Security Scan Report: ehay.item.scpconst.com

Submitted: Completed: publiccompleted
This website contacted 64 IPs in 7 countries across 27 domains to perform 155 HTTP transactions. The main domain is scpconst.com and was registered 10 years ago.

Submitted URL: https://ehay.item.scpconst.com/

AI Security Verdict

Confirmed Scam

Confidence: 97%

10
Risk Score

Typosquatted 'ehay' subdomain cloning eBay's sign-in page and posting credentials to passnew.php — a credential-phishing kit impersonating eBay.

Risk Factors (5)
Brand impersonation of a different entity (eBay) on a non-official domain
Typosquatted subdomain label 'ehay'
Credential capture form posting to a third-party script passnew.php
Domain unranked in Cisco Umbrella despite claiming to be a major brand
Obfuscated non-standard hidden field names in the login form
Domain age information unavailable

Details

Page Title

Loading ....

Scan Type

public

Domain Name Analysis

Within the commercial generic top-level domain (.com), 'ehay.item.scpconst.com' is registered and includes subdomain 'ehay.item'. The second-level label 'scpconst' is 8 characters long split between one vowel and seven consonants. Word splitting yields 3 words: s, cp, const. Expect two characters per word on average. No strong language cues emerged from the frequency lists.

Screenshot

Sign in to your account. New to eBay? Create account Email or username ) or (G Continue with Google ) (@ Continue with Facebook ) (« Continue with Apple ) Stay signed in © Copyright © 1995-2026...

Page Load Overview

7.16s
Total Load Time
1.9 MB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:806 chars
Detector Agreement:100%

Website Classification

Primary Category

social media network67% confidence
Type: spa
Method: ml+structural+ocr_tiebreaker

All Detected Categories

social media network
67%
e-commerce shopping
64%
technology software
61%
social_media
25%

Detected Features

Login Form
Search

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
29188.40.147.141Falkenstein, Saxony, Germany
AS24940Hetzner Online GmbH
223.200.24.88Akamai · CDNBerlin, State of Berlin, Germany
AS20940Akamai International B.V.
223.36.162.219Akamai · CDNFrankfurt am Main, Hesse, Germany
AS20940Akamai International B.V.
22.21.110.197Akamai · CDNHamburg, Free and Hanseatic City of Hamburg, Germany
AS20940Akamai International B.V.
223.200.24.87Akamai · CDNBerlin, State of Berlin, Germany
AS20940Akamai International B.V.
223.36.162.205Akamai · CDNFrankfurt am Main, Hesse, Germany
AS20940Akamai International B.V.
2178.250.1.8France
AS44788Criteo Technology SAS
2142.251.14.97Google · CDNUnited States
AS15169Google LLC
2157.240.0.6Facebook · CDNFrankfurt am Main, Hesse, Germany
AS32934Facebook, Inc.
23.163.248.4Cloudfront · CDNUnited States
AS16509Amazon.com, Inc.
15564--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1F4235C529134557AE12F8BC8E2E6B3591027339FFFA14EE472AC4BB02752C9E4C474E9

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

768:U2gWo8mqsVPU1WVyXBeeeebDRA2Rr7a7vFA+XRAB:CW/tWVyXBeeeehzyXK

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:45665:R1C+LcQCEIAUXkMADFFp/oJZFgEIFI8RwNAHIYSMFNIBDBECoZiw1HoFCeAQTgaQ4kjAEpIQA41gfEsJZSSAKbmEABiiUuwF

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:7fe7e7e7e7ffffe7
Perceptual Hash:b3228c8899dc7677
Difference Hash:888c4d0c0c08000e
Wavelet Hash:70e1e4e4273f3f02
Color Hash:N/A

Other Hashes

Crop Resistant:888c4d0c0c08000e

Scan History

Scan history not available

Unable to load historical scan data