![](/screenshots/336124ce-37a7-44f3-b0fc-fb4b65813db3.png)
cloudflare-ipfs.com
Open in
urlscan Pro
104.17.64.14
Malicious Activity!
Public Scan
Submission: On April 19 via automatic, source openphish — Scanned from DE
Summary
TLS certificate: Issued by E1 on February 25th 2024. Valid for: 3 months.
This is the only time cloudflare-ipfs.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Chase (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 104.17.64.14 104.17.64.14 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2606:4700:440... 2606:4700:4400::6812:29a9 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
6 | 192.236.232.35 192.236.232.35 | 54290 (HOSTWINDS) (HOSTWINDS) | |
1 | 2a04:4e42:600... 2a04:4e42:600::649 | 54113 (FASTLY) (FASTLY) | |
17 | 5 |
ASN13335 (CLOUDFLARENET, US)
bafybeiaur2qewz267wucf2k5uzsztj7amhb4ykphwex7xix72tbbq5kdlm.ipfs.w3s.link |
ASN54290 (HOSTWINDS, US)
PTR: client-192-236-232-35.hostwindsdns.com
dasmake.xyz |
Apex Domain Subdomains |
Transfer | |
---|---|---|
6 |
dasmake.xyz
dasmake.xyz |
378 KB |
1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 767 |
78 KB |
1 |
w3s.link
bafybeiaur2qewz267wucf2k5uzsztj7amhb4ykphwex7xix72tbbq5kdlm.ipfs.w3s.link |
28 KB |
1 |
cloudflare-ipfs.com
cloudflare-ipfs.com |
1 KB |
17 | 4 |
Domain | Requested by | |
---|---|---|
6 | dasmake.xyz |
bafybeiaur2qewz267wucf2k5uzsztj7amhb4ykphwex7xix72tbbq5kdlm.ipfs.w3s.link
dasmake.xyz cloudflare-ipfs.com |
1 | code.jquery.com |
bafybeiaur2qewz267wucf2k5uzsztj7amhb4ykphwex7xix72tbbq5kdlm.ipfs.w3s.link
|
1 | bafybeiaur2qewz267wucf2k5uzsztj7amhb4ykphwex7xix72tbbq5kdlm.ipfs.w3s.link |
cloudflare-ipfs.com
|
1 | cloudflare-ipfs.com | |
17 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
cloudflare-ipfs.com E1 |
2024-02-25 - 2024-05-25 |
3 months | crt.sh |
w3s.link Cloudflare Inc ECC CA-3 |
2023-06-17 - 2024-06-16 |
a year | crt.sh |
dasmake.xyz cPanel, Inc. Certification Authority |
2024-03-13 - 2024-06-11 |
3 months | crt.sh |
*.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2023-07-11 - 2024-07-14 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://cloudflare-ipfs.com/ipfs/bafybeidkir42skieqqcii5uwot52onkfjlab2ztels3bnp223whxzkkoim/login.html
Frame ID: E38B5B79A5B8726314AD158ADA58CC07
Requests: 17 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
17 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H3 |
Primary Request
login.html
cloudflare-ipfs.com/ipfs/bafybeidkir42skieqqcii5uwot52onkfjlab2ztels3bnp223whxzkkoim/ |
720 B 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
myscr517423.js
bafybeiaur2qewz267wucf2k5uzsztj7amhb4ykphwex7xix72tbbq5kdlm.ipfs.w3s.link/ |
104 KB 28 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
blue-ui.css
dasmake.xyz/chase/style/css/ |
493 KB 52 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fonto.css
dasmake.xyz/chase/style/css/ |
1 KB 348 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logon.css
dasmake.xyz/chase/style/css/ |
177 KB 23 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-1.9.1.js
code.jquery.com/ |
262 KB 78 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wordmark-white.svg
dasmake.xyz/chase/style/img/ |
1 KB 697 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
background.desktop.day.4.jpeg
dasmake.xyz/chase/style/img/ |
299 KB 299 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
opensans-regular.woff
dasmake.xyz/chase/style/css/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
dcefont.woff
dasmake.xyz/chase/style/css/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
opensans-bold.woff
dasmake.xyz/chase/style/css/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
opensans-semibold.woff
dasmake.xyz/chase/style/css/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
opensans-bold.ttf
dasmake.xyz/chase/style/css/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
opensans-semibold.ttf
dasmake.xyz/chase/style/css/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
opensans-regular.ttf
dasmake.xyz/chase/style/css/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
dcefont.ttf
dasmake.xyz/chase/style/css/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
chasefavicon.ico
dasmake.xyz/chase/style/img/ |
31 KB 2 KB |
Other
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- dasmake.xyz
- URL
- https://dasmake.xyz/chase/style/css/opensans-regular.woff
- Domain
- dasmake.xyz
- URL
- https://dasmake.xyz/chase/style/css/dcefont.woff
- Domain
- dasmake.xyz
- URL
- https://dasmake.xyz/chase/style/css/opensans-bold.woff
- Domain
- dasmake.xyz
- URL
- https://dasmake.xyz/chase/style/css/opensans-semibold.woff
- Domain
- dasmake.xyz
- URL
- https://dasmake.xyz/chase/style/css/opensans-bold.ttf
- Domain
- dasmake.xyz
- URL
- https://dasmake.xyz/chase/style/css/opensans-semibold.ttf
- Domain
- dasmake.xyz
- URL
- https://dasmake.xyz/chase/style/css/opensans-regular.ttf
- Domain
- dasmake.xyz
- URL
- https://dasmake.xyz/chase/style/css/dcefont.ttf
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Chase (Banking)13 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| erp string| em number| tmp function| acticheck function| togtoken function| load function| stopload function| disperr function| clrerr function| writerr function| validate function| $ function| jQuery1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
cloudflare-ipfs.com/ | Name: __cf_bm Value: BmrPzpysngIjAOpi88fL12wk1iSPi5qff7zgu09ZJMc-1713489013-1.0.1.1-ctZuWHHfT0w99jnCcYGvhcwcNsy1jo0wIdeTxpecZMLTT0JLs1tGZ77m569JYP5IAbpvdfsUXim.AmCEFc.4OA |
17 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
bafybeiaur2qewz267wucf2k5uzsztj7amhb4ykphwex7xix72tbbq5kdlm.ipfs.w3s.link
cloudflare-ipfs.com
code.jquery.com
dasmake.xyz
dasmake.xyz
104.17.64.14
192.236.232.35
2606:4700:4400::6812:29a9
2a04:4e42:600::649
01978e63789284edde4bb064e7d3215fad57fb5b7ea373b031b5b97021868085
4c2991816cbd382d7a0699c55c3fed48bc50aba2bd812e9f2e63d3bb8af4f533
580c90efe26580ec49d22036bd0d25bd26d2fff974c0af3f037cc82a15e46aeb
5a517beb619ad73d6d9569ffe52749a751a691219d5a3550c4cfd01ce6ddd57a
625816f80596303e9de8e68695973369faa462b416202825b03899c781464fb9
7bd80d06c01c0340c1b9159b9b4a197db882ca18cbac8e9b9aa025e68f998d40
974d76a5ed470b2b9ff16c81a581dd700995ed45af5ebe479d96b4ba9bd03523
9ffed7f389a2f0dcf80d8140295137655d1c541133753865003c513eb4cf7ea9
d3bf9c143e5e360da41736b1d4e833b5ac6b6f7093ddc91ffc538233a78488d0