m.ebay-kleinanzeigen.de.s-anzeige.snvs.de Open in urlscan Pro
23.95.228.68 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://m.ebay-kleinanzeigen.de.s-anzeige.snvs.de/
Effective URL:
http://m.ebay-kleinanzeigen.de.s-anzeige.snvs.de/1084651824-124-2425.htm
Submission: On April 27 via api (April 27th 2019, 4:20:44 pm UTC) from GB

Summary HTTP 8 Redirects Links 13 Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 8 HTTP transactions. The main IP is 23.95.228.68, located in Buffalo, United States and belongs to AS-COLOCROSSING - ColoCrossing, US. The main domain is m.ebay-kleinanzeigen.de.s-anzeige.snvs.de.

This is the only time m.ebay-kleinanzeigen.de.s-anzeige.snvs.de was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: eBay (E-commerce)

Domain & IP information

	IP Address	AS Autonomous System
1 2	23.95.228.68 23.95.228.68	36352 (AS-COLOCR...) (AS-COLOCROSSING - ColoCrossing)
7	2a04:cb41:f01... 2a04:cb41:f016:4::17	41552 (MARKTPLAA...) (MARKTPLAATS-AS)
8	3

2 23.95.228.68 (Buffalo, United States) 1 redirects

ASN36352 (AS-COLOCROSSING - ColoCrossing, US)
PTR: gt.sicherheitscenter-europa.de

m.ebay-kleinanzeigen.de.s-anzeige.snvs.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a04:cb41:f016:4::17 (Netherlands)

ASN41552 (MARKTPLAATS-AS, NL)

www.ebay-kleinanzeigen.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	ebay-kleinanzeigen.de www.ebay-kleinanzeigen.de	80 KB
2	snvs.de 1 redirects m.ebay-kleinanzeigen.de.s-anzeige.snvs.de	5 KB
8	2

	Domain	Requested by
7	www.ebay-kleinanzeigen.de	m.ebay-kleinanzeigen.de.s-anzeige.snvs.de www.ebay-kleinanzeigen.de
2	m.ebay-kleinanzeigen.de.s-anzeige.snvs.de	1 redirects
8	2

This site contains links to these domains. Also see Links.

Domain
m.ebay-kleinanzeigen.de
www.ebay-kleinanzeigen.de
themen.ebay-kleinanzeigen.de
de.surveymonkey.com

Subject Issuer	Validity	Valid
ebay-kleinanzeigen.de DigiCert SHA2 Secure Server CA	`2019-01-08` - `2020-01-09`	a year	crt.sh

This page contains 1 frames:

Primary Page: http://m.ebay-kleinanzeigen.de.s-anzeige.snvs.de/1084651824-124-2425.htm
Frame ID: A2E98B863C902768C784DB55E0F3F42E
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://m.ebay-kleinanzeigen.de.s-anzeige.snvs.de/ HTTP 302
http://m.ebay-kleinanzeigen.de.s-anzeige.snvs.de/1084651824-124-2425.htm Page URL

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Zepto (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /zepto.*\.js/i

Page Statistics

8
Requests

88 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

85 kB
Transfer

246 kB
Size

1
Cookies

13 Outgoing links

These are links going to different origins than the main page.

URL: https://m.ebay-kleinanzeigen.de/
Title: Start

Search URL Search Domain Scan URL

URL: https://m.ebay-kleinanzeigen.de/merkliste
Title: Merkliste

Search URL Search Domain Scan URL

URL: https://m.ebay-kleinanzeigen.de/nachrichten
Title: Nachrichten

Search URL Search Domain Scan URL

URL: https://m.ebay-kleinanzeigen.de/anzeige-aufgeben
Title: Anzeige aufgeben

Search URL Search Domain Scan URL

URL: http://www.ebay-kleinanzeigen.de/m-passwort-vergessen-inapp.html?appType=MWEB&_ga=2.68202961.1371456327.1552396580-797909444.1552396580
Title: Passwort vergessen

Search URL Search Domain Scan URL

URL: https://www.ebay-kleinanzeigen.de/anzeigen/m-benutzer-anmeldung-inapp.html?appType=MWEB&_ga=2.68202961.1371456327.1552396580-797909444.1552396580
Title: Registrieren

Search URL Search Domain Scan URL

URL: https://www.ebay-kleinanzeigen.de/back-from-mobile.html?mobile=false&to=
Title: Zur Webversion

Search URL Search Domain Scan URL

URL: https://www.ebay-kleinanzeigen.de/p-anzeige-aufgeben.html
Title: Anzeige aufgeben

Search URL Search Domain Scan URL

URL: https://themen.ebay-kleinanzeigen.de/datenschutzerklaerung/
Title: Datenschutzerklärung

Search URL Search Domain Scan URL

URL: https://themen.ebay-kleinanzeigen.de/nutzungsbedingungen/
Title: Nutzungsbedingungen

Search URL Search Domain Scan URL

URL: http://de.surveymonkey.com/s/7N5TFTR
Title: Feedback

Search URL Search Domain Scan URL

URL: https://www.ebay-kleinanzeigen.de/impressum.html
Title: Impressum

Search URL Search Domain Scan URL

URL: https://m.ebay-kleinanzeigen.de/einloggen-extra?targetUrl=/einloggen
Title: Einloggen

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://m.ebay-kleinanzeigen.de.s-anzeige.snvs.de/ HTTP 302
http://m.ebay-kleinanzeigen.de.s-anzeige.snvs.de/1084651824-124-2425.htm Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request 1084651824-124-2425.htm Show response m.ebay-kleinanzeigen.de.s-anzeige.snvs.de/ Redirect Chain http://m.ebay-kleinanzeigen.de.s-anzeige.snvs.de/ http://m.ebay-kleinanzeigen.de.s-anzeige.snvs.de/1084651824-124-2425.htm	16 KB 4 KB	112ms 112ms	Document text/html	23.95.228.68 ColoCrossing
General Check archive.org Show headers Download Go to Full URL http://m.ebay-kleinanzeigen.de.s-anzeige.snvs.de/1084651824-124-2425.htm Protocol HTTP/1.1 Server 23.95.228.68 Buffalo, United States, ASN36352 (AS-COLOCROSSING - ColoCrossing, US), Reverse DNS gt.sicherheitscenter-europa.de Software nginx / Resource Hash `4d17d38fa83696a6b7c5f19bd5025eb1198fd74eef3aed01f061d72e5eade05d` Request headers Host m.ebay-kleinanzeigen.de.s-anzeige.snvs.de Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3 Accept-Encoding gzip, deflate Cookie PHPSESSID=lhogh4ms2ap0e0j79m5mn310h6 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Server nginx Date Sat, 27 Apr 2019 16:20:28 GMT Content-Type text/html Last-Modified Wed, 13 Mar 2019 15:34:58 GMT Transfer-Encoding chunked Connection keep-alive Keep-Alive timeout=60 ETag W/"5c892322-4073" Content-Encoding gzip Redirect headers Server nginx Date Sat, 27 Apr 2019 16:20:28 GMT Content-Type text/html; charset=UTF-8 Transfer-Encoding chunked Connection keep-alive Keep-Alive timeout=60 Set-Cookie PHPSESSID=lhogh4ms2ap0e0j79m5mn310h6; path=/ Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate Pragma no-cache location 1084651824-124-2425.htm
GET H2	404	all.7c4rngb5jfv2.css www.ebay-kleinanzeigen.de/kmobile-static/static/css/	0 0	85ms 53ms	Stylesheet text/html	2a04:cb41:f016:4::17 MARKTPLAATS-AS
General Check archive.org Show headers Download Go to Full URL https://www.ebay-kleinanzeigen.de/kmobile-static/static/css/all.7c4rngb5jfv2.css Requested by Host: m.ebay-kleinanzeigen.de.s-anzeige.snvs.de URL: http://m.ebay-kleinanzeigen.de.s-anzeige.snvs.de/1084651824-124-2425.htm Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a04:cb41:f016:4::17 , Netherlands, ASN41552 (MARKTPLAATS-AS, NL), Reverse DNS Software nginx / Resource Hash Request headers Referer http://m.ebay-kleinanzeigen.de.s-anzeige.snvs.de/1084651824-124-2425.htm User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Sat, 27 Apr 2019 16:20:28 GMT content-encoding gzip server nginx age 17 vary Accept-Encoding x-varnish 1028177460 1043988742 status 404 content-type text/html; charset=iso-8859-1 content-length 29 via 1.1 varnish (Varnish/6.0)
GET H2	200	gdpr-consent.1s0odp6h8rfvs.js Show response www.ebay-kleinanzeigen.de/kmobile-static/static/js/lib/node_modules/gdpr-consent/dist/	220 KB 71 KB	59ms 27ms	Script application/javascript	2a04:cb41:f016:4::17 MARKTPLAATS-AS
General Check archive.org Show headers Download Go to Full URL https://www.ebay-kleinanzeigen.de/kmobile-static/static/js/lib/node_modules/gdpr-consent/dist/gdpr-consent.1s0odp6h8rfvs.js Requested by Host: m.ebay-kleinanzeigen.de.s-anzeige.snvs.de URL: http://m.ebay-kleinanzeigen.de.s-anzeige.snvs.de/1084651824-124-2425.htm Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a04:cb41:f016:4::17 , Netherlands, ASN41552 (MARKTPLAATS-AS, NL), Reverse DNS Software nginx / Resource Hash `74edcf541896f66126ac57b737bf1454935f6f22acfe52851fe54e42684e04ee` Request headers Referer http://m.ebay-kleinanzeigen.de.s-anzeige.snvs.de/1084651824-124-2425.htm User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Sat, 27 Apr 2019 16:20:28 GMT content-encoding gzip last-modified Thu, 28 Mar 2019 15:18:02 GMT server nginx age 2331245 vary Origin, Accept-Encoding content-type application/javascript status 200 cache-control max-age=4838400 x-varnish 102753344 1343579 accept-ranges bytes content-length 72225 via 1.1 varnish (Varnish/6.0) expires Sun, 26 May 2019 16:46:23 GMT
GET H2	404	all-zepto.g9kldtkw6381.js www.ebay-kleinanzeigen.de/kmobile-static/static/js/	0 0	84ms 52ms	Script text/html	2a04:cb41:f016:4::17 MARKTPLAATS-AS
General Check archive.org Show headers Download Go to Full URL https://www.ebay-kleinanzeigen.de/kmobile-static/static/js/all-zepto.g9kldtkw6381.js Requested by Host: m.ebay-kleinanzeigen.de.s-anzeige.snvs.de URL: http://m.ebay-kleinanzeigen.de.s-anzeige.snvs.de/1084651824-124-2425.htm Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a04:cb41:f016:4::17 , Netherlands, ASN41552 (MARKTPLAATS-AS, NL), Reverse DNS Software nginx / Resource Hash Request headers Referer http://m.ebay-kleinanzeigen.de.s-anzeige.snvs.de/1084651824-124-2425.htm User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Sat, 27 Apr 2019 16:20:28 GMT content-encoding gzip server nginx age 64 vary Accept-Encoding x-varnish 1028177459 1043923387 status 404 content-type text/html; charset=iso-8859-1 content-length 29 via 1.1 varnish (Varnish/6.0)
GET H2	200	logo-mobile.2phh3df7eyny.png www.ebay-kleinanzeigen.de/kmobile-static/static/img/common/	9 KB 9 KB	46ms 13ms	Image image/png	2a04:cb41:f016:4::17 MARKTPLAATS-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.ebay-kleinanzeigen.de/kmobile-static/static/img/common/logo-mobile.2phh3df7eyny.png Requested by Host: m.ebay-kleinanzeigen.de.s-anzeige.snvs.de URL: http://m.ebay-kleinanzeigen.de.s-anzeige.snvs.de/1084651824-124-2425.htm Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a04:cb41:f016:4::17 , Netherlands, ASN41552 (MARKTPLAATS-AS, NL), Reverse DNS Software nginx / Resource Hash `37b5f173604823eff40be11e02fa50161e743329131e30cc5d5836e0b8e591d6` Request headers Referer http://m.ebay-kleinanzeigen.de.s-anzeige.snvs.de/1084651824-124-2425.htm User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Sat, 27 Apr 2019 16:20:28 GMT via 1.1 varnish (Varnish/6.0) last-modified Thu, 28 Mar 2019 15:18:02 GMT server nginx age 2331246 vary Origin content-type image/png status 200 cache-control max-age=4838400 x-varnish 131537844 1572920 accept-ranges bytes content-length 9406 expires Sun, 26 May 2019 16:46:21 GMT
GET H2	404	all-zepto.g9kldtkw6381.js www.ebay-kleinanzeigen.de/kmobile-static/static/js/	0 0	16ms 16ms	Script text/html	2a04:cb41:f016:4::17 MARKTPLAATS-AS
General Check archive.org Show headers Download Go to Full URL https://www.ebay-kleinanzeigen.de/kmobile-static/static/js/all-zepto.g9kldtkw6381.js Requested by Host: m.ebay-kleinanzeigen.de.s-anzeige.snvs.de URL: http://m.ebay-kleinanzeigen.de.s-anzeige.snvs.de/1084651824-124-2425.htm Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a04:cb41:f016:4::17 , Netherlands, ASN41552 (MARKTPLAATS-AS, NL), Reverse DNS Software nginx / Resource Hash Request headers Referer http://m.ebay-kleinanzeigen.de.s-anzeige.snvs.de/1084651824-124-2425.htm User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Sat, 27 Apr 2019 16:20:28 GMT content-encoding gzip server nginx age 64 vary Accept-Encoding x-varnish 1028177462 1043923387 status 404 content-type text/html; charset=iso-8859-1 content-length 29 via 1.1 varnish (Varnish/6.0)
GET H2	404	all.7c4rngb5jfv2.css www.ebay-kleinanzeigen.de/kmobile-static/static/css/	0 0	31ms 30ms	Stylesheet text/html	2a04:cb41:f016:4::17 MARKTPLAATS-AS
General Check archive.org Show headers Download Go to Full URL https://www.ebay-kleinanzeigen.de/kmobile-static/static/css/all.7c4rngb5jfv2.css Requested by Host: m.ebay-kleinanzeigen.de.s-anzeige.snvs.de URL: http://m.ebay-kleinanzeigen.de.s-anzeige.snvs.de/1084651824-124-2425.htm Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a04:cb41:f016:4::17 , Netherlands, ASN41552 (MARKTPLAATS-AS, NL), Reverse DNS Software nginx / Resource Hash Request headers Referer http://m.ebay-kleinanzeigen.de.s-anzeige.snvs.de/1084651824-124-2425.htm User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers date Sat, 27 Apr 2019 16:20:28 GMT content-encoding gzip server nginx age 17 vary Accept-Encoding x-varnish 1028177463 1043988742 status 404 content-type text/html; charset=iso-8859-1 content-length 29 via 1.1 varnish (Varnish/6.0)
GET H2	200	vendorlist.json www.ebay-kleinanzeigen.de/gdpr/	0 0	153ms 124ms	XHR application/json	2a04:cb41:f016:4::17 MARKTPLAATS-AS
General Check archive.org Show headers Download Go to Full URL https://www.ebay-kleinanzeigen.de/gdpr/vendorlist.json Requested by Host: www.ebay-kleinanzeigen.de URL: https://www.ebay-kleinanzeigen.de/kmobile-static/static/js/lib/node_modules/gdpr-consent/dist/gdpr-consent.1s0odp6h8rfvs.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a04:cb41:f016:4::17 , Netherlands, ASN41552 (MARKTPLAATS-AS, NL), Reverse DNS Software / Resource Hash Request headers Accept application/json, text/plain, / Referer http://m.ebay-kleinanzeigen.de.s-anzeige.snvs.de/1084651824-124-2425.htm Origin http://m.ebay-kleinanzeigen.de.s-anzeige.snvs.de User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers access-control-allow-methods GET
GET DATA	200 OK	truncated /	505 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `13599f9bdecf3f99eb5c05ef5b532d0a56f84abc0d63697a28ed69b054be7905` Request headers Referer http://m.ebay-kleinanzeigen.de.s-anzeige.snvs.de/1084651824-124-2425.htm User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Content-Type image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: eBay (E-commerce)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			m.ebay-kleinanzeigen.de.s-anzeige.snvs.de/	1969-12-31 23:59:59	Name: PHPSESSID Value: lhogh4ms2ap0e0j79m5mn310h6

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	error	URL: https://www.ebay-kleinanzeigen.de/kmobile-static/static/js/lib/node_modules/gdpr-consent/dist/gdpr-consent.1s0odp6h8rfvs.js(Line 44) Message: Error: Network Error

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

m.ebay-kleinanzeigen.de.s-anzeige.snvs.de
www.ebay-kleinanzeigen.de
23.95.228.68
2a04:cb41:f016:4::17
13599f9bdecf3f99eb5c05ef5b532d0a56f84abc0d63697a28ed69b054be7905
37b5f173604823eff40be11e02fa50161e743329131e30cc5d5836e0b8e591d6
4d17d38fa83696a6b7c5f19bd5025eb1198fd74eef3aed01f061d72e5eade05d
74edcf541896f66126ac57b737bf1454935f6f22acfe52851fe54e42684e04ee

m.ebay-kleinanzeigen.de.s-anzeige.snvs.de Open in urlscan Pro 23.95.228.68 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

8 Requests

88 %HTTPS

50 %IPv6

2 Domains

2 Subdomains

3 IPs

2 Countries

85 kBTransfer

246 kBSize

1 Cookies

13 Outgoing links

Page URL History

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

7 JavaScript Global Variables

1 Cookies

1 Console Messages

Indicators

m.ebay-kleinanzeigen.de.s-anzeige.snvs.de Open in urlscan Pro
23.95.228.68 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

88 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

85 kB
Transfer

246 kB
Size

1
Cookies

8 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!