unisvvap.store Open in urlscan Pro
2a00:f940:2:2:1:4:0:112 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://unlswap.store/exchange
Effective URL:
https://unisvvap.store/
Submission: On December 17 via api (December 17th 2021, 8:04:11 am UTC) from JP — Scanned from JP

Summary HTTP 8 Redirects Links 7 Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 8 HTTP transactions. The main IP is 2a00:f940:2:2:1:4:0:112, located in Russian Federation and belongs to AS-REG, RU. The main domain is unisvvap.store.
TLS certificate: Issued by GlobalSign GCC R3 DV TLS CA 2020 on December 14th 2021. Valid for: a year.

This is the only time unisvvap.store was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Uniswap (Crypto Exchange)

Domain & IP information

	IP Address	AS Autonomous System
1 1	185.179.190.34 185.179.190.34	44094 (WEBHOST1-AS) (WEBHOST1-AS)
7	2a00:f940:2:2... 2a00:f940:2:2:1:4:0:112	197695 (AS-REG) (AS-REG)
1	91.215.155.5 91.215.155.5	59729 (ITL-BG) (ITL-BG)
8	3

1 185.179.190.34 (Russian Federation) 1 redirects

ASN44094 (WEBHOST1-AS, RU)
PTR: static.34.190.179.185.ip.webhost1.net

unlswap.store	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:f940:2:2:1:4:0:112 (Russian Federation)

ASN197695 (AS-REG, RU)

unisvvap.store	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 91.215.155.5 (Sofia, Bulgaria)

ASN59729 (ITL-BG, UA)
PTR: hmara69828.vds

mrproper.tk	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	unisvvap.store unisvvap.store	361 KB
1	mrproper.tk mrproper.tk	2 KB
1	unlswap.store 1 redirects unlswap.store	794 B
8	3

	Domain	Requested by
7	unisvvap.store	unisvvap.store
1	mrproper.tk	unisvvap.store
1	unlswap.store	1 redirects
8	3

This site contains links to these domains. Also see Links.

Domain
uniswap-fath.tech
info.uniswap.org
etherscan.io
www.youtube.com

Subject Issuer	Validity	Valid
www.unisvvap.store GlobalSign GCC R3 DV TLS CA 2020	`2021-12-14` - `2023-01-15`	a year	crt.sh
mrproper.tk R3	`2021-10-22` - `2022-01-20`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://unisvvap.store/
Frame ID: 6FBA6A8A8CD0E7B0B721FD5C2B7FBAEF
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Uniswap Interfacelogo

Page URL History Show full URLs

https://unlswap.store/exchange HTTP 302
https://unisvvap.store/ Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

8
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

363 kB
Transfer

500 kB
Size

2
Cookies

7 Outgoing links

These are links going to different origins than the main page.

URL: https://uniswap-fath.tech/
Title: logo

Search URL Search Domain Scan URL

URL: https://uniswap-fath.tech/#/swap
Title: Swap

Search URL Search Domain Scan URL

URL: https://uniswap-fath.tech/#/pool
Title: Pool

Search URL Search Domain Scan URL

URL: https://uniswap-fath.tech/#/vote
Title: Vote

Search URL Search Domain Scan URL

URL: https://info.uniswap.org/#/
Title: Chartsâ†—

Search URL Search Domain Scan URL

URL: https://etherscan.io/block/13434506
Title: 13434506â€‚

Search URL Search Domain Scan URL

URL: https://www.youtube.com/watch?v=lT_aEnx0-wY
Title: Learn how to connect

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://unlswap.store/exchange HTTP 302
https://unisvvap.store/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response unisvvap.store/ Redirect Chain https://unlswap.store/exchange https://unisvvap.store/	94 KB 24 KB	1575ms 1066ms	Document text/html	2a00:f940:2:2:1:4:0:112 AS-REG
General Check archive.org Show headers Download Go to Full URL https://unisvvap.store/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a00:f940:2:2:1:4:0:112 , Russian Federation, ASN197695 (AS-REG, RU), Reverse DNS Software nginx / Resource Hash `2f352ed76a13d59f8903e515b69373a4d4a6338e73cb3063cec94712d9822f5d` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Accept-Language jp-JP,jp;q=0.9 Response headers server nginx date Fri, 17 Dec 2021 08:04:05 GMT content-type text/html last-modified Thu, 16 Dec 2021 20:50:42 GMT content-encoding gzip Redirect headers Server nginx Date Fri, 17 Dec 2021 08:04:04 GMT Content-Type text/html; charset=UTF-8 Content-Length 0 Connection keep-alive Cache-Control no-cache, no-store, must-revalidate,post-check=0,pre-check=0 Expires 0 Last-Modified Fri, 17 Dec 2021 08:04:04 GMT Location https://unisvvap.store/ Pragma no-cache Vary Accept-Encoding Access-Control-Allow-Origin *
GET H2	200	JHZ1XJ Show response unisvvap.store/	3 KB 3 KB	844ms 843ms	Script text/plain	2a00:f940:2:2:1:4:0:112 AS-REG
General Check archive.org Show headers Download Go to Full URL https://unisvvap.store/JHZ1XJ Requested by Host: unisvvap.store URL: https://unisvvap.store/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a00:f940:2:2:1:4:0:112 , Russian Federation, ASN197695 (AS-REG, RU), Reverse DNS Software nginx / Resource Hash `3cc4d2019d09cfeb52c4ce96c88c026320f80076ec3c471ba0778004ec981342` Request headers Accept-Language jp-JP,jp;q=0.9 Referer https://unisvvap.store/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Fri, 17 Dec 2021 08:04:07 GMT last-modified Tue, 14 Dec 2021 13:40:22 GMT server nginx accept-ranges bytes content-length 3340
GET H2	200	JHZ1XJ_1 Show response unisvvap.store/	3 KB 3 KB	843ms 842ms	Script text/plain	2a00:f940:2:2:1:4:0:112 AS-REG
General Check archive.org Show headers Download Go to Full URL https://unisvvap.store/JHZ1XJ_1 Requested by Host: unisvvap.store URL: https://unisvvap.store/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a00:f940:2:2:1:4:0:112 , Russian Federation, ASN197695 (AS-REG, RU), Reverse DNS Software nginx / Resource Hash `9f129631d730392a770e6506c5877b480bde05b5bcfa8d9a4721b780285b2e7c` Request headers Accept-Language jp-JP,jp;q=0.9 Referer https://unisvvap.store/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Fri, 17 Dec 2021 08:04:07 GMT last-modified Tue, 14 Dec 2021 13:40:22 GMT server nginx accept-ranges bytes content-length 3340
GET H2	200	35.83e03661.chunk.css unisvvap.store/css/	5 KB 964 B	844ms 844ms	Stylesheet text/css	2a00:f940:2:2:1:4:0:112 AS-REG
General Check archive.org Show headers Download Go to Full URL https://unisvvap.store/css/35.83e03661.chunk.css Requested by Host: unisvvap.store URL: https://unisvvap.store/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a00:f940:2:2:1:4:0:112 , Russian Federation, ASN197695 (AS-REG, RU), Reverse DNS Software nginx / Resource Hash `dfff2110fcc584be300e2e9f7c4c039fbdeba1b9b3aaa3428c2fb8fbf4f249b0` Request headers Accept-Language jp-JP,jp;q=0.9 Referer https://unisvvap.store/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Fri, 17 Dec 2021 08:04:07 GMT content-encoding gzip last-modified Tue, 14 Dec 2021 13:40:22 GMT server nginx content-type text/css
GET H2	200	e77dabfada86ed1c3b850a800b435e9fd1a6a8c4.png unisvvap.store/images/	4 KB 4 KB	417ms 417ms	Image image/png	2a00:f940:2:2:1:4:0:112 AS-REG
General Check archive.org Show headers Download Go to Show image Full URL https://unisvvap.store/images/e77dabfada86ed1c3b850a800b435e9fd1a6a8c4.png Requested by Host: unisvvap.store URL: https://unisvvap.store/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a00:f940:2:2:1:4:0:112 , Russian Federation, ASN197695 (AS-REG, RU), Reverse DNS Software nginx / Resource Hash `cc1944a3d800b5cbede23e8acdf984598757033c891d54fbfdaab6f0644b4e32` Request headers Accept-Language jp-JP,jp;q=0.9 Referer https://unisvvap.store/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Fri, 17 Dec 2021 08:04:07 GMT last-modified Tue, 14 Dec 2021 13:40:32 GMT server nginx accept-ranges bytes content-length 3954 content-type image/png
GET H2	200	jquery.min.js Show response unisvvap.store/	94 KB 33 KB	267ms 267ms	Script application/javascript	2a00:f940:2:2:1:4:0:112 AS-REG
General Check archive.org Show headers Download Go to Full URL https://unisvvap.store/jquery.min.js Requested by Host: unisvvap.store URL: https://unisvvap.store/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a00:f940:2:2:1:4:0:112 , Russian Federation, ASN197695 (AS-REG, RU), Reverse DNS Software nginx / Resource Hash `aec3d419d50f05781a96f223e18289aeb52598b5db39be82a7b71dc67d6a7947` Request headers Accept-Language jp-JP,jp;q=0.9 Referer https://unisvvap.store/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Fri, 17 Dec 2021 08:04:07 GMT content-encoding gzip last-modified Tue, 14 Dec 2021 13:40:22 GMT server nginx content-type application/javascript
GET DATA	200 OK	truncated Show response /	2 KB 0		Script text/javascript
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `09612ab78535d8b10659b3b0a3874d1cb4091ea8788d45c434bae15f372c0efa` Request headers Accept-Language jp-JP,jp;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Content-Type text/javascript
GET H/1.1	200 OK	JHZ1XJ Show response mrproper.tk/	3 KB 2 KB	858ms 301ms	Script application/javascript	91.215.155.5 ITL-BG
General Check archive.org Show headers Download Go to Full URL https://mrproper.tk/JHZ1XJ?return=js.client&&se_referrer=&default_keyword=&landing_url=unisvvap.store%2F&name=_TDC94YTYGhCHYLbr&host=https%3A%2F%2Fmrproper.tk%2FJHZ1XJ Requested by Host: unisvvap.store URL: https://unisvvap.store/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 91.215.155.5 Sofia, Bulgaria, ASN59729 (ITL-BG, UA), Reverse DNS hmara69828.vds Software nginx / Resource Hash `197c2d85538041583173d6d4547b21dcb33d16de18ff35cfb38f97014d82d58d` Request headers Accept-Language jp-JP,jp;q=0.9 Referer https://unisvvap.store/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Fri, 17 Dec 2021 08:04:08 GMT Content-Encoding gzip Server nginx Vary Accept-Encoding Content-Type application/javascript; charset=UTF-8 Access-Control-Allow-Origin * Connection keep-alive Content-Length 1353
GET H2	200	Inter-roman.var.woff2 unisvvap.store/fonts/	292 KB 292 KB	413ms 413ms	Font font/woff2	2a00:f940:2:2:1:4:0:112 AS-REG
General Check archive.org Show headers Download Go to Full URL https://unisvvap.store/fonts/Inter-roman.var.woff2 Requested by Host: unisvvap.store URL: https://unisvvap.store/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a00:f940:2:2:1:4:0:112 , Russian Federation, ASN197695 (AS-REG, RU), Reverse DNS Software nginx / Resource Hash `05029490712ad5a909a96ceb8d97791a148ed63c86f7dba26903853733dd1917` Request headers Referer https://unisvvap.store/ Origin https://unisvvap.store Accept-Language jp-JP,jp;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Fri, 17 Dec 2021 08:04:07 GMT last-modified Tue, 14 Dec 2021 13:40:29 GMT server nginx accept-ranges bytes content-length 299043 content-type font/woff2

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Uniswap (Crypto Exchange)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			unlswap.store/	1970-01-20 00:13:26	Name: _subid Value: 1c0r4fg2if
			unlswap.store/	1970-02-07 22:59:02	Name: 5bf00 Value: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjM3XCI6MTYzOTcyODI0NH0sXCJjYW1wYWlnbnNcIjp7XCIxOFwiOjE2Mzk3MjgyNDR9LFwidGltZVwiOjE2Mzk3MjgyNDR9In0.lBswHUcXTjhqLopVilTL-3ahstdsUlad7_LrcdLy5gI

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	URL: https://unisvvap.store/ Message: Failed to decode downloaded font: https://unisvvap.store/fonts/Inter-roman.var.woff2
other	warning	URL: https://unisvvap.store/ Message: OTS parsing error: invalid sfntVersion: 1008821359
other	warning	URL: https://unisvvap.store/ Message: Failed to decode downloaded font: https://unisvvap.store/fonts/Inter-roman.var.woff2
other	warning	URL: https://unisvvap.store/ Message: OTS parsing error: invalid sfntVersion: 1008821359

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

mrproper.tk
unisvvap.store
unlswap.store
185.179.190.34
2a00:f940:2:2:1:4:0:112
91.215.155.5
05029490712ad5a909a96ceb8d97791a148ed63c86f7dba26903853733dd1917
09612ab78535d8b10659b3b0a3874d1cb4091ea8788d45c434bae15f372c0efa
197c2d85538041583173d6d4547b21dcb33d16de18ff35cfb38f97014d82d58d
2f352ed76a13d59f8903e515b69373a4d4a6338e73cb3063cec94712d9822f5d
3cc4d2019d09cfeb52c4ce96c88c026320f80076ec3c471ba0778004ec981342
9f129631d730392a770e6506c5877b480bde05b5bcfa8d9a4721b780285b2e7c
aec3d419d50f05781a96f223e18289aeb52598b5db39be82a7b71dc67d6a7947
cc1944a3d800b5cbede23e8acdf984598757033c891d54fbfdaab6f0644b4e32
dfff2110fcc584be300e2e9f7c4c039fbdeba1b9b3aaa3428c2fb8fbf4f249b0

unisvvap.store Open in urlscan Pro 2a00:f940:2:2:1:4:0:112 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

8 Requests

100 %HTTPS

33 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

363 kBTransfer

500 kBSize

2 Cookies

7 Outgoing links

Page URL History

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

7 JavaScript Global Variables

2 Cookies

4 Console Messages

Indicators

unisvvap.store Open in urlscan Pro
2a00:f940:2:2:1:4:0:112 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

363 kB
Transfer

500 kB
Size

2
Cookies

8 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!