signin.verify.eb2fauth.eu
Open in
urlscan Pro
185.158.250.227
Malicious Activity!
Public Scan
Submission: On December 02 via manual from US
Summary
TLS certificate: Issued by Let's Encrypt Authority X3 on November 28th 2019. Valid for: 3 months.
This is the only time signin.verify.eb2fauth.eu was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: eBay (E-commerce)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
3 | 185.158.250.227 185.158.250.227 | 9009 (M247) (M247) | |
16 | 72.247.226.12 72.247.226.12 | 16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies) | |
1 5 | 2.18.234.107 2.18.234.107 | 16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies) | |
1 | 216.113.181.119 216.113.181.119 | 11643 (EBAY) (EBAY - eBay) | |
24 | 5 |
ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a72-247-226-12.deploy.static.akamaitechnologies.com
ir.ebaystatic.com |
ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a2-18-234-107.deploy.static.akamaitechnologies.com
rover.ebay.co.uk | |
secureir.ebaystatic.com | |
secureinclude.ebaystatic.com |
ASN11643 (EBAY - eBay, Inc, US)
PTR: ghactmod-web-public-1-1-rnoaz03.ebay.com
gha.ebay.co.uk |
Apex Domain Subdomains |
Transfer | |
---|---|---|
18 |
ebaystatic.com
ir.ebaystatic.com secureir.ebaystatic.com secureinclude.ebaystatic.com |
385 KB |
4 |
ebay.co.uk
1 redirects
rover.ebay.co.uk gha.ebay.co.uk |
2 KB |
3 |
eb2fauth.eu
signin.verify.eb2fauth.eu |
152 KB |
24 | 3 |
Domain | Requested by | |
---|---|---|
16 | ir.ebaystatic.com |
signin.verify.eb2fauth.eu
ir.ebaystatic.com |
3 | rover.ebay.co.uk |
1 redirects
signin.verify.eb2fauth.eu
|
3 | signin.verify.eb2fauth.eu |
ir.ebaystatic.com
|
1 | gha.ebay.co.uk |
ir.ebaystatic.com
|
1 | secureinclude.ebaystatic.com |
ir.ebaystatic.com
|
1 | secureir.ebaystatic.com |
signin.verify.eb2fauth.eu
|
24 | 6 |
This site contains links to these domains. Also see Links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
www.verify.eb2fauth.eu Let's Encrypt Authority X3 |
2019-11-28 - 2020-02-26 |
3 months | crt.sh |
www.ebay.com DigiCert SHA2 Secure Server CA |
2019-07-17 - 2020-08-18 |
a year | crt.sh |
gha.ebay.com DigiCert SHA2 Secure Server CA |
2019-08-14 - 2020-09-05 |
a year | crt.sh |
This page contains 2 frames:
Primary Page:
https://signin.verify.eb2fauth.eu/cm9nZXIuZXJyaW5ndG9uQGJ0aW50ZXJuZXQuY29t
Frame ID: 1B16957097BA8DD9CF3657767B37A778
Requests: 26 HTTP requests in this frame
Frame:
https://ir.ebaystatic.com/rs/v/it02syay0qyozhdaszhv1jl4yyd.js
Frame ID: 0354DCC609CB6691BE96DEBCC5DDF9F0
Requests: 1 HTTP requests in this frame
81 Outgoing links
These are links going to different origins than the main page.
Title: eBay logo
Search URL Search Domain Scan URL
Title: Collectables & antiques
Search URL Search Domain Scan URL
Title: Collectables
Search URL Search Domain Scan URL
Title: Antiques
Search URL Search Domain Scan URL
Title: Sports memorabilia
Search URL Search Domain Scan URL
Title: Coins
Search URL Search Domain Scan URL
Title: Electronics
Search URL Search Domain Scan URL
Title: Mobile phones
Search URL Search Domain Scan URL
Title: Sound & vision
Search URL Search Domain Scan URL
Title: Video games
Search URL Search Domain Scan URL
Title: Computers & tablets
Search URL Search Domain Scan URL
Title: Fashion
Search URL Search Domain Scan URL
Title: Women's clothing
Search URL Search Domain Scan URL
Title: Men's clothing
Search URL Search Domain Scan URL
Title: Shoes
Search URL Search Domain Scan URL
Title: Kid's fashion
Search URL Search Domain Scan URL
Title: Home & garden
Search URL Search Domain Scan URL
Title: Garden
Search URL Search Domain Scan URL
Title: Appliances
Search URL Search Domain Scan URL
Title: DIY materials
Search URL Search Domain Scan URL
Title: Furniture & homeware
Search URL Search Domain Scan URL
Title: Jewellery & watches
Search URL Search Domain Scan URL
Title: Watches
Search URL Search Domain Scan URL
Title: Costume jewellery
Search URL Search Domain Scan URL
Title: Vintage & antique jewellery
Search URL Search Domain Scan URL
Title: Fine jewellery
Search URL Search Domain Scan URL
Title: Motors
Search URL Search Domain Scan URL
Title: Cars
Search URL Search Domain Scan URL
Title: Car parts
Search URL Search Domain Scan URL
Title: Motorcycles & scooters
Search URL Search Domain Scan URL
Title: Motorcycle parts
Search URL Search Domain Scan URL
Title: Sporting goods
Search URL Search Domain Scan URL
Title: Cycling
Search URL Search Domain Scan URL
Title: Fishing
Search URL Search Domain Scan URL
Title: Fitness, running & yoga
Search URL Search Domain Scan URL
Title: Golf
Search URL Search Domain Scan URL
Title: Toys & games
Search URL Search Domain Scan URL
Title: Radio controlled
Search URL Search Domain Scan URL
Title: Construction toys
Search URL Search Domain Scan URL
Title: Outdoor toys
Search URL Search Domain Scan URL
Title: Action figures
Search URL Search Domain Scan URL
Title: Other categories
Search URL Search Domain Scan URL
Title: Books, comics & magazines
Search URL Search Domain Scan URL
Title: Health & beauty
Search URL Search Domain Scan URL
Title: Musical instruments
Search URL Search Domain Scan URL
Title: Business, office & industrial
Search URL Search Domain Scan URL
Title: All Brands
Search URL Search Domain Scan URL
Title: All Interests
Search URL Search Domain Scan URL
Title: Advanced
Search URL Search Domain Scan URL
Title: Sign in
Search URL Search Domain Scan URL
Title: register
Search URL Search Domain Scan URL
Title: Daily Deals
Search URL Search Domain Scan URL
Title: Sell
Search URL Search Domain Scan URL
Title: Help & Contact
Search URL Search Domain Scan URL
Title: Watch List
Search URL Search Domain Scan URL
Title: My eBay
Search URL Search Domain Scan URL
Title: Summary
Search URL Search Domain Scan URL
Title: Recently Viewed
Search URL Search Domain Scan URL
Title: Bids/Offers
Search URL Search Domain Scan URL
Title: Watch List
Search URL Search Domain Scan URL
Title: Purchase History
Search URL Search Domain Scan URL
Title: Selling
Search URL Search Domain Scan URL
Title: Saved Searches
Search URL Search Domain Scan URL
Title: Saved Sellers
Search URL Search Domain Scan URL
Title: Messages
Search URL Search Domain Scan URL
Title: Collect & Spend Learn more
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Title: About eBay
Search URL Search Domain Scan URL
Title: Announcements
Search URL Search Domain Scan URL
Title: Community
Search URL Search Domain Scan URL
Title: Safety Centre
Search URL Search Domain Scan URL
Title: Resolution Centre
Search URL Search Domain Scan URL
Title: Seller Centre
Search URL Search Domain Scan URL
Title: VeRO: Protecting Intellectual Property
Search URL Search Domain Scan URL
Title: Policies
Search URL Search Domain Scan URL
Title: Site Map
Search URL Search Domain Scan URL
Title: User Agreement
Search URL Search Domain Scan URL
Title: Privacy
Search URL Search Domain Scan URL
Title: Cookies
Search URL Search Domain Scan URL
Title: AdChoice
Search URL Search Domain Scan URL
Title: Norton Secured - powered by Verisign
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 7- http://rover.ebay.co.uk/roverimp/0/0/9?imp=2046301&trknvp=cp%3D2510209%26ghi%3D98&1574931183789 HTTP 301
- https://rover.ebay.co.uk/roverimp/0/0/9?imp=2046301&trknvp=cp%3D2510209%26ghi%3D98&1574931183789
24 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
cm9nZXIuZXJyaW5ndG9uQGJ0aW50ZXJuZXQuY29t
signin.verify.eb2fauth.eu/ |
50 KB 51 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
a4ucjowkxay1rekex1cvhy3q1ej.css
ir.ebaystatic.com/rs/v/ |
62 KB 17 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
error-2a48e1.css
ir.ebaystatic.com/rs/c/ |
37 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fxxj3ttftm5ltcqnto1o4baovyl.png
ir.ebaystatic.com/rs/v/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
DANCING-GIFTg.gif
ir.ebaystatic.com/cr/v/c1/ |
4 KB 4 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
error-6ad1df.js
ir.ebaystatic.com/rs/c/ |
252 KB 81 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
2sws1qd2xq3b1pqeawmwyus2qm3.js
ir.ebaystatic.com/rs/v/ |
113 KB 38 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
makeebayfasterscript-src-scripts-body-78a2168a.js
ir.ebaystatic.com/rs/c/ |
4 KB 2 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
9
rover.ebay.co.uk/roverimp/0/0/ Redirect Chain
|
42 B 441 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
globalheader_widget_platform__v1-49d3462703.js
ir.ebaystatic.com/cr/v/c1/ |
20 KB 7 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
btt.png
ir.ebaystatic.com/pictures/aw/pics/globalheader/ |
300 B 738 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
spinner30x30.svg
ir.ebaystatic.com/cr/v/c1/ |
805 B 900 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
MarketSans-Regular-WebS.woff2
ir.ebaystatic.com/cr/v/c1/market-sans/v1.0/ |
22 KB 22 KB |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
4xx-bkgd.png
secureir.ebaystatic.com/cr/v/c1/ |
142 KB 142 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
725 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
f5uxsy10bmz05dtrtrqybl5qquv.png
ir.ebaystatic.com/rs/v/ |
994 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
MarketSans-SemiBold-WebS.woff2
ir.ebaystatic.com/cr/v/c1/market-sans/v1.0/ |
22 KB 22 KB |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ebay-ns.css
secureinclude.ebaystatic.com/css/v/us/legacy/ |
1 KB 702 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ScandalJS-1.2.0-v4.min.js
ir.ebaystatic.com/cr/v/c1/ |
52 KB 16 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
9
rover.ebay.co.uk/roverimp/0/0/ |
42 B 369 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
useracquisition
signin.verify.eb2fauth.eu/gh/ |
50 KB 51 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
it02syay0qyozhdaszhv1jl4yyd.js
ir.ebaystatic.com/rs/v/ Frame 0354 |
21 KB 8 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bullseye
gha.ebay.co.uk/nproxy/notification/v1/ |
0 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
globalheader_widget_platform__v1-49d3462703.js
ir.ebaystatic.com/cr/v/c1/ |
20 KB 7 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
useracquisition
signin.verify.eb2fauth.eu/gh/ |
50 KB 51 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: eBay (E-commerce)52 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate object| global object| $_mod object| __RAPTOR_PUBSUB object| lazyLoad object| $rlookup function| $rset function| $radd function| $rget function| $ function| jQuery object| $rmod function| raptorDefine function| raptorRequire function| define function| require object| raptor function| $ssg object| $MUID function| $W10NOOP function| $initComponents object| $components function| GHalertConf function| GHalertServiceConf function| GHalertObjData function| GH_alertData function| GHalertObj function| GHalertBase function| GHalertDesktop object| ebayContent object| GH function| GHFlyout number| totalCurrentTypeCount number| _GlobalNavHeaderSrcPageId function| GH_personalizedData function| onRemoveNotiifcation function| onClickCouponButton function| addEventOnOverlay function| addTabEvent function| addEvent function| GH_SetGHNotifs string| objName object| trkCorrelationSessionInfo function| HttpClient object| googletag object| scandalGlobalState object| scandalQ object| scandalAds object| scandalCSAGlobalState object| scandal object| scandalAgof0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
gha.ebay.co.uk
ir.ebaystatic.com
rover.ebay.co.uk
secureinclude.ebaystatic.com
secureir.ebaystatic.com
signin.verify.eb2fauth.eu
185.158.250.227
2.18.234.107
216.113.181.119
72.247.226.12
04bf49bbfd5a50a586141b928cf50b60555279a0a5c85c6772a0a233648bed78
0ddd9f4a1e517e190efeaf1df7b3294ae4438f731da96b94fb3e6b7575fb1364
1b3c84dc67fbaa659cd41ef4f90978cdc64ee8e7afa4410ee56b55652acd6263
1e6741cc4efc876cac36f1100cf500f83adbadac365c65682992403281d8b83f
25703f0289feaeefa92747cd97bf2dc50c54b2bc7669b370a1878eda1d81186c
3fac9dd937881562110c43dae210e66df603a25d93da516c007edcd3f68e7004
4a94f4329afbaced71c7ced387951cd0a58194ae87dd2249fec852bf3cf19038
4cc91dd133a0caa25f7de346d64842c86d485e2a43fe60fbd3180bfea6365748
5440e48584e47738479ccd905576e9ddf2097d07b6c7ba81dda6eeb13b1d4af0
548224d6654ef2f1566e6a84f4cc72dd1478223f207a5241495e4d4ad066d187
59e6f67328895c91a88260a47a967a59354acd25789457d396f6da361b941ae8
6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93
75dceb1952ced6dab35cf68d3b6bf2f3d2ee9dd7b799ef2b5efb39323d093cc4
7e06f3f6e7b81096b652787d1cc2e090d3d5c208c169521fd7fd14a9a53b06d6
7e0f4cd0590e2cf36c094d4226d70ccf2bc12107c46f3aeb8b3b5801396b44b0
81b9056bc784a4ac2299cb454ba74cc8f1b7732e3a7bfd4f65aec9ba9822686a
a7c9392b434d881a6812e400d672fc0199dcbe8da58e85ec70a95347b6d4024b
a9e401754921ecbffe950b97fd4ee4d9284176ec08134d5bdb16209c47d110b4
d1de97533f8c973f9eb1162098eee749715f058edb650efd69e9d6ac62b056b6
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
efe72b2a669d66054ede00b6608496ad8a64390061fa2fde77f183ae3539cbe8
f2e47d3e3f8f71c841b6955f8e76702b5bc430f686812805459465b3da2d9da8
ff51822e51386bd7735d40046df99aef736042d33f3fe428ce0826d931106dce