![](/screenshots/defbcfa1-85d6-4f43-ad70-34e05efdf15b.png)
coinbase.com.lending-app.pro
Open in
urlscan Pro
194.50.153.48
Malicious Activity!
Public Scan
Effective URL: https://coinbase.com.lending-app.pro/?_t=3aca56371967418192255878e9689713&_m=7613d79a1c1644008c4f3784cb7f7b9d&_e=pFHYLuiNhHZrXfJ0TMqV...
Submission: On July 27 via manual from NL — Scanned from NL
Summary
TLS certificate: Issued by R3 on July 14th 2023. Valid for: 3 months.
This is the only time coinbase.com.lending-app.pro was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Coinbase (Crypto Exchange)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 18 | 194.50.153.48 194.50.153.48 | 202973 (WAICORE-T...) (WAICORE-TRANSIT) | |
17 | 1 |
ASN202973 (WAICORE-TRANSIT, RU)
cbstklndfr.pro | |
coinbase.com.lending-app.pro |
Apex Domain Subdomains |
Transfer | |
---|---|---|
17 |
lending-app.pro
coinbase.com.lending-app.pro |
288 KB |
1 |
cbstklndfr.pro
1 redirects
cbstklndfr.pro |
666 B |
17 | 2 |
Domain | Requested by | |
---|---|---|
17 | coinbase.com.lending-app.pro |
coinbase.com.lending-app.pro
|
1 | cbstklndfr.pro | 1 redirects |
17 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
coinbase.com.lending-app.pro R3 |
2023-07-14 - 2023-10-12 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://coinbase.com.lending-app.pro/?_t=3aca56371967418192255878e9689713&_m=7613d79a1c1644008c4f3784cb7f7b9d&_e=pFHYLuiNhHZrXfJ0TMqV4b6pZLMM5QKoTAKZy84mBsaZ_Ul1WTAYhqte2jISPdw94Xx3BUB5VEiOhlmtS5a_K7GqeenlptZMEvRgBgLE_nPPWrpmgBh3LLUTZZTlBWUxRnfW7HDJXl9_ICkQthSaSX5uoVFH-QPSKeGpCoq06fkJElQ-pDTXt7Ms3mxmw9fUq7WHRDe9VgOwvZVSbEymM1I_lBWhTUS8cQJBKDheEzQuVQw-wvFnmX7-ZxyvPU-T-S1tSBMslcdFFMcn-c4MMCglZSCHw5gLx5j_pkcb-MBsdHW8yu5H6UTd_OLzIr9xMttp9ndslpzhnGpqq3gYh8FnFFbuEEXZNkN79m6D_nCIupRiZVNOgaGQGvHma0ka
Frame ID: E452621A40C19E7F3AB95056FB67AF97
Requests: 17 HTTP requests in this frame
Screenshot
![](/screenshots/defbcfa1-85d6-4f43-ad70-34e05efdf15b.png)
Page Title
CoinbasePage URL History Show full URLs
-
https://cbstklndfr.pro/lending.php
HTTP 302
https://coinbase.com.lending-app.pro/?_t=3aca56371967418192255878e9689713&_m=7613d79a1c1644008c4f3784cb7f7b9d&_e=... Page URL
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://cbstklndfr.pro/lending.php
HTTP 302
https://coinbase.com.lending-app.pro/?_t=3aca56371967418192255878e9689713&_m=7613d79a1c1644008c4f3784cb7f7b9d&_e=pFHYLuiNhHZrXfJ0TMqV4b6pZLMM5QKoTAKZy84mBsaZ_Ul1WTAYhqte2jISPdw94Xx3BUB5VEiOhlmtS5a_K7GqeenlptZMEvRgBgLE_nPPWrpmgBh3LLUTZZTlBWUxRnfW7HDJXl9_ICkQthSaSX5uoVFH-QPSKeGpCoq06fkJElQ-pDTXt7Ms3mxmw9fUq7WHRDe9VgOwvZVSbEymM1I_lBWhTUS8cQJBKDheEzQuVQw-wvFnmX7-ZxyvPU-T-S1tSBMslcdFFMcn-c4MMCglZSCHw5gLx5j_pkcb-MBsdHW8yu5H6UTd_OLzIr9xMttp9ndslpzhnGpqq3gYh8FnFFbuEEXZNkN79m6D_nCIupRiZVNOgaGQGvHma0ka Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
17 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
coinbase.com.lending-app.pro/ Redirect Chain
|
6 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
84b8ad28acc25855-s.p.woff2
coinbase.com.lending-app.pro/_next/static/media/ |
25 KB 25 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
335ed26c2a759467.css
coinbase.com.lending-app.pro/_next/static/css/ |
90 KB 14 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
webpack-0fca1534235a17f9.js
coinbase.com.lending-app.pro/_next/static/chunks/ |
4 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
framework-5e8ac8dd643904dd.js
coinbase.com.lending-app.pro/_next/static/chunks/ |
138 KB 45 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
main-5ac831401d78e836.js
coinbase.com.lending-app.pro/_next/static/chunks/ |
94 KB 28 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
_app-d370be6e6bd77ccf.js
coinbase.com.lending-app.pro/_next/static/chunks/pages/ |
400 KB 129 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
81-fe512148664386e9.js
coinbase.com.lending-app.pro/_next/static/chunks/ |
70 KB 21 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
555-fdc2786f2649bb5b.js
coinbase.com.lending-app.pro/_next/static/chunks/ |
11 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
index-8e4d40b743cb80ee.js
coinbase.com.lending-app.pro/_next/static/chunks/pages/ |
23 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
_buildManifest.js
coinbase.com.lending-app.pro/_next/static/ghMRgfQVFN00T5cXRh4DO/ |
665 B 1020 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
_ssgManifest.js
coinbase.com.lending-app.pro/_next/static/ghMRgfQVFN00T5cXRh4DO/ |
77 B 430 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo.svg
coinbase.com.lending-app.pro/ |
4 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
data
coinbase.com.lending-app.pro/api/client/ |
6 KB 6 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
visitor
coinbase.com.lending-app.pro/api/client/ |
1 B 272 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
markets-d973b32d0522f009.js
coinbase.com.lending-app.pro/_next/static/chunks/pages/ |
0 2 KB |
Other
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
markets-d973b32d0522f009.js
coinbase.com.lending-app.pro/_next/static/chunks/pages/ |
6 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Coinbase (Crypto Exchange)10 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| webpackChunk_N_E function| __next_require__ object| next object| __NEXT_DATA__ function| __SSG_MANIFEST_CB object| __NEXT_P object| _N_E object| __MIDDLEWARE_MATCHERS object| __BUILD_MANIFEST object| __SSG_MANIFEST0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cbstklndfr.pro
coinbase.com.lending-app.pro
194.50.153.48
126270d27d1ac1a29b8d7d01238377840fe79b70212bd230adc6b2d9da82bf38
2d8531b2fbebf2e434e0256835fa49cf47f78fd1c38e40383abe8787052f9ee3
38fa208cb4cd9ba6a2a796d6fd8ee041ced02862df3cbbbc4a97b68fd04d1777
3d7535fc10b05943456486d50143cf42df813e92a3ccd23161ebd0f4e4b1df9b
4597e5bece2391cd49b4e24d79d82bde3caab62b7db061d9b6dc771f9f8db231
4c381b9029f8077a86c0c5a7ac696ccba7f23e4a9a9b6479e875916b4e51f6e7
52c29308df137907df41302cef89c43fde4f8ca47934359f69a522230db97419
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6f5b4aa00d2f8d6aed9935b471806bf7acef464d0c1d390260e5fe27f800c67e
a17206dfd69fdbccdb1c58b1ff26e9f3ee6befd2f095da792a40f9b14f683972
a3e79d01211bb7e0dc36d1e36e74635d45ae343d2e43ff7f4b34f03b2047880f
c6b6486185fe58b68abd73be5eaee68704d70eff7b14b8cb048271a47ccbb698
cb35aa21e65beb523dc45f95beef46320cb0fb8cf02414707e78a8dea105c9cf
da504b9a73fbef8855c28d53e34eadc2c17967640583979dbe99cf3a475d2dea
dd1cf0310a4d6b27407345cc54fbe33ba954688642530082fdb409c9e21fe455
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f1ebf1a64cd020c1dc5a19f2343197af9f3ad284708d41043cc9b3e56e0026d7