csgo-mapclean.execellent.com
Open in
urlscan Pro
188.114.96.3
Malicious Activity!
Public Scan
Submission Tags: phishingrod
Submission: On August 19 via api from DE — Scanned from NL
Summary
TLS certificate: Issued by E6 on August 19th 2024. Valid for: 3 months.
This is the only time csgo-mapclean.execellent.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Steam (Gaming)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
4 | 188.114.96.3 188.114.96.3 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
4 | 2a04:4e42::485 2a04:4e42::485 | 54113 (FASTLY) (FASTLY) | |
1 | 76.76.21.241 76.76.21.241 | 16509 (AMAZON-02) (AMAZON-02) | |
3 | 2606:4700::68... 2606:4700::6810:4f49 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 151.101.65.229 151.101.65.229 | 54113 (FASTLY) (FASTLY) | |
1 | 104.18.9.10 104.18.9.10 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 167.253.154.48 167.253.154.48 | 46829 (LAMHOSTING) (LAMHOSTING) | |
1 | 218.12.76.169 218.12.76.169 | 4837 (CHINA169-...) (CHINA169-BACKBONE CHINA UNICOM China169 Backbone) | |
1 | 101.32.192.8 101.32.192.8 | 132203 (TENCENT-N...) (TENCENT-NET-AP-CN Tencent Building) | |
18 | 10 |
ASN13335 (CLOUDFLARENET, US)
static.cloudflareinsights.com | |
cloudflareinsights.com |
ASN4837 (CHINA169-BACKBONE CHINA UNICOM China169 Backbone, CN)
csgo.moeub.cn |
ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN)
bbs.upkk.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
5 |
jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 410 |
215 KB |
4 |
execellent.com
csgo-mapclean.execellent.com |
65 KB |
3 |
cloudflareinsights.com
static.cloudflareinsights.com — Cisco Umbrella Rank: 1223 cloudflareinsights.com — Cisco Umbrella Rank: 1204 |
7 KB |
1 |
upkk.com
bbs.upkk.com |
1 KB |
1 |
moeub.cn
csgo.moeub.cn |
4 KB |
1 |
fyscs.com
fyscs.com |
7 KB |
1 |
steamstatic.com
cdn.cloudflare.steamstatic.com — Cisco Umbrella Rank: 19959 |
2 KB |
1 |
vercel.app
steamcard.vercel.app |
37 KB |
0 |
zombieden.cn
Failed
bbs.zombieden.cn Failed |
|
18 | 9 |
Domain | Requested by | |
---|---|---|
5 | cdn.jsdelivr.net |
csgo-mapclean.execellent.com
cdn.jsdelivr.net |
4 | csgo-mapclean.execellent.com |
csgo-mapclean.execellent.com
cdn.jsdelivr.net |
2 | cloudflareinsights.com |
static.cloudflareinsights.com
|
1 | bbs.upkk.com |
csgo-mapclean.execellent.com
|
1 | csgo.moeub.cn |
csgo-mapclean.execellent.com
|
1 | fyscs.com |
csgo-mapclean.execellent.com
|
1 | cdn.cloudflare.steamstatic.com |
csgo-mapclean.execellent.com
|
1 | static.cloudflareinsights.com |
csgo-mapclean.execellent.com
|
1 | steamcard.vercel.app |
csgo-mapclean.execellent.com
|
0 | bbs.zombieden.cn Failed |
csgo-mapclean.execellent.com
|
18 | 10 |
This site contains links to these domains. Also see Links.
Domain |
---|
github.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
csgo-mapclean.execellent.com E6 |
2024-08-19 - 2024-11-17 |
3 months | crt.sh |
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2024 Q3 |
2024-07-30 - 2025-08-31 |
a year | crt.sh |
*.vercel.app R11 |
2024-08-14 - 2024-11-12 |
3 months | crt.sh |
cloudflareinsights.com WE1 |
2024-07-06 - 2024-10-04 |
3 months | crt.sh |
cloudflare.steamstatic.com Cloudflare Inc ECC CA-3 |
2024-06-15 - 2024-12-31 |
7 months | crt.sh |
fyscs.com Encryption Everywhere DV TLS CA - G2 |
2024-05-13 - 2025-05-13 |
a year | crt.sh |
moeub.cn ZeroSSL RSA Domain Secure Site CA |
2024-06-25 - 2024-09-23 |
3 months | crt.sh |
bbs.upkk.com TrustAsia RSA DV TLS CA G2 |
2024-03-16 - 2025-03-16 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://csgo-mapclean.execellent.com/
Frame ID: 0F01880EEA881176890C27BC017148B6
Requests: 17 HTTP requests in this frame
Screenshot
Detected technologies
Vue.js (JavaScript Frameworks) ExpandDetected patterns
- (?:/([\d.]+))?/vue(?:\.min)?\.js
Axios (JavaScript libraries) Expand
Detected patterns
- /axios(@|/)([\d.]+)(?:/[a-z]+)?/axios(?:.min)?\.js
Cloudflare Browser Insights (Analytics) Expand
Detected patterns
- static\.cloudflareinsights\.com/beacon(?:\.min)?\.js
jsDelivr (CDN) Expand
Detected patterns
- <link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
- //cdn\.jsdelivr\.net/
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: github
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
18 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H3 |
Primary Request
/
csgo-mapclean.execellent.com/ |
18 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mdui.min.css
cdn.jsdelivr.net/npm/mdui@1.0.2/dist/css/ |
318 KB 35 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dark,badge,group
steamcard.vercel.app/card/76561199062253455/ |
52 KB 37 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
email-decode.min.js
csgo-mapclean.execellent.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/ |
1 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mdui.min.js
cdn.jsdelivr.net/npm/mdui@1.0.2/dist/js/ |
72 KB 22 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
vue.js
cdn.jsdelivr.net/npm/vue@2/dist/ |
425 KB 107 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
axios.min.js
cdn.jsdelivr.net/npm/axios@0.27.2/dist/ |
20 KB 8 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
beacon.min.js
static.cloudflareinsights.com/ |
19 KB 7 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
MaterialIcons-Regular.woff2
cdn.jsdelivr.net/npm/mdui@1.0.2/dist/icons/material-icons/ |
43 KB 44 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
maps.json
csgo-mapclean.execellent.com/ |
499 KB 53 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
69f7ebe2735c366c65c0b33dae00e12dc40edbe4.jpg
cdn.cloudflare.steamstatic.com/steamcommunity/public/images/apps/730/ |
1 KB 2 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
favicon.ico
fyscs.com/ |
7 KB 7 KB |
Image
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
favicon.ico
bbs.zombieden.cn/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
moeub_logo.svg
csgo.moeub.cn/ |
3 KB 4 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
favicon.ico
bbs.upkk.com/ |
1 KB 1 KB |
Image
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
rum
cloudflareinsights.com/cdn-cgi/ |
0 37 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H2 |
rum
cloudflareinsights.com/cdn-cgi/ |
0 0 |
Preflight
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
favicon.ico
csgo-mapclean.execellent.com/ |
18 KB 5 KB |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- bbs.zombieden.cn
- URL
- https://bbs.zombieden.cn/favicon.ico
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Steam (Gaming)6 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| mdui function| Vue function| axios object| app number| _mduiEventId object| __cfBeacon0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Content-Type-Options | nosniff |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
bbs.upkk.com
bbs.zombieden.cn
cdn.cloudflare.steamstatic.com
cdn.jsdelivr.net
cloudflareinsights.com
csgo-mapclean.execellent.com
csgo.moeub.cn
fyscs.com
static.cloudflareinsights.com
steamcard.vercel.app
bbs.zombieden.cn
101.32.192.8
104.18.9.10
151.101.65.229
167.253.154.48
188.114.96.3
218.12.76.169
2606:4700::6810:4f49
2a04:4e42::485
76.76.21.241
0ca020e94a3761761b563a074d7a41de7fd79dec1eb9a80eecd93549cea63920
1c2fda3c0aed39cef2c3ad98701cc6db8b095e35c9bb46adba3661f5ae0bb54c
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
36b10d3b4920592a4ec26c064c429e9a3dfb4689235fdfc91e1736b681c76786
5ae451f69eae48edf6e68f6918b8ff397a6f8db413224eca999cd17296ee6c3b
5e9ffee9bbbe7fae18f0f0bc39609779a9929eb961801ca6d0fd0dc662c75400
6bfdddc6f90eaf132abb58580f3a4c42eda1d5eb99b139774773a60f31ffd20c
8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f
a50321aede22fb162e6737ca6e85d31369675c371c67ca88d8587c8321ad5fa4
a87d66c91b2e7dc5530aef76c03bd6a3d25ea5826110bf4803b561b811cc8726
b13ba298064a23f96a0cae5c50b57347457cd3bba2c1f6c6ee05e4c8ca291f37
b2b65e764ab1eecf61131576723c1edf64244315895b447e1a68f4a34ff5dd2a
e373b70a5167485c73a265421bcfcd1fdddbae49c9c51605e6d2918a3de4ae0d
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f7767255793ee9c0c1f9ca94a78a2289c11938aee7a9608a1a38b6b60e2bfb48
fb30c087b995cce523d8488af03c1f6d58b7876626584796e4c5381094a4422c