Ebay perform portscan

Test the syntax here, shout, do whatever (discuss about the forum if you want ...) but please behave ;) ... and spam is not welcome

Ebay perform portscan

Postby Rudi De Vos » 2017-12-04 20:09

Strange things with a script started when you logon on ebay

https://signin.ebay.co.uk

debug show

04/12/2017 14:00:43 Added firefox.exe TCP 127.0.0.1:50082 127.0.0.1:5900
04/12/2017 14:00:46 Added firefox.exe TCP 127.0.0.1:50085 127.0.0.1:5901
04/12/2017 14:00:47 Added firefox.exe TCP 127.0.0.1:50086 127.0.0.1:5902
04/12/2017 14:00:49 Added firefox.exe TCP 127.0.0.1:50088 127.0.0.1:5902
04/12/2017 14:00:52 Added firefox.exe TCP 127.0.0.1:50091 127.0.0.1:5903
04/12/2017 14:00:53 Added firefox.exe TCP 127.0.0.1:50092 127.0.0.1:3389

It seems to load
https://src.ebay-us.com/fp/check.js

and that launch a connection on the following ports
['REF:63333','VNC:5900','VNC:5901','VNC:5902','VNC:5903','RDP:3389','APC:5279','TV:5939'];

What's going on... is ebay logging how to possible access your system
In the vnc logging we see that a connection to the server is made .... from the browser.
A security check ?
Rudi De Vos
Admin & Developer
Admin & Developer
 
Posts: 5485
Joined: 2004-04-23 10:21

Re: Ebay perform portscan

Postby Rudi De Vos » 2017-12-06 14:00

scanner scripts is from

The domain belongs to https://www.threatmetrix.com/ which claims to do identity tracking for anti-fraud purposes.
https://www.threatmetrix.com/threatmetr ... y-network/

more info
https://www.reddit.com/r/AskNetsec/comm ... pen_ports/
Rudi De Vos
Admin & Developer
Admin & Developer
 
Posts: 5485
Joined: 2004-04-23 10:21


Return to Off topic posts (Sandbox)

Who is online

Users browsing this forum: No registered users and 1 guest