set-coinbase.com
Open in
urlscan Pro
188.114.96.3
Malicious Activity!
Public Scan
Submission Tags: @phish_report
Submission: On October 24 via api from FI — Scanned from NL
Summary
TLS certificate: Issued by WE1 on October 21st 2024. Valid for: 3 months.
This is the only time set-coinbase.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Cloudflare (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
4 20 | 188.114.96.3 188.114.96.3 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
4 | 104.18.40.68 104.18.40.68 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
3 | 172.217.18.100 172.217.18.100 | 15169 (GOOGLE) (GOOGLE) | |
1 | 151.101.2.137 151.101.2.137 | 54113 (FASTLY) (FASTLY) | |
1 | 216.58.212.131 216.58.212.131 | 15169 (GOOGLE) (GOOGLE) | |
1 | 104.18.35.15 104.18.35.15 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
26 | 6 |
ASN15169 (GOOGLE, US)
PTR: zrh04s05-in-f100.1e100.net
www.google.com |
ASN15169 (GOOGLE, US)
PTR: ams15s21-in-f131.1e100.net
www.gstatic.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
20 |
set-coinbase.com
4 redirects
set-coinbase.com |
970 KB |
4 |
fontawesome.com
site-assets.fontawesome.com — Cisco Umbrella Rank: 60742 |
95 KB |
3 |
google.com
www.google.com — Cisco Umbrella Rank: 3 |
595 B |
1 |
coinbase.com
login.coinbase.com — Cisco Umbrella Rank: 47652 |
2 KB |
1 |
gstatic.com
www.gstatic.com |
216 KB |
1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 791 |
82 KB |
26 | 6 |
Domain | Requested by | |
---|---|---|
20 | set-coinbase.com |
4 redirects
set-coinbase.com
code.jquery.com |
4 | site-assets.fontawesome.com |
set-coinbase.com
|
3 | www.google.com |
set-coinbase.com
www.gstatic.com |
1 | login.coinbase.com | |
1 | www.gstatic.com |
www.google.com
|
1 | code.jquery.com |
set-coinbase.com
|
26 | 6 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
set-coinbase.com WE1 |
2024-10-21 - 2025-01-19 |
3 months | crt.sh |
*.fontawesome.com DigiCert Global G2 TLS RSA SHA256 2020 CA1 |
2024-07-30 - 2025-01-27 |
6 months | crt.sh |
*.google.com WR2 |
2024-10-07 - 2024-12-30 |
3 months | crt.sh |
*.jquery.com Sectigo ECC Domain Validation Secure Server CA |
2024-06-25 - 2025-06-25 |
a year | crt.sh |
*.gstatic.com WR2 |
2024-10-07 - 2024-12-30 |
3 months | crt.sh |
coinbase.com WE1 |
2024-10-04 - 2025-01-02 |
3 months | crt.sh |
This page contains 4 frames:
Primary Page:
https://set-coinbase.com/captcha
Frame ID: 541B742E12E420AEBD74BC5EA3A68115
Requests: 22 HTTP requests in this frame
Frame:
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Le-wvkSAAAAAPBMRTvw0Q4Muexq9bi0DJwx_mJ-&co=aHR0cHM6Ly9zZXQtY29pbmJhc2UuY29tOjQ0Mw..&hl=nl&v=lqsTZ5beIbCkK4uGEGv9JmUR&theme=dark&size=normal&cb=d59ttr3aljxn
Frame ID: D45627950E6B3E9E14B03605078CE842
Requests: 1 HTTP requests in this frame
Frame:
https://set-coinbase.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/f2bbd6738e15/main.js
Frame ID: B89320C8B21E40F55D39A3AA6D3CD74B
Requests: 2 HTTP requests in this frame
Frame:
https://www.google.com/recaptcha/api2/bframe?hl=nl&v=lqsTZ5beIbCkK4uGEGv9JmUR&k=6Le-wvkSAAAAAPBMRTvw0Q4Muexq9bi0DJwx_mJ-
Frame ID: 9275C920F1C056E8C4EFB1AD39740636
Requests: 1 HTTP requests in this frame
Screenshot
Page Title
Coinbase - ProcessingPage URL History Show full URLs
- https://set-coinbase.com/captcha Page URL
-
https://set-coinbase.com/cdn-cgi/phish-bypass?atok=hSsBt9P7n3iySo2t29.0F6xNgJw1R43J47qiSgrF1Hs-172973...
HTTP 301
https://set-coinbase.com/captcha HTTP 302
https://set-coinbase.com/ HTTP 302
https://set-coinbase.com/captcha Page URL
Detected technologies
Font Awesome (Font Scripts) ExpandDetected patterns
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
reCAPTCHA (Captchas) Expand
Detected patterns
- /recaptcha/api\.js
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://set-coinbase.com/captcha Page URL
-
https://set-coinbase.com/cdn-cgi/phish-bypass?atok=hSsBt9P7n3iySo2t29.0F6xNgJw1R43J47qiSgrF1Hs-1729730653-0.0.1.1-%2Fcaptcha
HTTP 301
https://set-coinbase.com/captcha HTTP 302
https://set-coinbase.com/ HTTP 302
https://set-coinbase.com/captcha Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 20- https://set-coinbase.com/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
- https://set-coinbase.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/f2bbd6738e15/main.js
26 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H3 |
captcha
set-coinbase.com/ |
4 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
cf.errors.css
set-coinbase.com/cdn-cgi/styles/ |
23 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
icon-exclamation.png
set-coinbase.com/cdn-cgi/images/ |
452 B 634 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
favicon.ico
set-coinbase.com/ |
4 KB 2 KB |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
Primary Request
captcha
set-coinbase.com/ Redirect Chain
|
28 KB 8 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
main.255f49919c8959b92ec5.js.download
set-coinbase.com/assets/ |
838 KB 839 KB |
Script
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
styles.b1a6701d26421d7ef17e.css
set-coinbase.com/assets/ |
99 KB 19 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
styles.9c6065ade6c124942da3.css
set-coinbase.com/assets/ |
3 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
style
set-coinbase.com/assets/ |
533 B 1 KB |
Stylesheet
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
all.css
site-assets.fontawesome.com/releases/v6.4.2/css/ |
500 KB 94 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sharp-solid.css
site-assets.fontawesome.com/releases/v6.4.2/css/ |
549 B 490 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sharp-regular.css
site-assets.fontawesome.com/releases/v6.4.2/css/ |
557 B 474 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sharp-light.css
site-assets.fontawesome.com/releases/v6.4.2/css/ |
549 B 619 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
api.js
www.google.com/recaptcha/ |
870 B 595 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.7.1.js
code.jquery.com/ |
279 KB 82 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
functions.js
set-coinbase.com/assets/js/ |
2 KB 2 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
recaptcha__nl.js
www.gstatic.com/recaptcha/releases/lqsTZ5beIbCkK4uGEGv9JmUR/ |
545 KB 216 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
update_status
set-coinbase.com/api/ |
0 777 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
8a6a40a08f92d9a9b3e5.woff2
set-coinbase.com/assets/fonts/ |
39 KB 40 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
71371380d08a07cda58a.woff2
set-coinbase.com/assets/fonts/ |
40 KB 40 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
anchor
www.google.com/recaptcha/api2/ Frame D456 |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
main.js
set-coinbase.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/f2bbd6738e15/ Frame B893 Redirect Chain
|
8 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
8d75f0057e3b1c8e
set-coinbase.com/cdn-cgi/challenge-platform/h/g/jsd/r/ Frame B893 |
0 1 KB |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
favicon.ico
login.coinbase.com/ |
557 B 2 KB |
Other
image/vnd.microsoft.icon |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
bframe
www.google.com/recaptcha/api2/ Frame 9275 |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
update_status
set-coinbase.com/api/ |
0 769 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Cloudflare (Online)20 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| 1 object| 2 object| 3 object| ___grecaptcha_cfg object| grecaptcha string| __recaptcha_api boolean| __google_recaptcha_client function| $ function| jQuery function| url function| message function| updateUserStatus function| handleUnexpectedDisconnect function| handleKeyPress function| handleBeforeUnload function| onCaptchaSuccess object| recaptcha object| closure_lm_840096 object| webpackChunk_app_unified_login5 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.set-coinbase.com/ | Name: __cf_mw_byp Value: hSsBt9P7n3iySo2t29.0F6xNgJw1R43J47qiSgrF1Hs-1729730653-0.0.1.1-/captcha |
|
set-coinbase.com/ | Name: PHPSESSID Value: 352fc55ba9923e609ce0227cfcd99213 |
|
set-coinbase.com/ | Name: csrf_token Value: l6uE9h%2FAvnL7qP%2BrvB6MITPcyZ8jncWF1WyHjZ%2Fa9XuOoWGF5tyrAq8MqLxN8J5HJHtWhuXA%2BehZix7tXg4OeVvujitdeDaXzne9MWQ7NE4vevBV52uwzasHW3CD416kNM6PDOQOfgVdfYCN1cDArBtoxH%2FYzZztpMoq6nywYTQ%3D |
|
.set-coinbase.com/ | Name: cf_clearance Value: np61G535M.OlqyUg.WTkrTNm6bHbPfIW32OgXrDjt1M-1729730659-1.2.1.1-FzH9be_Wh9i9Kgqd8k5jogZ5V3CC1fAqDiaE2f23gJSpOnY_OCBFWRE8YHE42dp.vZ.OW4eh5lDJzA5E8ZaLoDV2P6ZpSfHY8k6Yhrk6LfSNHhSqYM2DJKDd9AIFIhJcWXmxqDSYJtydXIKHvVh41I1AngtbhBr1AnPmDHCzgpq2re4acj0GQjyzTgDlE4Pz6rfqhCx4DEICeRUl.br8b7__GQwXC_ZSy8BeBxkTPm8.b.uDgZzL5PlypMKx3w7JqvWWIBtHfQ5N6d_Hrs6AHzx5fBbaxvgsr_dCfGzAkrM8q6Cg3jmdSoW8gO0644rZdfiwFF8ZeemNojr.0645dJ_GA4aEPSZoDXKlBsdq1KZ9S4YespYacLH.Xy3gOmZLvLdM6Anf8g6Ba9_Mea83ugVb8Gh5XC8Mex62b..agGU |
|
.coinbase.com/ | Name: __cf_bm Value: o45H45qKzdyw8LaSNkNULgMdtawVJfrCVt0IhaFSmtk-1729730659-1.0.1.1-tSyUVDfhBSgtXj2xUnztfYwGVAtnX_G8TXsLpUwCI3vO9uySBmCLsMwdbVeeh0bJYZ._O9F9zKyR_sxLcWGfiQ |
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Frame-Options | SAMEORIGIN |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
code.jquery.com
login.coinbase.com
set-coinbase.com
site-assets.fontawesome.com
www.google.com
www.gstatic.com
104.18.35.15
104.18.40.68
151.101.2.137
172.217.18.100
188.114.96.3
216.58.212.131
1c4e7e389d73c6acf7f19cc812514e71230740791fde8a018c1d7edccf1590ae
21f5a60699b7829691322433f1ef442670b177124792b98dca8a59c37953acd2
426199deb52131112ca61c116b47f6f5ff60bcf4f0d5ea829c95b248fbd677ae
551ffa2dd3ebaa4a56a94e7ad2d175a557200f0cfe6a509ccd7a2a6f5ba785c1
5db56ddf9ab991fc7a3a5b188b6b0c92331213ec4991b71d9821c36dcbcdb687
61334b516a83f99977a4e42711acb6801e7ec9811236bc4870c838e3ea3d0607
68fc09a77a891ec12a8cc7c91e5f6f25fd9b331ec7ac02023fecf97758ec18ed
6dbc483abefa6ffac46cd50f33215cba1e61baf86015b83019f5d7987c748cdd
78a85aca2f0b110c29e0d2b137e09f0a1fb7a8e554b499f740d6744dc8962cfe
84e3c77025ace5af143972b4a40fc834dcdfd4e449d4b36a57e62326f16b3091
8c892e169dab0f0b09d24bf6e208baedc0cf5e3d0e583d9d9df8a0ad6378813e
9a41ab1c9a5cbef5a837098c3aa5d57bcc97ab398aade353d28ef7b4fea65ec4
9ce6f2323fb7d6b57b8259e89b64bee168b6fbeaeb417bfe646b4ff46cc14f7c
a1c4b4e7735fc2f845f5399e6d9c3e35b1da4cd8379c62f3beeca72f4b0e2237
a1f75e7f702059493bb74cfcb3178d095b3f6da4d313e92b3ceabc3e63eb914c
a32d4ddd26c315decb710b3db38d9268171f4a209c719196c2b02677648f5fb8
ae3908dc1c12792d4099ff66b74d932952030816d8b45ec227a606c0d5caf7fc
b90cdcbe9e842bf371d9c5e7dd13359fde26879a4642ad6f752e86a65fab4fb5
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
eb60aa29b04ea10878e51153ac1d4d5812e42bc2d6b7992fc0ce0c7cfefc937b
f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016
f5044ae8cd744eb4bb6a0741f4ce3b8b41145e460aea7205fb198005d10a0bde