x-coinbase.info
Open in
urlscan Pro
2606:4700:3032::6815:113f
Malicious Activity!
Public Scan
Effective URL: https://x-coinbase.info/login.php
Submission: On March 20 via automatic, source certstream-suspicious — Scanned from DE
Summary
TLS certificate: Issued by GTS CA 1P5 on March 20th 2023. Valid for: 3 months.
This is the only time x-coinbase.info was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Coinbase (Crypto Exchange)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 3 | 2606:4700:303... 2606:4700:3032::6815:113f | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 2 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
3 |
x-coinbase.info
1 redirects
x-coinbase.info |
523 KB |
2 | 1 |
Domain | Requested by | |
---|---|---|
3 | x-coinbase.info |
1 redirects
x-coinbase.info
|
2 | 1 |
This site contains links to these domains. Also see Links.
Domain |
---|
accounts.coinbase.com |
coinbase.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.x-coinbase.info GTS CA 1P5 |
2023-03-20 - 2023-06-18 |
3 months | crt.sh |
This page contains 2 frames:
Primary Page:
https://x-coinbase.info/login.php
Frame ID: 92DD455F992DA4CFA2006C719767392B
Requests: 6 HTTP requests in this frame
Frame:
data://truncated
Frame ID: F3D48BF6157C5EBD79200D35CD590450
Requests: 3 HTTP requests in this frame
Screenshot
Page Title
Coinbase - Sign InCoinbase logoPage URL History Show full URLs
-
https://x-coinbase.info/
HTTP 302
https://x-coinbase.info/login.php Page URL
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- \.php(?:$|\?)
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
3 Outgoing links
These are links going to different origins than the main page.
Title: Sign in to a business account
Search URL Search Domain Scan URL
Title: Privacy policy
Search URL Search Domain Scan URL
Title: Cookie Policy
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://x-coinbase.info/
HTTP 302
https://x-coinbase.info/login.php Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
2 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
login.php
x-coinbase.info/ Redirect Chain
|
620 KB 443 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
39 KB 39 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
38 KB 38 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
39 KB 39 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
40 KB 40 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
jquery.js
x-coinbase.info/core/js/ |
266 KB 79 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame F3D4 |
2 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame F3D4 |
15 KB 15 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame F3D4 |
15 KB 15 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Coinbase (Crypto Exchange)5 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| 1 boolean| credentialless function| $ function| jQuery1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
x-coinbase.info/ | Name: PHPSESSID Value: k095b1lc81u8q9h95tcm4d63tv |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
x-coinbase.info
2606:4700:3032::6815:113f
1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7
5db56ddf9ab991fc7a3a5b188b6b0c92331213ec4991b71d9821c36dcbcdb687
81368223143520415fe7fbdc3792d2d52ad7e422d8b214661ff932afe577b779
84086bb634fc6fd223918894c6b74641811e06e84007937c5809942b7a02ddff
8b3cc7c9b14f39432c27783181966b6ded36b65a1ea5ffd80a8335bb5395c47b
a1f75e7f702059493bb74cfcb3178d095b3f6da4d313e92b3ceabc3e63eb914c
b2943cf448795751c6a309662c5237904fcb74e31507271deb64437350274b8d