accounts.binancezh.top
Open in
urlscan Pro
170.33.8.8
Malicious Activity!
Public Scan
Effective URL: https://accounts.binancezh.top/en/login
Submission: On July 13 via api from PH
Summary
TLS certificate: Issued by RapidSSL TLS DV RSA Mixed SHA256 2020... on May 8th 2021. Valid for: a year.
This is the only time accounts.binancezh.top was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Crypto (Crypto Exchange)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 3 | 170.33.8.8 170.33.8.8 | 134963 (ASEPL-AS-...) (ASEPL-AS-AP Alibaba.com Singapore E-Commerce Private Limited) | |
15 | 101.33.11.25 101.33.11.25 | 132203 (TENCENT-N...) (TENCENT-NET-AP-CN Tencent Building) | |
2 | 2a00:1450:400... 2a00:1450:4001:80f::200e | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:812::2008 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:400c:c08::9c | 15169 (GOOGLE) (GOOGLE) | |
1 | 34.120.195.249 34.120.195.249 | 15169 (GOOGLE) (GOOGLE) | |
21 | 6 |
ASN134963 (ASEPL-AS-AP Alibaba.com Singapore E-Commerce Private Limited, SG)
accounts.binancezh.top |
ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN)
static-file-1259603563.file.myqcloud.com |
ASN15169 (GOOGLE, US)
www.google-analytics.com |
ASN15169 (GOOGLE, US)
www.googletagmanager.com |
ASN15169 (GOOGLE, US)
PTR: 249.195.120.34.bc.googleusercontent.com
o529943.ingest.sentry.io |
Apex Domain Subdomains |
Transfer | |
---|---|---|
15 |
myqcloud.com
static-file-1259603563.file.myqcloud.com |
659 KB |
3 |
binancezh.top
2 redirects
accounts.binancezh.top |
24 KB |
2 |
google-analytics.com
www.google-analytics.com |
19 KB |
1 |
sentry.io
o529943.ingest.sentry.io |
249 B |
1 |
doubleclick.net
stats.g.doubleclick.net |
89 B |
1 |
googletagmanager.com
www.googletagmanager.com |
34 KB |
21 | 6 |
Domain | Requested by | |
---|---|---|
15 | static-file-1259603563.file.myqcloud.com |
accounts.binancezh.top
static-file-1259603563.file.myqcloud.com |
3 | accounts.binancezh.top | 2 redirects |
2 | www.google-analytics.com |
accounts.binancezh.top
www.google-analytics.com |
1 | o529943.ingest.sentry.io |
static-file-1259603563.file.myqcloud.com
|
1 | stats.g.doubleclick.net |
www.google-analytics.com
|
1 | www.googletagmanager.com |
accounts.binancezh.top
|
21 | 6 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.binancezh.top RapidSSL TLS DV RSA Mixed SHA256 2020 CA-1 |
2021-05-08 - 2022-05-16 |
a year | crt.sh |
*.cdn.myqcloud.com TrustAsia TLS RSA CA |
2020-11-18 - 2021-11-17 |
a year | crt.sh |
*.google-analytics.com GTS CA 1C3 |
2021-06-22 - 2021-09-14 |
3 months | crt.sh |
*.g.doubleclick.net GTS CA 1C3 |
2021-06-22 - 2021-09-14 |
3 months | crt.sh |
*.ingest.sentry.io R3 |
2021-06-26 - 2021-09-24 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://accounts.binancezh.top/en/login
Frame ID: C65713864CFEB19DD623946242115F2E
Requests: 21 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://accounts.binancezh.top/
HTTP 301
https://accounts.binancezh.top/ HTTP 302
https://accounts.binancezh.top/en/login Page URL
Detected technologies
Tengine (Web Servers) ExpandDetected patterns
- headers server /Tengine/i
Google Analytics (Analytics) Expand
Detected patterns
- script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://accounts.binancezh.top/
HTTP 301
https://accounts.binancezh.top/ HTTP 302
https://accounts.binancezh.top/en/login Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
21 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
login
accounts.binancezh.top/en/ Redirect Chain
|
83 KB 24 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
page-0042.7de66ff6.js
static-file-1259603563.file.myqcloud.com/static/chunks/ |
11 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
index.min.css
static-file-1259603563.file.myqcloud.com/static/fonts/ |
1 KB 884 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
font.min.css
static-file-1259603563.file.myqcloud.com/static/fonts/ |
12 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
analytics.js
www.google-analytics.com/ |
48 KB 19 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
gtm.js
www.googletagmanager.com/ |
92 KB 34 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
nav-logo.svg
static-file-1259603563.file.myqcloud.com/static/images/common/ |
3 KB 4 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
qr.png
static-file-1259603563.file.myqcloud.com/static/images/accounts/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
react.production.16.13.0.js
static-file-1259603563.file.myqcloud.com/static/runtime/react/ |
12 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
react-dom.production.16.13.0.js
static-file-1259603563.file.myqcloud.com/static/runtime/react-dom/ |
116 KB 38 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
polyfill-0b9d41947fabadf834c4.js
static-file-1259603563.file.myqcloud.com/static/runtime/ |
143 KB 48 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
webpack-2cc0097e3051de30d003.js
static-file-1259603563.file.myqcloud.com/static/runtime/ |
4 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
framework.542789f8.js
static-file-1259603563.file.myqcloud.com/static/chunks/ |
30 KB 9 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
2edb282b.ff11f2df.js
static-file-1259603563.file.myqcloud.com/static/chunks/ |
70 KB 25 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
commons.1d1b6b85.js
static-file-1259603563.file.myqcloud.com/static/chunks/ |
1 MB 320 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sentry-3f2b1ef218ac5eb28951.js
static-file-1259603563.file.myqcloud.com/static/runtime/ |
157 B 746 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main-5fc478154b0b048afa6b.js
static-file-1259603563.file.myqcloud.com/static/runtime/ |
485 KB 150 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3-29 |
collect
www.google-analytics.com/j/ |
4 B 24 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
stats.g.doubleclick.net/j/ |
1 B 89 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
BinancePlex-Regular.woff2
static-file-1259603563.file.myqcloud.com/static/fonts/bp/ |
43 KB 44 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
/
o529943.ingest.sentry.io/api/5762379/envelope/ |
2 B 249 B |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Crypto (Crypto Exchange)39 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated undefined| search undefined| regexp undefined| params function| ga string| gaFilterExp object| dataLayer object| google_tag_data object| gaplugins object| gaGlobal object| gaData object| google_tag_manager object| React object| ReactDOM string| __shuvi_ssr_public_path__ object| webpackChunkaccounts_ui function| setImmediate function| clearImmediate object| regeneratorRuntime object| __SENTRY__ object| Sentry object| Integrations object| Base64 function| BridgeReceiveEvent boolean| __accelerate_compoleted boolean| ___bncPerformanceRegistered function| _ object| __SHUVI6 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.binancezh.top/ | Name: lang Value: en |
|
.binancezh.top/ | Name: bnc-uuid Value: 2e1d11da-0451-4229-9ac3-268f3c0f4e5e |
|
accounts.binancezh.top/ | Name: aliyungf_tc Value: f8b173ae0dd0b35176e8f24c30b13c486210514982f07de991041e947c1f123b |
|
.binancezh.top/ | Name: _ga Value: GA1.2.502363470.1626145724 |
|
.binancezh.top/ | Name: _gat Value: 1 |
|
.binancezh.top/ | Name: _gid Value: GA1.2.393720440.1626145724 |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Content-Security-Policy | default-src 'self' https://static-file-1259603563.file.myqcloud.com https://public-1259603563.file.myqcloud.com https://*.wistia.com https://*.wistia.net;script-src blob: 'self' undefined https://static.sensorsdata.cn https://monitor.geetest.com https://static.geetest.com https://api.geetest.com https://fast.wistia.com https://static-file-1259603563.file.myqcloud.com https://public-1259603563.file.myqcloud.com 'nonce-71ec54e1-5b5e-4b90-8f2a-319aef935ef1' https://accounts.binancezh.top https://www.googletagmanager.com https://www.google-analytics.com https://www.google.com https://*.wistia.com https://*.wistia.net https://src.litix.io data:;style-src 'self' 'unsafe-inline' blob: https://fast.wistia.com https://static-file-1259603563.file.myqcloud.com https://public-1259603563.file.myqcloud.com undefined https://dn-staticdown.qbox.me https://static.geetest.com;font-src 'self' data: https://static-file-1259603563.file.myqcloud.com https://public-1259603563.file.myqcloud.com https://*.wistia.com https://at.alicdn.com undefined;connect-src 'self' https://static-file-1259603563.file.myqcloud.com https://public-1259603563.file.myqcloud.com wss://stream.yshyqxx.com:443 wss://nbstream.yshyqxx.com:443 wss://haodesk.binance.im https://upload-bnbstatic-com.s3.ap-northeast-1.amazonaws.com https://*.s3-accelerate.amazonaws.com wss://*.binancezh.top https://*.binancezh.top https://frontend-m.binance.cloud https://sensors.binance.cloud https://report.binance.gg https://*.sentry.io https://stats.g.doubleclick.net undefined undefined https://gtm-n3ck8wk-n2nln.uc.r.appspot.com https://tk-dev-s3-bucket.s3.ap-northeast-1.amazonaws.com https://tk-prod-account-s3-bucket-photo.s3.ap-northeast-1.amazonaws.com blob: https://www.google-analytics.com https://www.googletagmanager.com https://*.litix.io https://*.wistia.com https://embedwistia-a.akamaihd.net;img-src 'self' data: blob: undefined https://tk-prod-account-s3-bucket-photo.s3.ap-northeast-1.amazonaws.com https://tk-dev-s3-bucket.s3.ap-northeast-1.amazonaws.com https://static.geetest.com https://dn-staticdown.qbox.me https://us-central1-madrid-investing.cloudfunctions.net https://embed-fastly.wistia.com https://sensors.binance.cloud https://static-file-1259603563.file.myqcloud.com https://public-1259603563.file.myqcloud.com https://upload-bnbstatic-com.s3.ap-northeast-1.amazonaws.com https://public.bnbstatic.com https://www.googletagmanager.com https://www.google-analytics.com https://googleads.g.doubleclick.net https://www.google.com https://analytics.twitter.com https://t.co https://www.facebook.com https://*.wistia.com https://*.wistia.net https://embedwistia-a.akamaihd.net;media-src 'self' https://static-file-1259603563.file.myqcloud.com https://public-1259603563.file.myqcloud.com https://*.wistia.com https://*.wistia.net https://embedwistia-a.akamaihd.net undefined https://fast.wistia.net blob:;frame-src 'self' undefined https://ss.datasconsole.com https://fast.wistia.com https://fast.wistia.net https://bid.g.doubleclick.net;object-src 'none';base-uri 'self' |
Strict-Transport-Security | max-age=86400 |
X-Content-Type-Options | nosniff |
X-Frame-Options | SAMEORIGIN |
X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
accounts.binancezh.top
o529943.ingest.sentry.io
static-file-1259603563.file.myqcloud.com
stats.g.doubleclick.net
www.google-analytics.com
www.googletagmanager.com
101.33.11.25
170.33.8.8
2a00:1450:4001:80f::200e
2a00:1450:4001:812::2008
2a00:1450:400c:c08::9c
34.120.195.249
14db4ca6b522ff67b02d2132a94ce107339e2f99b393ba5c847a7dbcdc705128
194cdc9d3a1282370bd2a011cd12142eaf4c671031b3a303a707cec1cd1a2fea
1bf4f3037f4ba06cf9785caf053901b435eed7950231fa043f04b8eaf2dd2bb9
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
4abb7d5a60c2a3b5f39a326c276768b47cf1efbf0320d1e78db65f0221402e7a
551ff1dbd0df95853706e675f7627394eb5613cc51f68683258567ecba12a996
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6cfd0ad7e4b5118750a51764ca18025be579980443e3b50c5c5836da7a657f7a
6e3438d9a73710dd06a8ae34a42f601a2fd88b1bcac99db8a8c3fff478865bbc
739f5b8afb10a2c9c8bf79ad1f79752745ddf3b336acc8f717ac167aea7b76db
73d6a5ea11fb7bf6e6a6ccd44b1635d52c79b0a00623d0387c9dddd4b7c68e89
753815555234c3a3a15d19b0eab23c8f1115a96b725ef6706c89c9935d0f95d5
7619529d2ecdd660ad9d274119649bd2bdae601dac4420690e65cdaaef83eeb5
891b2e701fa8c91c80e3108996007e53e83f8fdab77c5c5f9534025c523b7736
a9f935ee2230110b536fcbe1a3829e1c6a49172abeea899a5d82f6b1f7de6da1
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
b6b4b56e082770f5de03a9c75b45076120fa5f86d84633fba78333ce4ed5f226
c84baa37c5b3e20aa74054f534c546afd2fd75f7320a3d12ba91065280473565
d9d20ebb5a1655cf08741c38aaa26ff5991ab358d4aed88398e29505a739d1af
df61a6c39ac10d7c8c8e0ffbdc5829ba4a1365d32bc6e616eed8fc69d6cdf33e
eb214b548ceae3c938cb8f90990e456e7d2b978ffee0e599c2c7dc93d373ec5a