![](/screenshots/0f38b91f-bd96-4318-968f-87a1f538c4a6.png)
cloudflare-ipfs.com
Open in
urlscan Pro
104.17.96.13
Malicious Activity!
Public Scan
Submission: On May 17 via api from LU — Scanned from DE
Summary
TLS certificate: Issued by E1 on April 24th 2024. Valid for: 3 months.
This is the only time cloudflare-ipfs.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 104.17.96.13 104.17.96.13 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 104.17.25.14 104.17.25.14 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a04:4e42:400... 2a04:4e42:400::649 | 54113 (FASTLY) (FASTLY) | |
2 | 2a00:1450:400... 2a00:1450:4001:812::2001 | 15169 (GOOGLE) (GOOGLE) | |
6 | 5 |
ASN15169 (GOOGLE, US)
lh3.googleusercontent.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
2 |
googleusercontent.com
lh3.googleusercontent.com — Cisco Umbrella Rank: 44 |
193 KB |
1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 776 |
78 KB |
1 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 237 |
14 KB |
1 |
cloudflare-ipfs.com
cloudflare-ipfs.com |
40 KB |
0 |
lkalzzop.online
Failed
lkalzzop.online Failed |
|
6 | 5 |
Domain | Requested by | |
---|---|---|
2 | lh3.googleusercontent.com | |
1 | code.jquery.com |
cloudflare-ipfs.com
|
1 | cdnjs.cloudflare.com |
cloudflare-ipfs.com
|
1 | cloudflare-ipfs.com | |
0 | lkalzzop.online Failed |
code.jquery.com
|
6 | 5 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
cloudflare-ipfs.com E1 |
2024-04-24 - 2024-07-23 |
3 months | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2023-07-03 - 2024-07-02 |
a year | crt.sh |
*.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2023-07-11 - 2024-07-14 |
a year | crt.sh |
*.googleusercontent.com WR2 |
2024-05-06 - 2024-07-29 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://cloudflare-ipfs.com/ipfs/bafkreifatllyfctwdtwub4bg3agrb4mnz3dvopv27so4zp5w4psxjci65y
Frame ID: 3013F624F4B314291130D4E3E4C54C08
Requests: 6 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
6 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H3 |
Primary Request
bafkreifatllyfctwdtwub4bg3agrb4mnz3dvopv27so4zp5w4psxjci65y
cloudflare-ipfs.com/ipfs/ |
57 KB 40 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
crypto-js.min.js
cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/ |
47 KB 14 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-1.9.1.js
code.jquery.com/ |
262 KB 78 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
AJFCJaXhZo6cUCNh1ssNQzSV3jc1ppd5Vt2HN5GjHL82rJR25OrOigrMWVvBpwQN6BD4T_qHdwh2spOZ9bKA-BqcHsttYMUy5sxc-E99nKe9pgDJsCX0icydpRhjm97W_S4_6cism2sTCOp-Oxa807yjCEw=w1580-h720-s-no
lh3.googleusercontent.com/pw/ |
192 KB 193 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
AMWts8CjWLE-4lSHnzZVyyi38RiG_iHUev92wvk3GXVlZur4_v68tJc5TxPcsfc6Vo4P2_Sa5_Dg4wBjO9x0q0xYFQKyjpg1zURhvOLxyPhDhPJg_Z8XDFduSWtavIhhZp_z9dX4zrOp2jk9GCWUmL_6qus=s128-no
lh3.googleusercontent.com/pw/ |
330 B 439 B |
Other
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST |
/
lkalzzop.online/obufsssssssscaaatoion/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- lkalzzop.online
- URL
- https://lkalzzop.online/obufsssssssscaaatoion/
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)305 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
string| GRfAPcBg string| tFxZwqjt string| ufGiWwAv string| gkNLQhhn string| cfASjbBM string| WbkJmSgr string| jidXxIVu string| bndwynhi string| mQCiTacg string| PsQYZFOM string| LMKIzjDG string| zStvtrMU string| kSqsdFGm string| tBYuqANd string| hvNBKScs string| vhFnjypu string| hPTzxgxS string| BEnlSyIA string| xBOToUuu string| keexrEke string| TYgEIMDh string| xIGibJbN string| lgPXpEjT string| HgSmhKdd string| SHBkPzyW string| tAlfRhJC string| RgFzMtVK string| qWILdFmO string| tolUlDyb string| jJKJdMUN string| MfyqGgJY string| ZIZTSZsc string| GaOODDRq string| thyzbHWu string| HJXZSPLw string| SkBFKAJu string| VHrnEtgU string| QREFbmeq string| pPkgxovS string| JoVDlWmj string| ADFHRRFG string| TgsmdpfA string| cTUyrQgs string| HxdRSoKc string| LGmEJznM string| rxdZfWai string| UjziepBk string| SHAnwDGz string| vUFrqEZv string| FYIHAraE string| aOQEbetH string| pEonKDKX string| QiyEyaNh string| QWIJUkrS string| gQfQeCXj string| GVzWDiJV string| ECZnEyNh string| giJcncfd string| SsDagOIv string| hkVmgxBK string| qMxylfKC string| gCFZmFng string| yYwPAkMT string| pMmFhtjZ string| oglHKzeT string| Vcgvzkqm string| ePCOLpzR string| bLbMQbWP string| vRhaYAaG string| XUhCGjXR string| HyQpkGVM string| oUtzUdVy string| oFcMUpNM string| NNWFuBMX string| UZEhqiBd string| raXrYPhH string| RDBHkpHR string| TJLEXXFT string| xjVSHoMQ string| lxozPxFI string| UMDZVfoc string| eLHhDZvO string| ctsCMrAW string| RqecppuJ string| rkaVnKFy string| icpEMabR string| ZaKJTLal string| XLURmFtc string| SlPuxmRv string| gIZwPrvG string| rrDdoHXZ string| YcDymvSW string| LfccFcBX string| SXQzapPV string| cRzAkkJH string| hLUhcvGy string| VuErSlEI string| KEhpsWDt string| XTVmgvYM string| JvpvglKv string| YwPZVHPY string| MiANBrRK string| XjiSalAX string| EDuYMGJS string| RURWLOfQ string| dcdXiDjz string| LFCVtIqy string| kVSfRTlZ string| AwuJmnDk string| YYoaYrvA string| uicHIzXd string| fXGPxqtn string| jzSDECpp string| lqbYGxJM string| HjhqLNRD string| ecXmajxn string| PFbPoJbS string| GIlhdEvW string| iFXhqYLI string| WOOEuGUY string| cKZEExJW string| MmsgLJVx string| rnBVkCgf string| CaNJLdtk string| wIDFJlkI string| ucaAmktF string| TRAtQvMC string| RPCXFFui string| mEdduaQA string| uApPVaSW string| AqTzHWnQ string| FcWffVLw string| hSVBqGoc string| ZpuwSEoI string| SdwvrUjG string| tuDMAqyL string| wMYVLwUE string| ZjzQzTai string| pCBZfTYZ string| PQugwfwJ string| aGDlcRtU string| rFZDoELj string| TjwoDjmq string| oESfoThs string| YyGXvvgm string| FvrKrDpT string| vmzMfZPC string| hyiYxgtb string| TtudUSzO string| vTVmgfJb string| VLjiTLOJ string| CoLNGYPY string| LYIHSNyk string| QnmqhrwO string| ZojkKTYk string| OSYaXBGE string| JJakvkjt string| dCCJuQfb string| RtFJvABj string| WZTswEUu string| boUtQLUN string| vNYMvcLs string| CfPydEOO string| iNjnNVgz string| QbzHIRXO object| CryptoJS object| decrypted object| key function| _0x4284 function| _0x5e5f15 function| _0x2683b6 function| _0x406133 function| _0x1b6b69 function| _0x55fa27 function| _0x55d801 function| _0x55803b function| _0x2fe80a function| _0x15a4c4 function| _0x372cf9 function| _0x4a712a function| _0x3c4293 function| _0x26573e function| _0x499771 function| _0x3b9a13 function| _0x18664b function| _0x362e0b function| _0x5d3d5b function| _0x40b05b function| _0x4bb27e function| _0x5c2eae function| _0x595fcf function| _0x57ea80 function| _0x35e0b8 function| _0x5cdb1b function| _0x51e3c0 function| _0x2e2008 function| _0x376c27 function| _0x45af92 function| _0x4e26da function| _0xa35753 function| _0x4fe969 function| _0x19e989 function| _0x1c52c7 function| _0xe3067 function| _0x2307a2 function| _0x4d22bf function| _0x1512dc function| _0x94b32b function| _0x2a8aad function| _0x408c55 function| _0x25b338 function| _0xebaa1a function| _0x1a3a96 function| _0x25a674 function| _0x1c7ecb function| _0x3a9b2e function| _0x6be13a function| _0x5bc8bf function| _0x457212 function| _0x2d6ad1 function| _0xa897d5 function| _0x2db67a function| _0x27ebbb function| _0x77f85 function| _0x3a6937 function| _0xae4268 function| _0x349dbc function| _0x5e588c function| _0x153a99 function| _0x1a2aa4 function| _0x34da54 function| _0x3058f0 function| _0x4bdb11 function| _0x3ce0a6 function| _0x2b7702 function| _0x2e0725 function| _0x447f59 function| _0x64d053 function| _0x3a4ebe function| _0x5dc1b8 function| _0x42f03a function| _0x1820d7 function| _0x4fc37f function| _0x215e3f function| _0x4501a5 function| _0x4c754c function| _0x1e7ec2 function| _0x25570d function| _0x318f0f function| _0x40c6fe function| _0x33353e function| _0x20cbef function| _0x4445f3 function| _0x41d160 function| _0xefc003 function| _0x2e7763 function| _0x3dfd43 function| _0xa64e43 function| _0x4976f5 function| _0x3f5c6d function| _0x34187d function| _0x533aa1 function| _0x116e4a function| _0x1045f1 function| _0x35c949 function| _0xeedb60 function| _0x54fd3b function| _0x4e8c4b function| _0x505883 function| _0x3632a2 function| _0x39d259 function| _0x6152e7 function| _0x165d53 function| _0x200ef1 function| _0x39713a function| _0x389a53 function| _0x216e1d function| _0x151976 function| _0x59bbc9 function| _0x31c539 function| _0x5d4bdd function| _0x1bf78e function| _0x1228a7 function| _0x5a506a function| _0x5b9223 function| _0x2e258e function| _0x4c1047 function| _0x1b8c7b function| _0x2ebbca function| _0x67e14e function| _0x229223 function| _0x17d1c1 function| _0x55a773 function| _0x48e07a function| _0x12f8ad function| _0x1e86 object| _0xb9ac string| IGOBZL string| cbbg string| kaka90nal string| ka45k459final2 string| kak0011afinal number| countttingerr function| $ function| jQuery1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
cloudflare-ipfs.com/ | Name: __cf_bm Value: OUP.7BjxiyZdsWf62M7kimRMueXiKBPXn2uZlOCWx7g-1715929423-1.0.1.1-BrfvhjWGo5mOlnUaOb2i4RSD9cfavR3nVYreZ_rGuNXSmosywmxZvKxqud18ePqZun_OhwPld_3p.sr.Xy46UA |
3 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdnjs.cloudflare.com
cloudflare-ipfs.com
code.jquery.com
lh3.googleusercontent.com
lkalzzop.online
lkalzzop.online
104.17.25.14
104.17.96.13
2a00:1450:4001:812::2001
2a04:4e42:400::649
7bd80d06c01c0340c1b9159b9b4a197db882ca18cbac8e9b9aa025e68f998d40
8e3b0117f4df4be452c0b6af5b8f0a0acf9d4ade23d08d55d7e312af22077762
a09ad7828a761ced40f026d80d10f18dcec7573ebafc9dccbfb6e3e574891eee
c51ecfdbb39612d629bbbfa57896c63dc52971d7bcf78f1795944be16274a8eb
fea8fbaec75213e1af8005edfcdc94e7b5d7dca6ddb4e262d66e4756bda96d54