www.oriswap.xyz Open in urlscan Pro
3.115.250.60 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://oriswap.xyz/
Effective URL:
https://www.oriswap.xyz/
Submission: On December 30 via api (December 30th 2022, 3:55:19 pm UTC) from PL — Scanned from JP

Summary HTTP 16 Redirects Links 3 Behaviour Indicators

Summary

This website contacted 4 IPs in 3 countries across 3 domains to perform 16 HTTP transactions. The main IP is 3.115.250.60, located in Tokyo, Japan and belongs to AMAZON-02, US. The main domain is www.oriswap.xyz.
TLS certificate: Issued by Amazon RSA 2048 M01 on December 16th 2022. Valid for: a year.

This is the only time www.oriswap.xyz was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Uniswap (Crypto Exchange)

Domain & IP information

	IP Address	AS Autonomous System
2 2	35.79.111.165 35.79.111.165	16509 (AMAZON-02) (AMAZON-02)
1 10	3.115.250.60 3.115.250.60	16509 (AMAZON-02) (AMAZON-02)
3	2404:6800:400... 2404:6800:4004:825::200e	15169 (GOOGLE) (GOOGLE)
4	2606:4700:303... 2606:4700:3031::6815:7f6	13335 (CLOUDFLAR...) (CLOUDFLARENET)
16	4

2 35.79.111.165 (Tokyo, Japan) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-35-79-111-165.ap-northeast-1.compute.amazonaws.com

oriswap.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 3.115.250.60 (Tokyo, Japan) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-3-115-250-60.ap-northeast-1.compute.amazonaws.com

www.oriswap.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2404:6800:4004:825::200e (Australia)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700:3031::6815:7f6 (United States)

ASN13335 (CLOUDFLARENET, US)

rpc.etherfair.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	oriswap.xyz 3 redirects oriswap.xyz www.oriswap.xyz	5 MB
4	etherfair.org rpc.etherfair.org	1 KB
3	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 103	20 KB
16	3

	Domain	Requested by
10	www.oriswap.xyz	1 redirects www.oriswap.xyz
4	rpc.etherfair.org	www.oriswap.xyz
3	www.google-analytics.com	www.oriswap.xyz www.google-analytics.com
2	oriswap.xyz	2 redirects
16	4

This site contains links to these domains. Also see Links.

Domain
openapi.chainge.finance
info.oriswap.xyz
explorer.etherfair.org

Subject Issuer	Validity	Valid
*.oriswap.xyz Amazon RSA 2048 M01	`2022-12-16` - `2024-01-15`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2022-11-28` - `2023-02-20`	3 months	crt.sh
*.etherfair.org E1	`2022-12-05` - `2023-03-05`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://www.oriswap.xyz/
Frame ID: 3A0EE2B0A1921E7527387318884274D9
Requests: 18 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

OriSwap

Page URL History Show full URLs

http://oriswap.xyz/ HTTP 301
https://oriswap.xyz/ HTTP 301
http://www.oriswap.xyz/ HTTP 301
https://www.oriswap.xyz/ Page URL

Detected technologies

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Page Statistics

16
Requests

100 %
HTTPS

50 %
IPv6

3
Domains

4
Subdomains

4
IPs

3
Countries

5185 kB
Transfer

5214 kB
Size

3
Cookies

3 Outgoing links

These are links going to different origins than the main page.

URL: https://openapi.chainge.finance/app?fromChain=BSC&toChain=ETHF&fromToken=USDT&toToken=USDT
Title: Cross-chain Swap↗

Search URL Search Domain Scan URL

URL: https://info.oriswap.xyz/
Title: Charts ↗

Search URL Search Domain Scan URL

URL: https://explorer.etherfair.org/block/16224643
Title: 16224643

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://oriswap.xyz/ HTTP 301
https://oriswap.xyz/ HTTP 301
http://www.oriswap.xyz/ HTTP 301
https://www.oriswap.xyz/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

16 HTTP transactions
4 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
www.oriswap.xyz/
Redirect Chain

http://oriswap.xyz/
https://oriswap.xyz/
http://www.oriswap.xyz/
https://www.oriswap.xyz/

3 KB
3 KB

24ms
7ms

Document
text/html

3.115.250.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.oriswap.xyz/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.115.250.60 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-115-250-60.ap-northeast-1.compute.amazonaws.com
Software: nginx/1.22.0 /
Resource Hash: f6b13c60610c280318ec37215f55f1995b558704a58790c59af7a8c23411b8d0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language: jp-JP,jp;q=0.9

Response headers

accept-ranges: bytes
content-length: 3176
content-type: text/html
date: Fri, 30 Dec 2022 15:55:14 GMT
etag: "63ae9db9-c68"
last-modified: Fri, 30 Dec 2022 08:13:45 GMT
server: nginx/1.22.0

Redirect headers

Connection: keep-alive
Content-Length: 134
Content-Type: text/html
Date: Fri, 30 Dec 2022 15:55:14 GMT
Location: https://www.oriswap.xyz:443/
Server: awselb/2.0

GET
H2 200 3.ca0a8f81.chunk.css
www.oriswap.xyz/static/css/ 564 KB
565 KB 11ms
9ms Stylesheet
text/css 3.115.250.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.oriswap.xyz/static/css/3.ca0a8f81.chunk.css
Requested by: Host: www.oriswap.xyz
URL: https://www.oriswap.xyz/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.115.250.60 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-115-250-60.ap-northeast-1.compute.amazonaws.com
Software: nginx/1.22.0 /
Resource Hash: 28f9b00d1d2114657198e2419027cf66844d1eac27c60cdbfe0a8f61078a645f

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://www.oriswap.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 30 Dec 2022 15:55:14 GMT
last-modified: Fri, 30 Dec 2022 08:13:45 GMT
server: nginx/1.22.0
accept-ranges: bytes
etag: "63ae9db9-8d196"
content-length: 577942
content-type: text/css

GET
H2 200 3.0155ea30.chunk.js Show response
www.oriswap.xyz/static/js/ 4 MB
4 MB 19ms
17ms Script
application/javascript 3.115.250.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.oriswap.xyz/static/js/3.0155ea30.chunk.js
Requested by: Host: www.oriswap.xyz
URL: https://www.oriswap.xyz/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.115.250.60 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-115-250-60.ap-northeast-1.compute.amazonaws.com
Software: nginx/1.22.0 /
Resource Hash: 06757342b3b19c4d1f4717b9b0117ce5fe46ff2a0cd5462b496a603a8970c031

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://www.oriswap.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 30 Dec 2022 15:55:14 GMT
last-modified: Fri, 30 Dec 2022 08:13:45 GMT
server: nginx/1.22.0
accept-ranges: bytes
etag: "63ae9db9-385196"
content-length: 3690902
content-type: application/javascript

GET
H2 200 main.d6839e4a.chunk.js Show response
www.oriswap.xyz/static/js/ 740 KB
741 KB 19ms
18ms Script
application/javascript 3.115.250.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.oriswap.xyz/static/js/main.d6839e4a.chunk.js
Requested by: Host: www.oriswap.xyz
URL: https://www.oriswap.xyz/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.115.250.60 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-115-250-60.ap-northeast-1.compute.amazonaws.com
Software: nginx/1.22.0 /
Resource Hash: 3e279b2da92d621348d1ae31f1c47387c482b1090db31a18ad3e621e415f4bc3

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://www.oriswap.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 30 Dec 2022 15:55:14 GMT
last-modified: Fri, 30 Dec 2022 08:13:45 GMT
server: nginx/1.22.0
accept-ranges: bytes
etag: "63ae9db9-b9045"
content-length: 757829
content-type: application/javascript

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 9ms
2ms Script
text/javascript 2404:6800:4004:825::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.oriswap.xyz
URL: https://www.oriswap.xyz/static/js/3.0155ea30.chunk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4004:825::200e , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

b42e4a056cb5b80c5a315040826866445ec9332f0749e184509ab2d9d3b86719

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://www.oriswap.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Fri, 30 Dec 2022 15:38:49 GMT
last-modified: Tue, 27 Sep 2022 22:01:05 GMT
server: Golfe2
age: 985
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20039
expires: Fri, 30 Dec 2022 17:38:49 GMT

GET
DATA 200
OK truncated
/ 3 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8c02abca64e66308b45718018df19628abf6dced2392138e9265159ee160cf0a

Request headers

accept-language: jp-JP,jp;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 Inter-roman.var.57fa490c.woff2
www.oriswap.xyz/static/media/ 219 KB
220 KB 6ms
6ms Font
font/woff2 3.115.250.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.oriswap.xyz/static/media/Inter-roman.var.57fa490c.woff2
Requested by: Host: www.oriswap.xyz
URL: https://www.oriswap.xyz/static/css/3.ca0a8f81.chunk.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.115.250.60 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-115-250-60.ap-northeast-1.compute.amazonaws.com
Software: nginx/1.22.0 /
Resource Hash: ed38b29cfa2fc0d12d0ed4ed265228de9bd4c733d1ce007b54b4655928697420

Request headers

Referer: https://www.oriswap.xyz/static/css/3.ca0a8f81.chunk.css
Origin: https://www.oriswap.xyz
accept-language: jp-JP,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 30 Dec 2022 15:55:14 GMT
last-modified: Fri, 30 Dec 2022 08:13:45 GMT
server: nginx/1.22.0
accept-ranges: bytes
etag: "63ae9db9-36de8"
content-length: 224744
content-type: font/woff2

GET
H2 200 en-US.json Show response
www.oriswap.xyz/locales/ 3 KB
3 KB 6ms
5ms XHR
text/html 3.115.250.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.oriswap.xyz/locales/en-US.json
Requested by: Host: www.oriswap.xyz
URL: https://www.oriswap.xyz/static/js/3.0155ea30.chunk.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.115.250.60 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-115-250-60.ap-northeast-1.compute.amazonaws.com
Software: nginx/1.22.0 /
Resource Hash: f6b13c60610c280318ec37215f55f1995b558704a58790c59af7a8c23411b8d0

Request headers

Referer: https://www.oriswap.xyz/
X-Requested-With: XMLHttpRequest
accept-language: jp-JP,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 30 Dec 2022 15:55:14 GMT
last-modified: Fri, 30 Dec 2022 08:13:45 GMT
server: nginx/1.22.0
accept-ranges: bytes
etag: "63ae9db9-c68"
content-length: 3176
content-type: text/html

GET
H2 200 en.json Show response
www.oriswap.xyz/locales/ 15 KB
16 KB 6ms
6ms XHR
application/json 3.115.250.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.oriswap.xyz/locales/en.json
Requested by: Host: www.oriswap.xyz
URL: https://www.oriswap.xyz/static/js/3.0155ea30.chunk.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.115.250.60 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-115-250-60.ap-northeast-1.compute.amazonaws.com
Software: nginx/1.22.0 /
Resource Hash: 5af4334086d107018307abdc71b54d7f1d8f3999a64a1739d2067480e476e1cd

Request headers

Referer: https://www.oriswap.xyz/
X-Requested-With: XMLHttpRequest
accept-language: jp-JP,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 30 Dec 2022 15:55:14 GMT
last-modified: Fri, 30 Dec 2022 08:13:45 GMT
server: nginx/1.22.0
accept-ranges: bytes
etag: "63ae9db9-3dd9"
content-length: 15833
content-type: application/json

GET
H2 200 heco-mainnet-tokenlist.json Show response
www.oriswap.xyz/ 3 KB
3 KB 5ms
5ms Fetch
application/json 3.115.250.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.oriswap.xyz/heco-mainnet-tokenlist.json?v=3&t=20221229
Requested by: Host: www.oriswap.xyz
URL: https://www.oriswap.xyz/static/js/main.d6839e4a.chunk.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.115.250.60 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-115-250-60.ap-northeast-1.compute.amazonaws.com
Software: nginx/1.22.0 /
Resource Hash: c0fa624e0b21db5c3338ca08a3ad5a014d60d47a216997918af50a9554b7311d

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://www.oriswap.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 30 Dec 2022 15:55:14 GMT
last-modified: Fri, 30 Dec 2022 08:13:45 GMT
server: nginx/1.22.0
accept-ranges: bytes
etag: "63ae9db9-d5b"
content-length: 3419
content-type: application/json

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8ae01d48525de9513ec8dc6e8b43ea9d500c071df8d28c01d68780f0a7b958e1

Request headers

accept-language: jp-JP,jp;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 heco-mainnet-tokenlist.json Show response
www.oriswap.xyz/ 3 KB
3 KB 6ms
5ms Fetch
application/json 3.115.250.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.oriswap.xyz/heco-mainnet-tokenlist.json?v=3&t=20221229
Requested by: Host: www.oriswap.xyz
URL: https://www.oriswap.xyz/static/js/main.d6839e4a.chunk.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.115.250.60 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-115-250-60.ap-northeast-1.compute.amazonaws.com
Software: nginx/1.22.0 /
Resource Hash: c0fa624e0b21db5c3338ca08a3ad5a014d60d47a216997918af50a9554b7311d

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://www.oriswap.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date: Fri, 30 Dec 2022 15:55:14 GMT
last-modified: Fri, 30 Dec 2022 08:13:45 GMT
server: nginx/1.22.0
accept-ranges: bytes
etag: "63ae9db9-d5b"
content-length: 3419
content-type: application/json

GET
DATA 200
OK truncated
/ 579 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a2dfd2555595ba1d05a4ba686c0a31281ee344c5dd92b04325858c79c166c417

Request headers

accept-language: jp-JP,jp;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 4 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: cc1944a3d800b5cbede23e8acdf984598757033c891d54fbfdaab6f0644b4e32

Request headers

accept-language: jp-JP,jp;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Content-Type: image/png

POST
H2 200 collect Show response
www.google-analytics.com/j/ 2 B
146 B 36ms
36ms XHR
text/plain 2404:6800:4004:825::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j98&a=2062498467&t=pageview&_s=1&dl=https%3A%2F%2Fwww.oriswap.xyz%2F&dp=%2F&ul=en-us&de=UTF-8&dt=OriSwap&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAEABAAAAACAAI~&jid=198835319&gjid=421510608&cid=1710721208.1672415715&tid=UA-128182339-4&_gid=1323838123.1672415715&_r=1&_slc=1&z=113654044

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4004:825::200e , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.oriswap.xyz/
accept-language: jp-JP,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 30 Dec 2022 15:55:14 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.oriswap.xyz
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 collect
www.google-analytics.com/ 35 B
194 B 2ms
2ms Image
image/gif 2404:6800:4004:825::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j98&a=2062498467&t=pageview&_s=2&dl=https%3A%2F%2Fwww.oriswap.xyz%2F&dp=%2Fswap&ul=en-us&de=UTF-8&dt=OriSwap&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAEABAAAAACAAI~&jid=&gjid=&cid=1710721208.1672415715&tid=UA-128182339-4&_gid=1323838123.1672415715&z=1181644834

Requested by

Host: www.oriswap.xyz
URL: https://www.oriswap.xyz/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2404:6800:4004:825::200e , Australia, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://www.oriswap.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 30 Dec 2022 09:50:41 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 21873
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H3 200 / Show response
rpc.etherfair.org/ 47 B
512 B 242ms
235ms Fetch
application/json 2606:4700:3031::6815:7f6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://rpc.etherfair.org/
Requested by: Host: www.oriswap.xyz
URL: https://www.oriswap.xyz/static/js/main.d6839e4a.chunk.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::6815:7f6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fccd42bfb30573ea1cdb02c88533c88b4668b21a51ddd5e96bc1c78707b66ab7

Request headers

accept: application/json
Referer: https://www.oriswap.xyz/
accept-language: jp-JP,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
content-type: application/json

Response headers

date: Fri, 30 Dec 2022 15:55:15 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=S4kNsopbjaSWqHItTJoVmyVz8Rkf6PMuK1gX4Af9wdCXh0UhhztletBZBJSfe2gS2%2FSjkLGRTQVwsawp6vEr%2FsHzr0Dtx8NjU8vgIgIE3VLApfOKKGFfsO5b1U4a0uVZ4XYMTf3VAhP4eJupAHSDqw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: *
cf-ray: 781bf56e2fc1f6e5-NRT
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

OPTIONS
H2 200 /
rpc.etherfair.org/ 0
0 821ms
805ms Preflight 2606:4700:3031::6815:7f6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://rpc.etherfair.org/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::6815:7f6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.oriswap.xyz
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

access-control-allow-headers: Content-Type
access-control-allow-methods: POST
access-control-allow-origin: *
access-control-max-age: 600
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 781bf5690e69806f-NRT
date: Fri, 30 Dec 2022 15:55:15 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZvH5AxmJXmoOJdiEv9%2FgW0gr83%2B0eTWneJawf64LbbOf96rG8NLV%2FEXWPTI5sjS0CbkLG7fjSComxM%2BDLQ9LWKkyZSDh3Xnd7gf1zVs3212orHj3KnZntYejDPNCkjQMUDSaQINXaN047mKqTxbzBw%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Origin Access-Control-Request-Method Access-Control-Request-Headers

POST
H3 200 / Show response
rpc.etherfair.org/ 425 B
517 B 180ms
179ms Fetch
application/json 2606:4700:3031::6815:7f6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://rpc.etherfair.org/
Requested by: Host: www.oriswap.xyz
URL: https://www.oriswap.xyz/static/js/main.d6839e4a.chunk.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::6815:7f6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 542d521e83316810ace3d140cb0b1d47b9af37efb02e8d1a84706f80121c021c

Request headers

accept: application/json
Referer: https://www.oriswap.xyz/
accept-language: jp-JP,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
content-type: application/json

Response headers

date: Fri, 30 Dec 2022 15:55:16 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PymH7%2F0%2BCspy7jVDOL9F%2BCaccxyfrgC%2F%2FaLzEB7%2BoZk%2F2ceWLh7DJQFQCwCejhTQDAR3YXFkKMcdgqUEIwkm5hGAYpDcIJv1IsRx1lek2QmZKRKqn%2B%2BDW%2BP8SyLqaTLXT536NcjeGQH4J9ZK7hVtuw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: *
cf-ray: 781bf5721b64f6e5-NRT
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

OPTIONS
H3 200 /
rpc.etherfair.org/ 0
0 215ms
214ms Preflight 2606:4700:3031::6815:7f6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://rpc.etherfair.org/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::6815:7f6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.oriswap.xyz
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

access-control-allow-headers: Content-Type
access-control-allow-methods: POST
access-control-allow-origin: *
access-control-max-age: 600
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 781bf570ba49f6e5-NRT
date: Fri, 30 Dec 2022 15:55:16 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AMbq6MQ%2BYnzrQbOUvPTehK4lBaV9hUmDDBNtnkHrwNvF49ZTOEA3FBV%2F9esTugQ3rOnRuqJtGjV4adYyYALBdJ1SrvCEjsFzJkqD8AkoLBhZQIbvHVR0x4u9y%2BHjdg4mCYDKvV%2F%2F8QPvvW%2Bf%2FEIsvA%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Origin Access-Control-Request-Method Access-Control-Request-Headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Uniswap (Crypto Exchange)

14 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.oriswap.xyz/	1970-01-20 18:09:35	Name: _ga Value: GA1.2.1710721208.1672415715
.oriswap.xyz/	1970-01-20 08:35:02	Name: _gid Value: GA1.2.1323838123.1672415715
.oriswap.xyz/	1970-01-20 08:33:35	Name: _gat Value: 1

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

oriswap.xyz
rpc.etherfair.org
www.google-analytics.com
www.oriswap.xyz
2404:6800:4004:825::200e
2606:4700:3031::6815:7f6
3.115.250.60
35.79.111.165
06757342b3b19c4d1f4717b9b0117ce5fe46ff2a0cd5462b496a603a8970c031
28f9b00d1d2114657198e2419027cf66844d1eac27c60cdbfe0a8f61078a645f
3e279b2da92d621348d1ae31f1c47387c482b1090db31a18ad3e621e415f4bc3
542d521e83316810ace3d140cb0b1d47b9af37efb02e8d1a84706f80121c021c
5af4334086d107018307abdc71b54d7f1d8f3999a64a1739d2067480e476e1cd
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8ae01d48525de9513ec8dc6e8b43ea9d500c071df8d28c01d68780f0a7b958e1
8c02abca64e66308b45718018df19628abf6dced2392138e9265159ee160cf0a
a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f
a2dfd2555595ba1d05a4ba686c0a31281ee344c5dd92b04325858c79c166c417
b42e4a056cb5b80c5a315040826866445ec9332f0749e184509ab2d9d3b86719
c0fa624e0b21db5c3338ca08a3ad5a014d60d47a216997918af50a9554b7311d
cc1944a3d800b5cbede23e8acdf984598757033c891d54fbfdaab6f0644b4e32
ed38b29cfa2fc0d12d0ed4ed265228de9bd4c733d1ce007b54b4655928697420
f6b13c60610c280318ec37215f55f1995b558704a58790c59af7a8c23411b8d0
fccd42bfb30573ea1cdb02c88533c88b4668b21a51ddd5e96bc1c78707b66ab7

www.oriswap.xyz Open in urlscan Pro 3.115.250.60 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

16 Requests

100 %HTTPS

50 %IPv6

3 Domains

4 Subdomains

4 IPs

3 Countries

5185 kBTransfer

5214 kBSize

3 Cookies

3 Outgoing links

Page URL History

Redirected requests

16 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 4 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

14 JavaScript Global Variables

3 Cookies

Indicators

www.oriswap.xyz Open in urlscan Pro
3.115.250.60 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

16
Requests

100 %
HTTPS

50 %
IPv6

3
Domains

4
Subdomains

4
IPs

3
Countries

5185 kB
Transfer

5214 kB
Size

3
Cookies

16 HTTP transactions
4 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!