ethereumdrop.com Open in urlscan Pro
185.224.137.98 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://ethereumdrop.com/
Submission: On June 19 via automatic, source phishtank (June 19th 2018, 2:34:23 am UTC)

Summary HTTP 11 Redirects Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 5 IPs in 2 countries across 5 domains to perform 11 HTTP transactions. The main IP is 185.224.137.98, located in and belongs to SERVERIUS-AS, NL. The main domain is ethereumdrop.com.

This is the only time ethereumdrop.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Crypto (Crypto Exchange)

Domain & IP information

	IP Address		AS Autonomous System
4	185.224.137.98 185.224.137.98		50673 (SERVERIUS-AS) (SERVERIUS-AS)
1	2a00:1450:400... 2a00:1450:4001:818::2008		15169 (GOOGLE) (GOOGLE - Google LLC)
1	2a00:1450:400... 2a00:1450:4001:81f::200a		15169 (GOOGLE) (GOOGLE - Google LLC)
2	2a00:1450:400... 2a00:1450:4001:818::200e		15169 (GOOGLE) (GOOGLE - Google LLC)
11	5

4 185.224.137.98 (None, )

ASN50673 (SERVERIUS-AS, NL)

ethereumdrop.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:818::2008 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81f::200a (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

chart.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:818::200e (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	ethereumdrop.com ethereumdrop.com	181 KB
2	google-analytics.com www.google-analytics.com	14 KB
1	googleapis.com chart.googleapis.com	1 KB
1	googletagmanager.com www.googletagmanager.com	24 KB
0	blockchain.info Failed blockchain.info Failed
11	5

	Domain	Requested by
4	ethereumdrop.com	ethereumdrop.com
2	www.google-analytics.com	www.googletagmanager.com ethereumdrop.com
1	chart.googleapis.com	ethereumdrop.com
1	www.googletagmanager.com	ethereumdrop.com
0	blockchain.info Failed	ethereumdrop.com
11	5

This site contains no links.

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://ethereumdrop.com/
Frame ID: 415692D348231829E9879F899830D8E6
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Lua (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

headers server /openresty(?:\/([\d.]+))?/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /openresty(?:\/([\d.]+))?/i

OpenResty (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /openresty(?:\/([\d.]+))?/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|(analytics))\.js/i
env /^gaGlobal$/i

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

env /^google_tag_manager$/i

Page Statistics

11
Requests

0 %
HTTPS

75 %
IPv6

5
Domains

5
Subdomains

5
IPs

2
Countries

220 kB
Transfer

503 kB
Size

3
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
ethereumdrop.com/ 16 KB
5 KB 171ms
24ms Document
text/html 185.224.137.98
SERVERIUS-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://ethereumdrop.com/
Protocol: HTTP/1.1
Server: 185.224.137.98 -, , ASN50673 (SERVERIUS-AS, NL),
Reverse DNS
Software: openresty /
Resource Hash: 1d78dac0cbe7e21703ec4c28932b32746444989a73d026bc6b3e7b24ebfe1191

Request headers

Host: ethereumdrop.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id: 415692D348231829E9879F899830D8E6

Response headers

Server: openresty
Date: Tue, 19 Jun 2018 02:34:12 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Sun, 11 Mar 2018 14:39:23 GMT
Content-Encoding: gzip

GET
S 200 js Show response
www.googletagmanager.com/gtag/ 69 KB
24 KB 19ms
18ms Script
application/javascript 2a00:1450:4001:818::2008
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-115467981-1

Requested by

Host: ethereumdrop.com
URL: http://ethereumdrop.com/

Protocol

SPDY

Server

2a00:1450:4001:818::2008 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Google Tag Manager (scaffolding) /

Resource Hash

eccc2750d65f81202d935a539864ddef3d5661e369ef2028fb874dc2070681c0

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: http://ethereumdrop.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Tue, 19 Jun 2018 02:34:12 GMT
content-encoding: gzip
server: Google Tag Manager (scaffolding)
access-control-allow-headers: Cache-Control
status: 200
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: http://www.googletagmanager.com
cache-control: private, max-age=900
access-control-allow-credentials: true
alt-svc: quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 24899
x-xss-protection: 1; mode=block
expires: Tue, 19 Jun 2018 02:34:12 GMT

GET
H/1.1 200
OK blockchainc4ab.css
ethereumdrop.com/blockchain.info/Resources/css/ 255 KB
49 KB 25ms
25ms Stylesheet
text/css 185.224.137.98
SERVERIUS-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://ethereumdrop.com/blockchain.info/Resources/css/blockchainc4ab.css?18005c9c8eb43636
Requested by: Host: ethereumdrop.com
URL: http://ethereumdrop.com/
Protocol: HTTP/1.1
Server: 185.224.137.98 -, , ASN50673 (SERVERIUS-AS, NL),
Reverse DNS
Software: openresty /
Resource Hash: a7d6d3114dc8833f72059d0f1d4136ecaadad2e17724266d4712531c5b14ffb6

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: ethereumdrop.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: http://ethereumdrop.com/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://ethereumdrop.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Tue, 19 Jun 2018 02:34:12 GMT
Content-Encoding: gzip
Last-Modified: Sun, 11 Mar 2018 13:06:15 GMT
Server: openresty
Connection: keep-alive
Transfer-Encoding: chunked
Content-Type: text/css

GET
H/1.1 200
OK payment-requestc4ab.css
ethereumdrop.com/blockchain.info/Resources/ 734 B
946 B 44ms
18ms Stylesheet
text/css 185.224.137.98
SERVERIUS-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://ethereumdrop.com/blockchain.info/Resources/payment-requestc4ab.css?18005c9c8eb43636
Requested by: Host: ethereumdrop.com
URL: http://ethereumdrop.com/
Protocol: HTTP/1.1
Server: 185.224.137.98 -, , ASN50673 (SERVERIUS-AS, NL),
Reverse DNS
Software: openresty /
Resource Hash: 460383e2067d0c8ac748d0d33a2edc0dbdae3a69de9044cfe89373045c8a598f

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: ethereumdrop.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: http://ethereumdrop.com/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://ethereumdrop.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Tue, 19 Jun 2018 02:34:12 GMT
Last-Modified: Sun, 11 Mar 2018 13:06:14 GMT
Server: openresty
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 734
Content-Type: text/css

GET
S 200 chart
chart.googleapis.com/ 1 KB
1 KB 20ms
20ms Image
image/png 2a00:1450:4001:81f::200a
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://chart.googleapis.com/chart?cht=qr&chl=0x1036Bc312f0279b5889BCE88D09A100d411c0abb&chs=180x180&choe=UTF-8&chld=L|2%27%20alt=

Requested by

Host: ethereumdrop.com
URL: http://ethereumdrop.com/

Protocol

SPDY

Server

2a00:1450:4001:81f::200a , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

GoogleChartAPI/1.0 /

Resource Hash

91eaad3cdedfa62dfcaad8bee881f49d67234ac036bada3f6fb0bb5013c51b0c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	ALLOWALL
X-Xss-Protection	1; mode=block

Request headers

Referer: http://ethereumdrop.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date: Tue, 19 Jun 2018 02:34:12 GMT
x-content-type-options: nosniff
last-modified: Wed, 02-May-2018 18:35:04 GMT
server: GoogleChartAPI/1.0
status: 200
x-frame-options: ALLOWALL
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
alt-svc: quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 1030
x-xss-protection: 1; mode=block
expires: Wed, 20 Jun 2018 02:34:12 GMT

GET
H/1.1 200
OK T1X5ZPT.gif
ethereumdrop.com/i.imgur.com/ 126 KB
126 KB 17ms
16ms Image
image/gif 185.224.137.98
SERVERIUS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://ethereumdrop.com/i.imgur.com/T1X5ZPT.gif
Requested by: Host: ethereumdrop.com
URL: http://ethereumdrop.com/
Protocol: HTTP/1.1
Server: 185.224.137.98 -, , ASN50673 (SERVERIUS-AS, NL),
Reverse DNS
Software: openresty /
Resource Hash: 51db6c4f053f0649837ec06f4890fb346b0c62df43990e2c0f6ddd784468ce8d

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: ethereumdrop.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://ethereumdrop.com/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://ethereumdrop.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

Date: Tue, 19 Jun 2018 02:34:12 GMT
Last-Modified: Sun, 11 Mar 2018 13:06:14 GMT
Server: openresty
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 128768
Content-Type: image/gif

GET Montserrat-Light.ttf
blockchain.info/Resources/fonts/montserrat/ 0
0

GET Montserrat-Bold.ttf
blockchain.info/Resources/fonts/montserrat/ 0
0

GET Montserrat-Medium.ttf
blockchain.info/Resources/fonts/montserrat/ 0
0

GET
S 200 analytics.js Show response
www.google-analytics.com/ 34 KB
14 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:818::200e
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-115467981-1

Protocol

SPDY

Server

2a00:1450:4001:818::200e , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

3fab1c883847e4b5a02f3749a9f4d9eab15cd4765873d3b2904a1a4c8755fba3

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: http://ethereumdrop.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 18 May 2018 01:10:24 GMT
server: Golfe2
age: 6667
date: Tue, 19 Jun 2018 00:43:05 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 14386
expires: Tue, 19 Jun 2018 02:43:05 GMT

GET
S 200 collect
www.google-analytics.com/r/ 35 B
101 B 17ms
16ms Image
image/gif 2a00:1450:4001:818::200e
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/r/collect?v=1&_v=j68&a=397721683&t=pageview&_s=1&dl=http%3A%2F%2Fethereumdrop.com%2F&ul=en-us&de=UTF-8&dt=Ethereum%20Giveaway&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=IEBAAUAB~&jid=231489812&gjid=785127280&cid=548344290.1529375653&tid=UA-115467981-1&_gid=2003310511.1529375653&_r=1&gtm=u64&z=1927682256

Requested by

Host: ethereumdrop.com
URL: http://ethereumdrop.com/

Protocol

SPDY

Server

2a00:1450:4001:818::200e , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://ethereumdrop.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 19 Jun 2018 02:34:13 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
status: 200
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="43,42,41,39,35"
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: blockchain.info
URL: https://blockchain.info/Resources/fonts/montserrat/Montserrat-Light.ttf

Domain: blockchain.info
URL: https://blockchain.info/Resources/fonts/montserrat/Montserrat-Bold.ttf

Domain: blockchain.info
URL: https://blockchain.info/Resources/fonts/montserrat/Montserrat-Medium.ttf

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Crypto (Crypto Exchange)

27 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

string| ADDRESS function| gtag object| dataLayer function| random function| uuidv4 function| bet function| removeArr function| addLink function| sub function| newtr function| insertAfter function| updateTrans object| times object| google_tag_manager string| GoogleAnalyticsObject function| ga object| gaplugins object| gaGlobal object| gaData object| tr string| INT string| OUT string| TXID string| TXID2 number| INCIN number| INOUT number| trans

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.ethereumdrop.com/	1970-01-18 16:49:35	Name: _gat_gtag_UA_115467981_1 Value: 1
			.ethereumdrop.com/	1970-01-18 16:51:02	Name: _gid Value: GA1.2.2003310511.1529375653
			.ethereumdrop.com/	1970-01-19 10:20:47	Name: _ga Value: GA1.2.548344290.1529375653

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

blockchain.info
chart.googleapis.com
ethereumdrop.com
www.google-analytics.com
www.googletagmanager.com
blockchain.info
185.224.137.98
2a00:1450:4001:818::2008
2a00:1450:4001:818::200e
2a00:1450:4001:81f::200a
1d78dac0cbe7e21703ec4c28932b32746444989a73d026bc6b3e7b24ebfe1191
3fab1c883847e4b5a02f3749a9f4d9eab15cd4765873d3b2904a1a4c8755fba3
460383e2067d0c8ac748d0d33a2edc0dbdae3a69de9044cfe89373045c8a598f
51db6c4f053f0649837ec06f4890fb346b0c62df43990e2c0f6ddd784468ce8d
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
91eaad3cdedfa62dfcaad8bee881f49d67234ac036bada3f6fb0bb5013c51b0c
a7d6d3114dc8833f72059d0f1d4136ecaadad2e17724266d4712531c5b14ffb6
eccc2750d65f81202d935a539864ddef3d5661e369ef2028fb874dc2070681c0