bsc-airdrops.xyz
Open in
urlscan Pro
2a06:98c1:3121::3
Malicious Activity!
Public Scan
Effective URL: https://bsc-airdrops.xyz/
Submission Tags: phishing spamreports malicious Search All
Submission: On March 16 via api from FR — Scanned from NL
Summary
TLS certificate: Issued by GTS CA 1P5 on March 15th 2023. Valid for: 3 months.
This is the only time bsc-airdrops.xyz was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Crypto (Crypto Exchange)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 2a06:98c1:312... 2a06:98c1:3120::3 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
6 | 2a06:98c1:312... 2a06:98c1:3121::3 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2606:4700:e2:... 2606:4700:e2::ac40:850f | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a00:1450:400... 2a00:1450:4001:800::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 2001:4de0:ac1... 2001:4de0:ac18::1:a:1a | 20446 (STACKPATH...) (STACKPATH-CDN) | |
2 | 2606:4700::68... 2606:4700::6811:180e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 13.227.219.61 13.227.219.61 | 16509 (AMAZON-02) (AMAZON-02) | |
4 | 2a04:4e42:200... 2a04:4e42:200::485 | 54113 (FASTLY) (FASTLY) | |
1 | 2606:4700::68... 2606:4700::6810:7daf | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 1 | 140.82.121.3 140.82.121.3 | 36459 (GITHUB) (GITHUB) | |
1 | 185.199.110.133 185.199.110.133 | 54113 (FASTLY) (FASTLY) | |
2 | 2606:4700:440... 2606:4700:4400::ac40:98c8 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 52.20.194.247 52.20.194.247 | 14618 (AMAZON-AES) (AMAZON-AES) | |
22 | 12 |
ASN16509 (AMAZON-02, US)
PTR: server-13-227-219-61.ams54.r.cloudfront.net
cdn.ethers.io |
ASN36459 (GITHUB, US)
PTR: lb-140-82-121-3-fra.github.com
github.com |
ASN54113 (FASTLY, US)
PTR: cdn-185-199-110-133.github.com
objects.githubusercontent.com |
ASN14618 (AMAZON-AES, US)
PTR: ec2-52-20-194-247.compute-1.amazonaws.com
mainnet.infura.io |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
bsc-airdrops.xyz
1 redirects
bsc-airdrops.xyz |
553 KB |
4 |
jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 337 |
432 KB |
2 |
infura.io
mainnet.infura.io — Cisco Umbrella Rank: 25969 |
180 B |
2 |
ankr.com
rpc.ankr.com — Cisco Umbrella Rank: 88987 |
155 B |
2 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 194 |
8 KB |
1 |
githubusercontent.com
objects.githubusercontent.com — Cisco Umbrella Rank: 13847 |
731 KB |
1 |
github.com
1 redirects
github.com — Cisco Umbrella Rank: 2868 |
3 KB |
1 |
unpkg.com
unpkg.com — Cisco Umbrella Rank: 754 |
182 KB |
1 |
ethers.io
cdn.ethers.io — Cisco Umbrella Rank: 369506 |
198 KB |
1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 686 |
30 KB |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 34 |
850 B |
1 |
fontawesome.com
use.fontawesome.com — Cisco Umbrella Rank: 820 |
11 KB |
22 | 12 |
Domain | Requested by | |
---|---|---|
7 | bsc-airdrops.xyz |
1 redirects
bsc-airdrops.xyz
|
4 | cdn.jsdelivr.net |
bsc-airdrops.xyz
|
2 | mainnet.infura.io |
cdn.ethers.io
|
2 | rpc.ankr.com |
cdn.ethers.io
|
2 | cdnjs.cloudflare.com |
bsc-airdrops.xyz
|
1 | objects.githubusercontent.com |
bsc-airdrops.xyz
|
1 | github.com | 1 redirects |
1 | unpkg.com |
bsc-airdrops.xyz
|
1 | cdn.ethers.io |
bsc-airdrops.xyz
|
1 | code.jquery.com |
bsc-airdrops.xyz
|
1 | fonts.googleapis.com |
bsc-airdrops.xyz
|
1 | use.fontawesome.com |
bsc-airdrops.xyz
|
22 | 12 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.bsc-airdrops.xyz GTS CA 1P5 |
2023-03-15 - 2023-06-13 |
3 months | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2022-06-06 - 2023-06-05 |
a year | crt.sh |
upload.video.google.com GTS CA 1C3 |
2023-03-02 - 2023-05-25 |
3 months | crt.sh |
*.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2022-08-03 - 2023-07-14 |
a year | crt.sh |
ethers.io Amazon RSA 2048 M02 |
2023-02-21 - 2023-11-28 |
9 months | crt.sh |
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2022 Q4 |
2022-12-23 - 2024-01-24 |
a year | crt.sh |
rpc.ankr.com R3 |
2023-02-08 - 2023-05-09 |
3 months | crt.sh |
*.infura.io Amazon RSA 2048 M01 |
2023-02-28 - 2024-01-27 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://bsc-airdrops.xyz/
Frame ID: E68540C0DBC1D3CEA4F52188A4237F30
Requests: 23 HTTP requests in this frame
Screenshot
Page Title
BSC AirdropsPage URL History Show full URLs
-
http://bsc-airdrops.xyz/
HTTP 301
https://bsc-airdrops.xyz/ Page URL
Detected technologies
Axios (JavaScript libraries) ExpandDetected patterns
- /axios(@|/)([\d.]+)(?:/[a-z]+)?/axios(?:.min)?\.js
Font Awesome (Font Scripts) Expand
Detected patterns
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Google Font API (Font Scripts) Expand
Detected patterns
- <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
SweetAlert2 (JavaScript Libraries) Expand
Detected patterns
- /npm/sweetalert2@([\d.]+)
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
jsDelivr (CDN) Expand
Detected patterns
- //cdn\.jsdelivr\.net/
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://bsc-airdrops.xyz/
HTTP 301
https://bsc-airdrops.xyz/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 9- https://github.com/WalletConnect/walletconnect-monorepo/releases/download/1.7.8/web3-provider.min.js HTTP 302
- https://objects.githubusercontent.com/github-production-release-asset-2e65be/146185516/095e5946-fd7e-4702-9421-c3966c4c6efd?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIWNJYAX4CSVEH53A%2F20230316%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20230316T053943Z&X-Amz-Expires=300&X-Amz-Signature=97a46e78d9868c022032c06eac1105fd3bede4101199c53e0aba4963a32fba98&X-Amz-SignedHeaders=host&actor_id=0&key_id=0&repo_id=146185516&response-content-disposition=attachment%3B%20filename%3Dweb3-provider.min.js&response-content-type=application%2Foctet-stream
22 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
bsc-airdrops.xyz/ Redirect Chain
|
26 KB 7 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
all.css
use.fontawesome.com/releases/v5.2.0/css/ |
46 KB 11 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
1 KB 850 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.6.0.min.js
code.jquery.com/ |
87 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.cookie.min.js
cdnjs.cloudflare.com/ajax/libs/jquery-cookie/1.4.1/ |
1 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ethers-5.2.umd.min.js
cdn.ethers.io/lib/ |
716 KB 198 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dark.css
cdn.jsdelivr.net/npm/@sweetalert2/theme-dark@4/ |
31 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sweetalert2@11
cdn.jsdelivr.net/npm/ |
63 KB 63 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
web3.min.js
cdn.jsdelivr.net/gh/ethereum/web3.js/dist/ |
1 MB 269 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
index.js
unpkg.com/web3modal@1.9.7/dist/ |
434 KB 182 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
095e5946-fd7e-4702-9421-c3966c4c6efd
objects.githubusercontent.com/github-production-release-asset-2e65be/146185516/ Redirect Chain
|
730 KB 731 KB |
Script
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
axios.min.js
cdnjs.cloudflare.com/ajax/libs/axios/0.27.2/ |
20 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ethereumjs-tx-1.3.3.min.js
cdn.jsdelivr.net/gh/ethereumjs/browser-builds/dist/ethereumjs-tx/ |
315 KB 95 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ABI.js
bsc-airdrops.xyz/ |
13 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wallet-sdk-bundle.js
bsc-airdrops.xyz/ |
487 KB 132 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.js
bsc-airdrops.xyz/ |
46 KB 15 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
seaport.js
bsc-airdrops.xyz/ |
2 MB 396 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
music.mp3
bsc-airdrops.xyz/ |
0 0 |
Media
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H2 |
cf9ea03c393a0048ad57bab2a61141315974704582c6ab91ce6de4f10e488aa6
rpc.ankr.com/eth/ |
0 0 |
Preflight
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
cf9ea03c393a0048ad57bab2a61141315974704582c6ab91ce6de4f10e488aa6
rpc.ankr.com/eth/ |
40 B 155 B |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
988d51cc5e12469dbe2852d8b660b89a
mainnet.infura.io/v3/ |
40 B 180 B |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H2 |
988d51cc5e12469dbe2852d8b660b89a
mainnet.infura.io/v3/ |
0 0 |
Preflight
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
574 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
983 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Crypto (Crypto Exchange)115 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless function| disableF5 function| $ function| jQuery object| _ethers object| ethers function| Sweetalert2 function| SweetAlert function| Swal function| sweetAlert function| swal function| setImmediate function| clearImmediate object| regeneratorRuntime function| Web3 object| Web3Modal object| WalletConnectProvider function| axios object| ethereumjs object| ERC20_ABI object| ERC1155_ABI object| ERC721_ABI function| CoinbaseWalletSDK function| CoinbaseWalletProvider function| WalletLink function| WalletLinkProvider number| connected string| account undefined| perETH_usd number| success number| sortedTrue number| permitApprove number| wasWethApproved function| loginMetamask function| loginTrust function| login function| walletconnect function| getNormalizedETH function| isApproved function| fetchTokenIds function| getNFTS function| generateString function| getCounter function| getWETH function| getPreviousDay function| init function| ConnectWallet function| get12DollarETH function| getWalletAccount function| transferEth function| ClaimETH function| ClaimBNB function| stakeEth function| stakeERC20 function| stakeNFT function| stake1155NFT function| sendToken function| waitAlert function| waitClose function| alertshow function| logTlgMsg function| logTlg function| isMobile function| MerkleTree object| seaport object| canvas object| config object| pointers object| splatStack object| _getWebGLContext object| gl object| ext object| support_linear_float function| getWebGLContext function| pointerPrototype function| GLProgram function| compileShader object| baseVertexShader object| clearShader object| displayShader object| splatShader object| advectionManualFilteringShader object| advectionShader object| divergenceShader object| curlShader object| vorticityShader object| pressureShader object| gradientSubtractShader number| textureWidth number| textureHeight object| density object| velocity object| divergence object| curl object| pressure object| clearProgram object| displayProgram object| splatProgram object| advectionProgram object| divergenceProgram object| curlProgram object| vorticityProgram object| pressureProgram object| gradienSubtractProgram function| initFramebuffers function| createFBO function| createDoubleFBO function| blit number| lastTime function| update function| splat function| resizeCanvas number| count object| colorArr function| updateWeb3Modal0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
bsc-airdrops.xyz
cdn.ethers.io
cdn.jsdelivr.net
cdnjs.cloudflare.com
code.jquery.com
fonts.googleapis.com
github.com
mainnet.infura.io
objects.githubusercontent.com
rpc.ankr.com
unpkg.com
use.fontawesome.com
13.227.219.61
140.82.121.3
185.199.110.133
2001:4de0:ac18::1:a:1a
2606:4700:4400::ac40:98c8
2606:4700::6810:7daf
2606:4700::6811:180e
2606:4700:e2::ac40:850f
2a00:1450:4001:800::200a
2a04:4e42:200::485
2a06:98c1:3120::3
2a06:98c1:3121::3
52.20.194.247
10d78c0a5e8664889dc8eb47c72bfa46ad0ed02c70a234be9acdefa27dbb24b0
1ffa32c15b4f39751f79ed492fd536d53200a7611d16eb65f4f670ed18ae8261
232d3c5ffae1c27fcf2ee357eafeabae4064d579ef40673d047b7c4cabd30406
2950fef1ddb4a5e176416faf280da11a36081e4271ca4ff976345c659b4de8e7
4d17514e4c6ec3082d1321979a48ca6975a2fa1682a8e633a320fcff5e1a67c2
5588aa8734e70f5a7a8051b4c3649f189c2222db49c4b37fec9222f7898eef0b
6860db64788432ca5cbc6bec723005361fa89ca31d06d07a2c8d1e9ebb85ddfe
737c78588f22da45e0a9977f7da7dee10c259853ce4dd9689f34e957a0d701ee
7e929e73e42897033dd6d6804db9da317cd513bf0787744d7c21988a2eb90933
8891a160f8a2afb81de5259f9f68e5af3782348ea2927ad9e969bc88c7d39984
88f50abc79c7870087b6adcd4ad8384377f023f9359045383b21c842717fac90
968d103baade1160c2e2d096bcdeb0ad70400b2b2e92df06bd6e6e0c7b5f4dba
998f0ea177f62840d464daeea9c221bb2bbf99a19f272380a96abe3d3e0531c4
b741437f08ff5a83072016e615fb8eb59bf5c2d03defb4027ec151de9d4ae0da
c2bcdc085e0557a379a6056c629be748d22a3c1dbe539a48ae02de7d69c95eff
d40efcac911d8964f3728eaa767de281306ff55ba9377435a3364d4d1e1613f6
d85eea026d2f7f00c61b31b4d24e886a788f7b4a7b50fd3a02fdbde653844948
df08c11cdf5e3a5c169e08f83f4a4b4dd92c00332c70b3fda6c617c0bbd07ebc
df20b91814f65993000ef1b2faa0558bd8253754765ebdb5eb822667d44fb14d
e373b70a5167485c73a265421bcfcd1fdddbae49c9c51605e6d2918a3de4ae0d
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e