curve-monitor.pages.dev
Open in
urlscan Pro
172.66.47.109
Malicious Activity!
Public Scan
Effective URL: https://curve-monitor.pages.dev/
Submission Tags: threatview.io malwar3ninja rule: suspected phishing scam automated-submission Search All
Submission: On September 23 via api from DE — Scanned from DE
Summary
TLS certificate: Issued by WE1 on August 29th 2024. Valid for: 3 months.
This is the only time curve-monitor.pages.dev was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Cloudflare (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 16 | 172.66.47.109 172.66.47.109 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a00:1450:400... 2a00:1450:4001:829::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 2606:4700:440... 2606:4700:4400::6812:2844 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
3 | 2606:4700::68... 2606:4700::6810:5049 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
4 | 172.67.139.119 172.67.139.119 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
3 | 188.114.97.3 188.114.97.3 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 2606:4700:10:... 2606:4700:10::6816:3646 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 216.58.206.35 216.58.206.35 | 15169 (GOOGLE) (GOOGLE) | |
31 | 9 |
ASN13335 (CLOUDFLARENET, US)
static.cloudflareinsights.com | |
cloudflareinsights.com |
ASN15169 (GOOGLE, US)
PTR: lcfraa-aa-in-f3.1e100.net
fonts.gstatic.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
16 |
pages.dev
1 redirects
curve-monitor.pages.dev |
1 MB |
5 |
fontawesome.com
kit.fontawesome.com — Cisco Umbrella Rank: 1930 ka-f.fontawesome.com — Cisco Umbrella Rank: 5895 |
176 KB |
3 |
curve.fi
prices.curve.fi |
2 KB |
3 |
cloudflareinsights.com
static.cloudflareinsights.com — Cisco Umbrella Rank: 685 cloudflareinsights.com — Cisco Umbrella Rank: 665 |
7 KB |
2 |
llama.fi
coins.llama.fi — Cisco Umbrella Rank: 587088 |
423 B |
1 |
gstatic.com
fonts.gstatic.com |
38 KB |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 32 |
1 KB |
31 | 7 |
Domain | Requested by | |
---|---|---|
16 | curve-monitor.pages.dev |
1 redirects
curve-monitor.pages.dev
|
4 | ka-f.fontawesome.com |
kit.fontawesome.com
curve-monitor.pages.dev |
3 | prices.curve.fi |
curve-monitor.pages.dev
|
2 | cloudflareinsights.com |
static.cloudflareinsights.com
|
2 | coins.llama.fi |
curve-monitor.pages.dev
|
1 | fonts.gstatic.com |
fonts.googleapis.com
|
1 | static.cloudflareinsights.com |
curve-monitor.pages.dev
|
1 | kit.fontawesome.com |
curve-monitor.pages.dev
|
1 | fonts.googleapis.com |
curve-monitor.pages.dev
|
31 | 9 |
This site contains links to these domains. Also see Links.
Domain |
---|
blog.curvemonitor.com |
twitter.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
curve-monitor.pages.dev WE1 |
2024-08-29 - 2024-11-27 |
3 months | crt.sh |
upload.video.google.com WR2 |
2024-08-26 - 2024-11-18 |
3 months | crt.sh |
*.fontawesome.com DigiCert Global G2 TLS RSA SHA256 2020 CA1 |
2024-07-30 - 2025-01-27 |
6 months | crt.sh |
cloudflareinsights.com WE1 |
2024-09-03 - 2024-12-02 |
3 months | crt.sh |
ka-f.fontawesome.com WE1 |
2024-08-29 - 2024-11-27 |
3 months | crt.sh |
curve.fi WE1 |
2024-08-27 - 2024-11-25 |
3 months | crt.sh |
coins.llama.fi WE1 |
2024-08-26 - 2024-11-24 |
3 months | crt.sh |
*.gstatic.com WR2 |
2024-08-26 - 2024-11-18 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://curve-monitor.pages.dev/
Frame ID: 662924DA55F3E3DC5E900292E8D3073F
Requests: 27 HTTP requests in this frame
Screenshot
Page Title
Curve MonitorPage URL History Show full URLs
-
http://curve-monitor.pages.dev/
HTTP 307
https://curve-monitor.pages.dev/ Page URL
-
https://curve-monitor.pages.dev/cdn-cgi/phish-bypass?atok=aSDMOM5lP_wuVWs2kmmGZmYV_OvdKMau_3nY0Gug6P0-172705...
HTTP 301
https://curve-monitor.pages.dev/ Page URL
Detected technologies
Cloudflare Browser Insights (Analytics) ExpandDetected patterns
- static\.cloudflareinsights\.com/beacon(?:\.min)?\.js
Font Awesome (Font Scripts) Expand
Detected patterns
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- kit\.fontawesome\.com/([0-9a-z]+).js
Google Font API (Font Scripts) Expand
Detected patterns
- <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
Page Statistics
6 Outgoing links
These are links going to different origins than the main page.
Title: Articles
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Title: Read now
Search URL Search Domain Scan URL
Title: Read now
Search URL Search Domain Scan URL
Title: Read now
Search URL Search Domain Scan URL
Title: Read now
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://curve-monitor.pages.dev/
HTTP 307
https://curve-monitor.pages.dev/ Page URL
-
https://curve-monitor.pages.dev/cdn-cgi/phish-bypass?atok=aSDMOM5lP_wuVWs2kmmGZmYV_OvdKMau_3nY0Gug6P0-1727057534-0.0.1.1-%2F
HTTP 301
https://curve-monitor.pages.dev/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://curve-monitor.pages.dev/ HTTP 307
- https://curve-monitor.pages.dev/
31 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H3 |
/
curve-monitor.pages.dev/ Redirect Chain
|
4 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
speculation
curve-monitor.pages.dev/cdn-cgi/ |
128 B 554 B |
Other
application/speculationrules+json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
cf.errors.css
curve-monitor.pages.dev/cdn-cgi/styles/ |
23 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
icon-exclamation.png
curve-monitor.pages.dev/cdn-cgi/images/ |
452 B 634 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
favicon.ico
curve-monitor.pages.dev/ |
2 KB 1 KB |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
Primary Request
/
curve-monitor.pages.dev/ Redirect Chain
|
2 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
speculation
curve-monitor.pages.dev/cdn-cgi/ |
128 B 569 B |
Other
application/speculationrules+json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css2
fonts.googleapis.com/ |
4 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
f9fbdb64c0.js
kit.fontawesome.com/ |
13 KB 5 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
index-luCFVxDo.js
curve-monitor.pages.dev/assets/ |
249 KB 72 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
vendor-C8bzYiiU.js
curve-monitor.pages.dev/assets/ |
558 KB 188 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
index-CC2lMwfn.css
curve-monitor.pages.dev/assets/ |
74 KB 15 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
beacon.min.js
static.cloudflareinsights.com/ |
19 KB 7 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
free.min.css
ka-f.fontawesome.com/releases/v5.15.4/css/ |
59 KB 13 KB |
Fetch
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
free-v4-shims.min.css
ka-f.fontawesome.com/releases/v5.15.4/css/ |
26 KB 5 KB |
Fetch
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H3 |
ethereum
prices.curve.fi/v1/crvusd/markets/ |
0 0 |
Preflight
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H3 |
ethereum
prices.curve.fi/v1/chains/ |
0 0 |
Preflight
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H2 |
ethereum:0xd533a949740bb3306d119cc777fa900ba034cd52
coins.llama.fi/prices/current/ |
0 0 |
Preflight
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
XRXV3I6Li01BKofINeaB.woff2
fonts.gstatic.com/s/nunito/v26/ |
38 KB 38 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
crv-CKEIQw2g.png
curve-monitor.pages.dev/assets/ |
50 KB 50 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
hat-D1qfnSjv.png
curve-monitor.pages.dev/assets/ |
5 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
ethereum
prices.curve.fi/v1/crvusd/markets/ |
4 KB 2 KB |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
ethereum
prices.curve.fi/v1/chains/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ethereum:0xd533a949740bb3306d119cc777fa900ba034cd52
coins.llama.fi/prices/current/ |
154 B 423 B |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
llama-cloud-transparant-BquaG1Iu.png
curve-monitor.pages.dev/assets/ |
912 KB 913 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
telegram-DU4d4zRw.webp
curve-monitor.pages.dev/assets/ |
40 KB 41 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
free-fa-solid-900.woff2
ka-f.fontawesome.com/releases/v5.15.4/webfonts/ |
76 KB 77 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
free-fa-brands-400.woff2
ka-f.fontawesome.com/releases/v5.15.4/webfonts/ |
75 KB 76 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
rum
cloudflareinsights.com/cdn-cgi/ |
0 37 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H2 |
rum
cloudflareinsights.com/cdn-cgi/ |
0 0 |
Preflight
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
favicon.png
curve-monitor.pages.dev/ |
743 B 1 KB |
Other
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- prices.curve.fi
- URL
- https://prices.curve.fi/v1/chains/ethereum?page=1&per_page=1
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Cloudflare (Online)6 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| FontAwesomeKitConfig object| __VUE_INSTANCE_SETTERS__ object| __VUE_SSR_SETTERS__ object| __vueuse_ssr_handlers__ boolean| __VUE__ object| __cfBeacon1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.curve-monitor.pages.dev/ | Name: __cf_mw_byp Value: aSDMOM5lP_wuVWs2kmmGZmYV_OvdKMau_3nY0Gug6P0-1727057534-0.0.1.1-/ |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Frame-Options | SAMEORIGIN |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cloudflareinsights.com
coins.llama.fi
curve-monitor.pages.dev
fonts.googleapis.com
fonts.gstatic.com
ka-f.fontawesome.com
kit.fontawesome.com
prices.curve.fi
static.cloudflareinsights.com
prices.curve.fi
172.66.47.109
172.67.139.119
188.114.97.3
216.58.206.35
2606:4700:10::6816:3646
2606:4700:4400::6812:2844
2606:4700::6810:5049
2a00:1450:4001:829::200a
11a2142988720cd49ff000e5d488493947b3d34821301c5a706b3495b8381f7d
1a48b70f97555c13f84b8f088a417f9179d99b5101250819350acaf6e91bb92f
2d1a1a428dbfd37ba5635fcdf98da4605675ec3aa2437ac539e3941876b93196
5a921997ada972f4f98a648244a6a7a7cdb31c652f6085c9db4eec9050ab09ef
5f3ac888f29c6d2d8fa2074ffc5c31fdfe4f2e55a437b9d201b66deaea48aa30
674bc3718616f71de3e244b4497ef80bdf3b1e738072b71da909f31e3f0f69bc
680e080062b3223b0698ea54a7613729f67efcb747f6b62165e57d6dedf5356e
6dea47458a4cd7cd7312cc780a53c62e0c8b3ccc8d0b13c1ac0ea6e3dfcecea8
71ebf9331e91e1a7219b5571db406e94d07d1a09508fb2cc308f6873bc4a9361
7c8df99948ed7a06b1193f5080473b3146c82bb9611fadf096367754ac7f4a44
80c6c9b19ba175738faaf96165a2e4fc742f28f924557507a321db97cd0a69db
84e3c77025ace5af143972b4a40fc834dcdfd4e449d4b36a57e62326f16b3091
8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f
a88a09764a67762788d3985d440c23ef3419818889d33d419406a7c0184d6b43
b5be0732ab1cc16692e165a7950810f0c772e400f6a2f63e1026a0b938016813
c5dd43f53f3af822cbf17b1fb75f46192cdbd51724f277acf6cf0dacb3fd57e7
ca6314ed833752187b90db8c86012798298e8e97bdffe1ac3ff22e93dcad3e4d
d6d5ab58601854152953eadf4d13b75b52fb3f866f92e1c4c9f9b82f8d6fd076
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e9e88a1f622169517ab43071b80ca0108d9f19865865cf50ae974eb8c3a9593d
f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016
f337996857c297f0b9a9c866e36f41b3c5a169e1ec4a42e711a4edd9f39e0d78
f984b6069627949659f1bb71957fb5df056c54c50cdf842c64e217a8b5d3e839
fc5128dfdcdfa0c3a9967a6d2f19399d7bf1aaae6ad7571b96b03915a1f30dda