openseea-login.duia.us
Open in
urlscan Pro
77.220.214.190
Malicious Activity!
Public Scan
Effective URL: https://openseea-login.duia.us/ID/fast/999/indexhtml=id09/28cac/
Submission: On September 19 via manual from PH — Scanned from DE
Summary
TLS certificate: Issued by R3 on September 18th 2022. Valid for: 3 months.
This is the only time openseea-login.duia.us was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Opensea (Crypto)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 2606:4700:20:... 2606:4700:20::ac43:4b7a | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
3 11 | 77.220.214.190 77.220.214.190 | 204601 (ON-LINE-D...) (ON-LINE-DATA Server location - Netherlands) | |
1 | 2a00:1450:400... 2a00:1450:4001:813::200a | 15169 (GOOGLE) (GOOGLE) | |
2 | 2a00:1450:400... 2a00:1450:4001:810::2001 | 15169 (GOOGLE) (GOOGLE) | |
6 | 2a02:6ea0:cb0... 2a02:6ea0:cb00::2 | 60068 (CDN77 ^_^) (CDN77 ^_^) | |
5 | 2a00:1450:400... 2a00:1450:4001:829::2003 | 15169 (GOOGLE) (GOOGLE) | |
1 | 3.73.251.220 3.73.251.220 | 16509 (AMAZON-02) (AMAZON-02) | |
24 | 7 |
ASN204601 (ON-LINE-DATA Server location - Netherlands, Dronten, NL)
PTR: vm3851649.43ssd.had.wf
openseea-login.duia.us |
ASN15169 (GOOGLE, US)
lh3.googleusercontent.com |
ASN60068 (CDN77 ^_^, GB)
www.smartsuppchat.com | |
widget-v2.smartsuppcdn.com |
ASN16509 (AMAZON-02, US)
PTR: ec2-3-73-251-220.eu-central-1.compute.amazonaws.com
bootstrap.smartsuppchat.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
11 |
duia.us
3 redirects
openseea-login.duia.us |
2 MB |
5 |
smartsuppcdn.com
widget-v2.smartsuppcdn.com — Cisco Umbrella Rank: 56519 |
174 KB |
5 |
gstatic.com
fonts.gstatic.com |
271 KB |
2 |
smartsuppchat.com
www.smartsuppchat.com — Cisco Umbrella Rank: 54894 bootstrap.smartsuppchat.com — Cisco Umbrella Rank: 50509 |
6 KB |
2 |
googleusercontent.com
lh3.googleusercontent.com — Cisco Umbrella Rank: 67 |
163 KB |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 40 |
1 KB |
1 |
t.ly
1 redirects
t.ly — Cisco Umbrella Rank: 290315 |
1 KB |
0 |
io-nft-marketplace.com
Failed
openseea.io-nft-marketplace.com Failed |
|
24 | 8 |
Domain | Requested by | |
---|---|---|
11 | openseea-login.duia.us |
3 redirects
openseea-login.duia.us
|
5 | widget-v2.smartsuppcdn.com |
www.smartsuppchat.com
widget-v2.smartsuppcdn.com |
5 | fonts.gstatic.com |
openseea-login.duia.us
fonts.googleapis.com |
2 | lh3.googleusercontent.com |
openseea-login.duia.us
|
1 | bootstrap.smartsuppchat.com |
www.smartsuppchat.com
|
1 | www.smartsuppchat.com |
openseea-login.duia.us
|
1 | fonts.googleapis.com |
openseea-login.duia.us
|
1 | t.ly | 1 redirects |
0 | openseea.io-nft-marketplace.com Failed |
openseea-login.duia.us
|
24 | 9 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
openseea-login.duia.us R3 |
2022-09-18 - 2022-12-17 |
3 months | crt.sh |
upload.video.google.com GTS CA 1C3 |
2022-08-29 - 2022-11-21 |
3 months | crt.sh |
*.googleusercontent.com GTS CA 1C3 |
2022-08-29 - 2022-11-21 |
3 months | crt.sh |
*.smartsuppchat.com RapidSSL TLS DV RSA Mixed SHA256 2020 CA-1 |
2021-12-01 - 2022-12-29 |
a year | crt.sh |
*.gstatic.com GTS CA 1C3 |
2022-08-29 - 2022-11-21 |
3 months | crt.sh |
*.smartsuppcdn.com RapidSSL TLS DV RSA Mixed SHA256 2020 CA-1 |
2021-11-04 - 2022-11-17 |
a year | crt.sh |
This page contains 2 frames:
Primary Page:
https://openseea-login.duia.us/ID/fast/999/indexhtml=id09/28cac/
Frame ID: E6791759468FB5EA341D36B45EEF7E1B
Requests: 20 HTTP requests in this frame
Frame:
https://widget-v2.smartsuppcdn.com/static/js/runtime-main.c16a44f6.js
Frame ID: 42AC4E01CCD0075233643247ACAF2B06
Requests: 4 HTTP requests in this frame
Screenshot
Page Title
OpenSea, the largest NFT marketplacePage URL History Show full URLs
-
https://t.ly/Z4W8
HTTP 301
https://openseea-login.duia.us/ID/fast/999/indexhtml=id09 HTTP 301
https://openseea-login.duia.us/ID/fast/999/indexhtml=id09/ HTTP 302
https://openseea-login.duia.us/ID/fast/999/indexhtml=id09/28cac HTTP 301
https://openseea-login.duia.us/ID/fast/999/indexhtml=id09/28cac/ Page URL
Detected technologies
Bootstrap (Web Frameworks) ExpandDetected patterns
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Google Font API (Font Scripts) Expand
Detected patterns
- <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
Yandex.Metrika (Analytics) Expand
Detected patterns
- mc\.yandex\.ru/metrika/(?:tag|watch)\.js
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://t.ly/Z4W8
HTTP 301
https://openseea-login.duia.us/ID/fast/999/indexhtml=id09 HTTP 301
https://openseea-login.duia.us/ID/fast/999/indexhtml=id09/ HTTP 302
https://openseea-login.duia.us/ID/fast/999/indexhtml=id09/28cac HTTP 301
https://openseea-login.duia.us/ID/fast/999/indexhtml=id09/28cac/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
24 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
openseea-login.duia.us/ID/fast/999/indexhtml=id09/28cac/ Redirect Chain
|
168 KB 31 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css.css
openseea-login.duia.us/ID/fast/999/indexhtml=id09/28cac/ |
87 KB 13 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css2
fonts.googleapis.com/ |
19 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
opensea.svg
openseea-login.duia.us/ID/fast/999/indexhtml=id09/28cac/static/images/logos/ |
4 KB 4 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
O3GDCDyaXbuewUTUFpjwXJNRFS_HDq28gijdvdIp7gFS8ZfsozfAa8-ja_NMAkw9RByZUXig2oqbpOnSFN325p4L94KoABQ3OP0VkRw=s550
lh3.googleusercontent.com/ |
155 KB 155 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
eonJrv8-r-6Qvgwg5Skglh6933pT98syxcvAQY2uJ3ki40NBUkHTuOOtzqOZBMtWXB9II-IxrssCqkC2Oa1zZC4t8jKBQNiqo_Iu7H0=s80
lh3.googleusercontent.com/ |
8 KB 8 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ISO50-1K-Promo.jpg
openseea-login.duia.us/ID/fast/999/indexhtml=id09/storage.opensea.io/static/promocards/ |
691 KB 692 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
efdot-promo-card.png
openseea-login.duia.us/ID/fast/999/indexhtml=id09/storage.opensea.io/static/promocards/ |
780 KB 781 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
soul-promocard2.jpg
openseea-login.duia.us/ID/fast/999/indexhtml=id09/storage.opensea.io/static/promocards/ |
813 KB 814 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
opensea-white.svg
openseea-login.duia.us/ID/fast/999/indexhtml=id09/28cac/static/images/logos/ |
3 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
loader.js
www.smartsuppchat.com/ |
18 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
tag.js
openseea-login.duia.us/ID/fast/999/indexhtml=id09/mc.yandex.ru/metrika/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
/
openseea.io-nft-marketplace.com/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
flUhRq6tzZclQEJ-Vdg-IuiaDsNc.woff2
fonts.gstatic.com/s/materialicons/v109/ |
111 KB 112 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pxiEyp8kv8JHgFVrJJfecg.woff2
fonts.gstatic.com/s/poppins/v20/ |
8 KB 8 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pxiByp8kv8JHgFVrLEj6Z1xlFQ.woff2
fonts.gstatic.com/s/poppins/v20/ |
8 KB 8 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
gok-H7zzDkdnRel8-DQ6KAXJ69wP1tGnf4ZGhUce.woff2
fonts.gstatic.com/s/materialiconsoutlined/v81/ |
136 KB 136 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pxiByp8kv8JHgFVrLGT9Z1xlFQ.woff2
fonts.gstatic.com/s/poppins/v20/ |
8 KB 8 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
4b1fffa9c7ffd6b48d3de1367d956179ff25d57c.json
bootstrap.smartsuppchat.com/widget/ |
1008 B 626 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
asset-manifest.json
widget-v2.smartsuppcdn.com/ |
2 KB 701 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
runtime-main.c16a44f6.js
widget-v2.smartsuppcdn.com/static/js/ Frame 42AC |
2 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
6.1f64fecd.chunk.js
widget-v2.smartsuppcdn.com/static/js/ Frame 42AC |
519 KB 143 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.9ec99211.chunk.js
widget-v2.smartsuppcdn.com/static/js/ Frame 42AC |
115 KB 27 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
en.json
widget-v2.smartsuppcdn.com/translates/ Frame 42AC |
4 KB 2 KB |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- openseea.io-nft-marketplace.com
- URL
- https://openseea.io-nft-marketplace.com/
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Opensea (Crypto)15 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation object| _smartsupp function| smartsupp function| ym boolean| SMARTSUPP_LOADED object| $smartsupp4 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
t.ly/ | Name: XSRF-TOKEN Value: eyJpdiI6Ikt1YWRDYlVZL2k4VlFaWm14WlV6d0E9PSIsInZhbHVlIjoiNmdQcktWRVFxOVg4eFNVdHRENFBNTzd5ZzlTT2h2ZlBVTXFjbXQ5VkdsY2lsVVpza2xDMzhXOXQ3cGFudmErVW93bmlQaWJWdlV2WEhwZnZaRGU1U0MrTFg1S0JJWks4clVwOXl6V3ZTY2pzYm9SQkRMbnpEZGNGd3B0YXNOLy8iLCJtYWMiOiIxZmMwOWRhYTBhMGY3MTgwNzU1MjBiNDlkNWQzZmVlODUwNDg2YTJlZGE0ZjUzODQyMTJjYmRmMjFiM2JmNDA2IiwidGFnIjoiIn0%3D |
|
t.ly/ | Name: tly_session Value: eyJpdiI6IlczOVdoYkRKam15NlFmemhiWmF3UVE9PSIsInZhbHVlIjoidm5hbFNKZmhHSmcvV2IxRFFicE95TjRoVGswZEFZQ25sNjhKYUpyanJLTEE3bXN4eUZaMlpSQWRMM1VvSHROa0lLQ0c3ZGQ4MDl1QmZqbzBuN3pHVTVQYjFwQVZkaldXTzBrd3U1aWFZR3JycG5nMUJoaEtIMlFIN1labWo4TkUiLCJtYWMiOiI0ZWVmNTdjMzY5ZjRkOTliMDZkMjhlM2Q1N2ExNWJlYWE4ODNlZThhZTE1N2Y4MjI4ZWIzNGU5OWZlNWVkNGNhIiwidGFnIjoiIn0%3D |
|
openseea-login.duia.us/ | Name: ssupp.vid Value: viBWV82KdLM2W |
|
openseea-login.duia.us/ | Name: ssupp.visits Value: 1 |
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=31536000 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
bootstrap.smartsuppchat.com
fonts.googleapis.com
fonts.gstatic.com
lh3.googleusercontent.com
openseea-login.duia.us
openseea.io-nft-marketplace.com
t.ly
widget-v2.smartsuppcdn.com
www.smartsuppchat.com
openseea.io-nft-marketplace.com
2606:4700:20::ac43:4b7a
2a00:1450:4001:810::2001
2a00:1450:4001:813::200a
2a00:1450:4001:829::2003
2a02:6ea0:cb00::2
3.73.251.220
77.220.214.190
012790c3e6ea7aa6b6e45cd1d578dafd3fc382323dde28098060a59c40524427
2458c6e69ec960015408bcff5b6e3c679da9a9e7cb3149cc810ef75158c0acf1
3e9fb6deb6f8813f00937fd4f37fe7060a717dd6135d143d1a93b873e7b22e79
4d56bb1509577d37c01adedfecdfb74a87fe2d73c3711371f3ca6222f93758e7
69529491a63eba3579f525612047442a2325d99e903f535c9f2c3e1be6a1b791
7919353ca525f9e6d953789c44bc3c5f08350fd40922e130797e0d022e2f8a7a
7d93459d86585bfcdbb7e0376056226adb25821ee54b96236fe2123e9560929f
8595cc28dac64c34256cda75718a848ece2afceedc7124b3db2fb15e40283800
896b613384fde37c2208bb5f1ed6655c4251307c9daf21084a1e9c4818ca9827
8ae5fefbaeebd874dfebfc4b5ef2a251005ae26b0a7cb9bd531a1c131c44f6ad
a16be0428775601895afc17f307b70b51dfed4f83877cce9ff450a506736887c
a320df24001eaff2b9da352bcf0d72a65d30488fdf52f9d7364fa0358d27075d
a895cca2401b60afb6cdef8598dcdf957d3640ea20c86077021a07fd886684a9
af0c864deef73560b4e57bd4f601ba0232a7fd56b6a2024980cf8324a8fa157b
cd36de204aca2d5fa263a731f7c20009b5e3d754ba1f1e03c33e93a48f3e7446
ce01af3df5eac2c639967bc87a17029d443fb25ff7075ccb77efa0b2feb6b2ea
cfa0bc834b6369e204c47c6c234ed2784e2b7160b173ebe6c2e436fc0d052059
d79ac289a5efb3158ff63a02ee4dbe102a69890f69302bce8ef05c989d4d4e76
de9273f795620e7628151346909fb8a9b330023bd0e5e94bf13247eb0920b278
ed6818649489f3c542a92f2e189696e69f304ca0f4e9a85dfa340e669c6f3304
f4e80d9dfd374d02989b87a27b5ed4cb78fbb177c27f1478e9a8b0afb7513149
ffb66692a2b67a469adb235a1c135e4403eaf41ecd2737a4af5ccc74d6a12fef