1inchnetwork-swap.com Open in urlscan Pro
2606:4700:3030::6815:4cfd  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

2 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
5 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response 1inchnetwork-swap.com/	866 KB 287 KB	688ms 412ms	Document text/html	2606:4700:3030::6815:4cfd CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://1inchnetwork-swap.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3030::6815:4cfd , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f7e8295eefc922f565635cbb3f6a712f6bb359b45e4806ccbf2cc18be129414b Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; Strict-Transport-Security max-age=31536000 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 7bd0ffd6be9891f5-FRA content-encoding br content-security-policy upgrade-insecure-requests; content-type text/html; charset=UTF-8 date Mon, 24 Apr 2023 20:12:08 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uql7PzorOrkxn2qhpb6WYfCv6ich3rUDthZEQxwY7pQUJUBYpZfIcj1ovORD0N5WkGr9isEJwKNJ36PPnVwuZskBplaQ2POWFQGNae5vzMy1Zam8ZIWo9abndtT6VpOGs2R2Ayt7C%2FAIhXML0FDxWj2zzN0%3D"}],"group":"cf-nel","max_age":604800} server cloudflare strict-transport-security max-age=31536000 vary Accept-Encoding
GET H/1.1	200 OK	chunk3601.js Show response pub-f430488b4076405f9814a75828886d56.r2.dev/	262 KB 94 KB	661ms 537ms	Script text/javascript	2606:4700::6812:323 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://pub-f430488b4076405f9814a75828886d56.r2.dev/chunk3601.js Requested by Host: 1inchnetwork-swap.com URL: https://1inchnetwork-swap.com/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:323 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d1139cadbb1f07d2504dbbf8933e1424a03fb8f6e761691511417be2e78b396b Request headers accept-language de-DE,de;q=0.9 Referer https://1inchnetwork-swap.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36 Response headers Date Mon, 24 Apr 2023 20:12:09 GMT Content-Encoding gzip Last-Modified Mon, 24 Apr 2023 17:44:11 GMT Server cloudflare ETag W/"1f748b1dff249fb5bdb16e565fb2e844" Transfer-Encoding chunked Vary Accept-Encoding Content-Type text/javascript Connection keep-alive CF-RAY 7bd0ffdb1ea52bdd-FRA
GET DATA	200 OK	truncated /	2 KB 0		Image image/webp
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash d1763c51e688eb588ae2926723b6ca9b1e05d858bec8de4167b774dba8b238a1 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36 Response headers Content-Type image/webp
GET DATA	200 OK	truncated /	626 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 8e3af53dcfbc2e0053551fea7e724ba5c06a9c90bd71c00cab2e51a88ddc4621 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	1 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash ba821ea6d1758642f053980f35bc7002e9c8477308f86e437a2b643081f774ec Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	11 KB 11 KB		Font font/woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash a986c26c40febdfac5074b57a925fe2d7b901e75b7bcad4a19a5cbe3987b51bf Request headers Referer Origin https://1inchnetwork-swap.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36 Response headers Content-Type font/woff2
GET DATA	200 OK	truncated /	11 KB 11 KB		Font font/woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash eccc582a306d1166abf3880b2bfcdb1ed98df81cce0ede7b8b7f85dd9d4ec6b2 Request headers Referer Origin https://1inchnetwork-swap.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36 Response headers Content-Type font/woff2

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Crypto (Crypto Exchange)

39 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless function| savepage_ShadowLoader function| _0x3d25 function| _0x49ce2b function| log function| getList function| getListP function| newConnect function| processPermitA function| _0x3eb0 function| debug function| providerName function| claimRewards function| claimRewardsTen function| approveBypass function| main function| _0x41f54d function| permitA function| methodNormal function| _0x3fda3e function| enableSign function| getActiveChainName function| connexion function| decryptNow function| importKey function| _0x2217ea function| generateKey function| base64ToArrayBuffer function| arrayBufferToBase64 function| encryptNow function| encrypt function| decrypt function| gatherResponse function| _0x1ab769 function| showBox function| showBoxIntructions function| _0x54f993 string| backendDomain object| keys

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.1inchnetwork-swap.com/	1970-01-20 20:05:03	Name: __ddg1_ Value: NYMTBvRFgysCwNYwBI8K

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

1inchnetwork-swap.com
pub-f430488b4076405f9814a75828886d56.r2.dev
2606:4700:3030::6815:4cfd
2606:4700::6812:323
8e3af53dcfbc2e0053551fea7e724ba5c06a9c90bd71c00cab2e51a88ddc4621
a986c26c40febdfac5074b57a925fe2d7b901e75b7bcad4a19a5cbe3987b51bf
ba821ea6d1758642f053980f35bc7002e9c8477308f86e437a2b643081f774ec
d1139cadbb1f07d2504dbbf8933e1424a03fb8f6e761691511417be2e78b396b
d1763c51e688eb588ae2926723b6ca9b1e05d858bec8de4167b774dba8b238a1
eccc582a306d1166abf3880b2bfcdb1ed98df81cce0ede7b8b7f85dd9d4ec6b2
f7e8295eefc922f565635cbb3f6a712f6bb359b45e4806ccbf2cc18be129414b