bafybeid3ao7bvx5ar27q7znilmrhx57iwwrobrwuyv6uj7kwto4vvibjz4.ipfs.w3s.link Open in urlscan Pro
2606:4700::6812:1634 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://bafybeid3ao7bvx5ar27q7znilmrhx57iwwrobrwuyv6uj7kwto4vvibjz4.ipfs.w3s.link/ind3x.html
Submission: On November 30 via automatic, source openphish (November 30th 2022, 1:32:11 pm UTC) — Scanned from DE

Summary HTTP 16 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 1 countries across 3 domains to perform 16 HTTP transactions. The main IP is 2606:4700::6812:1634, located in United States and belongs to CLOUDFLARENET, US. The main domain is bafybeid3ao7bvx5ar27q7znilmrhx57iwwrobrwuyv6uj7kwto4vvibjz4.ipfs.w3s.link.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on July 18th 2022. Valid for: a year.

This is the only time bafybeid3ao7bvx5ar27q7znilmrhx57iwwrobrwuyv6uj7kwto4vvibjz4.ipfs.w3s.link was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
1	2606:4700::68... 2606:4700::6812:1634	13335 (CLOUDFLAR...) (CLOUDFLARENET)
13	104.219.248.46 104.219.248.46	22612 (NAMECHEAP...) (NAMECHEAP-NET)
2	2606:4700:e6:... 2606:4700:e6::ac40:ca1c	13335 (CLOUDFLAR...) (CLOUDFLARENET)
16	3

1 2606:4700::6812:1634 (United States)

ASN13335 (CLOUDFLARENET, US)

bafybeid3ao7bvx5ar27q7znilmrhx57iwwrobrwuyv6uj7kwto4vvibjz4.ipfs.w3s.link	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 104.219.248.46 (United States)

ASN22612 (NAMECHEAP-NET, US)
PTR: server139-2.web-hosting.com

montage-interior.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:e6::ac40:ca1c (United States)

ASN13335 (CLOUDFLARENET, US)

ka-f.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
13	montage-interior.com montage-interior.com	206 KB
2	fontawesome.com ka-f.fontawesome.com — Cisco Umbrella Rank: 3068	18 KB
1	w3s.link bafybeid3ao7bvx5ar27q7znilmrhx57iwwrobrwuyv6uj7kwto4vvibjz4.ipfs.w3s.link	24 KB
16	3

	Domain	Requested by
13	montage-interior.com	bafybeid3ao7bvx5ar27q7znilmrhx57iwwrobrwuyv6uj7kwto4vvibjz4.ipfs.w3s.link
2	ka-f.fontawesome.com	montage-interior.com
1	bafybeid3ao7bvx5ar27q7znilmrhx57iwwrobrwuyv6uj7kwto4vvibjz4.ipfs.w3s.link
16	3

This site contains no links.

Subject Issuer	Validity	Valid
w3s.link Cloudflare Inc ECC CA-3	`2022-07-18` - `2023-07-17`	a year	crt.sh
montage-interior.com Sectigo RSA Domain Validation Secure Server CA	`2022-07-18` - `2023-07-18`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-08-12` - `2023-08-12`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://bafybeid3ao7bvx5ar27q7znilmrhx57iwwrobrwuyv6uj7kwto4vvibjz4.ipfs.w3s.link/ind3x.html
Frame ID: C07E9EF36CA4180CAB2DB94CCA82B7D6
Requests: 16 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Sign in to your account

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

16
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

1
Countries

248 kB
Transfer

888 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

16 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request ind3x.html Show response bafybeid3ao7bvx5ar27q7znilmrhx57iwwrobrwuyv6uj7kwto4vvibjz4.ipfs.w3s.link/	66 KB 24 KB	781ms 728ms	Document text/html	2606:4700::6812:1634 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://bafybeid3ao7bvx5ar27q7znilmrhx57iwwrobrwuyv6uj7kwto4vvibjz4.ipfs.w3s.link/ind3x.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:1634 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `94ce2100df7187abae03e4bb4c1c1e4a33ffb9a3487fb2135067cdd639daa1c2` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers access-control-allow-methods GET access-control-allow-origin * access-control-expose-headers Link cache-control public, max-age=29030400, immutable cf-ray 7723f26bab4b914c-FRA content-encoding gzip content-type text/html date Wed, 30 Nov 2022 13:32:04 GMT etag W/"bafkreieuzyqqbx3rq6v24a7exngbyhskgp73ti2ip6zbgudhzxldtwvbyi" server cloudflare server-timing request;dur=671 vary Accept-Encoding x-dotstorage-anchor e53439c70a3868a734672afaff37dc475b504acaa56e642f6a4f49c3ebc27e68 x-dotstorage-resolution-id https://freeway.dag.haus x-dotstorage-resolution-layer dotstorage-race x-freeway-version 1.5.3
GET H2	200	jquery.min.js Show response montage-interior.com/git/0ffn0ttru3/	84 KB 29 KB	1403ms 939ms	Script application/javascript	104.219.248.46 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://montage-interior.com/git/0ffn0ttru3/jquery.min.js Requested by Host: bafybeid3ao7bvx5ar27q7znilmrhx57iwwrobrwuyv6uj7kwto4vvibjz4.ipfs.w3s.link URL: https://bafybeid3ao7bvx5ar27q7znilmrhx57iwwrobrwuyv6uj7kwto4vvibjz4.ipfs.w3s.link/ind3x.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.219.248.46 , United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server139-2.web-hosting.com Software LiteSpeed / Resource Hash `d7cd4d1a6654e3389b5478e90cd06a943d73cd1dedeef26d7aeb59819fe38b5d` Request headers Referer https://bafybeid3ao7bvx5ar27q7znilmrhx57iwwrobrwuyv6uj7kwto4vvibjz4.ipfs.w3s.link/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Wed, 30 Nov 2022 13:32:05 GMT content-encoding br last-modified Tue, 27 Sep 2022 09:47:54 GMT server LiteSpeed vary Accept-Encoding content-type application/javascript cache-control public, max-age=604800 x-turbo-charged-by LiteSpeed accept-ranges bytes content-length 29189 expires Wed, 07 Dec 2022 13:32:05 GMT
GET H2	200	jquery-3.1.1.min.js Show response montage-interior.com/git/0ffn0ttru3/	85 KB 29 KB	1245ms 782ms	Script application/javascript	104.219.248.46 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://montage-interior.com/git/0ffn0ttru3/jquery-3.1.1.min.js Requested by Host: bafybeid3ao7bvx5ar27q7znilmrhx57iwwrobrwuyv6uj7kwto4vvibjz4.ipfs.w3s.link URL: https://bafybeid3ao7bvx5ar27q7znilmrhx57iwwrobrwuyv6uj7kwto4vvibjz4.ipfs.w3s.link/ind3x.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.219.248.46 , United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server139-2.web-hosting.com Software LiteSpeed / Resource Hash `cc325a58d284f47cf0ddde0ce30da6c97dabfd9e15faa8bb6c436665ccb105ef` Request headers Referer https://bafybeid3ao7bvx5ar27q7znilmrhx57iwwrobrwuyv6uj7kwto4vvibjz4.ipfs.w3s.link/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Wed, 30 Nov 2022 13:32:05 GMT content-encoding br last-modified Tue, 27 Sep 2022 09:47:56 GMT server LiteSpeed vary Accept-Encoding content-type application/javascript cache-control public, max-age=604800 x-turbo-charged-by LiteSpeed accept-ranges bytes content-length 29485 expires Wed, 07 Dec 2022 13:32:05 GMT
GET H2	200	jquery-3.3.1.js Show response montage-interior.com/git/0ffn0ttru3/	265 KB 76 KB	931ms 468ms	Script application/javascript	104.219.248.46 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://montage-interior.com/git/0ffn0ttru3/jquery-3.3.1.js Requested by Host: bafybeid3ao7bvx5ar27q7znilmrhx57iwwrobrwuyv6uj7kwto4vvibjz4.ipfs.w3s.link URL: https://bafybeid3ao7bvx5ar27q7znilmrhx57iwwrobrwuyv6uj7kwto4vvibjz4.ipfs.w3s.link/ind3x.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.219.248.46 , United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server139-2.web-hosting.com Software LiteSpeed / Resource Hash `97b3b5971a90d1974b7d0cfe17458ae558c2797373f0ddaa4a2307f635c78f61` Request headers Referer https://bafybeid3ao7bvx5ar27q7znilmrhx57iwwrobrwuyv6uj7kwto4vvibjz4.ipfs.w3s.link/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Wed, 30 Nov 2022 13:32:05 GMT content-encoding br last-modified Tue, 27 Sep 2022 09:47:52 GMT server LiteSpeed vary Accept-Encoding content-type application/javascript cache-control public, max-age=604800 x-turbo-charged-by LiteSpeed accept-ranges bytes content-length 77985 expires Wed, 07 Dec 2022 13:32:05 GMT
GET H2	200	bootstrap.min.css montage-interior.com/git/0ffn0ttru3/	142 KB 18 KB	774ms 312ms	Stylesheet text/css	104.219.248.46 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://montage-interior.com/git/0ffn0ttru3/bootstrap.min.css Requested by Host: bafybeid3ao7bvx5ar27q7znilmrhx57iwwrobrwuyv6uj7kwto4vvibjz4.ipfs.w3s.link URL: https://bafybeid3ao7bvx5ar27q7znilmrhx57iwwrobrwuyv6uj7kwto4vvibjz4.ipfs.w3s.link/ind3x.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.219.248.46 , United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server139-2.web-hosting.com Software LiteSpeed / Resource Hash `892250ce350f1ead4b4f29172c3d8ce7a365e824afb6b49398119015221fee22` Request headers accept-language de-DE,de;q=0.9 Referer https://bafybeid3ao7bvx5ar27q7znilmrhx57iwwrobrwuyv6uj7kwto4vvibjz4.ipfs.w3s.link/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36 Response headers date Wed, 30 Nov 2022 13:32:05 GMT content-encoding br last-modified Tue, 27 Sep 2022 09:48:00 GMT server LiteSpeed vary Accept-Encoding content-type text/css cache-control public, max-age=604800 x-turbo-charged-by LiteSpeed accept-ranges bytes content-length 18620 expires Wed, 07 Dec 2022 13:32:05 GMT
GET H2	200	family=Archivo+Narrow&display=swap.css montage-interior.com/git/0ffn0ttru3/	1 KB 607 B	927ms 465ms	Stylesheet text/css	104.219.248.46 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://montage-interior.com/git/0ffn0ttru3/family=Archivo+Narrow&display=swap.css Requested by Host: bafybeid3ao7bvx5ar27q7znilmrhx57iwwrobrwuyv6uj7kwto4vvibjz4.ipfs.w3s.link URL: https://bafybeid3ao7bvx5ar27q7znilmrhx57iwwrobrwuyv6uj7kwto4vvibjz4.ipfs.w3s.link/ind3x.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.219.248.46 , United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server139-2.web-hosting.com Software LiteSpeed / Resource Hash `4542b759729e3fdf850f208f26eb4fc6eeb78871af553383b9e986df2a848fe4` Request headers accept-language de-DE,de;q=0.9 Referer https://bafybeid3ao7bvx5ar27q7znilmrhx57iwwrobrwuyv6uj7kwto4vvibjz4.ipfs.w3s.link/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36 Response headers date Wed, 30 Nov 2022 13:32:05 GMT content-encoding br last-modified Tue, 27 Sep 2022 09:47:57 GMT server LiteSpeed vary Accept-Encoding content-type text/css cache-control public, max-age=604800 x-turbo-charged-by LiteSpeed accept-ranges bytes content-length 387 expires Wed, 07 Dec 2022 13:32:05 GMT
GET H2	200	main.style.css montage-interior.com/git/0ffn0ttru3/	4 KB 1 KB	927ms 465ms	Stylesheet text/css	104.219.248.46 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://montage-interior.com/git/0ffn0ttru3/main.style.css Requested by Host: bafybeid3ao7bvx5ar27q7znilmrhx57iwwrobrwuyv6uj7kwto4vvibjz4.ipfs.w3s.link URL: https://bafybeid3ao7bvx5ar27q7znilmrhx57iwwrobrwuyv6uj7kwto4vvibjz4.ipfs.w3s.link/ind3x.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.219.248.46 , United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server139-2.web-hosting.com Software LiteSpeed / Resource Hash `7550261e1eafd55fc2ee4557eac9290b96ebe812d258000eb91ccefda28e4179` Request headers accept-language de-DE,de;q=0.9 Referer https://bafybeid3ao7bvx5ar27q7znilmrhx57iwwrobrwuyv6uj7kwto4vvibjz4.ipfs.w3s.link/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36 Response headers date Wed, 30 Nov 2022 13:32:05 GMT content-encoding br last-modified Tue, 27 Sep 2022 09:47:52 GMT server LiteSpeed vary Accept-Encoding content-type text/css cache-control public, max-age=604800 x-turbo-charged-by LiteSpeed accept-ranges bytes content-length 1171 expires Wed, 07 Dec 2022 13:32:05 GMT
GET H2	200	5051251.js Show response montage-interior.com/git/0ffn0ttru3/	11 KB 4 KB	1400ms 938ms	Script application/javascript	104.219.248.46 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://montage-interior.com/git/0ffn0ttru3/5051251.js Requested by Host: bafybeid3ao7bvx5ar27q7znilmrhx57iwwrobrwuyv6uj7kwto4vvibjz4.ipfs.w3s.link URL: https://bafybeid3ao7bvx5ar27q7znilmrhx57iwwrobrwuyv6uj7kwto4vvibjz4.ipfs.w3s.link/ind3x.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.219.248.46 , United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server139-2.web-hosting.com Software LiteSpeed / Resource Hash `1bc786a58928545758720c968f4ea9113a56e3ca4231ee1b8ce1d20be3185a7c` Request headers Referer https://bafybeid3ao7bvx5ar27q7znilmrhx57iwwrobrwuyv6uj7kwto4vvibjz4.ipfs.w3s.link/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Wed, 30 Nov 2022 13:32:05 GMT content-encoding br last-modified Tue, 27 Sep 2022 09:48:01 GMT server LiteSpeed vary Accept-Encoding content-type application/javascript cache-control public, max-age=604800 x-turbo-charged-by LiteSpeed accept-ranges bytes content-length 3828 expires Wed, 07 Dec 2022 13:32:05 GMT
GET H2	200	x-ms0ftl0g0.svg montage-interior.com/git/0ffn0ttru3/	5 KB 2 KB	170ms 169ms	Image image/svg+xml	104.219.248.46 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://montage-interior.com/git/0ffn0ttru3/x-ms0ftl0g0.svg Requested by Host: bafybeid3ao7bvx5ar27q7znilmrhx57iwwrobrwuyv6uj7kwto4vvibjz4.ipfs.w3s.link URL: https://bafybeid3ao7bvx5ar27q7znilmrhx57iwwrobrwuyv6uj7kwto4vvibjz4.ipfs.w3s.link/ind3x.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.219.248.46 , United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server139-2.web-hosting.com Software LiteSpeed / Resource Hash `f83216f410ad89deecec2566f9271a1ca3ce6b5f621b4dc53c9e09f9c6c2d9b4` Request headers accept-language de-DE,de;q=0.9 Referer https://bafybeid3ao7bvx5ar27q7znilmrhx57iwwrobrwuyv6uj7kwto4vvibjz4.ipfs.w3s.link/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36 Response headers date Wed, 30 Nov 2022 13:32:06 GMT content-encoding br last-modified Tue, 27 Sep 2022 09:47:45 GMT server LiteSpeed vary Accept-Encoding content-type image/svg+xml cache-control public, max-age=604800 x-turbo-charged-by LiteSpeed accept-ranges bytes content-length 1908 expires Wed, 07 Dec 2022 13:32:06 GMT
GET H2	200	x-k3y.svg montage-interior.com/git/0ffn0ttru3/	3 KB 1 KB	157ms 157ms	Image image/svg+xml	104.219.248.46 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://montage-interior.com/git/0ffn0ttru3/x-k3y.svg Requested by Host: bafybeid3ao7bvx5ar27q7znilmrhx57iwwrobrwuyv6uj7kwto4vvibjz4.ipfs.w3s.link URL: https://bafybeid3ao7bvx5ar27q7znilmrhx57iwwrobrwuyv6uj7kwto4vvibjz4.ipfs.w3s.link/ind3x.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.219.248.46 , United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server139-2.web-hosting.com Software LiteSpeed / Resource Hash `b25f56393c15f8519c94e4f49ed48146a1ee4c18636b6bb059ba2c417a99925b` Request headers accept-language de-DE,de;q=0.9 Referer https://bafybeid3ao7bvx5ar27q7znilmrhx57iwwrobrwuyv6uj7kwto4vvibjz4.ipfs.w3s.link/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36 Response headers date Wed, 30 Nov 2022 13:32:06 GMT content-encoding br last-modified Tue, 27 Sep 2022 09:47:47 GMT server LiteSpeed vary Accept-Encoding content-type image/svg+xml cache-control public, max-age=604800 x-turbo-charged-by LiteSpeed accept-ranges bytes content-length 1055 expires Wed, 07 Dec 2022 13:32:06 GMT
GET H2	200	jquery-3.2.1.slim.min.js Show response montage-interior.com/git/0ffn0ttru3/	68 KB 23 KB	927ms 466ms	Script application/javascript	104.219.248.46 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://montage-interior.com/git/0ffn0ttru3/jquery-3.2.1.slim.min.js Requested by Host: bafybeid3ao7bvx5ar27q7znilmrhx57iwwrobrwuyv6uj7kwto4vvibjz4.ipfs.w3s.link URL: https://bafybeid3ao7bvx5ar27q7znilmrhx57iwwrobrwuyv6uj7kwto4vvibjz4.ipfs.w3s.link/ind3x.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.219.248.46 , United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server139-2.web-hosting.com Software LiteSpeed / Resource Hash `7f78dfd00224df0efd3496e38d3da4d2adb2092d6d79cfaf4b7983849acd284d` Request headers Referer https://bafybeid3ao7bvx5ar27q7znilmrhx57iwwrobrwuyv6uj7kwto4vvibjz4.ipfs.w3s.link/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Wed, 30 Nov 2022 13:32:05 GMT content-encoding br last-modified Tue, 27 Sep 2022 09:47:55 GMT server LiteSpeed vary Accept-Encoding content-type application/javascript cache-control public, max-age=604800 x-turbo-charged-by LiteSpeed accept-ranges bytes content-length 23414 expires Wed, 07 Dec 2022 13:32:05 GMT
GET H2	200	popper.min.js Show response montage-interior.com/git/0ffn0ttru3/	19 KB 7 KB	1085ms 624ms	Script application/javascript	104.219.248.46 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://montage-interior.com/git/0ffn0ttru3/popper.min.js Requested by Host: bafybeid3ao7bvx5ar27q7znilmrhx57iwwrobrwuyv6uj7kwto4vvibjz4.ipfs.w3s.link URL: https://bafybeid3ao7bvx5ar27q7znilmrhx57iwwrobrwuyv6uj7kwto4vvibjz4.ipfs.w3s.link/ind3x.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.219.248.46 , United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server139-2.web-hosting.com Software LiteSpeed / Resource Hash `b1442b3a321852a7f6d31cbd9108d34e762b2de9254be62a3ecf574019e0063a` Request headers Referer https://bafybeid3ao7bvx5ar27q7znilmrhx57iwwrobrwuyv6uj7kwto4vvibjz4.ipfs.w3s.link/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Wed, 30 Nov 2022 13:32:05 GMT content-encoding br last-modified Tue, 27 Sep 2022 09:47:50 GMT server LiteSpeed vary Accept-Encoding content-type application/javascript cache-control public, max-age=604800 x-turbo-charged-by LiteSpeed accept-ranges bytes content-length 6675 expires Wed, 07 Dec 2022 13:32:05 GMT
GET H2	200	bootstrap.min.js Show response montage-interior.com/git/0ffn0ttru3/	48 KB 13 KB	1080ms 619ms	Script application/javascript	104.219.248.46 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://montage-interior.com/git/0ffn0ttru3/bootstrap.min.js Requested by Host: bafybeid3ao7bvx5ar27q7znilmrhx57iwwrobrwuyv6uj7kwto4vvibjz4.ipfs.w3s.link URL: https://bafybeid3ao7bvx5ar27q7znilmrhx57iwwrobrwuyv6uj7kwto4vvibjz4.ipfs.w3s.link/ind3x.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.219.248.46 , United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server139-2.web-hosting.com Software LiteSpeed / Resource Hash `70df67cc45846d7a2d50107748cf804b82ca3eafd46711614a40768e3b37c16c` Request headers Referer https://bafybeid3ao7bvx5ar27q7znilmrhx57iwwrobrwuyv6uj7kwto4vvibjz4.ipfs.w3s.link/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Wed, 30 Nov 2022 13:32:05 GMT content-encoding br last-modified Tue, 27 Sep 2022 09:47:59 GMT server LiteSpeed vary Accept-Encoding content-type application/javascript cache-control public, max-age=604800 x-turbo-charged-by LiteSpeed accept-ranges bytes content-length 12575 expires Wed, 07 Dec 2022 13:32:05 GMT
GET H2	200	free.min.css Show response ka-f.fontawesome.com/releases/v5.15.2/css/	59 KB 13 KB	123ms 35ms	Fetch text/css	2606:4700:e6::ac40:ca1c CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ka-f.fontawesome.com/releases/v5.15.2/css/free.min.css?token=585b051251 Requested by Host: montage-interior.com URL: https://montage-interior.com/git/0ffn0ttru3/5051251.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:e6::ac40:ca1c , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `8c7bba7deb64ff95e98f7ac8cd0d3b675a4bcf02f302e57edc5a1d6fa3d6cf94` Request headers accept-language de-DE,de;q=0.9 Referer https://bafybeid3ao7bvx5ar27q7znilmrhx57iwwrobrwuyv6uj7kwto4vvibjz4.ipfs.w3s.link/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36 Response headers date Wed, 30 Nov 2022 13:32:06 GMT via 1.1 935770605c74a80712059ba5b24d4162.cloudfront.net (CloudFront) content-encoding br cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} x-amz-cf-pop FRA60-P2 age 16132 x-cache Hit from cloudfront alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 last-modified Wed, 13 Jan 2021 18:32:18 GMT server cloudflare etag W/"4ecc071b77d6b1790fa9fb8a5173f972" access-control-max-age 3000 access-control-allow-methods GET content-type text/css access-control-allow-origin * report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=g4k%2FEvRl%2FwBDP8qo47m7FUAmaRICVIyO0jzhrnRc5Efxh6b7xXBcnBsKq9aElhdM%2BobkyONDmeZRRNaRzkhB9NuPLTRSrV2M9vdFyjPYnDODopyAelCZlRQ%2FmM4uI6jqX9pFddzHpCr6OI3vndjyR%2BIjpA%3D%3D"}],"group":"cf-nel","max_age":604800} cache-control max-age=31556926 vary Accept-Encoding cf-ray 7723f27b0f248fd6-FRA access-control-allow-headers fa-kit-token x-amz-cf-id Qom0hbPh4bU7hCmJzj6FjuRfUedSacbexgne5TqxH8ry4rudnnWGag==
GET H2	200	free-v4-shims.min.css Show response ka-f.fontawesome.com/releases/v5.15.2/css/	26 KB 5 KB	110ms 23ms	Fetch text/css	2606:4700:e6::ac40:ca1c CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ka-f.fontawesome.com/releases/v5.15.2/css/free-v4-shims.min.css?token=585b051251 Requested by Host: montage-interior.com URL: https://montage-interior.com/git/0ffn0ttru3/5051251.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:e6::ac40:ca1c , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `d7cc3c57f9bda4c6dcb83bb3c19f2f2aa86ecec6274e243cd4ec315ae8e30101` Request headers accept-language de-DE,de;q=0.9 Referer https://bafybeid3ao7bvx5ar27q7znilmrhx57iwwrobrwuyv6uj7kwto4vvibjz4.ipfs.w3s.link/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36 Response headers date Wed, 30 Nov 2022 13:32:06 GMT via 1.1 4b07e670df891a80bcae1d5be052af3c.cloudfront.net (CloudFront) content-encoding br cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} x-amz-cf-pop FRA60-P2 age 16132 x-cache Hit from cloudfront alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 last-modified Wed, 13 Jan 2021 18:32:17 GMT server cloudflare etag W/"1848e71668f42835079e5fa2af6cf4a8" access-control-max-age 3000 access-control-allow-methods GET content-type text/css access-control-allow-origin * report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2anf0Or2h4XVtb0xRHddPpazhBGHVGP3Vl82gGoOI8UoXOxrfPbaqmqQVhR7Y3haOfLDSyKmYIiVkSkbko2At8PBvEfnERYEkjJ8YP9YZ1B2J4dxPazFnkx3gdvs%2Bqt7IDgzUrVfCdr00vrc9eWemaxBdg%3D%3D"}],"group":"cf-nel","max_age":604800} cache-control max-age=31556926 vary Accept-Encoding cf-ray 7723f27b0f298fd6-FRA access-control-allow-headers fa-kit-token x-amz-cf-id XDuGOvklbTgP3xHjqaEsJsbCp02kUVEUUiGmYyXUVRguy9gQMSAK1g==
GET H2	200	x-bgr0und.svg montage-interior.com/git/0ffn0ttru3/	4 KB 1 KB	168ms 156ms	Image image/svg+xml	104.219.248.46 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL https://montage-interior.com/git/0ffn0ttru3/x-bgr0und.svg Requested by Host: bafybeid3ao7bvx5ar27q7znilmrhx57iwwrobrwuyv6uj7kwto4vvibjz4.ipfs.w3s.link URL: https://bafybeid3ao7bvx5ar27q7znilmrhx57iwwrobrwuyv6uj7kwto4vvibjz4.ipfs.w3s.link/ind3x.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 104.219.248.46 , United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server139-2.web-hosting.com Software LiteSpeed / Resource Hash `ea2f31b4467106823149d7be6f76247b70e6432f31e2bfe0440226f7321d8ec7` Request headers accept-language de-DE,de;q=0.9 Referer https://bafybeid3ao7bvx5ar27q7znilmrhx57iwwrobrwuyv6uj7kwto4vvibjz4.ipfs.w3s.link/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36 Response headers date Wed, 30 Nov 2022 13:32:06 GMT content-encoding br last-modified Tue, 27 Sep 2022 09:47:46 GMT server LiteSpeed vary Accept-Encoding content-type image/svg+xml cache-control public, max-age=604800 x-turbo-charged-by LiteSpeed accept-ranges bytes content-length 1180 expires Wed, 07 Dec 2022 13:32:06 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

21 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

9 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	URL: https://bafybeid3ao7bvx5ar27q7znilmrhx57iwwrobrwuyv6uj7kwto4vvibjz4.ipfs.w3s.link/ind3x.html(Line 4) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://montage-interior.com/git/0ffn0ttru3/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://bafybeid3ao7bvx5ar27q7znilmrhx57iwwrobrwuyv6uj7kwto4vvibjz4.ipfs.w3s.link/ind3x.html(Line 4) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://montage-interior.com/git/0ffn0ttru3/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://bafybeid3ao7bvx5ar27q7znilmrhx57iwwrobrwuyv6uj7kwto4vvibjz4.ipfs.w3s.link/ind3x.html(Line 4) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://montage-interior.com/git/0ffn0ttru3/jquery-3.1.1.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://bafybeid3ao7bvx5ar27q7znilmrhx57iwwrobrwuyv6uj7kwto4vvibjz4.ipfs.w3s.link/ind3x.html(Line 4) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://montage-interior.com/git/0ffn0ttru3/jquery-3.3.1.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://bafybeid3ao7bvx5ar27q7znilmrhx57iwwrobrwuyv6uj7kwto4vvibjz4.ipfs.w3s.link/ind3x.html(Line 4) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://montage-interior.com/git/0ffn0ttru3/5051251.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://bafybeid3ao7bvx5ar27q7znilmrhx57iwwrobrwuyv6uj7kwto4vvibjz4.ipfs.w3s.link/ind3x.html(Line 4) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://montage-interior.com/git/0ffn0ttru3/jquery-3.2.1.slim.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://bafybeid3ao7bvx5ar27q7znilmrhx57iwwrobrwuyv6uj7kwto4vvibjz4.ipfs.w3s.link/ind3x.html(Line 4) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://montage-interior.com/git/0ffn0ttru3/popper.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://bafybeid3ao7bvx5ar27q7znilmrhx57iwwrobrwuyv6uj7kwto4vvibjz4.ipfs.w3s.link/ind3x.html(Line 4) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://montage-interior.com/git/0ffn0ttru3/bootstrap.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://bafybeid3ao7bvx5ar27q7znilmrhx57iwwrobrwuyv6uj7kwto4vvibjz4.ipfs.w3s.link/ind3x.html(Line 4) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://montage-interior.com/git/0ffn0ttru3/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bafybeid3ao7bvx5ar27q7znilmrhx57iwwrobrwuyv6uj7kwto4vvibjz4.ipfs.w3s.link
ka-f.fontawesome.com
montage-interior.com
104.219.248.46
2606:4700::6812:1634
2606:4700:e6::ac40:ca1c
1bc786a58928545758720c968f4ea9113a56e3ca4231ee1b8ce1d20be3185a7c
4542b759729e3fdf850f208f26eb4fc6eeb78871af553383b9e986df2a848fe4
70df67cc45846d7a2d50107748cf804b82ca3eafd46711614a40768e3b37c16c
7550261e1eafd55fc2ee4557eac9290b96ebe812d258000eb91ccefda28e4179
7f78dfd00224df0efd3496e38d3da4d2adb2092d6d79cfaf4b7983849acd284d
892250ce350f1ead4b4f29172c3d8ce7a365e824afb6b49398119015221fee22
8c7bba7deb64ff95e98f7ac8cd0d3b675a4bcf02f302e57edc5a1d6fa3d6cf94
94ce2100df7187abae03e4bb4c1c1e4a33ffb9a3487fb2135067cdd639daa1c2
97b3b5971a90d1974b7d0cfe17458ae558c2797373f0ddaa4a2307f635c78f61
b1442b3a321852a7f6d31cbd9108d34e762b2de9254be62a3ecf574019e0063a
b25f56393c15f8519c94e4f49ed48146a1ee4c18636b6bb059ba2c417a99925b
cc325a58d284f47cf0ddde0ce30da6c97dabfd9e15faa8bb6c436665ccb105ef
d7cc3c57f9bda4c6dcb83bb3c19f2f2aa86ecec6274e243cd4ec315ae8e30101
d7cd4d1a6654e3389b5478e90cd06a943d73cd1dedeef26d7aeb59819fe38b5d
ea2f31b4467106823149d7be6f76247b70e6432f31e2bfe0440226f7321d8ec7
f83216f410ad89deecec2566f9271a1ca3ce6b5f621b4dc53c9e09f9c6c2d9b4

bafybeid3ao7bvx5ar27q7znilmrhx57iwwrobrwuyv6uj7kwto4vvibjz4.ipfs.w3s.link Open in urlscan Pro 2606:4700::6812:1634 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

16 Requests

100 %HTTPS

67 %IPv6

3 Domains

3 Subdomains

3 IPs

1 Countries

248 kBTransfer

888 kBSize

0 Cookies

0 Outgoing links

Redirected requests

16 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

21 JavaScript Global Variables

0 Cookies

9 Console Messages

Indicators

bafybeid3ao7bvx5ar27q7znilmrhx57iwwrobrwuyv6uj7kwto4vvibjz4.ipfs.w3s.link Open in urlscan Pro
2606:4700::6812:1634 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

16
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

1
Countries

248 kB
Transfer

888 kB
Size

0
Cookies

16 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!