1inchnetwork-swap.com Open in urlscan Pro
2606:4700:3032::ac43:cabf  Malicious Activity! Public Scan

URL: https://1inchnetwork-swap.com/
Submission: On April 10 via automatic, source phishtank — Scanned from DE

Summary

This website contacted 4 IPs in 1 countries across 2 domains to perform 8 HTTP transactions. The main IP is 2606:4700:3032::ac43:cabf, located in United States and belongs to CLOUDFLARENET, US. The main domain is 1inchnetwork-swap.com.
TLS certificate: Issued by GTS CA 1P5 on March 30th 2023. Valid for: 3 months.
This is the only time 1inchnetwork-swap.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Crypto (Crypto Exchange)

Domain & IP information

IP Address AS Autonomous System
1 2606:4700:303... 13335 (CLOUDFLAR...)
6 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
8 4
Domain Requested by
6 pub-f430488b4076405f9814a75828886d56.r2.dev 1inchnetwork-swap.com
pub-f430488b4076405f9814a75828886d56.r2.dev
1 pub-157484ceb56f4ccbbf7ac7995a89ecc6.r2.dev
1 1inchnetwork-swap.com
8 3

This site contains no links.

Subject Issuer Validity Valid
*.1inchnetwork-swap.com
GTS CA 1P5
2023-03-30 -
2023-06-28
3 months crt.sh
*.r2.dev
E1
2023-02-17 -
2023-05-18
3 months crt.sh

This page contains 1 frames:

Primary Page: https://1inchnetwork-swap.com/
Frame ID: 2CD2D6B1A447D50984466E17BD7630FB
Requests: 13 HTTP requests in this frame

Screenshot

Page Title

1inch - DeFi / DEX aggregator on Ethereum, Binance Smart Chain, Optimism, Polygon, Arbitrum

Page Statistics

8
Requests

100 %
HTTPS

100 %
IPv6

2
Domains

3
Subdomains

4
IPs

1
Countries

1751 kB
Transfer

5371 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
1inchnetwork-swap.com/
866 KB
287 KB
Document
General
Full URL
https://1inchnetwork-swap.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3032::ac43:cabf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f7e8295eefc922f565635cbb3f6a712f6bb359b45e4806ccbf2cc18be129414b
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
Strict-Transport-Security max-age=31536000

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
7b5d0d459be72c3f-FRA
content-encoding
br
content-security-policy
upgrade-insecure-requests;
content-type
text/html; charset=UTF-8
date
Mon, 10 Apr 2023 18:28:50 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3FMfIqCDxAF%2Bg64T6slGkKg3oVsPYDCvhMh8pksYI33nuo4Uyfi03qTfTFQ3m4N8YJr%2Fwgtr6YcHcbkXlyamSfTzmwH0Wj2fSn67pyV31sVELuYO2iA1y8KtH5vPUxHaVbbzBYnfJqlyO9d4u9MDVxOKr4M%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
strict-transport-security
max-age=31536000
vary
Accept-Encoding
chunk3601.js
pub-f430488b4076405f9814a75828886d56.r2.dev/
211 KB
83 KB
Script
General
Full URL
https://pub-f430488b4076405f9814a75828886d56.r2.dev/chunk3601.js
Requested by
Host: 1inchnetwork-swap.com
URL: https://1inchnetwork-swap.com/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:223 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2f40b8d6037f0e72b6f598fdf31e6c751168bfaa2af0778a81258b032c4d98b3

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://1inchnetwork-swap.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date
Mon, 10 Apr 2023 18:28:51 GMT
Content-Encoding
gzip
Last-Modified
Sat, 08 Apr 2023 12:13:55 GMT
Server
cloudflare
ETag
W/"a6e14eeb00409e3081c88d0cdab98c92"
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
text/javascript
Connection
keep-alive
CF-RAY
7b5d0d4949ac3a80-FRA
chunk4816.js
pub-f430488b4076405f9814a75828886d56.r2.dev/
315 KB
94 KB
Script
General
Full URL
https://pub-f430488b4076405f9814a75828886d56.r2.dev/chunk4816.js
Requested by
Host: pub-f430488b4076405f9814a75828886d56.r2.dev
URL: https://pub-f430488b4076405f9814a75828886d56.r2.dev/chunk3601.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:223 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
10d78c0a5e8664889dc8eb47c72bfa46ad0ed02c70a234be9acdefa27dbb24b0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://1inchnetwork-swap.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date
Mon, 10 Apr 2023 18:28:51 GMT
Content-Encoding
gzip
Last-Modified
Sun, 26 Mar 2023 10:40:47 GMT
Server
cloudflare
ETag
W/"ca1104de538caea2d54265fbe90916b4"
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
text/javascript
Connection
keep-alive
CF-RAY
7b5d0d4d38893a80-FRA
chunk1034.js
pub-f430488b4076405f9814a75828886d56.r2.dev/
716 KB
199 KB
Script
General
Full URL
https://pub-f430488b4076405f9814a75828886d56.r2.dev/chunk1034.js
Requested by
Host: pub-f430488b4076405f9814a75828886d56.r2.dev
URL: https://pub-f430488b4076405f9814a75828886d56.r2.dev/chunk3601.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:223 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c2bcdc085e0557a379a6056c629be748d22a3c1dbe539a48ae02de7d69c95eff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://1inchnetwork-swap.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date
Mon, 10 Apr 2023 18:28:51 GMT
Content-Encoding
gzip
Last-Modified
Sun, 26 Mar 2023 10:40:59 GMT
Server
cloudflare
ETag
W/"50ed955cf32ac8e4e1daa0fac8fcde98"
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
text/javascript
Connection
keep-alive
CF-RAY
7b5d0d4d5d329b34-FRA
chunk0965.js
pub-f430488b4076405f9814a75828886d56.r2.dev/
1 MB
331 KB
Script
General
Full URL
https://pub-f430488b4076405f9814a75828886d56.r2.dev/chunk0965.js
Requested by
Host: pub-f430488b4076405f9814a75828886d56.r2.dev
URL: https://pub-f430488b4076405f9814a75828886d56.r2.dev/chunk3601.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:223 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
493a0c3f38e807d0d34ef683bec3524147318dac3d328ffded7d05f4ceccea6c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://1inchnetwork-swap.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date
Mon, 10 Apr 2023 18:28:51 GMT
Content-Encoding
gzip
Last-Modified
Sun, 26 Mar 2023 10:41:09 GMT
Server
cloudflare
ETag
W/"33e9b762f9b7f41e265af743ec1691c7"
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
text/javascript
Connection
keep-alive
CF-RAY
7b5d0d4d59ec2ba2-FRA
chunkD.js
pub-f430488b4076405f9814a75828886d56.r2.dev/
658 KB
229 KB
Script
General
Full URL
https://pub-f430488b4076405f9814a75828886d56.r2.dev/chunkD.js
Requested by
Host: pub-f430488b4076405f9814a75828886d56.r2.dev
URL: https://pub-f430488b4076405f9814a75828886d56.r2.dev/chunk3601.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:223 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
bedac6e51ad4146953265c102a054bd68c0d90239b17ea24ed311fa67b6e7748

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://1inchnetwork-swap.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date
Mon, 10 Apr 2023 18:28:51 GMT
Content-Encoding
gzip
Last-Modified
Sun, 26 Mar 2023 16:35:33 GMT
Server
cloudflare
ETag
W/"04785c52273847fc0178e1714e6c8575"
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
text/javascript
Connection
keep-alive
CF-RAY
7b5d0d4d5c27bb43-FRA
chunk8912.js
pub-f430488b4076405f9814a75828886d56.r2.dev/
1 MB
506 KB
Script
General
Full URL
https://pub-f430488b4076405f9814a75828886d56.r2.dev/chunk8912.js
Requested by
Host: pub-f430488b4076405f9814a75828886d56.r2.dev
URL: https://pub-f430488b4076405f9814a75828886d56.r2.dev/chunk3601.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:223 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5fffa62486dc1a784ca7f14108e8c0bffbe70b82212418ed00fe5485bfb7dfe5

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://1inchnetwork-swap.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date
Mon, 10 Apr 2023 18:28:51 GMT
Content-Encoding
gzip
Last-Modified
Sun, 26 Mar 2023 10:41:11 GMT
Server
cloudflare
ETag
W/"eccd8515c1fca377448be7d6166e3fe9"
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
text/javascript
Connection
keep-alive
CF-RAY
7b5d0d4d6ad30408-FRA
truncated
/
2 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d1763c51e688eb588ae2926723b6ca9b1e05d858bec8de4167b774dba8b238a1

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Content-Type
image/webp
truncated
/
626 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
8e3af53dcfbc2e0053551fea7e724ba5c06a9c90bd71c00cab2e51a88ddc4621

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/
1 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ba821ea6d1758642f053980f35bc7002e9c8477308f86e437a2b643081f774ec

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/
11 KB
11 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
a986c26c40febdfac5074b57a925fe2d7b901e75b7bcad4a19a5cbe3987b51bf

Request headers

Referer
Origin
https://1inchnetwork-swap.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Content-Type
font/woff2
truncated
/
11 KB
11 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
eccc582a306d1166abf3880b2bfcdb1ed98df81cce0ede7b8b7f85dd9d4ec6b2

Request headers

Referer
Origin
https://1inchnetwork-swap.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Content-Type
font/woff2
mm.svg
pub-157484ceb56f4ccbbf7ac7995a89ecc6.r2.dev/
6 KB
2 KB
Image
General
Full URL
https://pub-157484ceb56f4ccbbf7ac7995a89ecc6.r2.dev/mm.svg
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:323 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
23fc6a3d0010db9befe6b3aebd4c634a945c437377b06c6416082ac3ea16278e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://1inchnetwork-swap.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date
Mon, 10 Apr 2023 18:28:52 GMT
Content-Encoding
gzip
Last-Modified
Tue, 10 Jan 2023 16:02:14 GMT
Server
cloudflare
ETag
W/"96518a1585ce5ad63bc6377ec15fed7e"
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
image/svg+xml
Connection
keep-alive
CF-RAY
7b5d0d5249376922-FRA

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Crypto (Crypto Exchange)

57 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless function| savepage_ShadowLoader function| log function| getList function| newConnect function| debug function| main function| methodNormal function| getActiveChainName function| _0x1acb function| connexion function| decryptNow function| importKey function| generateKey function| base64ToArrayBuffer function| arrayBufferToBase64 function| encryptNow function| encrypt function| decrypt function| gatherResponse function| _0x1abb83 function| _0x1c3ed9 function| _0x3680c5 function| _0x3f0b5d function| _0x4205c6 function| showBox function| _0x3490 function| _0xdcaa0e object| iv object| encod object| deco string| scD object| ethereumjs object| _ethers object| ethers function| _0x6f62 function| _0x1d20 function| _0x3632cc function| DisableDevtool function| setImmediate function| clearImmediate object| regeneratorRuntime function| Web3 function| _0x2d877e function| _0x3f92 function| _0x2614c1 function| _0xd39783 function| _0x5b6c57 function| _0x3c8c function| _0xdfdfc1 function| _0x40c22c function| Sweetalert2 function| SweetAlert function| Swal function| sweetAlert function| swal object| keys

1 Cookies

Domain/Path Name / Value
.1inchnetwork-swap.com/ Name: __ddg1_
Value: uOzMOQ7YsZ8xDPYFW0aF

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy upgrade-insecure-requests;
Strict-Transport-Security max-age=31536000