When you visit the eBay.com website, a script will run that performs a local port scan of your computer to detect remote support and remote access applications.
Many of these ports are related to remote access/remote support tools, such as Windows Remote Desktop, VNC, TeamViewer, Ammyy Manager, and others.
BleepingComputer performed a test and can confirm that eBay.com does indeed perform local port scanning of 14 different ports when visiting the site.
This scan is performed by a check.js script on eBay.com that attempts to connect to the following ports:
Listed below are the fourteen different ports scanned and the associated programs and eBay's reference string.
The script performs these scans using WebSockets to connect to 127.0.0.1, which is the local computer, on the specified port.
According to Nullsweep, who first reported on port scanning, they do not occur when browsing the site with Linux.
Once they tried Windows, however, a port scan was performed.
This makes sense as the programs being scanned are all Windows remote access tools
It was probably done to detect compromised computers
Since port scanning only looks for remote access programs, it is likely done to check for compromised computers used to make fraudulent eBay purchases.
In 2016, reports indicated that people's computers were being taken over via TeamViewer and used to make fraudulent purchases on eBay.
As many eBay users use cookies to automatically log in to the site, attackers were able to remotely control the computer and access eBay to make purchases.
It got so bad that one person created a spreadsheet to track all the reported attacks. As you can see, many of them are reported on eBay.
These port scans are still annoying and not something users like to see happen when they visit a website.
