![](/screenshots/1505b474-7efa-48e3-b6eb-1423407e4124.png)
basdiegoosust.top
Open in
urlscan Pro
104.31.73.42
Malicious Activity!
Public Scan
Effective URL: https://basdiegoosust.top/snntv/4mask/?c1=AT&n=crengineDE-ds01ya-b42sg-4mask-mar05sEN-downey-115-ERROR&mal=404errorDEmar05...
Submission: On October 05 via api from CH
Summary
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on June 19th 2020. Valid for: a year.
This is the only time basdiegoosust.top was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Crypto (Crypto Exchange)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 4 | 172.67.166.29 172.67.166.29 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 2 | 104.27.154.237 104.27.154.237 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 1 | 172.67.142.120 172.67.142.120 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
18 | 104.31.73.42 104.31.73.42 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a00:1450:400... 2a00:1450:4001:809::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:824::2003 | 15169 (GOOGLE) (GOOGLE) | |
1 | 157.230.127.24 157.230.127.24 | 14061 (DIGITALOC...) (DIGITALOCEAN-ASN) | |
3 | 2a00:1450:400... 2a00:1450:4001:806::2003 | 15169 (GOOGLE) (GOOGLE) | |
26 | 6 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
18 |
basdiegoosust.top
basdiegoosust.top |
404 KB |
4 |
gstatic.com
www.gstatic.com fonts.gstatic.com |
146 KB |
4 |
javalgbalza.xyz
2 redirects
llcty.javalgbalza.xyz |
3 KB |
2 |
adamcoitd.com
2 redirects
zuzz.adamcoitd.com |
1 KB |
1 |
megafastpush.com
megafastpush.com |
3 KB |
1 |
googleapis.com
ajax.googleapis.com |
30 KB |
1 |
ilkerdikme.com
1 redirects
eqoq.ilkerdikme.com |
1013 B |
26 | 7 |
Domain | Requested by | |
---|---|---|
18 | basdiegoosust.top |
llcty.javalgbalza.xyz
basdiegoosust.top |
4 | llcty.javalgbalza.xyz | 2 redirects |
3 | fonts.gstatic.com |
basdiegoosust.top
|
2 | zuzz.adamcoitd.com | 2 redirects |
1 | megafastpush.com |
basdiegoosust.top
|
1 | www.gstatic.com |
basdiegoosust.top
|
1 | ajax.googleapis.com |
basdiegoosust.top
|
1 | eqoq.ilkerdikme.com | 1 redirects |
26 | 8 |
This site contains links to these domains. Also see Links.
Domain |
---|
ai-redirect.link |
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2020-08-15 - 2021-08-15 |
a year | crt.sh |
upload.video.google.com GTS CA 1O1 |
2020-09-03 - 2020-11-26 |
3 months | crt.sh |
*.gstatic.com GTS CA 1O1 |
2020-09-03 - 2020-11-26 |
3 months | crt.sh |
megafastpush.com Let's Encrypt Authority X3 |
2020-08-06 - 2020-11-04 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://basdiegoosust.top/snntv/4mask/?c1=AT&n=crengineDE-ds01ya-b42sg-4mask-mar05sEN-downey-115-ERROR&mal=404errorDEmar05sEN-downey-115&pro=4mask&ser=ds01ya&b=b42sg
Frame ID: B40BB842390246384224570BD863F256
Requests: 26 HTTP requests in this frame
Screenshot
![](/screenshots/1505b474-7efa-48e3-b6eb-1423407e4124.png)
Page URL History Show full URLs
- https://llcty.javalgbalza.xyz/neyatiquyy1y7-ibsuno-orwoec Page URL
-
http://llcty.javalgbalza.xyz/gateway.php?frm=dm&token=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1cmwiOiJcL2...
HTTP 301
https://llcty.javalgbalza.xyz/gateway.php?frm=dm&token=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1cmwiOiJcL2... Page URL
-
https://llcty.javalgbalza.xyz/adz?p=6-uk-downey&b=b42sg&s=ds01ya&of=all&n=mar05sEN-downey-115
HTTP 302
https://zuzz.adamcoitd.com/6-uk-downey?n=mar05sEN-downey-115&sub_id_1=ds01ya&sub_id_2=mar05sEN-downey-1... HTTP 302
https://zuzz.adamcoitd.com/404?sub_id_1=ds01ya&sub_id_2=mar05sEN-downey-115&sub_id_3=6-uk-downey&sub_id... HTTP 302
https://eqoq.ilkerdikme.com/all?sub_id_1=ds01ya&sub_id_2=404errorDEmar05sEN-downey-115&sub_id_3=6-uk-dow... HTTP 302
https://basdiegoosust.top/snntv/4mask/?c1=AT&n=crengineDE-ds01ya-b42sg-4mask-mar05sEN-downey-115-ERROR... Page URL
Detected technologies
Detected patterns
- headers server /^cloudflare$/i
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title:
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://llcty.javalgbalza.xyz/neyatiquyy1y7-ibsuno-orwoec Page URL
-
http://llcty.javalgbalza.xyz/gateway.php?frm=dm&token=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1cmwiOiJcL2Fkej9wPTYtdWstZG93bmV5JmI9YjQyc2cmcz1kczAxeWEmb2Y9YWxsJm49bWFyMDVzRU4tZG93bmV5LTExNSJ9.b6zWrrZ2lusz2wdXMlOvEY2uAllIeSVPxDkE6WkV0pw
HTTP 301
https://llcty.javalgbalza.xyz/gateway.php?frm=dm&token=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1cmwiOiJcL2Fkej9wPTYtdWstZG93bmV5JmI9YjQyc2cmcz1kczAxeWEmb2Y9YWxsJm49bWFyMDVzRU4tZG93bmV5LTExNSJ9.b6zWrrZ2lusz2wdXMlOvEY2uAllIeSVPxDkE6WkV0pw Page URL
-
https://llcty.javalgbalza.xyz/adz?p=6-uk-downey&b=b42sg&s=ds01ya&of=all&n=mar05sEN-downey-115
HTTP 302
https://zuzz.adamcoitd.com/6-uk-downey?n=mar05sEN-downey-115&sub_id_1=ds01ya&sub_id_2=mar05sEN-downey-115&sub_id_3=6-uk-downey&sub_id_4=b42sg&of=all HTTP 302
https://zuzz.adamcoitd.com/404?sub_id_1=ds01ya&sub_id_2=mar05sEN-downey-115&sub_id_3=6-uk-downey&sub_id_4=b42sg&n=mar05sEN-downey-115-ERROR&of=all HTTP 302
https://eqoq.ilkerdikme.com/all?sub_id_1=ds01ya&sub_id_2=404errorDEmar05sEN-downey-115&sub_id_3=6-uk-downey&sub_id_4=b42sg&sub_id_5=4mask&n=4mask-mar05sEN-downey-115-ERROR&pr=4mask HTTP 302
https://basdiegoosust.top/snntv/4mask/?c1=AT&n=crengineDE-ds01ya-b42sg-4mask-mar05sEN-downey-115-ERROR&mal=404errorDEmar05sEN-downey-115&pro=4mask&ser=ds01ya&b=b42sg Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 1- http://llcty.javalgbalza.xyz/gateway.php?frm=dm&token=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1cmwiOiJcL2Fkej9wPTYtdWstZG93bmV5JmI9YjQyc2cmcz1kczAxeWEmb2Y9YWxsJm49bWFyMDVzRU4tZG93bmV5LTExNSJ9.b6zWrrZ2lusz2wdXMlOvEY2uAllIeSVPxDkE6WkV0pw HTTP 301
- https://llcty.javalgbalza.xyz/gateway.php?frm=dm&token=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1cmwiOiJcL2Fkej9wPTYtdWstZG93bmV5JmI9YjQyc2cmcz1kczAxeWEmb2Y9YWxsJm49bWFyMDVzRU4tZG93bmV5LTExNSJ9.b6zWrrZ2lusz2wdXMlOvEY2uAllIeSVPxDkE6WkV0pw
26 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
neyatiquyy1y7-ibsuno-orwoec
llcty.javalgbalza.xyz/ |
364 B 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
gateway.php
llcty.javalgbalza.xyz/ Redirect Chain
|
342 B 418 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
/
basdiegoosust.top/snntv/4mask/ Redirect Chain
|
21 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
basdiegoosust.top/snntv/4mask/ |
119 KB 18 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
font-awesome.css
basdiegoosust.top/snntv/4mask/ |
36 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.css
basdiegoosust.top/snntv/4mask/ |
8 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
comments.css
basdiegoosust.top/snntv/4mask/ |
4 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.3.1/ |
85 KB 30 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
firebase.js
www.gstatic.com/firebasejs/3.6.8/ |
294 KB 97 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
firebase_subscribe.js
megafastpush.com/js/ |
3 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fintips_logo_bright@4x.png
basdiegoosust.top/snntv/4mask/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
elon_hero.jpg
basdiegoosust.top/snntv/4mask/ |
135 KB 135 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
elon_2.jpg
basdiegoosust.top/snntv/4mask/ |
60 KB 60 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
millionaire_secret_thumb.jpg
basdiegoosust.top/snntv/4mask/ |
16 KB 16 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
29yo_thumb.jpg
basdiegoosust.top/snntv/4mask/ |
18 KB 18 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
work-from-home_thumb.jpg
basdiegoosust.top/snntv/4mask/ |
19 KB 19 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
avatar.png
basdiegoosust.top/snntv/4mask/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fintips_logo_dark@4x.png
basdiegoosust.top/snntv/4mask/ |
6 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
basdiegoosust.top/snntv/4mask/ |
85 KB 29 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fixto.min.js
basdiegoosust.top/snntv/4mask/ |
9 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
scripts.js
basdiegoosust.top/snntv/4mask/ |
1 KB 709 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css.css
basdiegoosust.top/snntv/4mask/ |
14 KB 975 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-Q050 |
6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2
fonts.gstatic.com/s/sourcesanspro/v11/ |
16 KB 16 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-Q050 |
u-440qyriQwlOrhSvowK_l5-fCZM.woff2
fonts.gstatic.com/s/merriweather/v19/ |
18 KB 19 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-Q050 |
6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v11/ |
15 KB 15 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fontawesome-webfont.woff2
basdiegoosust.top/snntv/4mask/ |
75 KB 76 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Crypto (Crypto Exchange)16 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| trustedTypes string| mybp function| $ function| jQuery object| firebase function| __extends function| __decorate function| __metadata function| __param function| __awaiter undefined| messaging function| subscribe function| sendTokenToServer function| isTokenSentToServer function| setTokenSentToServer object| fixto1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.basdiegoosust.top/ | Name: __cfduid Value: d3b6946f57ab410fe80b26e184834aa791601857232 |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Content-Type-Options | nosniff |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
basdiegoosust.top
eqoq.ilkerdikme.com
fonts.gstatic.com
llcty.javalgbalza.xyz
megafastpush.com
www.gstatic.com
zuzz.adamcoitd.com
104.27.154.237
104.31.73.42
157.230.127.24
172.67.142.120
172.67.166.29
2a00:1450:4001:806::2003
2a00:1450:4001:809::200a
2a00:1450:4001:824::2003
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
25d8e661ee6c6961bead620b6bdac082d49836fd2a7e2eff8c1c47e10a7e2986
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
2dc08fd6ff155de6997e6de400a8f008a6d9b1d7bced0d4ea3bd769e80ecf432
41c8871d281fe25d8ad6e8d5558025cf1b84ddd6020538fbbf23241ea47b09d2
53adac8847f77b5b72b3e9854aec655babaef178a420acef7263449a46e1816c
54b2c98f3fed8808805f4b4acb4dba887882474fd24b637e7ec55bb652f7fad0
5d68df0af7b07aea0e12b811f623f595b73860ed69e70793b4244146abe9ba2e
65018b34848eb6741d45d2b003c3aeec4c8456d9c4da4d680593c1af935c190b
6c181393ca5c9654fbf43199d606bd79c2760b0e91d5d8d7e93b10aa45bcf71e
7e9e4f90f03b2f453d368920b3c02bff1e29f0adf180618a68b1229e41362dfe
8196a199b4d94464d93ad792a9e48bf852c6bf2200e5f07cce96ee65d279d891
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
93a3f8ce7cec2ac6e2e01b0a2ef0b38229b186aa7aeb0eef01a112287238811b
9b0ef16ee948692f65e629582ca253243a75766018cdb95d01d88dbe6478c7e8
a45828948140ae2a503c32314a972210a567d99f8798081643c5876bd76b93bd
c09055f0d3ce5ac45f886c935226d1e4cb0f7488525e9f8b298f26fc0171e5a8
c38f9be92867b97e1a7c65d283ba840903c87ebe34842f7c65fe6998f3f9c6d1
c45e52b0991d6818b6289fb3a0fffd2b4c42a7d783d93663daa24250814cd59c
ca61695b1a98fdb8cbea99e37de798d43723408c4ced92b6a34725f8958d1074
cb992eae898417162c48b37712991d9ad8053c4a64fce51aff195edc69dc35f2
ce73e0b7673fe802be78c6e47b507bd415ad88d5768e6e94e961d79cdb42def1
d291a99807a8821c97bd0ec0f0fac20c8191bba4e92ec6de9fbe5debaaa47a2a
e46e31dd135f7e538c95a670fe0e8d0f71cc841048459bdc8f77c489227f918f
ee46998e4527bc0c4b66819eaf54b0521e29bb3a9b41c820ceeaa563f8f9ac43
f3e4b089d70c29544cc71899286e1df077a4205f47e83586f57dfc4e18231f1e