mycoinbase.vip Open in urlscan Pro
67.43.232.3 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://mycoinbase.vip/
Submission: On May 17 via automatic, source certstream-suspicious (May 17th 2024, 6:48:07 pm UTC) — Scanned from CA

Summary HTTP 17 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 4 IPs in 3 countries across 4 domains to perform 17 HTTP transactions. The main IP is 67.43.232.3, located in Canada and belongs to GTCOMM, CA. The main domain is mycoinbase.vip.
TLS certificate: Issued by R3 on May 17th 2024. Valid for: 3 months.

This is the only time mycoinbase.vip was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Coinbase (Crypto Exchange)

Domain & IP information

	IP Address	AS Autonomous System
7	67.43.232.3 67.43.232.3	36666 (GTCOMM) (GTCOMM)
1	172.253.63.95 172.253.63.95	15169 (GOOGLE) (GOOGLE)
7	104.17.249.203 104.17.249.203	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	142.251.163.94 142.251.163.94	15169 (GOOGLE) (GOOGLE)
17	4

7 67.43.232.3 (Canada)

ASN36666 (GTCOMM, CA)
PTR: mail.cpamg06.likuid.com

mycoinbase.vip	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.253.63.95 (United States)

ASN15169 (GOOGLE, US)
PTR: bi-in-f95.1e100.net

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 104.17.249.203 (None, )

ASN13335 (CLOUDFLARENET, US)

unpkg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.251.163.94 (Farmingdale, United States)

ASN15169 (GOOGLE, US)
PTR: wv-in-f94.1e100.net

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	unpkg.com unpkg.com — Cisco Umbrella Rank: 771	9 KB
7	mycoinbase.vip mycoinbase.vip	66 KB
2	gstatic.com fonts.gstatic.com	16 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 33	948 B
17	4

	Domain	Requested by
7	unpkg.com	mycoinbase.vip unpkg.com
7	mycoinbase.vip	mycoinbase.vip
2	fonts.gstatic.com	fonts.googleapis.com
1	fonts.googleapis.com	mycoinbase.vip
17	4

This site contains links to these domains. Also see Links.

Domain
afflat3b3.com

Subject Issuer	Validity	Valid
*.mycoinbase.vip R3	`2024-05-17` - `2024-08-15`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2024-05-06` - `2024-07-29`	3 months	crt.sh
unpkg.com GTS CA 1P5	`2024-04-01` - `2024-06-30`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2024-05-06` - `2024-07-29`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://mycoinbase.vip/
Frame ID: C1C746934DED54DE1C5174A3F90CBE8D
Requests: 17 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Coinbase – Buy & Sell Bitcoin, Ethereum, and more with trust

Detected technologies

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Page Statistics

17
Requests

100 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

92 kB
Transfer

102 kB
Size

0
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://afflat3b3.com/lnk.asp?o=27406&c=918277&a=582861&k=889EFC542B2C7E33BE3D5599750936E3&l=29446

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

17 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
mycoinbase.vip/ 3 KB
3 KB 90ms
27ms Document
text/html 67.43.232.3
GTCOMM

General

Check archive.org

Show headers Download Go to

Full URL: https://mycoinbase.vip/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 67.43.232.3 , Canada, ASN36666 (GTCOMM, CA),
Reverse DNS: mail.cpamg06.likuid.com
Software: Apache /
Resource Hash: c24e35372dd763640e5f73ecd860700904f80e6d33f8b823d2f84479fd40a989

Request headers

Accept-Language: en-CA,en;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

accept-ranges: bytes
content-length: 2726
content-type: text/html
date: Fri, 17 May 2024 18:48:02 GMT
last-modified: Fri, 17 May 2024 18:24:58 GMT
server: Apache

GET
H2 200 css2
fonts.googleapis.com/ 5 KB
948 B 229ms
52ms Stylesheet
text/css 172.253.63.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Poppins:ital,wght@0,300;0,400;0,500;0,600;0,700;1,500;1,600&display=swap

Requested by

Host: mycoinbase.vip
URL: https://mycoinbase.vip/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f95.1e100.net

Software

ESF /

Resource Hash

b562362aa1c0caefb2e5a579e3551c5e2fac71eff0e3863727c866086757de4f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://mycoinbase.vip/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000
date: Fri, 17 May 2024 18:48:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Fri, 17 May 2024 18:48:03 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 17 May 2024 18:48:03 GMT

GET
H2 200 style.css
mycoinbase.vip/ 9 KB
10 KB 37ms
35ms Stylesheet
text/css 67.43.232.3
GTCOMM

General

Check archive.org

Show headers Download Go to

Full URL: https://mycoinbase.vip/style.css
Requested by: Host: mycoinbase.vip
URL: https://mycoinbase.vip/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 67.43.232.3 , Canada, ASN36666 (GTCOMM, CA),
Reverse DNS: mail.cpamg06.likuid.com
Software: Apache /
Resource Hash: 6c9f30ae69483b7dfc500dfbb50b32d6decbe5abf0db1635fe07f2b3050ff101

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://mycoinbase.vip/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 17 May 2024 18:48:02 GMT
last-modified: Fri, 17 May 2024 18:22:54 GMT
server: Apache
accept-ranges: bytes
content-length: 9679
content-type: text/css

GET
H2 200 queries.css
mycoinbase.vip/ 5 KB
5 KB 37ms
35ms Stylesheet
text/css 67.43.232.3
GTCOMM

General

Check archive.org

Show headers Download Go to

Full URL: https://mycoinbase.vip/queries.css
Requested by: Host: mycoinbase.vip
URL: https://mycoinbase.vip/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 67.43.232.3 , Canada, ASN36666 (GTCOMM, CA),
Reverse DNS: mail.cpamg06.likuid.com
Software: Apache /
Resource Hash: 2fffe9655226e37e9244895c23c6bd96b2958e7d7047ca86fe658026b820b5a4

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://mycoinbase.vip/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 17 May 2024 18:48:02 GMT
last-modified: Fri, 17 May 2024 18:22:54 GMT
server: Apache
accept-ranges: bytes
content-length: 5565
content-type: text/css

GET
H2 200 logo.svg
mycoinbase.vip/img/ 4 KB
4 KB 29ms
27ms Image
image/svg+xml 67.43.232.3
GTCOMM

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mycoinbase.vip/img/logo.svg
Requested by: Host: mycoinbase.vip
URL: https://mycoinbase.vip/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 67.43.232.3 , Canada, ASN36666 (GTCOMM, CA),
Reverse DNS: mail.cpamg06.likuid.com
Software: Apache /
Resource Hash: 126270d27d1ac1a29b8d7d01238377840fe79b70212bd230adc6b2d9da82bf38

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://mycoinbase.vip/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 17 May 2024 18:48:02 GMT
last-modified: Fri, 17 May 2024 18:22:55 GMT
server: Apache
accept-ranges: bytes
content-length: 3788
content-type: image/svg+xml

GET
H2 200 banner.webp
mycoinbase.vip/img/ 29 KB
29 KB 36ms
35ms Image
image/webp 67.43.232.3
GTCOMM

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mycoinbase.vip/img/banner.webp
Requested by: Host: mycoinbase.vip
URL: https://mycoinbase.vip/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 67.43.232.3 , Canada, ASN36666 (GTCOMM, CA),
Reverse DNS: mail.cpamg06.likuid.com
Software: Apache /
Resource Hash: f7d696940ac77712e87388734b01e2978518291ae9dade39e0b824743ecf506e

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://mycoinbase.vip/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 17 May 2024 18:48:02 GMT
last-modified: Fri, 17 May 2024 18:22:54 GMT
server: Apache
accept-ranges: bytes
content-length: 30046
content-type: image/webp

GET
H2 200 script.js Show response
mycoinbase.vip/ 227 B
273 B 35ms
34ms Script
application/javascript 67.43.232.3
GTCOMM

General

Check archive.org

Show headers Download Go to

Full URL: https://mycoinbase.vip/script.js
Requested by: Host: mycoinbase.vip
URL: https://mycoinbase.vip/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 67.43.232.3 , Canada, ASN36666 (GTCOMM, CA),
Reverse DNS: mail.cpamg06.likuid.com
Software: Apache /
Resource Hash: e78460b39781ee4c369e5b12b0ddcc627fea7c61228d183f1167df8298031600

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://mycoinbase.vip/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 17 May 2024 18:48:02 GMT
last-modified: Fri, 17 May 2024 18:22:54 GMT
server: Apache
accept-ranges: bytes
content-length: 227
content-type: application/javascript

GET
H2 200 ionicons.esm.js Show response
unpkg.com/ionicons@7.1.0/dist/ionicons/ 340 B
672 B 205ms
33ms Script
application/javascript 104.17.249.203
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://unpkg.com/ionicons@7.1.0/dist/ionicons/ionicons.esm.js

Requested by

Host: mycoinbase.vip
URL: https://mycoinbase.vip/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.249.203 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

062fa0cee97dee43fdd025204c6776ae609d71a55b6117b100bcbf6adf394bd2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://mycoinbase.vip/
Origin: https://mycoinbase.vip
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 17 May 2024 18:48:03 GMT
content-encoding: br
via: 1.1 fly.io
cf-cache-status: HIT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 1554183
last-modified: Sat, 26 Oct 1985 08:15:00 GMT
fly-request-id: 01HWNKXQ7Z0X2CPW8MDBNXYYMQ-yyz
server: cloudflare
etag: "154-Yvf53JjVJOVZ9ojnyzM7GNGGCvg"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 8855c78dfa57ac96-YYZ

GET
H2 200 pxiByp8kv8JHgFVrLEj6Z1xlFQ.woff2
fonts.gstatic.com/s/poppins/v21/ 8 KB
8 KB 120ms
41ms Font
font/woff2 142.251.163.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/poppins/v21/pxiByp8kv8JHgFVrLEj6Z1xlFQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Poppins:ital,wght@0,300;0,400;0,500;0,600;0,700;1,500;1,600&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.94 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f94.1e100.net

Software

sffe /

Resource Hash

f4e80d9dfd374d02989b87a27b5ed4cb78fbb177c27f1478e9a8b0afb7513149

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://fonts.googleapis.com/
Origin: https://mycoinbase.vip
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 15 May 2024 14:21:15 GMT
x-content-type-options: nosniff
age: 188808
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8000
x-xss-protection: 0
last-modified: Fri, 22 Mar 2024 00:00:59 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 15 May 2025 14:21:15 GMT

GET
H2 200 pxiEyp8kv8JHgFVrJJfecg.woff2
fonts.gstatic.com/s/poppins/v21/ 8 KB
8 KB 116ms
38ms Font
font/woff2 142.251.163.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/poppins/v21/pxiEyp8kv8JHgFVrJJfecg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Poppins:ital,wght@0,300;0,400;0,500;0,600;0,700;1,500;1,600&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.94 Farmingdale, United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f94.1e100.net

Software

sffe /

Resource Hash

7d93459d86585bfcdbb7e0376056226adb25821ee54b96236fe2123e9560929f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://fonts.googleapis.com/
Origin: https://mycoinbase.vip
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 15 May 2024 07:50:26 GMT
x-content-type-options: nosniff
age: 212257
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7884
x-xss-protection: 0
last-modified: Fri, 22 Mar 2024 00:00:38 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 15 May 2025 07:50:26 GMT

GET
H2 200 p-d15ec307.js Show response
unpkg.com/ionicons@7.1.0/dist/ionicons/ 8 KB
4 KB 33ms
32ms Script
application/javascript 104.17.249.203
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://unpkg.com/ionicons@7.1.0/dist/ionicons/p-d15ec307.js

Requested by

Host: mycoinbase.vip
URL: https://mycoinbase.vip/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.249.203 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

124547b63964181d189d03dbb1884508fea77622f32709d236552c2c46368c55

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://unpkg.com/ionicons@7.1.0/dist/ionicons/ionicons.esm.js
Origin: https://mycoinbase.vip
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 17 May 2024 18:48:03 GMT
via: 1.1 fly.io
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 6824008
last-modified: Sat, 26 Oct 1985 08:15:00 GMT
fly-request-id: 01HQRJ7PTZSB5H9TQJRE1R32J5-yyz
server: cloudflare
etag: W/"21d1-dJ29Zq7KcbnJnZUTvF7HPfVtDCE"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 8855c78e6ad2ac96-YYZ

GET
H2 200 p-1c0b2c47.entry.js Show response
unpkg.com/ionicons@7.1.0/dist/ionicons/ 4 KB
2 KB 30ms
30ms Script
application/javascript 104.17.249.203
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://unpkg.com/ionicons@7.1.0/dist/ionicons/p-1c0b2c47.entry.js

Requested by

Host: unpkg.com
URL: https://unpkg.com/ionicons@7.1.0/dist/ionicons/p-d15ec307.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.249.203 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a1abb9748933534d9eba6be132c72c9846321f9aa6b063d5b51870299b71f0b3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://unpkg.com/ionicons@7.1.0/dist/ionicons/p-d15ec307.js
Origin: https://mycoinbase.vip
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 17 May 2024 18:48:03 GMT
via: 1.1 fly.io
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 6815596
last-modified: Sat, 26 Oct 1985 08:15:00 GMT
fly-request-id: 01HQRT8D3RSWE6814S8QXCWMZN-yyz
server: cloudflare
etag: W/"102d-HAssR+EnInAFwASMc9EDSQssXSU"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 8855c78eab08ac96-YYZ

GET
H2 200 p-40ae2aa7.js Show response
unpkg.com/ionicons@7.1.0/dist/ionicons/ 1 KB
726 B 33ms
33ms Script
application/javascript 104.17.249.203
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://unpkg.com/ionicons@7.1.0/dist/ionicons/p-40ae2aa7.js

Requested by

Host: mycoinbase.vip
URL: https://mycoinbase.vip/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.249.203 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c20fa1a22f15f8cf1e459b5bd91740823854099e77840b716d8d4aa24e9c7cf1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://unpkg.com/ionicons@7.1.0/dist/ionicons/p-1c0b2c47.entry.js
Origin: https://mycoinbase.vip
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 17 May 2024 18:48:03 GMT
via: 1.1 fly.io
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 6828999
last-modified: Sat, 26 Oct 1985 08:15:00 GMT
fly-request-id: 01HQRDFCVVQ50G0HRCZKMKWQN3-yyz
server: cloudflare
etag: W/"446-Txl4AaMXTHFEqGcTKKB8nQp2w2M"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 8855c78edb4cac96-YYZ

GET
H2 200 menu-outline.svg Show response
unpkg.com/ionicons@7.1.0/dist/ionicons/svg/ 222 B
293 B 32ms
32ms Fetch
image/svg+xml 104.17.249.203
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://unpkg.com/ionicons@7.1.0/dist/ionicons/svg/menu-outline.svg

Requested by

Host: unpkg.com
URL: https://unpkg.com/ionicons@7.1.0/dist/ionicons/p-1c0b2c47.entry.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.249.203 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

941344db7917bd83a91784c7cf12037ea8da017cccdaf5e7aa8882a11460e4f3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://mycoinbase.vip/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 17 May 2024 18:48:03 GMT
via: 1.1 fly.io
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 6828989
last-modified: Sat, 26 Oct 1985 08:15:00 GMT
fly-request-id: 01HQRDFP62F9KVWF5JD2AC01FV-yyz
server: cloudflare
etag: W/"de-PhK//JP5jYPbpp6zhr/3Spt1U4E"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 8855c78f1b84ac96-YYZ

GET
H2 200 logo-bitcoin.svg Show response
unpkg.com/ionicons@7.1.0/dist/ionicons/svg/ 943 B
736 B 38ms
37ms Fetch
image/svg+xml 104.17.249.203
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://unpkg.com/ionicons@7.1.0/dist/ionicons/svg/logo-bitcoin.svg

Requested by

Host: unpkg.com
URL: https://unpkg.com/ionicons@7.1.0/dist/ionicons/p-1c0b2c47.entry.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.249.203 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

35d4ec615e2b5b7bb063717128911594e8e088665a460d36eb122628be0cfc58

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://mycoinbase.vip/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 17 May 2024 18:48:03 GMT
content-encoding: br
via: 1.1 fly.io
cf-cache-status: HIT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 1455
last-modified: Sat, 26 Oct 1985 08:15:00 GMT
fly-request-id: 01HY3WQ9W36SW25CQDQNH6JE65-yyz
server: cloudflare
etag: "3af-WwVaoxC34Bnale8nkGKgksoInK0"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 8855c78f1b85ac96-YYZ

GET
H2 200 close-outline.svg Show response
unpkg.com/ionicons@7.1.0/dist/ionicons/svg/ 222 B
346 B 33ms
32ms Fetch
image/svg+xml 104.17.249.203
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://unpkg.com/ionicons@7.1.0/dist/ionicons/svg/close-outline.svg

Requested by

Host: unpkg.com
URL: https://unpkg.com/ionicons@7.1.0/dist/ionicons/p-1c0b2c47.entry.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.249.203 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e93373f5614e10b000fc398d2b02dd19c8bccae373d034c6cf30b0cb83db226c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://mycoinbase.vip/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 17 May 2024 18:48:03 GMT
content-encoding: br
via: 1.1 fly.io
cf-cache-status: HIT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 1502262
last-modified: Sat, 26 Oct 1985 08:15:00 GMT
fly-request-id: 01HWQ5EECF0NPA85WS95CWZCQ5-yyz
server: cloudflare
etag: "de-5ggNRuw367FDzjbSiXmGFXE8t4A"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 8855c78f1b86ac96-YYZ

GET
H2 200 favicon-192.png
mycoinbase.vip/img/ 15 KB
15 KB 30ms
30ms Other
image/png 67.43.232.3
GTCOMM

General

Check archive.org

Show headers Download Go to

Full URL: https://mycoinbase.vip/img/favicon-192.png
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 67.43.232.3 , Canada, ASN36666 (GTCOMM, CA),
Reverse DNS: mail.cpamg06.likuid.com
Software: Apache /
Resource Hash: 231a61323c76807897ea2fbd17bac69eaaebec23dbde9c4245848f8ac38891dc

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://mycoinbase.vip/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 17 May 2024 18:48:03 GMT
last-modified: Fri, 17 May 2024 18:22:54 GMT
server: Apache
accept-ranges: bytes
content-length: 14914
content-type: image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Coinbase (Crypto Exchange)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| Ionicons

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.googleapis.com
fonts.gstatic.com
mycoinbase.vip
unpkg.com
104.17.249.203
142.251.163.94
172.253.63.95
67.43.232.3
062fa0cee97dee43fdd025204c6776ae609d71a55b6117b100bcbf6adf394bd2
124547b63964181d189d03dbb1884508fea77622f32709d236552c2c46368c55
126270d27d1ac1a29b8d7d01238377840fe79b70212bd230adc6b2d9da82bf38
231a61323c76807897ea2fbd17bac69eaaebec23dbde9c4245848f8ac38891dc
2fffe9655226e37e9244895c23c6bd96b2958e7d7047ca86fe658026b820b5a4
35d4ec615e2b5b7bb063717128911594e8e088665a460d36eb122628be0cfc58
6c9f30ae69483b7dfc500dfbb50b32d6decbe5abf0db1635fe07f2b3050ff101
7d93459d86585bfcdbb7e0376056226adb25821ee54b96236fe2123e9560929f
941344db7917bd83a91784c7cf12037ea8da017cccdaf5e7aa8882a11460e4f3
a1abb9748933534d9eba6be132c72c9846321f9aa6b063d5b51870299b71f0b3
b562362aa1c0caefb2e5a579e3551c5e2fac71eff0e3863727c866086757de4f
c20fa1a22f15f8cf1e459b5bd91740823854099e77840b716d8d4aa24e9c7cf1
c24e35372dd763640e5f73ecd860700904f80e6d33f8b823d2f84479fd40a989
e78460b39781ee4c369e5b12b0ddcc627fea7c61228d183f1167df8298031600
e93373f5614e10b000fc398d2b02dd19c8bccae373d034c6cf30b0cb83db226c
f4e80d9dfd374d02989b87a27b5ed4cb78fbb177c27f1478e9a8b0afb7513149
f7d696940ac77712e87388734b01e2978518291ae9dade39e0b824743ecf506e

mycoinbase.vip Open in urlscan Pro 67.43.232.3 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

17 Requests

100 %HTTPS

0 %IPv6

4 Domains

4 Subdomains

4 IPs

3 Countries

92 kBTransfer

102 kBSize

0 Cookies

1 Outgoing links

Redirected requests

17 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

0 Cookies

Indicators

mycoinbase.vip Open in urlscan Pro
67.43.232.3 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

17
Requests

100 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

92 kB
Transfer

102 kB
Size

0
Cookies

17 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!