github-ban.com
Open in
urlscan Pro
172.67.189.177
Malicious Activity!
Public Scan
Effective URL: https://github-ban.com/
Submission: On May 23 via manual from PH — Scanned from DE
Summary
TLS certificate: Issued by GTS CA 1P5 on May 19th 2024. Valid for: 3 months.
This is the only time github-ban.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Cloudflare (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 20 | 172.67.189.177 172.67.189.177 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
3 | 2a04:4e42:400... 2a04:4e42:400::485 | 54113 (FASTLY) (FASTLY) | |
1 | 2a00:1450:400... 2a00:1450:4001:802::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:811::200e | 15169 (GOOGLE) (GOOGLE) | |
2 | 2a00:1450:400... 2a00:1450:4001:800::2003 | 15169 (GOOGLE) (GOOGLE) | |
2 | 188.114.96.3 188.114.96.3 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 104.17.24.14 104.17.24.14 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a02:6b8::1:119 2a02:6b8::1:119 | () () | |
1 3 | 2606:4700::68... 2606:4700::6811:f5cb | () () | |
33 | 10 |
ASN15169 (GOOGLE, US)
encrypted-tbn0.gstatic.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
20 |
github-ban.com
2 redirects
github-ban.com |
313 KB |
3 |
unpkg.com
1 redirects
unpkg.com |
658 B |
3 |
gstatic.com
encrypted-tbn0.gstatic.com fonts.gstatic.com |
68 KB |
3 |
jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 310 |
119 KB |
2 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 237 |
281 KB |
2 |
pages.dev
cdndelivery.pages.dev |
742 KB |
1 |
yandex.ru
mc.yandex.ru |
|
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 33 |
2 KB |
0 |
claim-token.shop
Failed
layer0.claim-token.shop Failed |
|
33 | 9 |
Domain | Requested by | |
---|---|---|
20 | github-ban.com |
2 redirects
github-ban.com
|
3 | unpkg.com |
1 redirects
github-ban.com
|
3 | cdn.jsdelivr.net |
github-ban.com
|
2 | cdnjs.cloudflare.com |
github-ban.com
|
2 | cdndelivery.pages.dev |
github-ban.com
|
2 | fonts.gstatic.com |
fonts.googleapis.com
|
1 | mc.yandex.ru |
github-ban.com
|
1 | encrypted-tbn0.gstatic.com |
github-ban.com
|
1 | fonts.googleapis.com |
github-ban.com
|
0 | layer0.claim-token.shop Failed |
github-ban.com
|
33 | 10 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
github-ban.com GTS CA 1P5 |
2024-05-19 - 2024-08-17 |
3 months | crt.sh |
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2023 Q3 |
2023-09-27 - 2024-10-28 |
a year | crt.sh |
upload.video.google.com WR2 |
2024-05-06 - 2024-07-29 |
3 months | crt.sh |
*.gstatic.com WR2 |
2024-05-06 - 2024-07-29 |
3 months | crt.sh |
cdndelivery.pages.dev GTS CA 1P5 |
2024-05-08 - 2024-08-06 |
3 months | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2023-07-03 - 2024-07-02 |
a year | crt.sh |
mc.yandex.ru GlobalSign ECC OV SSL CA 2018 |
2023-12-26 - 2024-06-05 |
5 months | crt.sh |
unpkg.com GTS CA 1P5 |
2024-04-01 - 2024-06-30 |
3 months | crt.sh |
This page contains 2 frames:
Primary Page:
https://github-ban.com/
Frame ID: 5C42C87AA67EE647C1FBD4979644D956
Requests: 31 HTTP requests in this frame
Frame:
https://github-ban.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/695da7821231/main.js
Frame ID: D89439993106E57F9B3D7DFD1AA232EB
Requests: 2 HTTP requests in this frame
Screenshot
Page Title
Github ban service. Hi Brian! Layer Zero | AirdropPage URL History Show full URLs
-
http://github-ban.com/
HTTP 307
https://github-ban.com/ Page URL
-
https://github-ban.com/cdn-cgi/phish-bypass?atok=NxjobMEsN_4AkU4uyshDESIxqgmP_kYpCrDX.NgGkqY-171643...
HTTP 301
https://github-ban.com/ Page URL
Detected technologies
SweetAlert2 (JavaScript Libraries) ExpandDetected patterns
- sweetalert2(?:\.all)?(?:\.min)?\.js
- /npm/sweetalert2@([\d.]+)
- sweetalert2@([\d.]+)/dist/sweetalert2(?:\.all)(?:\.min)\.js
Yandex.Metrika (Analytics) Expand
Detected patterns
- mc\.yandex\.ru/metrika/(?:tag|watch)\.js
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
jsDelivr (CDN) Expand
Detected patterns
- //cdn\.jsdelivr\.net/
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://github-ban.com/
HTTP 307
https://github-ban.com/ Page URL
-
https://github-ban.com/cdn-cgi/phish-bypass?atok=NxjobMEsN_4AkU4uyshDESIxqgmP_kYpCrDX.NgGkqY-1716432824-0.0.1.1-%2F
HTTP 301
https://github-ban.com/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://github-ban.com/ HTTP 307
- https://github-ban.com/
- https://github-ban.com/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
- https://github-ban.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/695da7821231/main.js
- https://unpkg.com/@web3modal/ethereum@2.6.2 HTTP 302
- https://unpkg.com/@web3modal/ethereum@2.6.2/dist/cdn/bundle.js
33 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H3 |
/
github-ban.com/ Redirect Chain
|
4 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
cf.errors.css
github-ban.com/cdn-cgi/styles/ |
23 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
icon-exclamation.png
github-ban.com/cdn-cgi/images/ |
452 B 636 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
favicon.ico
github-ban.com/ |
7 KB 2 KB |
Other
image/vnd.microsoft.icon |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
Primary Request
/
github-ban.com/ Redirect Chain
|
56 KB 16 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
banner-styles0.css
github-ban.com/ |
10 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
iconochive.css
github-ban.com/ |
5 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
css22.css
github-ban.com/ |
2 KB 663 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
toastr.min.css
github-ban.com/ |
7 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sweetalert2.min.css
cdn.jsdelivr.net/npm/sweetalert2@11.7.16/dist/ |
23 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css2
fonts.googleapis.com/ |
24 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
images
encrypted-tbn0.gstatic.com/ |
4 KB 4 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
rocket-loader.min.js
github-ban.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/ |
12 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
hero.mp4
layer0.claim-token.shop/free/layerzero_files/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa1ZL7.woff2
fonts.gstatic.com/s/inter/v13/ |
46 KB 46 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
UcCO3FwrK3iLTeHuS_fvQtMwCp50KnMw2boKoduKmMEVuDyYMZg.ttf
github-ban.com/ |
303 KB 149 KB |
Font
font/ttf |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa0ZL7SUc.woff2
fonts.gstatic.com/s/inter/v13/ |
17 KB 17 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
script14.js
github-ban.com/ |
3 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
toastr.min.js
github-ban.com/ |
6 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
jquery-3.6.0.js
github-ban.com/ |
283 KB 85 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
web3-ethers.js
cdndelivery.pages.dev/ |
2 MB 742 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
encryption.js
github-ban.com/ |
82 KB 31 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ethereumjs-tx-1.3.3.min.js
cdn.jsdelivr.net/gh/ethereumjs/browser-builds/dist/ethereumjs-tx/ |
315 KB 95 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sweetalert2.all.min.js
cdn.jsdelivr.net/npm/sweetalert2@11.7.16/dist/ |
66 KB 19 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
main.js
github-ban.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/695da7821231/ Frame D894 Redirect Chain
|
8 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
8881c2038bed4d3a
github-ban.com/cdn-cgi/challenge-platform/h/b/jsd/r/ Frame D894 |
0 599 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
ethers.umd.min.js
cdnjs.cloudflare.com/ajax/libs/ethers/5.7.2/ |
742 KB 137 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
favicon.ico
github-ban.com/ |
7 KB 0 |
Other
image/vnd.microsoft.icon |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
web3.min.js
cdnjs.cloudflare.com/ajax/libs/web3/4.0.3/ |
623 KB 144 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
tag.js
mc.yandex.ru/metrika/ |
43 KB 0 |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
web3-ethers.js
cdndelivery.pages.dev/ |
2 MB 445 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bundle.js
unpkg.com/@web3modal/ethereum@2.6.2/dist/cdn/ Redirect Chain
|
237 B 358 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bundle-fdcfd0d2.js
unpkg.com/@web3modal/ethereum@2.6.2/dist/cdn/ |
158 KB 0 |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- layer0.claim-token.shop
- URL
- https://layer0.claim-token.shop/free/layerzero_files/hero.mp4
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Cloudflare (Online)35 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| __cfQR function| Sweetalert2 function| SweetAlert function| Swal function| sweetAlert function| swal object| ethereumjs object| _ethers object| ethers function| setImmediate function| clearImmediate function| Web3 function| _0x146afd function| _0x3731 function| _0x1526 function| _0x2b5193 function| _0x265b1e function| AesCtr function| ym function| _____WB$wombat$assign$function_____ function| __WB_pmw function| $ function| jQuery object| toastr function| hideLoader function| notify function| getRandomNumberBetween function| saveStopTime function| startTimer function| countdownStart function| secondsToHms function| checkHasTimer function| updateTimer boolean| __cfRLUnblockHandlers2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.github-ban.com/ | Name: __cf_mw_byp Value: NxjobMEsN_4AkU4uyshDESIxqgmP_kYpCrDX.NgGkqY-1716432824-0.0.1.1-/ |
|
.github-ban.com/ | Name: cf_clearance Value: bzpol3yGvXXuA_A93T7YtufDl5J6ZelKjv0sCKNjf8k-1716432830-1.0.1.1-hrJZt2T5JYkIF00fxWoUWVtttV4.MiZ9yp2nQ6yY1MrD.CFIVUb_jtXU2JfpdWEu.JBO8iWWRLWNxqzCjStQ6A |
5 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Frame-Options | SAMEORIGIN |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn.jsdelivr.net
cdndelivery.pages.dev
cdnjs.cloudflare.com
encrypted-tbn0.gstatic.com
fonts.googleapis.com
fonts.gstatic.com
github-ban.com
layer0.claim-token.shop
mc.yandex.ru
unpkg.com
layer0.claim-token.shop
104.17.24.14
172.67.189.177
188.114.96.3
2606:4700::6811:f5cb
2a00:1450:4001:800::2003
2a00:1450:4001:802::200a
2a00:1450:4001:811::200e
2a02:6b8::1:119
2a04:4e42:400::485
0a9f0840be094f6fc48b6e8abff400e72e937aba6ceeb6eca4b60db4e8806fd7
10d78c0a5e8664889dc8eb47c72bfa46ad0ed02c70a234be9acdefa27dbb24b0
1e1105745e3f1bc4d5cc3a6f1fcaf657dbe2f359167d0e19a9eaa2eef92ffc5b
20fa05c320a4a613d7e0ee140a1449b0b998f68e1dcd1c05b4aa1d4e64a9b836
41585a2df9bfe7449d3d190eff2404371fee76d32609519d0a8f3af02eebce45
453e1303e4b318f6d3bdbb546901d68412355084c54b11d37d235d184ad8e862
4ea374c0632439a9afd8427344891b1332d55ead9d0bdd4684156fb57876232c
67140298fdf661b1a429bf9e9d73a386b3784991080249807f48116949459f1e
70cd2791d1a9d3987161ae9b529454d69dd8b8e4cd8952da13bc447619908d1d
84e3c77025ace5af143972b4a40fc834dcdfd4e449d4b36a57e62326f16b3091
88df0b5a7bc397dbc13a26bb8b3742cc62cd1c9b0dded57da7832416d6f52f42
a22f17bacbc2a8820be9a8b9f758769fdcd5cee93e8f729bd28804ef021b119c
a66293a6a2bb4dee061a68612be0be3c5c0ab7e4068ab8d98a4a357baf664c73
b030031299100b9d6c6b413bf9e9d712f59695f1384ef548c3f43b0a0faecbfa
c9c2143d1768787bd5ebebd9994cd4b782db73e4bc3abc31f35a7c3f2b56926d
ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142
d05ef79f5b9f0c4a51eea85428ad30f6e2eb6ae69efeedd7cbd82f022b764578
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e86cebe1229775f466e66b2c6bb3feff312d4c29a07ae02d130242b0c644ad19
e95c1fc6aaa308b9bbfc7ba359f34b57c65e4932440416441fe7c8864ccbdd84
ea8210cf1d5e05f0b0c351a8e60d01a8867f35ec543f9351f201502c407a2cee
eba9487840439a0fa53c9be0541c524bb84b590a7af8c86573ceb1fe19c4bda9
ed2f1428da0fae78f827e5f9c3aa232199894e000a5d0891b248cc023ef4d5b0
ee3512f8c59eaa415d996f68ce467b98f6a0cfe42631bb0196df90dccb04f855
ef7a94cfb4c19baefb77f17ce1eccd59608c18aff2af7a1f6ee9a9fdf112f0f9
f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016
f4c253a0131cfbeb24cf7f4c5506e99d1c8adc9e8dc28c00abd13c9d7cb979ca