urlscan.io logo urlscan.io
SecurityTrails logo

ipfs.io
209.94.90.1  Malicious Activity! Public Scan Open in urlscan Pro

Go To Rescan Add Verdict Report
Submitted URL: https://ipfs.io/ipfs/bafybeif7qgtsfc3rjax5faitkqisf6o4cm7euhn7dychupmlhhcazo2ewy#%3Cmy%20email%20address%3E 11yr old
Effective URL: https://ipfs.io/ipfs/bafybeif7qgtsfc3rjax5faitkqisf6o4cm7euhn7dychupmlhhcazo2ewy 11yr old
Submission Tags: @phish_report
Submission: On April 14 via api from FI — Scanned from ES
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 3 countries across 4 domains to perform 4 HTTP transactions. The main IP is 209.94.90.1, located in United States and belongs to PROTOCOL - Protocol Labs, US. The main domain is ipfs.io. The Cisco Umbrella rank of the primary domain is 137675. 11yr old
TLS certificate: Issued by WE1 on March 27th 2026. Valid for: 3mo.
This is the only time ipfs.io was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Email (Online)

Domain & IP information

IP Address AS Autonomous System
1 2 209.94.90.1 40680 (PROTOCOL)
1 2a00:1450:400... 15169 (GOOGLE)
1 104.18.11.207 13335 (CLOUDFLAR...)
1 2606:50c0:800... 54113 (FASTLY)
4 4
Apex Domain
Subdomains		 Transfer
2 ipfs.io
ipfs.io — Cisco Umbrella Rank: 137675 11yr old
55 KB
1 ipfs.tech
ipfs.tech — Cisco Umbrella Rank: 977481 5yr old
4 KB
1 bootstrapcdn.com
stackpath.bootstrapcdn.com — Cisco Umbrella Rank: 4601 8yr old
15 KB
1 googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 683 9yr old
30 KB
4 4
Domain Requested by
2 ipfs.io 1 redirects
1 ipfs.tech
1 stackpath.bootstrapcdn.com ipfs.io
1 ajax.googleapis.com ipfs.io
4 4

This site contains no links.

Subject Issuer Validity Valid
ipfs.io
WE1		 2026-03-27 -
2026-06-25		 3mo crt.sh
upload.video.google.com
WE2		 2026-03-23 -
2026-06-15		 3mo crt.sh
bootstrapcdn.com
WE1		 2026-03-05 -
2026-06-03		 3mo crt.sh

This page contains 1 frames:

Primary Page: https://ipfs.io/ipfs/bafybeif7qgtsfc3rjax5faitkqisf6o4cm7euhn7dychupmlhhcazo2ewy
Frame ID: 278B147FF05692C79E04AC92D83FFEF1
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Mail

Detected technologies

Overall confidence: 100%
Detected patterns
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • jquery
  • /(\d+\.\d+\.\d+)/jquery(?!\.popupoverlay\.js)[/.-][^u]
Overall confidence: 100%
Detected patterns
  • ajax\.googleapis\.com/ajax/libs/

Page Statistics

4
Requests

75 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

103 kB
Transfer

598 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 2
  • https://ipfs.io/favicon.ico HTTP 301
  • https://ipfs.tech/favicon.ico

4 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request bafybeif7qgtsfc3rjax5faitkqisf6o4cm7euhn7dychupmlhhcazo2ewy
ipfs.io/ipfs/ 		450 KB
55 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ipfs.io/ipfs/bafybeif7qgtsfc3rjax5faitkqisf6o4cm7euhn7dychupmlhhcazo2ewy
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
209.94.90.1 , United States, ASN40680 (PROTOCOL - Protocol Labs, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a2ba47acaa9e6f9047214a90f2a89b2029ceed0df0791b130598392cf8d074cb

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Linux"

Response headers

access-control-allow-headers
Content-Type Range User-Agent X-Requested-With
access-control-allow-methods
GET HEAD OPTIONS
access-control-allow-origin
*
access-control-expose-headers
Content-Length Content-Range X-Chunked-Output X-Ipfs-Path X-Ipfs-Roots X-Stream-Output
age
98191
alt-svc
h3=":443"; ma=86400
cache-control
public, max-age=29030400, immutable
cf-cache-status
HIT
cf-ray
9ec149fdb8f378b2-BCN
content-encoding
br
content-type
text/html
date
Tue, 14 Apr 2026 08:20:02 GMT
priority
u=0,i
server
cloudflare
server-timing
cfExtPri
vary
accept-encoding
x-ipfs-path
/ipfs/bafybeif7qgtsfc3rjax5faitkqisf6o4cm7euhn7dychupmlhhcazo2ewy
x-ipfs-pop
rainbow-rbx-247-80
x-ipfs-roots
bafybeif7qgtsfc3rjax5faitkqisf6o4cm7euhn7dychupmlhhcazo2ewy
x-robots-tag
noindex, nofollow
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/2.2.4/ 		84 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js
Requested by
Host: ipfs.io
URL: https://ipfs.io/ipfs/bafybeif7qgtsfc3rjax5faitkqisf6o4cm7euhn7dychupmlhhcazo2ewy
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a00:1450:4001:c15::5f Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://ipfs.io/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
gzip
age
76962
report-to
{"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
x-content-type-options
nosniff
expires
Tue, 13 Apr 2027 10:57:21 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Mon, 13 Apr 2026 10:57:21 GMT
last-modified
Tue, 03 Mar 2020 19:15:00 GMT
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="hosted-libraries-pushers"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
accept-ranges
bytes
access-control-allow-origin
*
content-length
30028
x-xss-protection
0
server
sffe
bootstrap.min.js
stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/ 		50 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js
Requested by
Host: ipfs.io
URL: https://ipfs.io/ipfs/bafybeif7qgtsfc3rjax5faitkqisf6o4cm7euhn7dychupmlhhcazo2ewy
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.11.207 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://ipfs.io/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="147", "Google Chrome";v="147", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cdn-status
200
content-encoding
br
cf-cache-status
HIT
etag
"67176c242e1bdc20603c878dee836df3"
age
2432743
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Tue, 14 Apr 2026 08:20:03 GMT
last-modified
Mon, 25 Jan 2021 22:04:06 GMT
cdn-cachedat
02/07/2025 02:56:30
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cdn-requestpullcode
200
priority
u=1,i=?0
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
public, max-age=31919000
cdn-requestpullsuccess
True
timing-allow-origin
*
cdn-requesttime
0
cdn-cache
HIT
cdn-requestid
d4aa4e899f6124bf0f753bc2aa01790b
cross-origin-resource-policy
cross-origin
cdn-pullzone
252412
cdn-proxyver
1.19
cf-ray
9ec14a006f77f134-BCN
access-control-allow-origin
*
cdn-edgestorageid
1187
server
cloudflare
cdn-requestcountrycode
FR
favicon.ico
ipfs.tech/
Redirect Chain
  • https://ipfs.io/favicon.ico
  • https://ipfs.tech/favicon.ico
15 KB
4 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://ipfs.tech/favicon.ico
Protocol
H2
Server
2606:50c0:8003::153 , United States, ASN54113 (FASTLY - Fastly, Inc., US),
Reverse DNS
Software
GitHub.com /
Resource Hash
94a9fefbbe42310c03ff1e52c1f753c21038805f632867ea78930a52c445a456

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36
Referer
https://ipfs.io/

Response headers

x-fastly-request-id
2f0721fd6d5a25954e96362d4a9bb66d9186f493
content-encoding
gzip
etag
W/"69d5012b-3aee"
age
417
x-github-request-id
21D8:4577C:4DA4A2:4ED52C:69DDDAF6
expires
Tue, 14 Apr 2026 06:23:11 GMT
x-proxy-cache
MISS
x-cache
HIT
date
Tue, 14 Apr 2026 08:20:03 GMT
content-type
image/vnd.microsoft.icon
last-modified
Tue, 07 Apr 2026 13:05:47 GMT
x-served-by
cache-mad2200085-MAD
x-cache-hits
1
vary
Accept-Encoding
cache-control
max-age=600
x-timer
S1776154804.968380,VS0,VE1
via
1.1 varnish
accept-ranges
bytes
access-control-allow-origin
*
content-length
3244
server
GitHub.com

Redirect headers

location
https://ipfs.tech/favicon.ico
cf-cache-status
HIT
age
283
cf-ray
9ec14a01ec4278b2-BCN
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Tue, 14 Apr 2026 08:20:03 GMT
content-type
text/html
vary
Accept-Encoding
server
cloudflare
x-ipfs-pop
rainbow-rbx-16-102
priority
u=1,i

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Email (Online)

4 JavaScript Window variables

These are the non-standard variables defined on the window object. These include var declarations and global functions and can be helpful in identifying possible client-side frameworks and code.

object| 0 function| $ function| jQuery object| bootstrap

0 Cookies

2 Console Messages

Source Level URL
Text
security warning URL: about:blank
Message:
An iframe which has both allow-scripts and allow-same-origin for its sandbox attribute can escape its sandboxing.
recommendation verbose URL: https://ipfs.io/ipfs/bafybeif7qgtsfc3rjax5faitkqisf6o4cm7euhn7dychupmlhhcazo2ewy#%3Cmy%20email%20address%3E
Message:
[DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o