bafybeicw2sqoqhczf33fh6cof2atherex42eqyuogvgheyhvywnung7zte.ipfs.dweb.link Open in urlscan Pro
2602:fea2:2::1 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://jonathanmalcolm147.lt.emlnk.com/Prod/link-tracker?notrack=1&redirectUrl=aHR0cHMlM0ElMkYlMkZiYWZ5YmVpY3cyc3FvcWhjemYzM2ZoNmNvZjJh...
Effective URL:
https://bafybeicw2sqoqhczf33fh6cof2atherex42eqyuogvgheyhvywnung7zte.ipfs.dweb.link/?filename=bill.htm
Submission: On May 13 via manual (May 13th 2022, 7:04:47 am UTC) from DE — Scanned from DE

Summary HTTP 11 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 3 countries across 6 domains to perform 11 HTTP transactions. The main IP is 2602:fea2:2::1, located in United States and belongs to PROTOCOL, US. The main domain is bafybeicw2sqoqhczf33fh6cof2atherex42eqyuogvgheyhvywnung7zte.ipfs.dweb.link.
TLS certificate: Issued by R3 on March 20th 2022. Valid for: 3 months.

This is the only time bafybeicw2sqoqhczf33fh6cof2atherex42eqyuogvgheyhvywnung7zte.ipfs.dweb.link was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Adobe (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
1 1	54.164.165.221 54.164.165.221	14618 (AMAZON-AES) (AMAZON-AES)
1	2602:fea2:2::1 2602:fea2:2::1	40680 (PROTOCOL) (PROTOCOL)
8 16	2620:100:6023... 2620:100:6023:15::a27d:430f	19679 (DROPBOX) (DROPBOX)
1	2001:4de0:ac1... 2001:4de0:ac18::1:a:3a	20446 (STACKPATH...) (STACKPATH-CDN)
1	51.210.32.106 51.210.32.106	16276 (OVH) (OVH)
11	5

1 54.164.165.221 (United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-164-165-221.compute-1.amazonaws.com

jonathanmalcolm147.lt.emlnk.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2602:fea2:2::1 (United States)

ASN40680 (PROTOCOL, US)

bafybeicw2sqoqhczf33fh6cof2atherex42eqyuogvgheyhvywnung7zte.ipfs.dweb.link	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 2620:100:6023:15::a27d:430f (United States) 8 redirects

ASN19679 (DROPBOX, US)

dl.dropbox.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
dl.dropboxusercontent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac18::1:a:3a (Netherlands)

ASN20446 (STACKPATH-CDN, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 51.210.32.106 (France)

ASN16276 (OVH, FR)
PTR: ns3172579.ip-51-210-32.eu

i.ibb.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	dropboxusercontent.com dl.dropboxusercontent.com — Cisco Umbrella Rank: 13457	70 KB
8	dropbox.com 8 redirects dl.dropbox.com — Cisco Umbrella Rank: 29379	1 KB
1	ibb.co i.ibb.co — Cisco Umbrella Rank: 13381	167 KB
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 660	78 KB
1	dweb.link bafybeicw2sqoqhczf33fh6cof2atherex42eqyuogvgheyhvywnung7zte.ipfs.dweb.link	32 KB
1	emlnk.com 1 redirects jonathanmalcolm147.lt.emlnk.com	263 B
11	6

	Domain	Requested by
8	dl.dropboxusercontent.com	bafybeicw2sqoqhczf33fh6cof2atherex42eqyuogvgheyhvywnung7zte.ipfs.dweb.link
8	dl.dropbox.com	8 redirects
1	i.ibb.co	bafybeicw2sqoqhczf33fh6cof2atherex42eqyuogvgheyhvywnung7zte.ipfs.dweb.link
1	code.jquery.com	bafybeicw2sqoqhczf33fh6cof2atherex42eqyuogvgheyhvywnung7zte.ipfs.dweb.link
1	bafybeicw2sqoqhczf33fh6cof2atherex42eqyuogvgheyhvywnung7zte.ipfs.dweb.link
1	jonathanmalcolm147.lt.emlnk.com	1 redirects
11	6

This site contains no links.

Subject Issuer	Validity	Valid
dweb.link R3	`2022-03-20` - `2022-06-18`	3 months	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2021-07-14` - `2022-08-14`	a year	crt.sh
ibb.co R3	`2022-04-07` - `2022-07-06`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://bafybeicw2sqoqhczf33fh6cof2atherex42eqyuogvgheyhvywnung7zte.ipfs.dweb.link/?filename=bill.htm
Frame ID: 724E422BA9217601962CA0E381E49979
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Adobe-PDF Online

Page URL History Show full URLs

https://jonathanmalcolm147.lt.emlnk.com/Prod/link-tracker?notrack=1&redirectUrl=aHR0cHMlM0ElMkYlMkZiYWZ5YmVpY3cyc3Fv... HTTP 302
https://bafybeicw2sqoqhczf33fh6cof2atherex42eqyuogvgheyhvywnung7zte.ipfs.dweb.link/?filename=bill.htm Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

11
Requests

27 %
HTTPS

60 %
IPv6

6
Domains

6
Subdomains

5
IPs

3
Countries

347 kB
Transfer

907 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://jonathanmalcolm147.lt.emlnk.com/Prod/link-tracker?notrack=1&redirectUrl=aHR0cHMlM0ElMkYlMkZiYWZ5YmVpY3cyc3FvcWhjemYzM2ZoNmNvZjJhdGhlcmV4NDJlcXl1b2d2Z2hleWh2eXdudW5nN3p0ZS5pcGZzLmR3ZWIubGluayUyRiUzRmZpbGVuYW1lJTNEYmlsbC5odG0lMjMlNUIlNUItRW1haWwtJTVEJTVE&sig=8r9aQJDm5Q9q3jv9PQFrQSAsfLtMjrXWrzXvPBbUUbPk&iat=1652376864&a=%7C%7C225765213%7C%7C&account=jonathanmalcolm147%2Eactivehosted%2Ecom&email=q7vI7uJ6LD5E1djtfleVwVwWGEkKj8PkvacsVbQnfc4%3D&s=757bea47b8c204ee331760b8f17e35ce&i=1A3A1A1 HTTP 302
https://bafybeicw2sqoqhczf33fh6cof2atherex42eqyuogvgheyhvywnung7zte.ipfs.dweb.link/?filename=bill.htm Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://dl.dropbox.com/s/wdqjm5z4qygv2ix/jquery-3.3.1.js.download?dl=0 HTTP 302
https://dl.dropboxusercontent.com/s/wdqjm5z4qygv2ix/jquery-3.3.1.js.download?dl=0

Request Chain 1

https://dl.dropbox.com/s/hth5gdn7nl0h3ox/jquery-3.1.1.min.js.download?dl=0 HTTP 302
https://dl.dropboxusercontent.com/s/hth5gdn7nl0h3ox/jquery-3.1.1.min.js.download?dl=0

Request Chain 2

https://dl.dropbox.com/s/hth5gdn7nl0h3ox/jquery-3.1.1.min.js.download?dl=0 HTTP 302
https://dl.dropboxusercontent.com/s/hth5gdn7nl0h3ox/jquery-3.1.1.min.js.download?dl=0

Request Chain 3

https://dl.dropbox.com/s/tqhuyar3b2h9ccb/bootstrap.min.css?dl=0 HTTP 302
https://dl.dropboxusercontent.com/s/tqhuyar3b2h9ccb/bootstrap.min.css?dl=0

Request Chain 4

https://dl.dropbox.com/s/cjs8oyuw669mgum/css?dl=0 HTTP 302
https://dl.dropboxusercontent.com/s/cjs8oyuw669mgum/css?dl=0

Request Chain 5

https://dl.dropbox.com/s/iio2cwh56o6icxb/all.css?dl=0 HTTP 302
https://dl.dropboxusercontent.com/s/iio2cwh56o6icxb/all.css?dl=0

Request Chain 6

https://dl.dropbox.com/s/91igi615287bf1o/jquery.min.js.download?dl=0 HTTP 302
https://dl.dropboxusercontent.com/s/91igi615287bf1o/jquery.min.js.download?dl=0

Request Chain 7

https://dl.dropbox.com/s/4wftgd76xaaolq9/bootstrap.min.js%281%29.download?dl=0 HTTP 302
https://dl.dropboxusercontent.com/s/4wftgd76xaaolq9/bootstrap.min.js%281%29.download?dl=0

11 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
bafybeicw2sqoqhczf33fh6cof2atherex42eqyuogvgheyhvywnung7zte.ipfs.dweb.link/
Redirect Chain

https://jonathanmalcolm147.lt.emlnk.com/Prod/link-tracker?notrack=1&redirectUrl=aHR0cHMlM0ElMkYlMkZiYWZ5YmVpY3cyc3FvcWhjemYzM2ZoNmNvZjJhdGhlcmV4NDJlcXl1b2d2Z2hleWh2eXdudW5nN3p0ZS5pcGZzLmR3ZWIubGlua...
https://bafybeicw2sqoqhczf33fh6cof2atherex42eqyuogvgheyhvywnung7zte.ipfs.dweb.link/?filename=bill.htm

167 KB
32 KB

46ms
13ms

Document
text/html

2602:fea2:2::1
PROTOCOL

General

Check archive.org

Show headers Download Go to

Full URL

https://bafybeicw2sqoqhczf33fh6cof2atherex42eqyuogvgheyhvywnung7zte.ipfs.dweb.link/?filename=bill.htm

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2602:fea2:2::1 , United States, ASN40680 (PROTOCOL, US),

Reverse DNS

Software

openresty /

Resource Hash

df72b051f8ee88e45ee6cdbe561aa8229e7043f5f08fbfc73a9aedd9f4e570eb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-headers: X-Requested-With, Range, Content-Range, X-Chunked-Output, X-Stream-Output
access-control-allow-methods: GET GET, POST, OPTIONS
access-control-allow-origin: *
access-control-expose-headers: Content-Range, X-Chunked-Output, X-Stream-Output
cache-control: public, max-age=29030400, immutable
content-disposition: inline; filename="bill.htm"; filename*=UTF-8''bill.htm
content-encoding: gzip
content-type: text/html
date: Fri, 13 May 2022 07:04:42 GMT
etag: W/"bafybeicw2sqoqhczf33fh6cof2atherex42eqyuogvgheyhvywnung7zte"
last-modified: Thu, 01 Jan 1970 00:00:01 GMT
server: openresty
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-ipfs-gateway-host: ipfs-bank6-fr2
x-ipfs-lb-pop: gateway-bank2-fr2
x-ipfs-path: /ipfs/bafybeicw2sqoqhczf33fh6cof2atherex42eqyuogvgheyhvywnung7zte/
x-ipfs-pop: ipfs-bank6-fr2
x-proxy-cache: HIT

Redirect headers

content-length: 0
content-type: application/json
date: Fri, 13 May 2022 07:04:42 GMT
location: https://bafybeicw2sqoqhczf33fh6cof2atherex42eqyuogvgheyhvywnung7zte.ipfs.dweb.link/?filename=bill.htm#[[-Email-]]
x-amz-apigw-id: SDVpnH0xIAMFurg=
x-amzn-requestid: 5994d7a0-5b34-4ac1-b9bc-c543bb3a6a30
x-amzn-trace-id: Root=1-627e030a-038b0abd2d9393041d83cc6b;Sampled=0

GET
H2

200

jquery-3.3.1.js.download Show response
dl.dropboxusercontent.com/s/wdqjm5z4qygv2ix/
Redirect Chain

https://dl.dropbox.com/s/wdqjm5z4qygv2ix/jquery-3.3.1.js.download?dl=0
https://dl.dropboxusercontent.com/s/wdqjm5z4qygv2ix/jquery-3.3.1.js.download?dl=0

0
0

428ms
427ms

Script
text/plain

2620:100:6023:15::a27d:430f
DROPBOX

General

Check archive.org

Show headers Download Go to

Full URL: https://dl.dropboxusercontent.com/s/wdqjm5z4qygv2ix/jquery-3.3.1.js.download?dl=0
Requested by: Host: bafybeicw2sqoqhczf33fh6cof2atherex42eqyuogvgheyhvywnung7zte.ipfs.dweb.link
URL: https://bafybeicw2sqoqhczf33fh6cof2atherex42eqyuogvgheyhvywnung7zte.ipfs.dweb.link/?filename=bill.htm
Protocol: H2
Server: 2620:100:6023:15::a27d:430f , United States, ASN19679 (DROPBOX, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bafybeicw2sqoqhczf33fh6cof2atherex42eqyuogvgheyhvywnung7zte.ipfs.dweb.link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Redirect headers

content-security-policy: sandbox
content-encoding: gzip
accept-encoding: identity,gzip
server: envoy
date: Fri, 13 May 2022 07:04:42 GMT
vary: Accept-Encoding
content-type: text/html; charset=utf-8
location: https://dl.dropboxusercontent.com/s/wdqjm5z4qygv2ix/jquery-3.3.1.js.download?dl=0
cache-control: no-cache
x-dropbox-response-origin: far_remote
x-dropbox-request-id: 57c5321797b84983bd7f477eb5b28296
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-robots-tag: noindex, nofollow, noimageindex

GET
H2

200

jquery-3.1.1.min.js.download Show response
dl.dropboxusercontent.com/s/hth5gdn7nl0h3ox/
Redirect Chain

https://dl.dropbox.com/s/hth5gdn7nl0h3ox/jquery-3.1.1.min.js.download?dl=0
https://dl.dropboxusercontent.com/s/hth5gdn7nl0h3ox/jquery-3.1.1.min.js.download?dl=0

0
0

446ms
441ms

Script
text/plain

2620:100:6023:15::a27d:430f
DROPBOX

General

Check archive.org

Show headers Download Go to

Full URL: https://dl.dropboxusercontent.com/s/hth5gdn7nl0h3ox/jquery-3.1.1.min.js.download?dl=0
Requested by: Host: bafybeicw2sqoqhczf33fh6cof2atherex42eqyuogvgheyhvywnung7zte.ipfs.dweb.link
URL: https://bafybeicw2sqoqhczf33fh6cof2atherex42eqyuogvgheyhvywnung7zte.ipfs.dweb.link/?filename=bill.htm
Protocol: H2
Server: 2620:100:6023:15::a27d:430f , United States, ASN19679 (DROPBOX, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bafybeicw2sqoqhczf33fh6cof2atherex42eqyuogvgheyhvywnung7zte.ipfs.dweb.link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Redirect headers

content-security-policy: sandbox
content-encoding: gzip
accept-encoding: identity,gzip
server: envoy
date: Fri, 13 May 2022 07:04:42 GMT
vary: Accept-Encoding
content-type: text/html; charset=utf-8
location: https://dl.dropboxusercontent.com/s/hth5gdn7nl0h3ox/jquery-3.1.1.min.js.download?dl=0
cache-control: no-cache
x-dropbox-response-origin: far_remote
x-dropbox-request-id: bc80985c4cfb4eba9cf555115b84163f
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-robots-tag: noindex, nofollow, noimageindex

GET
H2

200

jquery-3.1.1.min.js.download Show response
dl.dropboxusercontent.com/s/hth5gdn7nl0h3ox/
Redirect Chain

https://dl.dropbox.com/s/hth5gdn7nl0h3ox/jquery-3.1.1.min.js.download?dl=0
https://dl.dropboxusercontent.com/s/hth5gdn7nl0h3ox/jquery-3.1.1.min.js.download?dl=0

85 KB
34 KB

385ms
380ms

Script
text/plain

2620:100:6023:15::a27d:430f
DROPBOX

General

Check archive.org

Show headers Download Go to

Full URL

https://dl.dropboxusercontent.com/s/hth5gdn7nl0h3ox/jquery-3.1.1.min.js.download?dl=0

Requested by

Host: bafybeicw2sqoqhczf33fh6cof2atherex42eqyuogvgheyhvywnung7zte.ipfs.dweb.link
URL: https://bafybeicw2sqoqhczf33fh6cof2atherex42eqyuogvgheyhvywnung7zte.ipfs.dweb.link/?filename=bill.htm

Protocol

Server

2620:100:6023:15::a27d:430f , United States, ASN19679 (DROPBOX, US),

Reverse DNS

Software

envoy /

Resource Hash

85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf

Security Headers

Name	Value
Content-Security-Policy	report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bafybeicw2sqoqhczf33fh6cof2atherex42eqyuogvgheyhvywnung7zte.ipfs.dweb.link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

content-security-policy: report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
content-encoding: gzip
x-content-type-options: nosniff
accept-encoding: identity,gzip
x-dropbox-request-id: 0472747f0072460fa73892696fa93ce0
x-dropbox-response-origin: far_remote
content-disposition: inline; filename="jquery-3.1.1.min.js.download"; filename*=UTF-8''jquery-3.1.1.min.js.download
strict-transport-security: max-age=31536000; includeSubDomains; preload
pragma: public
server: envoy
date: Fri, 13 May 2022 07:04:42 GMT
x-server-response-time: 260
vary: Accept-Encoding
content-type: text/plain; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range, X-Dropbox-Metadata, X-Dropbox-Request-Id, X-JSON, X-Server-Response-Time, Timing-Allow-Origin, x-dropbox-pdf-password-needed
cache-control: max-age=60
accept-ranges: bytes
x-robots-tag: noindex, nofollow, noimageindex

Redirect headers

content-security-policy: sandbox
content-encoding: gzip
accept-encoding: identity,gzip
server: envoy
access-control-allow-origin: *
date: Fri, 13 May 2022 07:04:42 GMT
vary: Accept-Encoding
content-type: text/html; charset=utf-8
location: https://dl.dropboxusercontent.com/s/hth5gdn7nl0h3ox/jquery-3.1.1.min.js.download?dl=0
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range, X-Dropbox-Metadata, X-Dropbox-Request-Id, X-JSON, X-Server-Response-Time, Timing-Allow-Origin, x-dropbox-pdf-password-needed
cache-control: no-cache
x-dropbox-response-origin: far_remote
x-dropbox-request-id: fc1d1f9251434ed6868d4438b044009c
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-robots-tag: noindex, nofollow, noimageindex

GET
H2

200

bootstrap.min.css
dl.dropboxusercontent.com/s/tqhuyar3b2h9ccb/
Redirect Chain

https://dl.dropbox.com/s/tqhuyar3b2h9ccb/bootstrap.min.css?dl=0
https://dl.dropboxusercontent.com/s/tqhuyar3b2h9ccb/bootstrap.min.css?dl=0

141 KB
24 KB

445ms
436ms

Stylesheet
text/css

2620:100:6023:15::a27d:430f
DROPBOX

General

Check archive.org

Show headers Download Go to

Full URL

https://dl.dropboxusercontent.com/s/tqhuyar3b2h9ccb/bootstrap.min.css?dl=0

Requested by

Host: bafybeicw2sqoqhczf33fh6cof2atherex42eqyuogvgheyhvywnung7zte.ipfs.dweb.link
URL: https://bafybeicw2sqoqhczf33fh6cof2atherex42eqyuogvgheyhvywnung7zte.ipfs.dweb.link/?filename=bill.htm

Protocol

Server

2620:100:6023:15::a27d:430f , United States, ASN19679 (DROPBOX, US),

Reverse DNS

Software

envoy /

Resource Hash

2c0f3dcfe93d7e380c290fe4ab838ed8cadff1596d62697f5444be460d1f876d

Security Headers

Name	Value
Content-Security-Policy	report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bafybeicw2sqoqhczf33fh6cof2atherex42eqyuogvgheyhvywnung7zte.ipfs.dweb.link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

content-security-policy: report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
content-encoding: gzip
x-content-type-options: nosniff
accept-encoding: identity,gzip
x-dropbox-request-id: 96f7a0e509a34285a7839943ab7c0a8b
x-dropbox-response-origin: far_remote
content-disposition: inline; filename="bootstrap.min.css"; filename*=UTF-8''bootstrap.min.css
strict-transport-security: max-age=31536000; includeSubDomains; preload
pragma: public
server: envoy
date: Fri, 13 May 2022 07:04:42 GMT
x-server-response-time: 296
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range, X-Dropbox-Metadata, X-Dropbox-Request-Id, X-JSON, X-Server-Response-Time, Timing-Allow-Origin, x-dropbox-pdf-password-needed
cache-control: max-age=60
accept-ranges: bytes
x-robots-tag: noindex, nofollow, noimageindex

Redirect headers

content-security-policy: sandbox
content-encoding: gzip
accept-encoding: identity,gzip
server: envoy
access-control-allow-origin: *
date: Fri, 13 May 2022 07:04:42 GMT
vary: Accept-Encoding
content-type: text/html; charset=utf-8
location: https://dl.dropboxusercontent.com/s/tqhuyar3b2h9ccb/bootstrap.min.css?dl=0
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range, X-Dropbox-Metadata, X-Dropbox-Request-Id, X-JSON, X-Server-Response-Time, Timing-Allow-Origin, x-dropbox-pdf-password-needed
cache-control: no-cache
x-dropbox-response-origin: far_remote
x-dropbox-request-id: cfafac463f304a30bca6003c722d0469
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-robots-tag: noindex, nofollow, noimageindex

GET
H2

200

css
dl.dropboxusercontent.com/s/cjs8oyuw669mgum/
Redirect Chain

https://dl.dropbox.com/s/cjs8oyuw669mgum/css?dl=0
https://dl.dropboxusercontent.com/s/cjs8oyuw669mgum/css?dl=0

0
0

404ms
398ms

Stylesheet
text/plain

2620:100:6023:15::a27d:430f
DROPBOX

General

Check archive.org

Show headers Download Go to

Full URL: https://dl.dropboxusercontent.com/s/cjs8oyuw669mgum/css?dl=0
Requested by: Host: bafybeicw2sqoqhczf33fh6cof2atherex42eqyuogvgheyhvywnung7zte.ipfs.dweb.link
URL: https://bafybeicw2sqoqhczf33fh6cof2atherex42eqyuogvgheyhvywnung7zte.ipfs.dweb.link/?filename=bill.htm
Protocol: H2
Server: 2620:100:6023:15::a27d:430f , United States, ASN19679 (DROPBOX, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bafybeicw2sqoqhczf33fh6cof2atherex42eqyuogvgheyhvywnung7zte.ipfs.dweb.link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Redirect headers

content-security-policy: sandbox
content-encoding: gzip
accept-encoding: identity,gzip
server: envoy
date: Fri, 13 May 2022 07:04:42 GMT
vary: Accept-Encoding
content-type: text/html; charset=utf-8
location: https://dl.dropboxusercontent.com/s/cjs8oyuw669mgum/css?dl=0
cache-control: no-cache
x-dropbox-response-origin: far_remote
x-dropbox-request-id: a964055996e84bb0b8c28450a0f83c2d
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-robots-tag: noindex, nofollow, noimageindex

GET
H2

200

all.css
dl.dropboxusercontent.com/s/iio2cwh56o6icxb/
Redirect Chain

https://dl.dropbox.com/s/iio2cwh56o6icxb/all.css?dl=0
https://dl.dropboxusercontent.com/s/iio2cwh56o6icxb/all.css?dl=0

53 KB
12 KB

735ms
735ms

Stylesheet
text/css

2620:100:6023:15::a27d:430f
DROPBOX

General

Check archive.org

Show headers Download Go to

Full URL

https://dl.dropboxusercontent.com/s/iio2cwh56o6icxb/all.css?dl=0

Requested by

Host: bafybeicw2sqoqhczf33fh6cof2atherex42eqyuogvgheyhvywnung7zte.ipfs.dweb.link
URL: https://bafybeicw2sqoqhczf33fh6cof2atherex42eqyuogvgheyhvywnung7zte.ipfs.dweb.link/?filename=bill.htm

Protocol

Server

2620:100:6023:15::a27d:430f , United States, ASN19679 (DROPBOX, US),

Reverse DNS

Software

envoy /

Resource Hash

afdc6bf2de981ffd7d370b76f44e7580572f197efbe214b9cfa4005d189d8eae

Security Headers

Name	Value
Content-Security-Policy	report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bafybeicw2sqoqhczf33fh6cof2atherex42eqyuogvgheyhvywnung7zte.ipfs.dweb.link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

content-security-policy: report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
content-encoding: gzip
x-content-type-options: nosniff
accept-encoding: identity,gzip
x-dropbox-request-id: 5d9332fd3aeb43848872be2055b0322c
x-dropbox-response-origin: far_remote
content-disposition: inline; filename="all.css"; filename*=UTF-8''all.css
strict-transport-security: max-age=31536000; includeSubDomains; preload
pragma: public
server: envoy
date: Fri, 13 May 2022 07:04:43 GMT
x-server-response-time: 549
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range, X-Dropbox-Metadata, X-Dropbox-Request-Id, X-JSON, X-Server-Response-Time, Timing-Allow-Origin, x-dropbox-pdf-password-needed
cache-control: max-age=60
accept-ranges: bytes
x-robots-tag: noindex, nofollow, noimageindex

Redirect headers

content-security-policy: sandbox
content-encoding: gzip
accept-encoding: identity,gzip
server: envoy
access-control-allow-origin: *
date: Fri, 13 May 2022 07:04:42 GMT
vary: Accept-Encoding
content-type: text/html; charset=utf-8
location: https://dl.dropboxusercontent.com/s/iio2cwh56o6icxb/all.css?dl=0
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range, X-Dropbox-Metadata, X-Dropbox-Request-Id, X-JSON, X-Server-Response-Time, Timing-Allow-Origin, x-dropbox-pdf-password-needed
cache-control: no-cache
x-dropbox-response-origin: far_remote
x-dropbox-request-id: 442cfb4eda424776860cd04df235b791
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-robots-tag: noindex, nofollow, noimageindex

GET
H2

200

jquery.min.js.download Show response
dl.dropboxusercontent.com/s/91igi615287bf1o/
Redirect Chain

https://dl.dropbox.com/s/91igi615287bf1o/jquery.min.js.download?dl=0
https://dl.dropboxusercontent.com/s/91igi615287bf1o/jquery.min.js.download?dl=0

0
0

389ms
389ms

Script
text/plain

2620:100:6023:15::a27d:430f
DROPBOX

General

Check archive.org

Show headers Download Go to

Full URL: https://dl.dropboxusercontent.com/s/91igi615287bf1o/jquery.min.js.download?dl=0
Requested by: Host: bafybeicw2sqoqhczf33fh6cof2atherex42eqyuogvgheyhvywnung7zte.ipfs.dweb.link
URL: https://bafybeicw2sqoqhczf33fh6cof2atherex42eqyuogvgheyhvywnung7zte.ipfs.dweb.link/?filename=bill.htm
Protocol: H2
Server: 2620:100:6023:15::a27d:430f , United States, ASN19679 (DROPBOX, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bafybeicw2sqoqhczf33fh6cof2atherex42eqyuogvgheyhvywnung7zte.ipfs.dweb.link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Redirect headers

content-security-policy: sandbox
content-encoding: gzip
accept-encoding: identity,gzip
server: envoy
date: Fri, 13 May 2022 07:04:42 GMT
vary: Accept-Encoding
content-type: text/html; charset=utf-8
location: https://dl.dropboxusercontent.com/s/91igi615287bf1o/jquery.min.js.download?dl=0
cache-control: no-cache
x-dropbox-response-origin: far_remote
x-dropbox-request-id: f3f41f249e8a45689a4f87253bd5b9b6
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-robots-tag: noindex, nofollow, noimageindex

GET
H2

200

bootstrap.min.js%281%29.download Show response
dl.dropboxusercontent.com/s/4wftgd76xaaolq9/
Redirect Chain

https://dl.dropbox.com/s/4wftgd76xaaolq9/bootstrap.min.js%281%29.download?dl=0
https://dl.dropboxusercontent.com/s/4wftgd76xaaolq9/bootstrap.min.js%281%29.download?dl=0

0
0

404ms
397ms

Script
text/plain

2620:100:6023:15::a27d:430f
DROPBOX

General

Check archive.org

Show headers Download Go to

Full URL: https://dl.dropboxusercontent.com/s/4wftgd76xaaolq9/bootstrap.min.js%281%29.download?dl=0
Requested by: Host: bafybeicw2sqoqhczf33fh6cof2atherex42eqyuogvgheyhvywnung7zte.ipfs.dweb.link
URL: https://bafybeicw2sqoqhczf33fh6cof2atherex42eqyuogvgheyhvywnung7zte.ipfs.dweb.link/?filename=bill.htm
Protocol: H2
Server: 2620:100:6023:15::a27d:430f , United States, ASN19679 (DROPBOX, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bafybeicw2sqoqhczf33fh6cof2atherex42eqyuogvgheyhvywnung7zte.ipfs.dweb.link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Redirect headers

content-security-policy: sandbox
content-encoding: gzip
accept-encoding: identity,gzip
server: envoy
date: Fri, 13 May 2022 07:04:42 GMT
vary: Accept-Encoding
content-type: text/html; charset=utf-8
location: https://dl.dropboxusercontent.com/s/4wftgd76xaaolq9/bootstrap.min.js%281%29.download?dl=0
cache-control: no-cache
x-dropbox-response-origin: far_remote
x-dropbox-request-id: 3040de136a8c486ba4732695c24936dd
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-robots-tag: noindex, nofollow, noimageindex

GET
H2 200 jquery-1.9.1.js Show response
code.jquery.com/ 262 KB
78 KB 31ms
13ms Script
application/javascript 2001:4de0:ac18::1:a:3a
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-1.9.1.js
Requested by: Host: bafybeicw2sqoqhczf33fh6cof2atherex42eqyuogvgheyhvywnung7zte.ipfs.dweb.link
URL: https://bafybeicw2sqoqhczf33fh6cof2atherex42eqyuogvgheyhvywnung7zte.ipfs.dweb.link/?filename=bill.htm
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac18::1:a:3a , Netherlands, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
Software: nginx /
Resource Hash: 7bd80d06c01c0340c1b9159b9b4a197db882ca18cbac8e9b9aa025e68f998d40

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bafybeicw2sqoqhczf33fh6cof2atherex42eqyuogvgheyhvywnung7zte.ipfs.dweb.link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Fri, 13 May 2022 07:04:42 GMT
content-encoding: gzip
last-modified: Wed, 16 Feb 2022 10:50:39 GMT
server: nginx
etag: W/"620cd6ff-4185d"
vary: Accept-Encoding
x-hw: 1652425482.dop139.fr8.t,1652425482.cds232.fr8.hn,1652425482.cds251.fr8.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 79506

GET
DATA 200
OK truncated
/ 18 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d447ad5b2aa5ed963d25fc7f964086af8c67e28767c661f27d83a8945fe98100

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 13 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: aaa0e839c6e80bec8075702f8522c0550d4ceaaab3487f5c4f253bc0a6f7a71d

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 img.jpg
i.ibb.co/z5s1DfK/ 167 KB
167 KB 71ms
16ms Image
image/jpeg 51.210.32.106
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.ibb.co/z5s1DfK/img.jpg
Requested by: Host: bafybeicw2sqoqhczf33fh6cof2atherex42eqyuogvgheyhvywnung7zte.ipfs.dweb.link
URL: https://bafybeicw2sqoqhczf33fh6cof2atherex42eqyuogvgheyhvywnung7zte.ipfs.dweb.link/?filename=bill.htm
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 51.210.32.106 , France, ASN16276 (OVH, FR),
Reverse DNS: ns3172579.ip-51-210-32.eu
Software: nginx /
Resource Hash: 29b481ce8953bd0447442909c6f484ce8c8ddacf7e8f7eaed4740d192374a03e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://bafybeicw2sqoqhczf33fh6cof2atherex42eqyuogvgheyhvywnung7zte.ipfs.dweb.link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date: Fri, 13 May 2022 07:04:43 GMT
last-modified: Fri, 11 Jun 2021 12:07:15 GMT
server: nginx
access-control-allow-methods: GET, OPTIONS
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 170960
expires: Thu, 31 Dec 2037 23:55:55 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Adobe (Consumer)

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.dropboxusercontent.com/	1969-12-31 23:59:59	Name: uc_session Value: UqfMcYJQzslivgXOVlcl7Nu0NXvZvnhONVV5mujcbTjb64N7SE7Lo6EzGpdzeBgS

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	URL: https://bafybeicw2sqoqhczf33fh6cof2atherex42eqyuogvgheyhvywnung7zte.ipfs.dweb.link/?filename=bill.htm#[[-Email-]] Message: Failed to find a valid digest in the 'integrity' attribute for resource 'https://dl.dropbox.com/s/hth5gdn7nl0h3ox/jquery-3.1.1.min.js.download?dl=0' with computed SHA-256 integrity 'hVVnYaiADRTO2PzUGmuLJr8BLUSjGIZsDYGmIJLv2b8='. The resource has been blocked.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bafybeicw2sqoqhczf33fh6cof2atherex42eqyuogvgheyhvywnung7zte.ipfs.dweb.link
code.jquery.com
dl.dropbox.com
dl.dropboxusercontent.com
i.ibb.co
jonathanmalcolm147.lt.emlnk.com
2001:4de0:ac18::1:a:3a
2602:fea2:2::1
2620:100:6023:15::a27d:430f
51.210.32.106
54.164.165.221
29b481ce8953bd0447442909c6f484ce8c8ddacf7e8f7eaed4740d192374a03e
2c0f3dcfe93d7e380c290fe4ab838ed8cadff1596d62697f5444be460d1f876d
7bd80d06c01c0340c1b9159b9b4a197db882ca18cbac8e9b9aa025e68f998d40
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
aaa0e839c6e80bec8075702f8522c0550d4ceaaab3487f5c4f253bc0a6f7a71d
afdc6bf2de981ffd7d370b76f44e7580572f197efbe214b9cfa4005d189d8eae
d447ad5b2aa5ed963d25fc7f964086af8c67e28767c661f27d83a8945fe98100
df72b051f8ee88e45ee6cdbe561aa8229e7043f5f08fbfc73a9aedd9f4e570eb
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

bafybeicw2sqoqhczf33fh6cof2atherex42eqyuogvgheyhvywnung7zte.ipfs.dweb.link Open in urlscan Pro 2602:fea2:2::1 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

11 Requests

27 %HTTPS

60 %IPv6

6 Domains

6 Subdomains

5 IPs

3 Countries

347 kBTransfer

907 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

10 JavaScript Global Variables

1 Cookies

1 Console Messages

Security Headers

Indicators

bafybeicw2sqoqhczf33fh6cof2atherex42eqyuogvgheyhvywnung7zte.ipfs.dweb.link Open in urlscan Pro
2602:fea2:2::1 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

27 %
HTTPS

60 %
IPv6

6
Domains

6
Subdomains

5
IPs

3
Countries

347 kB
Transfer

907 kB
Size

1
Cookies

11 HTTP transactions
2 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!