gatavalen.cc Open in urlscan Pro
179.61.132.222 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://is.gd/iurYCy,/wpP/
Effective URL:
https://gatavalen.cc/payouts/
Submission: On August 18 via api (August 18th 2025, 11:12:24 am UTC) from US — Scanned from PT

Summary HTTP 15 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 3 countries across 5 domains to perform 15 HTTP transactions. The main IP is 179.61.132.222, located in Frankfurt am Main, Germany and belongs to FREAKHOSTING ALEXANDRU VLAD trading as FREAKHOSTING, GB. The main domain is gatavalen.cc.
TLS certificate: Issued by R11 on July 4th 2025. Valid for: 3 months.

This is the only time gatavalen.cc was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Crypto (Crypto Exchange)

Domain & IP information

	IP Address	AS Autonomous System
1 1	104.25.234.53 104.25.234.53	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	104.21.64.1 104.21.64.1	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	94.156.181.79 94.156.181.79	207957 (ServHost-...) (ServHost-AS SERV.HOST GROUP LTD)
1 14	179.61.132.222 179.61.132.222	215703 (FREAKHOST...) (FREAKHOSTING ALEXANDRU VLAD trading as FREAKHOSTING)
15	2

1 104.25.234.53 (Ascension Island) 1 redirects

ASN13335 (CLOUDFLARENET, US)

is.gd	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.21.64.1 (Ascension Island) 1 redirects

ASN13335 (CLOUDFLARENET, US)

571.com.ua	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 94.156.181.79 (Bulgaria) 1 redirects

ASN207957 (ServHost-AS SERV.HOST GROUP LTD, GB)

getprox.cc	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 179.61.132.222 (Frankfurt am Main, Germany) 1 redirects

ASN215703 (FREAKHOSTING ALEXANDRU VLAD trading as FREAKHOSTING, GB)

gatavalen.cc	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
14	gatavalen.cc 1 redirects gatavalen.cc	1 MB
1	getprox.cc 1 redirects getprox.cc	877 B
1	571.com.ua 1 redirects 571.com.ua	731 B
1	is.gd 1 redirects is.gd — Cisco Umbrella Rank: 164207	419 B
0	coingecko.com Failed api.coingecko.com Failed
15	5

	Domain	Requested by
14	gatavalen.cc	1 redirects gatavalen.cc
1	getprox.cc	1 redirects
1	571.com.ua	1 redirects
1	is.gd	1 redirects
0	api.coingecko.com Failed	gatavalen.cc
15	5

This site contains no links.

Subject Issuer	Validity	Valid
gatavalen.cc R11	`2025-07-04` - `2025-10-02`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://gatavalen.cc/payouts/
Frame ID: 703DEF19B48857828B95423B404EB1ED
Requests: 15 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Bitcoin Mining

Page URL History Show full URLs

https://is.gd/iurYCy,/wpP/ HTTP 301
https://571.com.ua/go.php?landoncarolan=939216&y=vpcy&url=https%3A%2F%2Fgetprox.cc%2Fgo%2F13b4y... HTTP 302
https://getprox.cc/go/13b4y2/y2?label=1 HTTP 302
https://gatavalen.cc/payouts/?b=YTo0OntzOjU6ImxhYmVsIjtzOjE6IjEiO3M6MzoidXNyIjtpOjQ1NDtzOjQ6Im5vc... HTTP 302
http://gatavalen.cc/payouts/ HTTP 307
https://gatavalen.cc/payouts/ Page URL

Detected technologies

Nuxt.js (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

<div [^>]*id="__nuxt"
/_nuxt/

Vue.js (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

<[^>]+\sdata-v(?:ue)?-

Page Statistics

15
Requests

87 %
HTTPS

0 %
IPv6

5
Domains

5
Subdomains

2
IPs

3
Countries

1359 kB
Transfer

3798 kB
Size

4
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://is.gd/iurYCy,/wpP/ HTTP 301
https://571.com.ua/go.php?landoncarolan=939216&y=vpcy&url=https%3A%2F%2Fgetprox.cc%2Fgo%2F13b4y2%2Fy2%3Flabel%3D1 HTTP 302
https://getprox.cc/go/13b4y2/y2?label=1 HTTP 302
https://gatavalen.cc/payouts/?b=YTo0OntzOjU6ImxhYmVsIjtzOjE6IjEiO3M6MzoidXNyIjtpOjQ1NDtzOjQ6Im5vcGQiO3M6MTA6ImdldHByb3guY2MiO3M6MToibyI7aToxO30= HTTP 302
http://gatavalen.cc/payouts/ HTTP 307
https://gatavalen.cc/payouts/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

15 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response gatavalen.cc/payouts/ Redirect Chain https://is.gd/iurYCy,/wpP/ https://571.com.ua/go.php?landoncarolan=939216&y=vpcy&url=https%3A%2F%2Fgetprox.cc%2Fgo%2F13b4y2%2Fy2%3Flabel%3D1 https://getprox.cc/go/13b4y2/y2?label=1 https://gatavalen.cc/payouts/?b=YTo0OntzOjU6ImxhYmVsIjtzOjE6IjEiO3M6MzoidXNyIjtpOjQ1NDtzOjQ6Im5vcGQiO3M6MTA6ImdldHByb3guY2MiO3M6MToibyI7aToxO30= http://gatavalen.cc/payouts/ https://gatavalen.cc/payouts/	2 KB 1000 B	89ms 88ms	Document text/html	179.61.132.222 FREAKHOSTING ALEX...
General Check archive.org Download Go to Full URL https://gatavalen.cc/payouts/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 179.61.132.222 Frankfurt am Main, Germany, ASN215703 (FREAKHOSTING ALEXANDRU VLAD trading as FREAKHOSTING, GB), Reverse DNS Software nginx / Resource Hash `59f7ca566cd1c2e18207e31929308863fa0414fa7371ea9eb2d7cf9fc7ddfdd6` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36 Response headers Connection keep-alive Content-Encoding gzip Content-Type text/html; charset=UTF-8 Date Mon, 18 Aug 2025 11:12:26 GMT Server nginx Transfer-Encoding chunked Vary Accept-Encoding Redirect headers Location https://gatavalen.cc/payouts/ Non-Authoritative-Reason HttpsUpgrades
GET H/1.1	200 OK	entry.4e713294.js Show response gatavalen.cc/_nuxt/	3 MB 1 MB	125ms 124ms	Script application/javascript	179.61.132.222 FREAKHOSTING ALEX...
General Check archive.org Download Go to Full URL https://gatavalen.cc/_nuxt/entry.4e713294.js Requested by Host: gatavalen.cc URL: https://gatavalen.cc/payouts/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 179.61.132.222 Frankfurt am Main, Germany, ASN215703 (FREAKHOSTING ALEXANDRU VLAD trading as FREAKHOSTING, GB), Reverse DNS Software nginx / Resource Hash `9e4ecd396853bafc315b2e4786e019627eda81c0ec36ecd0734456f86bb53cc1` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36 Origin https://gatavalen.cc Referer https://gatavalen.cc/payouts/ Response headers Transfer-Encoding chunked Cache-Control max-age=86400 Content-Encoding gzip ETag W/"689485af-36d838" Connection keep-alive Expires Tue, 19 Aug 2025 11:12:26 GMT Date Mon, 18 Aug 2025 11:12:26 GMT Content-Type application/javascript; charset=UTF-8 Last-Modified Thu, 07 Aug 2025 10:53:35 GMT Server nginx
GET H/1.1	200 OK	entry.816a5a0f.css gatavalen.cc/_nuxt/	49 KB 9 KB	242ms 82ms	Stylesheet text/css	179.61.132.222 FREAKHOSTING ALEX...
General Check archive.org Download Go to Full URL https://gatavalen.cc/_nuxt/entry.816a5a0f.css Requested by Host: gatavalen.cc URL: https://gatavalen.cc/payouts/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 179.61.132.222 Frankfurt am Main, Germany, ASN215703 (FREAKHOSTING ALEXANDRU VLAD trading as FREAKHOSTING, GB), Reverse DNS Software nginx / Resource Hash `816a5a0f5b2b5e79d25af268686381bfd7f2d7db7e04c59adc55731d13b67812` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36 Referer https://gatavalen.cc/payouts/ Response headers Transfer-Encoding chunked Cache-Control max-age=86400 Content-Encoding gzip ETag W/"685e267a-c34d" Connection keep-alive Expires Tue, 19 Aug 2025 11:12:27 GMT Date Mon, 18 Aug 2025 11:12:27 GMT Content-Type text/css Last-Modified Fri, 27 Jun 2025 05:04:58 GMT Server nginx
GET H/1.1	200 OK	url.0b90d914.js gatavalen.cc/_nuxt/	0 596 B	241ms 80ms	Other application/javascript	179.61.132.222 FREAKHOSTING ALEX...
General Check archive.org Download Go to Full URL https://gatavalen.cc/_nuxt/url.0b90d914.js Requested by Host: gatavalen.cc URL: https://gatavalen.cc/payouts/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 179.61.132.222 Frankfurt am Main, Germany, ASN215703 (FREAKHOSTING ALEXANDRU VLAD trading as FREAKHOSTING, GB), Reverse DNS Software nginx / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Origin https://gatavalen.cc Referer https://gatavalen.cc/payouts/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36 Sec-Purpose prefetch Response headers Transfer-Encoding chunked Cache-Control max-age=86400 Content-Encoding gzip ETag W/"685e267a-16e" Connection keep-alive Expires Tue, 19 Aug 2025 11:12:27 GMT Date Mon, 18 Aug 2025 11:12:27 GMT Content-Type application/javascript; charset=UTF-8 Last-Modified Fri, 27 Jun 2025 05:04:58 GMT Server nginx
GET H/1.1	200 OK	error-component.e8645654.js gatavalen.cc/_nuxt/	0 983 B	244ms 82ms	Other application/javascript	179.61.132.222 FREAKHOSTING ALEX...
General Check archive.org Download Go to Full URL https://gatavalen.cc/_nuxt/error-component.e8645654.js Requested by Host: gatavalen.cc URL: https://gatavalen.cc/payouts/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 179.61.132.222 Frankfurt am Main, Germany, ASN215703 (FREAKHOSTING ALEXANDRU VLAD trading as FREAKHOSTING, GB), Reverse DNS Software nginx / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Origin https://gatavalen.cc Referer https://gatavalen.cc/payouts/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36 Sec-Purpose prefetch Response headers Transfer-Encoding chunked Cache-Control max-age=86400 Content-Encoding gzip ETag W/"685e267a-49e" Connection keep-alive Expires Tue, 19 Aug 2025 11:12:27 GMT Date Mon, 18 Aug 2025 11:12:27 GMT Content-Type application/javascript; charset=UTF-8 Last-Modified Fri, 27 Jun 2025 05:04:58 GMT Server nginx
GET H/1.1	200 OK	index.b71f6f30.js Show response gatavalen.cc/_nuxt/	29 KB 11 KB	104ms 103ms	Script application/javascript	179.61.132.222 FREAKHOSTING ALEX...
General Check archive.org Download Go to Full URL https://gatavalen.cc/_nuxt/index.b71f6f30.js Requested by Host: gatavalen.cc URL: https://gatavalen.cc/_nuxt/entry.4e713294.js Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 179.61.132.222 Frankfurt am Main, Germany, ASN215703 (FREAKHOSTING ALEXANDRU VLAD trading as FREAKHOSTING, GB), Reverse DNS Software nginx / Resource Hash `134b62d8677d19e752b03e19f80ea2bd0c4eea35badc7244139813cdf1379427` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36 Origin https://gatavalen.cc Referer Response headers Transfer-Encoding chunked Cache-Control max-age=86400 Content-Encoding gzip ETag W/"685e267a-73bb" Connection keep-alive Expires Tue, 19 Aug 2025 11:12:27 GMT Date Mon, 18 Aug 2025 11:12:27 GMT Content-Type application/javascript; charset=UTF-8 Last-Modified Fri, 27 Jun 2025 05:04:58 GMT Server nginx
GET H/1.1	200 OK	OnlineUsers.13b0b975.js Show response gatavalen.cc/_nuxt/	638 B 755 B	83ms 83ms	Script application/javascript	179.61.132.222 FREAKHOSTING ALEX...
General Check archive.org Download Go to Full URL https://gatavalen.cc/_nuxt/OnlineUsers.13b0b975.js Requested by Host: gatavalen.cc URL: https://gatavalen.cc/_nuxt/entry.4e713294.js Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 179.61.132.222 Frankfurt am Main, Germany, ASN215703 (FREAKHOSTING ALEXANDRU VLAD trading as FREAKHOSTING, GB), Reverse DNS Software nginx / Resource Hash `1a21637c07b53055a9627efbe546551eada3aca036aa7b825204ae296e4aa9bb` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36 Origin https://gatavalen.cc Referer Response headers Transfer-Encoding chunked Cache-Control max-age=86400 Content-Encoding gzip ETag W/"685e267a-27e" Connection keep-alive Expires Tue, 19 Aug 2025 11:12:27 GMT Date Mon, 18 Aug 2025 11:12:27 GMT Content-Type application/javascript; charset=UTF-8 Last-Modified Fri, 27 Jun 2025 05:04:58 GMT Server nginx
GET H/1.1	200 OK	visit.4c68a206.js Show response gatavalen.cc/_nuxt/	421 B 593 B	80ms 80ms	Script application/javascript	179.61.132.222 FREAKHOSTING ALEX...
General Check archive.org Download Go to Full URL https://gatavalen.cc/_nuxt/visit.4c68a206.js Requested by Host: gatavalen.cc URL: https://gatavalen.cc/_nuxt/entry.4e713294.js Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 179.61.132.222 Frankfurt am Main, Germany, ASN215703 (FREAKHOSTING ALEXANDRU VLAD trading as FREAKHOSTING, GB), Reverse DNS Software nginx / Resource Hash `aa520d0866b7b49b642e4c85b6915e695a087f963e120cba2e91041de4a54010` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36 Origin https://gatavalen.cc Referer Response headers Transfer-Encoding chunked Cache-Control max-age=86400 Content-Encoding gzip ETag W/"685e267a-1a5" Connection keep-alive Expires Tue, 19 Aug 2025 11:12:27 GMT Date Mon, 18 Aug 2025 11:12:27 GMT Content-Type application/javascript; charset=UTF-8 Last-Modified Fri, 27 Jun 2025 05:04:58 GMT Server nginx
GET H/1.1	200 OK	client-only.11dfce23.js Show response gatavalen.cc/_nuxt/	468 B 659 B	81ms 81ms	Script application/javascript	179.61.132.222 FREAKHOSTING ALEX...
General Check archive.org Download Go to Full URL https://gatavalen.cc/_nuxt/client-only.11dfce23.js Requested by Host: gatavalen.cc URL: https://gatavalen.cc/_nuxt/entry.4e713294.js Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 179.61.132.222 Frankfurt am Main, Germany, ASN215703 (FREAKHOSTING ALEXANDRU VLAD trading as FREAKHOSTING, GB), Reverse DNS Software nginx / Resource Hash `8b9669ebd8a376e53af6be534e039dc797ac566c71b960f45f3f61726f568129` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36 Origin https://gatavalen.cc Referer Response headers Transfer-Encoding chunked Cache-Control max-age=86400 Content-Encoding gzip ETag W/"685e267a-1d4" Connection keep-alive Expires Tue, 19 Aug 2025 11:12:27 GMT Date Mon, 18 Aug 2025 11:12:27 GMT Content-Type application/javascript; charset=UTF-8 Last-Modified Fri, 27 Jun 2025 05:04:58 GMT Server nginx
GET H/1.1	200 OK	favicon.png gatavalen.cc/	1 KB 1 KB	103ms 81ms	Other image/png	179.61.132.222 FREAKHOSTING ALEX...
General Check archive.org Download Go to Full URL https://gatavalen.cc/favicon.png Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 179.61.132.222 Frankfurt am Main, Germany, ASN215703 (FREAKHOSTING ALEXANDRU VLAD trading as FREAKHOSTING, GB), Reverse DNS Software nginx / Resource Hash `f1cacb91db22e156f7f11cf755ab73bcaf30c058efe51b398cb425482113f411` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36 Referer https://gatavalen.cc/payouts/ Response headers Cache-Control max-age=86400 ETag "685e267a-491" Connection keep-alive Expires Tue, 19 Aug 2025 11:12:27 GMT Accept-Ranges bytes Content-Length 1169 Date Mon, 18 Aug 2025 11:12:27 GMT Content-Type image/png Last-Modified Fri, 27 Jun 2025 05:04:58 GMT Server nginx
GET H/1.1	200 OK	bonus.png gatavalen.cc/payouts/img/	175 KB 175 KB	82ms 82ms	Image image/png	179.61.132.222 FREAKHOSTING ALEX...
General Check archive.org Download Go to Show image Full URL https://gatavalen.cc/payouts/img/bonus.png Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 179.61.132.222 Frankfurt am Main, Germany, ASN215703 (FREAKHOSTING ALEXANDRU VLAD trading as FREAKHOSTING, GB), Reverse DNS Software nginx / Resource Hash `9b63e525a10bf17284925abba402aa3fd935d24a063f1fd332a95dc925d76968` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36 Referer https://gatavalen.cc/payouts/ Response headers Cache-Control max-age=86400 ETag "685e267a-2bc87" Connection keep-alive Expires Tue, 19 Aug 2025 11:12:27 GMT Accept-Ranges bytes Content-Length 179335 Date Mon, 18 Aug 2025 11:12:27 GMT Content-Type image/png Last-Modified Fri, 27 Jun 2025 05:04:58 GMT Server nginx
GET		price api.coingecko.com/api/v3/simple/	0 0

GET H/1.1	200 OK	bitcoin.png gatavalen.cc/payouts/img/	25 KB 25 KB	121ms 121ms	Image image/png	179.61.132.222 FREAKHOSTING ALEX...
General Check archive.org Download Go to Show image Full URL https://gatavalen.cc/payouts/img/bitcoin.png Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 179.61.132.222 Frankfurt am Main, Germany, ASN215703 (FREAKHOSTING ALEXANDRU VLAD trading as FREAKHOSTING, GB), Reverse DNS Software nginx / Resource Hash `d77369aa7567af2889718639538e0140ce999433bca0a41a6ea291a985490f97` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36 Referer https://gatavalen.cc/payouts/ Response headers Cache-Control max-age=86400 ETag "685e267a-635d" Connection keep-alive Expires Tue, 19 Aug 2025 11:12:27 GMT Accept-Ranges bytes Content-Length 25437 Date Mon, 18 Aug 2025 11:12:27 GMT Content-Type image/png Last-Modified Fri, 27 Jun 2025 05:04:58 GMT Server nginx
GET H/1.1	200 OK	circuit.svg gatavalen.cc/img/bg/	5 KB 2 KB	80ms 80ms	Image image/svg+xml	179.61.132.222 FREAKHOSTING ALEX...
General Check archive.org Download Go to Show image Full URL https://gatavalen.cc/img/bg/circuit.svg Requested by Host: gatavalen.cc URL: https://gatavalen.cc/_nuxt/entry.816a5a0f.css Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 179.61.132.222 Frankfurt am Main, Germany, ASN215703 (FREAKHOSTING ALEXANDRU VLAD trading as FREAKHOSTING, GB), Reverse DNS Software nginx / Resource Hash `759172998df26a3de2a6c715de7bea7e1ade68a5596833e8dc1425c1a504cce0` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36 Referer https://gatavalen.cc/_nuxt/entry.816a5a0f.css Response headers Transfer-Encoding chunked Cache-Control max-age=86400 Content-Encoding gzip ETag W/"685e267a-1499" Connection keep-alive Expires Tue, 19 Aug 2025 11:12:27 GMT Date Mon, 18 Aug 2025 11:12:27 GMT Content-Type image/svg+xml Last-Modified Fri, 27 Jun 2025 05:04:58 GMT Server nginx
GET		price api.coingecko.com/api/v3/simple/	0 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: api.coingecko.com
URL: https://api.coingecko.com/api/v3/simple/price?ids=bitcoin%2Cethereum%2Ccardano%2Cbitcoin-cash%2Clitecoin%2Cdogecoin%2Cripple%2Cmatic-network%2Cpolkadot%2Cbinancecoin%2Ctether%2Csolana&vs_currencies=usd&include_24hr_change=true&precision=2&1755515547520

Domain: api.coingecko.com
URL: https://api.coingecko.com/api/v3/simple/price?ids=bitcoin%2Cethereum%2Ccardano%2Cbitcoin-cash%2Clitecoin%2Cdogecoin%2Cripple%2Cmatic-network%2Cpolkadot%2Cbinancecoin%2Ctether%2Csolana&vs_currencies=usd&include_24hr_change=true&precision=2&1755515547520

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Crypto (Crypto Exchange)

8 JavaScript Window variables

These are the non-standard variables defined on the window object. These include var declarations and global functions and can be helpful in identifying possible client-side frameworks and code.

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.is.gd/	1970-01-21 07:38:37	Name: __cf_bm Value: BDI13OLwV.FqHV56etbPmX6JBVSGRoCR02odTWQTVdI-1755515545-1.0.1.1-g7Ewy_5E3VccH7arkFSAxrbAWMtH2zN2jFMAvXUPUj6X1FRsxl1lD_u0qS6F3TugDZv1ZcjZnBK.zSqy5nwYvc..MvKICPK6vYX25t2ALcY
.getprox.cc/	1970-01-21 17:14:35	Name: PHPSESSID Value: edfc324d685ba3d6130e8868a8d23928
.getprox.cc/	1970-01-21 08:23:13	Name: ofr_1 Value: a%3A4%3A%7Bs%3A5%3A%22label%22%3Bs%3A1%3A%221%22%3Bs%3A3%3A%22usr%22%3Bi%3A454%3Bs%3A4%3A%22nopd%22%3Bs%3A10%3A%22getprox.cc%22%3Bs%3A1%3A%22o%22%3Bi%3A1%3B%7D
.gatavalen.cc/	1970-01-21 08:23:13	Name: ofr Value: a%3A4%3A%7Bs%3A5%3A%22label%22%3Bs%3A1%3A%221%22%3Bs%3A3%3A%22usr%22%3Bi%3A454%3Bs%3A4%3A%22nopd%22%3Bs%3A10%3A%22getprox.cc%22%3Bs%3A1%3A%22o%22%3Bi%3A1%3B%7D

5 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	verbose	URL: https://gatavalen.cc/payouts/ Message: [DOM] Password field is not contained in a form: (More info: https://goo.gl/9p2vKq)
javascript	error	URL: https://gatavalen.cc/payouts/ Message: Access to fetch at 'https://api.coingecko.com/api/v3/simple/price?ids=bitcoin%2Cethereum%2Ccardano%2Cbitcoin-cash%2Clitecoin%2Cdogecoin%2Cripple%2Cmatic-network%2Cpolkadot%2Cbinancecoin%2Ctether%2Csolana&vs_currencies=usd&include_24hr_change=true&precision=2&1755515547520' from origin 'https://gatavalen.cc' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://api.coingecko.com/api/v3/simple/price?ids=bitcoin%2Cethereum%2Ccardano%2Cbitcoin-cash%2Clitecoin%2Cdogecoin%2Cripple%2Cmatic-network%2Cpolkadot%2Cbinancecoin%2Ctether%2Csolana&vs_currencies=usd&include_24hr_change=true&precision=2&1755515547520 Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://gatavalen.cc/payouts/ Message: Access to fetch at 'https://api.coingecko.com/api/v3/simple/price?ids=bitcoin%2Cethereum%2Ccardano%2Cbitcoin-cash%2Clitecoin%2Cdogecoin%2Cripple%2Cmatic-network%2Cpolkadot%2Cbinancecoin%2Ctether%2Csolana&vs_currencies=usd&include_24hr_change=true&precision=2&1755515547520' from origin 'https://gatavalen.cc' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://api.coingecko.com/api/v3/simple/price?ids=bitcoin%2Cethereum%2Ccardano%2Cbitcoin-cash%2Clitecoin%2Cdogecoin%2Cripple%2Cmatic-network%2Cpolkadot%2Cbinancecoin%2Ctether%2Csolana&vs_currencies=usd&include_24hr_change=true&precision=2&1755515547520 Message: Failed to load resource: net::ERR_FAILED

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

571.com.ua
api.coingecko.com
gatavalen.cc
getprox.cc
is.gd
api.coingecko.com
104.21.64.1
104.25.234.53
179.61.132.222
94.156.181.79
134b62d8677d19e752b03e19f80ea2bd0c4eea35badc7244139813cdf1379427
1a21637c07b53055a9627efbe546551eada3aca036aa7b825204ae296e4aa9bb
59f7ca566cd1c2e18207e31929308863fa0414fa7371ea9eb2d7cf9fc7ddfdd6
759172998df26a3de2a6c715de7bea7e1ade68a5596833e8dc1425c1a504cce0
816a5a0f5b2b5e79d25af268686381bfd7f2d7db7e04c59adc55731d13b67812
8b9669ebd8a376e53af6be534e039dc797ac566c71b960f45f3f61726f568129
9b63e525a10bf17284925abba402aa3fd935d24a063f1fd332a95dc925d76968
9e4ecd396853bafc315b2e4786e019627eda81c0ec36ecd0734456f86bb53cc1
aa520d0866b7b49b642e4c85b6915e695a087f963e120cba2e91041de4a54010
d77369aa7567af2889718639538e0140ce999433bca0a41a6ea291a985490f97
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f1cacb91db22e156f7f11cf755ab73bcaf30c058efe51b398cb425482113f411

gatavalen.cc Open in urlscan Pro 179.61.132.222 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

15 Requests

87 %HTTPS

0 %IPv6

5 Domains

5 Subdomains

2 IPs

3 Countries

1359 kBTransfer

3798 kBSize

4 Cookies

0 Outgoing links

Page URL History

Redirected requests

15 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

8 JavaScript Window variables

4 Cookies

5 Console Messages

Indicators

gatavalen.cc Open in urlscan Pro
179.61.132.222 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

15
Requests

87 %
HTTPS

0 %
IPv6

5
Domains

5
Subdomains

2
IPs

3
Countries

1359 kB
Transfer

3798 kB
Size

4
Cookies

15 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!