en-trzor-start.github.io

Summary

This website contacted 3 IPs in 1 countries across 3 domains to perform 3 HTTP transactions. The main IP is 185.199.109.153, located in San Francisco, United States and belongs to FASTLY, US. The main domain is en-trzor-start.github.io.
TLS certificate: Issued by DigiCert Global G2 TLS RSA SHA256 202... on March 15th 2024. Valid for: a year.

This is the only time en-trzor-start.github.io was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Trezor (Crypto)

Domain & IP information

	IP Address	AS Autonomous System
1	185.199.109.153 185.199.109.153	54113 (FASTLY) (FASTLY)
1	172.67.198.249 172.67.198.249	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	142.250.65.206 142.250.65.206	15169 (GOOGLE) (GOOGLE)
3	3

1 185.199.109.153 (San Francisco, United States)

ASN54113 (FASTLY, US)
PTR: cdn-185-199-109-153.github.com

en-trzor-start.github.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.67.198.249 (United States)

ASN13335 (CLOUDFLARENET, US)

gcdnb.pbrd.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.65.206 (Plainview, United States)

ASN15169 (GOOGLE, US)
PTR: lga25s72-in-f14.1e100.net

encrypted-tbn0.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
1	gstatic.com encrypted-tbn0.gstatic.com	5 KB
1	pbrd.co gcdnb.pbrd.co — Cisco Umbrella Rank: 722889	338 KB
1	github.io en-trzor-start.github.io	3 KB
3	3

	Domain	Requested by
1	encrypted-tbn0.gstatic.com
1	gcdnb.pbrd.co	en-trzor-start.github.io
1	en-trzor-start.github.io
3	3

This site contains links to these domains. Also see Links.

Domain
trezor.io
www.coindesk.com
www.investopedia.com
www.reddit.com
www.cointelegraph.com

Subject Issuer	Validity	Valid
*.github.io DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-03-15` - `2025-03-14`	a year	crt.sh
pbrd.co WE1	`2024-08-20` - `2024-11-18`	3 months	crt.sh
*.gstatic.com WR2	`2024-08-12` - `2024-11-04`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://en-trzor-start.github.io/en-us/
Frame ID: 7737A1747190C8ABC02D9BBA100CCD36
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Trezor.io/Start® | Trezor Suite App (Official) | Trezor®

Detected technologies

GitHub Pages (CDN) Expand

Overall confidence: 100%
Detected patterns

^https?://[^/]+\.github\.io

Page Statistics

3
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

1
Countries

345 kB
Transfer

348 kB
Size

0
Cookies

7 Outgoing links

These are links going to different origins than the main page.

URL: https://trezor.io/start
Title: Trezor.io/start

Search URL Search Domain Scan URL

URL: https://www.coindesk.com/learn/what-is-a-crypto-wallet/
Title: CoinDesk

Search URL Search Domain Scan URL

URL: https://www.investopedia.com/terms/r/recovery-seed.asp
Title: Investopedia's guide on recovery seeds

Search URL Search Domain Scan URL

URL: https://trezor.io/support
Title: trezor.io/support

Search URL Search Domain Scan URL

URL: https://www.reddit.com/r/TREZOR/
Title: Trezor subreddit

Search URL Search Domain Scan URL

URL: https://www.coindesk.com/learn/how-to-choose-a-bitcoin-wallet/
Title: CoinDesk

Search URL Search Domain Scan URL

URL: https://www.cointelegraph.com/what-is/what-is-a-bitcoin-wallet
Title: CoinTelegraph

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
en-trzor-start.github.io/en-us/ 8 KB
3 KB 341ms
43ms Document
text/html 185.199.109.153
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://en-trzor-start.github.io/en-us/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

185.199.109.153 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

cdn-185-199-109-153.github.com

Software

GitHub.com /

Resource Hash

5d2d7f1dc79f9360702cea0af636d3066f9233de040e76cbfc03e94586f261cc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556952

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 0
cache-control: max-age=600
content-encoding: gzip
content-length: 2643
content-type: text/html; charset=utf-8
date: Thu, 19 Sep 2024 23:05:11 GMT
etag: W/"66ea6a56-1ea0"
expires: Thu, 19 Sep 2024 22:25:31 GMT
last-modified: Wed, 18 Sep 2024 05:51:18 GMT
permissions-policy: interest-cohort=()
server: GitHub.com
strict-transport-security: max-age=31556952
vary: Accept-Encoding
via: 1.1 varnish
x-cache: HIT
x-cache-hits: 0
x-fastly-request-id: cc81efe47e1484648eac1380daafe73d1fb8e96f
x-github-request-id: 540D:16D3:83406BC:9248304:66ECA283
x-proxy-cache: MISS
x-served-by: cache-yyz4558-YYZ
x-timer: S1726787112.883504,VS0,VE23

GET
H3 200 7Gp12lgnxf0h.jpg
gcdnb.pbrd.co/images/ 337 KB
338 KB 175ms
99ms Image
image/jpeg 172.67.198.249
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gcdnb.pbrd.co/images/7Gp12lgnxf0h.jpg?o=1
Requested by: Host: en-trzor-start.github.io
URL: https://en-trzor-start.github.io/en-us/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.198.249 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 65c7283c7765089b4a2d1cfa9105af157081d2ae393a4fbe0dfd8f65f326dd7b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://en-trzor-start.github.io/

Response headers

x-goog-metageneration: 1
x-goog-hash: crc32c=TQ41EA==, md5=d2KpmQoULpImikzsCi+prQ==
cf-bgj: h2pri,csam-hash
etag: "7762a9990a142e92268a4cec0a2fa9ad"
cf-cache-status: REVALIDATED
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=o41CCHDrmSbxw6oVbPXBTXqloZNI0td2PoNYuqZAGCTsE2SAWa2Teh5S8wgGIqgbB9FGhMVOdbmEwzMTIyDjkjxo9xj%2F6L6pLdxTxn%2FuhQ%2BX8RJkBXM4ekm5LotecpVB"}],"group":"cf-nel","max_age":604800}
x-goog-stored-content-encoding: identity
expires: Fri, 20 Sep 2024 00:05:12 GMT
alt-svc: h3=":443"; ma=86400
x-goog-stored-content-length: 344618
date: Thu, 19 Sep 2024 23:05:12 GMT
content-type: image/jpeg
last-modified: Wed, 18 Sep 2024 05:28:44 GMT
vary: Accept-Encoding
x-guploader-uploadid: AD-8ljtTchammbmQXlNtDNcJAcVKlJJ-5LxvgcJIgZIPlU8EW83z8zjYsifCb1vDI8qsxpqRaLJyx8kM7Q
cache-control: public, max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-goog-storage-class: STANDARD
x-goog-expiration: Tue, 17 Dec 2024 05:28:44 GMT
cf-ray: 8c5d381a1831aa9b-YYZ
accept-ranges: bytes
x-goog-generation: 1726637324731179
content-length: 344618
server: cloudflare

GET
H2 200 images
encrypted-tbn0.gstatic.com/ 4 KB
5 KB 115ms
37ms Other
image/png 142.250.65.206
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcSTsNTxHBV-hCOgx3EEcYI03qVH54LKmxBOLw&s

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

142.250.65.206 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s72-in-f14.1e100.net

Software

sffe /

Resource Hash

dd6752ab3bc08942afcb6e4f34e8148dcec7ab5d4a158048c944c41c717c0282

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://en-trzor-start.github.io/

Response headers

age: 50820
report-to: {"group":"images-tbn","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/images-tbn"}]}
x-content-type-options: nosniff
expires: Fri, 19 Sep 2025 08:58:12 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 19 Sep 2024 08:58:12 GMT
last-modified: Sun, 11 Feb 2024 00:03:52 GMT
content-type: image/png
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/images-tbn
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="images-tbn"
content-length: 4241
x-xss-protection: 0
server: sffe

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Trezor (Crypto)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31556952

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

en-trzor-start.github.io
encrypted-tbn0.gstatic.com
gcdnb.pbrd.co
142.250.65.206
172.67.198.249
185.199.109.153
5d2d7f1dc79f9360702cea0af636d3066f9233de040e76cbfc03e94586f261cc
65c7283c7765089b4a2d1cfa9105af157081d2ae393a4fbe0dfd8f65f326dd7b
dd6752ab3bc08942afcb6e4f34e8148dcec7ab5d4a158048c944c41c717c0282

en-trzor-start.github.io Open in urlscan Pro 185.199.109.153 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

3 Requests

100 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

3 IPs

1 Countries

345 kBTransfer

348 kBSize

0 Cookies

7 Outgoing links

Redirected requests

3 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

Security Headers

Indicators

en-trzor-start.github.io Open in urlscan Pro
185.199.109.153 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

3
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

1
Countries

345 kB
Transfer

348 kB
Size

0
Cookies

3 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!