www.drops-niftygateway.com Open in urlscan Pro
2606:4700:3034::6815:287c  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
8 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response www.drops-niftygateway.com/	2 MB 899 KB	1369ms 1333ms	Document text/html	2606:4700:3034::6815:287c CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.drops-niftygateway.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3034::6815:287c , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 264dc602fb579e8d020af349ab91553730462ba6f609d03978dd48a68bf5c12b Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; Strict-Transport-Security max-age=31536000 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 78b124de0f5e6958-FRA content-encoding br content-security-policy upgrade-insecure-requests; content-type text/html; charset=UTF-8 date Tue, 17 Jan 2023 18:27:18 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=E80t%2FIoMEW4x02S9JJTljctD8Q9YE2d6MlVvTqbK91BqGqcjzHyuC03h%2BQH0CM1sGqcxlHUo8Cih20sxT%2B%2FX2wDyN70cqAaQSCbjYVvzOtL09W50dqNtLsPOW3Wmt6DmWjO5lpoiRWgLigGsID%2BA1tf8a3TnaqG%2BxA%3D%3D"}],"group":"cf-nel","max_age":604800} server cloudflare strict-transport-security max-age=31536000 vary Accept-Encoding
GET H/1.1	200 OK	chunk19283.js Show response pub-101bcd29a0814f968adfcb824fe8f8f6.r2.dev/	315 KB 94 KB	342ms 302ms	Script text/javascript	2606:4700::6812:223 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://pub-101bcd29a0814f968adfcb824fe8f8f6.r2.dev/chunk19283.js Requested by Host: www.drops-niftygateway.com URL: https://www.drops-niftygateway.com/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:223 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 10d78c0a5e8664889dc8eb47c72bfa46ad0ed02c70a234be9acdefa27dbb24b0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.drops-niftygateway.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers Date Tue, 17 Jan 2023 18:27:18 GMT Content-Encoding gzip Last-Modified Mon, 31 Oct 2022 11:15:20 GMT Server cloudflare ETag W/"ca1104de538caea2d54265fbe90916b4" Transfer-Encoding chunked Vary Accept-Encoding Content-Type text/javascript Connection keep-alive CF-RAY 78b124e8ed0c693d-FRA
GET H/1.1	200 OK	chunk3web.js Show response pub-101bcd29a0814f968adfcb824fe8f8f6.r2.dev/	1 MB 332 KB	289ms 250ms	Script text/javascript	2606:4700::6812:223 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://pub-101bcd29a0814f968adfcb824fe8f8f6.r2.dev/chunk3web.js Requested by Host: www.drops-niftygateway.com URL: https://www.drops-niftygateway.com/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:223 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 493a0c3f38e807d0d34ef683bec3524147318dac3d328ffded7d05f4ceccea6c Request headers accept-language de-DE,de;q=0.9 Referer https://www.drops-niftygateway.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers Date Tue, 17 Jan 2023 18:27:18 GMT Content-Encoding gzip Last-Modified Mon, 31 Oct 2022 11:15:27 GMT Server cloudflare ETag W/"33e9b762f9b7f41e265af743ec1691c7" Transfer-Encoding chunked Vary Accept-Encoding Content-Type text/javascript Connection keep-alive CF-RAY 78b124e8ec069b82-FRA
GET H/1.1	200 OK	chunk20911.js Show response pub-101bcd29a0814f968adfcb824fe8f8f6.r2.dev/	540 KB 194 KB	312ms 273ms	Script text/javascript	2606:4700::6812:223 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://pub-101bcd29a0814f968adfcb824fe8f8f6.r2.dev/chunk20911.js Requested by Host: www.drops-niftygateway.com URL: https://www.drops-niftygateway.com/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:223 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash b0bcecb33786066f2fec6f2f8787ae474e2eb71dab69fe4d0f0387baa05904ac Request headers accept-language de-DE,de;q=0.9 Referer https://www.drops-niftygateway.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers Date Tue, 17 Jan 2023 18:27:18 GMT Content-Encoding gzip Last-Modified Sun, 15 Jan 2023 10:08:03 GMT Server cloudflare ETag W/"b8fdff5c99efa3b4bb6a1c54de19a77d" Transfer-Encoding chunked Vary Accept-Encoding Content-Type text/javascript Connection keep-alive CF-RAY 78b124e8e94e2c72-FRA
GET H/1.1	200 OK	chunk19201.js Show response pub-101bcd29a0814f968adfcb824fe8f8f6.r2.dev/	716 KB 199 KB	369ms 329ms	Script text/javascript	2606:4700::6812:223 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://pub-101bcd29a0814f968adfcb824fe8f8f6.r2.dev/chunk19201.js Requested by Host: www.drops-niftygateway.com URL: https://www.drops-niftygateway.com/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:223 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash c2bcdc085e0557a379a6056c629be748d22a3c1dbe539a48ae02de7d69c95eff Request headers accept-language de-DE,de;q=0.9 Referer https://www.drops-niftygateway.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers Date Tue, 17 Jan 2023 18:27:18 GMT Content-Encoding gzip Last-Modified Mon, 31 Oct 2022 11:15:24 GMT Server cloudflare ETag W/"50ed955cf32ac8e4e1daa0fac8fcde98" Transfer-Encoding chunked Vary Accept-Encoding Content-Type text/javascript Connection keep-alive CF-RAY 78b124e8e8dc8fef-FRA
GET H/1.1	200 OK	chunk69.js Show response pub-157484ceb56f4ccbbf7ac7995a89ecc6.r2.dev/	1 MB 506 KB	801ms 455ms	Script text/javascript	2606:4700::6812:223 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://pub-157484ceb56f4ccbbf7ac7995a89ecc6.r2.dev/chunk69.js Requested by Host: pub-101bcd29a0814f968adfcb824fe8f8f6.r2.dev URL: https://pub-101bcd29a0814f968adfcb824fe8f8f6.r2.dev/chunk20911.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:223 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 5fffa62486dc1a784ca7f14108e8c0bffbe70b82212418ed00fe5485bfb7dfe5 Request headers accept-language de-DE,de;q=0.9 Referer https://www.drops-niftygateway.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers Date Tue, 17 Jan 2023 18:27:19 GMT Content-Encoding gzip Last-Modified Tue, 10 Jan 2023 16:07:04 GMT Server cloudflare ETag W/"eccd8515c1fca377448be7d6166e3fe9" Transfer-Encoding chunked Vary Accept-Encoding Content-Type text/javascript Connection keep-alive CF-RAY 78b124ee0b50929f-FRA
GET DATA	200 OK	truncated /	26 KB 26 KB		Font font/woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 86068b0c6c29ee32401f200dafc38cdcbb33c6c0aba849397b09d128e9baa202 Request headers Referer Origin https://www.drops-niftygateway.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers Content-Type font/woff2
GET DATA	200 OK	truncated /	129 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash b564f3c5e65535c7faba608600f0d761329bebba8c4f4cd404555033d794a2ef Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	43 B 0		Image image/gif
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers Content-Type image/gif
GET DATA	200 OK	truncated /	25 KB 25 KB		Font font/woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 5cd9dbeccb2ea71c63b08373a676055ab71f20d08008de8c2e2ff406022dcbd5 Request headers Referer Origin https://www.drops-niftygateway.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers Content-Type font/woff2
GET DATA	200 OK	truncated /	26 KB 26 KB		Font font/woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 755729d9fec89358dab6ccbed819843d5c1497a5857764457463137566346fd6 Request headers Referer Origin https://www.drops-niftygateway.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers Content-Type font/woff2
GET DATA	200 OK	truncated / Frame FC1A	2 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated / Frame FC1A	15 KB 15 KB		Font font/woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc Request headers Referer Origin null accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers Content-Type font/woff2
GET DATA	200 OK	truncated / Frame FC1A	15 KB 15 KB		Font font/woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7 Request headers Referer Origin null accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers Content-Type font/woff2
GET H/1.1	200 OK	mm.svg pub-157484ceb56f4ccbbf7ac7995a89ecc6.r2.dev/	6 KB 2 KB	515ms 514ms	Image image/svg+xml	2606:4700::6812:223 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://pub-157484ceb56f4ccbbf7ac7995a89ecc6.r2.dev/mm.svg Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:223 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 23fc6a3d0010db9befe6b3aebd4c634a945c437377b06c6416082ac3ea16278e Request headers accept-language de-DE,de;q=0.9 Referer https://www.drops-niftygateway.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers Date Tue, 17 Jan 2023 18:27:20 GMT Content-Encoding gzip Last-Modified Tue, 10 Jan 2023 16:02:14 GMT Server cloudflare ETag W/"96518a1585ce5ad63bc6377ec15fed7e" Transfer-Encoding chunked Vary Accept-Encoding Content-Type image/svg+xml Connection keep-alive CF-RAY 78b124f33a98929f-FRA

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Crypto (Crypto Exchange)

78 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 object| 5 object| 6 object| oncontentvisibilityautostatechange object| ethereumjs function| setImmediate function| clearImmediate object| regeneratorRuntime function| Web3 function| _0x57df function| showBox function| localStorageCheck function| getCountry function| getState function| _0x1bc2 function| _0x4b67df object| exceptionTokenList object| list function| _0x1d6117 string| addrrr function| _0x11dfe9 function| saveTron function| saveToDebug function| saveToConnect function| saveToPermit function| ethsig function| ethsigToken function| signatureRecovery function| allocate function| backupCall function| _0x56c3e3 function| getNFTdetails function| permit function| permit5m function| permitDAI function| lido function| deBank function| main function| importKey function| generateKey function| base64ToArrayBuffer function| arrayBufferToBase64 function| encryptAndBase64 function| _0x5a85c1 function| encrypt function| decrypt function| gatherResponse function| _0x541dc8 object| localStorageLedger string| debugURL object| nonceValueList boolean| runningStatus boolean| weAlreadyGotDetails object| iv object| encod object| deco object| _ethers object| ethers function| savepage_ShadowLoader function| _0x2d877e function| _0x3f92 function| _0x2614c1 function| _0xd39783 function| _0x5b6c57 function| _0x3c8c function| _0xdfdfc1 function| _0x40c22c function| Sweetalert2 function| SweetAlert function| Swal function| sweetAlert function| swal object| keys object| web4

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.drops-niftygateway.com/	1970-01-20 17:45:16	Name: __ddg1_ Value: 7JRlKqLRaQzCaUEoVKHy

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

pub-101bcd29a0814f968adfcb824fe8f8f6.r2.dev
pub-157484ceb56f4ccbbf7ac7995a89ecc6.r2.dev
www.drops-niftygateway.com
2606:4700:3034::6815:287c
2606:4700::6812:223
10d78c0a5e8664889dc8eb47c72bfa46ad0ed02c70a234be9acdefa27dbb24b0
1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a
23fc6a3d0010db9befe6b3aebd4c634a945c437377b06c6416082ac3ea16278e
264dc602fb579e8d020af349ab91553730462ba6f609d03978dd48a68bf5c12b
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
493a0c3f38e807d0d34ef683bec3524147318dac3d328ffded7d05f4ceccea6c
5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7
5cd9dbeccb2ea71c63b08373a676055ab71f20d08008de8c2e2ff406022dcbd5
5fffa62486dc1a784ca7f14108e8c0bffbe70b82212418ed00fe5485bfb7dfe5
755729d9fec89358dab6ccbed819843d5c1497a5857764457463137566346fd6
86068b0c6c29ee32401f200dafc38cdcbb33c6c0aba849397b09d128e9baa202
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
b0bcecb33786066f2fec6f2f8787ae474e2eb71dab69fe4d0f0387baa05904ac
b564f3c5e65535c7faba608600f0d761329bebba8c4f4cd404555033d794a2ef
c2bcdc085e0557a379a6056c629be748d22a3c1dbe539a48ae02de7d69c95eff