![](/screenshots/0d01a17f-c4b6-4864-ab49-9e1a89964ad9.png)
bafybeiatcbnh7kmhuwp2vjo76jeqwub5ep3qeqha4eyif7d4adnca4kzha.ipfs.dweb.link
Open in
urlscan Pro
2602:fea2:2::1
Malicious Activity!
Public Scan
Submission: On November 27 via api from US — Scanned from US
Summary
TLS certificate: Issued by R3 on November 20th 2023. Valid for: 3 months.
This is the only time bafybeiatcbnh7kmhuwp2vjo76jeqwub5ep3qeqha4eyif7d4adnca4kzha.ipfs.dweb.link was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: WeTransfer (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 2602:fea2:2::1 2602:fea2:2::1 | 40680 (PROTOCOL) (PROTOCOL) | |
2 | 34.199.59.238 34.199.59.238 | 14618 (AMAZON-AES) (AMAZON-AES) | |
1 | 2606:4700::68... 2606:4700::6812:bcf | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
3 | 151.101.130.132 151.101.130.132 | 54113 (FASTLY) (FASTLY) | |
1 | 2607:f8b0:400... 2607:f8b0:4004:c09::5f | 15169 (GOOGLE) (GOOGLE) | |
8 | 5 |
ASN40680 (PROTOCOL, US)
bafybeiatcbnh7kmhuwp2vjo76jeqwub5ep3qeqha4eyif7d4adnca4kzha.ipfs.dweb.link |
ASN14618 (AMAZON-AES, US)
PTR: ec2-34-199-59-238.compute-1.amazonaws.com
pear-ivy-bronze.glitch.me |
Apex Domain Subdomains |
Transfer | |
---|---|---|
3 |
glitch.global
cdn.glitch.global — Cisco Umbrella Rank: 161943 |
142 KB |
2 |
glitch.me
pear-ivy-bronze.glitch.me |
791 KB |
1 |
googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 364 |
84 KB |
1 |
bootstrapcdn.com
stackpath.bootstrapcdn.com — Cisco Umbrella Rank: 2914 |
24 KB |
1 |
dweb.link
bafybeiatcbnh7kmhuwp2vjo76jeqwub5ep3qeqha4eyif7d4adnca4kzha.ipfs.dweb.link |
3 KB |
8 | 5 |
Domain | Requested by | |
---|---|---|
3 | cdn.glitch.global |
bafybeiatcbnh7kmhuwp2vjo76jeqwub5ep3qeqha4eyif7d4adnca4kzha.ipfs.dweb.link
|
2 | pear-ivy-bronze.glitch.me |
bafybeiatcbnh7kmhuwp2vjo76jeqwub5ep3qeqha4eyif7d4adnca4kzha.ipfs.dweb.link
|
1 | ajax.googleapis.com |
bafybeiatcbnh7kmhuwp2vjo76jeqwub5ep3qeqha4eyif7d4adnca4kzha.ipfs.dweb.link
|
1 | stackpath.bootstrapcdn.com |
bafybeiatcbnh7kmhuwp2vjo76jeqwub5ep3qeqha4eyif7d4adnca4kzha.ipfs.dweb.link
|
1 | bafybeiatcbnh7kmhuwp2vjo76jeqwub5ep3qeqha4eyif7d4adnca4kzha.ipfs.dweb.link | |
8 | 5 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
dweb.link R3 |
2023-11-20 - 2024-02-18 |
3 months | crt.sh |
glitch.com Amazon RSA 2048 M01 |
2023-02-22 - 2024-02-01 |
a year | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2022-12-30 - 2023-12-30 |
a year | crt.sh |
cdn.glitch.global R3 |
2023-10-03 - 2024-01-01 |
3 months | crt.sh |
upload.video.google.com GTS CA 1C3 |
2023-10-23 - 2024-01-15 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://bafybeiatcbnh7kmhuwp2vjo76jeqwub5ep3qeqha4eyif7d4adnca4kzha.ipfs.dweb.link/wwrwrr.html
Frame ID: 92047B0019BBCA2526C85D8BC17D6384
Requests: 8 HTTP requests in this frame
Screenshot
![](/screenshots/0d01a17f-c4b6-4864-ab49-9e1a89964ad9.png)
Page Title
File ShareDetected technologies
![](/vendor/wappa/icons/Bootstrap.png)
Detected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Detected patterns
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
8 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
wwrwrr.html
bafybeiatcbnh7kmhuwp2vjo76jeqwub5ep3qeqha4eyif7d4adnca4kzha.ipfs.dweb.link/ |
11 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
custom.css
pear-ivy-bronze.glitch.me/ |
787 KB 788 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
stackpath.bootstrapcdn.com/bootstrap/4.3.1/css/ |
152 KB 24 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
0.png
cdn.glitch.global/354f0f2c-c6fe-4764-a05d-d63c52fc1690/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
3.png
cdn.glitch.global/354f0f2c-c6fe-4764-a05d-d63c52fc1690/ |
9 KB 9 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
2.png
cdn.glitch.global/354f0f2c-c6fe-4764-a05d-d63c52fc1690/ |
131 KB 131 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/2.2.4/ |
84 KB 84 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
app.js
pear-ivy-bronze.glitch.me/ |
2 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: WeTransfer (Online)4 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| documentPictureInPicture function| $ function| jQuery function| openDiv0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=31536000; includeSubDomains; preload |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
bafybeiatcbnh7kmhuwp2vjo76jeqwub5ep3qeqha4eyif7d4adnca4kzha.ipfs.dweb.link
cdn.glitch.global
pear-ivy-bronze.glitch.me
stackpath.bootstrapcdn.com
151.101.130.132
2602:fea2:2::1
2606:4700::6812:bcf
2607:f8b0:4004:c09::5f
34.199.59.238
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
591f338c1b4dac566bcd48392f1fdff70aa5d5ee2a0e73927f50386e1ac25a25
60abb3dd8f47929627c5ab0ad66a346f95a8de46a18d4271a8ea049d40aa2076
60b19e5da6a9234ff9220668a5ec1125c157a268513256188ee80f2d2c8d8d36
cc2462b8e8a38b0a2b175d61921da49c7fb854ad63e65fba83efb4ffee4d743d
df2fa4aedcde8d5c564fea1819b5965c5ba9524e15b8fddfafb0655853decca3
f3a50da5675c18402edb47ce9c1ce1828e9d0a05b2ad1c5ac796e4c72ce6b434
f49ca5686cee64d22e0e56d245a3574105b53f709f7ec8037786d2607051ea1c