I’d been browsing eBay a few days back, checking out a few items I was considering buying. I left my eBay tab open though I was not logged in. Yesterday morning, I figured I would log into my eBay account and save the item I was viewing to my “wish list.” So, I clicked on the login link and was surprised to see the eBay signin page show up … in Russian!

I cannot for the life of me figure out how this happened. My browser language is not set to Russian, my eBay preferences are not set to Russian, and I did not somehow enter a Russian URL. There was no reported BGP hijack on eBay, nor would eBay necessarily reflect it if there was – the IP would not have changed from the eBay webserver’s point of view. Yet somehow it served me up a Russian page.

So, what could have happened here? Either something big happened to eBay, or something happened on my end. I did a quick nslookup to make sure I was hitting the proper site:

Non-authoritative answer:
signin.ebay.com canonical name = origin-signin.g.ebay.com.
Name: origin-signin.g.ebay.com
Address: 66.211.185.34
Name: origin-signin.g.ebay.com
Address: 66.211.181.81
Name: origin-signin.g.ebay.com
Address: 66.211.181.96
Name: origin-signin.g.ebay.com
Address: 66.211.185.47

Looks good. I checked the SSL certificate I was receiving and it checked out:

What I think happened is that my connection to eBay was rerouted temporarily through Russia, possibly through malware. Time to do some spring cleaning on my network, methinks.