1

Using Firefox on Windows 10 every time when I visit ebay.com I get redirected to a clearly fraudulent website telling me I've won some prize and asking me to enter my personal information.

The website is also trying to convince me that it is legitimate by posing as my ISP and showing my IP address.

I try to keep my machine as maintained as possible with updates, scans and CCleaner. I researched a bit on the web and found that this problem has occurred with a lot of other people on Ebay. At this point I am 99% convinced it is an Ebay problem.

Why is this happening? (And, ideally, how to stop it?)

Short summary:

  1. Every time I visit ebay.com for the first time after running ccleaner (deleting cookies), I get redirected to scammy website.
  2. I'm using Firefox on Windows 10. It happened also on Chrome but the browser detected the fraudulent nature of the website and blocked it.
  3. This thing occurs only with ebay.com
  • 1
    Even with up to date malware protection, it's still possible for your computer to be compromised. It could also be something inside of your network intercepting and redirecting your request, such as a compromised modem/router, or a device providing DHCP information that is providing a malicious DNS server... You could try connecting to Ebay using HTTPS (note the S), and you'll likely see a warning about an invalid certificate. – Ghedipunk Aug 28 at 21:23
  • It seems like you're describing a hijacked browser or I'm wrong and someone just redirected ebay.com to a fraudulent site using MITM. – tungsten Aug 28 at 21:24
  • @Ghedipunk I always use https (I forgot to specify)... certificate is valid according to the browser... – mickkk Aug 28 at 21:26
  • @tungsten I'd like to clarify that the redirection occurs after I successfully visit and navigate ebay.com and ONLY that website. – mickkk Aug 28 at 21:28
  • 2
    @mickkk you might be compromised. – Vipul Nair Aug 28 at 21:45
2

Lots of possibilities...

  • Malicious browser extensions can do this easily. It's less likely given that it happened on multiple browsers, though.
  • Malware. Scanners/AV are a last-ditch attempt to save yourself from malware; they are unreliable, not that hard to bypass, and if you rely on them as a primary form of defense you will get compromised. With that said, it's weird for it to only affect a single site like this.
  • Network attacks such as DNS spoofing or ARP poisoning. These should be defeated by navigating directly to the https://ebay.com/ URL, though.
  • Compromised website. If there is (or recently was) a vulnerability in the site - either server-side (such as a file include) or client-side (such as stored XSS) - it could cause the behavior you're seeing. The fact that this only appears to happen with one site is evidence in favor of this, though not conclusive.
  • Compromised domain name. If the domain registration were taken over, an attacker could host their own site with any content they wanted (including a look-alike of the old site) and get a valid HTTPS certificate for it. It's unlikely that the root ebay.com domain would be vulnerable to such an attack, though.

There are other, even less likely possibilities. I can't reproduce the described behavior on my machine - https://ebay.com/ loads just fine for me - so I can't investigate any further. You could use the browser's debug tools and/or an intercepting proxy (such as Fiddler or Burp Suite) to capture the network traffic / view the code on the page, and see what's triggering the redirect (assuming it's not just the browser being compromised in some way).

1

All what @CBHacking said, is correct. But I would try to find the most probable reason.

Since it happens only one time after each clean up, I would suppose it is caused by browser, more precisely, by some add-on. I'd suggest following:

  • Back up your browser profile if you have there anything valuable: bookmarks, passwords, some site preferences, etc.
  • Uninstall the browser. Delete all directories that your browser used: program directories as well as profile directories.
  • Install browser again.
  • Try to open the web site in question.

If the problem disappeared, it is very likely that one of add-ons causes the problem. Then move your data from back up to the new profile step by step: Import bookmarks, import passwords, etc.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.