ebaytoken[.]io

On July 24, 2026, the domain ebaytoken.io was observed hosting a web page with the title “Login | EbyPreSale”. The page title suggests an attempt to collect credentials related to a service identified as EbyPreSale, and the domain has been classified as a crypto‑scam by existing intelligence. Technical analysis indicates that the domain resolves to the IPv4 address 31.210.23.142, which belongs to the SingNet network (AS3758) located in Singapore. The registration record shows the domain was registered through the RIPE NCC service, and only a single authoritative nameserver is listed. No TLS certificate was presented; the site was reachable only over HTTP, which is consistent with the lack of an SSL certificate in the data set. Threat‑intel aggregators have flagged the domain.

VirusTotal recorded four positive detections out of ninety‑five scanned engines, indicating that multiple security vendors consider the site malicious. The same domain appears on at least one public blocklist and has been added to the PhishDestroy blocklist. AlienVault OTX lists the domain in one pulse, providing additional corroboration of its malicious reputation. Independent reputation services assign extremely low trust scores: Gridinsoft rates it 0 out of 100, and Scamadviser records a score of 1 out of 100. These scores reflect the consensus that the domain is untrustworthy. The current operational state is offline; the site is no longer reachable, which limits real‑time verification of the content.

Because the page source has not been captured, the exact tactics used (e.g., form fields, redirects) remain unknown. Defenders should continue to block any DNS resolution to 31.210.23.142 and add ebaytoken.io to URL filtering rules. Incident response teams should query historical web archives for cached copies of the login page to extract potential indicators such as form parameters or malicious payloads.