safeheavenbtc.com
Open in
urlscan Pro
185.61.154.55
Malicious Activity!
Public Scan
Effective URL: https://safeheavenbtc.com/ZDFmediathek/?ci=71&ai=2958198&gi=56&sub=&MPC_1=&MPC_2=&s3=49_690054so=https://topconversion.clu...
Submission: On September 03 via api from BE
Summary
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on March 22nd 2020. Valid for: a year.
This is the only time safeheavenbtc.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Investment Scam (Online) Lion's Den Scam (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 91.217.82.91 91.217.82.91 | 13209 (ATOM-HOSTING) (ATOM-HOSTING) | |
1 | 94.130.176.72 94.130.176.72 | 24940 (HETZNER-AS) (HETZNER-AS) | |
1 1 | 35.241.23.11 35.241.23.11 | 15169 (GOOGLE) (GOOGLE) | |
27 | 185.61.154.55 185.61.154.55 | 22612 (NAMECHEAP...) (NAMECHEAP-NET) | |
1 | 2a00:1450:400... 2a00:1450:4001:800::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 195.201.240.51 195.201.240.51 | 24940 (HETZNER-AS) (HETZNER-AS) | |
1 | 2606:4700:20:... 2606:4700:20::ac43:4824 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2606:4700:303... 2606:4700:3031::681f:459e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
32 | 6 |
ASN24940 (HETZNER-AS, DE)
PTR: static.72.176.130.94.clients.your-server.de
freshgrownhosters.com |
ASN15169 (GOOGLE, US)
PTR: 11.23.241.35.bc.googleusercontent.com
aftr.clqtrk.com |
ASN22612 (NAMECHEAP-NET, US)
PTR: premium61-4.web-hosting.com
safeheavenbtc.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
27 |
safeheavenbtc.com
safeheavenbtc.com |
2 MB |
1 |
best-traffic.club
platform.best-traffic.club |
1 KB |
1 |
trackbox.guru
cdn.trackbox.guru |
62 KB |
1 |
pushwoosh.com
cdn.pushwoosh.com |
98 KB |
1 |
googleapis.com
ajax.googleapis.com |
30 KB |
1 |
clqtrk.com
1 redirects
aftr.clqtrk.com |
439 B |
1 |
freshgrownhosters.com
freshgrownhosters.com |
484 B |
1 |
hzjhealth.org.uk
1 redirects
hzjhealth.org.uk |
308 B |
32 | 8 |
Domain | Requested by | |
---|---|---|
27 | safeheavenbtc.com |
freshgrownhosters.com
safeheavenbtc.com |
1 | platform.best-traffic.club |
ajax.googleapis.com
|
1 | cdn.trackbox.guru |
safeheavenbtc.com
|
1 | cdn.pushwoosh.com |
safeheavenbtc.com
|
1 | ajax.googleapis.com |
safeheavenbtc.com
|
1 | aftr.clqtrk.com | 1 redirects |
1 | freshgrownhosters.com | |
1 | hzjhealth.org.uk | 1 redirects |
32 | 8 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
freshgrownhosters.com Sectigo RSA Domain Validation Secure Server CA |
2020-03-23 - 2021-04-16 |
a year | crt.sh |
safeheavenbtc.com Sectigo RSA Domain Validation Secure Server CA |
2020-03-22 - 2021-03-22 |
a year | crt.sh |
upload.video.google.com GTS CA 1O1 |
2020-08-11 - 2020-11-03 |
3 months | crt.sh |
*.pushwoosh.com Sectigo RSA Domain Validation Secure Server CA |
2020-02-12 - 2021-02-26 |
a year | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2020-07-23 - 2021-07-23 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://safeheavenbtc.com/ZDFmediathek/?ci=71&ai=2958198&gi=56&sub=&MPC_1=&MPC_2=&s3=49_690054so=https://topconversion.club/de/billionaire/
Frame ID: 7C6A883B4CAA8461F062FA160D3371E8
Requests: 32 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://hzjhealth.org.uk/1672202qK2324673Mq411041010zC12634kj2Dvr97976OM
HTTP 302
https://freshgrownhosters.com/1761443200a42071800/3b-1672202-2324673-97976-12634-/411041010 Page URL
-
https://aftr.clqtrk.com/37932Q/3S5BXL/?sub1=1063096886&source_id=690054&sub2=3b-1672202-2324673-9797...
HTTP 302
https://safeheavenbtc.com/ZDFmediathek/?ci=71&ai=2958198&gi=56&sub=&MPC_1=&MPC_2=&s3=49_690054so=https... Page URL
Detected technologies
Apache (Web Servers) ExpandDetected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://hzjhealth.org.uk/1672202qK2324673Mq411041010zC12634kj2Dvr97976OM
HTTP 302
https://freshgrownhosters.com/1761443200a42071800/3b-1672202-2324673-97976-12634-/411041010 Page URL
-
https://aftr.clqtrk.com/37932Q/3S5BXL/?sub1=1063096886&source_id=690054&sub2=3b-1672202-2324673-97976-12634-
HTTP 302
https://safeheavenbtc.com/ZDFmediathek/?ci=71&ai=2958198&gi=56&sub=&MPC_1=&MPC_2=&s3=49_690054so=https://topconversion.club/de/billionaire/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://hzjhealth.org.uk/1672202qK2324673Mq411041010zC12634kj2Dvr97976OM HTTP 302
- https://freshgrownhosters.com/1761443200a42071800/3b-1672202-2324673-97976-12634-/411041010
32 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Cookie set
411041010
freshgrownhosters.com/1761443200a42071800/3b-1672202-2324673-97976-12634-/ Redirect Chain
|
171 B 484 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
/
safeheavenbtc.com/ZDFmediathek/ Redirect Chain
|
52 KB 12 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css.css
safeheavenbtc.com/ZDFmediathek/index_files/ |
153 KB 21 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.4.1/ |
86 KB 30 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pushwoosh-web-notifications.js
cdn.pushwoosh.com/webpush/v3/ |
401 KB 98 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
global.js
safeheavenbtc.com/ |
904 B 674 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
trackbot-roikingdom-special.js
cdn.trackbox.guru/ |
197 KB 62 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo.png
safeheavenbtc.com/ZDFmediathek/index_files/ |
6 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cegrc1o7f3llvodpyray.jpg
safeheavenbtc.com/ZDFmediathek/index_files/ |
18 KB 18 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jgc2qdsl7f0wbpyk9nap.jpg
safeheavenbtc.com/ZDFmediathek/index_files/ |
212 KB 213 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jwccfgscfkwc894gdtcg.jpg
safeheavenbtc.com/ZDFmediathek/index_files/ |
215 KB 215 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dyxpm6j17qfnmnhj9rdc.jpg
safeheavenbtc.com/ZDFmediathek/index_files/ |
146 KB 146 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
xjfu04hzwv1fubhhu6l7.jpg
safeheavenbtc.com/ZDFmediathek/index_files/ |
82 KB 82 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ulprhvedsgozq6r6gy8t.jpg
safeheavenbtc.com/ZDFmediathek/index_files/ |
91 KB 92 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
l4tebgz5cuohroqtccyi.jpg
safeheavenbtc.com/ZDFmediathek/index_files/ |
96 KB 97 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
5c9ca78fbe8d4615367751.4f045f0a.gif
safeheavenbtc.com/andrew-forrest/index_files/ |
264 KB 265 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cheque.png
safeheavenbtc.com/ZDFmediathek/index_files/ |
760 KB 761 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
prod2.jpg
safeheavenbtc.com/ZDFmediathek/index_files/ |
33 KB 33 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cta2.png
safeheavenbtc.com/ZDFmediathek/index_files/ |
134 KB 134 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cta3.png
safeheavenbtc.com/ZDFmediathek/index_files/ |
124 KB 124 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
l7kp6sagzvgjamrhi0w8.png
safeheavenbtc.com/ZDFmediathek/index_files/ |
34 KB 34 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ainicniusbw2nyx3hlfi.png
safeheavenbtc.com/ZDFmediathek/index_files/ |
34 KB 34 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
xo0rgoorgbynpgw4kyqp.png
safeheavenbtc.com/ZDFmediathek/index_files/ |
38 KB 38 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ooo3goob2pv5nlmdwwas.png
safeheavenbtc.com/ZDFmediathek/index_files/ |
25 KB 25 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jfn5vt9dszilcurtwjlo.png
safeheavenbtc.com/ZDFmediathek/index_files/ |
37 KB 37 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wy3fkittrrlvgut3odp2.png
safeheavenbtc.com/ZDFmediathek/index_files/ |
34 KB 34 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
kdsy10yyahownwemccbo.png
safeheavenbtc.com/ZDFmediathek/index_files/ |
30 KB 31 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
checkmark.png
safeheavenbtc.com/ZDFmediathek/index_files/ |
341 B 453 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
prod.jpg
safeheavenbtc.com/ZDFmediathek/index_files/ |
59 KB 59 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
n4donflljypzf0jwaysp.png
safeheavenbtc.com/ZDFmediathek/index_files/ |
18 KB 18 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
hiqtte24snwgkglyozuw.jpg
safeheavenbtc.com/ZDFmediathek/index_files/ |
11 KB 12 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
Poolbox
platform.best-traffic.club/forms/ |
92 B 1 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Investment Scam (Online) Lion's Den Scam (Online)16 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| trustedTypes function| $ function| jQuery object| Pushwoosh object| gvars object| core object| __core-js_shared__ object| global object| System function| asap function| Observable function| setImmediate function| clearImmediate object| regeneratorRuntime boolean| _babelPolyfill string| url4 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
safeheavenbtc.com/ZDFmediathek | Name: page Value: secondToFirstBox |
|
safeheavenbtc.com/ZDFmediathek | Name: 2958198_GROUP Value: 56 |
|
safeheavenbtc.com/ZDFmediathek | Name: 2958198 Value: 240 |
|
safeheavenbtc.com/ZDFmediathek | Name: 2958198_240 Value: 63feba75c2529f12b33bd54a6944d99e |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
aftr.clqtrk.com
ajax.googleapis.com
cdn.pushwoosh.com
cdn.trackbox.guru
freshgrownhosters.com
hzjhealth.org.uk
platform.best-traffic.club
safeheavenbtc.com
185.61.154.55
195.201.240.51
2606:4700:20::ac43:4824
2606:4700:3031::681f:459e
2a00:1450:4001:800::200a
35.241.23.11
91.217.82.91
94.130.176.72
072616d23670d9d44a168b21236e9d6bf344a05459601971afb906dead0c1205
082275d6dfc5f31758e91b2de05f0b318128edc7ad46b6ed291df3d535bd8221
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
18f964969c482859c4aaa2aec0b97e478485cc368a7f8e07579e82be930aabe4
1b7e0a2736aeb5f656f8b9cc2fda4b3eb2ea212d2f344dae9b7792136c9c5562
2734afde9c73e70b3786d0aeaee5568550c8d2c16f79b741bcae8cbf6e4d0543
3dde975bef15653e64134deee5e1dd5220720f5ecb8fc26adc38f63b6cb57226
41df49a648ccd2386a5e32c674dc5979c069ec87359fb60aaec80eabec26c614
460d40afe453c437dd71cde2c17dc53a178871476ff78b629bfce0ef7d9a7b23
4639b4a9e38d286efbf0d6ee1444cfb7dd5ded249ec8b5994e13304c37e09355
494a3efdafd5407a5a88d922f5a4a72d71ac2f3ad8f3f9fe607f8cf89314dfa1
4a2fb7064b8bf6206b05a8d9ba3de694a675084308763d2b569a758a07b9b03c
4f7a2d74823de1bdc1e595f2b65095a8d5a71bfa5185f4d2177eaed57a7e721e
54e408290bafacaad2eaf0b17ec04ecf29ae7333a69784730a1af7d749b3c4a9
5adbed9d75481c04641b70a78519079b1aa08150757ee14f7c84327356e73b1f
5c3c295be8433cc36713bdfe3abe88546ac4b1dec7ba1fc1f264a0334d8a5265
88440fe5bc5612422e2a14e1d82446697ba17f0fa90b7290a09071323a4eb8bb
8e889d46c0d6f77205603430ed99deecc54d63a87063999149b69911aaa8126e
97cc62f17d02f1038c66f69694d842a2e855332b3ea8defbe702b4b7f1a84568
abfcb1683ba86df7a394fa39d6691eb207910eba690609687009a06e671c720e
b8ff47c69f9495e6ea65471b668c7d0145a9b2122aa780087cd59ca4ef8644b5
bf4064eaa4541f690ed8c1b4d82f0d6323a504d8cc0abd0db75f24cbd7ad2ff1
bf5189504db2989e3793ea49c8896d16257f1c7c4e3ae1764e6b25e946c33ea2
ca783fcc65d1ba104e19854f40695c8edad38a43f24809007af1177e79d41b31
d40b6ddebc5934e7075616be81b1c10e011590cc0210766773d87d8d329d0ac3
e5f99941f717ee56ec795c58e4c73d8f72d15494deb92d94894e2f0ea0f47b7e
e9d04e4fbd1f7c6a052cccf0588ed2c6ea41af104c59c70baaa10d8e0f5715a8
ec5031c65d66dbb2259fb306002d23bc4d7ddf14322b1491f313dba3429449cd
f01944dc991af11a6ab188db2f17ced71d0b73b1faa4f1d626e0574473383e99
f4623730049c816f0eeeea0723b92c16b2803cfa1fca1324efbd4af777af8865
f462d3a1e8980262d49048bba0c93026ddb913f5d6aaf143ccc24eca599a8bb9
f6bd6a6b49896da68970bd62dc8c05c2de2e82b70862894950ffc937fa80793e