Report - ebayfraud.gremlins-in-it.com/fraudulent.html

Report Overview

Submitted URL
ebayfraud.gremlins-in-it.com/fraudulent.html
IP
173.254.28.65
ASN
#46606 UNIFIEDLAYER-AS-1
Submitted
2024-04-20 15:36:56
Access
public
Website Title
2003 FIAT AUTOTRAIL APACHE MOTORHOME CAMPER VAN CARAVAN on eBay (end time 15-Dec-10 11:43:04 GMT)
Final URL
ebayfraud.gremlins-in-it.com/fraudulent.html
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
2

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
i376.photobucket.com	unknown	2003-05-08	2012-11-14	2023-12-16	423 B	7.9 kB	143.204.55.73
ebayfraud.gremlins-in-it.com	unknown	2009-09-01	2018-12-03	2024-03-10	974 B	106 kB	173.254.28.65

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

Scan Date	Severity	Indicator	Alert
2024-04-20	medium	ebayfraud.gremlins-in-it.com/fraudulent.html	eBay Inc.

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (13)

	URL	Size	First Seen	Last Seen
	ebayfraud.gremlins-in-it.com/fraudulent.html	208 B	2023-03-13	2024-04-20
Pretty URL ebayfraud.gremlins-in-it.com/fraudulent.html IP 173.254.28.65 ASN #46606 UNIFIEDLAYER-AS-1 Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-13 13:52:26 Last Seen2024-04-20 17:36:57 Times Seen5 Hash 79dbd21bc4c9d9037d727adfc0f779a0 57c332db2837acc5843d2d90eb65c061fba2f5a9 dd2966a87a13fe494e71499383c88fdb3f233fddf67cc4476ecb13c3f759c4cc Loading...

	ebayfraud.gremlins-in-it.com/fraudulent.html	30 B	2023-03-07	2024-04-20
Pretty URL ebayfraud.gremlins-in-it.com/fraudulent.html IP 173.254.28.65 ASN #46606 UNIFIEDLAYER-AS-1 Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 12:58:47 Last Seen2024-04-20 17:36:57 Times Seen16 Hash 3c35258a733b1675ec6ecddf4218ab5a c67c6177a7127c2caf24dc264f583ce81001e675 1705e2f0762c74f3618ff8055ac7764cdf5af25014a97379e3b20fdaf77b702c Loading...

	ebayfraud.gremlins-in-it.com/fraudulent.html	257 B	2023-03-07	2024-04-20
Pretty URL ebayfraud.gremlins-in-it.com/fraudulent.html IP 173.254.28.65 ASN #46606 UNIFIEDLAYER-AS-1 Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 12:58:47 Last Seen2024-04-20 17:36:57 Times Seen7 Hash fae2e2155dbb87a736152587be0714ac e876761eae1438b9133c162d40700eca0673d87c 838533857297f0b3e56fa12b00b1ea97ccd50919100af22af7b3b3352b54a6d8 Loading...

	ebayfraud.gremlins-in-it.com/fraudulent.html	78 B	2023-03-13	2024-04-20
Pretty URL ebayfraud.gremlins-in-it.com/fraudulent.html IP 173.254.28.65 ASN #46606 UNIFIEDLAYER-AS-1 Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-13 13:52:26 Last Seen2024-04-20 17:36:57 Times Seen5 Hash e38ca555039df252e5bfd54f50698a84 72d7a5063fe3f0ad5c414114b7b4c1829815c6ef e8168b95e3e1bda7512b255a0ec98c1428fed8a961695a5f757e6c9a7f2d0279 Loading...

	ebayfraud.gremlins-in-it.com/fraudulent.html	778 B	2023-03-13	2024-04-20
Pretty URL ebayfraud.gremlins-in-it.com/fraudulent.html IP 173.254.28.65 ASN #46606 UNIFIEDLAYER-AS-1 Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-13 13:52:26 Last Seen2024-04-20 17:36:57 Times Seen5 Hash 972a3bbe48723ed4e8efe88f0dc24d08 e8b4d7b6e074a739e20cd4ae6abc288504a0c05a 05bcfcd5f1a6868826cdfeff6582f8acfd40b1d9124bbb38a138ba32c70ebe2c Loading...

	ebayfraud.gremlins-in-it.com/fraudulent.html	40 B	2023-03-07	2024-04-20
Pretty URL ebayfraud.gremlins-in-it.com/fraudulent.html IP 173.254.28.65 ASN #46606 UNIFIEDLAYER-AS-1 Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 12:58:47 Last Seen2024-04-20 17:36:57 Times Seen8 Hash 85c65d677f10f0b9269e6992fa51cd0c b0b31fb3aa41ce3aadcacae62fdaa7b87e53dc77 cfbd01c2930387ea6074017ffc640398d6a64c439c863b9dfcb8ce5ffc88ed05 Loading...

	ebayfraud.gremlins-in-it.com/fraudulent.html	4.9 kB	2023-03-13	2024-04-20
Pretty URL ebayfraud.gremlins-in-it.com/fraudulent.html IP 173.254.28.65 ASN #46606 UNIFIEDLAYER-AS-1 Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-13 13:52:26 Last Seen2024-04-20 17:36:57 Times Seen5 Hash 83809a2bea48505e049ee386466584d8 9d096c3f6e7a6e4855caf64fab8f06f723cf2b67 e7b6300e35a07c67c9e77e15d8c9ecb0ac583e253d25759707c73b3ea9282a28 Loading...

	ebayfraud.gremlins-in-it.com/fraudulent.html	100 B	2023-03-07	2024-04-20
Pretty URL ebayfraud.gremlins-in-it.com/fraudulent.html IP 173.254.28.65 ASN #46606 UNIFIEDLAYER-AS-1 Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 12:58:47 Last Seen2024-04-20 17:36:57 Times Seen9 Hash 7894afa990dd22d428e61060e7e0c349 7592d3db685fc3e844488186efc94ef7c10c8cdd ade420bcf23f21c3e59ba48ff2b70fbb75010ba533eb7e129220e7f34e9a1494 Loading...

	ebayfraud.gremlins-in-it.com/fraudulent.html	142 B	2023-03-07	2024-04-20
Pretty URL ebayfraud.gremlins-in-it.com/fraudulent.html IP 173.254.28.65 ASN #46606 UNIFIEDLAYER-AS-1 Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 12:58:47 Last Seen2024-04-20 17:36:57 Times Seen16 Hash 6dfd39a722193b0c5a7dd878456d85cb 91745bc62165a6377329b97fd0977528f2b4fe9a 016bf9ed9ddec025a4c6ec08907678098548041e9b2b10e2f0ab8100b202c20c Loading...

	ebayfraud.gremlins-in-it.com/fraudulent.html	482 B	2023-03-13	2024-04-20
Pretty URL ebayfraud.gremlins-in-it.com/fraudulent.html IP 173.254.28.65 ASN #46606 UNIFIEDLAYER-AS-1 Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-13 13:52:26 Last Seen2024-04-20 17:36:57 Times Seen5 Hash 1fd9aa29151fc88160b713a2d30dfedd 5b10b813da7141b0c9b5a6ef6a8ecc68feb556ef 02299b16cae22d8b4bfc4a2fac8bb04eef063a7f63069b69db641d0f2ea85d9d Loading...

	ebayfraud.gremlins-in-it.com/fraudulent.html	19 kB	2023-03-07	2024-04-20
Pretty URL ebayfraud.gremlins-in-it.com/fraudulent.html IP 173.254.28.65 ASN #46606 UNIFIEDLAYER-AS-1 Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 12:58:47 Last Seen2024-04-20 17:36:57 Times Seen7 Hash 2583607a99797556620375b5c8dcf864 373a4c7050998610279993f93b59197f57543c8a eba0fff5a49a24cd05c9ba14459394b3dce7af2cfac9230612f64aa99eebf4af Loading...

	ebayfraud.gremlins-in-it.com/fraudulent.html	22 kB	2023-12-16	2024-04-20
Pretty URL ebayfraud.gremlins-in-it.com/fraudulent.html IP 173.254.28.65 ASN #46606 UNIFIEDLAYER-AS-1 Introduced by scriptElement Embedded in HTML true Observations First Seen2023-12-16 17:18:09 Last Seen2024-04-20 17:36:57 Times Seen3 Hash f81d429fbe1fbc5481fb2d960675d8e5 a361991bc0f2a3bd272c0f79934939861f7a5b6a 1b58a60c2acebcaaaacc977aab8bb533d2f60b1bb0a8b152e9fe180a7fa0518a Loading...

	ebayfraud.gremlins-in-it.com/fraudulent.html	171 B	2023-03-07	2024-04-20
Pretty URL ebayfraud.gremlins-in-it.com/fraudulent.html IP 173.254.28.65 ASN #46606 UNIFIEDLAYER-AS-1 Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 12:58:47 Last Seen2024-04-20 17:36:57 Times Seen18 Hash 9a213765c4af0b3c22ca46e338de0b59 ceab3e698c762ac9c490eb1f7ef11b1ac5f77ae1 de802ab422b337556b43a956753405fcbc596c953336946245007f6456a150fe Loading...

HTTP Transactions (3)

URL IP Response Size

i376.photobucket.com/albums/oo207/divdal2/hdr_escrow_760x50.gif

143.204.55.73

200 OK

7.2 kB

URL GET HTTP/2
i376.photobucket.com/albums/oo207/divdal2/hdr_escrow_760x50.gif
IP
143.204.55.73:443
ASN
#16509 AMAZON-02

Requested by
https://ebayfraud.gremlins-in-it.com/fraudulent.html
Certificate
IssuerAmazon
Subjectphotobucket.com
Fingerprint77:D7:BB:F4:20:5A:4F:04:86:48:7C:71:75:1E:21:70:C4:15:AF:2E
ValiditySat, 08 Jul 2023 00:00:00 GMT - Mon, 05 Aug 2024 23:59:59 GMT

File type
GIF image data, version 89a, 226 x 63
Size
7.2 kB (7243 bytes)
Hash
883d6cd2a37b17cd56302dc3e35e00ff
438af5109544093c6b9e76b88cdeaea1f7afd296
a79ffda6fbae855b2f38019f8764b94d5846e04b7794469bfcc95fdd73359c67

HTTP Headers

GET /albums/oo207/divdal2/hdr_escrow_760x50.gif HTTP/1.1
Host: i376.photobucket.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: image/gif
content-length: 7243
date: Sat, 20 Apr 2024 15:36:31 GMT
cache-control: max-age=31536000, public
content-disposition: inline; filename="hdr_escrow_760x50.gif"
content-security-policy: script-src 'none'
expires: Sun, 20 Apr 2025 15:36:31 GMT
server: photobucket
x-amzn-trace-id: Root=1-6623e0ff-34bf9ab770785a715ff9bbf1
x-request-id: CFJmxNefNi-BzTqROZUeK
x-cache: Miss from cloudfront
via: 1.1 50584ad285d5f627ddebae74efdd0770.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: oBdsOxMLiSKYoFuwZ68X05whIICi0jqEPDi2P6oMgSQRPxY29XXBOA==
vary: Accept, Origin
X-Firefox-Spdy: h2

ebayfraud.gremlins-in-it.com/ico.ico

173.254.28.65

404 Not Found

315 B

URL GET HTTP/2
ebayfraud.gremlins-in-it.com/ico.ico
IP
173.254.28.65:443
ASN
#46606 UNIFIEDLAYER-AS-1

Requested by
https://ebayfraud.gremlins-in-it.com/fraudulent.html
Certificate
IssuerLet's Encrypt
Subjectwww.windsorandmaidenhead.gremlins-in-it.com
Fingerprint98:AC:CB:D3:20:BE:D5:84:84:E4:E6:F8:DD:DA:F7:85:1C:9A:F3:97
ValidityMon, 18 Mar 2024 13:58:21 GMT - Sun, 16 Jun 2024 13:58:20 GMT

File type
HTML document, ASCII text
Size
315 B (315 bytes)
Hash
a34ac19f4afae63adc5d2f7bc970c07f
a82190fc530c265aa40a045c21770d967f4767b8
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

HTTP Headers

GET /ico.ico HTTP/1.1
Host: ebayfraud.gremlins-in-it.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ebayfraud.gremlins-in-it.com/fraudulent.html
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 404 Not Found
content-length: 315
content-type: text/html; charset=iso-8859-1
date: Sat, 20 Apr 2024 15:36:32 GMT
server: Apache
X-Firefox-Spdy: h2

ebayfraud.gremlins-in-it.com/fraudulent.html

173.254.28.65

200 OK

106 kB

URL User Request GET HTTP/2
ebayfraud.gremlins-in-it.com/fraudulent.html
IP
173.254.28.65:443
ASN
#46606 UNIFIEDLAYER-AS-1

Certificate
IssuerLet's Encrypt
Subjectwww.windsorandmaidenhead.gremlins-in-it.com
Fingerprint98:AC:CB:D3:20:BE:D5:84:84:E4:E6:F8:DD:DA:F7:85:1C:9A:F3:97
ValidityMon, 18 Mar 2024 13:58:21 GMT - Sun, 16 Jun 2024 13:58:20 GMT

File type

Size
106 kB (105740 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	eBay Inc.

HTTP Headers

GET /fraudulent.html HTTP/1.1
Host: ebayfraud.gremlins-in-it.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
last-modified: Sun, 12 Dec 2010 21:47:37 GMT
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
date: Sat, 20 Apr 2024 15:36:31 GMT
server: Apache
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (13)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML