mail.poloniex.com.ci Open in urlscan Pro
179.43.140.226  Malicious Activity! Public Scan

Submitted URL: http://mail.poloniex.com.ci/login.html?entity=458504
Effective URL: https://mail.poloniex.com.ci/login.html?entity=458504
Submission: On November 22 via manual from IN — Scanned from DE

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 11 HTTP transactions. The main IP is 179.43.140.226, located in Zurich, Switzerland and belongs to PLI-AS, PA. The main domain is mail.poloniex.com.ci.
TLS certificate: Issued by R3 on October 23rd 2022. Valid for: 3 months.
This is the only time mail.poloniex.com.ci was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Poloniex (Crypto Exchange)

Domain & IP information

IP Address AS Autonomous System
1 11 179.43.140.226 51852 (PLI-AS)
1 2600:9000:214... 16509 (AMAZON-02)
11 2
Apex Domain
Subdomains
Transfer
11 poloniex.com.ci
mail.poloniex.com.ci
701 KB
1 cloudfront.net
d21y75miwcfqoq.cloudfront.net
438 B
11 2
Domain Requested by
11 mail.poloniex.com.ci 1 redirects mail.poloniex.com.ci
1 d21y75miwcfqoq.cloudfront.net mail.poloniex.com.ci
11 2

This site contains links to these domains. Also see Links.

Domain
sunswap.com
apenft.io
Subject Issuer Validity Valid
webdisk.poloniex.com.ci
R3
2022-10-23 -
2023-01-21
3 months crt.sh
*.cloudfront.net
Amazon
2022-02-01 -
2023-01-31
a year crt.sh

This page contains 1 frames:

Primary Page: https://mail.poloniex.com.ci/login.html?entity=458504
Frame ID: 734E7E7E56338DF024DCDD2CD68E33E3
Requests: 11 HTTP requests in this frame

Screenshot

Page Title

Poloniex - Crypto Asset Exchange - Log in

Page URL History Show full URLs

  1. http://mail.poloniex.com.ci/login.html?entity=458504 HTTP 301
    https://mail.poloniex.com.ci/login.html?entity=458504 Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <[^>]+\sdata-v(?:ue)?-

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
  • <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

11
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

702 kB
Transfer

699 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://mail.poloniex.com.ci/login.html?entity=458504 HTTP 301
    https://mail.poloniex.com.ci/login.html?entity=458504 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request login.html
mail.poloniex.com.ci/
Redirect Chain
  • http://mail.poloniex.com.ci/login.html?entity=458504
  • https://mail.poloniex.com.ci/login.html?entity=458504
172 KB
172 KB
Document
General
Full URL
https://mail.poloniex.com.ci/login.html?entity=458504
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
179.43.140.226 Zurich, Switzerland, ASN51852 (PLI-AS, PA),
Reverse DNS
hostedby.privatealps.net
Software
Apache /
Resource Hash
c541d006503c5d78b25f07ad2ca115c98f468bd958d84c32b0dc18576d902630

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Accept-Ranges
bytes
Connection
Keep-Alive
Content-Length
175829
Content-Type
text/html
Date
Tue, 22 Nov 2022 18:09:32 GMT
Keep-Alive
timeout=5, max=100
Last-Modified
Mon, 24 Oct 2022 16:45:23 GMT
Server
Apache

Redirect headers

Connection
Keep-Alive
Content-Length
261
Content-Type
text/html; charset=iso-8859-1
Date
Tue, 22 Nov 2022 18:09:32 GMT
Keep-Alive
timeout=5, max=100
Location
https://mail.poloniex.com.ci/login.html?entity=458504
Server
Apache
font-awesome.min.css
mail.poloniex.com.ci/css/
30 KB
31 KB
Stylesheet
General
Full URL
https://mail.poloniex.com.ci/css/font-awesome.min.css
Requested by
Host: mail.poloniex.com.ci
URL: https://mail.poloniex.com.ci/login.html?entity=458504
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
179.43.140.226 Zurich, Switzerland, ASN51852 (PLI-AS, PA),
Reverse DNS
hostedby.privatealps.net
Software
Apache /
Resource Hash
68d4a759022635c8d1e96bf1cda36eb8559c7b2c6de3cb6d3f2f1104364aa7a1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://mail.poloniex.com.ci/login.html?entity=458504
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date
Tue, 22 Nov 2022 18:09:32 GMT
Last-Modified
Tue, 23 Aug 2022 21:10:57 GMT
Server
Apache
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
31043
font-proxima.css
mail.poloniex.com.ci/css/
7 KB
8 KB
Stylesheet
General
Full URL
https://mail.poloniex.com.ci/css/font-proxima.css
Requested by
Host: mail.poloniex.com.ci
URL: https://mail.poloniex.com.ci/login.html?entity=458504
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
179.43.140.226 Zurich, Switzerland, ASN51852 (PLI-AS, PA),
Reverse DNS
hostedby.privatealps.net
Software
Apache /
Resource Hash
70d7aca7ecb837130c86e14abe13d4e68ba59cc18c43c955153e5dc489ba3f47

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://mail.poloniex.com.ci/login.html?entity=458504
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date
Tue, 22 Nov 2022 18:09:32 GMT
Last-Modified
Tue, 23 Aug 2022 21:11:00 GMT
Server
Apache
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
7598
style-ls.css
mail.poloniex.com.ci/css/
195 KB
195 KB
Stylesheet
General
Full URL
https://mail.poloniex.com.ci/css/style-ls.css
Requested by
Host: mail.poloniex.com.ci
URL: https://mail.poloniex.com.ci/login.html?entity=458504
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
179.43.140.226 Zurich, Switzerland, ASN51852 (PLI-AS, PA),
Reverse DNS
hostedby.privatealps.net
Software
Apache /
Resource Hash
217a29c085d15841d51c72f965387d090200c8a33d06add04ceec7b2750295bf

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://mail.poloniex.com.ci/login.html?entity=458504
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date
Tue, 22 Nov 2022 18:09:32 GMT
Last-Modified
Tue, 23 Aug 2022 21:11:28 GMT
Server
Apache
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
199862
jquery-2.1.3.min.js
mail.poloniex.com.ci/js/
82 KB
82 KB
Script
General
Full URL
https://mail.poloniex.com.ci/js/jquery-2.1.3.min.js
Requested by
Host: mail.poloniex.com.ci
URL: https://mail.poloniex.com.ci/login.html?entity=458504
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
179.43.140.226 Zurich, Switzerland, ASN51852 (PLI-AS, PA),
Reverse DNS
hostedby.privatealps.net
Software
Apache /
Resource Hash
8c02b2938c7c5f8553e55bc6376e0a2d43356568590eda5c88c7339bdc6f9f60

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://mail.poloniex.com.ci/login.html?entity=458504
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date
Tue, 22 Nov 2022 18:09:32 GMT
Last-Modified
Tue, 23 Aug 2022 21:01:00 GMT
Server
Apache
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
83947
5d308ddf
d21y75miwcfqoq.cloudfront.net/
68 B
438 B
Image
General
Full URL
https://d21y75miwcfqoq.cloudfront.net/5d308ddf
Requested by
Host: mail.poloniex.com.ci
URL: https://mail.poloniex.com.ci/login.html?entity=458504
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:214f:3000:1b:ef38:3680:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
63ef318d96b5d0d0ceba6e04a4e622b1158335cdc67c49e27839132c6f655058

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://mail.poloniex.com.ci/login.html?entity=458504
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date
Tue, 22 Nov 2022 18:09:34 GMT
via
1.1 269bfdd288bfea5423a4e9e701777da6.cloudfront.net (CloudFront)
last-modified
Thu, 19 Nov 2020 18:37:03 GMT
server
AmazonS3
x-amz-cf-pop
FRA53-C1
etag
"91e42db1c66c0b276abf6234dc50b2eb"
x-amz-server-side-encryption
AES256
x-cache
Miss from cloudfront
content-type
image/png
cache-control
no-cache, no-store
accept-ranges
bytes
content-length
68
x-amz-cf-id
YQ2yn7eWbU1IvsNVi0R73xM94vZDhcPqng4cbrQWYQJxHFTqqVanwQ==
proxima-nova-medium.woff2
mail.poloniex.com.ci/css/fonts/ProximaNova/
21 KB
22 KB
Font
General
Full URL
https://mail.poloniex.com.ci/css/fonts/ProximaNova/proxima-nova-medium.woff2
Requested by
Host: mail.poloniex.com.ci
URL: https://mail.poloniex.com.ci/css/font-proxima.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
179.43.140.226 Zurich, Switzerland, ASN51852 (PLI-AS, PA),
Reverse DNS
hostedby.privatealps.net
Software
Apache /
Resource Hash
c80867a3e00e9a8d9232195c59408284ec1f984798ff711bb76b95eb7bf08dbb

Request headers

Referer
https://mail.poloniex.com.ci/css/font-proxima.css
Origin
https://mail.poloniex.com.ci
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date
Tue, 22 Nov 2022 18:09:32 GMT
Last-Modified
Tue, 23 Aug 2022 21:20:22 GMT
Server
Apache
Content-Type
font/woff2
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
21964
fontawesome-webfont.woff2
mail.poloniex.com.ci/css/fonts/fontawesome/
75 KB
76 KB
Font
General
Full URL
https://mail.poloniex.com.ci/css/fonts/fontawesome/fontawesome-webfont.woff2
Requested by
Host: mail.poloniex.com.ci
URL: https://mail.poloniex.com.ci/css/font-awesome.min.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
179.43.140.226 Zurich, Switzerland, ASN51852 (PLI-AS, PA),
Reverse DNS
hostedby.privatealps.net
Software
Apache /
Resource Hash
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

Request headers

Referer
https://mail.poloniex.com.ci/css/font-awesome.min.css
Origin
https://mail.poloniex.com.ci
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date
Tue, 22 Nov 2022 18:09:32 GMT
Last-Modified
Tue, 23 Aug 2022 21:14:16 GMT
Server
Apache
Content-Type
font/woff2
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
77160
proxima-nova-semibold.woff2
mail.poloniex.com.ci/css/fonts/ProximaNova/
38 KB
38 KB
Font
General
Full URL
https://mail.poloniex.com.ci/css/fonts/ProximaNova/proxima-nova-semibold.woff2
Requested by
Host: mail.poloniex.com.ci
URL: https://mail.poloniex.com.ci/css/font-proxima.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
179.43.140.226 Zurich, Switzerland, ASN51852 (PLI-AS, PA),
Reverse DNS
hostedby.privatealps.net
Software
Apache /
Resource Hash
9f982e254a4bf3eb7973170c9d1212c69fc52f8a53e460caa3f70944820ad33d

Request headers

Referer
https://mail.poloniex.com.ci/css/font-proxima.css
Origin
https://mail.poloniex.com.ci
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date
Tue, 22 Nov 2022 18:09:32 GMT
Last-Modified
Tue, 23 Aug 2022 21:20:57 GMT
Server
Apache
Content-Type
font/woff2
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
38948
proxima-nova-bold.woff2
mail.poloniex.com.ci/css/fonts/ProximaNova/
39 KB
39 KB
Font
General
Full URL
https://mail.poloniex.com.ci/css/fonts/ProximaNova/proxima-nova-bold.woff2
Requested by
Host: mail.poloniex.com.ci
URL: https://mail.poloniex.com.ci/css/font-proxima.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
179.43.140.226 Zurich, Switzerland, ASN51852 (PLI-AS, PA),
Reverse DNS
hostedby.privatealps.net
Software
Apache /
Resource Hash
0317d04b30d7259cd54e9482edf3d9c9eee31b0922c3274fefb41d0f3598816f

Request headers

Referer
https://mail.poloniex.com.ci/css/font-proxima.css
Origin
https://mail.poloniex.com.ci
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date
Tue, 22 Nov 2022 18:09:32 GMT
Last-Modified
Tue, 23 Aug 2022 21:17:55 GMT
Server
Apache
Content-Type
font/woff2
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
39424
proxima-nova-regular.woff2
mail.poloniex.com.ci/css/fonts/ProximaNova/
39 KB
39 KB
Font
General
Full URL
https://mail.poloniex.com.ci/css/fonts/ProximaNova/proxima-nova-regular.woff2
Requested by
Host: mail.poloniex.com.ci
URL: https://mail.poloniex.com.ci/css/font-proxima.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
179.43.140.226 Zurich, Switzerland, ASN51852 (PLI-AS, PA),
Reverse DNS
hostedby.privatealps.net
Software
Apache /
Resource Hash
a8ca63bf7e73b105859b4255a8f911c242f85736c8f5eb377213d28ae89f476e

Request headers

Referer
https://mail.poloniex.com.ci/css/font-proxima.css
Origin
https://mail.poloniex.com.ci
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

Date
Tue, 22 Nov 2022 18:09:32 GMT
Last-Modified
Tue, 23 Aug 2022 21:20:39 GMT
Server
Apache
Content-Type
font/woff2
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
39724

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Poloniex (Crypto Exchange)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery object| mobilenav_btn

0 Cookies