ebay.com.need-help.store
Open in
urlscan Pro
2606:4700:3034::ac43:c760
Malicious Activity!
Public Scan
Submission: On October 31 via api from US — Scanned from US
Summary
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on October 28th 2022. Valid for: a year.
This is the only time ebay.com.need-help.store was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: eBay (E-commerce)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
3 | 2606:4700:303... 2606:4700:3034::ac43:c760 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
8 | 104.16.168.131 104.16.168.131 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
11 | 3 |
ASN13335 (CLOUDFLARENET, US)
hcaptcha.com | |
newassets.hcaptcha.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
8 |
hcaptcha.com
hcaptcha.com — Cisco Umbrella Rank: 6314 newassets.hcaptcha.com — Cisco Umbrella Rank: 11150 |
707 KB |
3 |
need-help.store
ebay.com.need-help.store |
10 KB |
11 | 2 |
Domain | Requested by | |
---|---|---|
6 | newassets.hcaptcha.com |
hcaptcha.com
newassets.hcaptcha.com |
3 | ebay.com.need-help.store |
ebay.com.need-help.store
|
2 | hcaptcha.com |
ebay.com.need-help.store
newassets.hcaptcha.com |
11 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
need-help.store Cloudflare Inc ECC CA-3 |
2022-10-28 - 2023-10-27 |
a year | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2022-05-15 - 2023-05-15 |
a year | crt.sh |
This page contains 3 frames:
Primary Page:
https://ebay.com.need-help.store/captcha
Frame ID: 5803A3F2330415EB469F19F27520C976
Requests: 4 HTTP requests in this frame
Frame:
https://newassets.hcaptcha.com/captcha/v1/1f7dc62/static/hcaptcha.html
Frame ID: 52058F5536B9FCFBFDE599B78D8883FD
Requests: 4 HTTP requests in this frame
Frame:
https://newassets.hcaptcha.com/captcha/v1/1f7dc62/static/hcaptcha.html
Frame ID: 1C5E91044928C019A3592C27F183B963
Requests: 4 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
11 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
captcha
ebay.com.need-help.store/ |
4 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
left-logo.png
ebay.com.need-help.store/static/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
api.js
hcaptcha.com/1/ |
281 KB 79 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cert.png
ebay.com.need-help.store/static/ |
3 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
hcaptcha.html
newassets.hcaptcha.com/captcha/v1/1f7dc62/static/ Frame 5205 |
2 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
hcaptcha.html
newassets.hcaptcha.com/captcha/v1/1f7dc62/static/ Frame 1C5E |
2 KB 901 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
hcaptcha.js
newassets.hcaptcha.com/captcha/v1/1f7dc62/ Frame 5205 |
281 KB 79 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
hcaptcha.js
newassets.hcaptcha.com/captcha/v1/1f7dc62/ Frame 1C5E |
281 KB 79 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame 1C5E |
798 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
checksiteconfig
hcaptcha.com/ Frame 1C5E |
555 B 841 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
hsw.js
newassets.hcaptcha.com/c/210b48ee/ Frame 5205 |
957 KB 359 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
e
newassets.hcaptcha.com/i/bc030dc/ Frame 5205 |
107 KB 108 KB |
Fetch
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: eBay (E-commerce)15 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| 1 object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation number| intervalId object| Raven object| hcaptcha object| grecaptcha0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ebay.com.need-help.store
hcaptcha.com
newassets.hcaptcha.com
104.16.168.131
2606:4700:3034::ac43:c760
0c531af7d3bd28d8f69b451b1566f7644d5c8e893dd837e92aad9c8851a014d3
202d124cfbdf21fb5f5d09094c9b9ab6523960595e009145765e24bc4050971c
46148b0fa96c60f3498282e4d3071f1c7715ccffe12d0f63b2192e6bb3c9483e
4e626cb80c06ed2f4560b3b4fef501c83d601fde61cd7cc507d77d47c916f06b
5440e48584e47738479ccd905576e9ddf2097d07b6c7ba81dda6eeb13b1d4af0
57cafa49fb677c3f09d6e90b051917d10e7bb54e83102a25f3d32b06e8fa59a7
e555b02e337b4f414967fac7d5ab952773ef4acddd36e7adacad1125dafcb384
f13f4ed673e0842319f91d3ae31f9927ade2ecd5f024a550c8f5d6f43c5e4b21
f392e364e7238ab371a2b028f38e58039a61478eb76af4d3ad683de1e0cf54cb