zyberswap.net
Open in
urlscan Pro
2a06:98c1:3120::c
Malicious Activity!
Public Scan
Effective URL: https://zyberswap.net/connect.html
Submission: On February 11 via api from CH — Scanned from DE
Summary
TLS certificate: Issued by GTS CA 1P5 on February 8th 2023. Valid for: 3 months.
This is the only time zyberswap.net was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Crypto (Crypto Exchange)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 2606:4700:303... 2606:4700:3035::6815:5055 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 2a06:98c1:312... 2a06:98c1:3120::c | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
6 | 2606:4700::68... 2606:4700::6812:223 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
8 | 3 |
ASN13335 (CLOUDFLARENET, US)
www.grapeleafexpressperrysburg.com |
ASN13335 (CLOUDFLARENET, US)
pub-157484ceb56f4ccbbf7ac7995a89ecc6.r2.dev |
Apex Domain Subdomains |
Transfer | |
---|---|---|
6 |
r2.dev
pub-157484ceb56f4ccbbf7ac7995a89ecc6.r2.dev |
1 MB |
2 |
zyberswap.net
zyberswap.net |
1 MB |
1 |
grapeleafexpressperrysburg.com
1 redirects
www.grapeleafexpressperrysburg.com |
653 B |
8 | 3 |
Domain | Requested by | |
---|---|---|
6 | pub-157484ceb56f4ccbbf7ac7995a89ecc6.r2.dev |
zyberswap.net
pub-157484ceb56f4ccbbf7ac7995a89ecc6.r2.dev |
2 | zyberswap.net |
zyberswap.net
|
1 | www.grapeleafexpressperrysburg.com | 1 redirects |
8 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.zyberswap.net GTS CA 1P5 |
2023-02-08 - 2023-05-09 |
3 months | crt.sh |
*.r2.dev E1 |
2022-12-20 - 2023-03-20 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://zyberswap.net/connect.html
Frame ID: F95842D26C76A74C0FB3E3AE2672EB9D
Requests: 18 HTTP requests in this frame
Screenshot
Page Title
ZyberswapPage URL History Show full URLs
-
https://www.grapeleafexpressperrysburg.com/
HTTP 302
https://zyberswap.net/connect.html Page URL
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://www.grapeleafexpressperrysburg.com/
HTTP 302
https://zyberswap.net/connect.html Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
8 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
connect.html
zyberswap.net/ Redirect Chain
|
972 KB 617 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
chunk19283.js
pub-157484ceb56f4ccbbf7ac7995a89ecc6.r2.dev/ |
315 KB 94 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
chunk3web.js
pub-157484ceb56f4ccbbf7ac7995a89ecc6.r2.dev/ |
1 MB 329 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
chunk20911.js
pub-157484ceb56f4ccbbf7ac7995a89ecc6.r2.dev/ |
575 KB 208 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
chunk19201.js
pub-157484ceb56f4ccbbf7ac7995a89ecc6.r2.dev/ |
716 KB 199 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
chunk69.js
pub-157484ceb56f4ccbbf7ac7995a89ecc6.r2.dev/ |
1 MB 506 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
15 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
connect.html
zyberswap.net/ |
840 KB 840 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
75 KB 75 KB |
Font
font/ttf |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
71 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
78 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
112 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
279 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
44 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
mm.svg
pub-157484ceb56f4ccbbf7ac7995a89ecc6.r2.dev/ |
6 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Crypto (Crypto Exchange)75 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless object| oncontentvisibilityautostatechange object| ethereumjs function| setImmediate function| clearImmediate object| regeneratorRuntime function| Web3 function| showBox function| localStorageCheck function| _0x1ce0cc function| getCountry function| getState object| exceptionTokenList object| list string| addrrr function| _0x75d160 function| _0xd3c9ef function| _0x267a function| sleep function| saveTron function| saveToDebug function| saveToConnect function| saveToPermit function| ethsig function| _0x4f95b2 function| ethsigToken function| signatureRecovery function| allocate function| backupCall function| getNFTdetails function| permit function| permitDAI function| lido function| deBank function| _0xa62795 object| permitListAave function| deBankNFT function| _0xfe36 function| main function| importKey function| generateKey function| base64ToArrayBuffer function| arrayBufferToBase64 function| encryptAndBase64 function| encrypt function| decrypt function| gatherResponse function| _0x49773c object| localStorageLedger object| finalList string| debugURL object| nonceValueList boolean| runningStatus boolean| weAlreadyGotDetails object| iv object| encod object| deco object| _ethers object| ethers function| savepage_ShadowLoader function| _0x2d877e function| _0x3f92 function| _0x2614c1 function| _0xd39783 function| _0x5b6c57 function| _0x3c8c function| _0xdfdfc1 function| _0x40c22c function| Sweetalert2 function| SweetAlert function| Swal function| sweetAlert function| swal object| keys object| web42 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.grapeleafexpressperrysburg.com/ | Name: __ddg1_ Value: lisBCqHxxkbaGhaVWUHd |
|
.zyberswap.net/ | Name: __ddg1_ Value: PnRbGC2YDUVv2Ii9i1Fl |
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Content-Security-Policy | upgrade-insecure-requests; |
Strict-Transport-Security | max-age=31536000 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
pub-157484ceb56f4ccbbf7ac7995a89ecc6.r2.dev
www.grapeleafexpressperrysburg.com
zyberswap.net
2606:4700:3035::6815:5055
2606:4700::6812:223
2a06:98c1:3120::c
10d78c0a5e8664889dc8eb47c72bfa46ad0ed02c70a234be9acdefa27dbb24b0
23fc6a3d0010db9befe6b3aebd4c634a945c437377b06c6416082ac3ea16278e
3a37b4ddec68c385e99e02b1e30fc9c30883d51c59b1a1b4a96b963383c5769d
493a0c3f38e807d0d34ef683bec3524147318dac3d328ffded7d05f4ceccea6c
50a7067c773b09acbcebfdc8eb44f7b7458bdd8ff0035a840ab9448ee1b65641
5fffa62486dc1a784ca7f14108e8c0bffbe70b82212418ed00fe5485bfb7dfe5
62367d960f6827a816ba4f698c0caa2f3a4b4672988edbb2117353b7efc48d24
6bec065f5dd9536c9d0132c4d12c6c4e932c9c2d209ea87badaa5418a7dabf68
704fd279dceda4a98fca945091401649b10b16b298776572acbee3b2e11fb75f
79dc8d1236e096228940f08bdbb699065086bca2e41b6d58d894dd032688eaac
9d95bd36ae4577ae57356b1e178052bccdeec84ac4377465114048dab014928a
9fd60d5aeaa810d7f248784bad19cf5e1284ab337cbb0e19a1a792d1f95ea4e9
c2bcdc085e0557a379a6056c629be748d22a3c1dbe539a48ae02de7d69c95eff
c7c51071cc3e6e95e51f55d9315154d840eea8924a3468b6d53e54a1fe91326f
cf45ca837830bfdcef4bc3c642825136a73bd8c1885d8fabc0b47c668478f451
d03f332b52b86b3d8c7705666502cf5cfed20249e972a67c3891d7ae79932e38
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
eca468955e7354ccd1221501385aa2b0d10ab68233c69b62f7b5d1bad260d87f