presaie-beckercoin.net Open in urlscan Pro
172.67.183.151 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://presaie-beckercoin.net/?shiny
Effective URL:
https://presaie-beckercoin.net/?shiny
Submission Tags: shiny c290acadafe6362a fc6b18fd85158e2b bfst honeypoter@gmail.com Search All
Submission: On June 17 via api (June 17th 2024, 12:48:33 am UTC) from JP — Scanned from JP

Summary HTTP 12 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 2 countries across 4 domains to perform 12 HTTP transactions. The main IP is 172.67.183.151, located in United States and belongs to CLOUDFLARENET, US. The main domain is presaie-beckercoin.net.
TLS certificate: Issued by WE1 on June 13th 2024. Valid for: 3 months.

This is the only time presaie-beckercoin.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Crypto (Crypto Exchange)

Domain & IP information

	IP Address	AS Autonomous System
7	172.67.183.151 172.67.183.151	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	104.17.24.14 104.17.24.14	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	172.67.207.36 172.67.207.36	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a04:4e42:200... 2a04:4e42:200::485	54113 (FASTLY) (FASTLY)
12	5

7 172.67.183.151 (United States)

ASN13335 (CLOUDFLARENET, US)

presaie-beckercoin.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.17.24.14 (None, )

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.67.207.36 (United States)

ASN13335 (CLOUDFLARENET, US)

checker-api.su	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:200::485 (United States)

ASN54113 (FASTLY, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	presaie-beckercoin.net presaie-beckercoin.net	2 MB
2	checker-api.su checker-api.su	8 KB
2	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 265	143 KB
1	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 373	51 KB
12	4

	Domain	Requested by
7	presaie-beckercoin.net	presaie-beckercoin.net
2	checker-api.su	presaie-beckercoin.net
2	cdnjs.cloudflare.com	presaie-beckercoin.net
1	cdn.jsdelivr.net	presaie-beckercoin.net
12	4

This site contains no links.

Subject Issuer	Validity	Valid
presaie-beckercoin.net WE1	`2024-06-13` - `2024-09-11`	3 months	crt.sh
cdnjs.cloudflare.com E1	`2024-06-02` - `2024-08-31`	3 months	crt.sh
checker-api.su WE1	`2024-06-11` - `2024-09-09`	3 months	crt.sh
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2023 Q3	`2023-09-27` - `2024-10-28`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://presaie-beckercoin.net/?shiny
Frame ID: 97986B1A9ACFD87943946F0B518D7799
Requests: 17 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://presaie-beckercoin.net/?shiny HTTP 307
https://presaie-beckercoin.net/?shiny Page URL

Detected technologies

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

//cdn\.jsdelivr\.net/

Page Statistics

12
Requests

100 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

5
IPs

2
Countries

1805 kB
Transfer

4469 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://presaie-beckercoin.net/?shiny HTTP 307
https://presaie-beckercoin.net/?shiny Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions
5 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3

200

Primary Request / Show response
presaie-beckercoin.net/
Redirect Chain

http://presaie-beckercoin.net/?shiny
https://presaie-beckercoin.net/?shiny

857 KB
121 KB

568ms
544ms

Document
text/html

172.67.183.151
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://presaie-beckercoin.net/?shiny
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.183.151 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d816aedfb95e0f8dc72c2182b3ee81a5c0e1e625a168fd6f281244ad54c70b61

Request headers

Accept-Language: ja-JP,ja;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 894f08b00feb261e-NRT
content-encoding: br
content-type: text/html; charset=utf-8
date: Mon, 17 Jun 2024 00:48:26 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KmgRs%2BRw8osMpg10aIxsARL2q2z0glB1hSkaGf6ZfFFUk9xRTd7OKUysX3cWHEPLKr5yuH6nVl%2F%2BHhCnHU2EDGDS79Ar1zSiah%2Bv%2BprL7mqZvVBPHA8%2BgpQn6mGQ3rRDtgIwQHERQLem"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

Redirect headers

Location: https://presaie-beckercoin.net/?shiny
Non-Authoritative-Reason: HttpsUpgrades

GET
H3 200 contracts.js Show response
presaie-beckercoin.net/scripts/ 0
446 B 577ms
576ms Script
application/octet-stream 172.67.183.151
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://presaie-beckercoin.net/scripts/contracts.js
Requested by: Host: presaie-beckercoin.net
URL: https://presaie-beckercoin.net/?shiny
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.183.151 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: ja-JP,ja;q=0.9;q=0.9
Referer: https://presaie-beckercoin.net/?shiny
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Mon, 17 Jun 2024 00:48:26 GMT
cf-cache-status: MISS
last-modified: Mon, 17 Jun 2024 00:48:26 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gdyBh2mb28QoqqVaEMnz7TO%2FiOqf0rwVjHghPoR8JfMsoHgk4cAoie9756wqm1o7OEA%2BdAIT6Y2lvUAZaRxoWmPxJ3v%2FtIS1aONhPD2wj1259QLWIKvG1P33MOdzfext0uxOhP5J34YW"}],"group":"cf-nel","max_age":604800}
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 894f08b37c80261e-NRT
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H3 200 main.js Show response
presaie-beckercoin.net/scripts/ 1 MB
1 MB 1039ms
1038ms Script
application/octet-stream 172.67.183.151
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://presaie-beckercoin.net/scripts/main.js
Requested by: Host: presaie-beckercoin.net
URL: https://presaie-beckercoin.net/?shiny
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.183.151 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0ab4572c9ac1354bd12c96829f55f0cbcd1364dcfce17de4dff4354789cc506e

Request headers

Accept-Language: ja-JP,ja;q=0.9;q=0.9
Referer: https://presaie-beckercoin.net/?shiny
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Mon, 17 Jun 2024 00:48:27 GMT
cf-cache-status: MISS
last-modified: Mon, 17 Jun 2024 00:48:26 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9qc10fcLBEhD2NXMxwryWnwGZjn9VA30CO1Z8H09L0jhC6ccJOnivmkhYJUVxKLf7JPbeSs9KCikB0VJSUi%2FSpdU8iuFfuuv9rtVWlApWVQNFOZF9cM66%2FMv4%2B%2BIcheGkMco8qVvGor8"}],"group":"cf-nel","max_age":604800}
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 894f08b37c81261e-NRT
alt-svc: h3=":443"; ma=86400
content-length: 1505459

GET
H3 200 entry.js Show response
presaie-beckercoin.net/scripts/ 0
449 B 567ms
567ms Script
application/octet-stream 172.67.183.151
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://presaie-beckercoin.net/scripts/entry.js
Requested by: Host: presaie-beckercoin.net
URL: https://presaie-beckercoin.net/?shiny
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.183.151 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: ja-JP,ja;q=0.9;q=0.9
Referer: https://presaie-beckercoin.net/?shiny
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Mon, 17 Jun 2024 00:48:26 GMT
cf-cache-status: MISS
last-modified: Mon, 17 Jun 2024 00:48:26 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kkbCqbrwme3YTALHNkdbcUK%2BURLugdXP1NUsh0Usps4Lh4RH0EwuZntPAHOxR5225Tie8DDQZOHY2%2F0YoJ6Wi0agHDBj%2BtN8u3EVB68hjVBpEEVIuMoD2lh3hQ2C%2BZQcHmC8TcsqkaHJ"}],"group":"cf-nel","max_age":604800}
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 894f08b39ca2261e-NRT
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H3 200 crypto-js.min.js Show response
cdnjs.cloudflare.com/ajax/libs/crypto-js/4.2.0/ 59 KB
20 KB 24ms
17ms Script
application/javascript 104.17.24.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.2.0/crypto-js.min.js

Requested by

Host: presaie-beckercoin.net
URL: https://presaie-beckercoin.net/scripts/main.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

769a555de553babc35a3338f344dd7aa16260c93cea2c7db290707c90484e7cc

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Accept-Language: ja-JP,ja;q=0.9;q=0.9
Referer: https://presaie-beckercoin.net/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Mon, 17 Jun 2024 00:48:28 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 1470826
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 19621
last-modified: Tue, 24 Oct 2023 23:03:52 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "65384d58-4ca5"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8gfrs9iVPHsRIptxHr%2B23nDEOpYNTUDoeMlevztrwKNxg1xt6GqyNZwAA7KZhQTejGd7aDY5cU9t5N7rGem%2FQNmzBJH7O7B0KXPLu7AoLoLGuzLRIr6Vcpw5d6GJC%2FDNM8En8Uj1"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 894f08c0ce01afca-NRT
expires: Sat, 07 Jun 2025 00:48:28 GMT

GET
DATA 200
OK truncated
/ 26 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9cbf6773eb9744ef03d86abbc228c2d67551f7e873f6371f6f86cf4d259ac569

Request headers

Accept-Language: ja-JP,ja;q=0.9;q=0.9
Referer
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Content-Type: image/jpeg

GET
DATA 200
OK truncated
/ 122 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7b447d41d017da03cc2a5c91d2f559cb04b8562ba45b88239ce6e7a6760595f7

Request headers

Accept-Language: ja-JP,ja;q=0.9;q=0.9
Referer
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 646 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3bd151eb77e3cc456935eb7decbc0984759fb4d00598088fef0e3632968140ff

Request headers

Accept-Language: ja-JP,ja;q=0.9;q=0.9
Referer
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 422 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e94f4ec3d5f854f7281c9c36eeff5313fe0b739a16c7f2b6336eea87f1c013d3

Request headers

Accept-Language: ja-JP,ja;q=0.9;q=0.9
Referer
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 242 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4a9b945150c40797f351e4d03a02dfbd4718cec53fd5ce13b7c7fb2abd848d54

Request headers

Accept-Language: ja-JP,ja;q=0.9;q=0.9
Referer
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Content-Type: image/svg+xml

POST
H3 200 config Show response
checker-api.su/ 5 KB
4 KB 868ms
597ms Fetch
text/html 172.67.207.36
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://checker-api.su/config

Requested by

Host: presaie-beckercoin.net
URL: https://presaie-beckercoin.net/scripts/main.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.207.36 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

36ebb193363be5f4033d0816506d6c292eff8281bb924f36825f11aa75c830e2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://presaie-beckercoin.net/
Accept-Language: ja-JP,ja;q=0.9;q=0.9
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1
Content-Type: text/plain;charset=UTF-8

Response headers

date: Mon, 17 Jun 2024 00:48:29 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: Express
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ekkF7QHnjehTFi3X3Pu9ITkYJIv12P0jBNE5tx4QB7YfbJT2rOp6yOfPDsJP3FK%2BCm4%2FxNZemRJxVsD3Vnp3wpnLtVDeNuB0aj58NQ7N0L1hBNDMrtv8nmd2b%2B8tW2BgXQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cf-ray: 894f08c36b868a92-NRT
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block

POST
H3 200 config Show response
checker-api.su/ 5 KB
4 KB 823ms
560ms Fetch
text/html 172.67.207.36
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://checker-api.su/config

Requested by

Host: presaie-beckercoin.net
URL: https://presaie-beckercoin.net/scripts/main.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.207.36 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

ce09d7b41d424d39948d972afde642f71dc645352798763a146433aa2b58c247

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://presaie-beckercoin.net/
Accept-Language: ja-JP,ja;q=0.9;q=0.9
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1
Content-Type: text/plain;charset=UTF-8

Response headers

date: Mon, 17 Jun 2024 00:48:29 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: Express
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LmH1YZQd8hTjxIQQJYi%2BDoHzuDQL77L2jg0kx21M%2BWkHHGF5DsJ80iYOGsQJCPIKNbotMCIyPHNmwEJQ%2Fd9Pgm1%2BFJHUbgSOvYc5MjeOXPIFovzfpDrEpcdMx9TimERQww%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cf-ray: 894f08c36b858a92-NRT
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block

GET
H3 404 favicon.ico
presaie-beckercoin.net/ 150 B
529 B 496ms
496ms Other
text/html 172.67.183.151
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://presaie-beckercoin.net/favicon.ico

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.183.151 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6e21162bc64073fe9e3d3d6375ca24d04fed1912a5b7716aac0cb0f2d16fae7c

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'
X-Content-Type-Options	nosniff

Request headers

Accept-Language: ja-JP,ja;q=0.9;q=0.9
Referer: https://presaie-beckercoin.net/?shiny
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Mon, 17 Jun 2024 00:48:28 GMT
content-security-policy: default-src 'none'
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
content-encoding: br
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jv5Xl6sPfu5Uq4IVQwBcHS81b2lD6Devw3oM4VRgtoIpUK5CMgdsZiW3HHQ04iOcOb%2Bhl94q1N%2FbfdXkFepMdZyjLn52gkTr9uP4esFpm0eWhRPz4OrgYw3TzUeOTzCEMiAi3xioHIRl"}],"group":"cf-nel","max_age":604800}
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=14400
cf-ray: 894f08c1cfa1261e-NRT
alt-svc: h3=":443"; ma=86400

GET
H3 200 ethers.umd.min.js Show response
cdnjs.cloudflare.com/ajax/libs/ethers/5.6.9/ 719 KB
124 KB 16ms
15ms Script
application/javascript 104.17.24.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/ethers/5.6.9/ethers.umd.min.js

Requested by

Host: presaie-beckercoin.net
URL: https://presaie-beckercoin.net/scripts/main.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

95c66625ee20f53d542e23dded002b021b24e9d28c3d193a076d45cba4dc8618

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Accept-Language: ja-JP,ja;q=0.9;q=0.9
Referer: https://presaie-beckercoin.net/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Mon, 17 Jun 2024 00:48:29 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 261111
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 125841
last-modified: Sat, 18 Jun 2022 08:07:49 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "62ad87d5-1eb91"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OIczLJueONEitc3AOj987s%2FxF4Q4gY%2F7OP7jFqrFnL1vJfsqPRpHIHFLvDXBEfxUBfe7PQ3oeI3kdn4Mpxydo1qXnw2qu%2B4oQe1Wg4JGVn3LWQuNUsR7Q6UWRsVvK5VTIc%2BFGc7R"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 894f08c6fdb5afca-NRT
expires: Sat, 07 Jun 2025 00:48:29 GMT

GET
H2 200 merkletree.js Show response
cdn.jsdelivr.net/npm/merkletreejs@latest/ 209 KB
51 KB 8ms
2ms Script
application/javascript 2a04:4e42:200::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/merkletreejs@latest/merkletree.js

Requested by

Host: presaie-beckercoin.net
URL: https://presaie-beckercoin.net/scripts/main.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:200::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

af00d2cec87b70e8139926da6426dd0686ff9a8207386658b6d72ee4e799c2e3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: ja-JP,ja;q=0.9;q=0.9
Referer: https://presaie-beckercoin.net/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Mon, 17 Jun 2024 00:48:29 GMT
x-content-type-options: nosniff
content-encoding: br
age: 25021
x-jsd-version: 0.3.11
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 51348
x-served-by: cache-fra-etou8220103-FRA, cache-tyo11924-TYO
x-jsd-version-type: version
etag: W/"343f5-wn3//e2DIG1tBGj3Z3By+fDhqDc"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
accept-ranges: bytes
timing-allow-origin: *

GET
H3 200 wallet-connect-v3.js
presaie-beckercoin.net/scripts/ 702 KB
0 1329ms
1329ms Script
application/octet-stream 172.67.183.151
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://presaie-beckercoin.net/scripts/wallet-connect-v3.js
Requested by: Host: presaie-beckercoin.net
URL: https://presaie-beckercoin.net/scripts/main.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.183.151 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept-Language: ja-JP,ja;q=0.9;q=0.9
Referer: https://presaie-beckercoin.net/?shiny
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Mon, 17 Jun 2024 00:48:30 GMT
cf-cache-status: MISS
last-modified: Mon, 17 Jun 2024 00:48:29 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RJYJjORvCFCwPjiMkDwcPHlxFdnYM7iZ6civL2%2FaOPzoyhzv4HpFG3v1hTDhLS2qSVICTMnHPvJgYEdIIMIMu6TvDdkOf9KwFqECvb9bLs7HKTAbAp1Mfnt%2Bhh64%2BoXyrJ60RkrQWlgU"}],"group":"cf-nel","max_age":604800}
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 894f08c6febe261e-NRT
alt-svc: h3=":443"; ma=86400
content-length: 1975001

GET
H3 200 popup-6.css
presaie-beckercoin.net/styles/ 51 KB
10 KB 539ms
538ms Stylesheet
text/css 172.67.183.151
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://presaie-beckercoin.net/styles/popup-6.css
Requested by: Host: presaie-beckercoin.net
URL: https://presaie-beckercoin.net/scripts/main.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.183.151 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f4f2ea8a9fae0fe006897e4d5907c3677086ab3d476e308e2a6a43f43ca8ffaf

Request headers

Accept-Language: ja-JP,ja;q=0.9;q=0.9
Referer: https://presaie-beckercoin.net/?shiny
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Mon, 17 Jun 2024 00:48:29 GMT
content-encoding: gzip
cf-cache-status: MISS
last-modified: Mon, 17 Jun 2024 00:48:29 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jhRxy9nmEt88t59%2B7YDgHhvyzevHJbOEGYWFWoGSWmT1kVXwpKTbv3krlOsh4FpIMyrkgJck%2BnaY%2FzfsvFaxzSs%2F68UKN5nSV3lwicWQtdaH4bJHE3NX%2BzYQ76cQlaqeZGDvfFWrecD1"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=14400
cf-ray: 894f08c6fec1261e-NRT
alt-svc: h3=":443"; ma=86400

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Crypto (Crypto Exchange)

39 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://presaie-beckercoin.net/favicon.ico Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.jsdelivr.net
cdnjs.cloudflare.com
checker-api.su
presaie-beckercoin.net
104.17.24.14
172.67.183.151
172.67.207.36
2a04:4e42:200::485
0ab4572c9ac1354bd12c96829f55f0cbcd1364dcfce17de4dff4354789cc506e
36ebb193363be5f4033d0816506d6c292eff8281bb924f36825f11aa75c830e2
3bd151eb77e3cc456935eb7decbc0984759fb4d00598088fef0e3632968140ff
4a9b945150c40797f351e4d03a02dfbd4718cec53fd5ce13b7c7fb2abd848d54
6e21162bc64073fe9e3d3d6375ca24d04fed1912a5b7716aac0cb0f2d16fae7c
769a555de553babc35a3338f344dd7aa16260c93cea2c7db290707c90484e7cc
7b447d41d017da03cc2a5c91d2f559cb04b8562ba45b88239ce6e7a6760595f7
95c66625ee20f53d542e23dded002b021b24e9d28c3d193a076d45cba4dc8618
9cbf6773eb9744ef03d86abbc228c2d67551f7e873f6371f6f86cf4d259ac569
af00d2cec87b70e8139926da6426dd0686ff9a8207386658b6d72ee4e799c2e3
ce09d7b41d424d39948d972afde642f71dc645352798763a146433aa2b58c247
d816aedfb95e0f8dc72c2182b3ee81a5c0e1e625a168fd6f281244ad54c70b61
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e94f4ec3d5f854f7281c9c36eeff5313fe0b739a16c7f2b6336eea87f1c013d3
f4f2ea8a9fae0fe006897e4d5907c3677086ab3d476e308e2a6a43f43ca8ffaf

presaie-beckercoin.net Open in urlscan Pro 172.67.183.151 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

12 Requests

100 %HTTPS

25 %IPv6

4 Domains

4 Subdomains

5 IPs

2 Countries

1805 kBTransfer

4469 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 5 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

39 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

presaie-beckercoin.net Open in urlscan Pro
172.67.183.151 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

100 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

5
IPs

2
Countries

1805 kB
Transfer

4469 kB
Size

0
Cookies

12 HTTP transactions
5 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!