csgomap.execellent.com Open in urlscan Pro
2a06:98c1:3121::3 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://csgomap.execellent.com/
Submission Tags: phishingrod
Submission: On September 19 via api (September 19th 2023, 5:32:24 pm UTC) from DE — Scanned from NL

Summary HTTP 17 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 10 IPs in 4 countries across 9 domains to perform 17 HTTP transactions. The main IP is 2a06:98c1:3121::3, located in United States and belongs to CLOUDFLARENET, US. The main domain is csgomap.execellent.com.
TLS certificate: Issued by E1 on September 19th 2023. Valid for: 3 months.

This is the only time csgomap.execellent.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Steam (Gaming)

Domain & IP information

	IP Address	AS Autonomous System
3	2a06:98c1:312... 2a06:98c1:3121::3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	2606:4700::68... 2606:4700::6810:5814	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	76.76.21.164 76.76.21.164	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700::68... 2606:4700::6810:3965	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	104.18.42.105 104.18.42.105	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	124.95.191.43 124.95.191.43	4837 (CHINA169-...) (CHINA169-BACKBONE CHINA UNICOM China169 Backbone)
1	58.218.215.167 58.218.215.167	4134 (CHINANET-...) (CHINANET-BACKBONE No.31)
1	120.52.95.239 120.52.95.239	133119 (UNICOM-CN...) (UNICOM-CN China Unicom IP network)
1	101.32.192.8 101.32.192.8	132203 (TENCENT-N...) (TENCENT-NET-AP-CN Tencent Building)
2	2606:4700::68... 2606:4700::6810:3865	() ()
17	10

3 2a06:98c1:3121::3 (United States)

ASN13335 (CLOUDFLARENET, US)

csgomap.execellent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2606:4700::6810:5814 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 76.76.21.164 (Walnut, United States)

ASN16509 (AMAZON-02, US)

steamcard.vercel.app	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:3965 (United States)

ASN13335 (CLOUDFLARENET, US)

static.cloudflareinsights.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.18.42.105 (None, )

ASN13335 (CLOUDFLARENET, US)

cdn.cloudflare.steamstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 124.95.191.43 (China)

ASN4837 (CHINA169-BACKBONE CHINA UNICOM China169 Backbone, CN)

bbs.zombieden.cn	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 58.218.215.167 (China)

ASN4134 (CHINANET-BACKBONE No.31,Jin-rong Street, CN)

fyscs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 120.52.95.239 (China)

ASN133119 (UNICOM-CN China Unicom IP network, CN)

csgo.moeub.cn	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 101.32.192.8 (Hong Kong, Hong Kong)

ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN)

bbs.upkk.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6810:3865 (None, )

ASN- ()

cloudflareinsights.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 558	211 KB
3	cloudflareinsights.com static.cloudflareinsights.com — Cisco Umbrella Rank: 1476 cloudflareinsights.com	7 KB
3	execellent.com csgomap.execellent.com	215 KB
1	upkk.com bbs.upkk.com	1 KB
1	moeub.cn csgo.moeub.cn	4 KB
1	fyscs.com fyscs.com	7 KB
1	zombieden.cn bbs.zombieden.cn
1	steamstatic.com cdn.cloudflare.steamstatic.com — Cisco Umbrella Rank: 9944	2 KB
1	vercel.app steamcard.vercel.app	37 KB
17	9

	Domain	Requested by
5	cdn.jsdelivr.net	csgomap.execellent.com cdn.jsdelivr.net
3	csgomap.execellent.com	csgomap.execellent.com cdn.jsdelivr.net
2	cloudflareinsights.com	static.cloudflareinsights.com
1	bbs.upkk.com	csgomap.execellent.com
1	csgo.moeub.cn	csgomap.execellent.com
1	fyscs.com	csgomap.execellent.com
1	bbs.zombieden.cn	csgomap.execellent.com
1	cdn.cloudflare.steamstatic.com	csgomap.execellent.com
1	static.cloudflareinsights.com	csgomap.execellent.com
1	steamcard.vercel.app	csgomap.execellent.com
17	10

This site contains links to these domains. Also see Links.

Domain
github.com

Subject Issuer	Validity	Valid
csgomap.execellent.com E1	`2023-09-19` - `2023-12-18`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-05-02` - `2024-05-01`	a year	crt.sh
*.vercel.app R3	`2023-07-08` - `2023-10-06`	3 months	crt.sh
bbs.zombieden.cn TrustAsia RSA DV TLS CA G2	`2023-01-27` - `2024-01-27`	a year	crt.sh
fyscs.com Encryption Everywhere DV TLS CA - G1	`2023-05-13` - `2024-05-12`	a year	crt.sh
moeub.cn ZeroSSL RSA Domain Secure Site CA	`2023-09-11` - `2023-12-10`	3 months	crt.sh
bbs.upkk.com TrustAsia RSA DV TLS CA G2	`2023-02-14` - `2024-03-15`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://csgomap.execellent.com/
Frame ID: AA9301F5F590F8BB5A7FA80E1A4C45C7
Requests: 16 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Vue.js (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

(?:/([\d.]+))?/vue(?:\.min)?\.js

Axios (JavaScript libraries) Expand

Overall confidence: 100%
Detected patterns

/axios(@|/)([\d.]+)(?:/[a-z]+)?/axios(?:.min)?\.js

Cloudflare Browser Insights (Analytics) Expand

Overall confidence: 100%
Detected patterns

static\.cloudflareinsights\.com/beacon(?:\.min)?\.js

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

<link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
//cdn\.jsdelivr\.net/

Page Statistics

17
Requests

100 %
HTTPS

40 %
IPv6

9
Domains

10
Subdomains

10
IPs

4
Countries

484 kB
Transfer

2172 kB
Size

0
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://github.com/9268/csgomapclean
Title: github

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

17 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
csgomap.execellent.com/ 18 KB
5 KB 267ms
126ms Document
text/html 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://csgomap.execellent.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7c420abd53a61e6269511fd962742bf20e97bdbde40e8350889556ecd03788f7

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
cache-control: public, max-age=0, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 80939116ca123830-FRA
content-encoding: br
content-type: text/html; charset=utf-8
date: Tue, 19 Sep 2023 17:32:13 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5kFdwDADdaBRIZfHAdGiikgRT%2Bf%2FOfRYzVeg3lSLH0kvv0lIZa5Kj9ACjXP%2BJckcC6ag2W7%2BZPC3%2FKM18O17Ep7oisNtXR7wk0Ac6QAZsgJljHXmJOW0Cr3Q4%2BuI3VkgCfLIf4pX%2F6lkL2HfUg5mHcjyX1V6"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
x-content-type-options: nosniff

GET
H2 200 mdui.min.css
cdn.jsdelivr.net/npm/mdui@1.0.2/dist/css/ 318 KB
34 KB 98ms
45ms Stylesheet
text/css 2606:4700::6810:5814
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/mdui@1.0.2/dist/css/mdui.min.css

Requested by

Host: csgomap.execellent.com
URL: https://csgomap.execellent.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5814 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1c2fda3c0aed39cef2c3ad98701cc6db8b095e35c9bb46adba3661f5ae0bb54c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://csgomap.execellent.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 17:32:13 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 18089047
x-jsd-version: 1.0.2
content-encoding: br
x-cache: HIT, MISS
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-served-by: cache-fra-eddf8230124-FRA, cache-jnb7027-JNB
x-jsd-version-type: version
server: cloudflare
etag: W/"4f6da-r8CbHxaeKloJRtPzOADq4COux68"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=phZ%2BFxUl6dxFtWcCuP6Pb2n%2FhmHhf%2BvXtaw6AkKsejb7g9uaSH7v1FJlBTzQuJu%2BdoYu0XUZl5I1duSS9vgEe6W35WJqKVurmTgeEEmWGSSrzlKNujtjnwVs94%2Flo9S5t2oXRgGCk3Y9QMUMzWE%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin: *
cf-ray: 80939117ef1e3672-FRA

GET
H2 200 dark,badge,group
steamcard.vercel.app/card/76561199062253455/ 53 KB
37 KB 2711ms
2648ms Image
image/svg+xml 76.76.21.164
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://steamcard.vercel.app/card/76561199062253455/dark,badge,group

Requested by

Host: csgomap.execellent.com
URL: https://csgomap.execellent.com/

Protocol

Security

TLS 1.3, , CHACHA20_POLY1305

Server

76.76.21.164 Walnut, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Vercel /

Resource Hash

4a0bd78abf2561778c1fa64b5244e0bff4475e528b97864d833b5cd615a838a5

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://csgomap.execellent.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 17:32:15 GMT
content-encoding: br
strict-transport-security: max-age=63072000; includeSubDomains; preload
server: Vercel
x-vercel-id: fra1::iad1::4xcpc-1695144733438-f0c749645408
age: 0
x-vercel-cache: MISS
content-type: image/svg+xml
cache-control: public, max-age=86400

GET
H2 200 email-decode.min.js Show response
csgomap.execellent.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/ 1 KB
1 KB 32ms
31ms Script
application/javascript 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://csgomap.execellent.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js

Requested by

Host: csgomap.execellent.com
URL: https://csgomap.execellent.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://csgomap.execellent.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 17:32:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 12 Sep 2023 15:48:14 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"6500883e-4d7"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2MJ18cPN1Y5BSplrc8uQhSknD%2FWOv%2FU2004zr4DHABMak0nvi5Gqa2keYbP0DpZqH7Hy2kIqAfOl4xfBrudkip5nu3j%2B8T%2FNESXU5vu6cYIXFbDmUBmld42PIkjvyg4xyPH0ch3Icof1uijxsZZXMy5nCwyZ"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
x-frame-options: DENY
cache-control: max-age=172800, public
cf-ray: 80939117ab823830-FRA
expires: Thu, 21 Sep 2023 17:32:13 GMT

GET
H2 200 mdui.min.js Show response
cdn.jsdelivr.net/npm/mdui@1.0.2/dist/js/ 72 KB
21 KB 92ms
42ms Script
application/javascript 2606:4700::6810:5814
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/mdui@1.0.2/dist/js/mdui.min.js

Requested by

Host: csgomap.execellent.com
URL: https://csgomap.execellent.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5814 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a50321aede22fb162e6737ca6e85d31369675c371c67ca88d8587c8321ad5fa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://csgomap.execellent.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 17:32:13 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 18089047
x-jsd-version: 1.0.2
content-encoding: br
x-cache: HIT, MISS
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-served-by: cache-fra-eddf8230061-FRA, cache-jnb7022-JNB
x-jsd-version-type: version
server: cloudflare
etag: W/"12125-7MZesUCol9rrmaR3bvNplxUa14A"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BV6C5%2FxymkGkVQJvn9l7T8qfivWtOJSPVk4tA%2B8ENX1eErj%2F9T7zcmva5UDPOAhG7gEfABbA9oVKetWYbXaH31IG5m8i89GQO4WSS7%2BFqsHWaALftuUIVMSrSsyoGYgEGDjnTRJl2ZJGnGZsz0o%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin: *
cf-ray: 80939117ef213672-FRA

GET
H2 200 vue.js Show response
cdn.jsdelivr.net/npm/vue@2/dist/ 424 KB
104 KB 116ms
66ms Script
application/javascript 2606:4700::6810:5814
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/vue@2/dist/vue.js

Requested by

Host: csgomap.execellent.com
URL: https://csgomap.execellent.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5814 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a2029697010cdf442eea110b24c9735fdacfa9219860ad6ed888b320d102e609

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://csgomap.execellent.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 17:32:13 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 17447
x-jsd-version: 2.7.14
content-encoding: br
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-served-by: cache-fra-eddf8230078-FRA, cache-yyz4523-YYZ
x-jsd-version-type: version
server: cloudflare
etag: W/"69e4a-BKrau4AkkDJGeiJbm9fIy8gIwGA"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZBXoJG0GXLLEKg30pDfA9SvoV1LJzWB5zwcovKQtjtDjiPRwIwhNK3UgzP%2B2%2BwgU16MJw%2Ff79Ht99VJWYcmKtE%2FRLghTY1CAORo6CZxE%2BV%2FHEJm13VKMwvpN47cPjpxY8sjypiPHDbWjkXdlGvg%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
timing-allow-origin: *
cf-ray: 80939117ef263672-FRA

GET
H2 200 axios.min.js Show response
cdn.jsdelivr.net/npm/axios@0.27.2/dist/ 20 KB
8 KB 88ms
37ms Script
application/javascript 2606:4700::6810:5814
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/axios@0.27.2/dist/axios.min.js

Requested by

Host: csgomap.execellent.com
URL: https://csgomap.execellent.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5814 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e373b70a5167485c73a265421bcfcd1fdddbae49c9c51605e6d2918a3de4ae0d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://csgomap.execellent.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 17:32:13 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 12653363
x-jsd-version: 0.27.2
content-encoding: br
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-served-by: cache-fra-eddf8230138-FRA, cache-yyz4582-YYZ
x-jsd-version-type: version
server: cloudflare
etag: W/"511b-FCNxITHKHBRxCXquG/QTMqrMtJE"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZM0dmJ5V29ySdK8RShIIpDv8LUuW%2Fe15yorobCBv%2FNi5vD8QcWCPCc5TpqJyCdfEnrYQwDh85TjPDJxOaw91Nxw8HiHFijUoH38ykuDQ6mYiv9sFyO7TkldFCoWYZouT1h0Fg3IlVa5wEc3Z9qA%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin: *
cf-ray: 80939117ef233672-FRA

GET
H2 200 beacon.min.js Show response
static.cloudflareinsights.com/ 20 KB
7 KB 142ms
82ms Script
text/javascript 2606:4700::6810:3965
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://static.cloudflareinsights.com/beacon.min.js
Requested by: Host: csgomap.execellent.com
URL: https://csgomap.execellent.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:3965 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c235f21017bcc11fcaa31d7dfd9855aaebcbf5f6d7ee9bf9f2e98a910907c391

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://csgomap.execellent.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 17:32:13 GMT
content-encoding: gzip
last-modified: Thu, 20 Jul 2023 18:10:27 GMT
server: cloudflare
etag: W/"2023.7.1"
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
cf-ray: 80939117f97e03a6-FRA

GET
H3 200 MaterialIcons-Regular.woff2
cdn.jsdelivr.net/npm/mdui@1.0.2/dist/icons/material-icons/ 43 KB
44 KB 67ms
38ms Font
font/woff2 2606:4700::6810:5814
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/mdui@1.0.2/dist/icons/material-icons/MaterialIcons-Regular.woff2

Requested by

Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/npm/mdui@1.0.2/dist/css/mdui.min.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:5814 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a87d66c91b2e7dc5530aef76c03bd6a3d25ea5826110bf4803b561b811cc8726

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://cdn.jsdelivr.net/npm/mdui@1.0.2/dist/css/mdui.min.css
Origin: https://csgomap.execellent.com
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 17:32:13 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 6390400
x-jsd-version: 1.0.2
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 44300
x-served-by: cache-fra-eddf8230133-FRA, cache-yyz4557-YYZ
x-jsd-version-type: version
server: cloudflare
etag: W/"ad0c-CZY1kujJU8x+FOP7ClsF1QQuhDU"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0kC%2FCrAUnRlyuI4og0VQHAe4McKJjzZvS2EyUJ4SwQLMvEXoxpVK0yVPNIfXJIf7Ven9DzJvWGuB5UIcy1NuuPCRAnLixgdBJkCK1%2Bhvld8J7EPsbPS6gp%2BO9u9zqTz8YZdoCHh1zZeU7J4PbLA%3D"}],"group":"cf-nel","max_age":604800}
content-type: font/woff2
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 809391189e6930cf-FRA

GET
H3 200 maps.json Show response
csgomap.execellent.com/ 1 MB
209 KB 205ms
205ms XHR
application/json 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://csgomap.execellent.com/maps.json

Requested by

Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/npm/axios@0.27.2/dist/axios.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5bba3849903ba50b5a92571689f1fb7e4f7f2257da463e09c0e1a7359019e683

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer: https://csgomap.execellent.com/
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 17:32:13 GMT
content-encoding: br
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-cache-status: DYNAMIC
etag: W/"a5eaeed0376bf9d2ea39472a93f0f2b1"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=93ACM3gAOGAKSFfme9YJyL07DkHAk5ES%2B%2BDZtJSnMSjH1U98NM%2B35HXJOJ5h%2F3XZ%2BSfRHvUmnrY6ffqnoOd2V3gvh9max5r%2FeSJttwgnCwykwYno23Dkdz6M272FEVOQoQata0PlWU9J1PN2DktzPlBX2bjU"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
cf-ray: 8093911918dc37e8-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 69f7ebe2735c366c65c0b33dae00e12dc40edbe4.jpg
cdn.cloudflare.steamstatic.com/steamcommunity/public/images/apps/730/ 1 KB
2 KB 114ms
59ms Image
image/jpeg 104.18.42.105
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.cloudflare.steamstatic.com/steamcommunity/public/images/apps/730/69f7ebe2735c366c65c0b33dae00e12dc40edbe4.jpg
Requested by: Host: csgomap.execellent.com
URL: https://csgomap.execellent.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.42.105 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b13ba298064a23f96a0cae5c50b57347457cd3bba2c1f6c6ee05e4c8ca291f37

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://csgomap.execellent.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 17:32:14 GMT
cf-cache-status: HIT
cf-bgj: h2pri
last-modified: Thu, 22 Jul 2021 20:00:05 GMT
server: cloudflare
age: 52047396
etag: "60f9ce45-54a"
vary: Accept-Encoding
content-type: image/jpeg
edge-control: !no-store,!bypass-cache,cache-maxage=315360000
cache-control: max-age=315360000, public, max-age=315360000
accept-ranges: bytes
cf-ray: 8093911c0b781daa-FRA
content-length: 1354
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 403 favicon.ico
bbs.zombieden.cn/ 0
0 5856ms
170ms Image
text/html 124.95.191.43
CHINA169-BACKBONE...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bbs.zombieden.cn/favicon.ico
Requested by: Host: csgomap.execellent.com
URL: https://csgomap.execellent.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 124.95.191.43 , China, ASN4837 (CHINA169-BACKBONE CHINA UNICOM China169 Backbone, CN),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://csgomap.execellent.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

GET
H2 200 favicon.ico
fyscs.com/ 7 KB
7 KB 3053ms
304ms Image
image/x-icon 58.218.215.167
CHINANET-BACKBONE...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://fyscs.com/favicon.ico

Requested by

Host: csgomap.execellent.com
URL: https://csgomap.execellent.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

58.218.215.167 , China, ASN4134 (CHINANET-BACKBONE No.31,Jin-rong Street, CN),

Reverse DNS

Software

Kxnrl.Kestrel /

Resource Hash

aa8d94f3f9e6c26ac99adbb14fa0c2426a5c03f321df8393c0fce4d0d50ec4af

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains, max-age=31536000

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://csgomap.execellent.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains, max-age=31536000
date: Mon, 28 Aug 2023 04:15:51 GMT
via: cache7.l2ea120-6[0,0,200-0,H], cache30.l2ea120-6[2,0], kunlun1.cn192[0,16,200-0,H], kunlun3.cn192[22,0]
age: 1948585
x-swift-cachetime: 29883201
x-cache: HIT TCP_HIT dirn:10:888384200
x-swift-savetime: Mon, 11 Sep 2023 07:22:30 GMT
content-length: 6782
last-modified: Tue, 04 Oct 2022 20:09:04 GMT
server: Kxnrl.Kestrel
x-datacenter: cn-shenzhen-AliyunCS.main
etag: "633c92e0-1a7e"
ali-swift-global-savetime: 1693196151
content-type: image/x-icon
x-server: Kxnrl.Kestrel
accept-ranges: bytes
timing-allow-origin: *
eagleid: 3adad01716951447369218487e

GET
H2 200 moeub_logo.svg
csgo.moeub.cn/ 3 KB
4 KB 2325ms
199ms Image
image/svg+xml 120.52.95.239
UNICOM-CN China U...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://csgo.moeub.cn/moeub_logo.svg
Requested by: Host: csgomap.execellent.com
URL: https://csgomap.execellent.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 120.52.95.239 , China, ASN133119 (UNICOM-CN China Unicom IP network, CN),
Reverse DNS
Software: openresty /
Resource Hash: fb30c087b995cce523d8488af03c1f6d58b7876626584796e4c5381094a4422c

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://csgomap.execellent.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

nginx-hit: 1
date: Tue, 19 Sep 2023 17:32:16 GMT
via: CHN-HElangfang-AREACUCC1-CACHE27[4],CHN-HElangfang-AREACUCC1-CACHE41[0,TCP_HIT,2],CHN-TJ-GLOBAL1-CACHE13[24],CHN-TJ-GLOBAL1-CACHE41[11,TCP_MISS,20]
x-ccdn-cachettl: 31536000
age: 272669
alt-svc: h3=":443"; ma=2592000
content-length: 3111
last-modified: Sat, 16 Sep 2023 13:45:38 GMT
server: openresty
etag: "6505b182-c27"
access-control-allow-methods: *
content-type: image/svg+xml
access-control-allow-origin: *
x-ccdn-req-id-46b1: dde795f2818c1ad9e4b36fb7c89bbb8f
x-ccdn-expires: 31263331
accept-ranges: bytes
access-control-allow-headers: *
x-hcs-proxy-type: 1

GET
H2 200 favicon.ico
bbs.upkk.com/ 1 KB
1 KB 1538ms
411ms Image
image/x-icon 101.32.192.8
TENCENT-NET-AP-CN...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bbs.upkk.com/favicon.ico
Requested by: Host: csgomap.execellent.com
URL: https://csgomap.execellent.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 101.32.192.8 Hong Kong, Hong Kong, ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN),
Reverse DNS
Software: nginx / (BeeGo1.20/GoLang)
Resource Hash: b2b65e764ab1eecf61131576723c1edf64244315895b447e1a68f4a34ff5dd2a

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://csgomap.execellent.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 17:32:15 GMT
last-modified: Tue, 24 May 2016 02:07:57 GMT
server: nginx
etag: "9be6551761b5d11:0"
x-powered-by: (BeeGo1.20/GoLang)
x-cache: MISS
content-type: image/x-icon
cache-control: no-cache, no-cache
accept-ranges: bytes
content-length: 1150

POST
H2 204 rum Show response
cloudflareinsights.com/cdn-cgi/ 0
37 B 26ms
26ms XHR
text/plain 2606:4700::6810:3865

General

Check archive.org

Show headers Download Go to

Full URL

https://cloudflareinsights.com/cdn-cgi/rum

Requested by

Host: static.cloudflareinsights.com
URL: https://static.cloudflareinsights.com/beacon.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:3865 -, , ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://csgomap.execellent.com/
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36
content-type: application/json

Response headers

date: Tue, 19 Sep 2023 17:32:20 GMT
x-content-type-options: nosniff
server: cloudflare
vary: Origin
access-control-max-age: 86400
access-control-allow-methods: POST,OPTIONS
access-control-allow-origin: https://csgomap.execellent.com
x-frame-options: DENY
access-control-allow-credentials: true
cf-ray: 809391413b285c6e-FRA

OPTIONS
H2 200 rum
cloudflareinsights.com/cdn-cgi/ 0
0 141ms
24ms Preflight
text/plain 2606:4700::6810:3865

General

Check archive.org

Show headers Download Go to

Full URL

https://cloudflareinsights.com/cdn-cgi/rum

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:3865 -, , ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://csgomap.execellent.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.88 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type
access-control-allow-methods: POST,OPTIONS
access-control-allow-origin: https://csgomap.execellent.com
access-control-max-age: 86400
cf-ray: 809391410add5c6e-FRA
content-encoding: gzip
content-type: text/plain
date: Tue, 19 Sep 2023 17:32:20 GMT
server: cloudflare
vary: Origin
x-content-type-options: nosniff
x-frame-options: DENY

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Steam (Gaming)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://bbs.zombieden.cn/favicon.ico Message: Failed to load resource: the server responded with a status of 403 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bbs.upkk.com
bbs.zombieden.cn
cdn.cloudflare.steamstatic.com
cdn.jsdelivr.net
cloudflareinsights.com
csgo.moeub.cn
csgomap.execellent.com
fyscs.com
static.cloudflareinsights.com
steamcard.vercel.app
101.32.192.8
104.18.42.105
120.52.95.239
124.95.191.43
2606:4700::6810:3865
2606:4700::6810:3965
2606:4700::6810:5814
2a06:98c1:3121::3
58.218.215.167
76.76.21.164
1c2fda3c0aed39cef2c3ad98701cc6db8b095e35c9bb46adba3661f5ae0bb54c
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
4a0bd78abf2561778c1fa64b5244e0bff4475e528b97864d833b5cd615a838a5
5bba3849903ba50b5a92571689f1fb7e4f7f2257da463e09c0e1a7359019e683
7c420abd53a61e6269511fd962742bf20e97bdbde40e8350889556ecd03788f7
a2029697010cdf442eea110b24c9735fdacfa9219860ad6ed888b320d102e609
a50321aede22fb162e6737ca6e85d31369675c371c67ca88d8587c8321ad5fa4
a87d66c91b2e7dc5530aef76c03bd6a3d25ea5826110bf4803b561b811cc8726
aa8d94f3f9e6c26ac99adbb14fa0c2426a5c03f321df8393c0fce4d0d50ec4af
b13ba298064a23f96a0cae5c50b57347457cd3bba2c1f6c6ee05e4c8ca291f37
b2b65e764ab1eecf61131576723c1edf64244315895b447e1a68f4a34ff5dd2a
c235f21017bcc11fcaa31d7dfd9855aaebcbf5f6d7ee9bf9f2e98a910907c391
e373b70a5167485c73a265421bcfcd1fdddbae49c9c51605e6d2918a3de4ae0d
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
fb30c087b995cce523d8488af03c1f6d58b7876626584796e4c5381094a4422c

csgomap.execellent.com Open in urlscan Pro 2a06:98c1:3121::3 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

17 Requests

100 %HTTPS

40 %IPv6

9 Domains

10 Subdomains

10 IPs

4 Countries

484 kBTransfer

2172 kBSize

0 Cookies

1 Outgoing links

Redirected requests

17 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

7 JavaScript Global Variables

0 Cookies

1 Console Messages

Security Headers

Indicators

csgomap.execellent.com Open in urlscan Pro
2a06:98c1:3121::3 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

17
Requests

100 %
HTTPS

40 %
IPv6

9
Domains

10
Subdomains

10
IPs

4
Countries

484 kB
Transfer

2172 kB
Size

0
Cookies

17 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!