ipfs.eth.aragon.network

Summary

This website contacted 5 IPs in 2 countries across 5 domains to perform 4 HTTP transactions. The main IP is 146.190.204.125, located in Frankfurt am Main, Germany and belongs to DIGITALOCEAN-ASN, US. The main domain is ipfs.eth.aragon.network.
TLS certificate: Issued by R3 on December 9th 2023. Valid for: 3 months.

This is the only time ipfs.eth.aragon.network was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Email (Online)

Domain & IP information

	IP Address	AS Autonomous System
1	146.190.204.125 146.190.204.125	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
1	151.101.66.137 151.101.66.137	54113 (FASTLY) (FASTLY)
1 1	142.250.204.4 142.250.204.4	15169 (GOOGLE) (GOOGLE)
1	172.217.24.36 172.217.24.36	15169 (GOOGLE) (GOOGLE)
1	192.151.158.245 192.151.158.245	33387 (NOCIX) (NOCIX)
4	5

1 146.190.204.125 (Frankfurt am Main, Germany)

ASN14061 (DIGITALOCEAN-ASN, US)

ipfs.eth.aragon.network	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.66.137 (United States)

ASN54113 (FASTLY, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.204.4 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: syd09s25-in-f4.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.24.36 (United States)

ASN15169 (GOOGLE, US)
PTR: syd15s20-in-f4.1e100.net

t0.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.151.158.245 (United States)

ASN33387 (NOCIX, US)

www.pngitem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
1	pngitem.com www.pngitem.com — Cisco Umbrella Rank: 115629
1	gstatic.com t0.gstatic.com	917 B
1	google.com 1 redirects www.google.com — Cisco Umbrella Rank: 2	290 B
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 735	33 KB
1	aragon.network ipfs.eth.aragon.network	10 KB
4	5

	Domain	Requested by
1	www.pngitem.com	ipfs.eth.aragon.network
1	t0.gstatic.com	ipfs.eth.aragon.network
1	www.google.com	1 redirects
1	code.jquery.com	ipfs.eth.aragon.network
1	ipfs.eth.aragon.network
4	5

This site contains no links.

Subject Issuer	Validity	Valid
ipfs.eth.aragon.network R3	`2023-12-09` - `2024-03-08`	3 months	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2023-07-11` - `2024-07-14`	a year	crt.sh
pngitem.com R3	`2023-12-03` - `2024-03-02`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://ipfs.eth.aragon.network/ipfs/bafkreibnwnwvl5t5rix6tq3qoif4s6xqw6m3366c2yy7lnhig5zg2wk5ji
Frame ID: 3BA4B2EF2E8F404236CC45A5351F0EEE
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Webmail Portal Login

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

4
Requests

75 %
HTTPS

0 %
IPv6

5
Domains

5
Subdomains

5
IPs

2
Countries

43 kB
Transfer

105 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1

https://www.google.com/s2/favicons?domain=biofactlife.com HTTP 301
https://t0.gstatic.com/faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,SIZE,URL&url=http://biofactlife.com&size=16

4 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request bafkreibnwnwvl5t5rix6tq3qoif4s6xqw6m3366c2yy7lnhig5zg2wk5ji Show response
ipfs.eth.aragon.network/ipfs/ 9 KB
10 KB 926ms
287ms Document
text/html 146.190.204.125
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://ipfs.eth.aragon.network/ipfs/bafkreibnwnwvl5t5rix6tq3qoif4s6xqw6m3366c2yy7lnhig5zg2wk5ji
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 146.190.204.125 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx/1.21.6 /
Resource Hash: 2db36d55f67d8a2fe9c370720bc97af0b799bdfbc2d631f5b4e837726d595d4a

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-headers: Content-Type Range User-Agent X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-expose-headers: Content-Length Content-Range X-Chunked-Output X-Ipfs-Path X-Ipfs-Roots X-Stream-Output
cache-control: public, max-age=29030400, immutable
content-length: 9485
content-type: text/html
date: Tue, 12 Dec 2023 23:54:05 GMT
etag: "bafkreibnwnwvl5t5rix6tq3qoif4s6xqw6m3366c2yy7lnhig5zg2wk5ji"
server: nginx/1.21.6
x-ipfs-path: /ipfs/bafkreibnwnwvl5t5rix6tq3qoif4s6xqw6m3366c2yy7lnhig5zg2wk5ji
x-ipfs-roots: bafkreibnwnwvl5t5rix6tq3qoif4s6xqw6m3366c2yy7lnhig5zg2wk5ji

GET
H2 200 jquery-1.11.1.min.js Show response
code.jquery.com/ 94 KB
33 KB 727ms
142ms Script
application/javascript 151.101.66.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-1.11.1.min.js
Requested by: Host: ipfs.eth.aragon.network
URL: https://ipfs.eth.aragon.network/ipfs/bafkreibnwnwvl5t5rix6tq3qoif4s6xqw6m3366c2yy7lnhig5zg2wk5ji
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.66.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: 540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ipfs.eth.aragon.network/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 23:54:06 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
age: 7623043
x-cache: HIT, HIT
content-length: 33202
x-served-by: cache-lga21922-LGA, cache-bfi-kbfi7400048-BFI
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
server: nginx
x-timer: S1702425247.528628,VS0,VE0
etag: W/"28feccc0-1762a"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=604800
accept-ranges: bytes
x-cache-hits: 37, 3623

GET
H2

404

faviconV2
t0.gstatic.com/
Redirect Chain

https://www.google.com/s2/favicons?domain=biofactlife.com
https://t0.gstatic.com/faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,SIZE,URL&url=http://biofactlife.com&size=16

726 B
917 B

507ms
98ms

Image
image/png

172.217.24.36
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t0.gstatic.com/faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,SIZE,URL&url=http://biofactlife.com&size=16

Requested by

Host: ipfs.eth.aragon.network
URL: https://ipfs.eth.aragon.network/ipfs/bafkreibnwnwvl5t5rix6tq3qoif4s6xqw6m3366c2yy7lnhig5zg2wk5ji

Protocol

H2

Server

172.217.24.36 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

syd15s20-in-f4.1e100.net

Software

sffe /

Resource Hash

59bfe9bc385ad69f50793ce4a53397316d7a875a7148a63c16df9b674c6cda64

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ipfs.eth.aragon.network/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Tue, 12 Dec 2023 23:54:06 GMT
x-content-type-options: nosniff
server: sffe
content-type: image/png
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 726
x-xss-protection: 0

Redirect headers

date: Tue, 12 Dec 2023 23:54:06 GMT
x-content-type-options: nosniff
server: sffe
content-type: text/html; charset=UTF-8
location: https://t0.gstatic.com/faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,SIZE,URL&url=http://biofactlife.com&size=16
cache-control: public, max-age=1800
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 335
x-xss-protection: 0
expires: Wed, 13 Dec 2023 00:24:06 GMT

GET
H/1.1 404
Not Found 26-269507_arbys-logo-transparent-norton-secured-logo-png-png.png
www.pngitem.com/pimgs/m/ 0
0 865ms
183ms Image
text/html 192.151.158.245
NOCIX

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.pngitem.com/pimgs/m/26-269507_arbys-logo-transparent-norton-secured-logo-png-png.png
Requested by: Host: ipfs.eth.aragon.network
URL: https://ipfs.eth.aragon.network/ipfs/bafkreibnwnwvl5t5rix6tq3qoif4s6xqw6m3366c2yy7lnhig5zg2wk5ji
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.151.158.245 , United States, ASN33387 (NOCIX, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://ipfs.eth.aragon.network/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

GET
DATA 200
OK truncated
/ 558 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 578254b8c8e53db6ffe80754d29a9db454d8818885ac826b11e9b95389618b5b

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 520 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2172033cc841f94e32ca4412cd380e43d873a9e74e54aee03f0d26ed72d20be5

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

Content-Type: image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Email (Online)

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://t0.gstatic.com/faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,SIZE,URL&url=http://biofactlife.com&size=16 Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://www.pngitem.com/pimgs/m/26-269507_arbys-logo-transparent-norton-secured-logo-png-png.png Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

code.jquery.com
ipfs.eth.aragon.network
t0.gstatic.com
www.google.com
www.pngitem.com
142.250.204.4
146.190.204.125
151.101.66.137
172.217.24.36
192.151.158.245
2172033cc841f94e32ca4412cd380e43d873a9e74e54aee03f0d26ed72d20be5
2db36d55f67d8a2fe9c370720bc97af0b799bdfbc2d631f5b4e837726d595d4a
540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441
578254b8c8e53db6ffe80754d29a9db454d8818885ac826b11e9b95389618b5b
59bfe9bc385ad69f50793ce4a53397316d7a875a7148a63c16df9b674c6cda64
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

ipfs.eth.aragon.network Open in urlscan Pro 146.190.204.125 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

4 Requests

75 %HTTPS

0 %IPv6

5 Domains

5 Subdomains

5 IPs

2 Countries

43 kBTransfer

105 kBSize

0 Cookies

0 Outgoing links

Redirected requests

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

10 JavaScript Global Variables

0 Cookies

2 Console Messages

Indicators

ipfs.eth.aragon.network Open in urlscan Pro
146.190.204.125 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

4
Requests

75 %
HTTPS

0 %
IPv6

5
Domains

5
Subdomains

5
IPs

2
Countries

43 kB
Transfer

105 kB
Size

0
Cookies

4 HTTP transactions
2 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!