aave.do
Open in
urlscan Pro
2606:4700:3036::ac43:a873
Malicious Activity!
Public Scan
Submission: On March 01 via manual from US — Scanned from US
Summary
TLS certificate: Issued by GTS CA 1P5 on February 26th 2024. Valid for: 3 months.
This is the only time aave.do was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Aave (Crypto)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
5 | 2606:4700:303... 2606:4700:3036::ac43:a873 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a04:4e42:400... 2a04:4e42:400::649 | 54113 (FASTLY) (FASTLY) | |
1 | 2607:f8b0:400... 2607:f8b0:4006:809::200a | 15169 (GOOGLE) (GOOGLE) | |
2 | 2606:4700:303... 2606:4700:3031::ac43:dca6 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2607:f8b0:400... 2607:f8b0:4006:81d::2003 | 15169 (GOOGLE) (GOOGLE) | |
1 | 172.67.74.152 172.67.74.152 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2606:4700:10:... 2606:4700:10::ac43:1147 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
12 | 7 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
5 |
aave.do
aave.do |
32 KB |
2 |
aave.com
app.aave.com — Cisco Umbrella Rank: 565704 |
7 KB |
1 |
ipgeolocation.io
api.ipgeolocation.io — Cisco Umbrella Rank: 36851 |
795 B |
1 |
ipify.org
api.ipify.org — Cisco Umbrella Rank: 2821 |
154 B |
1 |
gstatic.com
fonts.gstatic.com |
46 KB |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 30 |
1 KB |
1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 760 |
31 KB |
12 | 7 |
Domain | Requested by | |
---|---|---|
5 | aave.do |
aave.do
|
2 | app.aave.com |
aave.do
|
1 | api.ipgeolocation.io |
aave.do
|
1 | api.ipify.org |
aave.do
|
1 | fonts.gstatic.com |
fonts.googleapis.com
|
1 | fonts.googleapis.com |
aave.do
|
1 | code.jquery.com |
aave.do
|
12 | 7 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
aave.do GTS CA 1P5 |
2024-02-26 - 2024-05-26 |
3 months | crt.sh |
*.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2023-07-11 - 2024-07-14 |
a year | crt.sh |
upload.video.google.com GTS CA 1C3 |
2024-02-05 - 2024-04-29 |
3 months | crt.sh |
aave.com E1 |
2024-01-20 - 2024-04-19 |
3 months | crt.sh |
*.gstatic.com GTS CA 1C3 |
2024-02-05 - 2024-04-29 |
3 months | crt.sh |
ipify.org GTS CA 1P5 |
2024-01-22 - 2024-04-21 |
3 months | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2023-04-28 - 2024-04-27 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://aave.do/
Frame ID: 80A9FE97D5214EC323E0A8FDD2FF112E
Requests: 12 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
12 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
aave.do/ |
98 KB 19 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.6.3.min.js
code.jquery.com/ |
88 KB 31 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
config.js
aave.do/ |
10 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
app.js
aave.do/ |
26 KB 8 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
info.js
aave.do/ |
1 KB 968 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
21 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
aaveLogo.svg
app.aave.com/ |
3 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ethereum.svg
app.aave.com/icons/networks/ |
6 KB 6 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa1ZL7.woff2
fonts.gstatic.com/s/inter/v13/ |
46 KB 46 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
api.ipify.org/ |
20 B 154 B |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ipgeo
api.ipgeolocation.io/ |
936 B 795 B |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
notify_telegram.php
aave.do/ |
486 B 773 B |
Fetch
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Aave (Crypto)38 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery object| __p_2313303698 object| __p_4329511002 number| __p_5923613118 object| __p_5738362295 function| __getGlobal object| __globalObject function| __TextDecoder function| __Uint8Array undefined| __Buffer function| __String function| __Array function| utf8ArrayToStr function| __p_6687875972 string| __p_5544306532 string| __p_9977584722 object| __p_2699751753 string| __p_0491608848 object| __p_2855783333 string| __p_4995437712 string| __p_3757460393 string| __p_1988636911 string| __p_0080782699 function| __p_6893900295_flat_unnamed function| __p_2712075162_flat_unnamed function| __p_9186299648_flat_removeCaptchaAndShowContent function| __p_6648308770_flat_setCookie function| __p_7863326013_flat_getCookie function| __p_5526454299_flat_unnamed function| __p_4173168848 object| scriptsToLoad function| __p_5559975980 function| __p_1791335054 function| __p_4482555825 function| __p_4588717783 function| __p_7736591941 function| __p_73422066570 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
aave.do
api.ipgeolocation.io
api.ipify.org
app.aave.com
code.jquery.com
fonts.googleapis.com
fonts.gstatic.com
172.67.74.152
2606:4700:10::ac43:1147
2606:4700:3031::ac43:dca6
2606:4700:3036::ac43:a873
2607:f8b0:4006:809::200a
2607:f8b0:4006:81d::2003
2a04:4e42:400::649
1bacf67cf153ed11df37509111e853b92c09e2f15ae25d3052a3b550e87ee7c8
2819e6fc23a4e0c513209a9a3bb3c274d13cd2516c865473f4c12badf39d69d5
5a7cfeecfbd90eb145a413b838a28f1bf23db29e42f71ee6c2eb99ecbd5d2afb
6a2808f084bb43b7776343164dd54a0be0823eddfdc0d6c5ec7b66c7bb3be4ed
88df0b5a7bc397dbc13a26bb8b3742cc62cd1c9b0dded57da7832416d6f52f42
90c4f0951056e5a82b2150c8b3fe6d011a08ea2abc957453d080b8179504e2d7
957755dc5613e30463d0018f158eb50b70c2901cf1051e01bb67f9ec6b662194
9858970d3451dfd889b9d2b610f5d10657099ec8ce7dd61aebab762884d40fdf
a6f3f0faea4b3d48e03176341bef0ed3151ffbf226d4c6635f1c6039c0500575
b02d005017a886a58703826ca9032d2942133d7af4c1837019e1e51d7afe7d91
c850af7de3df2281821f62ba9dc15782d6b6eb45e7343974b6f6813907aeed10
ea8db7418e9d9b85d0f42fe5a332ba257ea0f70f41d22d000c6d2ad88868f0cb