eBay port scans visitors' computers for remote access programs

When visiting the eBay.com site, a script will run that performs a local port scan of your computer to detect remote support and remote access applications.

Many of these ports are related to remote access/remote support tools such as the Windows Remote Desktop, VNC, TeamViewer, Ammy Admin, and more.

After learning about this, BleepingComputer conducted a test and can confirm that eBay.com is indeed performing a local port scan of 14 different ports when visiting the site.

This scan is being conducted by a check.js script [ archived ] on eBay.com that attempts to connect to the following ports:

The fourteen different ports that are scanned and their associated programs and eBay reference string is listed below.

BleepingComputer has not been able to identify the targeted program on port 63333. If you recognize it, please let us know.

The script performs these scans using WebSockets to connect to 127.0.0.1, which is the local computer, on the specified port.

According to Nullsweep, who first reported on the port scans, they do not occur when browsing the site with Linux.

Once they tested in Windows, though, the port scans occurred.

This makes sense as the programs being scanned for are all Windows remote access tools.

Likely done to detect hacked computers

As the port scan is only looking for remote access programs, it is most likely being done to check for compromised computers used to make fraudulent eBay purchases.

In 2016, reports were flooding in that people's computers were being taken over through TeamViewer and used to make fraudulent purchases on eBay.

As many eBay users use cookies to automatically login to the site, the attackers were able to remote control the computer and access eBay to make purchases.

It got so bad that one person created a spreadsheet to keep track of all the reported attacks. As you can see, many of them reference eBay.

These port scans are still intrusive and not something that many users would want to happen when visiting a site.

BleepingComputer has contacted eBay about this port scan but has not heard back at this time.

Update 5/25/20: Updated article with correct attribution.