sign-in-to-coinbase-pro-account.zx4xy.com
Open in
urlscan Pro
23.254.231.188
Malicious Activity!
Public Scan
Submission Tags: @phishunt_io
Submission: On December 30 via api from DE — Scanned from DE
Summary
TLS certificate: Issued by cPanel, Inc. Certification Authority on December 30th 2022. Valid for: 3 months.
This is the only time sign-in-to-coinbase-pro-account.zx4xy.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Coinbase (Crypto Exchange)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
16 | 23.254.231.188 23.254.231.188 | 54290 (HOSTWINDS) (HOSTWINDS) | |
1 | 2a00:1450:400... 2a00:1450:400d:805::200a | 15169 (GOOGLE) (GOOGLE) | |
2 | 2606:4700::68... 2606:4700::6811:190e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
4 | 2a00:1450:400... 2a00:1450:400d:80c::2003 | 15169 (GOOGLE) (GOOGLE) | |
23 | 4 |
ASN54290 (HOSTWINDS, US)
PTR: redelivery-update-fee.com
sign-in-to-coinbase-pro-account.zx4xy.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
16 |
zx4xy.com
sign-in-to-coinbase-pro-account.zx4xy.com |
1 MB |
4 |
gstatic.com
fonts.gstatic.com |
32 KB |
2 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 356 |
35 KB |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 127 |
1 KB |
23 | 4 |
Domain | Requested by | |
---|---|---|
16 | sign-in-to-coinbase-pro-account.zx4xy.com |
sign-in-to-coinbase-pro-account.zx4xy.com
|
4 | fonts.gstatic.com |
fonts.googleapis.com
|
2 | cdnjs.cloudflare.com |
sign-in-to-coinbase-pro-account.zx4xy.com
|
1 | fonts.googleapis.com |
sign-in-to-coinbase-pro-account.zx4xy.com
|
23 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
sign-in-to-coinbase-pro-account.zx4xy.com cPanel, Inc. Certification Authority |
2022-12-30 - 2023-03-30 |
3 months | crt.sh |
upload.video.google.com GTS CA 1C3 |
2022-11-28 - 2023-02-20 |
3 months | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2022-08-03 - 2023-08-02 |
a year | crt.sh |
*.gstatic.com GTS CA 1C3 |
2022-11-28 - 2023-02-20 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://sign-in-to-coinbase-pro-account.zx4xy.com/
Frame ID: C7F9DC7506B1A0CF9E5D1638E48588E1
Requests: 23 HTTP requests in this frame
Screenshot
Page Title
Sign in to Coinbase Pro Account - Buy and Sell Bitcoin, Ethereum, and more with TrustCoinbase logoCoinbase logoCoinbase logoCoinbase logoCoinbase logoDetected technologies
Bootstrap (Web Frameworks) ExpandDetected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Google Font API (Font Scripts) Expand
Detected patterns
- <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
23 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
sign-in-to-coinbase-pro-account.zx4xy.com/ |
16 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
6 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
cdnjs.cloudflare.com/ajax/libs/bootstrap/5.2.3/css/ |
190 KB 20 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap-icons.css
sign-in-to-coinbase-pro-account.zx4xy.com/assets/vendor/bootstrap-icons/ |
93 KB 12 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
aos.css
sign-in-to-coinbase-pro-account.zx4xy.com/assets/vendor/aos/ |
25 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.css
sign-in-to-coinbase-pro-account.zx4xy.com/assets/css/ |
17 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo.svg
sign-in-to-coinbase-pro-account.zx4xy.com/assets/img/ |
4 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
free-money.png
sign-in-to-coinbase-pro-account.zx4xy.com/assets/img/ |
126 KB 127 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
explore-crypto.png
sign-in-to-coinbase-pro-account.zx4xy.com/assets/img/ |
32 KB 33 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
trade.png
sign-in-to-coinbase-pro-account.zx4xy.com/assets/img/ |
164 KB 165 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
nft.png
sign-in-to-coinbase-pro-account.zx4xy.com/assets/img/ |
188 KB 189 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wallet.png
sign-in-to-coinbase-pro-account.zx4xy.com/assets/img/ |
280 KB 282 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
card.png
sign-in-to-coinbase-pro-account.zx4xy.com/assets/img/ |
98 KB 99 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
institutional.png
sign-in-to-coinbase-pro-account.zx4xy.com/assets/img/ |
75 KB 75 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cta.png
sign-in-to-coinbase-pro-account.zx4xy.com/assets/img/ |
43 KB 43 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.js
cdnjs.cloudflare.com/ajax/libs/bootstrap/5.2.3/js/ |
59 KB 14 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
aos.js
sign-in-to-coinbase-pro-account.zx4xy.com/assets/vendor/aos/ |
14 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.js
sign-in-to-coinbase-pro-account.zx4xy.com/assets/js/ |
4 KB 955 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pxiEyp8kv8JHgFVrJJfecg.woff2
fonts.gstatic.com/s/poppins/v20/ |
8 KB 8 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pxiByp8kv8JHgFVrLEj6Z1xlFQ.woff2
fonts.gstatic.com/s/poppins/v20/ |
8 KB 8 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pxiByp8kv8JHgFVrLGT9Z1xlFQ.woff2
fonts.gstatic.com/s/poppins/v20/ |
8 KB 8 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap-icons.woff2
sign-in-to-coinbase-pro-account.zx4xy.com/assets/vendor/bootstrap-icons/fonts/ |
118 KB 119 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pxiGyp8kv8JHgFVrJJLucHtA.woff2
fonts.gstatic.com/s/poppins/v20/ |
8 KB 9 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Coinbase (Crypto Exchange)4 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| oncontentvisibilityautostatechange number| uidEvent object| bootstrap object| AOS0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdnjs.cloudflare.com
fonts.googleapis.com
fonts.gstatic.com
sign-in-to-coinbase-pro-account.zx4xy.com
23.254.231.188
2606:4700::6811:190e
2a00:1450:400d:805::200a
2a00:1450:400d:80c::2003
01491eced67d7c2342547ab78d30e4e5626fd4671b34d0a5006331e54f20f4e3
126270d27d1ac1a29b8d7d01238377840fe79b70212bd230adc6b2d9da82bf38
13b26c95bf7fd4532be8c3b2da5645ad61a9708e2b35456a06448127d400ee00
1aa8845fd06e475aefe733d4e55b36a92fcd487975049c8172341827ac9cc03e
3c1acdcb5f1d416dba718b93b7d7dbd093c763aedffaf15742e57d3a4d196b8f
3f9899de53b538e6e4e3d31df08f015f5db6efbcab818ac8c52985d12246a25f
50d0c1742d80ac71f4cde20e8c04d41a24806af342831f479938b527fbff0972
53cbf51eed60d55592f7239912839a7864fd83785f1c5d360c333f8ed015fef2
5e10ccf5aebdb0b87f1162904421aec8ec4595298600bd17af6b0f3409dcdeb4
6390b31ed4656c80f71c554bfb2b4df6b48bcd6d0676eb2bdb28efddd412e05d
7d7b76855b08f8c86aa89d757a1027089dfc01a81f665bf9c65d302a4c7f4eb9
7d93459d86585bfcdbb7e0376056226adb25821ee54b96236fe2123e9560929f
84f64755d6968fa541fd948afc03c952fa0189f87656993d15dc175ad35d3474
966620f9e3bec428663687f9e8d67a6b8e35d79adebf6fb204e9b139eada7599
9bcd4d0f29dc6556ebeeff44eaa0965f0c7f7308ee58394708cce2f698cca1b0
a5005b2e414770fd5ccb40bc221a12771966d02b5c1f9c89da48bd8e3811d377
ba0185664a1ae85632c1157a02b478f2b2b13f7283adeda8e20a32bbd5d70ac7
c0bcf7898fdc3b87babca678cd19a8e3ef570e931c80a3afbffcc453738c951a
c855fd65881f6f569e3ddaa050ccc28983cf7e8f1b85edd6752e05a4528cec43
cd36de204aca2d5fa263a731f7c20009b5e3d754ba1f1e03c33e93a48f3e7446
e1172d3a0a208cf01dc066f0abeaf17f00264a966159a69f71947d6edcd4935f
f4e80d9dfd374d02989b87a27b5ed4cb78fbb177c27f1478e9a8b0afb7513149
f899badbafef91bd7193b44af6e29b96b1a594a091ca3db1f6db9648c7fdf3bf