coinbase-verifications171strix.crabdance.com Open in urlscan Pro
167.71.97.177 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://x-short.plus/3a4OR?userid=vUYrZIxw
Effective URL:
https://coinbase-verifications171strix.crabdance.com/signin?c_ds_na=nmQGt94xUdQgFMYGrItyqKuN6xd95l2vnG7BwIFE6R&c_ds_no=text%2Fhtml%2Capplication%2Fxh...
Submission: On October 29 via manual (October 29th 2024, 7:46:48 pm UTC) from US — Scanned from US

Summary HTTP 12 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 2 countries across 3 domains to perform 12 HTTP transactions. The main IP is 167.71.97.177, located in Clifton, United States and belongs to DIGITALOCEAN-ASN, US. The main domain is coinbase-verifications171strix.crabdance.com.
TLS certificate: Issued by R10 on October 22nd 2024. Valid for: 3 months.

This is the only time coinbase-verifications171strix.crabdance.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Coinbase (Crypto Exchange)

Domain & IP information

	IP Address	AS Autonomous System
1 1	194.67.208.183 194.67.208.183	209641 (I-SERVERS...) (I-SERVERS-EAST)
1 1	2606:4700:20:... 2606:4700:20::681a:f9e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 13	167.71.97.177 167.71.97.177	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
12	1

1 194.67.208.183 (Moscow, Russian Federation) 1 redirects

ASN209641 (I-SERVERS-EAST, GB)
PTR: vodi.top

x-short.plus	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:20::681a:f9e (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

t2m.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 167.71.97.177 (Clifton, United States) 1 redirects

ASN14061 (DIGITALOCEAN-ASN, US)

coinbase-verifications171strix.crabdance.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
13	crabdance.com 1 redirects coinbase-verifications171strix.crabdance.com	452 KB
1	t2m.io 1 redirects t2m.io — Cisco Umbrella Rank: 282767	513 B
1	x-short.plus 1 redirects x-short.plus	1 KB
12	3

	Domain	Requested by
13	coinbase-verifications171strix.crabdance.com	1 redirects coinbase-verifications171strix.crabdance.com
1	t2m.io	1 redirects
1	x-short.plus	1 redirects
12	3

This site contains no links.

Subject Issuer	Validity	Valid
coinbase-verifications171strix.crabdance.com R10	`2024-10-22` - `2025-01-20`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://coinbase-verifications171strix.crabdance.com/signin?c_ds_na=nmQGt94xUdQgFMYGrItyqKuN6xd95l2vnG7BwIFE6R&c_ds_no=text%2Fhtml%2Capplication%2Fxhtml%2Bxml%2Capplication%2Fxml%3Bq%3D0.9%2Cimage%2Favif%2Cimage%2Fwebp%2Cimage%2Fapng%2C%2A%2F%2A%3Bq%3D0.8%2Capplication%2Fsigned-exchange%3Bv%3Db3%3Bq%3D0.7
Frame ID: DC889D2AAB7438FDBC3B67C2D0F78F09
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Coinbase - Sign In

Page URL History Show full URLs

https://x-short.plus/3a4OR?userid=vUYrZIxw HTTP 301
https://t2m.io/XjDs9kU HTTP 301
https://coinbase-verifications171strix.crabdance.com/?signin2 HTTP 302
https://coinbase-verifications171strix.crabdance.com/signin?c_ds_na=nmQGt94xUdQgFMYGrItyqKuN6xd95l2vnG7BwIFE6R&c_ds_no=text%2Fhtm... Page URL

Page Statistics

12
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

1
IPs

2
Countries

451 kB
Transfer

493 kB
Size

3
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://x-short.plus/3a4OR?userid=vUYrZIxw HTTP 301
https://t2m.io/XjDs9kU HTTP 301
https://coinbase-verifications171strix.crabdance.com/?signin2 HTTP 302
https://coinbase-verifications171strix.crabdance.com/signin?c_ds_na=nmQGt94xUdQgFMYGrItyqKuN6xd95l2vnG7BwIFE6R&c_ds_no=text%2Fhtml%2Capplication%2Fxhtml%2Bxml%2Capplication%2Fxml%3Bq%3D0.9%2Cimage%2Favif%2Cimage%2Fwebp%2Cimage%2Fapng%2C%2A%2F%2A%3Bq%3D0.8%2Capplication%2Fsigned-exchange%3Bv%3Db3%3Bq%3D0.7 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request signin Show response coinbase-verifications171strix.crabdance.com/ Redirect Chain https://x-short.plus/3a4OR?userid=vUYrZIxw https://t2m.io/XjDs9kU https://coinbase-verifications171strix.crabdance.com/?signin2 https://coinbase-verifications171strix.crabdance.com/signin?c_ds_na=nmQGt94xUdQgFMYGrItyqKuN6xd95l2vnG7BwIFE6R&c_ds_no=text%2Fhtml%2Capplication%2Fxhtml%2Bxml%2Capplication%2Fxml%3Bq%3D0.9%2Cimage%...	55 KB 10 KB	68ms 67ms	Document text/html	167.71.97.177 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://coinbase-verifications171strix.crabdance.com/signin?c_ds_na=nmQGt94xUdQgFMYGrItyqKuN6xd95l2vnG7BwIFE6R&c_ds_no=text%2Fhtml%2Capplication%2Fxhtml%2Bxml%2Capplication%2Fxml%3Bq%3D0.9%2Cimage%2Favif%2Cimage%2Fwebp%2Cimage%2Fapng%2C%2A%2F%2A%3Bq%3D0.8%2Capplication%2Fsigned-exchange%3Bv%3Db3%3Bq%3D0.7 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 167.71.97.177 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software Apache / Resource Hash `ced435c5eee5778fd80ff1ad3a891be450784a96ce10b51501c1652dc8924ab6` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Response headers Cache-Control no-store, no-cache, must-revalidate Connection Keep-Alive Content-Encoding gzip Content-Type text/html; charset=UTF-8 Date Tue, 29 Oct 2024 19:46:35 GMT Expires Thu, 19 Nov 1981 08:52:00 GMT Keep-Alive timeout=5, max=99 Pragma no-cache Server Apache Transfer-Encoding chunked Vary Accept-Encoding Redirect headers Cache-Control no-store, no-cache, must-revalidate Connection Keep-Alive Content-Encoding gzip Content-Type text/html; charset=UTF-8 Date Tue, 29 Oct 2024 19:46:35 GMT Expires Thu, 19 Nov 1981 08:52:00 GMT Keep-Alive timeout=5, max=100 Location signin?c_ds_na=nmQGt94xUdQgFMYGrItyqKuN6xd95l2vnG7BwIFE6R&c_ds_no=text%2Fhtml%2Capplication%2Fxhtml%2Bxml%2Capplication%2Fxml%3Bq%3D0.9%2Cimage%2Favif%2Cimage%2Fwebp%2Cimage%2Fapng%2C%2A%2F%2A%3Bq%3D0.8%2Capplication%2Fsigned-exchange%3Bv%3Db3%3Bq%3D0.7 Pragma no-cache Server Apache Transfer-Encoding chunked Vary Accept-Encoding
GET H/1.1	200 OK	styles.d87df576ff25e358663e.css coinbase-verifications171strix.crabdance.com/assets/css/	122 KB 122 KB	63ms 62ms	Stylesheet text/css	167.71.97.177 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://coinbase-verifications171strix.crabdance.com/assets/css/styles.d87df576ff25e358663e.css Requested by Host: coinbase-verifications171strix.crabdance.com URL: https://coinbase-verifications171strix.crabdance.com/signin?c_ds_na=nmQGt94xUdQgFMYGrItyqKuN6xd95l2vnG7BwIFE6R&c_ds_no=text%2Fhtml%2Capplication%2Fxhtml%2Bxml%2Capplication%2Fxml%3Bq%3D0.9%2Cimage%2Favif%2Cimage%2Fwebp%2Cimage%2Fapng%2C%2A%2F%2A%3Bq%3D0.8%2Capplication%2Fsigned-exchange%3Bv%3Db3%3Bq%3D0.7 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 167.71.97.177 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software Apache / Resource Hash `f47de1b7f7de1c4e73d6ea89cf7a15fce2df5c45a8e42132399701421d21ffbc` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://coinbase-verifications171strix.crabdance.com/signin?c_ds_na=nmQGt94xUdQgFMYGrItyqKuN6xd95l2vnG7BwIFE6R&c_ds_no=text%2Fhtml%2Capplication%2Fxhtml%2Bxml%2Capplication%2Fxml%3Bq%3D0.9%2Cimage%2Favif%2Cimage%2Fwebp%2Cimage%2Fapng%2C%2A%2F%2A%3Bq%3D0.8%2Capplication%2Fsigned-exchange%3Bv%3Db3%3Bq%3D0.7 Response headers Connection Keep-Alive Accept-Ranges bytes Content-Length 124426 Keep-Alive timeout=5, max=98 Date Tue, 29 Oct 2024 19:46:35 GMT Last-Modified Wed, 22 May 2024 15:44:18 GMT Content-Type text/css Server Apache
GET H/1.1	200 OK	styles.43cdd765c2fa35b596d4.css coinbase-verifications171strix.crabdance.com/assets/css/	3 KB 3 KB	181ms 61ms	Stylesheet text/css	167.71.97.177 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://coinbase-verifications171strix.crabdance.com/assets/css/styles.43cdd765c2fa35b596d4.css Requested by Host: coinbase-verifications171strix.crabdance.com URL: https://coinbase-verifications171strix.crabdance.com/signin?c_ds_na=nmQGt94xUdQgFMYGrItyqKuN6xd95l2vnG7BwIFE6R&c_ds_no=text%2Fhtml%2Capplication%2Fxhtml%2Bxml%2Capplication%2Fxml%3Bq%3D0.9%2Cimage%2Favif%2Cimage%2Fwebp%2Cimage%2Fapng%2C%2A%2F%2A%3Bq%3D0.8%2Capplication%2Fsigned-exchange%3Bv%3Db3%3Bq%3D0.7 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 167.71.97.177 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software Apache / Resource Hash `73773da73980988a58070676b0f2477e94069c87d938ed063377c71de49474a2` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://coinbase-verifications171strix.crabdance.com/signin?c_ds_na=nmQGt94xUdQgFMYGrItyqKuN6xd95l2vnG7BwIFE6R&c_ds_no=text%2Fhtml%2Capplication%2Fxhtml%2Bxml%2Capplication%2Fxml%3Bq%3D0.9%2Cimage%2Favif%2Cimage%2Fwebp%2Cimage%2Fapng%2C%2A%2F%2A%3Bq%3D0.8%2Capplication%2Fsigned-exchange%3Bv%3Db3%3Bq%3D0.7 Response headers Connection Keep-Alive Accept-Ranges bytes Content-Length 2822 Keep-Alive timeout=5, max=100 Date Tue, 29 Oct 2024 19:46:35 GMT Last-Modified Wed, 22 May 2024 15:12:22 GMT Content-Type text/css Server Apache
GET H/1.1	200 OK	styles.babae8c0eccf7b247500.css coinbase-verifications171strix.crabdance.com/assets/css/	13 KB 14 KB	182ms 61ms	Stylesheet text/css	167.71.97.177 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://coinbase-verifications171strix.crabdance.com/assets/css/styles.babae8c0eccf7b247500.css Requested by Host: coinbase-verifications171strix.crabdance.com URL: https://coinbase-verifications171strix.crabdance.com/signin?c_ds_na=nmQGt94xUdQgFMYGrItyqKuN6xd95l2vnG7BwIFE6R&c_ds_no=text%2Fhtml%2Capplication%2Fxhtml%2Bxml%2Capplication%2Fxml%3Bq%3D0.9%2Cimage%2Favif%2Cimage%2Fwebp%2Cimage%2Fapng%2C%2A%2F%2A%3Bq%3D0.8%2Capplication%2Fsigned-exchange%3Bv%3Db3%3Bq%3D0.7 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 167.71.97.177 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software Apache / Resource Hash `63769174d2d68475a5cbd39a703b5f876f675486c64a903768dd52ec231b1f81` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://coinbase-verifications171strix.crabdance.com/signin?c_ds_na=nmQGt94xUdQgFMYGrItyqKuN6xd95l2vnG7BwIFE6R&c_ds_no=text%2Fhtml%2Capplication%2Fxhtml%2Bxml%2Capplication%2Fxml%3Bq%3D0.9%2Cimage%2Favif%2Cimage%2Fwebp%2Cimage%2Fapng%2C%2A%2F%2A%3Bq%3D0.8%2Capplication%2Fsigned-exchange%3Bv%3Db3%3Bq%3D0.7 Response headers Connection Keep-Alive Accept-Ranges bytes Content-Length 13736 Keep-Alive timeout=5, max=100 Date Tue, 29 Oct 2024 19:46:35 GMT Last-Modified Wed, 22 May 2024 15:12:22 GMT Content-Type text/css Server Apache
GET H/1.1	200 OK	styles__ltr.css coinbase-verifications171strix.crabdance.com/assets/css/	63 KB 64 KB	185ms 61ms	Stylesheet text/css	167.71.97.177 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://coinbase-verifications171strix.crabdance.com/assets/css/styles__ltr.css Requested by Host: coinbase-verifications171strix.crabdance.com URL: https://coinbase-verifications171strix.crabdance.com/signin?c_ds_na=nmQGt94xUdQgFMYGrItyqKuN6xd95l2vnG7BwIFE6R&c_ds_no=text%2Fhtml%2Capplication%2Fxhtml%2Bxml%2Capplication%2Fxml%3Bq%3D0.9%2Cimage%2Favif%2Cimage%2Fwebp%2Cimage%2Fapng%2C%2A%2F%2A%3Bq%3D0.8%2Capplication%2Fsigned-exchange%3Bv%3Db3%3Bq%3D0.7 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 167.71.97.177 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software Apache / Resource Hash `da0f41e5e49d2fcdddc204da77d0966d5a382b59801110137bd31eb95f3d4ad0` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://coinbase-verifications171strix.crabdance.com/signin?c_ds_na=nmQGt94xUdQgFMYGrItyqKuN6xd95l2vnG7BwIFE6R&c_ds_no=text%2Fhtml%2Capplication%2Fxhtml%2Bxml%2Capplication%2Fxml%3Bq%3D0.9%2Cimage%2Favif%2Cimage%2Fwebp%2Cimage%2Fapng%2C%2A%2F%2A%3Bq%3D0.8%2Capplication%2Fsigned-exchange%3Bv%3Db3%3Bq%3D0.7 Response headers Connection Keep-Alive Accept-Ranges bytes Content-Length 64932 Keep-Alive timeout=5, max=100 Date Tue, 29 Oct 2024 19:46:35 GMT Last-Modified Wed, 22 May 2024 15:45:56 GMT Content-Type text/css Server Apache
GET H/1.1	200 OK	captcha.png coinbase-verifications171strix.crabdance.com/assets/images/	2 KB 2 KB	62ms 62ms	Image image/png	167.71.97.177 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Show image Full URL https://coinbase-verifications171strix.crabdance.com/assets/images/captcha.png Requested by Host: coinbase-verifications171strix.crabdance.com URL: https://coinbase-verifications171strix.crabdance.com/assets/css/styles__ltr.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 167.71.97.177 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software Apache / Resource Hash `1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://coinbase-verifications171strix.crabdance.com/assets/css/styles__ltr.css Response headers Connection Keep-Alive Accept-Ranges bytes Content-Length 2228 Keep-Alive timeout=5, max=99 Date Tue, 29 Oct 2024 19:46:35 GMT Last-Modified Wed, 22 May 2024 15:45:02 GMT Content-Type image/png Server Apache
GET H/1.1	200 OK	502b733210ea3fdd4bf8.woff2 coinbase-verifications171strix.crabdance.com/assets/font/	39 KB 39 KB	65ms 63ms	Font font/woff2	167.71.97.177 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://coinbase-verifications171strix.crabdance.com/assets/font/502b733210ea3fdd4bf8.woff2 Requested by Host: coinbase-verifications171strix.crabdance.com URL: https://coinbase-verifications171strix.crabdance.com/assets/css/styles.d87df576ff25e358663e.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 167.71.97.177 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software Apache / Resource Hash `81368223143520415fe7fbdc3792d2d52ad7e422d8b214661ff932afe577b779` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Origin https://coinbase-verifications171strix.crabdance.com Referer https://coinbase-verifications171strix.crabdance.com/assets/css/styles.d87df576ff25e358663e.css Response headers Connection Keep-Alive Accept-Ranges bytes Content-Length 40016 Keep-Alive timeout=5, max=99 Date Tue, 29 Oct 2024 19:46:35 GMT Last-Modified Wed, 22 May 2024 15:42:00 GMT Content-Type font/woff2 Server Apache
GET H/1.1	200 OK	8a6a40a08f92d9a9b3e5.woff2 coinbase-verifications171strix.crabdance.com/assets/font/	39 KB 39 KB	63ms 62ms	Font font/woff2	167.71.97.177 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://coinbase-verifications171strix.crabdance.com/assets/font/8a6a40a08f92d9a9b3e5.woff2 Requested by Host: coinbase-verifications171strix.crabdance.com URL: https://coinbase-verifications171strix.crabdance.com/assets/css/styles.d87df576ff25e358663e.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 167.71.97.177 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software Apache / Resource Hash `a1f75e7f702059493bb74cfcb3178d095b3f6da4d313e92b3ceabc3e63eb914c` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Origin https://coinbase-verifications171strix.crabdance.com Referer https://coinbase-verifications171strix.crabdance.com/assets/css/styles.d87df576ff25e358663e.css Response headers Connection Keep-Alive Accept-Ranges bytes Content-Length 40076 Keep-Alive timeout=5, max=97 Date Tue, 29 Oct 2024 19:46:35 GMT Last-Modified Wed, 22 May 2024 15:42:20 GMT Content-Type font/woff2 Server Apache
GET H/1.1	200 OK	71371380d08a07cda58a.woff2 coinbase-verifications171strix.crabdance.com/assets/font/	40 KB 40 KB	62ms 60ms	Font font/woff2	167.71.97.177 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://coinbase-verifications171strix.crabdance.com/assets/font/71371380d08a07cda58a.woff2 Requested by Host: coinbase-verifications171strix.crabdance.com URL: https://coinbase-verifications171strix.crabdance.com/assets/css/styles.d87df576ff25e358663e.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 167.71.97.177 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software Apache / Resource Hash `5db56ddf9ab991fc7a3a5b188b6b0c92331213ec4991b71d9821c36dcbcdb687` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Origin https://coinbase-verifications171strix.crabdance.com Referer https://coinbase-verifications171strix.crabdance.com/assets/css/styles.d87df576ff25e358663e.css Response headers Connection Keep-Alive Accept-Ranges bytes Content-Length 40480 Keep-Alive timeout=5, max=99 Date Tue, 29 Oct 2024 19:46:35 GMT Last-Modified Wed, 22 May 2024 15:42:26 GMT Content-Type font/woff2 Server Apache
GET H/1.1	404 Not Found	2a5dafc68ca015ca866a.woff2 coinbase-verifications171strix.crabdance.com/assets/font/	0 0	95ms 61ms	Font text/html	167.71.97.177 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://coinbase-verifications171strix.crabdance.com/assets/font/2a5dafc68ca015ca866a.woff2 Requested by Host: coinbase-verifications171strix.crabdance.com URL: https://coinbase-verifications171strix.crabdance.com/assets/css/styles.d87df576ff25e358663e.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 167.71.97.177 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software Apache / Resource Hash Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Origin https://coinbase-verifications171strix.crabdance.com Referer https://coinbase-verifications171strix.crabdance.com/assets/css/styles.d87df576ff25e358663e.css Response headers Keep-Alive timeout=5, max=98 Content-Length 315 Date Tue, 29 Oct 2024 19:46:35 GMT Content-Type text/html; charset=iso-8859-1 Server Apache Connection Keep-Alive
GET H/1.1	200 OK	868eaaa6850959ed2ab9.woff2 coinbase-verifications171strix.crabdance.com/assets/font/	117 KB 117 KB	133ms 62ms	Font font/woff2	167.71.97.177 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://coinbase-verifications171strix.crabdance.com/assets/font/868eaaa6850959ed2ab9.woff2 Requested by Host: coinbase-verifications171strix.crabdance.com URL: https://coinbase-verifications171strix.crabdance.com/assets/css/styles.d87df576ff25e358663e.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 167.71.97.177 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software Apache / Resource Hash `31a55a060d59db48cab5fab57e607d844e5e4a97b75afa281cac1e5f09461341` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Origin https://coinbase-verifications171strix.crabdance.com Referer https://coinbase-verifications171strix.crabdance.com/assets/css/styles.d87df576ff25e358663e.css Response headers Connection Keep-Alive Accept-Ranges bytes Content-Length 119476 Keep-Alive timeout=5, max=96 Date Tue, 29 Oct 2024 19:46:35 GMT Last-Modified Wed, 22 May 2024 16:02:52 GMT Content-Type font/woff2 Server Apache
GET H/1.1	200 OK	favicon.ico coinbase-verifications171strix.crabdance.com/assets/images/	557 B 801 B	70ms 69ms	Other image/x-icon	167.71.97.177 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://coinbase-verifications171strix.crabdance.com/assets/images/favicon.ico Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 167.71.97.177 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software Apache / Resource Hash `b90cdcbe9e842bf371d9c5e7dd13359fde26879a4642ad6f752e86a65fab4fb5` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://coinbase-verifications171strix.crabdance.com/signin?c_ds_na=nmQGt94xUdQgFMYGrItyqKuN6xd95l2vnG7BwIFE6R&c_ds_no=text%2Fhtml%2Capplication%2Fxhtml%2Bxml%2Capplication%2Fxml%3Bq%3D0.9%2Cimage%2Favif%2Cimage%2Fwebp%2Cimage%2Fapng%2C%2A%2F%2A%3Bq%3D0.8%2Capplication%2Fsigned-exchange%3Bv%3Db3%3Bq%3D0.7 Response headers Connection Keep-Alive Accept-Ranges bytes Content-Length 557 Keep-Alive timeout=5, max=98 Date Tue, 29 Oct 2024 19:46:35 GMT Last-Modified Wed, 22 May 2024 16:06:46 GMT Content-Type image/x-icon Server Apache

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Coinbase (Crypto Exchange)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
x-short.plus/	1970-01-21 00:37:18	Name: XSRF-TOKEN Value: eyJpdiI6Iklrb09ZeHU0TVJIYWd5cVlzVDJaK3c9PSIsInZhbHVlIjoid0trQmJnK2Q2em5IanEwMXZBY2xCdHc5Rjc4ODcvQmZPMkdpdnIrTysxRHp5dktWL0pxM2NsQUlZNHg3MUVhbjIwWkRMQlVudjhndnVWTHdsbHp6M2t0ZHRRWWRIKzIvNm9uMU9QWmwzTWVpZWwrUVNyVmxIM2UwbmhtYzdjaWIiLCJtYWMiOiJkOWVmZmM0Y2I2Njg5NjBjYWY1ZjkwNDEzZWU4ZTc3NGIzMTVlMGViMTRjMGFlZDlhZDQzNmUwMGM2ZWQzNDJkIiwidGFnIjoiIn0%3D
x-short.plus/	1970-01-21 00:37:18	Name: shortlinks_session Value: eyJpdiI6Ik13M2UxRkVLWGM3ODNiZ0czekNCR0E9PSIsInZhbHVlIjoiN1ljdUVGaUphZWJFdnpMUGpTZ1o4VzV3M2k5N3FEUEx5SHpNRTA0SFRDUUdleTRNVDZPSFpnV2VZOHRFM0pFckZUVUR3QTJKMjJtelFaWWNnZmY2d2o3RjFvaHR2eTVoU2w3Q1h2eW1TMWdDK1Y4VEhTanFZakFWN2p2d2dSTEUiLCJtYWMiOiI0MmFiNTY3YzcyMTk2ZjA4N2MyZGZkODg0YTZiOTI1NzMwNDFlMGMwZmU3MWNlOTQ5ZWMzNWZhZjlmZThhNzJmIiwidGFnIjoiIn0%3D
coinbase-verifications171strix.crabdance.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 6d6a0d3d69ede770c53fa6e01262e384

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://coinbase-verifications171strix.crabdance.com/assets/font/2a5dafc68ca015ca866a.woff2 Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

coinbase-verifications171strix.crabdance.com
t2m.io
x-short.plus
167.71.97.177
194.67.208.183
2606:4700:20::681a:f9e
1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a
31a55a060d59db48cab5fab57e607d844e5e4a97b75afa281cac1e5f09461341
5db56ddf9ab991fc7a3a5b188b6b0c92331213ec4991b71d9821c36dcbcdb687
63769174d2d68475a5cbd39a703b5f876f675486c64a903768dd52ec231b1f81
73773da73980988a58070676b0f2477e94069c87d938ed063377c71de49474a2
81368223143520415fe7fbdc3792d2d52ad7e422d8b214661ff932afe577b779
a1f75e7f702059493bb74cfcb3178d095b3f6da4d313e92b3ceabc3e63eb914c
b90cdcbe9e842bf371d9c5e7dd13359fde26879a4642ad6f752e86a65fab4fb5
ced435c5eee5778fd80ff1ad3a891be450784a96ce10b51501c1652dc8924ab6
da0f41e5e49d2fcdddc204da77d0966d5a382b59801110137bd31eb95f3d4ad0
f47de1b7f7de1c4e73d6ea89cf7a15fce2df5c45a8e42132399701421d21ffbc

coinbase-verifications171strix.crabdance.com Open in urlscan Pro 167.71.97.177 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

12 Requests

100 %HTTPS

33 %IPv6

3 Domains

3 Subdomains

1 IPs

2 Countries

451 kBTransfer

493 kBSize

3 Cookies

0 Outgoing links

Page URL History

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

3 Cookies

1 Console Messages

Indicators

coinbase-verifications171strix.crabdance.com Open in urlscan Pro
167.71.97.177 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

1
IPs

2
Countries

451 kB
Transfer

493 kB
Size

3
Cookies

12 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!