97ee3.catex.at
31.59.121.53  Malicious Activity! Public Scan Open in urlscan Pro

Internal
urlscan.io (IP) urlscan.io (Domain)
Effective Hostname
VirusTotal SecurityTrails crt.sh
Submitted URL
Google Safe Browsing Archive.org
Effective URL Pivot
Google Safe Browsing Archive.org
Effective IP
VirusTotal SecurityTrails Domaintools Censys
Go To Rescan
Add Verdict Report
Submitted URL:
http://97ee6.blogspot.md/ 1mo old
Effective URL:
https://97ee3.catex.at/cnbcard/ 4mo old
Submission: On July 21 via api (July 21st 2026, 9:57:56 am UTC) from US — Scanned from DE
Summary HTTP 10 Redirects  Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 5 IPs in 6 countries across 7 domains to perform 10 HTTP transactions. The main IP is 31.59.121.53, located in Paris, France and belongs to AS56971 CGI GLOBAL LIMITED, HK. The main domain is 97ee3.catex.at. 4mo old
TLS certificate: Issued by YR1 on July 8th 2026. Valid for: 3mo.
This is the only time 97ee3.catex.at was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Coinbase (Crypto Exchange)

Domain & IP information

IP Address AS Autonomous System
1 2 2a00:1450:400... 2a00:1450:4001:c25::84 15169 (GOOGLE) (GOOGLE - Google LLC)
1 1 107.189.20.230 107.189.20.230 14956 (ROUTERHOS...) (ROUTERHOSTING - RouterHosting LLC)
1 6 31.59.121.53 31.59.121.53 56971 (AS56971 C...) (AS56971 CGI GLOBAL LIMITED)
1 2 2606:4700:20:... 2606:4700:20::ac43:440b 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
2 104.17.24.14 104.17.24.14 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1 2600:9000:235... 2600:9000:235a:1400:12:94b3:c380:93a1 16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
10 5
2    2a00:1450:4001:c25::84 (Frankfurt am Main, Germany) 1 redirects
IP Lookup
urlscan.io SecurityTrails VirusTotal AbuseIPDB Censys Domaintools ipinfo.io Shodan
ASN Lookup
urlscan.io CAIDA Rank ipinfo.io CIRCL BGP Ranking

ASN15169 (GOOGLE - Google LLC, US)
97ee6.blogspot.md 1mo old
VirusTotal SecurityTrails crt.sh Domaintools
97ee6.blogspot.com 1mo old
VirusTotal SecurityTrails crt.sh Domaintools
1    107.189.20.230 (Zaandam, Netherlands) 1 redirects
IP Lookup
urlscan.io SecurityTrails VirusTotal AbuseIPDB Censys Domaintools ipinfo.io Shodan
ASN Lookup
urlscan.io CAIDA Rank ipinfo.io CIRCL BGP Ranking

ASN14956 (ROUTERHOSTING - RouterHosting LLC, US)
PTR: 230.20.189.107.static.cloudzy.com
rss2.sayler.at 1mo old
VirusTotal SecurityTrails crt.sh Domaintools
6    31.59.121.53 (Paris, France) 1 redirects
IP Lookup
urlscan.io SecurityTrails VirusTotal AbuseIPDB Censys Domaintools ipinfo.io Shodan
ASN Lookup
urlscan.io CAIDA Rank ipinfo.io CIRCL BGP Ranking

ASN56971 (AS56971 CGI GLOBAL LIMITED, HK)
97ee3.catex.at 4mo old
VirusTotal SecurityTrails crt.sh Domaintools
2    2606:4700:20::ac43:440b (None, ) 1 redirects
IP Lookup
urlscan.io SecurityTrails VirusTotal AbuseIPDB Censys Domaintools ipinfo.io Shodan
ASN Lookup
urlscan.io CAIDA Rank ipinfo.io CIRCL BGP Ranking

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
cdn.tailwindcss.com 5yr old
VirusTotal SecurityTrails crt.sh Domaintools
2    104.17.24.14 (Ascension Island)
IP Lookup
urlscan.io SecurityTrails VirusTotal AbuseIPDB Censys Domaintools ipinfo.io Shodan
ASN Lookup
urlscan.io CAIDA Rank ipinfo.io CIRCL BGP Ranking

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
cdnjs.cloudflare.com 13yr old
VirusTotal SecurityTrails crt.sh Domaintools
1    2600:9000:235a:1400:12:94b3:c380:93a1 (United States)
IP Lookup
urlscan.io SecurityTrails VirusTotal AbuseIPDB Censys Domaintools ipinfo.io Shodan
ASN Lookup
urlscan.io CAIDA Rank ipinfo.io CIRCL BGP Ranking

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
images.ctfassets.net 9yr old
VirusTotal SecurityTrails crt.sh Domaintools
Apex Domain
Subdomains		 Transfer
6 catex.at 1 redirects
97ee3.catex.at 4mo old
6 KB
2 cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 281 13yr old
173 KB
2 tailwindcss.com 1 redirects
cdn.tailwindcss.com — Cisco Umbrella Rank: 10496 5yr old
124 KB
1 ctfassets.net
images.ctfassets.net — Cisco Umbrella Rank: 3669 9yr old
2 KB
1 sayler.at 1 redirects
rss2.sayler.at 1mo old
905 B
1 blogspot.com
97ee6.blogspot.com 1mo old
17 KB
1 blogspot.md 1 redirects
97ee6.blogspot.md 1mo old
502 B
10 7
Domain Requested by
6 97ee3.catex.at 1 redirects 97ee6.blogspot.com
97ee3.catex.at
2 cdnjs.cloudflare.com 97ee3.catex.at
cdnjs.cloudflare.com
2 cdn.tailwindcss.com 1 redirects 97ee3.catex.at
1 images.ctfassets.net 97ee3.catex.at
1 rss2.sayler.at 1 redirects
1 97ee6.blogspot.com
1 97ee6.blogspot.md 1 redirects
10 7

This site contains no links.

Subject Issuer Validity Valid
misc-sni.blogspot.com
WE2		 2026-06-29 -
2026-09-21		 3mo crt.sh
catex.at
YR1		 2026-07-08 -
2026-10-06		 3mo crt.sh
cdnjs.cloudflare.com
WE1		 2026-07-10 -
2026-10-08		 3mo crt.sh
images.ctfassets.net
Amazon RSA 2048 M01		 2025-10-18 -
2026-11-15		 1yr crt.sh

This page contains 1 frames:

Primary Page: https://97ee3.catex.at/cnbcard/
Frame ID: 57CE1C7EF99E0AA23E06DD362550ED5B
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Coinbase Card

Page URL History Show full URLs

  1. http://97ee6.blogspot.md/ HTTP 307
    https://97ee6.blogspot.md/ HTTP 302
    https://97ee6.blogspot.com/ Page URL
  2. https://rss2.sayler.at/go/y2c4y254/z274x264 HTTP 302
    https://97ee3.catex.at/cnbcard/?b=YTo0OntzOjU6ImxhYmVsIjtzOjA6IiI7czozOiJ1c3IiO2k6MTY0NDtzOjQ6Im5vc... HTTP 302
    http://97ee3.catex.at/cnbcard/ HTTP 307
    https://97ee3.catex.at/cnbcard/ Page URL

Detected technologies

(CMS)
Overall confidence: 100%
Detected patterns
  • <[^>]+(?:assets|downloads|images|videos)\.(?:ct?fassets\.net|contentful\.com)
(UI frameworks)
Overall confidence: 100%
Detected patterns
  • \.tailwindcss(?:tailwind-config-cdn)?\.(?:com|js)|/npm/@tailwindcss/browser
(CDN)
Overall confidence: 100%
Detected patterns
  • cdnjs\.cloudflare\.com
(Font scripts)
Overall confidence: 100%
Detected patterns
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Page Statistics

10
Requests

90 %
HTTPS

50 %
IPv6

7
Domains

7
Subdomains

5
IPs

6
Countries

321 kB
Transfer

747 kB
Size

3
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://97ee6.blogspot.md/ HTTP 307
    https://97ee6.blogspot.md/ HTTP 302
    https://97ee6.blogspot.com/ Page URL
  2. https://rss2.sayler.at/go/y2c4y254/z274x264 HTTP 302
    https://97ee3.catex.at/cnbcard/?b=YTo0OntzOjU6ImxhYmVsIjtzOjA6IiI7czozOiJ1c3IiO2k6MTY0NDtzOjQ6Im5vcGQiO3M6MTQ6InJzczIuc2F5bGVyLmF0IjtzOjE6Im8iO2k6MjEzNTt9 HTTP 302
    http://97ee3.catex.at/cnbcard/ HTTP 307
    https://97ee3.catex.at/cnbcard/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • http://97ee6.blogspot.md/ HTTP 307
  • https://97ee6.blogspot.md/ HTTP 302
  • https://97ee6.blogspot.com/
Request Chain 3
  • https://cdn.tailwindcss.com/ HTTP 302
  • https://cdn.tailwindcss.com/3.4.17

10 HTTP transactions
0 data transactions

Method
Protocol		 Status Resource
Path		 Size
x-fer		 Time
Latency		 Type
MIME-Type		 IP
Location
GET
H2 		200
 / Show response
97ee6.blogspot.com/
Redirect Chain
  • http://97ee6.blogspot.md/
  • https://97ee6.blogspot.md/
  • https://97ee6.blogspot.com/
82 KB
17 KB 		189ms
189ms 		Document
text/html		 2a00:1450:4001:c25::84
Google LLC
General
Check archive.org
Download Go to
Full URL
https://97ee6.blogspot.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:c25::84 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
GSE /
Resource Hash
b565b865e9db67b8894c27804352bae63efaec67ccdb4b19a85310388bd7370d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private, max-age=0
content-encoding
gzip
content-length
17016
content-type
text/html; charset=UTF-8
date
Tue, 21 Jul 2026 09:57:57 GMT
etag
W/"4f6642d5dfcb0bcc9fff82145829a6770153eab613fd6eda2e52796af1812577"
expires
Tue, 21 Jul 2026 09:57:57 GMT
last-modified
Mon, 20 Jul 2026 19:21:38 GMT
server
GSE
x-content-type-options
nosniff
x-xss-protection
1; mode=block

Redirect headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private, max-age=0
content-encoding
gzip
content-length
196
content-security-policy
frame-ancestors 'self'
content-type
text/html; charset=UTF-8
date
Tue, 21 Jul 2026 09:57:56 GMT
expires
Tue, 21 Jul 2026 09:57:56 GMT
location
https://97ee6.blogspot.com/
server
GSE
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-xss-protection
1; mode=block
GET
H/1.1 		200
OK 		Primary Request / Show response
97ee3.catex.at/cnbcard/
Redirect Chain
  • https://rss2.sayler.at/go/y2c4y254/z274x264
  • https://97ee3.catex.at/cnbcard/?b=YTo0OntzOjU6ImxhYmVsIjtzOjA6IiI7czozOiJ1c3IiO2k6MTY0NDtzOjQ6Im5vcGQiO3M6MTQ6InJzczIuc2F5bGVyLmF0IjtzOjE6Im8iO2k6MjEzNTt9
  • http://97ee3.catex.at/cnbcard/
  • https://97ee3.catex.at/cnbcard/
5 KB
2 KB 		50ms
49ms 		Document
text/html		 31.59.121.53
AS56971 CGI GLOBA...
General
Check archive.org
Download Go to
Full URL
https://97ee3.catex.at/cnbcard/
Requested by
Host: 97ee6.blogspot.com
URL: https://97ee6.blogspot.com/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
31.59.121.53 Paris, France, ASN56971 (AS56971 CGI GLOBAL LIMITED, HK),
Reverse DNS
Software
nginx /
Resource Hash
b41923eb7949fe50fa2ddae6dcf9147e845ffba8eff83ced6e5e45412b0c87ad

Request headers

Referer
https://97ee6.blogspot.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Linux"

Response headers

Connection
keep-alive
Content-Encoding
gzip
Content-Length
1948
Content-Type
text/html; charset=UTF-8
Date
Tue, 21 Jul 2026 09:57:58 GMT
Server
nginx
Vary
Accept-Encoding

Redirect headers

Location
https://97ee3.catex.at/cnbcard/
Non-Authoritative-Reason
HttpsUpgrades
GET
H/1.1 		200
OK 		redirect.js Show response
97ee3.catex.at/cnbcard/js/ 		4 KB
2 KB 		47ms
44ms 		Script
application/javascript		 31.59.121.53
AS56971 CGI GLOBA...
General
Check archive.org
Download Go to
Full URL
https://97ee3.catex.at/cnbcard/js/redirect.js
Requested by
Host: 97ee3.catex.at
URL: https://97ee3.catex.at/cnbcard/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
31.59.121.53 Paris, France, ASN56971 (AS56971 CGI GLOBAL LIMITED, HK),
Reverse DNS
Software
nginx /
Resource Hash
9fc4de3632844cd0d933464afb34d27818101adb004e95f4a6f60e861a0eda42

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://97ee3.catex.at/cnbcard/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

Transfer-Encoding
chunked
Cache-Control
max-age=86400
Content-Encoding
gzip
ETag
W/"69e04973-116f"
Connection
keep-alive
Expires
Wed, 22 Jul 2026 09:57:58 GMT
Date
Tue, 21 Jul 2026 09:57:58 GMT
Content-Type
application/javascript; charset=UTF-8
Last-Modified
Thu, 16 Apr 2026 02:29:07 GMT
Server
nginx
GET
H/1.1 		404
Not Found 		pform.js
97ee3.catex.at/cnbcard/ 		0
0 		98ms
49ms 		Script
text/html		 31.59.121.53
AS56971 CGI GLOBA...
General
Check archive.org
Download Go to
Full URL
https://97ee3.catex.at/cnbcard/pform.js
Requested by
Host: 97ee3.catex.at
URL: https://97ee3.catex.at/cnbcard/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
31.59.121.53 Paris, France, ASN56971 (AS56971 CGI GLOBAL LIMITED, HK),
Reverse DNS
Software
nginx /
Resource Hash

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://97ee3.catex.at/cnbcard/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

Transfer-Encoding
chunked
Content-Encoding
gzip
Date
Tue, 21 Jul 2026 09:57:58 GMT
Content-Type
text/html; charset=iso-8859-1
Server
nginx
Connection
keep-alive
GET
H2 		200
 3.4.17 Show response
cdn.tailwindcss.com/
Redirect Chain
  • https://cdn.tailwindcss.com/
  • https://cdn.tailwindcss.com/3.4.17
398 KB
124 KB 		19ms
19ms 		Script
text/javascript		 2606:4700:20::ac43:440b
Cloudflare
General
Check archive.org
Download Go to
Full URL
https://cdn.tailwindcss.com/3.4.17
Requested by
Host: 97ee3.catex.at
URL: https://97ee3.catex.at/cnbcard/
Protocol
H2
Server
2606:4700:20::ac43:440b -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
176e894661aa9cdc9a5cba6c720044cbbf7b8bd80d1c9a142a7c24b1b6c50d15
Security Headers
Name Value
Strict-Transport-Security max-age=63072000

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
Referer
https://97ee3.catex.at/

Response headers

strict-transport-security
max-age=63072000
cache-control
max-age=31536000
nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
content-encoding
br
x-vercel-cache
MISS
cf-cache-status
HIT
age
3481249
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=6j5FZ2GidVHhgsbyYW4MYtCH8x3bPyj4Y2BRIdIM5UIbEFagXMyu3mli8kMuI4bRuJwnGvGerjWgcU5leWqvrHSzdtnL4oOC4wwEFvVhy2Yh9%2FJSLwvZenahy0CVW5p7l6Tc%2BRJoL%2FxYtxplB35bGYA%3D"}]}
last-modified
Fri, 03 Jul 2026 03:13:21 GMT
cf-ray
a1e9583008ecaf15-TXL
date
Tue, 21 Jul 2026 09:57:58 GMT
content-type
text/javascript
vary
accept-encoding
server
cloudflare
x-vercel-id
fra1::iad1::bj55r-1781146628084-40ce7f37f405

Redirect headers

strict-transport-security
max-age=63072000
cache-control
max-age=14400
location
/3.4.17
x-vercel-cache
MISS
nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
cf-cache-status
HIT
age
208
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=Gqf%2FQ5gHx9qArOdB9nKa5SWDHnefC1E%2BTjKow%2BLmOgvtHM7dWUCmN51sqtfvtmZ%2FcB%2BGreuET9CHSIdEHm5SJfI%2Fl436P7gTuE%2FiNXGap6WybhgPXy1tZiRrAkostYrKpovyxB%2F1FTof586DTOAuvvQ%3D"}]}
cf-ray
a1e9582fe87caf15-TXL
date
Tue, 21 Jul 2026 09:57:58 GMT
server
cloudflare
x-vercel-id
fra1::iad1::s5f48-1784627670136-013381dfec18
GET
H3 		200
 all.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/6.5.0/css/ 		100 KB
19 KB 		74ms
42ms 		Stylesheet
text/css		 104.17.24.14
Cloudflare
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.5.0/css/all.min.css
Requested by
Host: 97ee3.catex.at
URL: https://97ee3.catex.at/cnbcard/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.24.14 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
c880eb3d25c765d399840aa204fec22b3230310991089f14781f09a35ed80b8a
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

Origin
https://97ee3.catex.at
sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cf-cdnjs-via
cfworker/r2
content-encoding
br
cf-cache-status
BYPASS
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=5gAslLEYAUTvFb0ab%2BwRSIKnjssCVxI9zjGj1DpMGF0t2qpTpCVEUyurkOKoXqR77RnOS10AsGWeZaH%2BC8tZ1JBrMxiDosAdzCmSz9Kq3H98I9npWM24KPDwXUliEo%2F1FOCpAoem"}]}
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
x-cdnjs-cache
HIT
date
Tue, 21 Jul 2026 09:57:58 GMT
content-type
text/css; charset=utf-8
last-modified
Tue, 28 Nov 2023 18:34:15 GMT
vary
Accept-Encoding
priority
u=0,i=?0
strict-transport-security
max-age=15780000
cache-control
no-transform, public, s-maxage=30672000, max-age=30672000, immutable
timing-allow-origin
*
nel
{"report_to":"cf-nel","success_fraction":0.01,"max_age":604800}
cross-origin-resource-policy
cross-origin
cf-ray
a1e9582feac54b92-CPH
access-control-allow-origin
*
content-length
18859
server
cloudflare
GET
H2 		200
 Consumer_Wordmark.svg
images.ctfassets.net/q5ulk4bp65r7/3TBS4oVkD1ghowTqVQJlqj/2dfd4ea3b623a7c0d8deb2ff445dee9e/ 		4 KB
2 KB 		71ms
23ms 		Image
image/svg+xml		 2600:9000:235a:1400:12:94b3:c380:93a1
Amazon.com
General
Check archive.org
Download Go to Show image
Full URL
https://images.ctfassets.net/q5ulk4bp65r7/3TBS4oVkD1ghowTqVQJlqj/2dfd4ea3b623a7c0d8deb2ff445dee9e/Consumer_Wordmark.svg
Requested by
Host: 97ee3.catex.at
URL: https://97ee3.catex.at/cnbcard/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:235a:1400:12:94b3:c380:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
Contentful Images API /
Resource Hash
126270d27d1ac1a29b8d7d01238377840fe79b70212bd230adc6b2d9da82bf38

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://97ee3.catex.at/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cache-control
max-age=31536000
content-encoding
gzip
etag
W/"78b2915b21e673b15957e22970b36c40"
age
25786
via
1.1 78668cba389ee6455cf1c23180f33cf8.cloudfront.net (CloudFront)
access-control-allow-origin
*
x-cache
Hit from cloudfront
x-amz-cf-id
jRh2rynWjigjDb22C1BR22X_SO7vA9YhXX9dXc0UPi38kn575fK7CQ==
date
Tue, 21 Jul 2026 02:48:13 GMT
content-type
image/svg+xml
last-modified
Fri, 26 Mar 2021 14:21:17 GMT
server
Contentful Images API
x-amz-cf-pop
FRA60-P9
vary
Accept-Encoding
GET
H/1.1 		200
OK 		placeholder.js Show response
97ee3.catex.at/cnbcard/js/ 		344 B
598 B 		133ms
46ms 		Script
application/javascript		 31.59.121.53
AS56971 CGI GLOBA...
General
Check archive.org
Download Go to
Full URL
https://97ee3.catex.at/cnbcard/js/placeholder.js
Requested by
Host: 97ee3.catex.at
URL: https://97ee3.catex.at/cnbcard/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
31.59.121.53 Paris, France, ASN56971 (AS56971 CGI GLOBAL LIMITED, HK),
Reverse DNS
Software
nginx /
Resource Hash
dd6b787ac7959f74254fb0da4d1de07fb8c7c5310eebffbfec28b88ce2e610ee

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://97ee3.catex.at/cnbcard/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

Transfer-Encoding
chunked
Cache-Control
max-age=86400
Content-Encoding
gzip
ETag
W/"69e04973-158"
Connection
keep-alive
Expires
Wed, 22 Jul 2026 09:57:58 GMT
Date
Tue, 21 Jul 2026 09:57:58 GMT
Content-Type
application/javascript; charset=UTF-8
Last-Modified
Thu, 16 Apr 2026 02:29:07 GMT
Server
nginx
GET
H3 		200
 fa-solid-900.woff2
cdnjs.cloudflare.com/ajax/libs/font-awesome/6.5.0/webfonts/ 		153 KB
154 KB 		50ms
50ms 		Font
application/octet-stream		 104.17.24.14
Cloudflare
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.5.0/webfonts/fa-solid-900.woff2
Requested by
Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.5.0/css/all.min.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.24.14 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
f4c5a5b297e623bc159679563a4d1eb16e409ca3b57698fbc00fd2c907dadae0
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

Origin
https://97ee3.catex.at
sec-ch-ua-platform
"Linux"
Referer
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.5.0/css/all.min.css
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cf-cdnjs-via
cfworker/r2
cf-cache-status
BYPASS
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=d5BrPLB5Hxxk%2Fjhmu492%2BzLTnWtIYx9J%2FzCY8CxGAaSDch3pstRGEyGSPRQixV%2FDKjOkEPrOdhZhkfJ54%2F%2Fz9FxtfK608Hls9v3rZz%2Fgk7X7olcWqnf6JurfjoRAkgbUMzBAZ8uA"}]}
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
x-cdnjs-cache
HIT
date
Tue, 21 Jul 2026 09:57:58 GMT
content-type
application/octet-stream; charset=utf-8
last-modified
Tue, 28 Nov 2023 18:34:15 GMT
vary
Accept-Encoding
priority
u=0,i=?0
strict-transport-security
max-age=15780000
cache-control
no-transform, public, s-maxage=30672000, max-age=30672000, immutable
timing-allow-origin
*
nel
{"report_to":"cf-nel","success_fraction":0.01,"max_age":604800}
cross-origin-resource-policy
cross-origin
cf-ray
a1e958311ca74b92-CPH
access-control-allow-origin
*
content-length
156532
server
cloudflare
GET
H/1.1 		200
OK 		favicon.ico
97ee3.catex.at/cnbcard/ 		1 KB
1 KB 		49ms
49ms 		Other
image/vnd.microsoft.icon		 31.59.121.53
AS56971 CGI GLOBA...
General
Check archive.org
Download Go to
Full URL
https://97ee3.catex.at/cnbcard/favicon.ico
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
31.59.121.53 Paris, France, ASN56971 (AS56971 CGI GLOBAL LIMITED, HK),
Reverse DNS
Software
nginx /
Resource Hash
90d32dc3c82462addda4a980562043cebd904dcb7c6c7f5390a623fce9f8ae49

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://97ee3.catex.at/cnbcard/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="150", "Google Chrome";v="150", "Not;A=Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

ETag
"47e-64f8a98c44b79"
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1150
Date
Tue, 21 Jul 2026 09:57:58 GMT
Content-Type
image/vnd.microsoft.icon
Last-Modified
Thu, 16 Apr 2026 02:29:07 GMT
Server
nginx

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Coinbase (Crypto Exchange)

14 JavaScript Window variables

These are the non-standard variables defined on the window object. These include var declarations and global functions and can be helpful in identifying possible client-side frameworks and code.

string| CRedirectName boolean| redirectLastPage object| pages function| getCookie function| setCookie function| readCookie function| redirectPage function| load function| init function| notificationShow function| notificationHide function| addNotificationPage object| tailwind string| /template.html

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path Expires Name / Value
.rss2.sayler.at/ 1970-01-22
01:19:47 		Name: PHPSESSID
Value: 1e5fd71d865f6dc5d75fe33264f42556
.rss2.sayler.at/ 1970-01-21
16:28:26 		Name: ofr_2135
Value: a%3A4%3A%7Bs%3A5%3A%22label%22%3Bs%3A0%3A%22%22%3Bs%3A3%3A%22usr%22%3Bi%3A1644%3Bs%3A4%3A%22nopd%22%3Bs%3A14%3A%22rss2.sayler.at%22%3Bs%3A1%3A%22o%22%3Bi%3A2135%3B%7D
.97ee3.catex.at/ 1970-01-21
16:28:26 		Name: ofr
Value: a%3A4%3A%7Bs%3A5%3A%22label%22%3Bs%3A0%3A%22%22%3Bs%3A3%3A%22usr%22%3Bi%3A1644%3Bs%3A4%3A%22nopd%22%3Bs%3A14%3A%22rss2.sayler.at%22%3Bs%3A1%3A%22o%22%3Bi%3A2135%3B%7D

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source Level URL
Text
network error URL: https://97ee3.catex.at/cnbcard/pform.js
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block