urlscan.io logo urlscan.io
SecurityTrails logo

brshaqeshlft-finance.online Open in urlscan Pro
2a06:98c1:3121::c  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://shapeshiftt0.blogspot.com/
Effective URL: https://brshaqeshlft-finance.online/?s=c2hhcGVzaGlmdDswNA==
Submission: On December 24 via api from CH — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 9 IPs in 3 countries across 9 domains to perform 17 HTTP transactions. The main IP is 2a06:98c1:3121::c, located in United States and belongs to CLOUDFLARENET, US. The main domain is brshaqeshlft-finance.online.
TLS certificate: Issued by E1 on December 23rd 2022. Valid for: 3 months.
This is the only time brshaqeshlft-finance.online was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Crypto (Crypto Exchange)

Domain & IP information

IP Address AS Autonomous System
1 2a00:1450:400... 15169 (GOOGLE)
3 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 1 2a06:98c1:312... 13335 (CLOUDFLAR...)
4 2a06:98c1:312... 13335 (CLOUDFLAR...)
1 18.66.147.92 16509 (AMAZON-02)
4 2a04:4e42:200... 54113 (FASTLY)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700:20:... 13335 (CLOUDFLAR...)
17 9
1    2a00:1450:4001:82a::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
shapeshiftt0.blogspot.com
3    2a00:1450:4001:806::2009 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.blogger.com
1    2a00:1450:400d:80a::200e (Ireland)

ASN15169 (GOOGLE, US)
apis.google.com
1    2a06:98c1:3120::c (United States)

ASN13335 (CLOUDFLARENET, US)
brshaqeshlft-finance.online
4    2a06:98c1:3121::c (United States)

ASN13335 (CLOUDFLARENET, US)
brshaqeshlft-finance.online
1    18.66.147.92 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-147-92.fra60.r.cloudfront.net
cdn.ethers.io
4    2a04:4e42:200::485 (United States)

ASN54113 (FASTLY, US)
cdn.jsdelivr.net
1    2606:4700::6810:f005 (United States)

ASN13335 (CLOUDFLARENET, US)
app.shapeshift.com
1    2606:4700:20::681a:649 (United States)

ASN13335 (CLOUDFLARENET, US)
registry.walletconnect.org
Apex Domain
Subdomains		 Transfer
5 brshaqeshlft-finance.online
brshaqeshlft-finance.online
43 KB
4 jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 381
795 KB
3 blogger.com
www.blogger.com — Cisco Umbrella Rank: 8574
3 KB
1 walletconnect.org
registry.walletconnect.org — Cisco Umbrella Rank: 547016
45 KB
1 shapeshift.com
app.shapeshift.com
87 KB
1 ethers.io
cdn.ethers.io — Cisco Umbrella Rank: 482820
197 KB
1 google.com
apis.google.com — Cisco Umbrella Rank: 92
21 KB
1 blogspot.com
shapeshiftt0.blogspot.com
0 cloudfront.net Failed
d3ugyf2ht6aenh.cloudfront.net Failed
17 9
Domain Requested by
5 brshaqeshlft-finance.online 1 redirects shapeshiftt0.blogspot.com
brshaqeshlft-finance.online
4 cdn.jsdelivr.net brshaqeshlft-finance.online
3 www.blogger.com shapeshiftt0.blogspot.com
1 registry.walletconnect.org cdn.jsdelivr.net
1 app.shapeshift.com brshaqeshlft-finance.online
1 cdn.ethers.io brshaqeshlft-finance.online
1 apis.google.com shapeshiftt0.blogspot.com
1 shapeshiftt0.blogspot.com
0 d3ugyf2ht6aenh.cloudfront.net Failed shapeshiftt0.blogspot.com
17 9

This site contains links to these domains. Also see Links.

Domain
shapeshift.zendesk.com
Subject Issuer Validity Valid
misc-sni.blogspot.com
GTS CA 1C3		 2022-11-28 -
2023-02-20		 3 months crt.sh
*.blogger.com
GTS CA 1C3		 2022-11-28 -
2023-02-20		 3 months crt.sh
*.apis.google.com
GTS CA 1C3		 2022-11-28 -
2023-02-20		 3 months crt.sh
*.brshaqeshlft-finance.online
E1		 2022-12-23 -
2023-03-23		 3 months crt.sh
ethers.io
Amazon		 2022-10-31 -
2023-11-28		 a year crt.sh
jsdelivr.net
GlobalSign Atlas R3 DV TLS CA 2022 Q4		 2022-12-23 -
2024-01-24		 a year crt.sh
shapeshift.com
Cloudflare Inc ECC CA-3		 2022-05-12 -
2023-05-11		 a year crt.sh
*.walletconnect.org
GTS CA 1P5		 2022-11-17 -
2023-02-15		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://brshaqeshlft-finance.online/?s=c2hhcGVzaGlmdDswNA==
Frame ID: 0D1B40B5B4771476307DC869DCCBF1DB
Requests: 18 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Connect Wallet | ShapeShift

Page URL History Show full URLs

  1. https://shapeshiftt0.blogspot.com/ Page URL
  2. http://brshaqeshlft-finance.online/?s=c2hhcGVzaGlmdDswNA== HTTP 301
    https://brshaqeshlft-finance.online/?s=c2hhcGVzaGlmdDswNA== Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • apis\.google\.com/js/platform\.js
Overall confidence: 100%
Detected patterns
  • apis\.google\.com/js/[a-z]*\.js
Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Overall confidence: 100%
Detected patterns
  • //cdn\.jsdelivr\.net/

Page Statistics

17
Requests

94 %
HTTPS

89 %
IPv6

9
Domains

9
Subdomains

9
IPs

3
Countries

1190 kB
Transfer

5411 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://shapeshiftt0.blogspot.com/ Page URL
  2. http://brshaqeshlft-finance.online/?s=c2hhcGVzaGlmdDswNA== HTTP 301
    https://brshaqeshlft-finance.online/?s=c2hhcGVzaGlmdDswNA== Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

17 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
shapeshiftt0.blogspot.com/ 		1 MB
0 		Document
General
Check archive.org
Download Go to
Full URL
https://shapeshiftt0.blogspot.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
private, max-age=0
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Sat, 24 Dec 2022 10:28:38 GMT
etag
W/"f292408c40ef721e7ca9bab8347174e9ae15d16cb74a5530be6885fcf81b1e19"
expires
Sat, 24 Dec 2022 10:28:38 GMT
last-modified
Sat, 24 Dec 2022 05:16:38 GMT
server
GSE
x-content-type-options
nosniff
x-xss-protection
1; mode=block
1601750677-blog_controls.css
www.blogger.com/static/v1/v-css/ 		657 B
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.blogger.com/static/v1/v-css/1601750677-blog_controls.css
Requested by
Host: shapeshiftt0.blogspot.com
URL: https://shapeshiftt0.blogspot.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2009 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://shapeshiftt0.blogspot.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date
Tue, 20 Dec 2022 20:12:36 GMT
x-content-type-options
nosniff
age
310563
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
657
x-xss-protection
0
last-modified
Tue, 20 Dec 2022 19:53:22 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"blogger-tech","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/blogger-tech"}]}
content-type
text/css
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="blogger-tech"
expires
Wed, 20 Dec 2023 20:12:36 GMT
authorization.css
www.blogger.com/dyn-css/ 		1 B
688 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.blogger.com/dyn-css/authorization.css?targetBlogID=5219128495372753061&zx=def57a69-18c9-4bf1-a5f4-c84831587809
Requested by
Host: shapeshiftt0.blogspot.com
URL: https://shapeshiftt0.blogspot.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2009 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'self' *.google.com *.google-analytics.com 'unsafe-inline' 'unsafe-eval' *.gstatic.com *.googlesyndication.com *.blogger.com *.googleapis.com uds.googleusercontent.com https://s.ytimg.com https://i18n-cloud.appspot.com https://www.youtube.com www-onepick-opensocial.googleusercontent.com www-bloggervideo-opensocial.googleusercontent.com www-blogger-opensocial.googleusercontent.com https://www.blogblog.com; report-uri /cspreport
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://shapeshiftt0.blogspot.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

pragma
no-cache
content-security-policy
script-src 'self' *.google.com *.google-analytics.com 'unsafe-inline' 'unsafe-eval' *.gstatic.com *.googlesyndication.com *.blogger.com *.googleapis.com uds.googleusercontent.com https://s.ytimg.com https://i18n-cloud.appspot.com https://www.youtube.com www-onepick-opensocial.googleusercontent.com www-bloggervideo-opensocial.googleusercontent.com www-blogger-opensocial.googleusercontent.com https://www.blogblog.com; report-uri /cspreport
date
Sat, 24 Dec 2022 10:28:39 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Sat, 24 Dec 2022 10:28:39 GMT
server
GSE
x-frame-options
SAMEORIGIN
p3p
CP="This is not a P3P policy! See https://www.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 for more info."
content-type
text/css; charset=UTF-8
cache-control
no-cache, no-store, max-age=0, must-revalidate
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
21
x-xss-protection
1; mode=block
expires
Mon, 01 Jan 1990 00:00:00 GMT
3334278262-classic.css
www.blogger.com/static/v1/v-css/navbar/ 		871 B
985 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.blogger.com/static/v1/v-css/navbar/3334278262-classic.css
Requested by
Host: shapeshiftt0.blogspot.com
URL: https://shapeshiftt0.blogspot.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2009 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://shapeshiftt0.blogspot.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date
Fri, 23 Dec 2022 06:59:55 GMT
x-content-type-options
nosniff
age
98924
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
871
x-xss-protection
0
last-modified
Thu, 22 Dec 2022 19:04:13 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"blogger-tech","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/blogger-tech"}]}
content-type
text/css
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="blogger-tech"
expires
Sat, 23 Dec 2023 06:59:55 GMT
platform.js
apis.google.com/js/ 		54 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://apis.google.com/js/platform.js
Requested by
Host: shapeshiftt0.blogspot.com
URL: https://shapeshiftt0.blogspot.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400d:80a::200e , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
Security Headers
Name Value
Content-Security-Policy require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gapi-team
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://shapeshiftt0.blogspot.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

content-security-policy
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gapi-team
content-encoding
gzip
x-content-type-options
nosniff
date
Sat, 24 Dec 2022 10:28:39 GMT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
20933
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="gapi-team"
etag
"ec76424fc4148a81"
vary
Accept-Encoding
report-to
{"group":"gapi-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gapi-team"}]}
content-type
text/javascript
access-control-allow-origin
*
cache-control
private, max-age=1800, stale-while-revalidate=1800
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 24 Dec 2022 10:28:39 GMT
logo-1890220343-1671545325-746795f1aee0b8721c0bd724c717c5f71671545325-320-0.png
d3ugyf2ht6aenh.cloudfront.net/stores/452/758/themes/common/ 		0
0
Primary Request /
brshaqeshlft-finance.online/
Redirect Chain
  • http://brshaqeshlft-finance.online/?s=c2hhcGVzaGlmdDswNA==
  • https://brshaqeshlft-finance.online/?s=c2hhcGVzaGlmdDswNA==
10 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://brshaqeshlft-finance.online/?s=c2hhcGVzaGlmdDswNA==
Requested by
Host: shapeshiftt0.blogspot.com
URL: https://shapeshiftt0.blogspot.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3121::c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PHP/7.4.33
Resource Hash
79694df18be9fb945fa006bdcb79eadaf70734644c23f3417577ce0df32ec1b0

Request headers

Referer
https://shapeshiftt0.blogspot.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
77e8a6c0ae0f91d8-FRA
content-encoding
br
content-type
text/html; charset=UTF-8
date
Sat, 24 Dec 2022 10:28:39 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=g9M62lP52bTcQfEPDEwfpeFspVuSqor%2BgJC4Z0ZQ1saaf7tpVBBCv02%2FWaeXGvVRRsEGY7TgXFKd23Q2znD1%2Fdl8DWTVnbg4JanbBNJY%2BLmbjT8zVoAJj%2B6LMSQ9Gr6rqXcrKeABO5sCmpWJLom8%2B%2FXRJ4veEkAoj1w%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
x-powered-by
PHP/7.4.33

Redirect headers

CF-RAY
77e8a6bfda5fbba7-FRA
Cache-Control
max-age=3600
Connection
keep-alive
Date
Sat, 24 Dec 2022 10:28:39 GMT
Expires
Sat, 24 Dec 2022 11:28:39 GMT
Location
https://brshaqeshlft-finance.online/?s=c2hhcGVzaGlmdDswNA==
NEL
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tAafuonU5r%2F5btKQk7mfI3VGLGnolkNdAeJr%2FdJNdWPfN8Ant3B0Zp2fyOQ0zFyhSs6StzmwgGoCFK7skcxqCt24%2FBVGQSsFR2icdJ7n9beC80I3J9%2FCvR1%2FSqSzW4hU9mCynZErvTEgLj7dPhqO7SiUzt2zULif9fc%3D"}],"group":"cf-nel","max_age":604800}
Server
cloudflare
Transfer-Encoding
chunked
Vary
Accept-Encoding
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
estilo.css
brshaqeshlft-finance.online/shapeshift/ 		34 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://brshaqeshlft-finance.online/shapeshift/estilo.css
Requested by
Host: brshaqeshlft-finance.online
URL: https://brshaqeshlft-finance.online/?s=c2hhcGVzaGlmdDswNA==
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3121::c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
14a2725184876da31bc7e6a80ebefbb1891d540d303e86697221aab89af4bed2

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date
Sat, 24 Dec 2022 10:28:39 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Thu, 22 Dec 2022 23:53:04 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"63a4ede0-89df"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=j%2FVyLWyctKnQ4fbzb2CsvzEHQIUytyAyKNwTnt5m2mzT216EUGk1mwYUSFCr6ed8VltdxN5XVOKQZf13tG4f3mn0ZcgqpL2Hn8PCXaVbjUOt2%2BZnkl64fFYW%2FgLCY23oiZCagzjCyIv4Bat3QdJNbl9uVzvPGNGpXw4%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
cf-ray
77e8a6c1e81091d8-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
jquery-3.6.1.min.js
brshaqeshlft-finance.online/js/ 		88 KB
32 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://brshaqeshlft-finance.online/js/jquery-3.6.1.min.js
Requested by
Host: brshaqeshlft-finance.online
URL: https://brshaqeshlft-finance.online/?s=c2hhcGVzaGlmdDswNA==
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3121::c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
131c0d82967fed05e1920e519e0ea6ec91ab97b7c40480f72f8af8680bba1f0a

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date
Sat, 24 Dec 2022 10:28:39 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Thu, 22 Dec 2022 23:52:58 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"63a4edda-15e3f"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=W3kxPB2zBE%2BO%2FmtkxQiXUKfRdLSecDdGqm9XrlWxZaR%2BP8OpTi5fpuqvGnpUTkYZk1Al%2B5Sed5kYvigBPLE%2Bd5wzYtUSv8H5VzAjPOh%2F%2BUfcXeKYRp0Hzff7rpGNPUsF3qhUtJUH6k1N%2BtZLW0FIn%2FEj71LwK9JoF%2Bw%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
cf-ray
77e8a6c1e81191d8-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
ethers-5.2.umd.min.js
cdn.ethers.io/lib/ 		716 KB
197 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.ethers.io/lib/ethers-5.2.umd.min.js
Requested by
Host: brshaqeshlft-finance.online
URL: https://brshaqeshlft-finance.online/?s=c2hhcGVzaGlmdDswNA==
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.147.92 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-147-92.fra60.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
c2bcdc085e0557a379a6056c629be748d22a3c1dbe539a48ae02de7d69c95eff

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-amz-version-id
3StspTE73ijjMFvXMjx4rHtfrweE9frC
content-encoding
gzip
via
1.1 77517a7f5d9094d359ba5186c3bda1e6.cloudfront.net (CloudFront)
date
Sat, 24 Dec 2022 02:26:54 GMT
last-modified
Thu, 20 May 2021 21:33:05 GMT
server
AmazonS3
x-amz-cf-pop
FRA60-P4
age
28906
etag
W/"50ed955cf32ac8e4e1daa0fac8fcde98"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript; charset=utf-8
x-amz-cf-id
KXgjQ0APXBIUtkT8G7rcJrRIJAGdEp0ZVJYbI9uXGwGCP_xztJrLuA==
web3.min.js
cdn.jsdelivr.net/npm/web3@latest/dist/ 		1 MB
410 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.jsdelivr.net/npm/web3@latest/dist/web3.min.js
Requested by
Host: brshaqeshlft-finance.online
URL: https://brshaqeshlft-finance.online/?s=c2hhcGVzaGlmdDswNA==
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:200::485 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
71d7328c8b5a399aac329a83d86b51058c01e0e0414fc4577dabfc79c518c6d8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Sat, 24 Dec 2022 10:28:39 GMT
x-content-type-options
nosniff
content-encoding
gzip
age
41219
x-jsd-version
1.8.1
x-cache
HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
419297
x-served-by
cache-fra-eddf8230044-FRA
x-jsd-version-type
version
etag
W/"163759-IwpZDBwarMNpRlZFtitwZD1oxeo"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=604800, s-maxage=43200
accept-ranges
bytes
timing-allow-origin
*
index.min.js
cdn.jsdelivr.net/npm/@walletconnect/web3-provider@1.7.1/dist/umd/ 		733 KB
220 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.jsdelivr.net/npm/@walletconnect/web3-provider@1.7.1/dist/umd/index.min.js
Requested by
Host: brshaqeshlft-finance.online
URL: https://brshaqeshlft-finance.online/?s=c2hhcGVzaGlmdDswNA==
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:200::485 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
249f824f34fd0715ba6210535decaab795ce238de0dcdf9ffb40a5d6b2ea0369
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Sat, 24 Dec 2022 10:28:39 GMT
x-content-type-options
nosniff
content-encoding
gzip
age
5544271
x-jsd-version
1.7.1
x-cache
HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
225413
x-served-by
cache-fra-eddf8230044-FRA
x-jsd-version-type
version
etag
W/"b72ae-I2VpOtfGa9/GSavEcSax34GI2zI"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges
bytes
timing-allow-origin
*
ethereumjs-tx-1.3.3.min.js
cdn.jsdelivr.net/gh/ethereumjs/browser-builds/dist/ethereumjs-tx/ 		315 KB
96 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.jsdelivr.net/gh/ethereumjs/browser-builds/dist/ethereumjs-tx/ethereumjs-tx-1.3.3.min.js
Requested by
Host: brshaqeshlft-finance.online
URL: https://brshaqeshlft-finance.online/?s=c2hhcGVzaGlmdDswNA==
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:200::485 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
10d78c0a5e8664889dc8eb47c72bfa46ad0ed02c70a234be9acdefa27dbb24b0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Sat, 24 Dec 2022 10:28:39 GMT
x-content-type-options
nosniff
content-encoding
gzip
age
3145
x-jsd-version
master
x-cache
HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
97784
x-served-by
cache-fra-eddf8230044-FRA
x-jsd-version-type
branch
etag
W/"4edeb-1sQW5dFT9QD3rGbSWitz20WGetQ"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=604800, s-maxage=43200
accept-ranges
bytes
timing-allow-origin
*
keccak256.js
cdn.jsdelivr.net/npm/keccak256@latest/ 		292 KB
69 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.jsdelivr.net/npm/keccak256@latest/keccak256.js
Requested by
Host: brshaqeshlft-finance.online
URL: https://brshaqeshlft-finance.online/?s=c2hhcGVzaGlmdDswNA==
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:200::485 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
88f4993e7e84aef5f7260bf1846558cdac02db313a3b2ab3eaa3deeda85fed31
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Sat, 24 Dec 2022 10:28:39 GMT
x-content-type-options
nosniff
content-encoding
gzip
age
33800
x-jsd-version
1.0.6
x-cache
HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
70487
x-served-by
cache-fra-eddf8230044-FRA
x-jsd-version-type
version
etag
W/"48f2d-XYSplk+1Z6bB7lJslSty4v/cISA"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=604800, s-maxage=43200
accept-ranges
bytes
timing-allow-origin
*
script.min.js
brshaqeshlft-finance.online/js/ 		8 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://brshaqeshlft-finance.online/js/script.min.js?v=10
Requested by
Host: brshaqeshlft-finance.online
URL: https://brshaqeshlft-finance.online/?s=c2hhcGVzaGlmdDswNA==
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3121::c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b9a7269bfcef6f6bca7b66b8ac23af7051c1c4725255553ed3d8e215f99bddfc

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date
Sat, 24 Dec 2022 10:28:39 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Thu, 22 Dec 2022 23:52:58 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"63a4edda-1ef0"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kvXwhNBzULDQNv%2BpkKeLuw64KLm%2BdwAXNxGmWWF4c8pMVNYttkR2F8OyGP6LoKTlzpyjebHkwyh%2BqOHeRrb%2BNNa77DvDrBOJ03%2FiAb6fok7E7lcQOneckQn%2B95AWeyO3sbvSz%2BT18zw%2BYaVHLmR4dZ%2BMYANGJ5fSRpo%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
cf-ray
77e8a6c1e81491d8-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
aurorabg.3757627048c7ef6096ef.jpg
app.shapeshift.com/static/media/ 		85 KB
87 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://app.shapeshift.com/static/media/aurorabg.3757627048c7ef6096ef.jpg
Requested by
Host: brshaqeshlft-finance.online
URL: https://brshaqeshlft-finance.online/shapeshift/estilo.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:f005 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3757627048c7ef6096ef630a3992be94c01ff181f1f61162b7fccb72daa44bec
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'none'
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://brshaqeshlft-finance.online/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

content-security-policy
frame-ancestors 'none'
cdn-pullzone
699547
referrer-policy
no-referrer
cf-bgj
h2pri
cdn-proxyver
1.03
x-ipfs-roots
bafybeihwxqk64xhzxvfmbrlfibqomvevgji7wkyqdcgfyil6w44qm4fn5u,QmWS6db8YYn2KCWnqvqohoTS7KGiQeJYUzQQLcfjawYcHr,QmVPmyakPDwBNsKLE7Qwf9nKCPmHMSKvLN7ZajAs8cTRvM,QmcyJfAT53oTHQ7nCD5meVrgeRXtGrDnbngm3PdRnYE9pJ
etag
"QmcyJfAT53oTHQ7nCD5meVrgeRXtGrDnbngm3PdRnYE9pJ"
x-frame-options
DENY
access-control-allow-methods
GET
content-type
image/jpeg
access-control-allow-origin
*
cdn-cache
EXPIRED
access-control-expose-headers
Content-Length, Content-Range, X-Chunked-Output, X-Ipfs-Path, X-Ipfs-Roots, X-Stream-Output
cache-control
public, max-age=14400
x-ipfs-path
/ipfs/bafybeihwxqk64xhzxvfmbrlfibqomvevgji7wkyqdcgfyil6w44qm4fn5u/static/media/aurorabg.3757627048c7ef6096ef.jpg
vary
Accept-Encoding
access-control-allow-headers
Content-Type, Range, User-Agent, X-Requested-With
cdn-requestcountrycode
DE
expires
Sat, 24 Dec 2022 14:28:39 GMT
date
Sat, 24 Dec 2022 10:28:39 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
cf-cache-status
REVALIDATED
cdn-edgestorageid
1048
x-cache-status
HIT
cdn-cachedat
12/18/2022 05:10:45
content-length
87459
x-xss-protection
0
x-request-id
ec1f08b2012da5c1aee5dcf5afd4bd08
server
cloudflare
cdn-requestpullcode
200
cross-origin-opener-policy
same-origin-allow-popups
cdn-uid
070ccd6e-b4b0-4c90-b45a-e26d7534205d
permissions-policy
document-domain=()
cdn-requestid
f725d2bd26690b275fe04089aa45a10b
accept-ranges
bytes
cf-ray
77e8a6c58e4e163e-FRA
cdn-status
200
cdn-requestpullsuccess
True
truncated
/ 		2 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
8eee49e3d0f4e651f9f40adfd661861997715b99d5b88103ae44d248ca6b1751

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Content-Type
image/svg+xml
wallets.json
registry.walletconnect.org/data/ 		254 KB
45 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://registry.walletconnect.org/data/wallets.json
Requested by
Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/npm/@walletconnect/web3-provider@1.7.1/dist/umd/index.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2606:4700:20::681a:649 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8d1605981c4c156812e521548d5e45ceb8feffb0a359c52e12c39186e6bc6db7

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date
Sat, 24 Dec 2022 10:28:40 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sat, 24 Dec 2022 10:26:29 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
131
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ul0W7FPIv%2F5r3WcObX90PnbY0iqsG9oEk4VJ7Us%2BcvQjSeDn%2FI2mBh8XzYvetzNlwPHGNzKXt5B4JSpIXJAU9IgF5Tr2rVSIM5Ku1VCGqYWuoCWBeBK6ds2%2B%2BbXk%2Bb8G%2FRsnsKGOBT%2BPA53wEkSRL%2FGHHMoIf%2BtM"}],"group":"cf-nel","max_age":604800}
content-type
application/json
access-control-allow-origin
*
cache-control
public, max-age=21600, s-maxage=7200
cf-ray
77e8a6c8e84b91e4-FRA
x-robots-tag
noindex

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
d3ugyf2ht6aenh.cloudfront.net
URL
https://d3ugyf2ht6aenh.cloudfront.net/stores/452/758/themes/common/logo-1890220343-1671545325-746795f1aee0b8721c0bd724c717c5f71671545325-320-0.png?0

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Crypto (Crypto Exchange)

25 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontentvisibilityautostatechange function| $ function| jQuery object| _ethers object| ethers function| setImmediate function| clearImmediate object| regeneratorRuntime function| Web3 object| WalletConnectProvider object| ethereumjs function| keccak256 string| user function| signTransaction function| getBalanceToken boolean| mobile function| hexToDec function| NewTransaction function| Metamask function| save_log function| WalletConnect function| openModal function| open_metamask function| open_trustwallet object| provider

1 Cookies

Domain/Path Name / Value
brshaqeshlft-finance.online/ Name: config
Value: c2hhcGVzaGlmdDswNA%3D%3D

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block