eBay is port scanning your system when you load the webpage

[harlan4096]

Have you been to eBay lately? The auction site is a popular destination to buy new and used items. It may surprise you that eBay is running a local port scan when you access the site in a browser.

I verified the port scan on ebay.com and ebay.de using built-in developer tools of several web browsers. It is likely that other eBay sites will also run the port scan.

You can verify this easily. Use a browser such as Google Chrome, Firefox, Brave, Microsoft Edge or Vivaldi. Open a new Tab page and hit the F12 button to open the Developer Tools of the web browser. Switch to the Network tab in the Developer Tools and load the eBay website in the browser's address bar.

Wait for the page to load and look for 127.0.0.1 in the name in the list of connections. These are the scans that eBay performs when you connect to the site.

You can click on the connection to look up additional information; doing so reveals the port that is scanned by eBay. The scan is run by check.js, a JavaScript that is executed on eBay when users connect to the site. It uses WebSockets to perform the lookups on the local system using the specified port, and the scans occur regardless of sign-in state.

Most of the ports are used by remote desktop applications such as VNC, Teamviewer, or Windows Remote Desktop. The eBay name is an abbreviation of the remote desktop software.

Nullsweep, the site that reported the issue first, discovered that the port scans were not run on Linux client systems.
...

Continue Reading