coiinbase.coimnvbase.com Open in urlscan Pro
2606:4700:3037::ac43:baa7 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://coiinbase.coimnvbase.com/
Effective URL:
https://coiinbase.coimnvbase.com/
Submission: On April 08 via api (April 8th 2024, 2:47:32 pm UTC) from US — Scanned from DE

Summary HTTP 12 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 3 countries across 2 domains to perform 12 HTTP transactions. The main IP is 2606:4700:3037::ac43:baa7, located in United States and belongs to CLOUDFLARENET, US. The main domain is coiinbase.coimnvbase.com.
TLS certificate: Issued by GTS CA 1P5 on March 6th 2024. Valid for: 3 months.

This is the only time coiinbase.coimnvbase.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Coinbase (Crypto Exchange)

Domain & IP information

	IP Address	AS Autonomous System
7	2606:4700:303... 2606:4700:3037::ac43:baa7	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2.16.1.171 2.16.1.171	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
3	2.17.147.122 2.17.147.122	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2.17.147.121 2.17.147.121	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
12	4

7 2606:4700:3037::ac43:baa7 (United States)

ASN13335 (CLOUDFLARENET, US)

coiinbase.coimnvbase.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.16.1.171 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a2-16-1-171.deploy.static.akamaitechnologies.com

cdn.livechatinc.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2.17.147.122 (Prague, Czech Republic)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a2-17-147-122.deploy.static.akamaitechnologies.com

api.livechatinc.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.17.147.121 (Prague, Czech Republic)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a2-17-147-121.deploy.static.akamaitechnologies.com

secure.livechatinc.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	coimnvbase.com coiinbase.coimnvbase.com	62 KB
5	livechatinc.com cdn.livechatinc.com — Cisco Umbrella Rank: 5706 api.livechatinc.com — Cisco Umbrella Rank: 5118 secure.livechatinc.com — Cisco Umbrella Rank: 6405	33 KB
12	2

	Domain	Requested by
7	coiinbase.coimnvbase.com	coiinbase.coimnvbase.com
3	api.livechatinc.com	cdn.livechatinc.com
1	secure.livechatinc.com	cdn.livechatinc.com
1	cdn.livechatinc.com	coiinbase.coimnvbase.com
12	4

This site contains no links.

Subject Issuer	Validity	Valid
coimnvbase.com GTS CA 1P5	`2024-03-06` - `2024-06-04`	3 months	crt.sh
livechat.com DigiCert TLS RSA SHA256 2020 CA1	`2024-01-31` - `2025-01-31`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://coiinbase.coimnvbase.com/
Frame ID: 46193FD945E4F6D556607395AABF4886
Requests: 11 HTTP requests in this frame

Frame: https://secure.livechatinc.com/customer/action/open_chat?license_id=17359248&group=0&embedded=1&widget_version=3&unique_groups=0
Frame ID: CC1213316F8404D3DF36BFF601038636
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Coinbase - Sign In

Page URL History Show full URLs

http://coiinbase.coimnvbase.com/ HTTP 307
https://coiinbase.coimnvbase.com/ Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

LiveChat (Live Chat) Expand

Overall confidence: 100%
Detected patterns

cdn\.livechatinc\.com/.*tracking\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

12
Requests

100 %
HTTPS

25 %
IPv6

2
Domains

4
Subdomains

4
IPs

3
Countries

95 kB
Transfer

345 kB
Size

5
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://coiinbase.coimnvbase.com/ HTTP 307
https://coiinbase.coimnvbase.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3

200

Primary Request / Show response
coiinbase.coimnvbase.com/
Redirect Chain

http://coiinbase.coimnvbase.com/
https://coiinbase.coimnvbase.com/

21 KB
4 KB

165ms
126ms

Document
text/html

2606:4700:3037::ac43:baa7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://coiinbase.coimnvbase.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3037::ac43:baa7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a378112e9f4c16f29e99abe0272e565d36af38fb61447761f0ebbea52d7854ea

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 87130d7dac94924d-FRA
content-encoding: br
content-type: text/html
date: Mon, 08 Apr 2024 14:47:27 GMT
last-modified: Wed, 03 Apr 2024 16:00:19 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jopjruNlz30zGTA8Y72Uu9LGnWyCwdBJeQxQlDoUQopyN4cKUeSuC%2F%2BQTIFUDiZeZZbmVKLvW9m13sjoLjA3Ohcm4MzD7a7JeMKYGJ0m6BxDtk2KbHfn9YpGVnBA2evHSWF6QVRW9e1AhKiMHNQ63qpUTqVXrCA%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

Redirect headers

Location: https://coiinbase.coimnvbase.com/
Non-Authoritative-Reason: HttpsUpgrades

GET
H3 200 bootstrap.min.css
coiinbase.coimnvbase.com/css/ 122 KB
20 KB 451ms
451ms Stylesheet
text/css 2606:4700:3037::ac43:baa7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://coiinbase.coimnvbase.com/css/bootstrap.min.css
Requested by: Host: coiinbase.coimnvbase.com
URL: https://coiinbase.coimnvbase.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3037::ac43:baa7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9bf87f7140c085febf881462c536ee73cf9183670811342d3dc1fd0f7a762a0d

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://coiinbase.coimnvbase.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 08 Apr 2024 14:47:28 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 03 Apr 2024 16:00:48 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"1e822-61533537f6f71"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0ETJO%2BjoIRNDEwV%2BnAfzmuS8Z6LHO0X8OWaTXePEj9eI3a7utrFscFITNeWAubVsbhSlUb%2BfcWtdh%2B3toAbsVTpuZx%2Bu74QZaOe%2FMjdcdfKNXl2FLbeAOoBepcw4lu9O9yf2hs0pLyVNy8%2FJqhQDh3X3yOPdzUo%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
cf-ray: 87130d7e7d3f924d-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 style.css
coiinbase.coimnvbase.com/css/ 6 KB
2 KB 377ms
376ms Stylesheet
text/css 2606:4700:3037::ac43:baa7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://coiinbase.coimnvbase.com/css/style.css
Requested by: Host: coiinbase.coimnvbase.com
URL: https://coiinbase.coimnvbase.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3037::ac43:baa7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3dcb2e09768e40337da6067090f9410b7c6fc8fdefe031c4cd87d50b5c966b90

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://coiinbase.coimnvbase.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 08 Apr 2024 14:47:28 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 03 Apr 2024 16:00:46 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"19be-6153353607d78"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jOtfsuwuGSqLaJQXk9Hkfe%2BQi3guxa%2BDsjjic4iZUe6TLECtVD1BL%2FdyzCtrKKDjS1QurGVtmoeIrmrMxzU2DXmCtgWM9tWdrLIoH3u2S1byTBM6wgdC35wG28fozY8htTwuANQuUe21aRHPobXh3HTLWfx2FsE%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
cf-ray: 87130d7e7d41924d-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 404 font-awesome.min.css
coiinbase.coimnvbase.com/cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/ 0
0 415ms
414ms Stylesheet
text/html 2606:4700:3037::ac43:baa7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://coiinbase.coimnvbase.com/cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css
Requested by: Host: coiinbase.coimnvbase.com
URL: https://coiinbase.coimnvbase.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3037::ac43:baa7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://coiinbase.coimnvbase.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 08 Apr 2024 14:47:28 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ljg9%2BY%2B1iuZsJpmRwZP9LNKyoskOKckzoNKMzig1dTKYfU8Wlrt%2Fhs60ewH7hozaOCpZMv491Kncdd4bDE4V5Yk007YD2S4gVSUmk%2FYh4kwAZU4kVqPAwm8Xk2eDz9HdhsFadIdJclkN3OGjLy6I5Ycgf9mL5K8%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html; charset=iso-8859-1
cache-control: max-age=14400
cf-ray: 87130d7e7d42924d-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 mail.png
coiinbase.coimnvbase.com/img/ 2 KB
3 KB 124ms
123ms Image
image/png 2606:4700:3037::ac43:baa7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://coiinbase.coimnvbase.com/img/mail.png
Requested by: Host: coiinbase.coimnvbase.com
URL: https://coiinbase.coimnvbase.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3037::ac43:baa7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d410b76d060ecc345f18fe5f84f4ec6f6d7b31b03e83117a064a1aedcb7e7dfd

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://coiinbase.coimnvbase.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 08 Apr 2024 14:47:27 GMT
cf-cache-status: HIT
last-modified: Wed, 03 Apr 2024 16:00:33 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "834-6153352966673"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jNwr85HcYGH3YXInFER1qeamR8etDW6JeiijPWShm6jjJVKb4%2F3ettOnV4o9rMcJ30J5qT3SVbBilXzCKv33WLDBbzSzDrwghgzvCyFDmf44DtMQW8qYCTkIfmUoAkX9ATH2hmV8b5UcyyPgsHXPwUlYyAVyu%2BU%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 87130d7e7d43924d-FRA
alt-svc: h3=":443"; ma=86400
content-length: 2100

GET
H3 200 jquery.min.js Show response
coiinbase.coimnvbase.com/js/ 88 KB
32 KB 406ms
405ms Script
text/javascript 2606:4700:3037::ac43:baa7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://coiinbase.coimnvbase.com/js/jquery.min.js
Requested by: Host: coiinbase.coimnvbase.com
URL: https://coiinbase.coimnvbase.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3037::ac43:baa7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a6f3f0faea4b3d48e03176341bef0ed3151ffbf226d4c6635f1c6039c0500575

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://coiinbase.coimnvbase.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 08 Apr 2024 14:47:28 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 03 Apr 2024 16:00:33 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"15f5b-615335291364f"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Fwn%2FOHLH6uDQUPROyIC9Jes3N4ldud19OpKnENIcHfbTwVthG0uOgEqE%2F338nCWAhjfgiN6aDORZ1QhTlO5PH82ysNcyE%2BJJFGWVPtKDYfB9Q0HYbzFN%2FHhqcFMIfHgxNe2W%2FRIW7qJ%2FHHjFqIbfrrcDrLv%2Brks%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript
cache-control: max-age=14400
cf-ray: 87130d7e7d45924d-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 tracking.js Show response
cdn.livechatinc.com/ 89 KB
27 KB 44ms
6ms Script
application/javascript 2.16.1.171
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.livechatinc.com/tracking.js
Requested by: Host: coiinbase.coimnvbase.com
URL: https://coiinbase.coimnvbase.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.16.1.171 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a2-16-1-171.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 3881f1d6786c233140b2dbafc3bd238d13dcd1bb0342a5db9cb5db4fb811a8cf

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://coiinbase.coimnvbase.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-amz-version-id: oDcbkIR6opYIMfk8jmAc68pwKRNH2vUW
content-encoding: br
date: Mon, 08 Apr 2024 14:47:28 GMT
last-modified: Mon, 08 Apr 2024 11:31:25 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P2
x-amz-server-side-encryption: AES256
etag: W/"1f74924f0af880825bc980547920f6b3"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=28800
x-amz-cf-id: UZfeaAnGhrqgcBQiu-CsMUnBlXCpQdli_lx-ur54f-72UQJMNvR9xg==
content-length: 27473
expires: Mon, 08 Apr 2024 22:47:28 GMT

GET
H2 200 get_dynamic_configuration Show response
api.livechatinc.com/v3.6/customer/action/ 322 B
517 B 952ms
360ms Script
application/javascript 2.17.147.122
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://api.livechatinc.com/v3.6/customer/action/get_dynamic_configuration?license_id=17359248&client_id=c5e4f61e1a6c3b1521b541bc5c5a2ac5&url=https%3A%2F%2Fcoiinbase.coimnvbase.com%2F&channel_type=code&jsonp=__qwf1lowvzx

Requested by

Host: cdn.livechatinc.com
URL: https://cdn.livechatinc.com/tracking.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.17.147.122 Prague, Czech Republic, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a2-17-147-122.deploy.static.akamaitechnologies.com

Software

Resource Hash

5bb8eb9f00691076d4a446d09d33c97af9f2a85a3041c3dbf7deb6645d429f38

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://coiinbase.coimnvbase.com/;
X-Frame-Options	allow-from https://coiinbase.coimnvbase.com/

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://coiinbase.coimnvbase.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-security-policy: frame-ancestors https://coiinbase.coimnvbase.com/;
date: Mon, 08 Apr 2024 14:47:29 GMT
content-length: 322
vary: Accept-Encoding
x-frame-options: allow-from https://coiinbase.coimnvbase.com/
content-type: application/javascript; charset=UTF-8

GET
H2 200 get_configuration Show response
api.livechatinc.com/v3.4/customer/action/ 5 KB
2 KB 394ms
394ms Script
application/javascript 2.17.147.122
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://api.livechatinc.com/v3.4/customer/action/get_configuration?organization_id=bcfe51e9-0315-4fd1-a7ee-b302b02e4c5c&version=35.0.1.1.1.1.1.1.1.1.1.2.1&group_id=0&jsonp=__lc_static_config
Requested by: Host: cdn.livechatinc.com
URL: https://cdn.livechatinc.com/tracking.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.17.147.122 Prague, Czech Republic, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a2-17-147-122.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: fd1c8d12e8c1d9372acae4f4aef5944ca2d07db020d7361347cadf4b790e13b9

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://coiinbase.coimnvbase.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 08 Apr 2024 14:47:29 GMT
content-encoding: gzip
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
legacy: 2024-05-31
cache-control: public, max-age=600
content-length: 1499
expires: Mon, 08 Apr 2024 14:57:29 GMT

GET
H/1.1 200
OK open_chat
secure.livechatinc.com/customer/action/ Frame CC12 0
0 318ms
231ms Document
text/html 2.17.147.121
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.livechatinc.com/customer/action/open_chat?license_id=17359248&group=0&embedded=1&widget_version=3&unique_groups=0
Requested by: Host: cdn.livechatinc.com
URL: https://cdn.livechatinc.com/tracking.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2.17.147.121 Prague, Czech Republic, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a2-17-147-121.deploy.static.akamaitechnologies.com
Software: /
Resource Hash

Request headers

Referer: https://coiinbase.coimnvbase.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-language: de-DE,de;q=0.9
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

Connection: keep-alive
Content-Encoding: gzip
Content-Length: 2616
Content-Type: text/html; charset=utf-8
Date: Mon, 08 Apr 2024 14:47:29 GMT
Vary: Accept-Encoding

GET
H2 200 get_localization Show response
api.livechatinc.com/v3.4/customer/action/ 11 KB
4 KB 365ms
365ms Script
application/javascript 2.17.147.122
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://api.livechatinc.com/v3.4/customer/action/get_localization?organization_id=bcfe51e9-0315-4fd1-a7ee-b302b02e4c5c&version=8b4136637a184fd9fc32b59b8d4ec45a&language=en&group_id=0&jsonp=__lc_localization
Requested by: Host: cdn.livechatinc.com
URL: https://cdn.livechatinc.com/tracking.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.17.147.122 Prague, Czech Republic, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a2-17-147-122.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 10620c905f13a3f3af6a35efe1f9bd38018a6a15e7e6144855aab5c0543a66b6

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://coiinbase.coimnvbase.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 08 Apr 2024 14:47:30 GMT
content-encoding: gzip
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
legacy: 2024-05-31
cache-control: public, max-age=599
content-length: 3894
expires: Mon, 08 Apr 2024 14:57:29 GMT

GET
H3 200 favicon.ico
coiinbase.coimnvbase.com/img/ 557 B
1002 B 367ms
367ms Other
image/x-icon 2606:4700:3037::ac43:baa7
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://coiinbase.coimnvbase.com/img/favicon.ico
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3037::ac43:baa7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b90cdcbe9e842bf371d9c5e7dd13359fde26879a4642ad6f752e86a65fab4fb5

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://coiinbase.coimnvbase.com/
accept-language: de-DE,de;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 08 Apr 2024 14:47:30 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 03 Apr 2024 16:00:30 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"22d-61533526db072"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qW5cG%2F6Wa94253jATuQtAUZKUqRBDivxji0ET1BxfORDXMFZ1X%2B6f%2BUHJMEb0lj53mgWxSaRxY8DML1yJV2t5lSby4ufGThdtCitmbX8dlJF75OKcTb%2B2nw%2FH9wWxPBVrFMNYxf066LSOmPU1HfS5iDDQcGgixM%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/x-icon
cache-control: max-age=14400
cf-ray: 87130d8d5a66924d-FRA
alt-svc: h3=":443"; ma=86400

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Coinbase (Crypto Exchange)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

5 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.accounts.livechatinc.com/v2/customer/token	1970-01-21 05:19:07	Name: __lc_cid Value: bc631538-9701-4a7c-b616-3118abbf675d
.accounts.livechatinc.com/v2/customer/token	1970-01-21 05:19:07	Name: __lc_cst Value: 23f74ce1fa80644d215d00ea83a3ab9a170eff95fc8c14d6861ff7614abe922e9f9ca6ae7e980c3d284d26ff13587a34cdd54f8360a3dee417f394a0edcc
.accounts.livechatinc.com/customer/token	1970-01-21 05:19:07	Name: __lc_cid Value: bc631538-9701-4a7c-b616-3118abbf675d
.accounts.livechatinc.com/customer/token	1970-01-21 05:19:07	Name: __lc_cst Value: 23f74ce1fa80644d215d00ea83a3ab9a170eff95fc8c14d6861ff7614abe922e9f9ca6ae7e980c3d284d26ff13587a34cdd54f8360a3dee417f394a0edcc
accounts.livechatinc.com/	1970-01-20 19:43:07	Name: __oauth_redirect_detector Value: counter=1&t=1712587680&tag=200790e14c75ba0a046ac79cbff9968eb94b99eb

5 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://coiinbase.coimnvbase.com/cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css Message: Failed to load resource: the server responded with a status of 404 ()
recommendation	warning	URL: https://coiinbase.coimnvbase.com/ Message: [DOM] Found 2 elements with non-unique id #password-field: (More info: https://goo.gl/9p2vKq) %o %o
recommendation	verbose	URL: https://coiinbase.coimnvbase.com/ Message: [DOM] Multiple forms should be contained in their own form elements; break up complex forms into ones that represent a single action: (More info: https://goo.gl/9p2vKq) %o
other	warning	URL: https://coiinbase.coimnvbase.com/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://cdn.livechatinc.com/tracking.js Message: The AudioContext was not allowed to start. It must be resumed (or created) after a user gesture on the page. https://goo.gl/7K7WLu

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api.livechatinc.com
cdn.livechatinc.com
coiinbase.coimnvbase.com
secure.livechatinc.com
2.16.1.171
2.17.147.121
2.17.147.122
2606:4700:3037::ac43:baa7
10620c905f13a3f3af6a35efe1f9bd38018a6a15e7e6144855aab5c0543a66b6
3881f1d6786c233140b2dbafc3bd238d13dcd1bb0342a5db9cb5db4fb811a8cf
3dcb2e09768e40337da6067090f9410b7c6fc8fdefe031c4cd87d50b5c966b90
5bb8eb9f00691076d4a446d09d33c97af9f2a85a3041c3dbf7deb6645d429f38
9bf87f7140c085febf881462c536ee73cf9183670811342d3dc1fd0f7a762a0d
a378112e9f4c16f29e99abe0272e565d36af38fb61447761f0ebbea52d7854ea
a6f3f0faea4b3d48e03176341bef0ed3151ffbf226d4c6635f1c6039c0500575
b90cdcbe9e842bf371d9c5e7dd13359fde26879a4642ad6f752e86a65fab4fb5
d410b76d060ecc345f18fe5f84f4ec6f6d7b31b03e83117a064a1aedcb7e7dfd
fd1c8d12e8c1d9372acae4f4aef5944ca2d07db020d7361347cadf4b790e13b9

coiinbase.coimnvbase.com Open in urlscan Pro 2606:4700:3037::ac43:baa7 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

12 Requests

100 %HTTPS

25 %IPv6

2 Domains

4 Subdomains

4 IPs

3 Countries

95 kBTransfer

345 kBSize

5 Cookies

0 Outgoing links

Page URL History

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

9 JavaScript Global Variables

5 Cookies

5 Console Messages

Indicators

coiinbase.coimnvbase.com Open in urlscan Pro
2606:4700:3037::ac43:baa7 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

100 %
HTTPS

25 %
IPv6

2
Domains

4
Subdomains

4
IPs

3
Countries

95 kB
Transfer

345 kB
Size

5
Cookies

12 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!