cifwt.top Open in urlscan Pro
172.67.172.185  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response cifwt.top/	683 B 1 KB	747ms 122ms	Document text/html	172.67.172.185
General Check archive.org Show headers Download Go to Full URL https://cifwt.top/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.67.172.185 , United States, ASN (), Reverse DNS Software cloudflare / Resource Hash 35b81e227eda3c9b211fba4ff1bfe9e10e7f6914b7bbec9be464b873be3c24d8 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Response headers alt-svc h3=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 8e2370cd3b94c80e-DUS content-encoding zstd content-type text/html date Thu, 14 Nov 2024 02:06:09 GMT last-modified Sat, 23 Dec 2023 08:02:48 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wW%2BaWo7yuRPahdW0gf6MWrQOHK4kRWSOXMjWjyoTE0IHPOGH9%2FFmjAIT1I2V280l6J3QZCT%2Fkq3ELmzjqBqI3v0oTBJGI7l3SBzEdVnNVElAZREOKwN4MVvEFi8%3D"}],"group":"cf-nel","max_age":604800} server cloudflare server-timing cfL4;desc="?proto=TCP&rtt=23060&sent=6&recv=9&lost=0&retrans=0&sent_bytes=3903&recv_bytes=2284&delivery_rate=167171&cwnd=223&unsent_bytes=0&cid=57d441f29c16d496&ts=193&x=0"
GET H2	200	index.css cifwt.top/static/	94 KB 26 KB	468ms 466ms	Stylesheet text/css	172.67.172.185
General Check archive.org Show headers Download Go to Full URL https://cifwt.top/static/index.css Requested by Host: cifwt.top URL: https://cifwt.top/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.67.172.185 , United States, ASN (), Reverse DNS Software cloudflare / Resource Hash f6789ee8a50f44f18ba717956bd34c4cd17b1d658443e92408976907b83a0242 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://cifwt.top/ Response headers content-encoding gzip cf-cache-status MISS etag "65869428-6576" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=j0xfzDDEEZwzQ2ZQawt%2FTaDxtwIIP3ws3%2B0ul1oEqVZg52V0U7fsdMuHz8y8nXh9RdQTll9uGHhZkEAg2KWihhwKBTxy2UH2lNXP5MbS2qn%2BfNoBLgvkc7aDyPg%3D"}],"group":"cf-nel","max_age":604800} expires Thu, 14 Nov 2024 14:06:09 GMT alt-svc h3=":443"; ma=86400 server-timing cfL4;desc="?proto=TCP&rtt=23152&sent=535&recv=100&lost=0&retrans=0&sent_bytes=663073&recv_bytes=2564&delivery_rate=13161916&cwnd=646&unsent_bytes=0&cid=57d441f29c16d496&ts=668&x=0" date Thu, 14 Nov 2024 02:06:10 GMT content-type text/css last-modified Sat, 23 Dec 2023 08:02:48 GMT vary Accept-Encoding cache-control max-age=43200 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 8e2370ce0bf7c80e-DUS accept-ranges bytes content-length 25974 server cloudflare
GET H2	200	chunk-vendors.5a30e4b0.js Show response cifwt.top/static/js/	2 MB 594 KB	318ms 317ms	Script application/javascript	172.67.172.185
General Check archive.org Show headers Download Go to Full URL https://cifwt.top/static/js/chunk-vendors.5a30e4b0.js Requested by Host: cifwt.top URL: https://cifwt.top/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.67.172.185 , United States, ASN (), Reverse DNS Software cloudflare / Resource Hash 3ef8c6346700019f8e5cac940dc38a3db29e44e31101f159118969e4cd40e7ac Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://cifwt.top/ Response headers content-encoding gzip cf-cache-status REVALIDATED etag "65869428-943a0" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aBrEwQ5vAppjpA3nN%2B%2BPg0qDE%2FDumsazfkOdhByvGd7ol%2Fj6GacafU1Prg39DLhloJPpOOyLysa6leu9F5Bjfe8Fay0cbjGUAxA7NBR6qP6Svh38w%2BP%2F7c2Z3sM%3D"}],"group":"cf-nel","max_age":604800} expires Thu, 14 Nov 2024 14:06:09 GMT alt-svc h3=":443"; ma=86400 server-timing cfL4;desc="?proto=TCP&rtt=28487&sent=53&recv=19&lost=0&retrans=0&sent_bytes=52979&recv_bytes=2564&delivery_rate=601633&cwnd=226&unsent_bytes=0&cid=57d441f29c16d496&ts=516&x=0" date Thu, 14 Nov 2024 02:06:09 GMT content-type application/javascript last-modified Sat, 23 Dec 2023 08:02:48 GMT vary Accept-Encoding cache-control max-age=43200 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 8e2370ce0bf8c80e-DUS accept-ranges bytes content-length 607136 server cloudflare
GET H2	200	index.4c6e0489.js Show response cifwt.top/static/js/	113 KB 46 KB	58ms 58ms	Script application/javascript	172.67.172.185
General Check archive.org Show headers Download Go to Full URL https://cifwt.top/static/js/index.4c6e0489.js Requested by Host: cifwt.top URL: https://cifwt.top/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.67.172.185 , United States, ASN (), Reverse DNS Software cloudflare / Resource Hash a5cb20c30df0998bcaf5803655fc10aeb822c60b28c76aec88d89bfe2b2ca6b1 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://cifwt.top/ Response headers content-encoding gzip cf-cache-status HIT etag "65869428-b5f5" age 17345 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=os7L5fFIaePOzHy4jKG936FbG%2Btk5h7UIkN5UsEf22PXKrfRsXS1Lk4zM9DSLXyhTWqV%2Fsx3Iyngcd4smUTkVRi%2FLY23say%2B2d%2BqBW%2BnV28VWusI9MkGCWlLvkQ%3D"}],"group":"cf-nel","max_age":604800} expires Thu, 14 Nov 2024 09:17:04 GMT alt-svc h3=":443"; ma=86400 server-timing cfL4;desc="?proto=TCP&rtt=23077&sent=10&recv=12&lost=0&retrans=0&sent_bytes=5034&recv_bytes=2564&delivery_rate=167171&cwnd=226&unsent_bytes=0&cid=57d441f29c16d496&ts=261&x=0" date Thu, 14 Nov 2024 02:06:09 GMT content-type application/javascript last-modified Sat, 23 Dec 2023 08:02:48 GMT vary Accept-Encoding cache-control max-age=43200 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 8e2370ce0bf9c80e-DUS accept-ranges bytes content-length 46581 server cloudflare
GET H2	200	pages-index-index~pages-index-preview.7b2f604f.js Show response cifwt.top/static/js/	107 KB 19 KB	53ms 52ms	Script application/javascript	172.67.172.185
General Check archive.org Show headers Download Go to Full URL https://cifwt.top/static/js/pages-index-index~pages-index-preview.7b2f604f.js Requested by Host: cifwt.top URL: https://cifwt.top/static/js/index.4c6e0489.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.67.172.185 , United States, ASN (), Reverse DNS Software cloudflare / Resource Hash 7abef18fa4ddb3cad81938a3fd1e15034ed189b7c4e30189f31a86b055a50e65 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://cifwt.top/ Response headers content-encoding gzip cf-cache-status HIT etag "65869428-4a55" age 17340 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=h25kHGUahQcFR218eI62qGP36%2Fu9d9gM5%2BHRWZnvIsc7Tg8TOD3cVOtcKq8GhqQef6VILRr6x1yf2IdxpiMJUXZd2aXshORCOyCszrsjQ827dCxPwiQm0A2eldM%3D"}],"group":"cf-nel","max_age":604800} expires Thu, 14 Nov 2024 09:17:10 GMT alt-svc h3=":443"; ma=86400 server-timing cfL4;desc="?proto=TCP&rtt=23165&sent=558&recv=108&lost=0&retrans=0&sent_bytes=689619&recv_bytes=2881&delivery_rate=13161916&cwnd=668&unsent_bytes=0&cid=57d441f29c16d496&ts=968&x=0" date Thu, 14 Nov 2024 02:06:10 GMT content-type application/javascript last-modified Sat, 23 Dec 2023 08:02:48 GMT vary Accept-Encoding cache-control max-age=43200 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 8e2370d27df3c80e-DUS accept-ranges bytes content-length 19029 server cloudflare
GET H2	200	pages-index-index.99b54a4d.js Show response cifwt.top/static/js/	52 KB 11 KB	129ms 129ms	Script application/javascript	172.67.172.185
General Check archive.org Show headers Download Go to Full URL https://cifwt.top/static/js/pages-index-index.99b54a4d.js Requested by Host: cifwt.top URL: https://cifwt.top/static/js/index.4c6e0489.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.67.172.185 , United States, ASN (), Reverse DNS Software cloudflare / Resource Hash add141ea47ab9b399538f5cd53961c90ee765257a5701f2e83e97d303ce5d969 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://cifwt.top/ Response headers content-encoding gzip cf-cache-status REVALIDATED etag "65869428-2b36" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=06qgg5N0P6k%2Bm%2B%2BNDhujem7eARW0VOdQRveo7JZGR853CfLUabkyrHMdALSLOQWFiMWxE9dfZWx8fbyUhQAdRsKRlH1aVsSjdGNQO2oBB2FVXLi9GI8dGaBVeZE%3D"}],"group":"cf-nel","max_age":604800} expires Thu, 14 Nov 2024 14:06:10 GMT alt-svc h3=":443"; ma=86400 server-timing cfL4;desc="?proto=TCP&rtt=23114&sent=575&recv=112&lost=0&retrans=0&sent_bytes=709201&recv_bytes=2881&delivery_rate=13161916&cwnd=685&unsent_bytes=0&cid=57d441f29c16d496&ts=1043&x=0" date Thu, 14 Nov 2024 02:06:10 GMT content-type application/javascript last-modified Sat, 23 Dec 2023 08:02:48 GMT vary Accept-Encoding cache-control max-age=43200 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 8e2370d27df5c80e-DUS accept-ranges bytes content-length 11062 server cloudflare
POST H2	200	rate Show response cifwt.top/api/common/	109 B 792 B	2006ms 2005ms	XHR application/json	172.67.172.185
General Check archive.org Show headers Download Go to Full URL https://cifwt.top/api/common/rate Requested by Host: cifwt.top URL: https://cifwt.top/static/js/chunk-vendors.5a30e4b0.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.67.172.185 , United States, ASN (), Reverse DNS Software cloudflare / Resource Hash 4ce0aab612d5221af2ca1bbcf78d63310277cbb3ccf9c2f5520aa5a94f645ee3 Request headers lang en Referer https://cifwt.top/ Accept-Language en User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Content-Type application/x-www-form-urlencoded token Response headers access-control-max-age 86400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} content-encoding zstd cf-cache-status DYNAMIC access-control-allow-credentials true report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GaLqbl48py4T5vAW%2FcFdM7Ygcbxynd5SUsatx1CBJtIJDjae8IGPlZLj4y4zFI6l2lAzgAfANtV%2BPa76BUt0bkdiRKfO9QJPIqU7SlHepXwtEacLtovdvUtgWMy5x5WKu%2B%2Fb41dcUDFHkpu%2BrjA%3D"}],"group":"cf-nel","max_age":604800} cf-ray 8e2370d28df7c80e-DUS access-control-allow-origin https://cifwt.top server-timing cfL4;desc="?proto=TCP&rtt=299928&sent=5&recv=7&lost=0&retrans=0&sent_bytes=3003&recv_bytes=1306&delivery_rate=9655&cwnd=33&unsent_bytes=0&cid=e7b59cc850b66f82&ts=1314&x=0", cfL4;desc="?proto=TCP&rtt=23231&sent=613&recv=123&lost=0&retrans=0&sent_bytes=749739&recv_bytes=3070&delivery_rate=13161916&cwnd=721&unsent_bytes=0&cid=57d441f29c16d496&ts=2920&x=0" alt-svc h3=":443"; ma=86400 date Thu, 14 Nov 2024 02:06:12 GMT content-type application/json; charset=utf-8 vary accept-encoding server cloudflare
GET DATA	200 OK	truncated /	1 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 0ccf8dd29c61715a6364ea9ec36d32c295e82ca837488590130c51cee298b7d3 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer Response headers Content-Type image/svg+xml
GET H2	200	re1.jpeg cifwt.top/static/img/	37 KB 27 KB	165ms 138ms	Image image/jpeg	172.67.172.185
General Check archive.org Show headers Download Go to Show image Full URL https://cifwt.top/static/img/re1.jpeg Requested by Host: cifwt.top URL: https://cifwt.top/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.67.172.185 , United States, ASN (), Reverse DNS Software cloudflare / Resource Hash 8e61ba5d4c9fb12d461a8109d17ef9e13b5c66c19fbf92fbdb62c8e0e17e9bff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://cifwt.top/ Response headers cache-control max-age=2592000 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} content-encoding gzip cf-cache-status MISS etag W/"65869428-93a8" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KekJrIxRtPbdkT6%2FFkLexERYBI4MMJ3igLm0C5W30NNHltqw%2B%2FWC%2FCo4rxK6fRNsRaMr6RduFEkjSy89z5BkAcBgrNeKbhT8EMr2qf4SxBb9o%2FzOCQuxEtXSxzM%3D"}],"group":"cf-nel","max_age":604800} cf-ray 8e2370d4aed2c80e-DUS expires Sat, 14 Dec 2024 02:06:10 GMT alt-svc h3=":443"; ma=86400 server-timing cfL4;desc="?proto=TCP&rtt=23099&sent=587&recv=117&lost=0&retrans=0&sent_bytes=720889&recv_bytes=3004&delivery_rate=13161916&cwnd=696&unsent_bytes=0&cid=57d441f29c16d496&ts=1423&x=0" date Thu, 14 Nov 2024 02:06:10 GMT content-type image/jpeg last-modified Sat, 23 Dec 2023 08:02:48 GMT vary Accept-Encoding server cloudflare
GET H2	200	favicon.svg cifwt.top/static/img/	556 B 772 B	130ms 129ms	Other image/svg+xml	172.67.172.185
General Check archive.org Show headers Download Go to Full URL https://cifwt.top/static/img/favicon.svg Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.67.172.185 , United States, ASN (), Reverse DNS Software cloudflare / Resource Hash 7e5941f066b2070419995072dac7323c02d5ae107b23d8085772f232487fecae Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://cifwt.top/ Response headers cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} content-encoding zstd cf-cache-status REVALIDATED etag W/"65869428-22c" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BEHUsrArieIpJhNaXzluPiAAszxt8Q7TMpOgy3tudiPylFF9RKUz07lY60M4ROR3gkY3uZi1cHBzCMiE2WpxJhZUnWORz8F%2FCnbxD2ZdmM5AWEDIWHTGj68OhJA%3D"}],"group":"cf-nel","max_age":604800} cf-ray 8e2370d5bf5ec80e-DUS alt-svc h3=":443"; ma=86400 server-timing cfL4;desc="?proto=TCP&rtt=23261&sent=611&recv=122&lost=0&retrans=0&sent_bytes=748901&recv_bytes=3070&delivery_rate=13161916&cwnd=719&unsent_bytes=0&cid=57d441f29c16d496&ts=1564&x=0" date Thu, 14 Nov 2024 02:06:10 GMT content-type image/svg+xml last-modified Sat, 23 Dec 2023 08:02:48 GMT vary Accept-Encoding server cloudflare
GET H2	200	shadow-grey.png cdn.dcloud.net.cn/img/	136 B 420 B	1182ms 272ms	Image image/png	111.231.169.247
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.dcloud.net.cn/img/shadow-grey.png Requested by Host: cifwt.top URL: https://cifwt.top/static/index.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 111.231.169.247 , China, ASN (), Reverse DNS Software nginx / Resource Hash ad4ebea1c3496dd2924789ee009174a2c6289d1200e9811f458fd46f172d1d6f Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://cifwt.top/ Response headers cache-control max-age=46800 etag "5cf8b5bf-88" expires Thu, 14 Nov 2024 15:06:14 GMT accept-ranges bytes content-length 136 date Thu, 14 Nov 2024 02:06:14 GMT content-type image/png last-modified Thu, 06 Jun 2019 06:42:07 GMT server nginx

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Crypto (Crypto Exchange)

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| webpackJsonp object| __uniConfig object| __uniRoutes function| UniApp object| UniViewJSBridge object| UniServiceJSBridge object| uni object| wx function| getApp function| getCurrentPages function| clearImmediate function| setImmediate object| regeneratorRuntime

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.dcloud.net.cn/	1970-01-21 10:35:09	Name: __uni__uid Value: rBEQUmc1WxaAG39bAxz4Ag==

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.dcloud.net.cn
cifwt.top
111.231.169.247
172.67.172.185
0ccf8dd29c61715a6364ea9ec36d32c295e82ca837488590130c51cee298b7d3
35b81e227eda3c9b211fba4ff1bfe9e10e7f6914b7bbec9be464b873be3c24d8
3ef8c6346700019f8e5cac940dc38a3db29e44e31101f159118969e4cd40e7ac
4ce0aab612d5221af2ca1bbcf78d63310277cbb3ccf9c2f5520aa5a94f645ee3
7abef18fa4ddb3cad81938a3fd1e15034ed189b7c4e30189f31a86b055a50e65
7e5941f066b2070419995072dac7323c02d5ae107b23d8085772f232487fecae
8e61ba5d4c9fb12d461a8109d17ef9e13b5c66c19fbf92fbdb62c8e0e17e9bff
a5cb20c30df0998bcaf5803655fc10aeb822c60b28c76aec88d89bfe2b2ca6b1
ad4ebea1c3496dd2924789ee009174a2c6289d1200e9811f458fd46f172d1d6f
add141ea47ab9b399538f5cd53961c90ee765257a5701f2e83e97d303ce5d969
f6789ee8a50f44f18ba717956bd34c4cd17b1d658443e92408976907b83a0242