firesblack.site Open in urlscan Pro
2606:4700:3030::ac43:c1d9 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://firesblack.site/
Submission: On July 14 via manual (July 14th 2024, 11:17:08 am UTC) from US — Scanned from DE

Summary HTTP 11 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 11 HTTP transactions. The main IP is 2606:4700:3030::ac43:c1d9, located in United States and belongs to CLOUDFLARENET, US. The main domain is firesblack.site.
TLS certificate: Issued by WE1 on July 11th 2024. Valid for: 3 months.

This is the only time firesblack.site was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Fireblocks (Crypto) Generic Cloudflare (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 7	2606:4700:303... 2606:4700:3030::ac43:c1d9	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	23.15.178.139 23.15.178.139	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
4	95.101.111.146 95.101.111.146	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
11	3

7 2606:4700:3030::ac43:c1d9 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

firesblack.site	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.15.178.139 (Düsseldorf, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-15-178-139.deploy.static.akamaitechnologies.com

cdn.livechatinc.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 95.101.111.146 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a95-101-111-146.deploy.static.akamaitechnologies.com

api.livechatinc.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
secure.livechatinc.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	firesblack.site 1 redirects firesblack.site	12 KB
5	livechatinc.com cdn.livechatinc.com — Cisco Umbrella Rank: 5562 api.livechatinc.com — Cisco Umbrella Rank: 5127 secure.livechatinc.com — Cisco Umbrella Rank: 6405	33 KB
11	2

	Domain	Requested by
7	firesblack.site	1 redirects firesblack.site
3	api.livechatinc.com	cdn.livechatinc.com
1	secure.livechatinc.com	cdn.livechatinc.com
1	cdn.livechatinc.com	firesblack.site
11	4

This site contains no links.

Subject Issuer	Validity	Valid
firesblack.site WE1	`2024-07-11` - `2024-10-09`	3 months	crt.sh
livechat.com DigiCert TLS RSA SHA256 2020 CA1	`2024-07-10` - `2025-07-10`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://firesblack.site/
Frame ID: 4E26F94613CA6F8302B086113B2FE8DA
Requests: 10 HTTP requests in this frame

Frame: https://secure.livechatinc.com/customer/action/open_chat?license_id=18207579&group=0&embedded=1&widget_version=3&unique_groups=0
Frame ID: 826100A6FDA5BA8D1C20D26B73CC8320
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Fireblocks

Page URL History Show full URLs

https://firesblack.site/ Page URL
https://firesblack.site/cdn-cgi/phish-bypass?atok=Y.sPownmfWeoXA_oDTYKy5djdTFIwwTh0yjZLoxFB74-172095... HTTP 301
https://firesblack.site/ Page URL

Detected technologies

LiveChat (Live Chat) Expand

Overall confidence: 100%
Detected patterns

cdn\.livechatinc\.com/.*tracking\.js

Page Statistics

11
Requests

100 %
HTTPS

33 %
IPv6

2
Domains

4
Subdomains

3
IPs

2
Countries

45 kB
Transfer

137 kB
Size

6
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://firesblack.site/ Page URL
https://firesblack.site/cdn-cgi/phish-bypass?atok=Y.sPownmfWeoXA_oDTYKy5djdTFIwwTh0yjZLoxFB74-1720955819-0.0.1.1-%2F HTTP 301
https://firesblack.site/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3 200 / Show response
firesblack.site/ 4 KB
2 KB 128ms
20ms Document
text/html 2606:4700:3030::ac43:c1d9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://firesblack.site/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::ac43:c1d9 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

79823bef8a72f04b88d6404f70f2d3e428296216bab2553bd47df423442adffe

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/126.0.6478.108 Mobile/15E148 Safari/604.1

Response headers

cf-ray: 8a311a913e0c656e-AMS
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Sun, 14 Jul 2024 11:16:59 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oPZDowueghKLGhfwuF482Vrt8LoZDAnnq8dY3gfjYhxwSDLg%2BhNrCwdigT98iI5p9ykMvAMIzHv%2BodbVb%2BiKp%2BcNO5iJ1VX25Me3QdzP7Z27HsR%2Fm7FDJ0iDfF2eO%2Bmy7ze5gEzVCHC22D%2Fgx4g%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
x-frame-options: SAMEORIGIN

GET
H3 200 cf.errors.css
firesblack.site/cdn-cgi/styles/ 23 KB
5 KB 17ms
16ms Stylesheet
text/css 2606:4700:3030::ac43:c1d9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://firesblack.site/cdn-cgi/styles/cf.errors.css

Requested by

Host: firesblack.site
URL: https://firesblack.site/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::ac43:c1d9 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

84e3c77025ace5af143972b4a40fc834dcdfd4e449d4b36a57e62326f16b3091

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://firesblack.site/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/126.0.6478.108 Mobile/15E148 Safari/604.1

Response headers

date: Sun, 14 Jul 2024 11:16:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 11 Jul 2024 08:13:48 GMT
server: cloudflare
etag: W/"668f943c-5df3"
x-frame-options: DENY
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=7200, public
cf-ray: 8a311a916e36656e-AMS
expires: Sun, 14 Jul 2024 13:16:59 GMT

GET
H3 200 icon-exclamation.png
firesblack.site/cdn-cgi/images/ 452 B
636 B 16ms
16ms Image
image/png 2606:4700:3030::ac43:c1d9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://firesblack.site/cdn-cgi/images/icon-exclamation.png?1376755637

Requested by

Host: firesblack.site
URL: https://firesblack.site/cdn-cgi/styles/cf.errors.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::ac43:c1d9 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://firesblack.site/cdn-cgi/styles/cf.errors.css
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/126.0.6478.108 Mobile/15E148 Safari/604.1

Response headers

date: Sun, 14 Jul 2024 11:16:59 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Jul 2024 08:13:48 GMT
server: cloudflare
etag: "668f943c-1c4"
x-frame-options: DENY
vary: Accept-Encoding
content-type: image/png
cache-control: max-age=7200, public
accept-ranges: bytes
cf-ray: 8a311a918e63656e-AMS
content-length: 452
expires: Sun, 14 Jul 2024 13:16:59 GMT

GET
H3 404 favicon.ico
firesblack.site/ 371 B
705 B 124ms
124ms Other
text/html 2606:4700:3030::ac43:c1d9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://firesblack.site/favicon.ico
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3030::ac43:c1d9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 35c07c7ddde722dc024a6ee7775398f42f509d00aeda26feedca69b9a77f80c0

Request headers

Referer: https://firesblack.site/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/126.0.6478.108 Mobile/15E148 Safari/604.1

Response headers

date: Sun, 14 Jul 2024 11:16:59 GMT
content-encoding: br
cf-cache-status: EXPIRED
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MdD6g4LVc4ZtAaWND8dDyJ%2B%2FYrjzxCXlvdFhs1uV0PjJuhDZDtdRUaA2F%2FW%2BFxqnjf3BXWalP%2FYfYVFwQVeuixEwV9IiYqXgkYzEMBi2H8QZh2PMzJ3idhhjYll8BXDx47lx43Apz9QvANTd5Go%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html; charset=iso-8859-1
cache-control: max-age=14400
cf-ray: 8a311a91ae81656e-AMS
alt-svc: h3=":443"; ma=86400

GET
H3

200

Primary Request / Show response
firesblack.site/
Redirect Chain

https://firesblack.site/cdn-cgi/phish-bypass?atok=Y.sPownmfWeoXA_oDTYKy5djdTFIwwTh0yjZLoxFB74-1720955819-0.0.1.1-%2F
https://firesblack.site/

3 KB
2 KB

122ms
122ms

Document
text/html

2606:4700:3030::ac43:c1d9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://firesblack.site/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3030::ac43:c1d9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 34599a631ecc6ae8f03098abe7b9069d761006bfabe7e09ba54d2aa5a4f40e59

Request headers

Referer: https://firesblack.site/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/126.0.6478.108 Mobile/15E148 Safari/604.1

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8a311aaad881656e-AMS
content-encoding: br
content-type: text/html; charset=UTF-8
date: Sun, 14 Jul 2024 11:17:03 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0aqo7Wt7s5DWhkul94cpa%2FkNl3Q3b2E227fOEq0pwscxig3F4BfrSR4lcSsChPnuFf5C5PWT5FnjoPPzb%2BoiLwrr3AvSkISDMcJH%2Ft8Op8gHW4w3S6sMpGWWFKiJyRTLb3szXh3fAK19xKkVH%2Fw%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

Redirect headers

cache-control: private, no-cache
cf-ray: 8a311aaab869656e-AMS
content-length: 167
content-type: text/html
date: Sun, 14 Jul 2024 11:17:03 GMT
location: https://firesblack.site/
server: cloudflare
x-content-type-options: nosniff
x-frame-options: DENY

GET
H3 200 logo.svg
firesblack.site/ 8 KB
3 KB 26ms
26ms Image
image/svg+xml 2606:4700:3030::ac43:c1d9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://firesblack.site/logo.svg
Requested by: Host: firesblack.site
URL: https://firesblack.site/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3030::ac43:c1d9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5f8831228b881c8848bca2695ecc7e95d019865a9704122f7dce6dbd69590b10

Request headers

Referer: https://firesblack.site/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/126.0.6478.108 Mobile/15E148 Safari/604.1

Response headers

date: Sun, 14 Jul 2024 11:17:03 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Sat, 13 Jul 2024 08:05:04 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 5243
etag: W/"204a-61d1c741d2509"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ju6j%2BJzGJnohq8iF6fu%2B3wKH9iNVl5wEzf8hXvkG7OCt6EOfZmfQBI4Adt%2FhP3WtcEt6w7WZfIZsx3KzRMP%2F45kve5FpOhc2f8OgloYA11c9pqYvhFXOC2X6A%2F3ieBR1lkgd0T7pfEgPsG%2FhFCo%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/svg+xml
cache-control: max-age=14400
cf-ray: 8a311aaba95a656e-AMS
alt-svc: h3=":443"; ma=86400

GET
H2 200 tracking.js Show response
cdn.livechatinc.com/ 81 KB
26 KB 48ms
11ms Script
application/javascript 23.15.178.139
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.livechatinc.com/tracking.js
Requested by: Host: firesblack.site
URL: https://firesblack.site/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.15.178.139 Düsseldorf, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-15-178-139.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: e22420dfc28eb5093b4992bf8a6f619e68ccbf452353d889b342696b1a7be6a7

Request headers

Referer: https://firesblack.site/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/126.0.6478.108 Mobile/15E148 Safari/604.1

Response headers

x-amz-version-id: ivkX1J2yffWDYf7iUzvbZkNIhRrIZjEC
content-encoding: br
date: Sun, 14 Jul 2024 11:17:03 GMT
x-amz-cf-pop: FRA60-P2
x-amz-server-side-encryption: AES256
cross-origin-resource-policy: cross-origin
content-length: 26473
last-modified: Wed, 10 Jul 2024 06:54:48 GMT
server: AmazonS3
etag: W/"7c2896e2c74a3b93802d6116e79ff798"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=28800
x-amz-cf-id: 82D907fyWuuaF3kMC1mDrF9In_HcSmw-RUKPOKNSZpj9wEQvDo4_1g==
expires: Sun, 14 Jul 2024 19:17:03 GMT

GET
H2 200 get_dynamic_configuration Show response
api.livechatinc.com/v3.6/customer/action/ 345 B
561 B 224ms
194ms Script
application/javascript 95.101.111.146
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://api.livechatinc.com/v3.6/customer/action/get_dynamic_configuration?license_id=18207579&client_id=c5e4f61e1a6c3b1521b541bc5c5a2ac5&url=https%3A%2F%2Ffiresblack.site%2F&channel_type=code&origin=livechat&implementation_type=manual_channels&jsonp=__ilek84ml0e

Requested by

Host: cdn.livechatinc.com
URL: https://cdn.livechatinc.com/tracking.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

95.101.111.146 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a95-101-111-146.deploy.static.akamaitechnologies.com

Software

Resource Hash

f3adfa4294ad71f6925ddeb85541aa003d687b8344a69be178ef26a407f67684

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://firesblack.site/;
X-Frame-Options	allow-from https://firesblack.site/

Request headers

Referer: https://firesblack.site/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/126.0.6478.108 Mobile/15E148 Safari/604.1

Response headers

content-security-policy: frame-ancestors https://firesblack.site/;
date: Sun, 14 Jul 2024 11:17:04 GMT
cross-origin-resource-policy: cross-origin
content-length: 345
vary: Accept-Encoding
x-frame-options: allow-from https://firesblack.site/
content-type: application/javascript; charset=UTF-8

GET
H2 200 get_configuration Show response
api.livechatinc.com/v3.4/customer/action/ 5 KB
2 KB 187ms
187ms Script
application/javascript 95.101.111.146
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://api.livechatinc.com/v3.4/customer/action/get_configuration?organization_id=2f55cb77-f855-414d-9900-596ce884ed69&version=21.0.1.1.1.1.1.1.1.1.1.3.1&group_id=0&jsonp=__lc_static_config
Requested by: Host: cdn.livechatinc.com
URL: https://cdn.livechatinc.com/tracking.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 95.101.111.146 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a95-101-111-146.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 4b8e4d43362e96a7b7073a01d334d97287d28a3c171f844a7f3331325c3ebe79

Request headers

Referer: https://firesblack.site/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/126.0.6478.108 Mobile/15E148 Safari/604.1

Response headers

date: Sun, 14 Jul 2024 11:17:04 GMT
content-encoding: gzip
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
deprecation: 2024-11-30
cache-control: public, max-age=600
cross-origin-resource-policy: cross-origin
content-length: 1508
expires: Sun, 14 Jul 2024 11:27:04 GMT

GET
H/1.1 200
OK open_chat
secure.livechatinc.com/customer/action/ Frame 8261 0
0 201ms
170ms Document
text/html 95.101.111.146
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.livechatinc.com/customer/action/open_chat?license_id=18207579&group=0&embedded=1&widget_version=3&unique_groups=0
Requested by: Host: cdn.livechatinc.com
URL: https://cdn.livechatinc.com/tracking.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 95.101.111.146 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a95-101-111-146.deploy.static.akamaitechnologies.com
Software: /
Resource Hash

Request headers

Referer: https://firesblack.site/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/126.0.6478.108 Mobile/15E148 Safari/604.1

Response headers

Connection: keep-alive
Content-Encoding: gzip
Content-Length: 744
Content-Type: text/html; charset=utf-8
Date: Sun, 14 Jul 2024 11:17:04 GMT
Vary: Accept-Encoding
cross-origin-resource-policy: cross-origin

GET
H2 200 get_localization Show response
api.livechatinc.com/v3.4/customer/action/ 11 KB
4 KB 154ms
153ms Script
application/javascript 95.101.111.146
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://api.livechatinc.com/v3.4/customer/action/get_localization?organization_id=2f55cb77-f855-414d-9900-596ce884ed69&version=470b74842e9d45ce9f156d1d5a957bad&language=en&group_id=0&jsonp=__lc_localization
Requested by: Host: cdn.livechatinc.com
URL: https://cdn.livechatinc.com/tracking.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 95.101.111.146 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a95-101-111-146.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 0b5f85dfe715ad05b49501aa63c5294f69c822ec0441152bbcdca9bd2abbe298

Request headers

Referer: https://firesblack.site/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/126.0.6478.108 Mobile/15E148 Safari/604.1

Response headers

date: Sun, 14 Jul 2024 11:17:04 GMT
content-encoding: gzip
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
deprecation: 2024-11-30
cache-control: public, max-age=600
cross-origin-resource-policy: cross-origin
content-length: 3957
expires: Sun, 14 Jul 2024 11:27:04 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Fireblocks (Crypto) Generic Cloudflare (Online)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

6 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.accounts.livechatinc.com/v2/customer/token	1970-01-21 07:38:35	Name: __lc_cid Value: 9f53bd30-13bb-4847-a1c3-ca040a744481
.accounts.livechatinc.com/v2/customer/token	1970-01-21 07:38:35	Name: __lc_cst Value: ae340499bb94eb2c2c9792eedde1456ca4272ed49300889c2dfe5363d35ee03da77050b37dd2bce254111d7070affca3b1750be5430442bb76a8d9648bb5
.accounts.livechatinc.com/customer/token	1970-01-21 07:38:35	Name: __lc_cid Value: 9f53bd30-13bb-4847-a1c3-ca040a744481
.accounts.livechatinc.com/customer/token	1970-01-21 07:38:35	Name: __lc_cst Value: ae340499bb94eb2c2c9792eedde1456ca4272ed49300889c2dfe5363d35ee03da77050b37dd2bce254111d7070affca3b1750be5430442bb76a8d9648bb5
.firesblack.site/	1970-01-20 22:04:02	Name: __cf_mw_byp Value: Y.sPownmfWeoXA_oDTYKy5djdTFIwwTh0yjZLoxFB74-1720955819-0.0.1.1-/
accounts.livechatinc.com/	1970-01-20 22:02:35	Name: __oauth_redirect_detector Value: counter=1&t=1720955854&tag=37d22eb3105cf38d0b9d5077a35726d265d36ae5

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://firesblack.site/favicon.ico Message: Failed to load resource: the server responded with a status of 404 ()
recommendation	verbose	URL: https://firesblack.site/ Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api.livechatinc.com
cdn.livechatinc.com
firesblack.site
secure.livechatinc.com
23.15.178.139
2606:4700:3030::ac43:c1d9
95.101.111.146
0b5f85dfe715ad05b49501aa63c5294f69c822ec0441152bbcdca9bd2abbe298
34599a631ecc6ae8f03098abe7b9069d761006bfabe7e09ba54d2aa5a4f40e59
35c07c7ddde722dc024a6ee7775398f42f509d00aeda26feedca69b9a77f80c0
4b8e4d43362e96a7b7073a01d334d97287d28a3c171f844a7f3331325c3ebe79
5f8831228b881c8848bca2695ecc7e95d019865a9704122f7dce6dbd69590b10
79823bef8a72f04b88d6404f70f2d3e428296216bab2553bd47df423442adffe
84e3c77025ace5af143972b4a40fc834dcdfd4e449d4b36a57e62326f16b3091
e22420dfc28eb5093b4992bf8a6f619e68ccbf452353d889b342696b1a7be6a7
f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016
f3adfa4294ad71f6925ddeb85541aa003d687b8344a69be178ef26a407f67684

firesblack.site Open in urlscan Pro 2606:4700:3030::ac43:c1d9 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

11 Requests

100 %HTTPS

33 %IPv6

2 Domains

4 Subdomains

3 IPs

2 Countries

45 kBTransfer

137 kBSize

6 Cookies

0 Outgoing links

Page URL History

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

6 JavaScript Global Variables

6 Cookies

2 Console Messages

Security Headers

Indicators

firesblack.site Open in urlscan Pro
2606:4700:3030::ac43:c1d9 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

100 %
HTTPS

33 %
IPv6

2
Domains

4
Subdomains

3
IPs

2
Countries

45 kB
Transfer

137 kB
Size

6
Cookies

11 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!