www.binanceexchange.online Open in urlscan Pro
18.138.206.213  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response www.binanceexchange.online/	59 KB 11 KB	1219ms 208ms	Document text/html	18.138.206.213 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://www.binanceexchange.online/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 18.138.206.213 , Singapore, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-138-206-213.ap-southeast-1.compute.amazonaws.com Software openresty / Resource Hash 951cf09a3e8fea90ff6211dc95872b9cc9364c7718e4d66888f99b514e254b72 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers cache-control no-store, no-cache, must-revalidate, post-check=0, pre-check=0, max-age=0 content-encoding gzip content-type text/html; charset=utf-8 date Mon, 19 Dec 2022 18:35:29 GMT server openresty statuscode 200 vary Accept-Encoding
GET H2	200	css fonts.googleapis.com/	6 KB 1 KB	133ms 52ms	Stylesheet text/css	2a00:1450:400d:804::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Open%20Sans:bold,regular&display=swap Requested by Host: www.binanceexchange.online URL: https://www.binanceexchange.online/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400d:804::200a , Ireland, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 012deec03fbfd6c92c075b502ee777e094cd1a0cedb202a84cde1218b3b60fb4 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.binanceexchange.online/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers strict-transport-security max-age=31536000 date Mon, 19 Dec 2022 18:35:29 GMT content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Mon, 19 Dec 2022 18:35:29 GMT server ESF cross-origin-opener-policy same-origin-allow-popups x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Mon, 19 Dec 2022 18:35:29 GMT
GET H2	200	ladipage.vi.min.js Show response w.ladicdn.com/v2/source/	334 KB 83 KB	289ms 61ms	Script text/javascript	2400:52e0:1e00::863:1 BUNNYCDN
General Check archive.org Show headers Download Go to Full URL https://w.ladicdn.com/v2/source/ladipage.vi.min.js?v=1653875791278 Requested by Host: www.binanceexchange.online URL: https://www.binanceexchange.online/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2400:52e0:1e00::863:1 , Slovenia, ASN200325 (BUNNYCDN, SI), Reverse DNS Software BunnyCDN-DE1-863 / Resource Hash ffc8b977428c9bdedb8f7c2f37e0213d1fed17ed2a233afa3a3f6685c67d2cf1 Request headers accept-language de-DE,de;q=0.9 Referer https://www.binanceexchange.online/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Mon, 19 Dec 2022 18:35:29 GMT content-encoding br cdn-edgestorageid 723 perma-cache HIT cdn-storageserver NY-268 cdn-cachedat 10/04/2022 16:31:46 cdn-pullzone 575124 last-modified Fri, 09 Sep 2022 14:20:01 GMT server BunnyCDN-DE1-863 cdn-fileserver 341 cdn-requestpullcode 200 cdn-proxyver 1.02 etag W/"631b4b91-53940" vary Accept-Encoding, Accept-Encoding content-type text/javascript cdn-cache HIT cdn-uid 595f2f5d-bafe-46b1-9efc-ee9b65944aba cache-control public, max-age=31919000 cdn-requestid b663b5777d7b170a0af55a8fd10ea660 cdn-requestcountrycode RU cdn-status 200 cdn-requestpullsuccess True
GET H2	200	memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2 fonts.gstatic.com/s/opensans/v34/	44 KB 44 KB	116ms 36ms	Font font/woff2	2a00:1450:400d:80e::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/opensans/v34/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Open%20Sans:bold,regular&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400d:80e::2003 , Ireland, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 8778e9af2422858d7052ff9a0f3c12c08ae976bdd6e0316db144cd5579cd97db Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://www.binanceexchange.online accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Mon, 12 Dec 2022 18:50:55 GMT x-content-type-options nosniff age 603874 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 44856 x-xss-protection 0 last-modified Mon, 15 Aug 2022 18:20:18 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Tue, 12 Dec 2023 18:50:55 GMT
GET DATA	200 OK	truncated /	326 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash e0443635c51b8994d84e78c985f1163cd5b13c156d40fdc143530ac55ee78a03 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers Content-Type image/svg+xml
GET H2	200	binance_logo-20220608024854.svg w.ladicdn.com/5e4524d408f1bf0a36147c24/	4 KB 3 KB	213ms 189ms	Image image/svg+xml	2400:52e0:1e00::863:1 BUNNYCDN
General Check archive.org Show headers Download Go to Show image Full URL https://w.ladicdn.com/5e4524d408f1bf0a36147c24/binance_logo-20220608024854.svg Requested by Host: www.binanceexchange.online URL: https://www.binanceexchange.online/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2400:52e0:1e00::863:1 , Slovenia, ASN200325 (BUNNYCDN, SI), Reverse DNS Software BunnyCDN-DE1-863 / Resource Hash 53513e352a3559410d4202a1f0a80a7ac2e5390a34ea4b60dbc4d4a9c31380c8 Request headers accept-language de-DE,de;q=0.9 Referer https://www.binanceexchange.online/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Mon, 19 Dec 2022 18:35:29 GMT content-encoding br cdn-edgestorageid 874 perma-cache HIT cdn-storageserver NY-346 cdn-cachedat 12/19/2022 18:35:29 cdn-pullzone 575124 last-modified Wed, 08 Jun 2022 03:11:04 GMT server BunnyCDN-DE1-863 cdn-fileserver 341 cdn-requestpullcode 200 cdn-proxyver 1.03 etag W/"62a01348-f3b" vary Accept-Encoding content-type image/svg+xml access-control-allow-origin * cdn-cache MISS cdn-uid 595f2f5d-bafe-46b1-9efc-ee9b65944aba access-control-expose-headers Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match cache-control public, max-age=31919000 cdn-requestid d0588a0f57ee8e91add72151872bcec9 cdn-requestcountrycode RU access-control-allow-headers Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match cdn-status 200 cdn-requestpullsuccess True
GET H2	200	ladipage.min.css w.ladicdn.com/v2/source/	66 KB 9 KB	141ms 118ms	Stylesheet text/css	2400:52e0:1e00::863:1 BUNNYCDN
General Check archive.org Show headers Download Go to Full URL https://w.ladicdn.com/v2/source/ladipage.min.css?v=1653875791278 Requested by Host: www.binanceexchange.online URL: https://www.binanceexchange.online/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2400:52e0:1e00::863:1 , Slovenia, ASN200325 (BUNNYCDN, SI), Reverse DNS Software BunnyCDN-DE1-863 / Resource Hash cdf280f70a1b4ee57e3451e5aecb0d56269e5feec54513bed76598df05acabdf Request headers accept-language de-DE,de;q=0.9 Referer https://www.binanceexchange.online/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers date Mon, 19 Dec 2022 18:35:29 GMT content-encoding br cdn-edgestorageid 1049 perma-cache HIT cdn-storageserver NY-426 cdn-cachedat 11/12/2022 05:26:54 cdn-pullzone 575124 last-modified Mon, 30 May 2022 02:01:50 GMT server BunnyCDN-DE1-863 cdn-fileserver 353 cdn-requestpullcode 200 cdn-proxyver 1.03 etag W/"6294258e-1071b" vary Accept-Encoding, Accept-Encoding content-type text/css access-control-allow-origin * cdn-cache HIT cdn-uid 595f2f5d-bafe-46b1-9efc-ee9b65944aba access-control-expose-headers Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match cache-control public, max-age=31919000 cdn-requestid b8a455ed48584be98f042b56eeee188b cdn-requestcountrycode RU access-control-allow-headers Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match cdn-status 200 cdn-requestpullsuccess True
POST H2	200	event Show response a.ladipage.com/	106 B 632 B	210ms 210ms	XHR text/plain	52.76.249.3 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://a.ladipage.com/event Requested by Host: w.ladicdn.com URL: https://w.ladicdn.com/v2/source/ladipage.vi.min.js?v=1653875791278 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.76.249.3 , Singapore, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-76-249-3.ap-southeast-1.compute.amazonaws.com Software / Resource Hash 4fa02c92c32cd79f96f6032cd26baa89f69748297451280bde4851c486b4c843 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers LADI_CLIENT_ID 61734cb9-406a-4329-5d01-30496e1af35c LADI_CAMP_ORIGIN_URL LADI_FORM_SUBMIT 0 LADI_CAMP_ID LADI_CAMP_FORM_SUBMIT 0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 LADI_CAMP_NAME Content-Type application/json accept-language de-DE,de;q=0.9 LADI_CAMP_TARGET_URL LADI_CAMP_PAGE_VIEW 0 Referer https://www.binanceexchange.online/ LADI_PAGE_VIEW 1 LADI_CAMP_TYPE Response headers date Mon, 19 Dec 2022 18:35:30 GMT x-content-type-options nosniff x-download-options noopen x-frame-options SAMEORIGIN access-control-allow-methods POST, OPTIONS content-type text/plain; charset=utf-8 access-control-allow-origin * access-control-max-age 2592000 access-control-allow-headers Origin, X-Requested-With, Content-Type, Accept, Authorization, Accept-Encoding, ladi_camp_form_submit, ladi_camp_form_submit_daily, ladi_camp_id, ladi_camp_name, ladi_camp_origin_url, ladi_camp_page_view, ladi_camp_page_view_daily, ladi_camp_target_url, ladi_camp_type, ladi_client_id, ladi_form_submit, ladi_form_submit_daily, ladi_page_view, ladi_page_view_daily x-xss-protection 0
OPTIONS H2	200	event a.ladipage.com/	0 0	641ms 209ms	Preflight application/json	52.76.249.3 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://a.ladipage.com/event Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.76.249.3 , Singapore, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-76-249-3.ap-southeast-1.compute.amazonaws.com Software / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Accept */* Access-Control-Request-Headers content-type,ladi_camp_form_submit,ladi_camp_id,ladi_camp_name,ladi_camp_origin_url,ladi_camp_page_view,ladi_camp_target_url,ladi_camp_type,ladi_client_id,ladi_form_submit,ladi_page_view Access-Control-Request-Method POST Origin https://www.binanceexchange.online Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36 Response headers access-control-allow-headers Origin, X-Requested-With, Content-Type, Accept, Authorization, Accept-Encoding, ladi_camp_form_submit, ladi_camp_form_submit_daily, ladi_camp_id, ladi_camp_name, ladi_camp_origin_url, ladi_camp_page_view, ladi_camp_page_view_daily, ladi_camp_target_url, ladi_camp_type, ladi_client_id, ladi_form_submit, ladi_form_submit_daily, ladi_page_view, ladi_page_view_daily access-control-allow-methods POST, OPTIONS access-control-allow-origin * access-control-max-age 2592000 content-encoding gzip content-type application/json; charset=utf-8 date Mon, 19 Dec 2022 18:35:30 GMT vary Accept-Encoding x-content-type-options nosniff x-download-options noopen x-frame-options SAMEORIGIN x-xss-protection 0

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Binance (Crypto Exchange)

18 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontentvisibilityautostatechange function| ladi_viewport boolean| ladi_is_desktop function| ladi_fbq function| LadiPageScriptV2 object| Base64 object| LadiPageScript object| LadiFormApi function| parseFloatLadiPage function| decodeURIComponentLadiPage function| lightbox_run function| lightbox_iframe function| lightbox_image function| lightbox_video function| LadiPageLibraryV2 function| LadiPageAppV2 function| ladi object| LadiPageApp

5 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.binanceexchange.online/	1970-01-20 17:53:54	Name: LADI_DNS_CHECK Value: "2022-12-19 18:35:29.338521614 +0000 UTC m=+4102119.220189024"
			www.binanceexchange.online/	1970-01-20 17:53:54	Name: LADI_CLIENT_ID Value: 61734cb9-406a-4329-5d01-30496e1af35c
			www.binanceexchange.online/	1970-01-20 17:53:54	Name: LADI_FORM_SUBMIT Value: 0
			www.binanceexchange.online/	1970-01-20 17:53:54	Name: LADI_PAGE_VIEW Value: 1
			www.binanceexchange.online/	1970-01-20 08:19:21	Name: _timenow Value: 1671474929808

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.ladipage.com
fonts.googleapis.com
fonts.gstatic.com
w.ladicdn.com
www.binanceexchange.online
18.138.206.213
2400:52e0:1e00::863:1
2a00:1450:400d:804::200a
2a00:1450:400d:80e::2003
52.76.249.3
012deec03fbfd6c92c075b502ee777e094cd1a0cedb202a84cde1218b3b60fb4
4fa02c92c32cd79f96f6032cd26baa89f69748297451280bde4851c486b4c843
53513e352a3559410d4202a1f0a80a7ac2e5390a34ea4b60dbc4d4a9c31380c8
8778e9af2422858d7052ff9a0f3c12c08ae976bdd6e0316db144cd5579cd97db
951cf09a3e8fea90ff6211dc95872b9cc9364c7718e4d66888f99b514e254b72
cdf280f70a1b4ee57e3451e5aecb0d56269e5feec54513bed76598df05acabdf
e0443635c51b8994d84e78c985f1163cd5b13c156d40fdc143530ac55ee78a03
ffc8b977428c9bdedb8f7c2f37e0213d1fed17ed2a233afa3a3f6685c67d2cf1