csgo-mapclean.execellent.com
Open in
urlscan Pro
2a06:98c1:3120::3
Malicious Activity!
Public Scan
Submission Tags: phishingrod
Submission: On December 27 via api from DE — Scanned from NL
Summary
TLS certificate: Issued by E1 on December 27th 2023. Valid for: 3 months.
This is the only time csgo-mapclean.execellent.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Steam (Gaming)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
3 | 2a06:98c1:312... 2a06:98c1:3120::3 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
5 | 2606:4700::68... 2606:4700::6810:5614 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 76.76.21.123 76.76.21.123 | 16509 (AMAZON-02) (AMAZON-02) | |
3 | 2606:4700::68... 2606:4700::6810:3965 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 104.18.42.105 104.18.42.105 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 114.80.179.231 114.80.179.231 | 4812 (CHINANET-...) (CHINANET-SH-AP China Telecom Group) | |
1 | 58.253.212.197 58.253.212.197 | 17816 (CHINA169-...) (CHINA169-GZ China Unicom IP network China169 Guangdong province) | |
1 | 120.52.95.241 120.52.95.241 | 133119 (UNICOM-CN...) (UNICOM-CN China Unicom IP network) | |
1 | 101.32.192.8 101.32.192.8 | 132203 (TENCENT-N...) (TENCENT-NET-AP-CN Tencent Building) | |
17 | 9 |
ASN13335 (CLOUDFLARENET, US)
static.cloudflareinsights.com | |
cloudflareinsights.com |
ASN17816 (CHINA169-GZ China Unicom IP network China169 Guangdong province, CN)
bbs.zombieden.cn |
ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN)
bbs.upkk.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
5 |
jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 313 |
211 KB |
3 |
cloudflareinsights.com
static.cloudflareinsights.com — Cisco Umbrella Rank: 864 cloudflareinsights.com — Cisco Umbrella Rank: 842 |
7 KB |
3 |
execellent.com
csgo-mapclean.execellent.com |
140 KB |
1 |
upkk.com
bbs.upkk.com |
1 KB |
1 |
moeub.cn
csgo.moeub.cn |
4 KB |
1 |
zombieden.cn
bbs.zombieden.cn |
|
1 |
fyscs.com
fyscs.com |
7 KB |
1 |
steamstatic.com
cdn.cloudflare.steamstatic.com — Cisco Umbrella Rank: 14701 |
2 KB |
1 |
vercel.app
steamcard.vercel.app |
38 KB |
17 | 9 |
Domain | Requested by | |
---|---|---|
5 | cdn.jsdelivr.net |
csgo-mapclean.execellent.com
cdn.jsdelivr.net |
3 | csgo-mapclean.execellent.com |
csgo-mapclean.execellent.com
cdn.jsdelivr.net |
2 | cloudflareinsights.com |
static.cloudflareinsights.com
|
1 | bbs.upkk.com | |
1 | csgo.moeub.cn | |
1 | bbs.zombieden.cn | |
1 | fyscs.com | |
1 | cdn.cloudflare.steamstatic.com | |
1 | static.cloudflareinsights.com |
csgo-mapclean.execellent.com
|
1 | steamcard.vercel.app |
csgo-mapclean.execellent.com
|
17 | 10 |
This site contains links to these domains. Also see Links.
Domain |
---|
github.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
csgo-mapclean.execellent.com E1 |
2023-12-27 - 2024-03-26 |
3 months | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2023-05-02 - 2024-05-01 |
a year | crt.sh |
*.vercel.app R3 |
2023-12-15 - 2024-03-14 |
3 months | crt.sh |
fyscs.com Encryption Everywhere DV TLS CA - G1 |
2023-05-13 - 2024-05-12 |
a year | crt.sh |
bbs.zombieden.cn TrustAsia RSA DV TLS CA G2 |
2023-01-27 - 2024-01-27 |
a year | crt.sh |
moeub.cn ZeroSSL RSA Domain Secure Site CA |
2023-11-09 - 2024-02-07 |
3 months | crt.sh |
bbs.upkk.com TrustAsia RSA DV TLS CA G2 |
2023-02-14 - 2024-03-15 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://csgo-mapclean.execellent.com/
Frame ID: E505CCCAABFBB6361B4E53EF7FCB08A3
Requests: 16 HTTP requests in this frame
Screenshot
Detected technologies
Vue.js (JavaScript Frameworks) ExpandDetected patterns
- (?:/([\d.]+))?/vue(?:\.min)?\.js
Axios (JavaScript libraries) Expand
Detected patterns
- /axios(@|/)([\d.]+)(?:/[a-z]+)?/axios(?:.min)?\.js
Cloudflare Browser Insights (Analytics) Expand
Detected patterns
- static\.cloudflareinsights\.com/beacon(?:\.min)?\.js
jsDelivr (CDN) Expand
Detected patterns
- <link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
- //cdn\.jsdelivr\.net/
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: github
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
17 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
csgo-mapclean.execellent.com/ |
18 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mdui.min.css
cdn.jsdelivr.net/npm/mdui@1.0.2/dist/css/ |
318 KB 34 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dark,badge,group
steamcard.vercel.app/card/76561199062253455/ |
53 KB 38 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
email-decode.min.js
csgo-mapclean.execellent.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/ |
1 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mdui.min.js
cdn.jsdelivr.net/npm/mdui@1.0.2/dist/js/ |
72 KB 22 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
vue.js
cdn.jsdelivr.net/npm/vue@2/dist/ |
425 KB 104 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
axios.min.js
cdn.jsdelivr.net/npm/axios@0.27.2/dist/ |
20 KB 8 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
beacon.min.js
static.cloudflareinsights.com/ |
20 KB 7 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
MaterialIcons-Regular.woff2
cdn.jsdelivr.net/npm/mdui@1.0.2/dist/icons/material-icons/ |
43 KB 44 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
maps.json
csgo-mapclean.execellent.com/ |
1006 KB 134 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H2 |
rum
cloudflareinsights.com/cdn-cgi/ |
0 0 |
Preflight
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
rum
cloudflareinsights.com/cdn-cgi/ |
0 36 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
69f7ebe2735c366c65c0b33dae00e12dc40edbe4.jpg
cdn.cloudflare.steamstatic.com/steamcommunity/public/images/apps/730/ |
1 KB 2 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
favicon.ico
fyscs.com/ |
7 KB 7 KB |
Image
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
favicon.ico
bbs.zombieden.cn/ |
0 0 |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
moeub_logo.svg
csgo.moeub.cn/ |
3 KB 4 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
favicon.ico
bbs.upkk.com/ |
1 KB 1 KB |
Image
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Steam (Gaming)7 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| documentPictureInPicture object| mdui function| Vue function| axios object| app number| _mduiEventId object| __cfBeacon0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Content-Type-Options | nosniff |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
bbs.upkk.com
bbs.zombieden.cn
cdn.cloudflare.steamstatic.com
cdn.jsdelivr.net
cloudflareinsights.com
csgo-mapclean.execellent.com
csgo.moeub.cn
fyscs.com
static.cloudflareinsights.com
steamcard.vercel.app
101.32.192.8
104.18.42.105
114.80.179.231
120.52.95.241
2606:4700::6810:3965
2606:4700::6810:5614
2a06:98c1:3120::3
58.253.212.197
76.76.21.123
1c2fda3c0aed39cef2c3ad98701cc6db8b095e35c9bb46adba3661f5ae0bb54c
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
36b10d3b4920592a4ec26c064c429e9a3dfb4689235fdfc91e1736b681c76786
6153d13804862b0fc1c016cf1129f34cb7c6185f2cf4bf1a3a862eecdab50101
6de0a1dda3bdbeffc1e0a71cddeb0355d9b1ed6832afaa9daa0dc3d458e11aff
7846647446e9e1e173f024754b0bb8dfbfc61da1d9196ccd15764ca033abd0d9
891804a155e1cddac46ee3eee88326bfaf41247b0578396e66f63879a63244d3
a50321aede22fb162e6737ca6e85d31369675c371c67ca88d8587c8321ad5fa4
a87d66c91b2e7dc5530aef76c03bd6a3d25ea5826110bf4803b561b811cc8726
aa8d94f3f9e6c26ac99adbb14fa0c2426a5c03f321df8393c0fce4d0d50ec4af
b13ba298064a23f96a0cae5c50b57347457cd3bba2c1f6c6ee05e4c8ca291f37
b2b65e764ab1eecf61131576723c1edf64244315895b447e1a68f4a34ff5dd2a
e373b70a5167485c73a265421bcfcd1fdddbae49c9c51605e6d2918a3de4ae0d
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
fb30c087b995cce523d8488af03c1f6d58b7876626584796e4c5381094a4422c