ipfs.io Open in urlscan Pro
209.94.90.1 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://paws-coin.events/?shiny
Effective URL:
https://ipfs.io/ipfs/QmbX4pf3zGMgPX2m6BfiiRxmBcVKjcaSYt6RQT31v5p3vt/
Submission Tags: shiny c290acadafe6362a fc6b18fd85158e2b bfst honeypoter@gmail.com Search All
Submission: On October 01 via api (October 1st 2024, 10:38:58 pm UTC) from JP — Scanned from JP

Summary HTTP 11 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 2 countries across 5 domains to perform 11 HTTP transactions. The main IP is 209.94.90.1, located in United States and belongs to PROTOCOL, US. The main domain is ipfs.io. The Cisco Umbrella rank of the primary domain is 111091.
TLS certificate: Issued by WE1 on August 13th 2024. Valid for: 3 months.

This is the only time ipfs.io was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Crypto (Crypto Exchange)

Domain & IP information

	IP Address	AS Autonomous System
1 1	172.67.189.221 172.67.189.221	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	209.94.90.1 209.94.90.1	40680 (PROTOCOL) (PROTOCOL)
2	104.17.24.14 104.17.24.14	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6812:12aa	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6812:ba1f	13335 (CLOUDFLAR...) (CLOUDFLARENET)
11	5

1 172.67.189.221 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

paws-coin.events	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 209.94.90.1 (United States)

ASN40680 (PROTOCOL, US)

ipfs.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.17.24.14 (None, )

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:12aa (United States)

ASN13335 (CLOUDFLARENET, US)

apidata-web3-nfts-ethereum1.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:ba1f (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	ipfs.io ipfs.io — Cisco Umbrella Rank: 111091	1 MB
2	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 257	143 KB
1	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 341	47 KB
1	apidata-web3-nfts-ethereum1.ru apidata-web3-nfts-ethereum1.ru	8 KB
1	paws-coin.events 1 redirects paws-coin.events	452 B
11	5

	Domain	Requested by
3	ipfs.io	ipfs.io
2	cdnjs.cloudflare.com	ipfs.io
1	cdn.jsdelivr.net	ipfs.io
1	apidata-web3-nfts-ethereum1.ru	ipfs.io
1	paws-coin.events	1 redirects
11	5

This site contains no links.

Subject Issuer	Validity	Valid
ipfs.io WE1	`2024-08-13` - `2024-11-11`	3 months	crt.sh
cdnjs.cloudflare.com WE1	`2024-09-28` - `2024-12-27`	3 months	crt.sh
apidata-web3-nfts-ethereum1.ru WE1	`2024-08-09` - `2024-11-07`	3 months	crt.sh
*.jsdelivr.net Sectigo RSA Domain Validation Secure Server CA	`2024-05-04` - `2025-05-04`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://ipfs.io/ipfs/QmbX4pf3zGMgPX2m6BfiiRxmBcVKjcaSYt6RQT31v5p3vt/
Frame ID: B87C3F6FB6BC663399B694D2465AA7EE
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

BabyDoge | Airdrop

Page URL History Show full URLs

http://paws-coin.events/?shiny HTTP 307
https://paws-coin.events/?shiny HTTP 301
https://ipfs.io/ipfs/QmbX4pf3zGMgPX2m6BfiiRxmBcVKjcaSYt6RQT31v5p3vt/ Page URL

Detected technologies

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

//cdn\.jsdelivr\.net/

Page Statistics

11
Requests

64 %
HTTPS

40 %
IPv6

5
Domains

5
Subdomains

5
IPs

2
Countries

1447 kB
Transfer

4404 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://paws-coin.events/?shiny HTTP 307
https://paws-coin.events/?shiny HTTP 301
https://ipfs.io/ipfs/QmbX4pf3zGMgPX2m6BfiiRxmBcVKjcaSYt6RQT31v5p3vt/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions
3 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3

200

Primary Request / Show response
ipfs.io/ipfs/QmbX4pf3zGMgPX2m6BfiiRxmBcVKjcaSYt6RQT31v5p3vt/
Redirect Chain

http://paws-coin.events/?shiny
https://paws-coin.events/?shiny
https://ipfs.io/ipfs/QmbX4pf3zGMgPX2m6BfiiRxmBcVKjcaSYt6RQT31v5p3vt/

913 KB
494 KB

37ms
17ms

Document
text/html

209.94.90.1
PROTOCOL

General

Check archive.org

Show headers Download Go to

Full URL: https://ipfs.io/ipfs/QmbX4pf3zGMgPX2m6BfiiRxmBcVKjcaSYt6RQT31v5p3vt/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 209.94.90.1 , United States, ASN40680 (PROTOCOL, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 570cbde8ccf3813f68691f4c03d68db8bc3f1a088d248bc99f92ad2f5c86ce10

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

access-control-allow-headers: Content-Type Range User-Agent X-Requested-With
access-control-allow-methods: GET HEAD OPTIONS
access-control-allow-origin: *
access-control-expose-headers: Content-Length Content-Range X-Chunked-Output X-Ipfs-Path X-Ipfs-Roots X-Stream-Output
age: 156035
cache-control: public, max-age=29030400, immutable
cf-cache-status: HIT
cf-ray: 8cbff2146c09e370-NRT
content-encoding: br
content-type: text/html
date: Tue, 01 Oct 2024 22:38:54 GMT
server: cloudflare
vary: Accept-Encoding
x-ipfs-path: /ipfs/QmbX4pf3zGMgPX2m6BfiiRxmBcVKjcaSYt6RQT31v5p3vt/
x-ipfs-pop: rainbow-sl1-01
x-ipfs-roots: QmbX4pf3zGMgPX2m6BfiiRxmBcVKjcaSYt6RQT31v5p3vt

Redirect headers

access-control-allow-origin: *
cf-cache-status: DYNAMIC
cf-ray: 8cbff2110c3a1d8b-NRT
date: Tue, 01 Oct 2024 22:38:54 GMT
location: https://ipfs.io/ipfs/QmbX4pf3zGMgPX2m6BfiiRxmBcVKjcaSYt6RQT31v5p3vt/
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Alp3m49oBz1n4i2ZWac6Q6GJooqFmuzSGWC9RAxkR3aNl%2Bt2FdxywFtq6kYyK%2F7zDzVSTaUvj3dgFHcDlrO4QpSq9mq83N38Bt%2F3n%2BRqLypLfIItiyRQ6DPVzrN%2BYkMB4f0r"}],"group":"cf-nel","max_age":604800}
server: cloudflare

GET
H3 200 init.js Show response
ipfs.io/ipfs/QmbX4pf3zGMgPX2m6BfiiRxmBcVKjcaSYt6RQT31v5p3vt/scripts/ 2 MB
697 KB 194ms
194ms Script
text/javascript 209.94.90.1
PROTOCOL

General

Check archive.org

Show headers Download Go to

Full URL: https://ipfs.io/ipfs/QmbX4pf3zGMgPX2m6BfiiRxmBcVKjcaSYt6RQT31v5p3vt/scripts/init.js
Requested by: Host: ipfs.io
URL: https://ipfs.io/ipfs/QmbX4pf3zGMgPX2m6BfiiRxmBcVKjcaSYt6RQT31v5p3vt/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 209.94.90.1 , United States, ASN40680 (PROTOCOL, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2b2e7567648cefee94954ac078187fb80818eff3f068b2c8f271e5d5e9143da9

Request headers

User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1
Referer

Response headers

access-control-expose-headers: Content-Length, Content-Range, X-Chunked-Output, X-Ipfs-Path, X-Ipfs-Roots, X-Stream-Output
content-encoding: br
x-ipfs-path: /ipfs/QmbX4pf3zGMgPX2m6BfiiRxmBcVKjcaSYt6RQT31v5p3vt/scripts/init.js
etag: W/"QmdL9cu6YRMBiEQV4EPCdNgfNouwbjnKry8hBDknMhe48p"
cf-cache-status: HIT
access-control-allow-methods: GET, HEAD, OPTIONS
date: Tue, 01 Oct 2024 22:38:54 GMT
content-type: text/javascript; charset=utf-8
x-ipfs-roots: QmbX4pf3zGMgPX2m6BfiiRxmBcVKjcaSYt6RQT31v5p3vt,QmfDyVTjVS2ziUwWVEDUY4r1DZZn2XAk6d7d3uhyCtGdq3,QmdL9cu6YRMBiEQV4EPCdNgfNouwbjnKry8hBDknMhe48p
vary: Accept-Encoding
x-ipfs-pop: rainbow-sl1-01
access-control-allow-headers: Content-Type, Range, User-Agent, X-Requested-With
cache-control: public, max-age=29030400, immutable
cf-ray: 8cbff2149c3fe370-NRT
access-control-allow-origin: *
server: cloudflare

GET
H3 200 crypto-js.min.js Show response
cdnjs.cloudflare.com/ajax/libs/crypto-js/4.2.0/ 59 KB
20 KB 23ms
16ms Script
application/javascript 104.17.24.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.2.0/crypto-js.min.js

Requested by

Host: ipfs.io
URL: https://ipfs.io/ipfs/QmbX4pf3zGMgPX2m6BfiiRxmBcVKjcaSYt6RQT31v5p3vt/scripts/init.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

769a555de553babc35a3338f344dd7aa16260c93cea2c7db290707c90484e7cc

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1
Referer

Response headers

cf-cdnjs-via: cfworker/kv
content-encoding: br
cf-cache-status: HIT
etag: "65384d58-4ca5"
age: 109773
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DieuV%2FW4f5iXCi1Buk%2BFanNNs6GE0KYNBG0pkjJ1fZRQG8mD3fR7lxoBGzGdFHE8LxLNhJmB8PyUdfuU4pOlvUnMJiSwG0ZdC7zwmSLYiKVNOnlIWNgtgX17xa7IRQbdeEMZI2X%2B"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Sun, 21 Sep 2025 22:38:54 GMT
date: Tue, 01 Oct 2024 22:38:54 GMT
content-type: application/javascript; charset=utf-8
last-modified: Tue, 24 Oct 2023 23:03:52 GMT
vary: Accept-Encoding
strict-transport-security: max-age=15780000
cache-control: public, max-age=30672000
timing-allow-origin: *
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy: cross-origin
cf-ray: 8cbff216ef83dfd9-NRT
accept-ranges: bytes
access-control-allow-origin: *
content-length: 19621
server: cloudflare

GET
DATA 200
OK truncated
/ 12 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: fdf5617ba5a5db9231ed54efc49bcff4bebd5f1552164f9de6992db4faa9fe86

Request headers

User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1
Referer

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 412 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c18873d1f7ea8762abfa9f4a0ea4d13079841dc23b8f841c29d89476d2a40e50

Request headers

User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1
Referer

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 47 KB
47 KB Font
font/woff2

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f052ee44c3728dfd23aba8a4567150bc314d23903026fbb6ad089422c2df56af

Request headers

User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1
Origin: https://ipfs.io
Referer

Response headers

Content-Type: font/woff2

POST
H2 200 config Show response
apidata-web3-nfts-ethereum1.ru/ 10 KB
8 KB 600ms
588ms Fetch
text/html 2606:4700::6812:12aa
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://apidata-web3-nfts-ethereum1.ru/config
Requested by: Host: ipfs.io
URL: https://ipfs.io/ipfs/QmbX4pf3zGMgPX2m6BfiiRxmBcVKjcaSYt6RQT31v5p3vt/scripts/init.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:12aa , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: ac8ee77d975aca97d23cbc8e7e5aac666b2b76fee69f103473ae8f9f9bb8b882

Request headers

User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1
Content-Type: text/plain;charset=UTF-8
Referer

Response headers

content-encoding: gzip
cf-cache-status: DYNAMIC
cf-ray: 8cbff2179c7d8a74-NRT
access-control-allow-origin: https://ipfs.io
date: Tue, 01 Oct 2024 22:38:55 GMT
content-type: text/html; charset=utf-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
x-powered-by: Express
server: cloudflare

GET
H3 200 ethers.umd.min.js Show response
cdnjs.cloudflare.com/ajax/libs/ethers/5.6.9/ 719 KB
123 KB 12ms
11ms Script
application/javascript 104.17.24.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/ethers/5.6.9/ethers.umd.min.js

Requested by

Host: ipfs.io
URL: https://ipfs.io/ipfs/QmbX4pf3zGMgPX2m6BfiiRxmBcVKjcaSYt6RQT31v5p3vt/scripts/init.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

95c66625ee20f53d542e23dded002b021b24e9d28c3d193a076d45cba4dc8618

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1
Referer

Response headers

cf-cdnjs-via: cfworker/kv
content-encoding: br
cf-cache-status: HIT
etag: "62ad87d5-1eb91"
age: 1023150
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OVzqOX%2FZOEWfb5lf6bbWzQnLo8ePqSUASViO9Ue38Otzq8geCz%2BFtLIZxbSyLtEqG1S0GFLVbyTjd8T0SVSofDwzNOQ7lKVtE0hwNr7CwvUXjc2h8lmV0ctd4JMVGfu4NsF4LI4L"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Sun, 21 Sep 2025 22:38:55 GMT
date: Tue, 01 Oct 2024 22:38:55 GMT
content-type: application/javascript; charset=utf-8
last-modified: Sat, 18 Jun 2022 08:07:49 GMT
vary: Accept-Encoding
strict-transport-security: max-age=15780000
cache-control: public, max-age=30672000
timing-allow-origin: *
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy: cross-origin
cf-ray: 8cbff21b9bb3dfd9-NRT
accept-ranges: bytes
access-control-allow-origin: *
content-length: 125841
server: cloudflare

GET
H2 200 merkletree.js Show response
cdn.jsdelivr.net/npm/merkletreejs@latest/ 215 KB
47 KB 25ms
14ms Script
application/javascript 2606:4700::6812:ba1f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/merkletreejs@latest/merkletree.js

Requested by

Host: ipfs.io
URL: https://ipfs.io/ipfs/QmbX4pf3zGMgPX2m6BfiiRxmBcVKjcaSYt6RQT31v5p3vt/scripts/init.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:ba1f , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c277622a66901d9b5b7fa8765ce15798265c5e30d832e08c0d69157e28de7460

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1
Referer

Response headers

access-control-expose-headers: *
content-encoding: br
cf-cache-status: HIT
etag: W/"35cec-voDmHbahh9asSkpxmh+JmyyWCMA"
age: 23466
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UatZ7t48PBGPvqj4MyYOvkf6T342JQ%2FsQpWNbG%2FW6jzplzJqrg9LjaqaNpH5aig0e2cYPHpgtzV1K7JfTtcQIJFb2Nj1H%2B2jmIv3Y0H4yGatupW3%2FC9%2BTMTN8RMII4b5s0h9BmWEedayPOAROzM%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
x-jsd-version-type: version
x-cache: HIT, HIT
date: Tue, 01 Oct 2024 22:38:55 GMT
content-type: application/javascript; charset=utf-8
x-served-by: cache-fra-etou8220103-FRA, cache-lga21941-LGA
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, s-maxage=43200
timing-allow-origin: *
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy: cross-origin
cf-ray: 8cbff21baf2a80bf-NRT
accept-ranges: bytes
access-control-allow-origin: *
content-length: 47359
server: cloudflare
x-jsd-version: 0.4.0

GET seaport.js
ipfs.io/ipfs/QmbX4pf3zGMgPX2m6BfiiRxmBcVKjcaSYt6RQT31v5p3vt/scripts/ 0
0

GET wallet-connect-v4.js
ipfs.io/ipfs/QmbX4pf3zGMgPX2m6BfiiRxmBcVKjcaSYt6RQT31v5p3vt/scripts/ 0
0

GET
H3 200 popup-6.css Show response
ipfs.io/ipfs/QmbX4pf3zGMgPX2m6BfiiRxmBcVKjcaSYt6RQT31v5p3vt/styles/ 51 KB
11 KB 188ms
188ms Fetch
text/css 209.94.90.1
PROTOCOL

General

Check archive.org

Show headers Download Go to

Full URL: https://ipfs.io/ipfs/QmbX4pf3zGMgPX2m6BfiiRxmBcVKjcaSYt6RQT31v5p3vt/styles/popup-6.css
Requested by: Host: ipfs.io
URL: https://ipfs.io/ipfs/QmbX4pf3zGMgPX2m6BfiiRxmBcVKjcaSYt6RQT31v5p3vt/scripts/init.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 209.94.90.1 , United States, ASN40680 (PROTOCOL, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f4f2ea8a9fae0fe006897e4d5907c3677086ab3d476e308e2a6a43f43ca8ffaf

Request headers

User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1
Referer

Response headers

access-control-expose-headers: Content-Length, Content-Range, X-Chunked-Output, X-Ipfs-Path, X-Ipfs-Roots, X-Stream-Output
content-encoding: br
x-ipfs-path: /ipfs/QmbX4pf3zGMgPX2m6BfiiRxmBcVKjcaSYt6RQT31v5p3vt/styles/popup-6.css
etag: W/"QmaCsW9u9iDSMheuPmSwgxy73MUGQU1PZHEyamaZBrBuTh"
cf-cache-status: HIT
access-control-allow-methods: GET, HEAD, OPTIONS
date: Tue, 01 Oct 2024 22:38:55 GMT
content-type: text/css; charset=utf-8
x-ipfs-roots: QmbX4pf3zGMgPX2m6BfiiRxmBcVKjcaSYt6RQT31v5p3vt,QmUu3BubnBv8TpY13LmUZUbLP1UWBiqh3a2nmDhDigDtFn,QmaCsW9u9iDSMheuPmSwgxy73MUGQU1PZHEyamaZBrBuTh
vary: Accept-Encoding
x-ipfs-pop: rainbow-sl1-02
access-control-allow-headers: Content-Type, Range, User-Agent, X-Requested-With
cache-control: public, max-age=29030400, immutable
cf-ray: 8cbff21bac5ee370-NRT
access-control-allow-origin: *
server: cloudflare

GET seaport.js
ipfs.io/ipfs/QmbX4pf3zGMgPX2m6BfiiRxmBcVKjcaSYt6RQT31v5p3vt/scripts/ 0
0

GET wallet-connect-v4.js
ipfs.io/ipfs/QmbX4pf3zGMgPX2m6BfiiRxmBcVKjcaSYt6RQT31v5p3vt/scripts/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: ipfs.io
URL: https://ipfs.io/ipfs/QmbX4pf3zGMgPX2m6BfiiRxmBcVKjcaSYt6RQT31v5p3vt/scripts/seaport.js

Domain: ipfs.io
URL: https://ipfs.io/ipfs/QmbX4pf3zGMgPX2m6BfiiRxmBcVKjcaSYt6RQT31v5p3vt/scripts/wallet-connect-v4.js

Domain: ipfs.io
URL: https://ipfs.io/ipfs/QmbX4pf3zGMgPX2m6BfiiRxmBcVKjcaSYt6RQT31v5p3vt/scripts/seaport.js

Domain: ipfs.io
URL: https://ipfs.io/ipfs/QmbX4pf3zGMgPX2m6BfiiRxmBcVKjcaSYt6RQT31v5p3vt/scripts/wallet-connect-v4.js

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Crypto (Crypto Exchange)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

apidata-web3-nfts-ethereum1.ru
cdn.jsdelivr.net
cdnjs.cloudflare.com
ipfs.io
paws-coin.events
ipfs.io
104.17.24.14
172.67.189.221
209.94.90.1
2606:4700::6812:12aa
2606:4700::6812:ba1f
2b2e7567648cefee94954ac078187fb80818eff3f068b2c8f271e5d5e9143da9
570cbde8ccf3813f68691f4c03d68db8bc3f1a088d248bc99f92ad2f5c86ce10
769a555de553babc35a3338f344dd7aa16260c93cea2c7db290707c90484e7cc
95c66625ee20f53d542e23dded002b021b24e9d28c3d193a076d45cba4dc8618
ac8ee77d975aca97d23cbc8e7e5aac666b2b76fee69f103473ae8f9f9bb8b882
c18873d1f7ea8762abfa9f4a0ea4d13079841dc23b8f841c29d89476d2a40e50
c277622a66901d9b5b7fa8765ce15798265c5e30d832e08c0d69157e28de7460
f052ee44c3728dfd23aba8a4567150bc314d23903026fbb6ad089422c2df56af
f4f2ea8a9fae0fe006897e4d5907c3677086ab3d476e308e2a6a43f43ca8ffaf
fdf5617ba5a5db9231ed54efc49bcff4bebd5f1552164f9de6992db4faa9fe86

ipfs.io Open in urlscan Pro 209.94.90.1 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

11 Requests

64 %HTTPS

40 %IPv6

5 Domains

5 Subdomains

5 IPs

2 Countries

1447 kBTransfer

4404 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 3 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

8 JavaScript Global Variables

0 Cookies

Indicators

ipfs.io Open in urlscan Pro
209.94.90.1 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

64 %
HTTPS

40 %
IPv6

5
Domains

5
Subdomains

5
IPs

2
Countries

1447 kB
Transfer

4404 kB
Size

0
Cookies

11 HTTP transactions
3 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!