coinbase-gateway.com Open in urlscan Pro
2606:4700:3037::6815:2e63 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://coinbase-gateway.com/
Effective URL:
https://coinbase-gateway.com/login.php
Submission: On October 07 via automatic, source certstream-suspicious (October 7th 2023, 2:27:13 am UTC) — Scanned from DE

Summary HTTP 4 Redirects Links 3 Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 4 HTTP transactions. The main IP is 2606:4700:3037::6815:2e63, located in United States and belongs to CLOUDFLARENET, US. The main domain is coinbase-gateway.com.
TLS certificate: Issued by E1 on October 6th 2023. Valid for: 3 months.

This is the only time coinbase-gateway.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Coinbase (Crypto Exchange)

Domain & IP information

	IP Address		AS Autonomous System
2 6	2606:4700:303... 2606:4700:3037::6815:2e63		13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2

6 2606:4700:3037::6815:2e63 (United States) 2 redirects

ASN13335 (CLOUDFLARENET, US)

coinbase-gateway.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	coinbase-gateway.com 2 redirects coinbase-gateway.com	531 KB
4	1

	Domain	Requested by
6	coinbase-gateway.com	2 redirects coinbase-gateway.com
4	1

This site contains links to these domains. Also see Links.

Domain
accounts.coinbase.com
coinbase.com

Subject Issuer	Validity	Valid
coinbase-gateway.com E1	`2023-10-06` - `2024-01-04`	3 months	crt.sh

This page contains 3 frames:

Primary Page: https://coinbase-gateway.com/login.php
Frame ID: 3DCACC8A9E026EEB01277BDACDA741B7
Requests: 6 HTTP requests in this frame

Frame: data://truncated
Frame ID: C87E1F36FF91B94A7E5E40D6B95E5466
Requests: 3 HTTP requests in this frame

Frame: https://coinbase-gateway.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/dffb14d6/main.js
Frame ID: A0B813CC2435054226EAE9FA28BB9E11
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Coinbase - Sign InCoinbase logo

Page URL History Show full URLs

https://coinbase-gateway.com/ HTTP 302
https://coinbase-gateway.com/login.php Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

4
Requests

75 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

717 kB
Transfer

1082 kB
Size

2
Cookies

3 Outgoing links

These are links going to different origins than the main page.

URL: https://accounts.coinbase.com/signin
Title: Sign in to a business account

Search URL Search Domain Scan URL

URL: https://coinbase.com/legal/privacy
Title: Privacy policy

Search URL Search Domain Scan URL

URL: https://coinbase.com/legal/cookie
Title: Cookie Policy

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://coinbase-gateway.com/ HTTP 302
https://coinbase-gateway.com/login.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 8

https://coinbase-gateway.com/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
https://coinbase-gateway.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/dffb14d6/main.js

4 HTTP transactions
7 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request login.php Show response
coinbase-gateway.com/
Redirect Chain

https://coinbase-gateway.com/
https://coinbase-gateway.com/login.php

621 KB
447 KB

242ms
241ms

Document
text/html

2606:4700:3037::6815:2e63
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://coinbase-gateway.com/login.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3037::6815:2e63 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d99b275514ebef4cd4ad883eebb3ccb06da70259b70c027da4c38e55aa49ba01

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-store, no-cache, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 8122b3fc596318d5-FRA
content-encoding: br
content-type: text/html; charset=UTF-8
date: Sat, 07 Oct 2023 02:27:06 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EgYQMGgx91F9Gd2dD3fk77U%2BDugoT1Bag0STkU6EljaVpEbgJmUr8d7%2BoIoEW572TxwInrHs%2BJmUZM7YWmYK8UakEZ6hNoeZA1L6M2czz1WBTZLDdkGRWUa0lL9IifS%2BwANfEuL9xyjmIPWd%2BTOaPERbfQ%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

Redirect headers

alt-svc: h3=":443"; ma=86400
cache-control: no-store, no-cache, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 8122b3f9bf9818d5-FRA
content-type: text/html; charset=UTF-8
date: Sat, 07 Oct 2023 02:27:06 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
location: login.php
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FonnYsYehiGCDkZkGKeEfiDJw8d2gOMiu8MaR7nEfbma3czRhRPj20QbA6tijoz6c8GS3XHV2B%2Bwrp%2FSjQx4dpcZ8zCc5Rdz3mS%2FGH1n702brBhRPh6wKgYnkCGiSrf2DoYjcz%2FdLqNWzeqWJbbiX3JJ7A%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

GET
DATA 200
OK truncated
/ 38 KB
38 KB Font
font/woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b2943cf448795751c6a309662c5237904fcb74e31507271deb64437350274b8d

Request headers

Referer
Origin: https://coinbase-gateway.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

Content-Type: font/woff2

GET
DATA 200
OK truncated
/ 39 KB
39 KB Font
font/woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 81368223143520415fe7fbdc3792d2d52ad7e422d8b214661ff932afe577b779

Request headers

Referer
Origin: https://coinbase-gateway.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

Content-Type: font/woff2

GET
DATA 200
OK truncated
/ 40 KB
40 KB Font
font/woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5db56ddf9ab991fc7a3a5b188b6b0c92331213ec4991b71d9821c36dcbcdb687

Request headers

Referer
Origin: https://coinbase-gateway.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

Content-Type: font/woff2

GET
DATA 200
OK truncated
/ 39 KB
39 KB Font
font/woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a1f75e7f702059493bb74cfcb3178d095b3f6da4d313e92b3ceabc3e63eb914c

Request headers

Referer
Origin: https://coinbase-gateway.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

Content-Type: font/woff2

GET
H3 200 jquery.js Show response
coinbase-gateway.com/core/js/ 266 KB
79 KB 942ms
941ms Script
text/javascript 2606:4700:3037::6815:2e63
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://coinbase-gateway.com/core/js/jquery.js
Requested by: Host: coinbase-gateway.com
URL: https://coinbase-gateway.com/login.php
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3037::6815:2e63 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 84086bb634fc6fd223918894c6b74641811e06e84007937c5809942b7a02ddff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://coinbase-gateway.com/login.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Sat, 07 Oct 2023 02:27:08 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Sun, 16 Oct 2022 03:47:40 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"42719-5eb1eb8786f00-gzip"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cKJ5ZzSw6kQ4ZfIXSBtIJfdsCvksxU%2FK8jnlrOFipmNK6dTiZetKc8ktO%2B%2FHcLhySidhW2wrSQS%2FChZlqSv5b42Qeh2bxLPX8x7iOmGFBKkbT9HJV03B2jAokTXiH0DBxJtGpEOXaLinJJUaElIvMYtI0w%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript
cache-control: max-age=14400
cf-ray: 8122b40488b736e0-FRA
alt-svc: h3=":443"; ma=86400

GET
DATA 200
OK truncated
/ Frame C87E 2 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame C87E 15 KB
15 KB Font
font/woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc

Request headers

Referer
Origin: null
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

Content-Type: font/woff2

GET
DATA 200
OK truncated
/ Frame C87E 15 KB
15 KB Font
font/woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7

Request headers

Referer
Origin: null
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

Content-Type: font/woff2

GET
H3

200

main.js Show response
coinbase-gateway.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/dffb14d6/ Frame A0B8
Redirect Chain

https://coinbase-gateway.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
https://coinbase-gateway.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/dffb14d6/main.js

7 KB
4 KB

44ms
44ms

Script
application/javascript

2606:4700:3037::6815:2e63
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://coinbase-gateway.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/dffb14d6/main.js

Protocol

Server

2606:4700:3037::6815:2e63 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6e65f91da5cab310a13b5b6bf3269ad603bab2f6b221bd08dbb60f4ea186518f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36

Response headers

date: Sat, 07 Oct 2023 02:27:08 GMT
content-encoding: br
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: accept-encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cy1l3xMJBvSyxl1iMHhLqm66ABmjM%2Fdphb%2FcN1ZXKsX%2BEOkHyl5TMC82TYChDMdp0EG2FnmxH5Teldj0zOzC2MJc1aAYYMTJ9RwNptHWOBdAUKJlSVYMmB2vzLgdYAeRQcIoy1dEOQBXdL%2FWG2joHNr3JQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
cache-control: max-age=14400, public
cf-ray: 8122b40b5cd836e0-FRA
alt-svc: h3=":443"; ma=86400

Redirect headers

date: Sat, 07 Oct 2023 02:27:08 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: accept-encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FASJUapOoAHIEM%2BEGyrNioYJQHOMkUofwh%2F3Of1XQgqtGgcw0dNPhlwTih%2Ff2a%2FLXAqpyOtWpGiDHxoJtkucArrDgXHfJa%2Bst%2B12qqVQ7Yc317HHG8ihhP7VuGK3eidj7coDcGWi%2BZp3mAzkZjpRcn0y2g%3D%3D"}],"group":"cf-nel","max_age":604800}
location: /cdn-cgi/challenge-platform/h/g/scripts/jsd/dffb14d6/main.js
access-control-allow-origin: *
cache-control: max-age=300, public
cf-ray: 8122b40b1c9f36e0-FRA
alt-svc: h3=":443"; ma=86400

POST
H3 200 8122b3fc596318d5 Show response
coinbase-gateway.com/cdn-cgi/challenge-platform/h/g/jsd/r/ Frame A0B8 0
571 B 59ms
56ms XHR
text/plain 2606:4700:3037::6815:2e63
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://coinbase-gateway.com/cdn-cgi/challenge-platform/h/g/jsd/r/8122b3fc596318d5
Requested by: Host: coinbase-gateway.com
URL: https://coinbase-gateway.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3037::6815:2e63 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.149 Safari/537.36
Content-Type: application/json

Response headers

date: Sat, 07 Oct 2023 02:27:08 GMT
content-encoding: br
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0srCI0xHtLb6x3iAwTKZHlM2KxVhrnJaaGVSiNyfPigJ%2BLC53ChXMMjQnw9yTDCDZ3%2F1HZTqOyKTwLmWBJ5HY2uNHKOdFZShoiaUUvZPlaJIij1lI1ikxq11%2BmhSHgsVbeGftl%2FQJqhaXbbcTMBAgLghmQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/plain; charset=UTF-8
cf-ray: 8122b40c2d6c36e0-FRA
alt-svc: h3=":443"; ma=86400

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Coinbase (Crypto Exchange)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			coinbase-gateway.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: oetcspgoel9cd6vrhsefnq7p6j
			.coinbase-gateway.com/	1970-01-21 00:03:01	Name: cf_clearance Value: EnqIittNrKOQX71gmvigeyzD8TH.pOt7Gbme_eUQfhg-1696645628-0-1-68136468.580f3505.889bdc1a-0.2.1696645628

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

coinbase-gateway.com
2606:4700:3037::6815:2e63
1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7
5db56ddf9ab991fc7a3a5b188b6b0c92331213ec4991b71d9821c36dcbcdb687
6e65f91da5cab310a13b5b6bf3269ad603bab2f6b221bd08dbb60f4ea186518f
81368223143520415fe7fbdc3792d2d52ad7e422d8b214661ff932afe577b779
84086bb634fc6fd223918894c6b74641811e06e84007937c5809942b7a02ddff
a1f75e7f702059493bb74cfcb3178d095b3f6da4d313e92b3ceabc3e63eb914c
b2943cf448795751c6a309662c5237904fcb74e31507271deb64437350274b8d
d99b275514ebef4cd4ad883eebb3ccb06da70259b70c027da4c38e55aa49ba01
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

coinbase-gateway.com Open in urlscan Pro 2606:4700:3037::6815:2e63 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

4 Requests

75 %HTTPS

100 %IPv6

1 Domains

1 Subdomains

2 IPs

1 Countries

717 kBTransfer

1082 kBSize

2 Cookies

3 Outgoing links

Page URL History

Redirected requests

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 7 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

5 JavaScript Global Variables

2 Cookies

Indicators

coinbase-gateway.com Open in urlscan Pro
2606:4700:3037::6815:2e63 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

4
Requests

75 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

717 kB
Transfer

1082 kB
Size

2
Cookies

4 HTTP transactions
7 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!