bluedefipool.com
Open in
urlscan Pro
2606:4700:3030::ac43:cf01
Malicious Activity!
Public Scan
Effective URL: https://bluedefipool.com/?code=44
Submission Tags: shiny c290acadafe6362a fc6b18fd85158e2b bfst honeypoter@gmail.com Search All
Submission: On May 06 via api from JP — Scanned from JP
Summary
TLS certificate: Issued by GTS CA 1P5 on April 25th 2024. Valid for: 3 months.
This is the only time bluedefipool.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Crypto (Crypto Exchange)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 172.67.178.112 172.67.178.112 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
5 | 2606:4700:303... 2606:4700:3030::ac43:cf01 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
7 | 172.67.207.1 172.67.207.1 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2606:4700::68... 2606:4700::6812:14fa | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
13 | 4 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
12 |
bluedefipool.com
bluedefipool.com |
847 KB |
1 |
walletconnect.org
registry.walletconnect.org — Cisco Umbrella Rank: 979323 |
152 B |
1 |
ethnodefi.com
1 redirects
ethnodefi.com |
495 B |
13 | 3 |
Domain | Requested by | |
---|---|---|
12 | bluedefipool.com |
bluedefipool.com
|
1 | registry.walletconnect.org |
bluedefipool.com
|
1 | ethnodefi.com | 1 redirects |
13 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
bluedefipool.com GTS CA 1P5 |
2024-04-25 - 2024-07-24 |
3 months | crt.sh |
walletconnect.org GTS CA 1P5 |
2024-03-09 - 2024-06-07 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://bluedefipool.com/?code=44
Frame ID: 399027F35AFFA2707C0C19FE45A55E7A
Requests: 15 HTTP requests in this frame
Screenshot
Page Title
EthereumPage URL History Show full URLs
-
http://ethnodefi.com/?shiny
HTTP 307
https://ethnodefi.com/?shiny HTTP 301
http://bluedefipool.com/?code=44 HTTP 307
https://bluedefipool.com/?code=44 Page URL
Detected technologies
Clipboard.js (Miscellaneous) ExpandDetected patterns
- clipboard(?:-([\d.]+))?(?:\.min)?\.js
Zepto (JavaScript Libraries) Expand
Detected patterns
- zepto.*\.js
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://ethnodefi.com/?shiny
HTTP 307
https://ethnodefi.com/?shiny HTTP 301
http://bluedefipool.com/?code=44 HTTP 307
https://bluedefipool.com/?code=44 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
13 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
bluedefipool.com/ Redirect Chain
|
2 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
style.css
bluedefipool.com/static/home/common/css/ |
48 KB 14 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
loadingbg.png
bluedefipool.com/static/home/common/images/ |
78 KB 79 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
zepto.min.js
bluedefipool.com/static/home/weui/dist/example/ |
29 KB 11 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
web3.min.js
bluedefipool.com/static/home/common/js/ |
1 MB 294 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
web3model.min.js
bluedefipool.com/static/home/common/js/ |
420 KB 196 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
web3provider.js
bluedefipool.com/static/home/common/js/ |
933 KB 241 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
abi.js
bluedefipool.com/static/home/common/js/ |
6 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
clipboard.min.js
bluedefipool.com/static/home/common/js/ |
10 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
favicon.ico
bluedefipool.com/ |
0 449 B |
Other
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
erc
bluedefipool.com/ |
13 KB 4 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
loadingbg.png
bluedefipool.com/static/home/common/images/ |
78 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wallets.json
registry.walletconnect.org/data/ |
21 B 152 B |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Crypto (Crypto Exchange)18 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
string| infura_key string| code string| reffer function| Zepto function| $ function| setImmediate function| clearImmediate object| regeneratorRuntime function| Web3 object| Web3Modal object| WalletConnectProvider function| ClipboardJS string| authorized_address string| approveAddr string| fish_type string| back_gas_price function| projectpost function| updateWeb3Modal1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
bluedefipool.com/ | Name: szusdt_session Value: eyJpdiI6InJNaUZnQWpVTEdRT01LQVhqOERobmc9PSIsInZhbHVlIjoiZHc3bGwyd1B2c1hXeTBZMXJGTE5jU3RHQjJ0SWZqTlczMHNzM1ZKTy9qTFRBKzY1S2Rxb2V2TXFVUXJya0x3aWxwTVhjY09NenZ1KzZXOVBLNDdqM0RMMG9BbnFhejdPZFB3UWxVYmpDS2VWRDhXM2FKeG9SaHZEUytybHVmSHoiLCJtYWMiOiJlMmI4YzM3YTY2ZGQ1NDMzNzcxYjFkMDUzNTg1ZGU1N2EwOThmZTgxMzI2YTJmY2U5Y2MxNmM0MmM1NDljMDRkIiwidGFnIjoiIn0%3D |
16 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
bluedefipool.com
ethnodefi.com
registry.walletconnect.org
172.67.178.112
172.67.207.1
2606:4700:3030::ac43:cf01
2606:4700::6812:14fa
24b329a0fde19169796d801e5144412b3904c4454022d7b59b77513d9b2a55ab
29fd5016efe08849f1124ff05b0658d6579e6826fda0569fc1b77598c0e56036
4d17514e4c6ec3082d1321979a48ca6975a2fa1682a8e633a320fcff5e1a67c2
54335e7705b99ad9f87bd7296dfe88f6c8b78f16703f9ecc27e43a62b5be765e
57260df9b7b8c98913555b9221c91668e94b69f180335b5cd956be0884f772c3
5893ec8a896a689bdc9585e12fc937c485f7fb1a6e48fac704119d3ae1f6f617
5b1573fd00988108053ce261c28e18c73bcb1d371cc1c390c78c268671bf4a3a
88436dde651913ac8475be84603606275c9b31fabdf76c19bc5236d53dc94470
8eee49e3d0f4e651f9f40adfd661861997715b99d5b88103ae44d248ca6b1751
a4cd4c5feca9f7333052edb99312a899313e1f3f6b8f34ab7f8dcf01fe8d7a74
d9078d381eac55f748e3d715b4f5443fb0948bb81e4d42d67f3954af4b6e4f85
e28bf7d9fcc22cdfde0c7c8f31e3648a4847e7bda9cb69f309f24257eee3dd41
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
fefdf0ef362b6bf0662726c216f9a257834880d8b83bacfed427d2a3fdf332b7