urlscan.io logo urlscan.io
SecurityTrails logo

cvc-7.icu Open in urlscan Pro
2606:4700:30::681b:a2cb  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://cvc-7.icu/list/
Effective URL: https://cvc-7.icu/list/
Submission: On March 29 via api from CA
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 7 HTTP transactions. The main IP is 2606:4700:30::681b:a2cb, located in United States and belongs to CLOUDFLARENET - Cloudflare, Inc., US. The main domain is cvc-7.icu.
TLS certificate: Issued by CloudFlare Inc ECC CA-2 on March 27th 2019. Valid for: a year.
This is the only time cvc-7.icu was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Bestchange (Crypto Exchange)

Domain & IP information

IP Address AS Autonomous System
1 1 2606:4700:30:... 13335 (CLOUDFLAR...)
6 2606:4700:30:... 13335 (CLOUDFLAR...)
1 95.213.197.59 50340 (SELECTEL-MSK)
7 2
Apex Domain
Subdomains		 Transfer
7 cvc-7.icu
cvc-7.icu
181 KB
1 bestchange.ru
www.bestchange.ru
693 B
7 2
Domain Requested by
7 cvc-7.icu 1 redirects cvc-7.icu
1 www.bestchange.ru cvc-7.icu
7 2

This site contains no links.

Subject Issuer Validity Valid
sni.cloudflaressl.com
CloudFlare Inc ECC CA-2		 2019-03-27 -
2020-03-27		 a year crt.sh
www.bestchange.ru
RapidSSL RSA CA 2018		 2019-01-08 -
2020-02-07		 a year crt.sh

This page contains 1 frames:

Primary Page: https://cvc-7.icu/list/
Frame ID: 43506D9307B93AC6462E065596E497A2
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. http://cvc-7.icu/list/ HTTP 301
    https://cvc-7.icu/list/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • env /^Reveal$/i
Overall confidence: 100%
Detected patterns
  • headers server /cloudflare/i
Overall confidence: 100%
Detected patterns
  • env /^jQuery$/i
Overall confidence: 100%
Detected patterns
  • env /^Reveal$/i

Page Statistics

7
Requests

100 %
HTTPS

67 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

181 kB
Transfer

955 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://cvc-7.icu/list/ HTTP 301
    https://cvc-7.icu/list/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
cvc-7.icu/list/
Redirect Chain
  • http://cvc-7.icu/list/
  • https://cvc-7.icu/list/
55 KB
7 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://cvc-7.icu/list/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:30::681b:a2cb , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / PHP/5.4.16
Resource Hash
fe0ebd13c5b5e4093f1631fb21b84c1513375b05b78cfddcec0d5376a48f6e33

Request headers

:method
GET
:authority
cvc-7.icu
:scheme
https
:path
/list/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status
200
date
Fri, 29 Mar 2019 05:19:15 GMT
content-type
text/html
set-cookie
__cfduid=d732b0b8b7f36d8f9179d9176882c37f91553836755; expires=Sat, 28-Mar-20 05:19:15 GMT; path=/; domain=.cvc-7.icu; HttpOnly; Secure
x-powered-by
PHP/5.4.16
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
4bef63488de12bdc-AMS
content-encoding
br

Redirect headers

Date
Fri, 29 Mar 2019 05:19:15 GMT
Transfer-Encoding
chunked
Connection
keep-alive
Cache-Control
max-age=3600
Expires
Fri, 29 Mar 2019 06:19:15 GMT
Location
https://cvc-7.icu/list/
Vary
Accept-Encoding
Server
cloudflare
CF-RAY
4bef63480e24c83d-AMS
app.css
cvc-7.icu/list/css/ 		146 KB
17 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cvc-7.icu/list/css/app.css
Requested by
Host: cvc-7.icu
URL: https://cvc-7.icu/list/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:30::681b:a2cb , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
11ffde93e0dcd99af437dae9fbda2560d3091a8c8f2e32ca46a6d3b0ec7b07fa

Request headers

:path
/list/css/app.css
pragma
no-cache
cookie
__cfduid=d732b0b8b7f36d8f9179d9176882c37f91553836755
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/css,*/*;q=0.1
cache-control
no-cache
:authority
cvc-7.icu
referer
https://cvc-7.icu/list/
:scheme
https
:method
GET
Referer
https://cvc-7.icu/list/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Fri, 29 Mar 2019 05:19:15 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Thu, 28 Mar 2019 12:33:20 GMT
server
cloudflare
etag
W/"246ab-58526c2669afe"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css
status
200
cache-control
public, max-age=14400
cf-ray
4bef6349ca2e2bdc-AMS
expires
Fri, 29 Mar 2019 09:19:15 GMT
bg.png
www.bestchange.ru/images/ 		344 B
693 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.bestchange.ru/images/bg.png
Requested by
Host: cvc-7.icu
URL: https://cvc-7.icu/list/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
95.213.197.59 , Russian Federation, ASN50340 (SELECTEL-MSK, RU),
Reverse DNS
Software
nginx /
Resource Hash
b0a21614cf0af4e8ef22f21ded2040df872fba31a6eacea40edf990b9cbbb6d2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;

Request headers

Referer
https://cvc-7.icu/list/css/app.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Fri, 29 Mar 2019 05:19:15 GMT
Last-Modified
Fri, 21 Nov 2014 14:46:33 GMT
Server
nginx
ETag
"546f5049-158"
Strict-Transport-Security
max-age=31536000;
Content-Type
image/png
Cache-Control
max-age=2592000
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
344
Expires
Sun, 28 Apr 2019 05:19:15 GMT
jquery.js
cvc-7.icu/list/node_modules/jquery/dist/ 		265 KB
75 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cvc-7.icu/list/node_modules/jquery/dist/jquery.js
Requested by
Host: cvc-7.icu
URL: https://cvc-7.icu/list/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:30::681b:a2cb , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
d8aa24ecc6cecb1a60515bc093f1c9da38a0392612d9ab8ae0f7f36e6eee1fad

Request headers

:path
/list/node_modules/jquery/dist/jquery.js
pragma
no-cache
cookie
__cfduid=d732b0b8b7f36d8f9179d9176882c37f91553836755
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
cvc-7.icu
referer
https://cvc-7.icu/list/
:scheme
https
:method
GET
Referer
https://cvc-7.icu/list/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Fri, 29 Mar 2019 05:19:15 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Thu, 28 Mar 2019 12:33:19 GMT
server
cloudflare
etag
W/"42587-58526c2542854"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
public, max-age=14400
cf-ray
4bef634a6c142bdc-AMS
expires
Fri, 29 Mar 2019 09:19:15 GMT
what-input.js
cvc-7.icu/list/node_modules/what-input/dist/ 		13 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cvc-7.icu/list/node_modules/what-input/dist/what-input.js
Requested by
Host: cvc-7.icu
URL: https://cvc-7.icu/list/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:30::681b:a2cb , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
17fbb1f9e0c56be3310782a1ab8a2177896a879c03cab6540b1903ef8e971ae8

Request headers

:path
/list/node_modules/what-input/dist/what-input.js
pragma
no-cache
cookie
__cfduid=d732b0b8b7f36d8f9179d9176882c37f91553836755
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
cvc-7.icu
referer
https://cvc-7.icu/list/
:scheme
https
:method
GET
Referer
https://cvc-7.icu/list/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Fri, 29 Mar 2019 05:19:15 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Thu, 28 Mar 2019 12:33:18 GMT
server
cloudflare
etag
W/"3492-58526c24c92eb"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
public, max-age=14400
cf-ray
4bef634a6c162bdc-AMS
expires
Fri, 29 Mar 2019 09:19:15 GMT
foundation.js
cvc-7.icu/list/node_modules/foundation-sites/dist/js/ 		476 KB
77 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cvc-7.icu/list/node_modules/foundation-sites/dist/js/foundation.js
Requested by
Host: cvc-7.icu
URL: https://cvc-7.icu/list/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:30::681b:a2cb , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
ed655b37f276bc0ea5e2d267453c75621dd119051c3510182e8d0e57daac2fe9

Request headers

:path
/list/node_modules/foundation-sites/dist/js/foundation.js
pragma
no-cache
cookie
__cfduid=d732b0b8b7f36d8f9179d9176882c37f91553836755
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
cvc-7.icu
referer
https://cvc-7.icu/list/
:scheme
https
:method
GET
Referer
https://cvc-7.icu/list/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Fri, 29 Mar 2019 05:19:15 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Thu, 28 Mar 2019 12:33:19 GMT
server
cloudflare
etag
W/"76e9f-58526c259ece4"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
public, max-age=14400
cf-ray
4bef634a6c182bdc-AMS
expires
Fri, 29 Mar 2019 09:19:15 GMT
app.js
cvc-7.icu/list/js/ 		26 B
107 B 		Script
General
Check archive.org
Download Go to
Full URL
https://cvc-7.icu/list/js/app.js
Requested by
Host: cvc-7.icu
URL: https://cvc-7.icu/list/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:30::681b:a2cb , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
c89b7a361593106453fbdf684c30721245fa53056e2c124bfc6fadfae32c9e55

Request headers

:path
/list/js/app.js
pragma
no-cache
cookie
__cfduid=d732b0b8b7f36d8f9179d9176882c37f91553836755
accept-encoding
gzip, deflate, br
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
cvc-7.icu
referer
https://cvc-7.icu/list/
:scheme
https
:method
GET
Referer
https://cvc-7.icu/list/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Fri, 29 Mar 2019 05:19:15 GMT
cf-cache-status
HIT
last-modified
Thu, 28 Mar 2019 12:33:18 GMT
server
cloudflare
etag
"1a-58526c249a103"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
status
200
cache-control
public, max-age=14400
accept-ranges
bytes
cf-ray
4bef634a6c1a2bdc-AMS
content-length
26
expires
Fri, 29 Mar 2019 09:19:15 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Bestchange (Crypto Exchange)

44 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask function| $ function| jQuery object| whatInput object| Foundation object| CoreUtils object| Box function| onImagesLoaded object| MediaQuery object| Motion object| Nest function| Timer object| Triggers function| Abide function| Accordion function| AccordionMenu function| Drilldown function| Dropdown function| DropdownMenu function| Equalizer function| Interchange function| Magellan function| OffCanvas function| Orbit function| ResponsiveMenu function| ResponsiveToggle function| Reveal function| Slider function| SmoothScroll function| Sticky function| Tabs function| Toggler function| Tooltip function| ResponsiveAccordionTabs object| default boolean| lstate boolean| rstate function| getRandomInt function| fullRandRefreshReserved function| getPercent function| colorPercent boolean| moreCurrencysState

1 Cookies

Domain/Path Name / Value
.cvc-7.icu/ Name: __cfduid
Value: d732b0b8b7f36d8f9179d9176882c37f91553836755