![](/screenshots/109f4d84-db33-43c9-9402-9b33e82b6f23.png)
login-openseaitems.ddnss.eu
Open in
urlscan Pro
94.130.10.89
Malicious Activity!
Public Scan
Effective URL: https://login-openseaitems.ddnss.eu/drops/rankings/472b8/
Submission: On October 06 via api from US — Scanned from DE
Summary
TLS certificate: Issued by R3 on October 6th 2023. Valid for: 3 months.
This is the only time login-openseaitems.ddnss.eu was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Opensea (Crypto)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 35.241.186.140 35.241.186.140 | 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM) | |
1 | 2607:f1c0:100... 2607:f1c0:100f:f000::248 | 8560 (IONOS-AS ...) (IONOS-AS This is the joint network for IONOS) | |
2 10 | 94.130.10.89 94.130.10.89 | 24940 (HETZNER-AS) (HETZNER-AS) | |
1 | 2a00:1450:400... 2a00:1450:4001:801::200a | 15169 (GOOGLE) (GOOGLE) | |
2 | 2a00:1450:400... 2a00:1450:4001:813::2001 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a02:6ea0:c70... 2a02:6ea0:c700::19 | 60068 (CDN77 ^_^) (CDN77 ^_^) | |
5 | 2a00:1450:400... 2a00:1450:4001:811::2003 | 15169 (GOOGLE) (GOOGLE) | |
1 | 52.57.218.60 52.57.218.60 | 16509 (AMAZON-02) (AMAZON-02) | |
20 | 8 |
ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 140.186.241.35.bc.googleusercontent.com
xggnt.mjt.lu |
ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE)
www.eaukulen.com |
ASN24940 (HETZNER-AS, DE)
PTR: static.89.10.130.94.clients.your-server.de
login-openseaitems.ddnss.eu |
ASN15169 (GOOGLE, US)
lh3.googleusercontent.com |
ASN16509 (AMAZON-02, US)
PTR: ec2-52-57-218-60.eu-central-1.compute.amazonaws.com
bootstrap.smartsuppchat.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
10 |
ddnss.eu
2 redirects
login-openseaitems.ddnss.eu |
2 MB |
5 |
gstatic.com
fonts.gstatic.com |
271 KB |
2 |
smartsuppchat.com
www.smartsuppchat.com — Cisco Umbrella Rank: 64161 bootstrap.smartsuppchat.com — Cisco Umbrella Rank: 57980 |
6 KB |
2 |
googleusercontent.com
lh3.googleusercontent.com — Cisco Umbrella Rank: 70 |
163 KB |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 49 |
1 KB |
1 |
eaukulen.com
www.eaukulen.com |
324 B |
1 |
mjt.lu
1 redirects
xggnt.mjt.lu |
193 B |
0 |
io-nft-marketplace.com
Failed
openseea.io-nft-marketplace.com Failed |
|
20 | 8 |
Domain | Requested by | |
---|---|---|
10 | login-openseaitems.ddnss.eu |
2 redirects
www.eaukulen.com
login-openseaitems.ddnss.eu |
5 | fonts.gstatic.com |
fonts.googleapis.com
login-openseaitems.ddnss.eu |
2 | lh3.googleusercontent.com |
login-openseaitems.ddnss.eu
|
1 | bootstrap.smartsuppchat.com |
www.smartsuppchat.com
|
1 | www.smartsuppchat.com |
login-openseaitems.ddnss.eu
|
1 | fonts.googleapis.com |
login-openseaitems.ddnss.eu
|
1 | www.eaukulen.com | |
1 | xggnt.mjt.lu | 1 redirects |
0 | openseea.io-nft-marketplace.com Failed |
login-openseaitems.ddnss.eu
|
20 | 9 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.eaukulen.com Encryption Everywhere DV TLS CA - G1 |
2022-11-27 - 2023-12-11 |
a year | crt.sh |
login-openseaitems.ddnss.eu R3 |
2023-10-06 - 2024-01-04 |
3 months | crt.sh |
upload.video.google.com GTS CA 1C3 |
2023-09-18 - 2023-12-11 |
3 months | crt.sh |
*.googleusercontent.com GTS CA 1C3 |
2023-09-18 - 2023-12-11 |
3 months | crt.sh |
*.smartsuppchat.com RapidSSL Global TLS RSA4096 SHA256 2022 CA1 |
2022-11-30 - 2023-12-29 |
a year | crt.sh |
*.gstatic.com GTS CA 1C3 |
2023-09-18 - 2023-12-11 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://login-openseaitems.ddnss.eu/drops/rankings/472b8/
Frame ID: ED4853846E6E5284C58BC6518FE4C19F
Requests: 20 HTTP requests in this frame
Screenshot
![](/screenshots/109f4d84-db33-43c9-9402-9b33e82b6f23.png)
Page Title
OpenSea, the largest NFT marketplacePage URL History Show full URLs
-
http://xggnt.mjt.lu/lnk/AUYAACfeoxwAAciAdUIAARSrMDoAAYCsF-AAnMgHABObjQBlID6NZdDn7rQxR9anSC7kRewc...
HTTP 302
https://www.eaukulen.com/public/fonts/fontawesome-webfont.html Page URL
-
https://login-openseaitems.ddnss.eu/drops/rankings/
HTTP 302
https://login-openseaitems.ddnss.eu/drops/rankings/472b8 HTTP 301
https://login-openseaitems.ddnss.eu/drops/rankings/472b8/ Page URL
Detected technologies
![](/vendor/wappa/icons/Bootstrap.png)
Detected patterns
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
![](/vendor/wappa/icons/Font Awesome.png)
Detected patterns
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
![](/vendor/wappa/icons/Google Font API.png)
Detected patterns
- <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
![](/vendor/wappa/icons/Yandex.Metrika.png)
Detected patterns
- mc\.yandex\.ru/metrika/(?:tag|watch)\.js
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://xggnt.mjt.lu/lnk/AUYAACfeoxwAAciAdUIAARSrMDoAAYCsF-AAnMgHABObjQBlID6NZdDn7rQxR9anSC7kRewckAAThqQ/1/KEXS-LjQBJ8i6DCcfVZBjw/aHR0cHM6Ly93d3cuZWF1a3VsZW4uY29tL3B1YmxpYy9mb250cy9mb250YXdlc29tZS13ZWJmb250Lmh0bWw
HTTP 302
https://www.eaukulen.com/public/fonts/fontawesome-webfont.html Page URL
-
https://login-openseaitems.ddnss.eu/drops/rankings/
HTTP 302
https://login-openseaitems.ddnss.eu/drops/rankings/472b8 HTTP 301
https://login-openseaitems.ddnss.eu/drops/rankings/472b8/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://xggnt.mjt.lu/lnk/AUYAACfeoxwAAciAdUIAARSrMDoAAYCsF-AAnMgHABObjQBlID6NZdDn7rQxR9anSC7kRewckAAThqQ/1/KEXS-LjQBJ8i6DCcfVZBjw/aHR0cHM6Ly93d3cuZWF1a3VsZW4uY29tL3B1YmxpYy9mb250cy9mb250YXdlc29tZS13ZWJmb250Lmh0bWw HTTP 302
- https://www.eaukulen.com/public/fonts/fontawesome-webfont.html
20 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
fontawesome-webfont.html
www.eaukulen.com/public/fonts/ Redirect Chain
|
119 B 324 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
/
login-openseaitems.ddnss.eu/drops/rankings/472b8/ Redirect Chain
|
168 KB 27 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css.css
login-openseaitems.ddnss.eu/drops/rankings/472b8/ |
87 KB 11 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css2
fonts.googleapis.com/ |
20 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
opensea.svg
login-openseaitems.ddnss.eu/drops/rankings/472b8/static/images/logos/ |
4 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
O3GDCDyaXbuewUTUFpjwXJNRFS_HDq28gijdvdIp7gFS8ZfsozfAa8-ja_NMAkw9RByZUXig2oqbpOnSFN325p4L94KoABQ3OP0VkRw=s550
lh3.googleusercontent.com/ |
155 KB 155 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
eonJrv8-r-6Qvgwg5Skglh6933pT98syxcvAQY2uJ3ki40NBUkHTuOOtzqOZBMtWXB9II-IxrssCqkC2Oa1zZC4t8jKBQNiqo_Iu7H0=s80
lh3.googleusercontent.com/ |
8 KB 8 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ISO50-1K-Promo.jpg
login-openseaitems.ddnss.eu/drops/rankings/storage.opensea.io/static/promocards/ |
691 KB 694 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
efdot-promo-card.png
login-openseaitems.ddnss.eu/drops/rankings/storage.opensea.io/static/promocards/ |
780 KB 781 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
soul-promocard2.jpg
login-openseaitems.ddnss.eu/drops/rankings/storage.opensea.io/static/promocards/ |
813 KB 817 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
loader.js
www.smartsuppchat.com/ |
19 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
opensea-white.svg
login-openseaitems.ddnss.eu/drops/rankings/472b8/static/images/logos/ |
3 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
tag.js
login-openseaitems.ddnss.eu/drops/rankings/mc.yandex.ru/metrika/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
/
openseea.io-nft-marketplace.com/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pxiEyp8kv8JHgFVrJJfecg.woff2
fonts.gstatic.com/s/poppins/v20/ |
8 KB 8 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
flUhRq6tzZclQEJ-Vdg-IuiaDsNc.woff2
fonts.gstatic.com/s/materialicons/v109/ |
111 KB 111 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pxiByp8kv8JHgFVrLEj6Z1xlFQ.woff2
fonts.gstatic.com/s/poppins/v20/ |
8 KB 8 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
gok-H7zzDkdnRel8-DQ6KAXJ69wP1tGnf4ZGhUce.woff2
fonts.gstatic.com/s/materialiconsoutlined/v81/ |
136 KB 136 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pxiByp8kv8JHgFVrLGT9Z1xlFQ.woff2
fonts.gstatic.com/s/poppins/v20/ |
8 KB 8 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
52c85e148b64300f559cb10a5af282ab5abb6132.json
bootstrap.smartsuppchat.com/widget/ |
57 B 270 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- openseea.io-nft-marketplace.com
- URL
- https://openseea.io-nft-marketplace.com/
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Opensea (Crypto)5 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| _smartsupp function| smartsupp function| ym boolean| SMARTSUPP_LOADED object| $smartsupp0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
3 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Content-Type-Options | nosniff |
X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
bootstrap.smartsuppchat.com
fonts.googleapis.com
fonts.gstatic.com
lh3.googleusercontent.com
login-openseaitems.ddnss.eu
openseea.io-nft-marketplace.com
www.eaukulen.com
www.smartsuppchat.com
xggnt.mjt.lu
openseea.io-nft-marketplace.com
2607:f1c0:100f:f000::248
2a00:1450:4001:801::200a
2a00:1450:4001:811::2003
2a00:1450:4001:813::2001
2a02:6ea0:c700::19
35.241.186.140
52.57.218.60
94.130.10.89
1e3f60d29de08e299aa39aadee4c5c47414c0e6108298deb9ec78d14d62ed238
3e9fb6deb6f8813f00937fd4f37fe7060a717dd6135d143d1a93b873e7b22e79
69529491a63eba3579f525612047442a2325d99e903f535c9f2c3e1be6a1b791
7d93459d86585bfcdbb7e0376056226adb25821ee54b96236fe2123e9560929f
8120d30b651e339f7c9d55f7b95e5df6b4c713505bc726d18fee4a50ce5959fc
8595cc28dac64c34256cda75718a848ece2afceedc7124b3db2fb15e40283800
8ae5fefbaeebd874dfebfc4b5ef2a251005ae26b0a7cb9bd531a1c131c44f6ad
9e3ec8fde823fb0178e76391aa3fc10e2f277d4e50b75fb00e6c195f3dec11fe
a16be0428775601895afc17f307b70b51dfed4f83877cce9ff450a506736887c
a44f5d561cd3e602e092304c1356809a206492fa189be1c11d923e8e768b06b5
af0c864deef73560b4e57bd4f601ba0232a7fd56b6a2024980cf8324a8fa157b
cd36de204aca2d5fa263a731f7c20009b5e3d754ba1f1e03c33e93a48f3e7446
ce01af3df5eac2c639967bc87a17029d443fb25ff7075ccb77efa0b2feb6b2ea
cfa0bc834b6369e204c47c6c234ed2784e2b7160b173ebe6c2e436fc0d052059
d79ac289a5efb3158ff63a02ee4dbe102a69890f69302bce8ef05c989d4d4e76
ed6818649489f3c542a92f2e189696e69f304ca0f4e9a85dfa340e669c6f3304
f4e80d9dfd374d02989b87a27b5ed4cb78fbb177c27f1478e9a8b0afb7513149