8g0fn404aviuvcmbtkl7jtcg9l8sp6eb9fnsh2ld0112b399ptaac20.web3portal.com Open in urlscan Pro
185.150.190.66 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://clicktime.symantec.com/15sM65e3ABbc8RKacbNLB?h=RHyxwvJN_jueZvpcpIf4ypPXhl6J7tvjFDKDh06bLE8=
Effective URL:
https://8g0fn404aviuvcmbtkl7jtcg9l8sp6eb9fnsh2ld0112b399ptaac20.web3portal.com/?_kx=vTIPy2K0mY5ynYi-htrNCPhQFCkzF14ihGKH0x1jZ_4=.RGBj4d
Submission: On October 01 via manual (October 1st 2022, 5:37:32 am UTC) from GB — Scanned from SE

Summary HTTP 12 Redirects Behaviour Indicators

Summary

This website contacted 9 IPs in 4 countries across 10 domains to perform 12 HTTP transactions. The main IP is 185.150.190.66, located in United States and belongs to RELIABLESITE, US. The main domain is 8g0fn404aviuvcmbtkl7jtcg9l8sp6eb9fnsh2ld0112b399ptaac20.web3portal.com.
TLS certificate: Issued by R3 on August 7th 2022. Valid for: 3 months.

This is the only time 8g0fn404aviuvcmbtkl7jtcg9l8sp6eb9fnsh2ld0112b399ptaac20.web3portal.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Email (Online) Barclays (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1 1	54.246.29.234 54.246.29.234	16509 (AMAZON-02) (AMAZON-02)
1 1	167.89.115.54 167.89.115.54	11377 (SENDGRID) (SENDGRID)
3	185.150.190.66 185.150.190.66	23470 (RELIABLESITE) (RELIABLESITE)
1	104.18.11.207 104.18.11.207	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	142.250.184.200 142.250.184.200	15169 (GOOGLE) (GOOGLE)
1	142.251.39.74 142.251.39.74	15169 (GOOGLE) (GOOGLE)
3	52.222.139.122 52.222.139.122	16509 (AMAZON-02) (AMAZON-02)
1	104.103.101.221 104.103.101.221	16625 (AKAMAI-AS) (AKAMAI-AS)
1 2	13.227.219.73 13.227.219.73	16509 (AMAZON-02) (AMAZON-02)
1	52.222.214.71 52.222.214.71	16509 (AMAZON-02) (AMAZON-02)
12	9

1 54.246.29.234 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-54-246-29-234.eu-west-1.compute.amazonaws.com

clicktime.symantec.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 167.89.115.54 (Herndon, United States) 1 redirects

ASN11377 (SENDGRID, US)
PTR: o16789115x54.outbound-mail.sendgrid.net

u29298097.ct.sendgrid.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 185.150.190.66 (United States)

ASN23470 (RELIABLESITE, US)

000940tvjrhchv30kk4ot9mrqdkriraj36ddoco8cijjm8c88a7lg78.web3portal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
8g0fn404aviuvcmbtkl7jtcg9l8sp6eb9fnsh2ld0112b399ptaac20.web3portal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.18.11.207 (Shahr, Iran, Islamic Republic Of)

ASN13335 (CLOUDFLARENET, US)

stackpath.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.184.200 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s11-in-f8.1e100.net

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.251.39.74 (United States)

ASN15169 (GOOGLE, US)
PTR: bud02s39-in-f10.1e100.net

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 52.222.139.122 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-139-122.ams50.r.cloudfront.net

d12y7sg0iam4lc.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.103.101.221 (Vienna, Austria)

ASN16625 (AKAMAI-AS, US)
PTR: a104-103-101-221.deploy.static.akamaitechnologies.com

appleid.cdn-apple.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.227.219.73 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: server-13-227-219-73.ams54.r.cloudfront.net

logo.clearbit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.222.214.71 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-214-71.fra56.r.cloudfront.net

image.thum.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	cloudfront.net d12y7sg0iam4lc.cloudfront.net
3	web3portal.com 000940tvjrhchv30kk4ot9mrqdkriraj36ddoco8cijjm8c88a7lg78.web3portal.com 8g0fn404aviuvcmbtkl7jtcg9l8sp6eb9fnsh2ld0112b399ptaac20.web3portal.com	28 KB
2	clearbit.com 1 redirects logo.clearbit.com — Cisco Umbrella Rank: 21899	8 KB
1	thum.io image.thum.io — Cisco Umbrella Rank: 278543	978 KB
1	cdn-apple.com appleid.cdn-apple.com — Cisco Umbrella Rank: 2948	17 KB
1	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 284	31 KB
1	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 64	43 KB
1	bootstrapcdn.com stackpath.bootstrapcdn.com — Cisco Umbrella Rank: 2320	25 KB
1	sendgrid.net 1 redirects u29298097.ct.sendgrid.net	313 B
1	symantec.com 1 redirects clicktime.symantec.com — Cisco Umbrella Rank: 86322	2 KB
12	10

	Domain	Requested by
3	d12y7sg0iam4lc.cloudfront.net	8g0fn404aviuvcmbtkl7jtcg9l8sp6eb9fnsh2ld0112b399ptaac20.web3portal.com
2	logo.clearbit.com	1 redirects 8g0fn404aviuvcmbtkl7jtcg9l8sp6eb9fnsh2ld0112b399ptaac20.web3portal.com
2	8g0fn404aviuvcmbtkl7jtcg9l8sp6eb9fnsh2ld0112b399ptaac20.web3portal.com	000940tvjrhchv30kk4ot9mrqdkriraj36ddoco8cijjm8c88a7lg78.web3portal.com 8g0fn404aviuvcmbtkl7jtcg9l8sp6eb9fnsh2ld0112b399ptaac20.web3portal.com
1	image.thum.io	8g0fn404aviuvcmbtkl7jtcg9l8sp6eb9fnsh2ld0112b399ptaac20.web3portal.com
1	appleid.cdn-apple.com	8g0fn404aviuvcmbtkl7jtcg9l8sp6eb9fnsh2ld0112b399ptaac20.web3portal.com
1	ajax.googleapis.com	8g0fn404aviuvcmbtkl7jtcg9l8sp6eb9fnsh2ld0112b399ptaac20.web3portal.com
1	www.googletagmanager.com	8g0fn404aviuvcmbtkl7jtcg9l8sp6eb9fnsh2ld0112b399ptaac20.web3portal.com
1	stackpath.bootstrapcdn.com	8g0fn404aviuvcmbtkl7jtcg9l8sp6eb9fnsh2ld0112b399ptaac20.web3portal.com
1	000940tvjrhchv30kk4ot9mrqdkriraj36ddoco8cijjm8c88a7lg78.web3portal.com
1	u29298097.ct.sendgrid.net	1 redirects
1	clicktime.symantec.com	1 redirects
12	11

This site contains no links.

Subject Issuer	Validity	Valid
web3portal.com R3	`2022-08-07` - `2022-11-05`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-01-29` - `2023-01-29`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
*.cloudfront.net Amazon	`2022-02-01` - `2023-01-31`	a year	crt.sh
appleid.cdn-apple.com Apple Public EV Server RSA CA 2 - G1	`2022-04-19` - `2023-05-19`	a year	crt.sh
thum.io Amazon	`2021-11-07` - `2022-12-05`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://8g0fn404aviuvcmbtkl7jtcg9l8sp6eb9fnsh2ld0112b399ptaac20.web3portal.com/?_kx=vTIPy2K0mY5ynYi-htrNCPhQFCkzF14ihGKH0x1jZ_4=.RGBj4d
Frame ID: 24DFD2788E491311071FA5BAA0DD75F6
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Barclays

Page URL History Show full URLs

https://clicktime.symantec.com/15sM65e3ABbc8RKacbNLB?h=RHyxwvJN_jueZvpcpIf4ypPXhl6J7tvjFDKDh06bLE8= HTTP 307
https://u29298097.ct.sendgrid.net/ls/click?upn=0qQuu4TpfEINn168nQlWxUYm4rTxQxLMSL-2B8GgV4e-2F4FbL30fi9sQsDRxZT... HTTP 302
https://000940tvjrhchv30kk4ot9mrqdkriraj36ddoco8cijjm8c88a7lg78.web3portal.com/ Page URL
https://8g0fn404aviuvcmbtkl7jtcg9l8sp6eb9fnsh2ld0112b399ptaac20.web3portal.com/?_kx=vTIPy2K0mY5ynYi-htrNCPhQFCkzF14ihGKH0x1jZ_4=.RGBj4d Page URL

Detected technologies

Apple Sign-in (Social logins) Expand

Overall confidence: 100%
Detected patterns

appleid\.auth\.js

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

12
Requests

92 %
HTTPS

0 %
IPv6

10
Domains

11
Subdomains

9
IPs

4
Countries

1130 kB
Transfer

1443 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://clicktime.symantec.com/15sM65e3ABbc8RKacbNLB?h=RHyxwvJN_jueZvpcpIf4ypPXhl6J7tvjFDKDh06bLE8= HTTP 307
https://u29298097.ct.sendgrid.net/ls/click?upn=0qQuu4TpfEINn168nQlWxUYm4rTxQxLMSL-2B8GgV4e-2F4FbL30fi9sQsDRxZTw4zjAy3we0Yy1coCukyHT7MU0EECq5ejrM4z-2FbzwGT9VX4Fdt7ftYmLCh82RjFLaNomeFMNwyYte6NkzCjmBai3QhwQOR0AnhL-2FdKh0IpYQtJzaw-3DFS7w_jf835s-2BEZKoYZ2Wx5dkUf2KUqB1ufkxhUcuabRtU6AcXX7eP-2Fss47rr7dTl3Wzo1F2XFrQ9I-2BlnUAJ-2FzyLg2n-2FKIChfUuwziQ8trv57IHjGXycenhA5XpT56TK6-2B521-2FQiSuaIVkpOaqqw10sIUYv3D-2F91vKBEQpgIrmftdLg8R00z696uOTzdpncHC160jb-2FIs2vgAtYzeT0BIDwpIbYWKAc0nuF4N3kFIge5XMVrJThzh-2F8pdwye-2B15Nv8YhNAbodUSuKmZ7XBX015gZgNqC-2BI-2B-2FqQ4dLqKhVTHSJICFDwSqWgz9bOFFwT-2FYB4zG5Y2vxylRXmqOC1nsCU8vpUCFuwrWhGeE0VYwJHKXEprIFKQtz6RISdeUh7E7AqBf-2FYVyQywtk0WdqXTiJ5GrrJevxHAy6AEH36DhlrGIleD8Y4J1Zc7-2BGpwkhM6i8QoIO2sHr6N4Do6J-2F42KjHdai6lZdaQxeko0k-2FepJdXwlSopLRp3wDntPNSfjn1Ycr4tV5pup54A9vvQrR1vvoX91Zci2NqpMOY-2Fopxze02OnbTZbv8D72NA7BeUCwEhIjvh5OQCiEOPVlx-2FtmqhHlRK7vH8kSuji-2Fzi7Te5y-2FqcbPxg4oJG0xzLTwz5-2BwjDIP1PpqJI7mvXaC3M788cdfF8ZnIccDWREFhe0EIOZ08Dox3nqfEv5U7BmyTskEyG2yad5yQPrMiBIS41FsCdS5qYaJn4d45dvztj9ppVSj4Ski0w9-2BNs-2BW7b42JpkuzS9oE-2FNTOqGuTxYYAS1b6KU6l2OcaPEqdnbtFymUUwSWgi-2BKQUsR5Lcrfg-2BRQETn-2BLH5RXQsIpXZI2ceNV-2FxdBNMnmSDXKunXf3SEbZme6kSMAXIgedvcbqW-2FGuzzPDEeOn0hbPGjyx-2BKGwFF7TPywG4i4UzDI-2BJ3Eh7BW3gVZMC14HM2MNSbaAYIlXRNDzDXieuU8Mlp-2B5BWJ-2BTVJELOkylprtPjEenoNvdtcSYsDOcUsEK4AA-3D HTTP 302
https://000940tvjrhchv30kk4ot9mrqdkriraj36ddoco8cijjm8c88a7lg78.web3portal.com/ Page URL
https://8g0fn404aviuvcmbtkl7jtcg9l8sp6eb9fnsh2ld0112b399ptaac20.web3portal.com/?_kx=vTIPy2K0mY5ynYi-htrNCPhQFCkzF14ihGKH0x1jZ_4=.RGBj4d Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://clicktime.symantec.com/15sM65e3ABbc8RKacbNLB?h=RHyxwvJN_jueZvpcpIf4ypPXhl6J7tvjFDKDh06bLE8= HTTP 307
https://u29298097.ct.sendgrid.net/ls/click?upn=0qQuu4TpfEINn168nQlWxUYm4rTxQxLMSL-2B8GgV4e-2F4FbL30fi9sQsDRxZTw4zjAy3we0Yy1coCukyHT7MU0EECq5ejrM4z-2FbzwGT9VX4Fdt7ftYmLCh82RjFLaNomeFMNwyYte6NkzCjmBai3QhwQOR0AnhL-2FdKh0IpYQtJzaw-3DFS7w_jf835s-2BEZKoYZ2Wx5dkUf2KUqB1ufkxhUcuabRtU6AcXX7eP-2Fss47rr7dTl3Wzo1F2XFrQ9I-2BlnUAJ-2FzyLg2n-2FKIChfUuwziQ8trv57IHjGXycenhA5XpT56TK6-2B521-2FQiSuaIVkpOaqqw10sIUYv3D-2F91vKBEQpgIrmftdLg8R00z696uOTzdpncHC160jb-2FIs2vgAtYzeT0BIDwpIbYWKAc0nuF4N3kFIge5XMVrJThzh-2F8pdwye-2B15Nv8YhNAbodUSuKmZ7XBX015gZgNqC-2BI-2B-2FqQ4dLqKhVTHSJICFDwSqWgz9bOFFwT-2FYB4zG5Y2vxylRXmqOC1nsCU8vpUCFuwrWhGeE0VYwJHKXEprIFKQtz6RISdeUh7E7AqBf-2FYVyQywtk0WdqXTiJ5GrrJevxHAy6AEH36DhlrGIleD8Y4J1Zc7-2BGpwkhM6i8QoIO2sHr6N4Do6J-2F42KjHdai6lZdaQxeko0k-2FepJdXwlSopLRp3wDntPNSfjn1Ycr4tV5pup54A9vvQrR1vvoX91Zci2NqpMOY-2Fopxze02OnbTZbv8D72NA7BeUCwEhIjvh5OQCiEOPVlx-2FtmqhHlRK7vH8kSuji-2Fzi7Te5y-2FqcbPxg4oJG0xzLTwz5-2BwjDIP1PpqJI7mvXaC3M788cdfF8ZnIccDWREFhe0EIOZ08Dox3nqfEv5U7BmyTskEyG2yad5yQPrMiBIS41FsCdS5qYaJn4d45dvztj9ppVSj4Ski0w9-2BNs-2BW7b42JpkuzS9oE-2FNTOqGuTxYYAS1b6KU6l2OcaPEqdnbtFymUUwSWgi-2BKQUsR5Lcrfg-2BRQETn-2BLH5RXQsIpXZI2ceNV-2FxdBNMnmSDXKunXf3SEbZme6kSMAXIgedvcbqW-2FGuzzPDEeOn0hbPGjyx-2BKGwFF7TPywG4i4UzDI-2BJ3Eh7BW3gVZMC14HM2MNSbaAYIlXRNDzDXieuU8Mlp-2B5BWJ-2BTVJELOkylprtPjEenoNvdtcSYsDOcUsEK4AA-3D HTTP 302
https://000940tvjrhchv30kk4ot9mrqdkriraj36ddoco8cijjm8c88a7lg78.web3portal.com/

Request Chain 10

https://logo.clearbit.com/https://barclays.com HTTP 301
https://logo.clearbit.com/https:/barclays.com

12 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

/
000940tvjrhchv30kk4ot9mrqdkriraj36ddoco8cijjm8c88a7lg78.web3portal.com/
Redirect Chain

https://clicktime.symantec.com/15sM65e3ABbc8RKacbNLB?h=RHyxwvJN_jueZvpcpIf4ypPXhl6J7tvjFDKDh06bLE8=
https://u29298097.ct.sendgrid.net/ls/click?upn=0qQuu4TpfEINn168nQlWxUYm4rTxQxLMSL-2B8GgV4e-2F4FbL30fi9sQsDRxZTw4zjAy3we0Yy1coCukyHT7MU0EECq5ejrM4z-2FbzwGT9VX4Fdt7ftYmLCh82RjFLaNomeFMNwyYte6NkzCjmBa...
https://000940tvjrhchv30kk4ot9mrqdkriraj36ddoco8cijjm8c88a7lg78.web3portal.com/

569 B
1 KB

1056ms
759ms

Document
text/html

185.150.190.66
RELIABLESITE

General

Check archive.org

Show headers Download Go to

Full URL

https://000940tvjrhchv30kk4ot9mrqdkriraj36ddoco8cijjm8c88a7lg78.web3portal.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.150.190.66 , United States, ASN23470 (RELIABLESITE, US),

Reverse DNS

Software

openresty/1.19.9.1 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36
accept-language: se-SE,se;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,If-None-Match,Cache-Control,Content-Type,Range,X-HTTP-Method-Override,upload-offset,upload-metadata,upload-length,tus-version,tus-resumable,tus-extension,tus-max-size,upload-concat,location,Skynet-API-Key
access-control-allow-methods: GET, POST, HEAD, OPTIONS, PUT, PATCH, DELETE
access-control-expose-headers: Content-Length,Content-Range,ETag,Accept-Ranges,Skynet-File-Metadata,Skynet-Skylink,Skynet-Proof,Skynet-Portal-Api,Skynet-Server-Api,upload-offset,upload-metadata,upload-length,tus-version,tus-resumable,tus-extension,tus-max-size,upload-concat,location
content-disposition: inline; filename="REDirect.html"
content-encoding: gzip
content-type: text/html
date: Sat, 01 Oct 2022 05:37:24 GMT
etag: W/"727d862fbd94d757c8f4f833205457ddbe07bb55fc46536ce370abc29b338be8"
server: openresty/1.19.9.1
skynet-cache-ratio: 1
skynet-portal-api: https://web3portal.com
skynet-server-api: https://web3portal.com
skynet-skylink: AACSA7-e4sj8YKUJjqbb02m5bVMZmtwzCGSnOyGIQo9YHQ
strict-transport-security: max-age=63072000
vary: Accept-Encoding

Redirect headers

Connection: keep-alive
Content-Length: 132
Content-Type: text/html; charset=utf-8
Date: Sat, 01 Oct 2022 05:37:23 GMT
Location: https://000940tvjrhchv30kk4ot9mrqdkriraj36ddoco8cijjm8c88a7lg78.web3portal.com#aggelos.stylianos@barclays.com
Server: nginx
X-Robots-Tag: noindex, nofollow

GET
H2 200 Primary Request / Show response
8g0fn404aviuvcmbtkl7jtcg9l8sp6eb9fnsh2ld0112b399ptaac20.web3portal.com/ 48 KB
26 KB 1341ms
1308ms Document
text/html 185.150.190.66
RELIABLESITE

General

Check archive.org

Show headers Download Go to

Full URL

https://8g0fn404aviuvcmbtkl7jtcg9l8sp6eb9fnsh2ld0112b399ptaac20.web3portal.com/?_kx=vTIPy2K0mY5ynYi-htrNCPhQFCkzF14ihGKH0x1jZ_4=.RGBj4d

Requested by

Host: 000940tvjrhchv30kk4ot9mrqdkriraj36ddoco8cijjm8c88a7lg78.web3portal.com
URL: https://000940tvjrhchv30kk4ot9mrqdkriraj36ddoco8cijjm8c88a7lg78.web3portal.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.150.190.66 , United States, ASN23470 (RELIABLESITE, US),

Reverse DNS

Software

openresty/1.19.9.1 /

Resource Hash

d1788fa4cffce823f0818b821d6b31339735a058288c14812db89a49fdcc13ac

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

Referer: https://000940tvjrhchv30kk4ot9mrqdkriraj36ddoco8cijjm8c88a7lg78.web3portal.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36
accept-language: se-SE,se;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,If-None-Match,Cache-Control,Content-Type,Range,X-HTTP-Method-Override,upload-offset,upload-metadata,upload-length,tus-version,tus-resumable,tus-extension,tus-max-size,upload-concat,location,Skynet-API-Key
access-control-allow-methods: GET, POST, HEAD, OPTIONS, PUT, PATCH, DELETE
access-control-expose-headers: Content-Length,Content-Range,ETag,Accept-Ranges,Skynet-File-Metadata,Skynet-Skylink,Skynet-Proof,Skynet-Portal-Api,Skynet-Server-Api,upload-offset,upload-metadata,upload-length,tus-version,tus-resumable,tus-extension,tus-max-size,upload-concat,location
content-disposition: inline; filename="ACCESSsia.html"
content-encoding: gzip
content-type: text/html
date: Sat, 01 Oct 2022 05:37:25 GMT
etag: W/"b260b360da7f20bc47d707b88b378fe8a21355ec3acfb8243a3453ceb045301b"
server: openresty/1.19.9.1
skynet-cache-ratio: 1
skynet-portal-api: https://web3portal.com
skynet-server-api: https://web3portal.com
skynet-skylink: RAD7kARX5e-yy-0qefWQTVHMmctL78iKrQBCJY0pz1SmCA
strict-transport-security: max-age=63072000
vary: Accept-Encoding

GET
H2 200 bootstrap.min.css
stackpath.bootstrapcdn.com/bootstrap/4.5.2/css/ 157 KB
25 KB 116ms
40ms Stylesheet
text/css 104.18.11.207
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://stackpath.bootstrapcdn.com/bootstrap/4.5.2/css/bootstrap.min.css

Requested by

Host: 8g0fn404aviuvcmbtkl7jtcg9l8sp6eb9fnsh2ld0112b399ptaac20.web3portal.com
URL: https://8g0fn404aviuvcmbtkl7jtcg9l8sp6eb9fnsh2ld0112b399ptaac20.web3portal.com/?_kx=vTIPy2K0mY5ynYi-htrNCPhQFCkzF14ihGKH0x1jZ_4=.RGBj4d

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.11.207 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5b0fbe5b7ad705f6a937c4998ad02f73d8f0d976fe231b74aef0ec996990c93a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://8g0fn404aviuvcmbtkl7jtcg9l8sp6eb9fnsh2ld0112b399ptaac20.web3portal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Sat, 01 Oct 2022 05:37:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
cdn-edgestorageid: 601, 617, 617
age: 13912949
cdn-cachedat: 2021-04-23 06:38:57
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Mon, 25 Jan 2021 22:04:11 GMT
server: cloudflare
cdn-requestpullcode: 200
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cache-control: public, max-age=31919000
cdn-requestid: 13251c3df5248784fca36d69c81e4532
timing-allow-origin: *
cdn-requestcountrycode: SE
cf-ray: 7532d8a7e98b9906-ARN
cdn-requestpullsuccess: True

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 109 KB
43 KB 192ms
70ms Script
application/javascript 142.250.184.200
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-48347893-1

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.200 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

4468c3f915285a29f464c5b7777be51691636982d9e48cbc0d3fcbc09c71c0bb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://8g0fn404aviuvcmbtkl7jtcg9l8sp6eb9fnsh2ld0112b399ptaac20.web3portal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Sat, 01 Oct 2022 05:37:25 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 43419
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sat, 01 Oct 2022 05:37:25 GMT

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.6.0/ 87 KB
31 KB 226ms
63ms Script
text/javascript 142.251.39.74
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.6.0/jquery.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.39.74 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bud02s39-in-f10.1e100.net

Software

sffe /

Resource Hash

ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://8g0fn404aviuvcmbtkl7jtcg9l8sp6eb9fnsh2ld0112b399ptaac20.web3portal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Sat, 01 Oct 2022 03:29:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 7679
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 31017
x-xss-protection: 0
last-modified: Wed, 10 Mar 2021 14:28:09 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 01 Oct 2023 03:29:26 GMT

GET
H2 403 mesg_en.js
d12y7sg0iam4lc.cloudfront.net/b1268/s/js/ 0
0 780ms
647ms Script
application/xml 52.222.139.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d12y7sg0iam4lc.cloudfront.net/b1268/s/js/mesg_en.js
Requested by: Host: 8g0fn404aviuvcmbtkl7jtcg9l8sp6eb9fnsh2ld0112b399ptaac20.web3portal.com
URL: https://8g0fn404aviuvcmbtkl7jtcg9l8sp6eb9fnsh2ld0112b399ptaac20.web3portal.com/?_kx=vTIPy2K0mY5ynYi-htrNCPhQFCkzF14ihGKH0x1jZ_4=.RGBj4d
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.139.122 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-139-122.ams50.r.cloudfront.net
Software: /
Resource Hash

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://8g0fn404aviuvcmbtkl7jtcg9l8sp6eb9fnsh2ld0112b399ptaac20.web3portal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

GET
H2 403 pack.min.js
d12y7sg0iam4lc.cloudfront.net/b1268/s/js/ 0
0 748ms
649ms Script
application/xml 52.222.139.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d12y7sg0iam4lc.cloudfront.net/b1268/s/js/pack.min.js
Requested by: Host: 8g0fn404aviuvcmbtkl7jtcg9l8sp6eb9fnsh2ld0112b399ptaac20.web3portal.com
URL: https://8g0fn404aviuvcmbtkl7jtcg9l8sp6eb9fnsh2ld0112b399ptaac20.web3portal.com/?_kx=vTIPy2K0mY5ynYi-htrNCPhQFCkzF14ihGKH0x1jZ_4=.RGBj4d
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.139.122 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-139-122.ams50.r.cloudfront.net
Software: /
Resource Hash

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://8g0fn404aviuvcmbtkl7jtcg9l8sp6eb9fnsh2ld0112b399ptaac20.web3portal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

GET
H/1.1 200
OK appleid.auth.js Show response
appleid.cdn-apple.com/appleauth/static/jsapi/appleid/1/en_US/ 42 KB
17 KB 336ms
75ms Script
application/javascript 104.103.101.221
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://appleid.cdn-apple.com/appleauth/static/jsapi/appleid/1/en_US/appleid.auth.js

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.103.101.221 Vienna, Austria, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-103-101-221.deploy.static.akamaitechnologies.com

Software

Apple /

Resource Hash

60e60bf2583cf7444b00a4b0b8d46de5fd5816f768fc72fd71c643357132df69

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://8g0fn404aviuvcmbtkl7jtcg9l8sp6eb9fnsh2ld0112b399ptaac20.web3portal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Content-Encoding: gzip
Date: Sat, 01 Oct 2022 05:37:25 GMT
Last-Modified: Thu, 29 Sep 2022 18:45:50 GMT
Server: Apple
ETag: W/"42671-1664477150090"
Vary: accept-encoding
Content-Type: application/javascript;charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=86400,stale-while-revalidate=86400
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 17247

GET
H2 403 authen.min.js
d12y7sg0iam4lc.cloudfront.net/b1268/s/js/ 0
0 747ms
648ms Script
application/xml 52.222.139.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d12y7sg0iam4lc.cloudfront.net/b1268/s/js/authen.min.js
Requested by: Host: 8g0fn404aviuvcmbtkl7jtcg9l8sp6eb9fnsh2ld0112b399ptaac20.web3portal.com
URL: https://8g0fn404aviuvcmbtkl7jtcg9l8sp6eb9fnsh2ld0112b399ptaac20.web3portal.com/?_kx=vTIPy2K0mY5ynYi-htrNCPhQFCkzF14ihGKH0x1jZ_4=.RGBj4d
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.139.122 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-139-122.ams50.r.cloudfront.net
Software: /
Resource Hash

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://8g0fn404aviuvcmbtkl7jtcg9l8sp6eb9fnsh2ld0112b399ptaac20.web3portal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

GET
DATA 200
OK truncated
/ 16 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2d1c6efc7ba8d7b7a3bd04a9e11a7761c112e4bbc23f74937749067acea91d70

Request headers

accept-language: se-SE,se;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 404 bg-image.jpg
8g0fn404aviuvcmbtkl7jtcg9l8sp6eb9fnsh2ld0112b399ptaac20.web3portal.com/img/ 70 B
70 B 129ms
128ms Image
application/json 185.150.190.66
RELIABLESITE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://8g0fn404aviuvcmbtkl7jtcg9l8sp6eb9fnsh2ld0112b399ptaac20.web3portal.com/img/bg-image.jpg

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

185.150.190.66 , United States, ASN23470 (RELIABLESITE, US),

Reverse DNS

Software

openresty/1.19.9.1 /

Resource Hash

280f7e03c589a5f2640f3e2b4450f54165946786a724cc4612c0d084239e7614

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://8g0fn404aviuvcmbtkl7jtcg9l8sp6eb9fnsh2ld0112b399ptaac20.web3portal.com/?_kx=vTIPy2K0mY5ynYi-htrNCPhQFCkzF14ihGKH0x1jZ_4=.RGBj4d
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Sat, 01 Oct 2022 05:37:25 GMT
skynet-portal-api: https://web3portal.com
strict-transport-security: max-age=63072000
server: openresty/1.19.9.1
skynet-server-api: https://web3portal.com
access-control-allow-methods: GET, POST, HEAD, OPTIONS, PUT, PATCH, DELETE
content-type: application/json; charset=utf-8
skynet-cache-ratio: 1
access-control-expose-headers: Content-Length,Content-Range,ETag,Accept-Ranges,Skynet-File-Metadata,Skynet-Skylink,Skynet-Proof,Skynet-Portal-Api,Skynet-Server-Api,upload-offset,upload-metadata,upload-length,tus-version,tus-resumable,tus-extension,tus-max-size,upload-concat,location
access-control-allow-credentials: true
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,If-None-Match,Cache-Control,Content-Type,Range,X-HTTP-Method-Override,upload-offset,upload-metadata,upload-length,tus-version,tus-resumable,tus-extension,tus-max-size,upload-concat,location,Skynet-API-Key
content-length: 70

GET
H2

200

barclays.com
logo.clearbit.com/https:/
Redirect Chain

https://logo.clearbit.com/https://barclays.com
https://logo.clearbit.com/https:/barclays.com

8 KB
8 KB

57ms
57ms

Image
image/png

13.227.219.73
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://logo.clearbit.com/https:/barclays.com

Requested by

Protocol

Server

13.227.219.73 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-219-73.ams54.r.cloudfront.net

Software

envoy /

Resource Hash

4bb34f89507154eb8440b8fb4c85ad58080041c1b6b63a75ec89bf28641ed36a

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://8g0fn404aviuvcmbtkl7jtcg9l8sp6eb9fnsh2ld0112b399ptaac20.web3portal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Thu, 29 Sep 2022 12:48:47 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff
via: 1.1 fe106b75368b4a44b0461d7e712cd360.cloudfront.net (CloudFront)
server: envoy
x-amz-cf-pop: AMS54-C1
age: 146918
x-cache: Hit from cloudfront
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=2592000
x-amz-cf-id: gkB7qVPnxwqJldtVxwgtUo3dh7Jx6hRYC1A2FGjijx4jZq-Qmz_S3g==

Redirect headers

date: Sat, 01 Oct 2022 05:37:26 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff
via: 1.1 fe106b75368b4a44b0461d7e712cd360.cloudfront.net (CloudFront)
server: envoy
x-amz-cf-pop: AMS54-C1
x-cache: Miss from cloudfront
content-type: text/html; charset=utf-8
location: /https:/barclays.com
content-length: 55
x-amz-cf-id: Mlzp44QMRax_XcmOxZ29CCjW78PLq7yPiUjm6V0GalR8WIsffr0rMg==

GET
H2 200 barclays.com
image.thum.io/get/width/1920/auth/59515-8e4ca0ef2dc92f5257cbf26280b32226/https:// 976 KB
978 KB 566ms
352ms Image
image/png 52.222.214.71
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image.thum.io/get/width/1920/auth/59515-8e4ca0ef2dc92f5257cbf26280b32226/https://barclays.com
Requested by: Host: 8g0fn404aviuvcmbtkl7jtcg9l8sp6eb9fnsh2ld0112b399ptaac20.web3portal.com
URL: https://8g0fn404aviuvcmbtkl7jtcg9l8sp6eb9fnsh2ld0112b399ptaac20.web3portal.com/?_kx=vTIPy2K0mY5ynYi-htrNCPhQFCkzF14ihGKH0x1jZ_4=.RGBj4d
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.214.71 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-214-71.fra56.r.cloudfront.net
Software: /
Resource Hash: beb1f3b3cf8d89cd694a2a7cbc50950fef8f6ecfc2090ec2ec6758c3892197c5

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://8g0fn404aviuvcmbtkl7jtcg9l8sp6eb9fnsh2ld0112b399ptaac20.web3portal.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Sat, 01 Oct 2022 05:37:26 GMT
via: 1.1 59439a13f6db75e801a63663b4f79372.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P3
x-cache: Miss from cloudfront
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=86400
content-disposition: inline; filename= "barclays.com.png"
thum_status_code: 200
x-amz-cf-id: EJt3U_aozuXmcwPrhYqPTQjxFG7ySHw-7RSqFbAkRpFjbUscJztzEg==
expires: Sun, 02 Oct 2022 05:37:26 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Email (Online) Barclays (Banking)

19 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://8g0fn404aviuvcmbtkl7jtcg9l8sp6eb9fnsh2ld0112b399ptaac20.web3portal.com/img/bg-image.jpg Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://d12y7sg0iam4lc.cloudfront.net/b1268/s/js/mesg_en.js Message: Failed to load resource: the server responded with a status of 403 ()
network	error	URL: https://d12y7sg0iam4lc.cloudfront.net/b1268/s/js/authen.min.js Message: Failed to load resource: the server responded with a status of 403 ()
network	error	URL: https://d12y7sg0iam4lc.cloudfront.net/b1268/s/js/pack.min.js Message: Failed to load resource: the server responded with a status of 403 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=63072000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

000940tvjrhchv30kk4ot9mrqdkriraj36ddoco8cijjm8c88a7lg78.web3portal.com
8g0fn404aviuvcmbtkl7jtcg9l8sp6eb9fnsh2ld0112b399ptaac20.web3portal.com
ajax.googleapis.com
appleid.cdn-apple.com
clicktime.symantec.com
d12y7sg0iam4lc.cloudfront.net
image.thum.io
logo.clearbit.com
stackpath.bootstrapcdn.com
u29298097.ct.sendgrid.net
www.googletagmanager.com
104.103.101.221
104.18.11.207
13.227.219.73
142.250.184.200
142.251.39.74
167.89.115.54
185.150.190.66
52.222.139.122
52.222.214.71
54.246.29.234
280f7e03c589a5f2640f3e2b4450f54165946786a724cc4612c0d084239e7614
2d1c6efc7ba8d7b7a3bd04a9e11a7761c112e4bbc23f74937749067acea91d70
4468c3f915285a29f464c5b7777be51691636982d9e48cbc0d3fcbc09c71c0bb
4bb34f89507154eb8440b8fb4c85ad58080041c1b6b63a75ec89bf28641ed36a
5b0fbe5b7ad705f6a937c4998ad02f73d8f0d976fe231b74aef0ec996990c93a
60e60bf2583cf7444b00a4b0b8d46de5fd5816f768fc72fd71c643357132df69
beb1f3b3cf8d89cd694a2a7cbc50950fef8f6ecfc2090ec2ec6758c3892197c5
d1788fa4cffce823f0818b821d6b31339735a058288c14812db89a49fdcc13ac
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

8g0fn404aviuvcmbtkl7jtcg9l8sp6eb9fnsh2ld0112b399ptaac20.web3portal.com Open in urlscan Pro 185.150.190.66 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

12 Requests

92 %HTTPS

0 %IPv6

10 Domains

11 Subdomains

9 IPs

4 Countries

1130 kBTransfer

1443 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

19 JavaScript Global Variables

0 Cookies

4 Console Messages

Security Headers

Indicators

8g0fn404aviuvcmbtkl7jtcg9l8sp6eb9fnsh2ld0112b399ptaac20.web3portal.com Open in urlscan Pro
185.150.190.66 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

92 %
HTTPS

0 %
IPv6

10
Domains

11
Subdomains

9
IPs

4
Countries

1130 kB
Transfer

1443 kB
Size

0
Cookies

12 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!