ebay.payments-support-center.com

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 6 HTTP transactions. The main IP is 2606:4700:3032::681b:a1b5, located in United States and belongs to CLOUDFLARENET, US. The main domain is ebay.payments-support-center.com.

This is the only time ebay.payments-support-center.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: eBay (E-commerce)

Domain & IP information

	IP Address	AS Autonomous System
3	2606:4700:303... 2606:4700:3032::681b:a1b5	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a00:1450:400... 2a00:1450:4001:81d::200a	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:825::2003	15169 (GOOGLE) (GOOGLE)
6	3

3 2606:4700:3032::681b:a1b5 (United States)

ASN13335 (CLOUDFLARENET, US)

ebay.payments-support-center.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:81d::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:825::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	payments-support-center.com ebay.payments-support-center.com	20 KB
2	googleapis.com fonts.googleapis.com	1 KB
1	gstatic.com fonts.gstatic.com	20 KB
6	3

	Domain	Requested by
3	ebay.payments-support-center.com	ebay.payments-support-center.com
2	fonts.googleapis.com	ebay.payments-support-center.com
1	fonts.gstatic.com	fonts.googleapis.com
6	3

This site contains no links.

Subject Issuer	Validity	Valid
upload.video.google.com GTS CA 1O1	`2020-11-10` - `2021-02-02`	3 months	crt.sh
*.gstatic.com GTS CA 1O1	`2020-11-10` - `2021-02-02`	3 months	crt.sh

This page contains 1 frames:

Primary Page: http://ebay.payments-support-center.com/
Frame ID: 64AA572A33530E9AEF493D6388F9EC8C
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Page Statistics

6
Requests

50 %
HTTPS

100 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

41 kB
Transfer

59 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request Cookie set / Show response
ebay.payments-support-center.com/ 31 KB
15 KB 72ms
58ms Document
text/html 2606:4700:3032::681b:a1b5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://ebay.payments-support-center.com/
Protocol: HTTP/1.1
Server: 2606:4700:3032::681b:a1b5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3bc5493b96691edca94bd20e9aecaa7d8e9e80ce0d0f0d629919a76b61b18557

Request headers

Host: ebay.payments-support-center.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 29 Dec 2020 13:41:42 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=d9f135acecd93d237a107ccab1b6ae7a91609249302; expires=Thu, 28-Jan-21 13:41:42 GMT; path=/; domain=.payments-support-center.com; HttpOnly; SameSite=Lax
Vary: Accept-Encoding
CF-Cache-Status: DYNAMIC
cf-request-id: 075054c08a00003248da185000000001
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=uuQ6HRqgZaqeZe%2FNYHGjF3rdcMDEWnmIvlevYhtzKOAe8SmHnP%2BRCcMQByMWqI7JAHoeneUvCIGCNeWiv%2FPuXBarvmi43LPQgDW392iDoOI%2FCgx7J6uzIFzWBwXp6Q1dzEa9Np2n9lyPN80aOA%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 6093f0ada97e3248-FRA
Content-Encoding: gzip

GET
H/1.1 200
OK styles.css
ebay.payments-support-center.com/ 2 KB
1 KB 43ms
43ms Stylesheet
text/css 2606:4700:3032::681b:a1b5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://ebay.payments-support-center.com/styles.css
Requested by: Host: ebay.payments-support-center.com
URL: http://ebay.payments-support-center.com/
Protocol: HTTP/1.1
Server: 2606:4700:3032::681b:a1b5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9ca0ed4276735c9afd845926ef8373c1b0da43fd9d76cafc03e5fdaaa68b70f7

Request headers

Referer: http://ebay.payments-support-center.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 29 Dec 2020 13:41:42 GMT
Content-Encoding: gzip
CF-Cache-Status: MISS
NEL: {"report_to":"cf-nel","max_age":604800}
Connection: keep-alive
Content-Length: 601
cf-request-id: 075054c0f700003248d0033000000001
Last-Modified: Thu, 22 Oct 2020 10:13:46 GMT
Server: cloudflare
ETag: "6e3-5b23fb838a008-gzip"
Vary: Accept-Encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=sIkeNXOOL1tflLNM0bzuDSwyG71lh6tw3GOn0B1sUGb1pKwQiIwGNMJMNGbOIFRUImFW3YJmrn%2FmO3rTDl1OvtNRowQhlQz2uxpvFC7L1CyIjxcCmWrxqngKlvYpQ4SP7dACUHy%2FdWrxQEDRgA%3D%3D"}],"group":"cf-nel","max_age":604800}
Content-Type: text/css
Cache-Control: max-age=14400
Accept-Ranges: bytes
CF-RAY: 6093f0ae5a303248-FRA

GET
H2 200 css
fonts.googleapis.com/ 2 KB
639 B 15ms
14ms Stylesheet
text/css 2a00:1450:4001:81d::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Raleway:700&display=swap

Requested by

Host: ebay.payments-support-center.com
URL: http://ebay.payments-support-center.com/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

dd34887446e930271b35849880d0af6270e2bfa822e3a61cd6e5d2029b9bfc6d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: http://ebay.payments-support-center.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 29 Dec 2020 13:41:42 GMT
server: ESF
date: Tue, 29 Dec 2020 13:41:42 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 29 Dec 2020 13:41:42 GMT

GET
H2 200 css
fonts.googleapis.com/ 2 KB
593 B 15ms
15ms Stylesheet
text/css 2a00:1450:4001:81d::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Nunito&display=swap

Requested by

Host: ebay.payments-support-center.com
URL: http://ebay.payments-support-center.com/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

31bb3651213f9ff82d0d2e84253efce0663128afb10d5612d4849a16a5184b86

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: http://ebay.payments-support-center.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 29 Dec 2020 13:34:34 GMT
server: ESF
date: Tue, 29 Dec 2020 13:41:42 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 29 Dec 2020 13:41:42 GMT

GET
H/1.1 200
OK left-logo.png
ebay.payments-support-center.com/ 3 KB
4 KB 71ms
66ms Image
image/png 2606:4700:3032::681b:a1b5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://ebay.payments-support-center.com/left-logo.png
Requested by: Host: ebay.payments-support-center.com
URL: http://ebay.payments-support-center.com/
Protocol: HTTP/1.1
Server: 2606:4700:3032::681b:a1b5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6f289149df91f3bfae5de1f926a11f33e96fd157ea5f47f54aa8bc21a4a1431f

Request headers

Referer: http://ebay.payments-support-center.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 29 Dec 2020 13:41:42 GMT
CF-Cache-Status: MISS
Last-Modified: Thu, 22 Oct 2020 10:13:46 GMT
Server: cloudflare
ETag: "b77-5b23fb83544a9"
Vary: Accept-Encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=dYZAmBQasMROU6Xji%2B%2FQtRwOybFMRAlw70FZDPiG9h3Si9ZF1U%2Bbv2yHpppSM3FrZhGEmCgc3oOQ6F8Bi8%2FeObX3ipVz7ehzaKxL7%2Fm8eEG9QjAH6iz6ZVb4reXpJhQiibLoZisr8a3QKAAy9Q%3D%3D"}],"group":"cf-nel","max_age":604800}
Content-Type: image/png
Cache-Control: max-age=14400
NEL: {"report_to":"cf-nel","max_age":604800}
Connection: keep-alive
Accept-Ranges: bytes
CF-RAY: 6093f0ae6becc2db-FRA
Content-Length: 2935
cf-request-id: 075054c0fc0000c2dbe01e9000000001

GET
H2 200 1Ptxg8zYS_SKggPN4iEgvnHyvveLxVs9pbCIPrcVIT9d0c8.woff
fonts.gstatic.com/s/raleway/v18/ 20 KB
20 KB 6ms
5ms Font
font/woff 2a00:1450:4001:825::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/raleway/v18/1Ptxg8zYS_SKggPN4iEgvnHyvveLxVs9pbCIPrcVIT9d0c8.woff

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Raleway:700&display=swap

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7878bbef599ba8ab8d2b85f5c4be4d73684136b62b7a5ff99aa6f497f23304b1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: http://ebay.payments-support-center.com
Referer: https://fonts.googleapis.com/css?family=Raleway:700&display=swap
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Dec 2020 23:34:15 GMT
x-content-type-options: nosniff
last-modified: Wed, 30 Sep 2020 20:46:05 GMT
server: sffe
age: 310047
content-type: font/woff
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20152
x-xss-protection: 0
expires: Sat, 25 Dec 2021 23:34:15 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: eBay (E-commerce)

14 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.payments-support-center.com/	1970-01-19 15:44:01	Name: __cfduid Value: d9f135acecd93d237a107ccab1b6ae7a91609249302

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ebay.payments-support-center.com
fonts.googleapis.com
fonts.gstatic.com
2606:4700:3032::681b:a1b5
2a00:1450:4001:81d::200a
2a00:1450:4001:825::2003
31bb3651213f9ff82d0d2e84253efce0663128afb10d5612d4849a16a5184b86
3bc5493b96691edca94bd20e9aecaa7d8e9e80ce0d0f0d629919a76b61b18557
6f289149df91f3bfae5de1f926a11f33e96fd157ea5f47f54aa8bc21a4a1431f
7878bbef599ba8ab8d2b85f5c4be4d73684136b62b7a5ff99aa6f497f23304b1
9ca0ed4276735c9afd845926ef8373c1b0da43fd9d76cafc03e5fdaaa68b70f7
dd34887446e930271b35849880d0af6270e2bfa822e3a61cd6e5d2029b9bfc6d

ebay.payments-support-center.com Open in urlscan Pro 2606:4700:3032::681b:a1b5 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

6 Requests

50 %HTTPS

100 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

41 kBTransfer

59 kBSize

1 Cookies

0 Outgoing links

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

14 JavaScript Global Variables

1 Cookies

Indicators

ebay.payments-support-center.com Open in urlscan Pro
2606:4700:3032::681b:a1b5 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

50 %
HTTPS

100 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

41 kB
Transfer

59 kB
Size

1
Cookies

6 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!