Hash
374eee0aa2ea3745055a959e8a96c5dcb4716cdd7fe5205d5b34e8666b2582b5

Request headers

Referer
https://ebay.com.productpayment.ga/?fbclid=IwAR0lB6YZUYY66LwdRaJ4sjRTeJ9_fqX49BMi-hmqyywbkZFhdxrEgaAXYvQ
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 28 Nov 2018 14:41:11 GMT
content-encoding
gzip
x-cache-lookup
HIT from phxincludecache-2412621:80
status
200
x-ebay-c-version
1.0.0
content-length
3180
pragma
no-cache
last-modified
Tue, 04 Sep 2018 12:40:20 GMT
server
ebay server
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
application/x-javascript;charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, immutable
rlogid
t6q%60utuf%3C%3Dsm%7Eufvuq%60%284256402-1668217eedd-0xd5
x-ebay-request-id
1668217e-edd0-ab19-f575-91c5ffd7d7f5![]
access-control-allow-headers
*
expires
Thu, 28 Nov 2019 14:41:11 GMT
inflowcomponent
ocsrest.ebay.com/ocsrsapp/o2/inflow/ 		10 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ocsrest.ebay.com/ocsrsapp/o2/inflow/inflowcomponent?input=%7B%22pageId%22:%222487283%22%7D&callback=Inflow.cb
Requested by
Host: ebay.com.productpayment.ga
URL: https://ebay.com.productpayment.ga/?fbclid=IwAR0lB6YZUYY66LwdRaJ4sjRTeJ9_fqX49BMi-hmqyywbkZFhdxrEgaAXYvQ
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_GCM
Server
66.135.209.124 Campbell, United States, ASN11643 (EBAY - eBay, Inc, US),
Reverse DNS
ocsrest.ebay.com
Software
ebay server /
Resource Hash
f8f1da2402cf5b780bbd1c5cd55b00ddccf82525ffcc2a4be179a1e81149ceb4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://ebay.com.productpayment.ga/?fbclid=IwAR0lB6YZUYY66LwdRaJ4sjRTeJ9_fqX49BMi-hmqyywbkZFhdxrEgaAXYvQ
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 28 Nov 2018 14:41:11 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Server
ebay server
X-Frame-Options
SAMEORIGIN
Content-Type
application/javascript;charset=utf-8
X-EBAY-C-REQUEST-ID
ri=B4%2FwAxmMRm1B,rci=DYjmPqvbhYAXE7ym
Transfer-Encoding
chunked
RlogId
t6lfuupdvw9%3Fuk%60jetqvgws%284532727%2Busqdrrp%2Buk%60%2Bceb%7C%28dlh-1675ac446f1-0x229
X-EBAY-REQUEST-ID
1675ac44-6f20-ada5-d506-e650fc98ed20![]
X-EBAY-C-VERSION
1.0.0
X-XSS-Protection
1; mode=block
signin-e84ee6.js
ir.ebaystatic.com/rs/c/ 		370 KB
106 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ir.ebaystatic.com/rs/c/signin-e84ee6.js
Requested by
Host: ebay.com.productpayment.ga
URL: https://ebay.com.productpayment.ga/?fbclid=IwAR0lB6YZUYY66LwdRaJ4sjRTeJ9_fqX49BMi-hmqyywbkZFhdxrEgaAXYvQ
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2.18.234.244 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-234-244.deploy.static.akamaitechnologies.com
Software
ebay server /
Resource Hash
6dc70f764db5f32d13335101894dd4761db066d410d5db97d263e106b76c368f

Request headers

Referer
https://ebay.com.productpayment.ga/?fbclid=IwAR0lB6YZUYY66LwdRaJ4sjRTeJ9_fqX49BMi-hmqyywbkZFhdxrEgaAXYvQ
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 28 Nov 2018 14:41:11 GMT
content-encoding
gzip
x-cache-lookup
HIT from lvsincludecache-2522848:80
status
200
x-ebay-c-version
1.0.0
content-length
108045
last-modified
Fri, 24 Aug 2018 20:13:42 GMT
server
ebay server
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000, immutable
rlogid
t6q%60utuf%3C%3Dosuufvuq%60%284204106-1672896cc08-0xbb
x-ebay-request-id
1672896c-c080-aadc-6d13-dc78ff310eb2![]
access-control-allow-headers
*
expires
Thu, 28 Nov 2019 14:41:11 GMT
10341xh50yz21mhhydueu4m5wad.js
ir.ebaystatic.com/rs/v/ 		8 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ir.ebaystatic.com/rs/v/10341xh50yz21mhhydueu4m5wad.js
Requested by
Host: ebay.com.productpayment.ga
URL: https://ebay.com.productpayment.ga/?fbclid=IwAR0lB6YZUYY66LwdRaJ4sjRTeJ9_fqX49BMi-hmqyywbkZFhdxrEgaAXYvQ
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2.18.234.244 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-234-244.deploy.static.akamaitechnologies.com
Software
ebay server /
Resource Hash
e123f0c91db61c7420316106e7233facfb16217f90c30cbfa837b66a4d4c8ae3

Request headers

Referer
https://ebay.com.productpayment.ga/?fbclid=IwAR0lB6YZUYY66LwdRaJ4sjRTeJ9_fqX49BMi-hmqyywbkZFhdxrEgaAXYvQ
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 28 Nov 2018 14:41:11 GMT
content-encoding
gzip
x-cache-lookup
HIT from slcincludecache-1959350:80
rlogid
t6q%60utuf%3C%3Dpieufvuq%60%2870%3A%3D%3E51-1646d012670-0xcc
status
200
x-ebay-c-version
1.0.0
content-length
3255
last-modified
Sat, 03 Mar 2018 03:10:07 GMT
server
ebay server
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
application/x-javascript;charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, immutable
warning
113 slcincludecache-1959350 (squid) This cache hit is still fresh and more than 1 day old
x-ebay-request-id
1646d012-6700-a991-8425-f4a1ff629b94![]
access-control-allow-headers
*
expires
Thu, 28 Nov 2019 14:41:11 GMT
makeebayfasterscript-src-scripts-body-78a2168a.js
ir.ebaystatic.com/rs/c/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ir.ebaystatic.com/rs/c/makeebayfasterscript-src-scripts-body-78a2168a.js
Requested by
Host: ebay.com.productpayment.ga
URL: https://ebay.com.productpayment.ga/?fbclid=IwAR0lB6YZUYY66LwdRaJ4sjRTeJ9_fqX49BMi-hmqyywbkZFhdxrEgaAXYvQ
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2.18.234.244 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-234-244.deploy.static.akamaitechnologies.com
Software
ebay server /
Resource Hash
81b9056bc784a4ac2299cb454ba74cc8f1b7732e3a7bfd4f65aec9ba9822686a

Request headers

Referer
https://ebay.com.productpayment.ga/?fbclid=IwAR0lB6YZUYY66LwdRaJ4sjRTeJ9_fqX49BMi-hmqyywbkZFhdxrEgaAXYvQ
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 28 Nov 2018 14:41:11 GMT
content-encoding
gzip
x-cache-lookup
HIT from slcincludecache-1959350:80
rlogid
t6q%60utuf%3C%3Dsm%7Eufvuq%60%284570120-16535373cda-0xb5
status
200
x-ebay-c-version
1.0.0
content-length
1917
last-modified
Thu, 09 Aug 2018 18:44:15 GMT
server
ebay server
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000, immutable
warning
113 slcincludecache-1959350 (squid) This cache hit is still fresh and more than 1 day old
x-ebay-request-id
16535373-cda0-ac19-a2e5-1a3fffb60923![]
access-control-allow-headers
*
expires
Thu, 28 Nov 2019 14:41:11 GMT
sgninui-src-static-images-FB-f-Logo__white_29-366f0bd1.png
ir.ebaystatic.com/rs/c/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ir.ebaystatic.com/rs/c/sgninui-src-static-images-FB-f-Logo__white_29-366f0bd1.png
Requested by
Host: ebay.com.productpayment.ga
URL: https://ebay.com.productpayment.ga/?fbclid=IwAR0lB6YZUYY66LwdRaJ4sjRTeJ9_fqX49BMi-hmqyywbkZFhdxrEgaAXYvQ
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2.18.234.244 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-234-244.deploy.static.akamaitechnologies.com
Software
ebay server /
Resource Hash
53c410f2864972705c250f8c95f111e583c15f6efce891dae6f902c3490d97bf

Request headers

Referer
https://ir.ebaystatic.com/rs/c/signin-ebd720.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 28 Nov 2018 14:41:11 GMT
x-cache-lookup
HIT from slcincludecache-1959351:80
status
200
x-ebay-c-version
1.0.0
content-length
1201
last-modified
Tue, 24 Jul 2018 23:37:11 GMT
server
ebay server
access-control-allow-methods
GET
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000, immutable
rlogid
t6q%60utuf%3C%3Dsm%7Eufvuq%60%284256663-165e930661d-0xab
x-ebay-request-id
165e9306-61d0-ab1c-a3e7-292cffa411cb![]
access-control-allow-headers
*
warning
113 slcincludecache-1959351 (squid) This cache hit is still fresh and more than 1 day old
expires
Thu, 28 Nov 2019 14:41:11 GMT
fxxj3ttftm5ltcqnto1o4baovyl.png
ir.ebaystatic.com/rs/v/ 		5 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ir.ebaystatic.com/rs/v/fxxj3ttftm5ltcqnto1o4baovyl.png
Requested by
Host: ebay.com.productpayment.ga
URL: https://ebay.com.productpayment.ga/?fbclid=IwAR0lB6YZUYY66LwdRaJ4sjRTeJ9_fqX49BMi-hmqyywbkZFhdxrEgaAXYvQ
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2.18.234.244 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-234-244.deploy.static.akamaitechnologies.com
Software
ebay server /
Resource Hash
5440e48584e47738479ccd905576e9ddf2097d07b6c7ba81dda6eeb13b1d4af0

Request headers

Referer
https://ebay.com.productpayment.ga/?fbclid=IwAR0lB6YZUYY66LwdRaJ4sjRTeJ9_fqX49BMi-hmqyywbkZFhdxrEgaAXYvQ
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 28 Nov 2018 14:41:11 GMT
x-cache-lookup
HIT from lvsincludecache-2522848:80
status
200
x-ebay-c-version
1.0.0
content-length
4820
last-modified
Wed, 29 Oct 2014 18:09:24 GMT
server
ebay server
access-control-allow-methods
GET
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000, immutable
rlogid
t6q%60utuf%3C%3Dosuufvuq%60%28421043%3A-165d03a8b30-0xce
x-ebay-request-id
165d03a8-b300-aadc-2e21-3c6effc1a4dd![]
access-control-allow-headers
*
warning
113 lvsincludecache-2522848 (squid) This cache hit is still fresh and more than 1 day old
expires
Thu, 28 Nov 2019 14:41:11 GMT
MarketSans-Regular-WebS.woff2
ir.ebaystatic.com/cr/v/c1/market-sans/v1.0/ 		22 KB
22 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://ir.ebaystatic.com/cr/v/c1/market-sans/v1.0/MarketSans-Regular-WebS.woff2
Requested by
Host: ebay.com.productpayment.ga
URL: https://ebay.com.productpayment.ga/?fbclid=IwAR0lB6YZUYY66LwdRaJ4sjRTeJ9_fqX49BMi-hmqyywbkZFhdxrEgaAXYvQ
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2.18.234.244 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-234-244.deploy.static.akamaitechnologies.com
Software
ebay server /
Resource Hash
75dceb1952ced6dab35cf68d3b6bf2f3d2ee9dd7b799ef2b5efb39323d093cc4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://ir.ebaystatic.com/rs/c/signin-ebd720.css
Origin
https://ebay.com.productpayment.ga

Response headers

date
Wed, 28 Nov 2018 14:41:11 GMT
content-encoding
gzip
x-content-type-options
nosniff
x-cache-lookup
HIT from lvsincludecache-2522847:80
status
200
content-length
22156
x-xss-protection
1; mode=block
server
ebay server
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
application/font-woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000, immutable
rlogid
t6q%60uebwh%3D9iptq%60uebwh*1305%3B43%29pqtfwpu%29osu%29fgg%7E-fij-166812ac513-0xc7
access-control-allow-headers
*
expires
Thu, 28 Nov 2019 14:41:11 GMT
MarketSans-SemiBold-WebS.woff2
ir.ebaystatic.com/cr/v/c1/market-sans/v1.0/ 		22 KB
22 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://ir.ebaystatic.com/cr/v/c1/market-sans/v1.0/MarketSans-SemiBold-WebS.woff2
Requested by
Host: ebay.com.productpayment.ga
URL: https://ebay.com.productpayment.ga/?fbclid=IwAR0lB6YZUYY66LwdRaJ4sjRTeJ9_fqX49BMi-hmqyywbkZFhdxrEgaAXYvQ
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2.18.234.244 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-234-244.deploy.static.akamaitechnologies.com
Software
ebay server /
Resource Hash
d1de97533f8c973f9eb1162098eee749715f058edb650efd69e9d6ac62b056b6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://ir.ebaystatic.com/rs/c/signin-ebd720.css
Origin
https://ebay.com.productpayment.ga

Response headers

date
Wed, 28 Nov 2018 14:41:11 GMT
content-encoding
gzip
x-content-type-options
nosniff
x-cache-lookup
HIT from slcincludecache-1959351:80
status
200
content-length
22468
x-xss-protection
1; mode=block
server
ebay server
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
application/font-woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000, immutable
rlogid
t6q%60uebwh%3D9un%7Fq%60uebwh*110%3F7%3D%3F%29pqtfwpu%29sm%7E%29fgg%7E-fij-16684560e7d-0xc8
access-control-allow-headers
*
expires
Thu, 28 Nov 2019 14:41:11 GMT
fb.js
c.paypal.com/da/r/ Frame 069D 		43 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://c.paypal.com/da/r/fb.js
Requested by
Host: ebay.com.productpayment.ga
URL: https://ebay.com.productpayment.ga/?fbclid=IwAR0lB6YZUYY66LwdRaJ4sjRTeJ9_fqX49BMi-hmqyywbkZFhdxrEgaAXYvQ
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2.18.232.222 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-232-222.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
6817805f2be9fb71e88438bb2ac8453351d572421983de38309d5d186845b07d

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://ebay.com.productpayment.ga/?fbclid=IwAR0lB6YZUYY66LwdRaJ4sjRTeJ9_fqX49BMi-hmqyywbkZFhdxrEgaAXYvQ
Origin
https://ebay.com.productpayment.ga

Response headers

Date
Wed, 28 Nov 2018 14:41:11 GMT
X-Pad
avoid browser bug
Vary
Accept-Encoding
Connection
keep-alive
Content-Encoding
gzip
Content-Length
14704
Last-Modified
Mon, 13 Aug 2018 17:30:19 GMT
Server
Apache
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET
Content-Type
application/x-javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=86400
Access-Control-Allow-Credentials
false
Accept-Ranges
bytes
Expires
Thu, 29 Nov 2018 14:41:11 GMT
f5uxsy10bmz05dtrtrqybl5qquv.png
ir.ebaystatic.com/rs/v/ 		994 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ir.ebaystatic.com/rs/v/f5uxsy10bmz05dtrtrqybl5qquv.png
Requested by
Host: ebay.com.productpayment.ga
URL: https://ebay.com.productpayment.ga/?fbclid=IwAR0lB6YZUYY66LwdRaJ4sjRTeJ9_fqX49BMi-hmqyywbkZFhdxrEgaAXYvQ
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2.18.234.244 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-234-244.deploy.static.akamaitechnologies.com
Software
ebay server /
Resource Hash
7e0f4cd0590e2cf36c094d4226d70ccf2bc12107c46f3aeb8b3b5801396b44b0

Request headers

Referer
https://ir.ebaystatic.com/rs/v/3sbepdq10q0dtksnrmgitl41cm0.css?proc=DU:N
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 28 Nov 2018 14:41:11 GMT
x-cache-lookup
HIT from lvsincludecache-2522846:80
status
200
x-ebay-c-version
1.0.0
content-length
994
last-modified
Fri, 12 Feb 2016 00:01:35 GMT
server
ebay server
access-control-allow-methods
GET
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000, immutable
rlogid
t6q%60utuf%3C%3Dosuufvuq%60%284377764-16540b4496c-0xb8
x-ebay-request-id
16540b44-96c0-aa46-5245-3997ffaf3af4![]
access-control-allow-headers
*
warning
113 lvsincludecache-2522846 (squid) This cache hit is still fresh and more than 1 day old
expires
Thu, 28 Nov 2019 14:41:11 GMT
truncated
/ 		725 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
1b3c84dc67fbaa659cd41ef4f90978cdc64ee8e7afa4410ee56b55652acd6263

Request headers

Response headers

Access-Control-Allow-Origin
*
Content-Type
image/svg+xml
rtm
srv.main.ebayrtm.com/ Frame 6E5C 		9 B
446 B 		Script
General
Check archive.org
Download Go to
Full URL
https://srv.main.ebayrtm.com/rtm?RtmGetCapJs&p=18&rqid=8d16a0ab1650abc1dad21657ffffffff&cb=parent.window.updateRtmField
Requested by
Host: ebay.com.productpayment.ga
URL: https://ebay.com.productpayment.ga/?fbclid=IwAR0lB6YZUYY66LwdRaJ4sjRTeJ9_fqX49BMi-hmqyywbkZFhdxrEgaAXYvQ
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_GCM
Server
66.135.197.242 Campbell, United States, ASN11643 (EBAY - eBay, Inc, US),
Reverse DNS
srv.ebayrtm.com
Software
Apache-Coyote/1.1 /
Resource Hash
9088173db5a37e3a5b4d9e25cdd7d10505217415bf10cb6ddc2ccce74728d5d7

Request headers

Referer
https://ebay.com.productpayment.ga/?fbclid=IwAR0lB6YZUYY66LwdRaJ4sjRTeJ9_fqX49BMi-hmqyywbkZFhdxrEgaAXYvQ
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 28 Nov 2018 14:41:11 GMT
Server
Apache-Coyote/1.1
P3P
CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Cache-Control
no-cache
RlogId
p4pphdlwc%3D9ipt37%2B6%3B73271-1675ac4483f-0xc2
Content-Type
application/x-javascript;charset=utf-8
Content-Length
9
Expires
0
GlanceCobrowseLoader_4.2.0M.js
secureir.ebaystatic.com/cr/v/c1/cobrowse_4.2.0/js/ 		9 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://secureir.ebaystatic.com/cr/v/c1/cobrowse_4.2.0/js/GlanceCobrowseLoader_4.2.0M.js?group=20315&site=production
Requested by
Host: ocsrest.ebay.com
URL: https://ocsrest.ebay.com/ocsrsapp/o2/inflow/inflowcomponent?input=%7B%22pageId%22:%222487283%22%7D&callback=Inflow.cb
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2.18.234.107 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a2-18-234-107.deploy.static.akamaitechnologies.com
Software
ebay server /
Resource Hash
acb761de56201714caf6714349449e651698b34b30b5274e6ff7eb3c755976a5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://ebay.com.productpayment.ga/?fbclid=IwAR0lB6YZUYY66LwdRaJ4sjRTeJ9_fqX49BMi-hmqyywbkZFhdxrEgaAXYvQ
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 28 Nov 2018 14:41:12 GMT
content-encoding
gzip
x-content-type-options
nosniff
x-cache-lookup
HIT from lvsincludecache-2522846:80
status
200
content-length
3553
x-xss-protection
1; mode=block
server
ebay server
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
application/x-javascript;charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, immutable
rlogid
t6q%60uebwh%3D9iptq%60uebwh*1006035%29pqtfwpu%29osu%29fgg%7E-fij-16684590080-0xca
access-control-allow-headers
*
expires
Thu, 28 Nov 2019 14:41:12 GMT
t_n.html
signin.ebay.com/ Frame 04DE 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://signin.ebay.com/t_n.html?suppressFlash=true&org_id=usllpic0&session_id=8d16a0a91650abc1dadcde21fff422e8
Requested by
Host: ir.ebaystatic.com
URL: https://ir.ebaystatic.com/rs/c/signin-e84ee6.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_GCM
Server
66.211.185.34 Campbell, United States, ASN11643 (EBAY - eBay, Inc, US),
Reverse DNS
signin.ebay.com
Software
Apache-Coyote/1.1 /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age= 31536000

Request headers

Host
signin.ebay.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer
https://ebay.com.productpayment.ga/?fbclid=IwAR0lB6YZUYY66LwdRaJ4sjRTeJ9_fqX49BMi-hmqyywbkZFhdxrEgaAXYvQ
Accept-Encoding
gzip, deflate
Cookie
ebay=%5Esbf%3D%23%5E; dp1=bu1p/QEBfX0BAX19AQA**5ddfdc87^; s=CgAD4ACBb//qHNWFjNDQ2ZTkxNjcwYWRhNWQ1MDI0ZGFkZmUxZWI0YTWRdXuO; nonsession=CgADLAAFb/rAPMQDKACBlZKqHNWFjNDQ2ZTkxNjcwYWRhNWQ1MDI0ZGFkZmUxZWI0YTWCnyvV
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://ebay.com.productpayment.ga/?fbclid=IwAR0lB6YZUYY66LwdRaJ4sjRTeJ9_fqX49BMi-hmqyywbkZFhdxrEgaAXYvQ

Response headers

Server
Apache-Coyote/1.1
last-modified
Mon, 27 Aug 2018 21:28:26 GMT
Content-Type
text/html
Content-Length
3459
Date
Wed, 28 Nov 2018 14:41:12 GMT
Strict-Transport-Security
max-age= 31536000

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: eBay (E-commerce)

57 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

number| $ssgST boolean| useCustomFont function| DFP function| setVariable function| flashAlert function| onSLLoadError function| readWriteSLTagCB object| globalDfpContext object| oDFP undefined| dfpDetails undefined| dom object| doc object| where object| iframe function| handleParentCallBackForSocial function| $rset function| $radd function| $rget object| $rlookup object| $jscomp object| _checkBoxSelector function| $ function| jQuery object| $rmod object| global object| $_mod function| raptorDefine function| raptorRequire function| define function| require object| raptor object| $i18n function| $ssg object| $MUID object| $components object| trkCorrelationSessionInfo function| Uri function| $uri function| TaaSDynamic object| TaaSDynamicObj function| attachTrackingListener object| $trk undefined| idmapRoverURL function| TaaSIdMapTracker object| tracking function| triggerTracking function| TaaSTrackingCore object| TaaSIdMapTrackerObj object| __RAPTOR_PUBSUB object| cookies-browser object| GH object| GH_config string| rtmAsyncURL function| updateRtmField function| otpSubmit object| Inflow object| GLANCE

4 Cookies

Domain/Path Name / Value
.ebay.com/ Name: nonsession
Value: CgADLAAFb/rAPMQDKACBlZKqHNWFjNDQ2ZTkxNjcwYWRhNWQ1MDI0ZGFkZmUxZWI0YTWCnyvV
.ebay.com/ Name: s
Value: CgAD4ACBb//qHNWFjNDQ2ZTkxNjcwYWRhNWQ1MDI0ZGFkZmUxZWI0YTWRdXuO
.ebay.com/ Name: dp1
Value: bu1p/QEBfX0BAX19AQA**5ddfdc87^
.ebay.com/ Name: ebay
Value: %5Esbf%3D%23%5E

1 Console Messages

Source Level URL
Text
console-api error URL: https://secureir.ebaystatic.com/cr/v/c1/cobrowse_4.2.0/js/GlanceCobrowseLoader_4.2.0M.js?group=20315&site=production(Line 21)
Message:
ERR_COBROWSE_NOT_SUPP

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

c.paypal.com
ebay.com.productpayment.ga
ir.ebaystatic.com
ocsrest.ebay.com
secureir.ebaystatic.com
signin.ebay.com
srv.main.ebayrtm.com
2.18.232.222
2.18.234.107
2.18.234.244
2606:4700:30::6818:6834
66.135.197.242
66.135.209.124
66.211.185.34
05830fdef4ed02fa522186d6b44ff242fbdec217f36fb1fe7a7df98abe05bfd1
1b3c84dc67fbaa659cd41ef4f90978cdc64ee8e7afa4410ee56b55652acd6263
374eee0aa2ea3745055a959e8a96c5dcb4716cdd7fe5205d5b34e8666b2582b5
53c410f2864972705c250f8c95f111e583c15f6efce891dae6f902c3490d97bf
5440e48584e47738479ccd905576e9ddf2097d07b6c7ba81dda6eeb13b1d4af0
645850bf000d7450c0f1059da0dbe177b7dbfe92ce605daa7d3a0ebee9d9b611
6817805f2be9fb71e88438bb2ac8453351d572421983de38309d5d186845b07d
6dc70f764db5f32d13335101894dd4761db066d410d5db97d263e106b76c368f
75dceb1952ced6dab35cf68d3b6bf2f3d2ee9dd7b799ef2b5efb39323d093cc4
7e0f4cd0590e2cf36c094d4226d70ccf2bc12107c46f3aeb8b3b5801396b44b0
81b9056bc784a4ac2299cb454ba74cc8f1b7732e3a7bfd4f65aec9ba9822686a
9088173db5a37e3a5b4d9e25cdd7d10505217415bf10cb6ddc2ccce74728d5d7
acb761de56201714caf6714349449e651698b34b30b5274e6ff7eb3c755976a5
d1de97533f8c973f9eb1162098eee749715f058edb650efd69e9d6ac62b056b6
d755349aad3f4d2f953d90c585067ed9e8fa395d8e2a68c108c34ebadc722617
e123f0c91db61c7420316106e7233facfb16217f90c30cbfa837b66a4d4c8ae3
f8f1da2402cf5b780bbd1c5cd55b00ddccf82525ffcc2a4be179a1e81149ceb4