gateway.pinata.cloud Open in urlscan Pro
2606:4700:4400::ac40:9ae1 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://gateway.pinata.cloud/ipfs/bafybeia3oxfyhceg7udar663tc65vdemhjutzhhcb3h7cymyncj2f7zive
Submission: On May 21 via api (May 21st 2023, 4:03:49 am UTC) from JP — Scanned from JP

Summary HTTP 26 Redirects Links 13 Behaviour Indicators

Summary

This website contacted 4 IPs in 1 countries across 8 domains to perform 26 HTTP transactions. The main IP is 2606:4700:4400::ac40:9ae1, located in United States and belongs to CLOUDFLARENET, US. The main domain is gateway.pinata.cloud. The Cisco Umbrella rank of the primary domain is 99336.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on April 10th 2023. Valid for: a year.

This is the only time gateway.pinata.cloud was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: WeTransfer (Online)

Domain & IP information

	IP Address	AS Autonomous System
6	2606:4700:440... 2606:4700:4400::ac40:9ae1	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2606:4700::68... 2606:4700::6812:691	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	63.250.43.128 63.250.43.128	22612 (NAMECHEAP...) (NAMECHEAP-NET)
26	4

6 2606:4700:4400::ac40:9ae1 (United States)

ASN13335 (CLOUDFLARENET, US)

gateway.pinata.cloud	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700::6812:691 (United States)

ASN13335 (CLOUDFLARENET, US)

storageapi.fleek.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 63.250.43.128 (United States)

ASN22612 (NAMECHEAP-NET, US)
PTR: ingress-earth.easywp.com

mk2-b4c8d3.ingress-earth.ewp.live	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	pinata.cloud gateway.pinata.cloud — Cisco Umbrella Rank: 99336	9 KB
3	fleek.co storageapi.fleek.co — Cisco Umbrella Rank: 783581	152 KB
1	ewp.live mk2-b4c8d3.ingress-earth.ewp.live Failed
0	googleapis.com Failed ajax.googleapis.com Failed
0	cloudflare.com Failed cdnjs.cloudflare.com Failed
0	jquery.com Failed code.jquery.com Failed
0	wetransfer.net Failed prod-cdn.wetransfer.net Failed
0	bootstrapcdn.com Failed stackpath.bootstrapcdn.com Failed maxcdn.bootstrapcdn.com Failed
26	8

	Domain	Requested by
6	gateway.pinata.cloud	gateway.pinata.cloud
3	storageapi.fleek.co	gateway.pinata.cloud
1	mk2-b4c8d3.ingress-earth.ewp.live	storageapi.fleek.co
0	ajax.googleapis.com Failed	gateway.pinata.cloud
0	maxcdn.bootstrapcdn.com Failed	gateway.pinata.cloud
0	cdnjs.cloudflare.com Failed	gateway.pinata.cloud
0	code.jquery.com Failed	gateway.pinata.cloud
0	prod-cdn.wetransfer.net Failed	gateway.pinata.cloud
0	stackpath.bootstrapcdn.com Failed	gateway.pinata.cloud
26	9

This site contains links to these domains. Also see Links.

Domain
wetransfer.com
wetransfer.pr.co
wetransfer.homerun.co
twitter.com
www.facebook.com
www.instagram.com
www.youtube.com
about.wetransfer.com

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-04-10` - `2024-04-09`	a year	crt.sh
fleek.co Cloudflare Inc ECC CA-3	`2023-02-28` - `2024-02-28`	a year	crt.sh
*.ingress-earth.ewp.live Sectigo RSA Domain Validation Secure Server CA	`2023-05-09` - `2024-05-25`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://gateway.pinata.cloud/ipfs/bafybeia3oxfyhceg7udar663tc65vdemhjutzhhcb3h7cymyncj2f7zive
Frame ID: DB8A0C08781A2E3FC4C68446A57C532C
Requests: 27 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

WeTransfer

Page Statistics

26
Requests

38 %
HTTPS

67 %
IPv6

8
Domains

9
Subdomains

4
IPs

1
Countries

161 kB
Transfer

713 kB
Size

0
Cookies

13 Outgoing links

These are links going to different origins than the main page.

URL: https://wetransfer.com/legal/terms
Title: Terms

Search URL Search Domain Scan URL

URL: https://wetransfer.com/legal/manage-cookies
Title: Your Privacy Choices

Search URL Search Domain Scan URL

URL: https://wetransfer.pr.co/
Title: Press

Search URL Search Domain Scan URL

URL: https://wetransfer.homerun.co/
Title: Jobs

Search URL Search Domain Scan URL

URL: https://twitter.com/WeTransfer

Search URL Search Domain Scan URL

URL: https://www.facebook.com/wetransfer

Search URL Search Domain Scan URL

URL: https://www.instagram.com/WeTransfer/

Search URL Search Domain Scan URL

URL: https://www.youtube.com/WeTransfer

Search URL Search Domain Scan URL

URL: https://wetransfer.com/help
Title: Help

Search URL Search Domain Scan URL

URL: https://about.wetransfer.com/products
Title: Products

Search URL Search Domain Scan URL

URL: https://about.wetransfer.com/
Title: Company

Search URL Search Domain Scan URL

URL: https://wetransfer.com/pro?trk=WT202005_signup
Title: Sign up

Search URL Search Domain Scan URL

URL: https://wetransfer.com/log-in
Title: Log in

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

26 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request bafybeia3oxfyhceg7udar663tc65vdemhjutzhhcb3h7cymyncj2f7zive Show response
gateway.pinata.cloud/ipfs/ 29 KB
9 KB 219ms
212ms Document
text/html 2606:4700:4400::ac40:9ae1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://gateway.pinata.cloud/ipfs/bafybeia3oxfyhceg7udar663tc65vdemhjutzhhcb3h7cymyncj2f7zive

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:9ae1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

29d1865a7da77223f4d1aa20388fd829b820ff2857f814d66c34ee853631a967

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; img-src * data: blob: 'unsafe-inline'; style-src * 'unsafe-inline';

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language: jp-JP,jp;q=0.9

Response headers

access-control-allow-headers: Content-Type Range User-Agent X-Requested-With
access-control-allow-methods: GET HEAD
access-control-allow-origin: *
access-control-expose-headers: Content-Length Content-Range X-Chunked-Output X-Ipfs-Path X-Ipfs-Roots X-Stream-Output
age: 7150
cache-control: public, max-age=29030400
cf-cache-status: HIT
cf-ray: 7ca9ee6ceb9c7825-NRT
content-encoding: gzip
content-security-policy: default-src 'self'; img-src * data: blob: 'unsafe-inline'; style-src * 'unsafe-inline';
content-type: text/html
date: Sun, 21 May 2023 04:03:44 GMT
expires: Sun, 21 Apr 2024 04:03:44 GMT
last-modified: Sun, 21 May 2023 01:59:26 GMT
server: cloudflare
vary: Accept-Encoding
x-ipfs-path: /ipfs/bafybeia3oxfyhceg7udar663tc65vdemhjutzhhcb3h7cymyncj2f7zive
x-ipfs-roots: bafybeia3oxfyhceg7udar663tc65vdemhjutzhhcb3h7cymyncj2f7zive

GET
H2 200 style.css
storageapi.fleek.co/f32f51ce-f1e7-4668-9cba-12beeb431209-bucket/ 538 KB
131 KB 22ms
14ms Stylesheet
text/css 2606:4700::6812:691
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://storageapi.fleek.co/f32f51ce-f1e7-4668-9cba-12beeb431209-bucket/style.css

Requested by

Host: gateway.pinata.cloud
URL: https://gateway.pinata.cloud/ipfs/bafybeia3oxfyhceg7udar663tc65vdemhjutzhhcb3h7cymyncj2f7zive

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:691 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0167aeb8b557995a880328158eb451adbfd06c68c01971d2cb17b437de6bdd31

Security Headers

Name	Value
Content-Security-Policy	block-all-mixed-content
X-Xss-Protection	1; mode=block

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://gateway.pinata.cloud/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Sun, 21 May 2023 04:03:45 GMT
content-security-policy: block-all-mixed-content
content-encoding: gzip
cf-cache-status: HIT
last-modified: Sun, 04 Dec 2022 16:38:08 GMT
server: cloudflare
x-amz-request-id: 1760E07603D894E6
age: 11
etag: W/"bafybeid5rmdoscnnmwcen52z7u6l4x2bin3hnh75flm4qlkno6wse32yge"
vary: Origin, Accept-Encoding
content-type: text/css
cache-control: public, max-age=14400
cf-ray: 7ca9ee6e4cb7afed-NRT
x-xss-protection: 1; mode=block
expires: Sun, 21 May 2023 08:03:45 GMT

GET
H2 200 download.png
storageapi.fleek.co/f32f51ce-f1e7-4668-9cba-12beeb431209-bucket/ 13 KB
13 KB 18ms
11ms Image
image/png 2606:4700::6812:691
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://storageapi.fleek.co/f32f51ce-f1e7-4668-9cba-12beeb431209-bucket/download.png

Requested by

Host: gateway.pinata.cloud
URL: https://gateway.pinata.cloud/ipfs/bafybeia3oxfyhceg7udar663tc65vdemhjutzhhcb3h7cymyncj2f7zive

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:691 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1d6f06c578fbe919beec761b4b1f7d75445753b0db44ead4039bd71e4c3c098e

Security Headers

Name	Value
Content-Security-Policy	block-all-mixed-content
X-Xss-Protection	1; mode=block

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://gateway.pinata.cloud/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Sun, 21 May 2023 04:03:45 GMT
content-security-policy: block-all-mixed-content
cf-cache-status: HIT
x-amz-request-id: 175F76C5743D5271
age: 7095
content-length: 13096
x-xss-protection: 1; mode=block
last-modified: Sun, 04 Dec 2022 17:01:21 GMT
server: cloudflare
etag: "bafybeifyv3ndg2kvpanmyerd5o6vix4abldyqbshsv6fz5nmpv4pu4ydre"
vary: Origin, Accept-Encoding
content-type: image/png
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 7ca9ee6e4cb9afed-NRT
expires: Sun, 21 May 2023 08:03:45 GMT

GET
H2 200 hun.png
storageapi.fleek.co/f32f51ce-f1e7-4668-9cba-12beeb431209-bucket/ 8 KB
9 KB 13ms
10ms Image
image/png 2606:4700::6812:691
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://storageapi.fleek.co/f32f51ce-f1e7-4668-9cba-12beeb431209-bucket/hun.png

Requested by

Host: gateway.pinata.cloud
URL: https://gateway.pinata.cloud/ipfs/bafybeia3oxfyhceg7udar663tc65vdemhjutzhhcb3h7cymyncj2f7zive

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:691 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8593ddf29f1159a2aeda0a0e4de911aa1715b3b181c0f21e3ecd9d71904153d1

Security Headers

Name	Value
Content-Security-Policy	block-all-mixed-content
X-Xss-Protection	1; mode=block

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://gateway.pinata.cloud/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Sun, 21 May 2023 04:03:45 GMT
content-security-policy: block-all-mixed-content
cf-cache-status: HIT
x-amz-request-id: 175F76C575F2F77C
age: 11
content-length: 8618
x-xss-protection: 1; mode=block
last-modified: Sun, 04 Dec 2022 17:02:58 GMT
server: cloudflare
etag: "bafybeicrnvebplp755oy4x4ularviuevbdu7qop6t67ihpufxjt27ssla4"
vary: Origin, Accept-Encoding
content-type: image/png
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 7ca9ee6e4cbaafed-NRT
expires: Sun, 21 May 2023 08:03:45 GMT

GET
H2 400 gtm.js
gateway.pinata.cloud/ipfs/css/ 0
0 477ms
476ms Script
text/plain 2606:4700:4400::ac40:9ae1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://gateway.pinata.cloud/ipfs/css/gtm.js

Requested by

Host: gateway.pinata.cloud
URL: https://gateway.pinata.cloud/ipfs/bafybeia3oxfyhceg7udar663tc65vdemhjutzhhcb3h7cymyncj2f7zive

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:9ae1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://gateway.pinata.cloud/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Sun, 21 May 2023 04:03:45 GMT
x-content-type-options: nosniff
cf-cache-status: EXPIRED
server: cloudflare
vary: Accept-Encoding
content-type: text/plain; charset=utf-8
cf-ray: 7ca9ee6e4ccf7825-NRT
content-length: 116

GET
H2 400 sp.js
gateway.pinata.cloud/ipfs/css/ 0
0 475ms
474ms Script
text/plain 2606:4700:4400::ac40:9ae1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://gateway.pinata.cloud/ipfs/css/sp.js

Requested by

Host: gateway.pinata.cloud
URL: https://gateway.pinata.cloud/ipfs/bafybeia3oxfyhceg7udar663tc65vdemhjutzhhcb3h7cymyncj2f7zive

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:9ae1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://gateway.pinata.cloud/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Sun, 21 May 2023 04:03:45 GMT
x-content-type-options: nosniff
cf-cache-status: EXPIRED
server: cloudflare
vary: Accept-Encoding
content-type: text/plain; charset=utf-8
cf-ray: 7ca9ee6e4cd17825-NRT
content-length: 114

GET
H2 400 en-0d65947306b8b68f172b.js
gateway.pinata.cloud/ipfs/css/ 0
0 457ms
456ms Script
text/plain 2606:4700:4400::ac40:9ae1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://gateway.pinata.cloud/ipfs/css/en-0d65947306b8b68f172b.js

Requested by

Host: gateway.pinata.cloud
URL: https://gateway.pinata.cloud/ipfs/bafybeia3oxfyhceg7udar663tc65vdemhjutzhhcb3h7cymyncj2f7zive

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:9ae1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://gateway.pinata.cloud/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Sun, 21 May 2023 04:03:45 GMT
x-content-type-options: nosniff
cf-cache-status: EXPIRED
server: cloudflare
vary: Accept-Encoding
content-type: text/plain; charset=utf-8
cf-ray: 7ca9ee6e4ccc7825-NRT
content-length: 156

GET
H2 400 en-de295c39cb769807d9fa.js
gateway.pinata.cloud/ipfs/css/ 0
0 474ms
473ms Script
text/plain 2606:4700:4400::ac40:9ae1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://gateway.pinata.cloud/ipfs/css/en-de295c39cb769807d9fa.js

Requested by

Host: gateway.pinata.cloud
URL: https://gateway.pinata.cloud/ipfs/bafybeia3oxfyhceg7udar663tc65vdemhjutzhhcb3h7cymyncj2f7zive

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:9ae1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://gateway.pinata.cloud/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Sun, 21 May 2023 04:03:45 GMT
x-content-type-options: nosniff
cf-cache-status: EXPIRED
server: cloudflare
vary: Accept-Encoding
content-type: text/plain; charset=utf-8
cf-ray: 7ca9ee6e4ccd7825-NRT
content-length: 156

GET
H2 400 0.txt
gateway.pinata.cloud/ipfs/css/ 114 B
114 B 459ms
458ms Image
text/plain 2606:4700:4400::ac40:9ae1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://gateway.pinata.cloud/ipfs/css/0.txt

Requested by

Host: gateway.pinata.cloud
URL: https://gateway.pinata.cloud/ipfs/bafybeia3oxfyhceg7udar663tc65vdemhjutzhhcb3h7cymyncj2f7zive

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:9ae1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

acdc95b5035076a79a7fabe4204e58a0bb1bdb5a42c8a79ead89ba05094f5cae

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://gateway.pinata.cloud/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Sun, 21 May 2023 04:03:45 GMT
x-content-type-options: nosniff
cf-cache-status: EXPIRED
server: cloudflare
vary: Accept-Encoding
content-type: text/plain; charset=utf-8
cf-ray: 7ca9ee6e4cd37825-NRT
content-length: 114

GET bootstrap.min.js
stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/ 0
0

GET ActiefGrotesque_W_Regular-1f437876.woff
prod-cdn.wetransfer.net/packs/media/actiefgrotesque/ 0
0

GET ActiefGrotesque_W_Medium-293e86f0.woff
prod-cdn.wetransfer.net/packs/media/actiefgrotesque/ 0
0

GET GT-Super-WT-Super-1b214df1.woff
prod-cdn.wetransfer.net/packs/media/gt-super-wt/ 0
0

GET GT-Super-WT-Super-1b214df1.woff
mk2-b4c8d3.ingress-earth.ewp.live/packs/media/gt-super-wt/ 0
0

GET GT-Super-WT-Regular-4aad923e.woff
mk2-b4c8d3.ingress-earth.ewp.live/packs/media/gt-super-wt/ 0
0

GET ActiefGrotesque_W_Regular-1f437876.woff
mk2-b4c8d3.ingress-earth.ewp.live/packs/media/actiefgrotesque/ 0
0

GET ActiefGrotesque_W_Medium-293e86f0.woff
mk2-b4c8d3.ingress-earth.ewp.live/packs/media/actiefgrotesque/ 0
0

GET ActiefGrotesque_W_Bd-1bdd99f9.woff
mk2-b4c8d3.ingress-earth.ewp.live/packs/media/actiefgrotesque/ 0
0

GET FreightSans-Pro-Medium-1243d73c.woff
mk2-b4c8d3.ingress-earth.ewp.live/packs/media/freightsans/ 0
0

GET FreightSans-Pro-Semibold-b548f89b.woff
mk2-b4c8d3.ingress-earth.ewp.live/packs/media/freightsans/ 0
0

GET
DATA 200
OK truncated
/ 126 KB
0 Image
image/jpeg

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 90a3ba7915742ec7bf75a01c3bca9df3969a57dd7e5f6a675bbb98e378e877fc

Request headers

accept-language: jp-JP,jp;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Content-Type: image/jpeg

GET
H2 404 globe-dd3d31e7.svg
mk2-b4c8d3.ingress-earth.ewp.live/packs/media/images/ 0
0 668ms
261ms Image
text/html 63.250.43.128
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mk2-b4c8d3.ingress-earth.ewp.live/packs/media/images/globe-dd3d31e7.svg
Requested by: Host: storageapi.fleek.co
URL: https://storageapi.fleek.co/f32f51ce-f1e7-4668-9cba-12beeb431209-bucket/style.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 63.250.43.128 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: ingress-earth.easywp.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://storageapi.fleek.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

GET jquery-3.2.1.slim.min.js
code.jquery.com/ 0
0

GET popper.min.js
cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/ 0
0

GET bootstrap.min.js
maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/ 0
0

GET jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/2.2.4/ 0
0

GET bootstrap.min.js
stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: stackpath.bootstrapcdn.com
URL: https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js

Domain: prod-cdn.wetransfer.net
URL: https://prod-cdn.wetransfer.net/packs/media/actiefgrotesque/ActiefGrotesque_W_Regular-1f437876.woff

Domain: prod-cdn.wetransfer.net
URL: https://prod-cdn.wetransfer.net/packs/media/actiefgrotesque/ActiefGrotesque_W_Medium-293e86f0.woff

Domain: prod-cdn.wetransfer.net
URL: https://prod-cdn.wetransfer.net/packs/media/gt-super-wt/GT-Super-WT-Super-1b214df1.woff

Domain: mk2-b4c8d3.ingress-earth.ewp.live
URL: https://mk2-b4c8d3.ingress-earth.ewp.live/packs/media/gt-super-wt/GT-Super-WT-Super-1b214df1.woff

Domain: mk2-b4c8d3.ingress-earth.ewp.live
URL: https://mk2-b4c8d3.ingress-earth.ewp.live/packs/media/gt-super-wt/GT-Super-WT-Regular-4aad923e.woff

Domain: mk2-b4c8d3.ingress-earth.ewp.live
URL: https://mk2-b4c8d3.ingress-earth.ewp.live/packs/media/actiefgrotesque/ActiefGrotesque_W_Regular-1f437876.woff

Domain: mk2-b4c8d3.ingress-earth.ewp.live
URL: https://mk2-b4c8d3.ingress-earth.ewp.live/packs/media/actiefgrotesque/ActiefGrotesque_W_Medium-293e86f0.woff

Domain: mk2-b4c8d3.ingress-earth.ewp.live
URL: https://mk2-b4c8d3.ingress-earth.ewp.live/packs/media/actiefgrotesque/ActiefGrotesque_W_Bd-1bdd99f9.woff

Domain: mk2-b4c8d3.ingress-earth.ewp.live
URL: https://mk2-b4c8d3.ingress-earth.ewp.live/packs/media/freightsans/FreightSans-Pro-Medium-1243d73c.woff

Domain: mk2-b4c8d3.ingress-earth.ewp.live
URL: https://mk2-b4c8d3.ingress-earth.ewp.live/packs/media/freightsans/FreightSans-Pro-Semibold-b548f89b.woff

Domain: code.jquery.com
URL: https://code.jquery.com/jquery-3.2.1.slim.min.js

Domain: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js

Domain: maxcdn.bootstrapcdn.com
URL: https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js

Domain: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js

Domain: stackpath.bootstrapcdn.com
URL: https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: WeTransfer (Online)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

28 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	URL: https://gateway.pinata.cloud/ipfs/bafybeia3oxfyhceg7udar663tc65vdemhjutzhhcb3h7cymyncj2f7zive Message: Refused to load the script 'https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js' because it violates the following Content Security Policy directive: "default-src 'self'". Note that 'script-src-elem' was not explicitly set, so 'default-src' is used as a fallback.
security	error	URL: https://gateway.pinata.cloud/ipfs/bafybeia3oxfyhceg7udar663tc65vdemhjutzhhcb3h7cymyncj2f7zive(Line 16) Message: Refused to execute inline script because it violates the following Content Security Policy directive: "default-src 'self'". Either the 'unsafe-inline' keyword, a hash ('sha256-pxw2Lx/evWmZRZoGQfNWBuzX4MJCiog/ydOyAXF7L70='), or a nonce ('nonce-...') is required to enable inline execution. Note also that 'script-src' was not explicitly set, so 'default-src' is used as a fallback.
security	error	URL: https://gateway.pinata.cloud/ipfs/bafybeia3oxfyhceg7udar663tc65vdemhjutzhhcb3h7cymyncj2f7zive(Line 26) Message: Refused to load the font 'https://prod-cdn.wetransfer.net/packs/media/actiefgrotesque/ActiefGrotesque_W_Regular-1f437876.woff' because it violates the following Content Security Policy directive: "default-src 'self'". Note that 'font-src' was not explicitly set, so 'default-src' is used as a fallback.
security	error	URL: https://gateway.pinata.cloud/ipfs/bafybeia3oxfyhceg7udar663tc65vdemhjutzhhcb3h7cymyncj2f7zive(Line 27) Message: Refused to load the font 'https://prod-cdn.wetransfer.net/packs/media/actiefgrotesque/ActiefGrotesque_W_Medium-293e86f0.woff' because it violates the following Content Security Policy directive: "default-src 'self'". Note that 'font-src' was not explicitly set, so 'default-src' is used as a fallback.
security	error	URL: https://gateway.pinata.cloud/ipfs/bafybeia3oxfyhceg7udar663tc65vdemhjutzhhcb3h7cymyncj2f7zive(Line 28) Message: Refused to load the font 'https://prod-cdn.wetransfer.net/packs/media/gt-super-wt/GT-Super-WT-Super-1b214df1.woff' because it violates the following Content Security Policy directive: "default-src 'self'". Note that 'font-src' was not explicitly set, so 'default-src' is used as a fallback.
security	error	URL: https://gateway.pinata.cloud/ipfs/bafybeia3oxfyhceg7udar663tc65vdemhjutzhhcb3h7cymyncj2f7zive Message: Refused to load the font 'https://mk2-b4c8d3.ingress-earth.ewp.live/packs/media/gt-super-wt/GT-Super-WT-Super-1b214df1.woff' because it violates the following Content Security Policy directive: "default-src 'self'". Note that 'font-src' was not explicitly set, so 'default-src' is used as a fallback.
security	error	URL: https://gateway.pinata.cloud/ipfs/bafybeia3oxfyhceg7udar663tc65vdemhjutzhhcb3h7cymyncj2f7zive Message: Refused to load the font 'https://mk2-b4c8d3.ingress-earth.ewp.live/packs/media/gt-super-wt/GT-Super-WT-Regular-4aad923e.woff' because it violates the following Content Security Policy directive: "default-src 'self'". Note that 'font-src' was not explicitly set, so 'default-src' is used as a fallback.
security	error	URL: https://gateway.pinata.cloud/ipfs/bafybeia3oxfyhceg7udar663tc65vdemhjutzhhcb3h7cymyncj2f7zive Message: Refused to load the font 'https://mk2-b4c8d3.ingress-earth.ewp.live/packs/media/actiefgrotesque/ActiefGrotesque_W_Regular-1f437876.woff' because it violates the following Content Security Policy directive: "default-src 'self'". Note that 'font-src' was not explicitly set, so 'default-src' is used as a fallback.
security	error	URL: https://gateway.pinata.cloud/ipfs/bafybeia3oxfyhceg7udar663tc65vdemhjutzhhcb3h7cymyncj2f7zive Message: Refused to load the font 'https://mk2-b4c8d3.ingress-earth.ewp.live/packs/media/actiefgrotesque/ActiefGrotesque_W_Medium-293e86f0.woff' because it violates the following Content Security Policy directive: "default-src 'self'". Note that 'font-src' was not explicitly set, so 'default-src' is used as a fallback.
security	error	URL: https://gateway.pinata.cloud/ipfs/bafybeia3oxfyhceg7udar663tc65vdemhjutzhhcb3h7cymyncj2f7zive Message: Refused to load the font 'https://mk2-b4c8d3.ingress-earth.ewp.live/packs/media/actiefgrotesque/ActiefGrotesque_W_Bd-1bdd99f9.woff' because it violates the following Content Security Policy directive: "default-src 'self'". Note that 'font-src' was not explicitly set, so 'default-src' is used as a fallback.
security	error	URL: https://gateway.pinata.cloud/ipfs/bafybeia3oxfyhceg7udar663tc65vdemhjutzhhcb3h7cymyncj2f7zive Message: Refused to load the font 'https://mk2-b4c8d3.ingress-earth.ewp.live/packs/media/freightsans/FreightSans-Pro-Medium-1243d73c.woff' because it violates the following Content Security Policy directive: "default-src 'self'". Note that 'font-src' was not explicitly set, so 'default-src' is used as a fallback.
security	error	URL: https://gateway.pinata.cloud/ipfs/bafybeia3oxfyhceg7udar663tc65vdemhjutzhhcb3h7cymyncj2f7zive Message: Refused to load the font 'https://mk2-b4c8d3.ingress-earth.ewp.live/packs/media/freightsans/FreightSans-Pro-Semibold-b548f89b.woff' because it violates the following Content Security Policy directive: "default-src 'self'". Note that 'font-src' was not explicitly set, so 'default-src' is used as a fallback.
network	error	URL: https://gateway.pinata.cloud/ipfs/css/en-0d65947306b8b68f172b.js Message: Failed to load resource: the server responded with a status of 400 ()
security	error	URL: https://gateway.pinata.cloud/ipfs/bafybeia3oxfyhceg7udar663tc65vdemhjutzhhcb3h7cymyncj2f7zive Message: Refused to execute script from 'https://gateway.pinata.cloud/ipfs/css/en-0d65947306b8b68f172b.js' because its MIME type ('text/plain') is not executable, and strict MIME type checking is enabled.
network	error	URL: https://gateway.pinata.cloud/ipfs/css/0.txt Message: Failed to load resource: the server responded with a status of 400 ()
network	error	URL: https://gateway.pinata.cloud/ipfs/css/en-de295c39cb769807d9fa.js Message: Failed to load resource: the server responded with a status of 400 ()
security	error	URL: https://gateway.pinata.cloud/ipfs/bafybeia3oxfyhceg7udar663tc65vdemhjutzhhcb3h7cymyncj2f7zive Message: Refused to execute script from 'https://gateway.pinata.cloud/ipfs/css/en-de295c39cb769807d9fa.js' because its MIME type ('text/plain') is not executable, and strict MIME type checking is enabled.
security	error	URL: https://gateway.pinata.cloud/ipfs/bafybeia3oxfyhceg7udar663tc65vdemhjutzhhcb3h7cymyncj2f7zive Message: Refused to load the script 'https://code.jquery.com/jquery-3.2.1.slim.min.js' because it violates the following Content Security Policy directive: "default-src 'self'". Note that 'script-src-elem' was not explicitly set, so 'default-src' is used as a fallback.
security	error	URL: https://gateway.pinata.cloud/ipfs/bafybeia3oxfyhceg7udar663tc65vdemhjutzhhcb3h7cymyncj2f7zive Message: Refused to load the script 'https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js' because it violates the following Content Security Policy directive: "default-src 'self'". Note that 'script-src-elem' was not explicitly set, so 'default-src' is used as a fallback.
security	error	URL: https://gateway.pinata.cloud/ipfs/bafybeia3oxfyhceg7udar663tc65vdemhjutzhhcb3h7cymyncj2f7zive Message: Refused to load the script 'https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js' because it violates the following Content Security Policy directive: "default-src 'self'". Note that 'script-src-elem' was not explicitly set, so 'default-src' is used as a fallback.
security	error	URL: https://gateway.pinata.cloud/ipfs/bafybeia3oxfyhceg7udar663tc65vdemhjutzhhcb3h7cymyncj2f7zive Message: Refused to load the script 'https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js' because it violates the following Content Security Policy directive: "default-src 'self'". Note that 'script-src-elem' was not explicitly set, so 'default-src' is used as a fallback.
security	error	URL: https://gateway.pinata.cloud/ipfs/bafybeia3oxfyhceg7udar663tc65vdemhjutzhhcb3h7cymyncj2f7zive Message: Refused to load the script 'https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js' because it violates the following Content Security Policy directive: "default-src 'self'". Note that 'script-src-elem' was not explicitly set, so 'default-src' is used as a fallback.
security	error	URL: https://gateway.pinata.cloud/ipfs/bafybeia3oxfyhceg7udar663tc65vdemhjutzhhcb3h7cymyncj2f7zive(Line 163) Message: Refused to execute inline script because it violates the following Content Security Policy directive: "default-src 'self'". Either the 'unsafe-inline' keyword, a hash ('sha256-2rMGbQakFB14R8Ns0dA60rX3Xn7HWk2eftUV0vOE/kw='), or a nonce ('nonce-...') is required to enable inline execution. Note also that 'script-src' was not explicitly set, so 'default-src' is used as a fallback.
network	error	URL: https://gateway.pinata.cloud/ipfs/css/sp.js Message: Failed to load resource: the server responded with a status of 400 ()
security	error	URL: https://gateway.pinata.cloud/ipfs/bafybeia3oxfyhceg7udar663tc65vdemhjutzhhcb3h7cymyncj2f7zive(Line 267) Message: Refused to execute script from 'https://gateway.pinata.cloud/ipfs/css/sp.js' because its MIME type ('text/plain') is not executable, and strict MIME type checking is enabled.
network	error	URL: https://gateway.pinata.cloud/ipfs/css/gtm.js Message: Failed to load resource: the server responded with a status of 400 ()
security	error	URL: https://gateway.pinata.cloud/ipfs/bafybeia3oxfyhceg7udar663tc65vdemhjutzhhcb3h7cymyncj2f7zive(Line 267) Message: Refused to execute script from 'https://gateway.pinata.cloud/ipfs/css/gtm.js' because its MIME type ('text/plain') is not executable, and strict MIME type checking is enabled.
network	error	URL: https://mk2-b4c8d3.ingress-earth.ewp.live/packs/media/images/globe-dd3d31e7.svg Message: Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	default-src 'self'; img-src * data: blob: 'unsafe-inline'; style-src * 'unsafe-inline';

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
cdnjs.cloudflare.com
code.jquery.com
gateway.pinata.cloud
maxcdn.bootstrapcdn.com
mk2-b4c8d3.ingress-earth.ewp.live
prod-cdn.wetransfer.net
stackpath.bootstrapcdn.com
storageapi.fleek.co
ajax.googleapis.com
cdnjs.cloudflare.com
code.jquery.com
maxcdn.bootstrapcdn.com
mk2-b4c8d3.ingress-earth.ewp.live
prod-cdn.wetransfer.net
stackpath.bootstrapcdn.com
2606:4700:4400::ac40:9ae1
2606:4700::6812:691
63.250.43.128
0167aeb8b557995a880328158eb451adbfd06c68c01971d2cb17b437de6bdd31
1d6f06c578fbe919beec761b4b1f7d75445753b0db44ead4039bd71e4c3c098e
29d1865a7da77223f4d1aa20388fd829b820ff2857f814d66c34ee853631a967
8593ddf29f1159a2aeda0a0e4de911aa1715b3b181c0f21e3ecd9d71904153d1
90a3ba7915742ec7bf75a01c3bca9df3969a57dd7e5f6a675bbb98e378e877fc
acdc95b5035076a79a7fabe4204e58a0bb1bdb5a42c8a79ead89ba05094f5cae
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

gateway.pinata.cloud Open in urlscan Pro 2606:4700:4400::ac40:9ae1 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

26 Requests

38 %HTTPS

67 %IPv6

8 Domains

9 Subdomains

4 IPs

1 Countries

161 kBTransfer

713 kBSize

0 Cookies

13 Outgoing links

Redirected requests

26 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

0 Cookies

28 Console Messages

Security Headers

Indicators

gateway.pinata.cloud Open in urlscan Pro
2606:4700:4400::ac40:9ae1 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

26
Requests

38 %
HTTPS

67 %
IPv6

8
Domains

9
Subdomains

4
IPs

1
Countries

161 kB
Transfer

713 kB
Size

0
Cookies

26 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!