Ebay perform portscan

[Rudi De Vos]

Strange things with a script started when you logon on ebay

https://signin.ebay.co.uk

debug show

04/12/2017 14:00:43 Added firefox.exe TCP 127.0.0.1:50082 127.0.0.1:5900
04/12/2017 14:00:46 Added firefox.exe TCP 127.0.0.1:50085 127.0.0.1:5901
04/12/2017 14:00:47 Added firefox.exe TCP 127.0.0.1:50086 127.0.0.1:5902
04/12/2017 14:00:49 Added firefox.exe TCP 127.0.0.1:50088 127.0.0.1:5902
04/12/2017 14:00:52 Added firefox.exe TCP 127.0.0.1:50091 127.0.0.1:5903
04/12/2017 14:00:53 Added firefox.exe TCP 127.0.0.1:50092 127.0.0.1:3389

It seems to load
https://src.ebay-us.com/fp/check.js

and that launch a connection on the following ports
['REF:63333','VNC:5900','VNC:5901','VNC:5902','VNC:5903','RDP:3389','APC:5279','TV:5939'];

What's going on... is ebay logging how to possible access your system
In the vnc logging we see that a connection to the server is made .... from the browser.
A security check ?

[Rudi De Vos]

scanner scripts is from

The domain belongs to https://www.threatmetrix.com/ which claims to do identity tracking for anti-fraud purposes.
https://www.threatmetrix.com/threatmetr ... y-network/

more info
https://www.reddit.com/r/AskNetsec/comm ... pen_ports/

[AnotherUVNCuser]

hm, that explains it (you may safely disregard my "little-too-late" PM)