accounts.binancezh.sh
Open in
urlscan Pro
170.33.8.8
Malicious Activity!
Public Scan
Effective URL: https://accounts.binancezh.sh/zh-CN/register?ref=141191314
Submission: On July 21 via api from US
Summary
TLS certificate: Issued by RapidSSL TLS DV RSA Mixed SHA256 2020... on May 10th 2021. Valid for: a year.
This is the only time accounts.binancezh.sh was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Crypto (Crypto Exchange)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 2 | 185.199.108.153 185.199.108.153 | 54113 (FASTLY) (FASTLY) | |
1 | 170.33.8.8 170.33.8.8 | 134963 (ASEPL-AS-...) (ASEPL-AS-AP Alibaba.com Singapore E-Commerce Private Limited) | |
16 | 101.33.11.110 101.33.11.110 | 132203 (TENCENT-N...) (TENCENT-NET-AP-CN Tencent Building) | |
2 | 2a00:1450:400... 2a00:1450:4001:80f::200e | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:828::2008 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:400c:c04::9b | 15169 (GOOGLE) (GOOGLE) | |
1 | 34.120.195.249 34.120.195.249 | 15169 (GOOGLE) (GOOGLE) | |
23 | 7 |
ASN54113 (FASTLY, US)
PTR: cdn-185-199-108-153.github.com
wangyuliang8848.github.io | |
bian.blue |
ASN134963 (ASEPL-AS-AP Alibaba.com Singapore E-Commerce Private Limited, SG)
accounts.binancezh.sh |
ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN)
static-file-1259603563.file.myqcloud.com |
ASN15169 (GOOGLE, US)
www.google-analytics.com |
ASN15169 (GOOGLE, US)
www.googletagmanager.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
16 |
myqcloud.com
static-file-1259603563.file.myqcloud.com |
717 KB |
2 |
google-analytics.com
www.google-analytics.com |
19 KB |
1 |
sentry.io
o529943.ingest.sentry.io |
249 B |
1 |
doubleclick.net
stats.g.doubleclick.net |
91 B |
1 |
googletagmanager.com
www.googletagmanager.com |
36 KB |
1 |
binancezh.sh
accounts.binancezh.sh |
28 KB |
1 |
bian.blue
bian.blue |
996 B |
1 |
github.io
1 redirects
wangyuliang8848.github.io |
231 B |
23 | 8 |
Domain | Requested by | |
---|---|---|
16 | static-file-1259603563.file.myqcloud.com |
accounts.binancezh.sh
static-file-1259603563.file.myqcloud.com |
2 | www.google-analytics.com |
accounts.binancezh.sh
www.google-analytics.com |
1 | o529943.ingest.sentry.io |
static-file-1259603563.file.myqcloud.com
|
1 | stats.g.doubleclick.net |
www.google-analytics.com
|
1 | www.googletagmanager.com |
accounts.binancezh.sh
|
1 | accounts.binancezh.sh |
bian.blue
|
1 | bian.blue | |
1 | wangyuliang8848.github.io | 1 redirects |
23 | 8 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.binancezh.sh RapidSSL TLS DV RSA Mixed SHA256 2020 CA-1 |
2021-05-10 - 2022-05-10 |
a year | crt.sh |
*.cdn.myqcloud.com TrustAsia TLS RSA CA |
2020-11-18 - 2021-11-17 |
a year | crt.sh |
*.google-analytics.com GTS CA 1C3 |
2021-06-22 - 2021-09-14 |
3 months | crt.sh |
*.g.doubleclick.net GTS CA 1C3 |
2021-06-28 - 2021-09-20 |
3 months | crt.sh |
*.ingest.sentry.io R3 |
2021-06-26 - 2021-09-24 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://accounts.binancezh.sh/zh-CN/register?ref=141191314
Frame ID: DB17B5A8CB9884222DA6A7CDCA295BFE
Requests: 23 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://wangyuliang8848.github.io/
HTTP 301
http://bian.blue/ Page URL
- https://accounts.binancezh.sh/zh-CN/register?ref=141191314 Page URL
Detected technologies
Ruby (Programming Languages) ExpandDetected patterns
- url /^https?:\/\/[^/]+\.github\.io\//i
- headers server /^GitHub\.com$/i
Varnish (Cache Tools) Expand
Detected patterns
- headers via /varnish(?: \(Varnish\/([\d.]+)\))?/i
Ruby on Rails (Web Frameworks) Expand
Detected patterns
- url /^https?:\/\/[^/]+\.github\.io\//i
- headers server /^GitHub\.com$/i
GitHub Pages (CDN) Expand
Detected patterns
- url /^https?:\/\/[^/]+\.github\.io\//i
- headers server /^GitHub\.com$/i
Google Analytics (Analytics) Expand
Detected patterns
- script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://wangyuliang8848.github.io/
HTTP 301
http://bian.blue/ Page URL
- https://accounts.binancezh.sh/zh-CN/register?ref=141191314 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://wangyuliang8848.github.io/ HTTP 301
- http://bian.blue/
23 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
/
bian.blue/ Redirect Chain
|
441 B 996 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
register
accounts.binancezh.sh/zh-CN/ |
96 KB 28 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
a29ae703.38fee879.js
static-file-1259603563.file.myqcloud.com/static/chunks/ |
59 KB 19 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
page-ef7e.a1e51bf3.js
static-file-1259603563.file.myqcloud.com/static/chunks/ |
1 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
index.min.css
static-file-1259603563.file.myqcloud.com/static/fonts/ |
1 KB 884 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
font.min.css
static-file-1259603563.file.myqcloud.com/static/fonts/ |
12 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
analytics.js
www.google-analytics.com/ |
48 KB 19 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
nav-logo.svg
static-file-1259603563.file.myqcloud.com/static/images/common/ |
3 KB 4 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
gtm.js
www.googletagmanager.com/ |
95 KB 36 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
react.production.16.13.0.js
static-file-1259603563.file.myqcloud.com/static/runtime/react/ |
12 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
react-dom.production.16.13.0.js
static-file-1259603563.file.myqcloud.com/static/runtime/react-dom/ |
116 KB 38 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
polyfill-0b9d41947fabadf834c4.js
static-file-1259603563.file.myqcloud.com/static/runtime/ |
143 KB 48 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
webpack-d9d65c14ea2f902cd05e.js
static-file-1259603563.file.myqcloud.com/static/runtime/ |
4 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
framework.542789f8.js
static-file-1259603563.file.myqcloud.com/static/chunks/ |
30 KB 9 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
2edb282b.ff11f2df.js
static-file-1259603563.file.myqcloud.com/static/chunks/ |
70 KB 25 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
commons.a79f0cc3.js
static-file-1259603563.file.myqcloud.com/static/chunks/ |
1 MB 319 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sentry-3f2b1ef218ac5eb28951.js
static-file-1259603563.file.myqcloud.com/static/runtime/ |
157 B 748 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main-357fa58e8303b8f888e4.js
static-file-1259603563.file.myqcloud.com/static/runtime/ |
486 KB 150 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3-29 |
collect
www.google-analytics.com/j/ |
4 B 24 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
stats.g.doubleclick.net/j/ |
1 B 91 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
BinancePlex-Regular.woff2
static-file-1259603563.file.myqcloud.com/static/fonts/bp/ |
43 KB 44 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
BinancePlex-Medium.woff2
static-file-1259603563.file.myqcloud.com/static/fonts/bp/ |
46 KB 47 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
/
o529943.ingest.sentry.io/api/5762379/envelope/ |
2 B 249 B |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Crypto (Crypto Exchange)40 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated string| search object| regexp object| params function| ga string| gaFilterExp string| paramsString object| dataLayer object| google_tag_data object| gaplugins object| gaGlobal object| gaData object| google_tag_manager object| React object| ReactDOM string| __shuvi_ssr_public_path__ object| webpackChunkaccounts_ui function| setImmediate function| clearImmediate object| regeneratorRuntime object| __SENTRY__ object| Sentry object| Integrations object| Base64 function| BridgeReceiveEvent boolean| __accelerate_compoleted boolean| ___bncPerformanceRegistered function| _ object| __SHUVI6 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.binancezh.sh/ | Name: lang Value: zh-cn |
|
.binancezh.sh/ | Name: bnc-uuid Value: 1e62110d-d070-4de5-8173-5a2ffabdcd88 |
|
.binancezh.sh/ | Name: _gat Value: 1 |
|
.binancezh.sh/ | Name: _gid Value: GA1.2.249495286.1626858396 |
|
.binancezh.sh/ | Name: _ga Value: GA1.2.825495730.1626858396 |
|
accounts.binancezh.sh/ | Name: aliyungf_tc Value: 70c6778648c76f0c454c1ee03fcf77257f0b07b930ef7288e02ff3970505339d |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
accounts.binancezh.sh
bian.blue
o529943.ingest.sentry.io
static-file-1259603563.file.myqcloud.com
stats.g.doubleclick.net
wangyuliang8848.github.io
www.google-analytics.com
www.googletagmanager.com
101.33.11.110
170.33.8.8
185.199.108.153
2a00:1450:4001:80f::200e
2a00:1450:4001:828::2008
2a00:1450:400c:c04::9b
34.120.195.249
14db4ca6b522ff67b02d2132a94ce107339e2f99b393ba5c847a7dbcdc705128
1b19af9dfbb00701982ed326bba457a627f92cbd6aae62d16ba206bffd2c6a86
1bf4f3037f4ba06cf9785caf053901b435eed7950231fa043f04b8eaf2dd2bb9
2f1cb83ea3e20b97f6add1df3ae9b2e14e99ee05b6437422a43359d6a89d0a45
312363d983254a0c07d34d8c639d1eda2ec7f06864ced5a3c146bf209e79a698
3da82fa28f665264359f207aa6520b129ac94c5a6e1aaa04c29989cd351cfe65
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
551ff1dbd0df95853706e675f7627394eb5613cc51f68683258567ecba12a996
576f81d46f7afc90670787c58b97f7be12e6330c2a1da697be0704550218e5a1
5de13a8123aca52bbeee3a19ed0ba2b04c7ef1d19f6aa56171393d5d979aa2fd
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6e3438d9a73710dd06a8ae34a42f601a2fd88b1bcac99db8a8c3fff478865bbc
739f5b8afb10a2c9c8bf79ad1f79752745ddf3b336acc8f717ac167aea7b76db
73d6a5ea11fb7bf6e6a6ccd44b1635d52c79b0a00623d0387c9dddd4b7c68e89
753815555234c3a3a15d19b0eab23c8f1115a96b725ef6706c89c9935d0f95d5
7619529d2ecdd660ad9d274119649bd2bdae601dac4420690e65cdaaef83eeb5
7e2ba95dde6318691998c0924ef863d54254c6fec96b2d17e8d8d6db6f3d34a4
9d2f46a87f9a45e1919c8f142dd1fad49053913f7593035656bea571357fa171
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
d0799a576cdf0fadd4683e5775f08bdce41d0cf7b262886173c56bbec9e46a4c
d9d20ebb5a1655cf08741c38aaa26ff5991ab358d4aed88398e29505a739d1af
df61a6c39ac10d7c8c8e0ffbdc5829ba4a1365d32bc6e616eed8fc69d6cdf33e
eb214b548ceae3c938cb8f90990e456e7d2b978ffee0e599c2c7dc93d373ec5a