urlscan.io logo urlscan.io
SecurityTrails logo

bafkreie6cx2qynun2ptghgdfketdzowxei4av6tt3ufjcyk4gx5c3wjbgm.ipfs.dweb.link Open in urlscan Pro
209.94.90.1  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://bafkreie6cx2qynun2ptghgdfketdzowxei4av6tt3ufjcyk4gx5c3wjbgm.ipfs.dweb.link/
Effective URL: https://bafkreie6cx2qynun2ptghgdfketdzowxei4av6tt3ufjcyk4gx5c3wjbgm.ipfs.dweb.link/
Submission: On August 23 via api from AU — Scanned from AU
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 6 IPs in 2 countries across 6 domains to perform 15 HTTP transactions. The main IP is 209.94.90.1, located in United States and belongs to PROTOCOL, US. The main domain is bafkreie6cx2qynun2ptghgdfketdzowxei4av6tt3ufjcyk4gx5c3wjbgm.ipfs.dweb.link.
TLS certificate: Issued by R3 on June 11th 2023. Valid for: 3 months.
This is the only time bafkreie6cx2qynun2ptghgdfketdzowxei4av6tt3ufjcyk4gx5c3wjbgm.ipfs.dweb.link was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

IP Address AS Autonomous System
1 209.94.90.1 40680 (PROTOCOL)
1 104.17.25.14 13335 (CLOUDFLAR...)
1 69.16.175.10 20446 (STACKPATH...)
4 172.217.194.132 15169 (GOOGLE)
1 104.21.93.58 ()
15 6
1    209.94.90.1 (United States)

ASN40680 (PROTOCOL, US)
bafkreie6cx2qynun2ptghgdfketdzowxei4av6tt3ufjcyk4gx5c3wjbgm.ipfs.dweb.link
1    104.17.25.14 (None, )

ASN13335 (CLOUDFLARENET, US)
cdnjs.cloudflare.com
1    69.16.175.10 (United States)

ASN20446 (STACKPATH-CDN, US)
PTR: hwcdn.net
code.jquery.com
4    172.217.194.132 (United States)

ASN15169 (GOOGLE, US)
PTR: si-in-f132.1e100.net
lh3.googleusercontent.com
1    104.21.93.58 (None, )

ASN- ()
uiel35hsjic.jdjdmxnx.online
Apex Domain
Subdomains		 Transfer
4 googleusercontent.com
lh3.googleusercontent.com — Cisco Umbrella Rank: 84
199 KB
1 jdjdmxnx.online
uiel35hsjic.jdjdmxnx.online
73 KB
1 jquery.com
code.jquery.com — Cisco Umbrella Rank: 985
78 KB
1 cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 277
14 KB
1 dweb.link
bafkreie6cx2qynun2ptghgdfketdzowxei4av6tt3ufjcyk4gx5c3wjbgm.ipfs.dweb.link
32 KB
0 msftauth.net Failed
aadcdn.msftauth.net Failed
15 6
Domain Requested by
4 lh3.googleusercontent.com
1 uiel35hsjic.jdjdmxnx.online code.jquery.com
1 code.jquery.com bafkreie6cx2qynun2ptghgdfketdzowxei4av6tt3ufjcyk4gx5c3wjbgm.ipfs.dweb.link
1 cdnjs.cloudflare.com bafkreie6cx2qynun2ptghgdfketdzowxei4av6tt3ufjcyk4gx5c3wjbgm.ipfs.dweb.link
1 bafkreie6cx2qynun2ptghgdfketdzowxei4av6tt3ufjcyk4gx5c3wjbgm.ipfs.dweb.link
0 aadcdn.msftauth.net Failed
15 6

This site contains no links.

Subject Issuer Validity Valid
dweb.link
R3		 2023-06-11 -
2023-09-09		 3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2023-07-03 -
2024-07-02		 a year crt.sh
*.jquery.com
Sectigo RSA Domain Validation Secure Server CA		 2023-07-11 -
2024-07-14		 a year crt.sh
*.googleusercontent.com
GTS CA 1C3		 2023-07-31 -
2023-10-23		 3 months crt.sh
jdjdmxnx.online
E1		 2023-08-15 -
2023-11-13		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://bafkreie6cx2qynun2ptghgdfketdzowxei4av6tt3ufjcyk4gx5c3wjbgm.ipfs.dweb.link/
Frame ID: 5CF0293DCF58BDE100EE9E86D7A19888
Requests: 15 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. http://bafkreie6cx2qynun2ptghgdfketdzowxei4av6tt3ufjcyk4gx5c3wjbgm.ipfs.dweb.link/ HTTP 307
    https://bafkreie6cx2qynun2ptghgdfketdzowxei4av6tt3ufjcyk4gx5c3wjbgm.ipfs.dweb.link/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

15
Requests

53 %
HTTPS

0 %
IPv6

6
Domains

6
Subdomains

6
IPs

2
Countries

397 kB
Transfer

1504 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://bafkreie6cx2qynun2ptghgdfketdzowxei4av6tt3ufjcyk4gx5c3wjbgm.ipfs.dweb.link/ HTTP 307
    https://bafkreie6cx2qynun2ptghgdfketdzowxei4av6tt3ufjcyk4gx5c3wjbgm.ipfs.dweb.link/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

15 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
bafkreie6cx2qynun2ptghgdfketdzowxei4av6tt3ufjcyk4gx5c3wjbgm.ipfs.dweb.link/
Redirect Chain
  • http://bafkreie6cx2qynun2ptghgdfketdzowxei4av6tt3ufjcyk4gx5c3wjbgm.ipfs.dweb.link/
  • https://bafkreie6cx2qynun2ptghgdfketdzowxei4av6tt3ufjcyk4gx5c3wjbgm.ipfs.dweb.link/
54 KB
32 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://bafkreie6cx2qynun2ptghgdfketdzowxei4av6tt3ufjcyk4gx5c3wjbgm.ipfs.dweb.link/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
209.94.90.1 , United States, ASN40680 (PROTOCOL, US),
Reverse DNS
Software
openresty /
Resource Hash
9e15f50c368dd3e663986551263cbad722380afa73dd0a91615c35fa2dd92133
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36
accept-language
en-AU,en;q=0.9

Response headers

access-control-allow-headers
X-Requested-With, Range, Content-Range, X-Chunked-Output, X-Stream-Output
access-control-allow-methods
GET HEAD OPTIONS GET, POST, OPTIONS
access-control-allow-origin
*
access-control-expose-headers
Content-Range, X-Chunked-Output, X-Stream-Output
cache-control
public, max-age=29030400, immutable
content-encoding
gzip
content-type
text/html
date
Wed, 23 Aug 2023 01:25:28 GMT
etag
W/"bafkreie6cx2qynun2ptghgdfketdzowxei4av6tt3ufjcyk4gx5c3wjbgm"
server
openresty
strict-transport-security
max-age=31536000; includeSubDomains; preload
timing-allow-origin
*
vary
Accept-Encoding
x-ipfs-gateway-host
ipfs-bank14-sg1
x-ipfs-lb-pop
gateway-bank1-sg1
x-ipfs-path
/ipfs/bafkreie6cx2qynun2ptghgdfketdzowxei4av6tt3ufjcyk4gx5c3wjbgm/
x-ipfs-pop
ipfs-bank14-sg1
x-ipfs-roots
bafkreie6cx2qynun2ptghgdfketdzowxei4av6tt3ufjcyk4gx5c3wjbgm
x-proxy-cache
HIT

Redirect headers

Cross-Origin-Resource-Policy
Cross-Origin
Location
https://bafkreie6cx2qynun2ptghgdfketdzowxei4av6tt3ufjcyk4gx5c3wjbgm.ipfs.dweb.link/
Non-Authoritative-Reason
HSTS
crypto-js.min.js
cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/ 		47 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js
Requested by
Host: bafkreie6cx2qynun2ptghgdfketdzowxei4av6tt3ufjcyk4gx5c3wjbgm.ipfs.dweb.link
URL: https://bafkreie6cx2qynun2ptghgdfketdzowxei4av6tt3ufjcyk4gx5c3wjbgm.ipfs.dweb.link/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8e3b0117f4df4be452c0b6af5b8f0a0acf9d4ade23d08d55d7e312af22077762
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

accept-language
en-AU,en;q=0.9
Referer
https://bafkreie6cx2qynun2ptghgdfketdzowxei4av6tt3ufjcyk4gx5c3wjbgm.ipfs.dweb.link/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date
Wed, 23 Aug 2023 01:25:30 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
2274100
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
13972
last-modified
Thu, 22 Jun 2023 10:57:57 GMT
server
cloudflare
cf-cdnjs-via
cfworker/r2
etag
"64942935-3694"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NfliHmJICFIWWU3Otcudh8WjvMk7UCSlJ2aR%2BVt%2BINYOWy335apw%2FeXvV59PyDRwsnPDNKD8cFrYXksbsvt397djPBZuPmV3h3CBpxvi%2FBznxSI28GtzBU6Raa%2BStKZ67WsCVmPD"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
7faf8fde9b1da823-SYD
expires
Mon, 12 Aug 2024 01:25:30 GMT
jquery-1.9.1.js
code.jquery.com/ 		262 KB
78 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/jquery-1.9.1.js
Requested by
Host: bafkreie6cx2qynun2ptghgdfketdzowxei4av6tt3ufjcyk4gx5c3wjbgm.ipfs.dweb.link
URL: https://bafkreie6cx2qynun2ptghgdfketdzowxei4av6tt3ufjcyk4gx5c3wjbgm.ipfs.dweb.link/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
69.16.175.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
hwcdn.net
Software
nginx /
Resource Hash
7bd80d06c01c0340c1b9159b9b4a197db882ca18cbac8e9b9aa025e68f998d40

Request headers

accept-language
en-AU,en;q=0.9
Referer
https://bafkreie6cx2qynun2ptghgdfketdzowxei4av6tt3ufjcyk4gx5c3wjbgm.ipfs.dweb.link/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date
Wed, 23 Aug 2023 01:25:31 GMT
content-encoding
gzip
last-modified
Fri, 20 Aug 2021 17:47:53 GMT
server
nginx
etag
W/"611feac9-4185d"
vary
Accept-Encoding
x-hw
1692753931.dop221.la3.t,1692753931.cds278.la3.hn,1692753931.cds064.la3.c
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
content-length
79506
AJFCJaXhZo6cUCNh1ssNQzSV3jc1ppd5Vt2HN5GjHL82rJR25OrOigrMWVvBpwQN6BD4T_qHdwh2spOZ9bKA-BqcHsttYMUy5sxc-E99nKe9pgDJsCX0icydpRhjm97W_S4_6cism2sTCOp-Oxa807yjCEw=w1580-h720-s-no
lh3.googleusercontent.com/pw/ 		192 KB
193 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lh3.googleusercontent.com/pw/AJFCJaXhZo6cUCNh1ssNQzSV3jc1ppd5Vt2HN5GjHL82rJR25OrOigrMWVvBpwQN6BD4T_qHdwh2spOZ9bKA-BqcHsttYMUy5sxc-E99nKe9pgDJsCX0icydpRhjm97W_S4_6cism2sTCOp-Oxa807yjCEw=w1580-h720-s-no?authuser=0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.194.132 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
si-in-f132.1e100.net
Software
fife /
Resource Hash
c51ecfdbb39612d629bbbfa57896c63dc52971d7bcf78f1795944be16274a8eb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-AU,en;q=0.9
Referer
https://bafkreie6cx2qynun2ptghgdfketdzowxei4av6tt3ufjcyk4gx5c3wjbgm.ipfs.dweb.link/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date
Wed, 23 Aug 2023 01:25:31 GMT
x-content-type-options
nosniff
server
fife
etag
"v51"
vary
Origin
content-type
image/gif
access-control-expose-headers
Content-Length
cache-control
private, max-age=86400, no-transform
cross-origin-resource-policy
cross-origin
content-disposition
inline;filename="Flashback - Jul 5, 2023 00_04_12.gif"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
197044
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
uiel35hsjic.jdjdmxnx.online/obufsssssssscaaatoion/ 		940 KB
73 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://uiel35hsjic.jdjdmxnx.online/obufsssssssscaaatoion/
Requested by
Host: code.jquery.com
URL: https://code.jquery.com/jquery-1.9.1.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.21.93.58 -, , ASN (),
Reverse DNS
Software
cloudflare /
Resource Hash
5dd5d09e21b53e07ec3423492ee3443eacd2a8ad3f1e595809f34ecebc90c455
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://bafkreie6cx2qynun2ptghgdfketdzowxei4av6tt3ufjcyk4gx5c3wjbgm.ipfs.dweb.link/
accept-language
en-AU,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

date
Wed, 23 Aug 2023 01:25:33 GMT
content-encoding
br
x-content-type-options
nosniff
referrer-policy
same-origin
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
origin
x-frame-options
DENY
content-type
application/json
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OKfqQQwlIbOQszg0ZS8zuXN10AVi%2BSBUZEj5QTg62K1AIY9UwPwe3JwuqkDyS5VJlSp7qywiKghSyT7Op6TG62Sj4G%2Fqe3%2F7DxsxvMPK4EYshIqw2eDZX6TU15MDtttBBWAty%2F1yWLaJ8Np2UHc%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
7faf8ff22d832ea0-MEL
alt-svc
h3=":443"; ma=86400
x-xss-protection
1; mode=block
AMWts8C1y-LmqPwr79FSVd9YMV5yeje6h34dtqg8n1c7UYT__udX1hIixqqaItUS-Vtl4epJI-2Qtycgc0GgiWtrFAFZIVdjRD8HShOpZsK0Vucx0qiSJ9iKKAd1_ocqVqIgMtn1jlLj4HB4Ap_2ZUiwAnk=w108-h24-no
lh3.googleusercontent.com/pw/ 		0
0
AMWts8CNmlIjdTtHgPdAMoSG4uyQnKbGT1407U5GJD9BBD5gOhyThvxN7ptqzSc9OV7GvMrNxsLjt_kin2qpj8tlLu4VPG_UA8XrdDZZYTEJRXHQkb_glHR4oYOoSP3tDH1rPkDWcGOdNw-zacvrmMF7NU0=s150-no
lh3.googleusercontent.com/pw/ 		0
0
AMWts8DXuoTCchIiCUMSjRAC76eUjCoJ1Hj726Mdu1LszHJglP2MLf_RoCW0uZpRXU92HCp7sJJtRW1SSsaUhnE1muSBc8avCHEqEHuLdsuLbYPj0hMJ1kVq-hZ1eYf_w6QcxuCHVVBR-siBvHZM2G9Rlbw=s150-no
lh3.googleusercontent.com/pw/ 		0
0
AMWts8CLLNnGpj7_FWohqCPJSzzgHwWUwFqF-CN0acr9XqBJvbhlCprvfnAvLav0gAOr0ez63QMTk6WPV7V7rT_ZZ7E5ueysaU99HDwu7huiWEUvbNO3mDIklTKmUuxN9sPyZMwDPt-T39tp9ZO2Pq53dRI=s150-no
lh3.googleusercontent.com/pw/ 		0
0
arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg
aadcdn.msftauth.net/shared/1.0/content/images/ 		0
0
AMWts8AK-lOypWQRHV6CblnIhwum5iMC-2fHJehOkF8BqfFCgB1DZT2LI30pbRIC605sfh4PyJS0qLFawTwXAyFCgEjDlPQe4GThYYbbx5CB-urZNnpa1Uhn-GrOGG5UcX6f5GsSPkypixgkdMoOBFlQqZ4=s150-no
lh3.googleusercontent.com/pw/ 		810 B
933 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lh3.googleusercontent.com/pw/AMWts8AK-lOypWQRHV6CblnIhwum5iMC-2fHJehOkF8BqfFCgB1DZT2LI30pbRIC605sfh4PyJS0qLFawTwXAyFCgEjDlPQe4GThYYbbx5CB-urZNnpa1Uhn-GrOGG5UcX6f5GsSPkypixgkdMoOBFlQqZ4=s150-no?authuser=0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.194.132 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
si-in-f132.1e100.net
Software
fife /
Resource Hash
34058a4c997349cd3c91a3bc59bcc82dd6920bd57a555b49875bf71eae942e2c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-AU,en;q=0.9
Referer
https://bafkreie6cx2qynun2ptghgdfketdzowxei4av6tt3ufjcyk4gx5c3wjbgm.ipfs.dweb.link/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date
Wed, 23 Aug 2023 01:25:35 GMT
x-content-type-options
nosniff
server
fife
etag
"v4c"
vary
Origin
content-type
image/png
access-control-expose-headers
Content-Length
cache-control
private, max-age=86400, no-transform
cross-origin-resource-policy
cross-origin
content-disposition
inline;filename="picker_verify_sms_27a6d18b56f46818420e60a773c36d4e.png"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
810
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
AMWts8Cql-_FqT-vTMz5KecPfNkES17GUcAhZtgXLH0x4Wv9Lj4vnoCGPorATuuzvKe5c-hTrhXFnWh6cu4TC2cJjWKbnr2Fq-avQW5Q1oqvrNCP29CvGjXZZkxpkBgWTjA6DBjYlYpLr5-pfWHOb04OsBY=s150-no
lh3.googleusercontent.com/pw/ 		1 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lh3.googleusercontent.com/pw/AMWts8Cql-_FqT-vTMz5KecPfNkES17GUcAhZtgXLH0x4Wv9Lj4vnoCGPorATuuzvKe5c-hTrhXFnWh6cu4TC2cJjWKbnr2Fq-avQW5Q1oqvrNCP29CvGjXZZkxpkBgWTjA6DBjYlYpLr5-pfWHOb04OsBY=s150-no
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.194.132 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
si-in-f132.1e100.net
Software
fife /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-AU,en;q=0.9
Referer
https://bafkreie6cx2qynun2ptghgdfketdzowxei4av6tt3ufjcyk4gx5c3wjbgm.ipfs.dweb.link/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date
Wed, 23 Aug 2023 01:25:35 GMT
x-content-type-options
nosniff
server
fife
etag
"v4c"
vary
Origin
content-type
image/png
access-control-expose-headers
Content-Length
cache-control
private, max-age=86400, no-transform
cross-origin-resource-policy
cross-origin
content-disposition
inline;filename="picker_verify_code_f7ab697e65b83ce9870a4736085deeec.png"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
2382
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
AMWts8CPpl_w_5Fj80z5l9jlYET_SacByn_w9oXKdt92XWEATpkaTNMXRjd49krHesOb3FAHMXEQBD5153gSMnAZGOmXwR9Rp_K_-6jVQvTb4qi9QggArKoSZ61C-gpBRHxrTvoFunjzMPQhEspfqSTvD-o=s150-no
lh3.googleusercontent.com/pw/ 		5 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lh3.googleusercontent.com/pw/AMWts8CPpl_w_5Fj80z5l9jlYET_SacByn_w9oXKdt92XWEATpkaTNMXRjd49krHesOb3FAHMXEQBD5153gSMnAZGOmXwR9Rp_K_-6jVQvTb4qi9QggArKoSZ61C-gpBRHxrTvoFunjzMPQhEspfqSTvD-o=s150-no
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.194.132 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
si-in-f132.1e100.net
Software
fife /
Resource Hash
f2c40a63580308bf348c5e8eb9a0880238f5f207e228e0c091e83b1efcbf979f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-AU,en;q=0.9
Referer
https://bafkreie6cx2qynun2ptghgdfketdzowxei4av6tt3ufjcyk4gx5c3wjbgm.ipfs.dweb.link/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date
Wed, 23 Aug 2023 01:25:35 GMT
x-content-type-options
nosniff
server
fife
etag
"v4c"
vary
Origin
content-type
image/png
access-control-expose-headers
Content-Length
cache-control
private, max-age=86400, no-transform
cross-origin-resource-policy
cross-origin
content-disposition
inline;filename="picker_verify_call_fe87496cc7a44412f7893a72099c120a.png"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
5533
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
AMWts8BB5eL1vbp9dPEQCSEMJxM3Y9agty2fbo3XhD76Dz3OBAH0vp3VSA07-yrArrrYp5TuF80R6HzDKK65oJ8-tv7Px-SFgTOIBONfJYbApe2ilHyCEg9LRrwu52XsghVBZuQtpKdlw0j9iUdY8MqKhVU=s150-no
lh3.googleusercontent.com/pw/ 		0
0
AMWts8D8e5caxJov7GOp1rwDQidEks3V2UuXk1O7PZDbHZa5IL_i0KpG0ekmdhUvoDq55PguGPsZ-IFD0DpviH169WF09S-C8-tYQlW5MiYBzUesaWNDrAhwB3xLJo66GKNcYquCnPMjb1AN4oiTdyMOkvI=w1652-h929-no
lh3.googleusercontent.com/pw/ 		0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
lh3.googleusercontent.com
URL
https://lh3.googleusercontent.com/pw/AMWts8C1y-LmqPwr79FSVd9YMV5yeje6h34dtqg8n1c7UYT__udX1hIixqqaItUS-Vtl4epJI-2Qtycgc0GgiWtrFAFZIVdjRD8HShOpZsK0Vucx0qiSJ9iKKAd1_ocqVqIgMtn1jlLj4HB4Ap_2ZUiwAnk=w108-h24-no
Domain
lh3.googleusercontent.com
URL
https://lh3.googleusercontent.com/pw/AMWts8CNmlIjdTtHgPdAMoSG4uyQnKbGT1407U5GJD9BBD5gOhyThvxN7ptqzSc9OV7GvMrNxsLjt_kin2qpj8tlLu4VPG_UA8XrdDZZYTEJRXHQkb_glHR4oYOoSP3tDH1rPkDWcGOdNw-zacvrmMF7NU0=s150-no
Domain
lh3.googleusercontent.com
URL
https://lh3.googleusercontent.com/pw/AMWts8DXuoTCchIiCUMSjRAC76eUjCoJ1Hj726Mdu1LszHJglP2MLf_RoCW0uZpRXU92HCp7sJJtRW1SSsaUhnE1muSBc8avCHEqEHuLdsuLbYPj0hMJ1kVq-hZ1eYf_w6QcxuCHVVBR-siBvHZM2G9Rlbw=s150-no
Domain
lh3.googleusercontent.com
URL
https://lh3.googleusercontent.com/pw/AMWts8CLLNnGpj7_FWohqCPJSzzgHwWUwFqF-CN0acr9XqBJvbhlCprvfnAvLav0gAOr0ez63QMTk6WPV7V7rT_ZZ7E5ueysaU99HDwu7huiWEUvbNO3mDIklTKmUuxN9sPyZMwDPt-T39tp9ZO2Pq53dRI=s150-no
Domain
aadcdn.msftauth.net
URL
https://aadcdn.msftauth.net/shared/1.0/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg
Domain
lh3.googleusercontent.com
URL
https://lh3.googleusercontent.com/pw/AMWts8BB5eL1vbp9dPEQCSEMJxM3Y9agty2fbo3XhD76Dz3OBAH0vp3VSA07-yrArrrYp5TuF80R6HzDKK65oJ8-tv7Px-SFgTOIBONfJYbApe2ilHyCEg9LRrwu52XsghVBZuQtpKdlw0j9iUdY8MqKhVU=s150-no
Domain
lh3.googleusercontent.com
URL
https://lh3.googleusercontent.com/pw/AMWts8D8e5caxJov7GOp1rwDQidEks3V2UuXk1O7PZDbHZa5IL_i0KpG0ekmdhUvoDq55PguGPsZ-IFD0DpviH169WF09S-C8-tYQlW5MiYBzUesaWNDrAhwB3xLJo66GKNcYquCnPMjb1AN4oiTdyMOkvI=w1652-h929-no

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

37 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture object| CryptoJS string| encrypted string| key string| iv object| keyBytes object| ivBytes object| decrypted string| decryptedString object| s string| rlPyUidm function| _0x33fcc1 function| _0xca375 function| _0x4c2155 function| _0x55ea39 function| _0x2ba133 function| _0x437614 function| _0x5a4613 function| _0x1442c4 function| _0x560846 function| _0x2f564e function| _0x385a96 function| _0x5d2160 function| _0x12c1ce function| _0xa06f60 function| _0x44c461 function| _0x3311 function| _0x117e object| _0x4e37 string| IGOBZL string| cbbg string| kaka90nal string| ka45k459final2 string| kak0011afinal number| countttingerr function| $ function| jQuery

0 Cookies

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload