ipfs.io
Open in
urlscan Pro
209.94.90.1
Malicious Activity!
Public Scan
Effective URL: https://ipfs.io/ipfs/QmXbv3FLtU8xPjrV3hrQQw7QiUYRtueGttcaZwEdJSHnyg/
Submission: On June 16 via api from US — Scanned from FI
Summary
TLS certificate: Issued by WE1 on June 14th 2024. Valid for: 3 months.
This is the only time ipfs.io was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Crypto (Crypto Exchange)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 172.67.140.212 172.67.140.212 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 209.94.90.1 209.94.90.1 | 40680 (PROTOCOL) (PROTOCOL) | |
6 | 76.76.21.93 76.76.21.93 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 104.17.24.14 104.17.24.14 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
13 | 4 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
6 |
curve.fi
classic.curve.fi |
202 KB |
2 |
ipfs.io
ipfs.io — Cisco Umbrella Rank: 90147 |
379 KB |
1 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 265 |
20 KB |
1 |
curve-fi.support
1 redirects
curve-fi.support |
469 B |
0 |
5loz5rb0qf.ru
Failed
5loz5rb0qf.ru Failed |
|
0 |
ipfs.tech
Failed
ipfs.tech Failed |
|
13 | 6 |
Domain | Requested by | |
---|---|---|
6 | classic.curve.fi |
ipfs.io
|
2 | ipfs.io |
ipfs.io
|
1 | cdnjs.cloudflare.com |
ipfs.io
|
1 | curve-fi.support | 1 redirects |
0 | 5loz5rb0qf.ru Failed |
ipfs.io
|
0 | ipfs.tech Failed |
ipfs.io
|
13 | 6 |
This site contains links to these domains. Also see Links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
ipfs.io WE1 |
2024-06-14 - 2024-09-12 |
3 months | crt.sh |
classic.curve.fi R3 |
2024-05-04 - 2024-08-02 |
3 months | crt.sh |
cdnjs.cloudflare.com E1 |
2024-06-02 - 2024-08-31 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://ipfs.io/ipfs/QmXbv3FLtU8xPjrV3hrQQw7QiUYRtueGttcaZwEdJSHnyg/
Frame ID: 0139BB8809ADA7FF13B46CF636DBE4BE
Requests: 13 HTTP requests in this frame
Screenshot
Page Title
Curve.fiPage URL History Show full URLs
-
https://curve-fi.support/
HTTP 301
https://ipfs.io/ipfs/QmXbv3FLtU8xPjrV3hrQQw7QiUYRtueGttcaZwEdJSHnyg/ Page URL
Detected technologies
Vue.js (JavaScript Frameworks) ExpandDetected patterns
- <[^>]+\sdata-v(?:ue)?-
Page Statistics
24 Outgoing links
These are links going to different origins than the main page.
Search URL Search Domain Scan URL
Title: DAO
Search URL Search Domain Scan URL
Title: Dune dashboard ↗
Search URL Search Domain Scan URL
Title: Llama Airforce ↗
Search URL Search Domain Scan URL
Title: Ethereum
Search URL Search Domain Scan URL
Title: Arbitrum
Search URL Search Domain Scan URL
Title: Aurora
Search URL Search Domain Scan URL
Title: Avalanche
Search URL Search Domain Scan URL
Title: Fantom
Search URL Search Domain Scan URL
Title: Harmony
Search URL Search Domain Scan URL
Title: Optimism
Search URL Search Domain Scan URL
Title: Polygon
Search URL Search Domain Scan URL
Title: xDai
Search URL Search Domain Scan URL
Title: Moonbeam
Search URL Search Domain Scan URL
Title: Kava
Search URL Search Domain Scan URL
Title: Celo
Search URL Search Domain Scan URL
Title: News
Search URL Search Domain Scan URL
Title: Resources
Search URL Search Domain Scan URL
Title: #Twitter
Search URL Search Domain Scan URL
Title: @Telegram
Search URL Search Domain Scan URL
Title: @Telegram CN
Search URL Search Domain Scan URL
Title: @Discord
Search URL Search Domain Scan URL
Title: Dune Analytics
Search URL Search Domain Scan URL
Title: git@
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://curve-fi.support/
HTTP 301
https://ipfs.io/ipfs/QmXbv3FLtU8xPjrV3hrQQw7QiUYRtueGttcaZwEdJSHnyg/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://ipfs.io/css/app.aa124228.css HTTP 301
- https://ipfs.tech/css/app.aa124228.css
- https://ipfs.io/js/app.8ac9f6e9.js HTTP 301
- https://ipfs.tech/js/app.8ac9f6e9.js
- https://ipfs.io/js/chunk-vendors.d97fb712.js HTTP 301
- https://ipfs.tech/js/chunk-vendors.d97fb712.js
13 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H3 |
Primary Request
/
ipfs.io/ipfs/QmXbv3FLtU8xPjrV3hrQQw7QiUYRtueGttcaZwEdJSHnyg/ Redirect Chain
|
91 KB 57 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
app.aa124228.css
ipfs.tech/css/ Redirect Chain
|
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
app.8ac9f6e9.js
ipfs.tech/js/ Redirect Chain
|
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
chunk-vendors.d97fb712.js
ipfs.tech/js/ Redirect Chain
|
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
app.aa124228.css
classic.curve.fi/css/ |
22 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
chunk-012c4385.f741bd35.css
classic.curve.fi/css/ |
1004 B 583 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
chunk-4e7f17cf.19781dd2.css
classic.curve.fi/css/ |
1 KB 559 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
main.js
ipfs.io/ipfs/QmXbv3FLtU8xPjrV3hrQQw7QiUYRtueGttcaZwEdJSHnyg/scripts/ |
1 MB 322 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo.png
classic.curve.fi/ |
146 KB 146 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo_optimized.svg
classic.curve.fi/logos/ |
175 KB 46 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
crypto-js.min.js
cdnjs.cloudflare.com/ajax/libs/crypto-js/4.2.0/ |
59 KB 20 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST |
config
5loz5rb0qf.ru/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
favicon-32x32.png
classic.curve.fi/img/icons/ |
2 KB 2 KB |
Other
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- ipfs.tech
- URL
- https://ipfs.tech/css/app.aa124228.css
- Domain
- ipfs.tech
- URL
- https://ipfs.tech/js/app.8ac9f6e9.js
- Domain
- ipfs.tech
- URL
- https://ipfs.tech/js/chunk-vendors.d97fb712.js
- Domain
- 5loz5rb0qf.ru
- URL
- https://5loz5rb0qf.ru/config
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Crypto (Crypto Exchange)34 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
undefined| event object| fence object| sharedStorage function| __p_8984104896 object| __p_5923361479 number| __p_1112857319 object| __p_0244567194 function| __getGlobal object| __globalObject function| __TextDecoder function| __Uint8Array undefined| __Buffer function| __String function| __Array function| utf8ArrayToStr function| __p_5396426274 string| __p_5535667839 string| __p_1093133938 string| __p_2191077397 string| __p_8032792620 string| __p_9067685933 object| __p_6559063652 string| __p_8800704611 string| __p_9497388044 object| __p_4521372638 function| __p_7869975072_calc function| __p_9355119408 number| __p_4535649479 function| _0x3bfa function| _0x1560 function| _0x1616d6 function| __p_7037781560 function| __p_6048030636 object| CryptoJS0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
3 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
5loz5rb0qf.ru
cdnjs.cloudflare.com
classic.curve.fi
curve-fi.support
ipfs.io
ipfs.tech
5loz5rb0qf.ru
ipfs.tech
104.17.24.14
172.67.140.212
209.94.90.1
76.76.21.93
00d916bca4f213e7550b81688583a2d9ba900f4c9db57836c1171c34ca9e277e
2d692bb02f158d5b6ac9d4868241fcf308f9df835e1ea8764a0edafab14fbd5e
3b06f48ce3c04996493da83213c5e5f5d5c6f65daeefcfcfca3dcc9d7657fe98
769a555de553babc35a3338f344dd7aa16260c93cea2c7db290707c90484e7cc
96637882555d185c82c8ca4367066a8a1bab251bafdd4bfebef7a3fa705a3733
a7c0c291bea84d8b753a198fa8b3a5b7c36ab10321f56bd3f8905939013f9f9b
b7b6f09684dc4454d00f56993fd17e345f8556fad3a88ff536089305079c1abf
c4895b47f34a3abd3f37f3385ed70710b8cd226511995e57d63387f210914f38
e714e68f9546cf2a86f7d4c89a16057846e63123854877a3accae810e3aca559