www.naidakundurovic.com Open in urlscan Pro
185.99.1.226 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://www.naidakundurovic.com/cli/45bade2Fusr2Ftiraoo3F_trksid3Dp2047675l2559eayISAPIdllSignInru=http0A2F2Fwwwebade2Fusr2Ftira...
Submission: On November 11 via api (November 11th 2019, 9:52:04 am UTC) from CZ

Summary HTTP 14 Redirects Links 9 Behaviour Indicators

Summary

This website contacted 7 IPs in 5 countries across 7 domains to perform 14 HTTP transactions. The main IP is 185.99.1.226, located in Bosnia & Herzegovina and belongs to GLOBALHOST-BOSNIA-AS, BA. The main domain is www.naidakundurovic.com.

This is the only time www.naidakundurovic.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: eBay (E-commerce)

Domain & IP information

	IP Address	AS Autonomous System
1	185.99.1.226 185.99.1.226	200698 (GLOBALHOS...) (GLOBALHOST-BOSNIA-AS)
6	2.18.234.107 2.18.234.107	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
2	2.21.38.79 2.21.38.79	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	184.31.90.74 184.31.90.74	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	66.135.201.92 66.135.201.92	11643 (EBAY) (EBAY - eBay)
1 2	64.4.245.84 64.4.245.84	17012 (PAYPAL) (PAYPAL - PayPal)
14	7

1 185.99.1.226 (Bosnia & Herzegovina)

ASN200698 (GLOBALHOST-BOSNIA-AS, BA)
PTR: polaris.global.ba

www.naidakundurovic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2.18.234.107 (Ascension Island)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a2-18-234-107.deploy.static.akamaitechnologies.com

secureir.ebaystatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
securepics.ebaystatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2.21.38.79 (France)

ASN20940 (AKAMAI-ASN1, US)
PTR: a2-21-38-79.deploy.static.akamaitechnologies.com

www.paypalobjects.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.paypal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 184.31.90.74 (Netherlands)

ASN20940 (AKAMAI-ASN1, US)
PTR: a184-31-90-74.deploy.static.akamaitechnologies.com

signin.ebay.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 66.135.201.92 (United States)

ASN11643 (EBAY - eBay, Inc, US)
PTR: srv.ebayrtm.com

srv.de.ebayrtm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 64.4.245.84 (United States) 1 redirects

ASN17012 (PAYPAL - PayPal, Inc., US)

b.stats.paypal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
dub.stats.paypal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	ebaystatic.com secureir.ebaystatic.com securepics.ebaystatic.com	69 KB
3	paypal.com 1 redirects b.stats.paypal.com dub.stats.paypal.com c.paypal.com	1 KB
1	ebayrtm.com srv.de.ebayrtm.com	204 B
1	ebay.de signin.ebay.de
1	paypalobjects.com www.paypalobjects.com	15 KB
1	naidakundurovic.com www.naidakundurovic.com	153 KB
0	ebay.com Failed b.stats.ebay.com Failed 395920152eap21qb.stats.ebay.com Failed
14	7

	Domain	Requested by
4	secureir.ebaystatic.com	www.naidakundurovic.com
2	securepics.ebaystatic.com	www.naidakundurovic.com
1	c.paypal.com	www.paypalobjects.com
1	dub.stats.paypal.com
1	b.stats.paypal.com	1 redirects
1	srv.de.ebayrtm.com	www.naidakundurovic.com
1	signin.ebay.de	www.naidakundurovic.com
1	www.paypalobjects.com	www.naidakundurovic.com
1	www.naidakundurovic.com
0	395920152eap21qb.stats.ebay.com Failed	www.naidakundurovic.com
0	b.stats.ebay.com Failed	www.naidakundurovic.com
14	11

This site contains links to these domains. Also see Links.

Domain
www.ebay.de
qu.ebay.de
scgi.ebay.de
pages.ebay.de
cgi6.ebay.de
trustsealinfo.websecurity.norton.com
www.symantec.com

Subject Issuer	Validity	Valid
www.ebay.com DigiCert SHA2 Secure Server CA	`2019-07-17` - `2020-08-18`	a year	crt.sh
www.paypal.com DigiCert SHA2 Extended Validation Server CA	`2019-09-10` - `2020-08-18`	a year	crt.sh
signin.ebay.com DigiCert SHA2 Secure Server CA	`2019-04-01` - `2020-04-26`	a year	crt.sh
srv.ebayrtm.com DigiCert SHA2 Secure Server CA	`2019-03-27` - `2020-03-27`	a year	crt.sh
b.stats.paypal.com DigiCert SHA2 High Assurance Server CA	`2018-02-16` - `2020-04-29`	2 years	crt.sh

This page contains 6 frames:

Primary Page: http://www.naidakundurovic.com/cli/45bade2Fusr2Ftiraoo3F_trksid3Dp2047675l2559eayISAPIdllSignInru=http0A2F2Fwwwebade2Fusr2Ftiraoo3F_trksid3Dp2047675l2559.html
Frame ID: F44F79E6C33CEDECACA26F082224369A
Requests: 10 HTTP requests in this frame

Frame: https://www.paypalobjects.com/webstatic/r/fb/fb-all-prod.akamai.pp.min.js
Frame ID: A3A8F4B301CD25865EFE2849929A4324
Requests: 1 HTTP requests in this frame

Frame: https://signin.ebay.de/t_n.html?org_id=usllpic0&session_id=ea3959201520a5e5b55178e1ffdfec59
Frame ID: A4F94610B296365D3E1F23EAD1F1DE1E
Requests: 1 HTTP requests in this frame

Frame: https://srv.de.ebayrtm.com/rtm?RtmGetCapJs&p=18&rqid=ea3959201520a5e5b557d5c7ffd40d85&cb=parent.window.updateRtmField
Frame ID: FF7DB7C44E016171B9C31FE768EC6156
Requests: 1 HTTP requests in this frame

Frame: https://dub.stats.paypal.com/counter2.cgi
Frame ID: DCA05F61558F9CF87AEB3500343AA338
Requests: 1 HTTP requests in this frame

Frame: https://c.paypal.com/v1/r/d/i?js_src=https://www.paypalobjects.com/webstatic/r/fb/fb-all-prod.akamai.pp.min.js
Frame ID: 6EA18A1D371416A3534A96DCE81A25DD
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i

Page Statistics

14
Requests

79 %
HTTPS

0 %
IPv6

7
Domains

11
Subdomains

7
IPs

5
Countries

238 kB
Transfer

362 kB
Size

1
Cookies

9 Outgoing links

These are links going to different origins than the main page.

URL: http://www.ebay.de/
Title: eBay

Search URL Search Domain Scan URL

URL: http://qu.ebay.de/survey?srvName=signin+(si-DE)
Title: Kommentare?

Search URL Search Domain Scan URL

URL: https://scgi.ebay.de/ws/eBayISAPI.dll?FYPShow&_trksid=p4853.m2379.l4061&ru=http%3A%2F%2Fwww.ebay.de%2F
Title: Passwort vergessen

Search URL Search Domain Scan URL

URL: http://pages.ebay.de/help/policies/user-agreement.html
Title: eBay-AGB

Search URL Search Domain Scan URL

URL: http://pages.ebay.de/help/policies/privacy-policy.html
Title: Datenschutzerklärung

Search URL Search Domain Scan URL

URL: http://pages.ebay.de/help/account/cookies-web-beacons.html
Title: Cookies

Search URL Search Domain Scan URL

URL: http://cgi6.ebay.de/ws/eBayISAPI.dll?AdChoiceLandingPage&partner=0
Title: AdChoice

Search URL Search Domain Scan URL

URL: https://trustsealinfo.websecurity.norton.com/splash?form_file=fdf/splash.fdf&dn=www.ebay.de&lang=de

Search URL Search Domain Scan URL

URL: http://www.symantec.com/ssl-certificates
Title: Zum Thema SSL-Zertifikate

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 12

https://b.stats.paypal.com/v1/counter.cgi?r=cD1lYTM4OWI4YzE1MjBhN2UyZTY1MmIwMGJmZjg1YjRiNCZpPTM3LjExLjE0LjEzMiZ0PTE0NTU2Mjg1NzImYT0yMG2Kug8EjvzuOMGpVQKM7KZYCK6h HTTP 302
https://dub.stats.paypal.com/counter2.cgi

14 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request 45bade2Fusr2Ftiraoo3F_trksid3Dp2047675l2559eayISAPIdllSignInru=http0A2F2Fwwwebade2Fusr2Ftiraoo3F_trksid3Dp2047675l2559.html Show response
www.naidakundurovic.com/cli/ 153 KB
153 KB 631ms
115ms Document
text/html 185.99.1.226
GLOBALHOST-BOSNIA-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://www.naidakundurovic.com/cli/45bade2Fusr2Ftiraoo3F_trksid3Dp2047675l2559eayISAPIdllSignInru=http0A2F2Fwwwebade2Fusr2Ftiraoo3F_trksid3Dp2047675l2559.html
Protocol: HTTP/1.1
Server: 185.99.1.226 , Bosnia & Herzegovina, ASN200698 (GLOBALHOST-BOSNIA-AS, BA),
Reverse DNS: polaris.global.ba
Software: Apache /
Resource Hash: abdc74e23e62936022a3c02f9e66d6ef3cea9f67ad5d2edae669a34165850030

Request headers

Host: www.naidakundurovic.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 11 Nov 2019 09:51:47 GMT
Server: Apache
Upgrade: h2,h2c
Connection: Upgrade, Keep-Alive
Last-Modified: Wed, 06 Apr 2016 11:51:29 GMT
Accept-Ranges: bytes
Content-Length: 156347
Keep-Alive: timeout=3, max=100
Content-Type: text/html

GET
H2 200 fxxj3ttftm5ltcqnto1o4baovyl.png
secureir.ebaystatic.com/rs/v/ 5 KB
5 KB 92ms
42ms Image
image/png 2.18.234.107
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secureir.ebaystatic.com/rs/v/fxxj3ttftm5ltcqnto1o4baovyl.png
Requested by: Host: www.naidakundurovic.com
URL: http://www.naidakundurovic.com/cli/45bade2Fusr2Ftiraoo3F_trksid3Dp2047675l2559eayISAPIdllSignInru=http0A2F2Fwwwebade2Fusr2Ftiraoo3F_trksid3Dp2047675l2559.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2.18.234.107 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-234-107.deploy.static.akamaitechnologies.com
Software: ebay server /
Resource Hash: 5440e48584e47738479ccd905576e9ddf2097d07b6c7ba81dda6eeb13b1d4af0

Request headers

Sec-Fetch-Mode: no-cors
Referer: http://www.naidakundurovic.com/cli/45bade2Fusr2Ftiraoo3F_trksid3Dp2047675l2559eayISAPIdllSignInru=http0A2F2Fwwwebade2Fusr2Ftiraoo3F_trksid3Dp2047675l2559.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 11 Nov 2019 09:51:47 GMT
x-cache-lookup: HIT from lvsincludecache-2522847:80
status: 200
x-ebay-c-version: 1.0.0
content-length: 4820
last-modified: Wed, 29 Oct 2014 18:09:24 GMT
server: ebay server
x-edgeconnect-cache-status: 1
access-control-allow-methods: GET
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000, immutable
rlogid: t6q%60utuf%3C%3Dosuufvuq%60%284%3F36%3F%3E2-16707f5d3cb-0xe1
x-ebay-request-id: 16707f5d-3cb0-ad4e-19f3-bb01ff7faa17![]
access-control-allow-headers: *
warning: 113 lvsincludecache-2522847 (squid) This cache hit is still fresh and more than 1 day old
expires: Tue, 10 Nov 2020 09:51:47 GMT

GET eBayISAPI.dll
b.stats.ebay.com/ws/ 0
0

GET eBayISAPI.dll
395920152eap21qb.stats.ebay.com/ws/ 0
0

GET
H2 200 imgbg.jpg
securepics.ebaystatic.com/aw/pics/cmp/ds3/ 1 KB
2 KB 69ms
22ms Image
image/jpeg 2.18.234.107
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepics.ebaystatic.com/aw/pics/cmp/ds3/imgbg.jpg
Requested by: Host: www.naidakundurovic.com
URL: http://www.naidakundurovic.com/cli/45bade2Fusr2Ftiraoo3F_trksid3Dp2047675l2559eayISAPIdllSignInru=http0A2F2Fwwwebade2Fusr2Ftiraoo3F_trksid3Dp2047675l2559.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2.18.234.107 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-234-107.deploy.static.akamaitechnologies.com
Software: eBay Server /
Resource Hash: b054c21c769e6e73a3f3f2e51ff27783043d87f8c4cb963c0554b33010fa3efc

Request headers

Sec-Fetch-Mode: no-cors
Referer: http://www.naidakundurovic.com/cli/45bade2Fusr2Ftiraoo3F_trksid3Dp2047675l2559eayISAPIdllSignInru=http0A2F2Fwwwebade2Fusr2Ftiraoo3F_trksid3Dp2047675l2559.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 11 Nov 2019 09:51:47 GMT
last-modified: Tue, 30 May 2017 20:58:47 GMT
server: eBay Server
etag: "570-550c411e57d01"
content-type: image/jpeg
status: 200
cache-control: max-age=897142
accept-ranges: bytes
content-length: 1392
expires: Thu, 21 Nov 2019 19:04:09 GMT

GET
H2 200 sprSignIn3.png
securepics.ebaystatic.com/aw/pics/register/ 19 KB
20 KB 70ms
24ms Image
image/png 2.18.234.107
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepics.ebaystatic.com/aw/pics/register/sprSignIn3.png
Requested by: Host: www.naidakundurovic.com
URL: http://www.naidakundurovic.com/cli/45bade2Fusr2Ftiraoo3F_trksid3Dp2047675l2559eayISAPIdllSignInru=http0A2F2Fwwwebade2Fusr2Ftiraoo3F_trksid3Dp2047675l2559.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2.18.234.107 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-234-107.deploy.static.akamaitechnologies.com
Software: eBay Server /
Resource Hash: e2192eadf7564ceb9202cb5b5ddcfb244c4a2627ffd46b7292855972181623ec

Request headers

Sec-Fetch-Mode: no-cors
Referer: http://www.naidakundurovic.com/cli/45bade2Fusr2Ftiraoo3F_trksid3Dp2047675l2559eayISAPIdllSignInru=http0A2F2Fwwwebade2Fusr2Ftiraoo3F_trksid3Dp2047675l2559.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 11 Nov 2019 09:51:47 GMT
last-modified: Tue, 30 May 2017 21:02:38 GMT
server: eBay Server
etag: "4de3-550c41fb00e9b"
content-type: image/png
status: 200
cache-control: max-age=442114
accept-ranges: bytes
content-length: 19939
expires: Sat, 16 Nov 2019 12:40:21 GMT

GET
H2 200 seal.gif
secureir.ebaystatic.com/pictures/aw/pics/globalHeader/ 2 KB
2 KB 110ms
64ms Image
image/gif 2.18.234.107
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secureir.ebaystatic.com/pictures/aw/pics/globalHeader/seal.gif

Requested by

Host: www.naidakundurovic.com
URL: http://www.naidakundurovic.com/cli/45bade2Fusr2Ftiraoo3F_trksid3Dp2047675l2559eayISAPIdllSignInru=http0A2F2Fwwwebade2Fusr2Ftiraoo3F_trksid3Dp2047675l2559.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2.18.234.107 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a2-18-234-107.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

9329e47d8f7f88e1b452b8520dbe8187523f2e109a98601376bb000e7806f418

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: no-cors
Referer: http://www.naidakundurovic.com/cli/45bade2Fusr2Ftiraoo3F_trksid3Dp2047675l2559eayISAPIdllSignInru=http0A2F2Fwwwebade2Fusr2Ftiraoo3F_trksid3Dp2047675l2559.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 11 Nov 2019 09:51:47 GMT
x-cache-lookup: HIT from lvspicscache-2505095:80
last-modified: Tue, 30 May 2017 20:59:28 GMT
server: Apache
status: 200
access-control-allow-methods: GET
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=31536000, immutable
accept-ranges: bytes
access-control-allow-headers: *
content-length: 1536
x-xss-protection: 1; mode=block
expires: Tue, 10 Nov 2020 09:51:47 GMT

GET
H2 200 r32gctn0fu3vjkpge2mjhij3q.js Show response
secureir.ebaystatic.com/v4js/z/i5/ 102 KB
31 KB 87ms
42ms Script
application/x-javascript 2.18.234.107
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://secureir.ebaystatic.com/v4js/z/i5/r32gctn0fu3vjkpge2mjhij3q.js
Requested by: Host: www.naidakundurovic.com
URL: http://www.naidakundurovic.com/cli/45bade2Fusr2Ftiraoo3F_trksid3Dp2047675l2559eayISAPIdllSignInru=http0A2F2Fwwwebade2Fusr2Ftiraoo3F_trksid3Dp2047675l2559.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2.18.234.107 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-234-107.deploy.static.akamaitechnologies.com
Software: ebay server /
Resource Hash: 8e27b0403bf1062e5c8df7f76bb053bac530db88e86a3f5b99930b4dc78c69d1

Request headers

Sec-Fetch-Mode: no-cors
Referer: http://www.naidakundurovic.com/cli/45bade2Fusr2Ftiraoo3F_trksid3Dp2047675l2559eayISAPIdllSignInru=http0A2F2Fwwwebade2Fusr2Ftiraoo3F_trksid3Dp2047675l2559.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 11 Nov 2019 09:51:47 GMT
content-encoding: gzip
x-cache-lookup: MISS from rnoincludecache-970415:80
status: 200
x-ebay-c-version: 1.0.0
content-length: 31543
last-modified: Thu, 06 Sep 2018 13:34:45 GMT
server: ebay server
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/x-javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, immutable
rlogid: t6q%60utuf%3C%3Dpieufvuq%60%285620771-16e380fbce0-0xda
x-ebay-request-id: 16e380fb-ce00-aca5-1dd5-84ceffc24f0d![
access-control-allow-headers: *
expires: Tue, 10 Nov 2020 09:51:47 GMT

GET
H2 200 btozt5kwui1jbeo4irdyb4hudun.js Show response
secureir.ebaystatic.com/rs/v/ 31 KB
10 KB 107ms
62ms Script
application/x-javascript 2.18.234.107
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://secureir.ebaystatic.com/rs/v/btozt5kwui1jbeo4irdyb4hudun.js
Requested by: Host: www.naidakundurovic.com
URL: http://www.naidakundurovic.com/cli/45bade2Fusr2Ftiraoo3F_trksid3Dp2047675l2559eayISAPIdllSignInru=http0A2F2Fwwwebade2Fusr2Ftiraoo3F_trksid3Dp2047675l2559.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2.18.234.107 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-234-107.deploy.static.akamaitechnologies.com
Software: envoy /
Resource Hash: 391f1eb710e4c55cd679045b3fa1f78a090fd4678f8b49b6f0c72a6d645bdee2

Request headers

Sec-Fetch-Mode: no-cors
Referer: http://www.naidakundurovic.com/cli/45bade2Fusr2Ftiraoo3F_trksid3Dp2047675l2559eayISAPIdllSignInru=http0A2F2Fwwwebade2Fusr2Ftiraoo3F_trksid3Dp2047675l2559.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 11 Nov 2019 09:51:47 GMT
content-encoding: gzip
x-cache-lookup: HIT from rnoincludecache-970418:80
x-ebay-pop-id: UFES2-SYD-irstatic-1
rlogid: t6q%60utuf%3C%3Dosuufvuq%60%285610%3F4%3B-16d3112d634-0xbb
status: 200
x-envoy-upstream-service-time: 153
x-ebay-c-version: 1.0.0
content-length: 9454
last-modified: Wed, 03 Jun 2015 21:19:23 GMT
server: envoy
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/x-javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, immutable
warning: 113 rnoincludecache-970418 (squid) This cache hit is still fresh and more than 1 day old
x-ebay-request-id: 16d3112d-6340-aa13-c415-5af7ff64dc06![
access-control-allow-headers: *
expires: Tue, 10 Nov 2020 09:51:47 GMT

GET
H2 200 fb-all-prod.akamai.pp.min.js Show response
www.paypalobjects.com/webstatic/r/fb/ Frame A3A8 48 KB
15 KB 87ms
35ms Script
application/x-javascript 2.21.38.79
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paypalobjects.com/webstatic/r/fb/fb-all-prod.akamai.pp.min.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2.21.38.79 , France, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a2-21-38-79.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

8a7b0ef0042a25ed17ab7aa1294d453ed4072ce3146368cbe8d78f4b17e73817

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: http://www.naidakundurovic.com/cli/45bade2Fusr2Ftiraoo3F_trksid3Dp2047675l2559eayISAPIdllSignInru=http0A2F2Fwwwebade2Fusr2Ftiraoo3F_trksid3Dp2047675l2559.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 11 Nov 2019 09:51:47 GMT
x-pad: avoid browser bug
x-content-type-options: nosniff
last-modified: Mon, 10 Aug 2015 04:55:21 GMT
server: Apache
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=86400
strict-transport-security: max-age=31536000
accept-ranges: bytes
content-encoding: gzip
content-length: 15275
expires: Tue, 12 Nov 2019 09:51:47 GMT

GET
H2 200 t_n.html
signin.ebay.de/ Frame A4F9 0
0 267ms
214ms Document
text/html 184.31.90.74
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://signin.ebay.de/t_n.html?org_id=usllpic0&session_id=ea3959201520a5e5b55178e1ffdfec59

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

184.31.90.74 , Netherlands, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a184-31-90-74.deploy.static.akamaitechnologies.com

Software

Apache-Coyote/1.1 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

:method: GET
:authority: signin.ebay.de
:scheme: https
:path: /t_n.html?org_id=usllpic0&session_id=ea3959201520a5e5b55178e1ffdfec59
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode: nested-navigate
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
referer: http://www.naidakundurovic.com/cli/45bade2Fusr2Ftiraoo3F_trksid3Dp2047675l2559eayISAPIdllSignInru=http0A2F2Fwwwebade2Fusr2Ftiraoo3F_trksid3Dp2047675l2559.html
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Referer: http://www.naidakundurovic.com/cli/45bade2Fusr2Ftiraoo3F_trksid3Dp2047675l2559eayISAPIdllSignInru=http0A2F2Fwwwebade2Fusr2Ftiraoo3F_trksid3Dp2047675l2559.html

Response headers

status: 200
server: Apache-Coyote/1.1
last-modified: Mon, 23 Sep 2019 17:57:02 GMT
content-type: text/html
strict-transport-security: max-age=31536000
vary: Accept-Encoding
content-encoding: gzip
expires: Mon, 11 Nov 2019 09:51:47 GMT
cache-control: max-age=0, no-cache, no-store
pragma: no-cache
date: Mon, 11 Nov 2019 09:51:47 GMT
content-length: 1151

GET
H/1.1 200 rtm Show response
srv.de.ebayrtm.com/ Frame FF7D 56 B
204 B 630ms
158ms Script
application/x-javascript 66.135.201.92
eBay

General

Check archive.org

Show headers Download Go to

Full URL: https://srv.de.ebayrtm.com/rtm?RtmGetCapJs&p=18&rqid=ea3959201520a5e5b557d5c7ffd40d85&cb=parent.window.updateRtmField
Requested by: Host: www.naidakundurovic.com
URL: http://www.naidakundurovic.com/cli/45bade2Fusr2Ftiraoo3F_trksid3Dp2047675l2559eayISAPIdllSignInru=http0A2F2Fwwwebade2Fusr2Ftiraoo3F_trksid3Dp2047675l2559.html
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 66.135.201.92 , United States, ASN11643 (EBAY - eBay, Inc, US),
Reverse DNS: srv.ebayrtm.com
Software: /
Resource Hash: efd2bd5237dc50a234f9f80e4167135da2f1cc535974c1cd8d55d7055b9f864c

Request headers

Sec-Fetch-Mode: no-cors
Referer: http://www.naidakundurovic.com/cli/45bade2Fusr2Ftiraoo3F_trksid3Dp2047675l2559eayISAPIdllSignInru=http0A2F2Fwwwebade2Fusr2Ftiraoo3F_trksid3Dp2047675l2559.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 11 Nov 2019 09:51:47 GMT
Content-Length: 56
Content-Type: application/x-javascript;charset=UTF-8

GET
DATA 200
OK truncated
/ 725 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1b3c84dc67fbaa659cd41ef4f90978cdc64ee8e7afa4410ee56b55652acd6263

Request headers

Referer: http://www.naidakundurovic.com/cli/45bade2Fusr2Ftiraoo3F_trksid3Dp2047675l2559eayISAPIdllSignInru=http0A2F2Fwwwebade2Fusr2Ftiraoo3F_trksid3Dp2047675l2559.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H/1.1

200
OK

counter2.cgi
dub.stats.paypal.com/ Frame DCA0
Redirect Chain

https://b.stats.paypal.com/v1/counter.cgi?r=cD1lYTM4OWI4YzE1MjBhN2UyZTY1MmIwMGJmZjg1YjRiNCZpPTM3LjExLjE0LjEzMiZ0PTE0NTU2Mjg1NzImYT0yMG2Kug8EjvzuOMGpVQKM7KZYCK6h
https://dub.stats.paypal.com/counter2.cgi

42 B
494 B

159ms
54ms

Image
image/jpeg

64.4.245.84
PayPal

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dub.stats.paypal.com/counter2.cgi
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 64.4.245.84 , United States, ASN17012 (PAYPAL - PayPal, Inc., US),
Reverse DNS
Software: /
Resource Hash: 47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292

Request headers

Referer: http://www.naidakundurovic.com/cli/45bade2Fusr2Ftiraoo3F_trksid3Dp2047675l2559eayISAPIdllSignInru=http0A2F2Fwwwebade2Fusr2Ftiraoo3F_trksid3Dp2047675l2559.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 11 Nov 2019 09:51:48 GMT
Cache-Control: private, must-revalidate, proxy-revalidate
Server
Connection: close
ETag: "5cc35fa7d744a1d57870"
Content-Length: 42
Content-type: image/jpeg

Redirect headers

Location: https://dub.stats.paypal.com/counter2.cgi
Date: Mon, 11 Nov 2019 09:51:47 GMT
Server
Connection: close
Content-Length: 289
Content-Type: text/html; charset=utf-8

GET
H2 200 i
c.paypal.com/v1/r/d/ Frame 6EA1 0
0 140ms
133ms Document
text/html 2.21.38.79
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://c.paypal.com/v1/r/d/i?js_src=https://www.paypalobjects.com/webstatic/r/fb/fb-all-prod.akamai.pp.min.js

Requested by

Host: www.paypalobjects.com
URL: https://www.paypalobjects.com/webstatic/r/fb/fb-all-prod.akamai.pp.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2.21.38.79 , France, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a2-21-38-79.deploy.static.akamaitechnologies.com

Software

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: c.paypal.com
:scheme: https
:path: /v1/r/d/i?js_src=https://www.paypalobjects.com/webstatic/r/fb/fb-all-prod.akamai.pp.min.js
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode: nested-navigate
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
referer: http://www.naidakundurovic.com/cli/45bade2Fusr2Ftiraoo3F_trksid3Dp2047675l2559eayISAPIdllSignInru=http0A2F2Fwwwebade2Fusr2Ftiraoo3F_trksid3Dp2047675l2559.html
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Referer: http://www.naidakundurovic.com/cli/45bade2Fusr2Ftiraoo3F_trksid3Dp2047675l2559eayISAPIdllSignInru=http0A2F2Fwwwebade2Fusr2Ftiraoo3F_trksid3Dp2047675l2559.html

Response headers

status: 200
correlation-id: 3cce0e7e9e6b5
content-security-policy-report-only: default-src 'self' https://*.paypal.com https://*.paypalobjects.com; script-src 'self' https://*.paypal.com https://*.paypalobjects.com https://www.facebook.com 'unsafe-eval' 'unsafe-inline' blob:; connect-src 'self' https://*.paypal.com; style-src 'self' https://*.paypal.com https://*.paypalobjects.com 'unsafe-inline'; font-src 'self' https://*.paypal.com https://*.paypalobjects.com data:; img-src 'self' https: data:; form-action 'self' https://*.paypal.com; base-uri 'self' https://*.paypal.com; object-src 'self' https://*.paypal.com https://*.paypalobjects.com; report-uri https://www.paypal.com/csplog/api/log/csp
content-type: text/html;charset=UTF-8
paypal-debug-id: 3cce0e7e9e6b5
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
vary: Accept-Encoding
content-encoding: gzip
content-length: 168
cache-control: no-cache, no-store, must-revalidate
date: Mon, 11 Nov 2019 09:51:47 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: b.stats.ebay.com
URL: https://b.stats.ebay.com/ws/eBayISAPI.dll?V4AppCounter&r=bOI4Way37Va7xf4VtOL3u7-ckFQ3pgVNRFoNJTruURgTKbHA5OwZ3Y3HnPOJNbEsEbckM5PE6k7XITayma6QR_dH-TztDbYeGNDA5bRu3zBfLgcbCsQf869jRCrk9eLhSUGDhw**&seq=1

Domain: 395920152eap21qb.stats.ebay.com
URL: https://395920152eap21qb.stats.ebay.com/ws/eBayISAPI.dll?V4AppCounter&r=bOI4Way37Va7xf4VtOL3u7-ckFQ3pgVNRFoNJTruURgTKbHA5OwZ3Y3HnPOJNbEsEbckM5PE6k7XITayma6QR_dH-TztDbYeGNDA5bRu3zBfLgcbCsQf869jRCrk9eLhSUGDhw**&seq=2

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: eBay (E-commerce)

85 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			c.paypal.com/	1969-12-31 23:59:59	Name: PP-Corr-Id Value: EBAY_SIGNIN:ea389b8c1520a7e2e652b00bff85b4b4

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

395920152eap21qb.stats.ebay.com
b.stats.ebay.com
b.stats.paypal.com
c.paypal.com
dub.stats.paypal.com
secureir.ebaystatic.com
securepics.ebaystatic.com
signin.ebay.de
srv.de.ebayrtm.com
www.naidakundurovic.com
www.paypalobjects.com
395920152eap21qb.stats.ebay.com
b.stats.ebay.com
184.31.90.74
185.99.1.226
2.18.234.107
2.21.38.79
64.4.245.84
66.135.201.92
1b3c84dc67fbaa659cd41ef4f90978cdc64ee8e7afa4410ee56b55652acd6263
391f1eb710e4c55cd679045b3fa1f78a090fd4678f8b49b6f0c72a6d645bdee2
47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292
5440e48584e47738479ccd905576e9ddf2097d07b6c7ba81dda6eeb13b1d4af0
8a7b0ef0042a25ed17ab7aa1294d453ed4072ce3146368cbe8d78f4b17e73817
8e27b0403bf1062e5c8df7f76bb053bac530db88e86a3f5b99930b4dc78c69d1
9329e47d8f7f88e1b452b8520dbe8187523f2e109a98601376bb000e7806f418
abdc74e23e62936022a3c02f9e66d6ef3cea9f67ad5d2edae669a34165850030
b054c21c769e6e73a3f3f2e51ff27783043d87f8c4cb963c0554b33010fa3efc
e2192eadf7564ceb9202cb5b5ddcfb244c4a2627ffd46b7292855972181623ec
efd2bd5237dc50a234f9f80e4167135da2f1cc535974c1cd8d55d7055b9f864c

www.naidakundurovic.com Open in urlscan Pro 185.99.1.226 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

14 Requests

79 %HTTPS

0 %IPv6

7 Domains

11 Subdomains

7 IPs

5 Countries

238 kBTransfer

362 kBSize

1 Cookies

9 Outgoing links

Redirected requests

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

85 JavaScript Global Variables

1 Cookies

Indicators

www.naidakundurovic.com Open in urlscan Pro
185.99.1.226 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

14
Requests

79 %
HTTPS

0 %
IPv6

7
Domains

11
Subdomains

7
IPs

5
Countries

238 kB
Transfer

362 kB
Size

1
Cookies

14 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!