![](/screenshots/0883ef2a-fcc2-42fb-a1b6-da7a47985c1f.png)
www.bpay.billing.xkv9-services.com
Open in
urlscan Pro
188.241.58.119
Malicious Activity!
Public Scan
Effective URL: https://www.bpay.billing.xkv9-services.com/
Submission: On July 30 via api from US — Scanned from DE
Summary
TLS certificate: Issued by cPanel, Inc. Certification Authority on July 27th 2024. Valid for: 3 months.
This is the only time www.bpay.billing.xkv9-services.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Binance (Crypto Exchange)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
10 | 188.241.58.119 188.241.58.119 | 51177 (THCPROJECTS) (THCPROJECTS) | |
2 | 104.17.24.14 104.17.24.14 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 158.220.96.98 158.220.96.98 | 51167 (CONTABO) (CONTABO) | |
15 | 4 |
ASN51177 (THCPROJECTS, RO)
PTR: bitcompany.online
www.bpay.billing.xkv9-services.com |
ASN51167 (CONTABO, DE)
PTR: vmi1506127.contaboserver.net
bpay-m-server.xkv9-services.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
11 |
xkv9-services.com
www.bpay.billing.xkv9-services.com bpay-m-server.xkv9-services.com Failed |
151 KB |
2 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 336 |
82 KB |
15 | 2 |
Domain | Requested by | |
---|---|---|
10 | www.bpay.billing.xkv9-services.com |
www.bpay.billing.xkv9-services.com
|
2 | cdnjs.cloudflare.com |
www.bpay.billing.xkv9-services.com
cdnjs.cloudflare.com |
1 | bpay-m-server.xkv9-services.com |
www.bpay.billing.xkv9-services.com
|
15 | 3 |
This site contains links to these domains. Also see Links.
Domain |
---|
xkv9-services.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
bpay.billing.xkv9-services.com cPanel, Inc. Certification Authority |
2024-07-27 - 2024-10-25 |
3 months | crt.sh |
cdnjs.cloudflare.com E1 |
2024-06-02 - 2024-08-31 |
3 months | crt.sh |
bpay-m-server.xkv9-services.com E6 |
2024-07-24 - 2024-10-22 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://www.bpay.billing.xkv9-services.com/
Frame ID: EEA4DE471FACEDBAE4B91863A9EF816D
Requests: 14 HTTP requests in this frame
Screenshot
![](/screenshots/0883ef2a-fcc2-42fb-a1b6-da7a47985c1f.png)
Page Title
Binance Merchant Pay - Cryptocurrency invoicingPage URL History Show full URLs
-
http://www.bpay.billing.xkv9-services.com:443/
HTTP 307
https://www.bpay.billing.xkv9-services.com/ Page URL
Detected technologies
![](/vendor/wappa/icons/Font Awesome.png)
Detected patterns
- <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Page Statistics
2 Outgoing links
These are links going to different origins than the main page.
Title: terms of service and privacy policy
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://www.bpay.billing.xkv9-services.com:443/
HTTP 307
https://www.bpay.billing.xkv9-services.com/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
15 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
www.bpay.billing.xkv9-services.com/ Redirect Chain
|
11 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
style.css
www.bpay.billing.xkv9-services.com/ |
35 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
font-awesome.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/ |
30 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
notification.css
www.bpay.billing.xkv9-services.com/css/ |
3 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
cmain.js
www.bpay.billing.xkv9-services.com/ |
50 KB 18 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Binance_logo.svg
www.bpay.billing.xkv9-services.com/img/ |
4 KB 4 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo.png
www.bpay.billing.xkv9-services.com/ |
55 KB 55 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
fontawesome-webfont.woff2
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/fonts/ |
75 KB 76 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
payment_completed.mp3
www.bpay.billing.xkv9-services.com/sfx/ |
15 KB 15 KB |
Media
audio/mpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
payment_failed.mp3
www.bpay.billing.xkv9-services.com/sfx/ |
45 KB 45 KB |
Media
audio/mpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
chevron.svg
www.bpay.billing.xkv9-services.com/img/ |
619 B 864 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST |
/
bpay-m-server.xkv9-services.com/bpay-req/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
order-status
bpay-m-server.xkv9-services.com/bpay-req/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H/1.1 |
/
bpay-m-server.xkv9-services.com/bpay-req/ |
0 0 |
Preflight
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
cropped-Icon_Site-32x32.png
www.bpay.billing.xkv9-services.com/ |
2 KB 2 KB |
Other
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- bpay-m-server.xkv9-services.com
- URL
- https://bpay-m-server.xkv9-services.com:8443/bpay-req/
- Domain
- bpay-m-server.xkv9-services.com
- URL
- https://bpay-m-server.xkv9-services.com:8443/bpay-req/order-status
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Binance (Crypto Exchange)40 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
string| serviceTypePlaceHolder object| sseSourceServer number| pollServerIntervalId function| onWindowUnloading function| computeActivePaymentSessions function| getDeepLink function| _0x553d function| restorePrePaymentConditions function| processPostPaymentStuff function| startPollingInterval function| deletePollingInterval function| resetPollingInterval function| getEnumNameByValue function| onWindowLoad function| isValidEmail function| initSounds function| scrollToTopAndFocus function| validateFields function| _0x1b59 function| rem2px object| _Cmzo string| _Hio string| _HQ string| _euN string| _104o string| _6T2w string| _7yk string| _538A string| _kEz1 string| _5U number| _E8lX string| _Fa4p number| _4vP object| S_LOCALES function| showPaymentSuccessNotification function| showPaymentFailNotification object| modal2 object| modal3 object| jselect_INSTANCES object| prov_service_type_selector0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
4 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
bpay-m-server.xkv9-services.com
cdnjs.cloudflare.com
www.bpay.billing.xkv9-services.com
bpay-m-server.xkv9-services.com
104.17.24.14
158.220.96.98
188.241.58.119
16098fa3e3c9b98a9b53397f935edbcc8bb6970d991a0fbad6305811585d7796
2397f1c1f6a358ad017bf933a33476706e27dfa0cf56a37f4374d2c4316f77f0
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
34bd1b3dde08f4d19f5437fbf1ca3360b03b22f1d4e422f4d78cdfe249a538de
53513e352a3559410d4202a1f0a80a7ac2e5390a34ea4b60dbc4d4a9c31380c8
67882ed6cfdf529aba4e12d48f67109e1995ddc624c5921c5f9201ee628aa83c
6d3f797fa4b357594eae857b58f5ffaedd993510d7b2022eb0c107b88afd5718
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
b449b20b0550e803134c5027a4c17a7c5064f0c4ba8c633d03b3aab8a8ef6f05
ca9dcd87632bb29356a320cf9d40a223c3568e40d0cf1765588e3f346a6db587
e2db2c437c7c95926e5582f1f7e836f7206e685b50a2aeca65a7298b05c7566b
f77353348ce50952f07c21774a35717167cc27330db6db9c132802e6c72ec172