urlscan.io logo urlscan.io
SecurityTrails logo

cb-help.net Open in urlscan Pro
45.133.200.238  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://cb-help.net/coinbase_clean/
Effective URL: http://cb-help.net/coinbase_clean/signin.php?cmd=login_submit&id=1562995aa244619eefd9209cc1109c101562995aa244619eef...
Submission Tags: #phishing @ecarlesi Search All
Submission: On September 01 via api from FI — Scanned from FI
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 6 HTTP transactions. The main IP is 45.133.200.238, located in Virgin Islands (British) and belongs to INTERNET-IT, VG. The main domain is cb-help.net.
This is the only time cb-help.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Coinbase (Crypto Exchange)

Domain & IP information

IP Address AS Autonomous System
1 7 45.133.200.238 200313 (INTERNET-IT)
6 1
Apex Domain
Subdomains		 Transfer
7 cb-help.net
cb-help.net
116 KB
6 1
Domain Requested by
7 cb-help.net 1 redirects cb-help.net
6 1

This site contains links to these domains. Also see Links.

Domain
www.coinbase.com
Subject Issuer Validity Valid

This page contains 1 frames:

Primary Page: http://cb-help.net/coinbase_clean/signin.php?cmd=login_submit&id=1562995aa244619eefd9209cc1109c101562995aa244619eefd9209cc1109c10&session=1562995aa244619eefd9209cc1109c101562995aa244619eefd9209cc1109c10
Frame ID: E289FF6BDF79693CD47BADC94332FECF
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Coinbase - Buy/Sell Cryptocurrency

Page URL History Show full URLs

  1. http://cb-help.net/coinbase_clean/ HTTP 302
    http://cb-help.net/coinbase_clean/signin.php?cmd=login_submit&id=1562995aa244619eefd9209cc1109c... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)
Overall confidence: 100%
Detected patterns
  • <[^>]+data-controller

Page Statistics

6
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

116 kB
Transfer

603 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://cb-help.net/coinbase_clean/ HTTP 302
    http://cb-help.net/coinbase_clean/signin.php?cmd=login_submit&id=1562995aa244619eefd9209cc1109c101562995aa244619eefd9209cc1109c10&session=1562995aa244619eefd9209cc1109c101562995aa244619eefd9209cc1109c10 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request signin.php
cb-help.net/coinbase_clean/
Redirect Chain
  • http://cb-help.net/coinbase_clean/
  • http://cb-help.net/coinbase_clean/signin.php?cmd=login_submit&id=1562995aa244619eefd9209cc1109c101562995aa244619eefd9209cc1109c10&session=1562995aa244619eefd9209cc1109c101562995aa244619eefd9209cc11...
10 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://cb-help.net/coinbase_clean/signin.php?cmd=login_submit&id=1562995aa244619eefd9209cc1109c101562995aa244619eefd9209cc1109c10&session=1562995aa244619eefd9209cc1109c101562995aa244619eefd9209cc1109c10
Protocol
HTTP/1.1
Server
45.133.200.238 , Virgin Islands (British), ASN200313 (INTERNET-IT, VG),
Reverse DNS
egodimpa.com
Software
nginx / PHP/5.6.40
Resource Hash
471543d32b269393d981a809336abc5b4f3465da0ca605139579a6de9b19026c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
accept-language
fi-FI,fi;q=0.9

Response headers

Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection
keep-alive
Content-Encoding
gzip
Content-Type
text/html; charset=UTF-8
Date
Thu, 01 Sep 2022 06:05:02 GMT
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Pragma
no-cache
Server
nginx
Transfer-Encoding
chunked
Vary
Accept-Encoding
X-Content-Type-Options
nosniff
X-Nginx-Upstream-Cache-Status
BYPASS
X-Powered-By
PHP/5.6.40
X-Server-Powered-By
Engintron
X-XSS-Protection
1; mode=block

Redirect headers

Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection
keep-alive
Content-Length
0
Content-Type
text/html; charset=UTF-8
Date
Thu, 01 Sep 2022 06:05:02 GMT
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Pragma
no-cache
Server
nginx
X-Content-Type-Options
nosniff
X-Nginx-Upstream-Cache-Status
MISS
X-Powered-By
PHP/5.6.40
X-Server-Powered-By
Engintron
X-XSS-Protection
1; mode=block
location
signin.php?cmd=login_submit&id=1562995aa244619eefd9209cc1109c101562995aa244619eefd9209cc1109c10&session=1562995aa244619eefd9209cc1109c101562995aa244619eefd9209cc1109c10
core-1cad8ec81312fe711dc9d9a79d9fd51820c717eed0abb2805af5bfc0378b52f5.css
cb-help.net/coinbase_clean/xAssets/login_files/ 		331 KB
64 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://cb-help.net/coinbase_clean/xAssets/login_files/core-1cad8ec81312fe711dc9d9a79d9fd51820c717eed0abb2805af5bfc0378b52f5.css
Requested by
Host: cb-help.net
URL: http://cb-help.net/coinbase_clean/signin.php?cmd=login_submit&id=1562995aa244619eefd9209cc1109c101562995aa244619eefd9209cc1109c10&session=1562995aa244619eefd9209cc1109c101562995aa244619eefd9209cc1109c10
Protocol
HTTP/1.1
Server
45.133.200.238 , Virgin Islands (British), ASN200313 (INTERNET-IT, VG),
Reverse DNS
egodimpa.com
Software
nginx /
Resource Hash
45d4675e6fd9cd4867f21991e1236dcaab25f3f37f8b03bfb62d6390e07e6ca1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
http://cb-help.net/coinbase_clean/signin.php?cmd=login_submit&id=1562995aa244619eefd9209cc1109c101562995aa244619eefd9209cc1109c10&session=1562995aa244619eefd9209cc1109c101562995aa244619eefd9209cc1109c10
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

Date
Thu, 01 Sep 2022 06:05:02 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Wed, 19 Jan 2022 22:07:20 GMT
Server
nginx
Vary
Accept-Encoding
Content-Type
text/css
Expires
Sat, 01 Oct 2022 06:05:02 GMT
Cache-Control
max-age=2592000
Transfer-Encoding
chunked
X-Server-Powered-By
Engintron
Connection
keep-alive
X-XSS-Protection
1; mode=block
X-Nginx-Upstream-Cache-Status
STALE
application-b1e17ca9263cf6169dbdd5f38d79e89941855cf2eba13a70ee5ddecc183e657e.css
cb-help.net/coinbase_clean/xAssets/login_files/ 		262 KB
48 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://cb-help.net/coinbase_clean/xAssets/login_files/application-b1e17ca9263cf6169dbdd5f38d79e89941855cf2eba13a70ee5ddecc183e657e.css
Requested by
Host: cb-help.net
URL: http://cb-help.net/coinbase_clean/signin.php?cmd=login_submit&id=1562995aa244619eefd9209cc1109c101562995aa244619eefd9209cc1109c10&session=1562995aa244619eefd9209cc1109c101562995aa244619eefd9209cc1109c10
Protocol
HTTP/1.1
Server
45.133.200.238 , Virgin Islands (British), ASN200313 (INTERNET-IT, VG),
Reverse DNS
egodimpa.com
Software
nginx /
Resource Hash
527c801514f580e3967e7891300b529e4f1dc01e8db58813390bb77b288624f9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
http://cb-help.net/coinbase_clean/signin.php?cmd=login_submit&id=1562995aa244619eefd9209cc1109c101562995aa244619eefd9209cc1109c10&session=1562995aa244619eefd9209cc1109c101562995aa244619eefd9209cc1109c10
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

Date
Thu, 01 Sep 2022 06:05:02 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Wed, 19 Jan 2022 22:07:20 GMT
Server
nginx
Vary
Accept-Encoding
Content-Type
text/css
Expires
Sat, 01 Oct 2022 06:05:02 GMT
Cache-Control
max-age=2592000
Transfer-Encoding
chunked
X-Server-Powered-By
Engintron
Connection
keep-alive
X-XSS-Protection
1; mode=block
X-Nginx-Upstream-Cache-Status
STALE
icon-visible-active-402d81fd99fe281230bdf39a8bf63c1d3012f790fb521b1c1f0624296eac4be7.svg
cb-help.net/assets/app/ 		315 B
315 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://cb-help.net/assets/app/icon-visible-active-402d81fd99fe281230bdf39a8bf63c1d3012f790fb521b1c1f0624296eac4be7.svg
Requested by
Host: cb-help.net
URL: http://cb-help.net/coinbase_clean/xAssets/login_files/application-b1e17ca9263cf6169dbdd5f38d79e89941855cf2eba13a70ee5ddecc183e657e.css
Protocol
HTTP/1.1
Server
45.133.200.238 , Virgin Islands (British), ASN200313 (INTERNET-IT, VG),
Reverse DNS
egodimpa.com
Software
nginx /
Resource Hash
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
http://cb-help.net/coinbase_clean/xAssets/login_files/application-b1e17ca9263cf6169dbdd5f38d79e89941855cf2eba13a70ee5ddecc183e657e.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

Date
Thu, 01 Sep 2022 06:05:02 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Server
nginx
Vary
Accept-Encoding
Content-Type
text/html; charset=iso-8859-1
Transfer-Encoding
chunked
Connection
keep-alive
X-XSS-Protection
1; mode=block
Graphik-Regular-Web-aeabadfcbec89b7a55d9a65893d93f275b406984811f8236b60bc9d9a7653360.woff2
cb-help.net/assets/graphik/ 		0
0 		Font
General
Check archive.org
Download Go to
Full URL
http://cb-help.net/assets/graphik/Graphik-Regular-Web-aeabadfcbec89b7a55d9a65893d93f275b406984811f8236b60bc9d9a7653360.woff2
Requested by
Host: cb-help.net
URL: http://cb-help.net/coinbase_clean/xAssets/login_files/core-1cad8ec81312fe711dc9d9a79d9fd51820c717eed0abb2805af5bfc0378b52f5.css
Protocol
HTTP/1.1
Server
45.133.200.238 , Virgin Islands (British), ASN200313 (INTERNET-IT, VG),
Reverse DNS
egodimpa.com
Software
nginx /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
http://cb-help.net/coinbase_clean/xAssets/login_files/core-1cad8ec81312fe711dc9d9a79d9fd51820c717eed0abb2805af5bfc0378b52f5.css
Origin
http://cb-help.net
accept-language
fi-FI,fi;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

Date
Thu, 01 Sep 2022 06:05:02 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Server
nginx
Vary
Accept-Encoding
Content-Type
text/html; charset=iso-8859-1
Transfer-Encoding
chunked
Connection
keep-alive
X-XSS-Protection
1; mode=block
Graphik-Regular-Web-7dfd8a5140355bdddf118fb75ad563f47fd8d4fd85d4f185c8bd894cf821069b.woff
cb-help.net/assets/graphik/ 		0
0 		Font
General
Check archive.org
Download Go to
Full URL
http://cb-help.net/assets/graphik/Graphik-Regular-Web-7dfd8a5140355bdddf118fb75ad563f47fd8d4fd85d4f185c8bd894cf821069b.woff
Requested by
Host: cb-help.net
URL: http://cb-help.net/coinbase_clean/xAssets/login_files/core-1cad8ec81312fe711dc9d9a79d9fd51820c717eed0abb2805af5bfc0378b52f5.css
Protocol
HTTP/1.1
Server
45.133.200.238 , Virgin Islands (British), ASN200313 (INTERNET-IT, VG),
Reverse DNS
egodimpa.com
Software
nginx /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
http://cb-help.net/coinbase_clean/xAssets/login_files/core-1cad8ec81312fe711dc9d9a79d9fd51820c717eed0abb2805af5bfc0378b52f5.css
Origin
http://cb-help.net
accept-language
fi-FI,fi;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

Date
Thu, 01 Sep 2022 06:05:02 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Server
nginx
Vary
Accept-Encoding
Content-Type
text/html; charset=iso-8859-1
Transfer-Encoding
chunked
Connection
keep-alive
X-XSS-Protection
1; mode=block

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Coinbase (Crypto Exchange)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch object| navigation

1 Cookies

Domain/Path Name / Value
cb-help.net/ Name: PHPSESSID
Value: 4o8q79vfltsvtc7ecko08eq8o6

3 Console Messages

Source Level URL
Text
network error URL: http://cb-help.net/assets/app/icon-visible-active-402d81fd99fe281230bdf39a8bf63c1d3012f790fb521b1c1f0624296eac4be7.svg
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)
network error URL: http://cb-help.net/assets/graphik/Graphik-Regular-Web-aeabadfcbec89b7a55d9a65893d93f275b406984811f8236b60bc9d9a7653360.woff2
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)
network error URL: http://cb-help.net/assets/graphik/Graphik-Regular-Web-7dfd8a5140355bdddf118fb75ad563f47fd8d4fd85d4f185c8bd894cf821069b.woff
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block