urlscan.io logo urlscan.io
SecurityTrails logo

cloudflare-ipfs.com Open in urlscan Pro
2606:4700::6811:600d  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://raspy-pine-2197.pages.dev/?djc=lrkips&psa=c***************.j*********@g****.com
Effective URL: https://cloudflare-ipfs.com/ipfs/QmcUzHrhN4GVnPjdEoPBSWZyFyudxG2CXzCe6sZJf34qpm/?cos=deirik&epi=c***************.j*********@...
Submission: On March 24 via api from US — Scanned from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 6 HTTP transactions. The main IP is 2606:4700::6811:600d, located in United States and belongs to CLOUDFLARENET, US. The main domain is cloudflare-ipfs.com.
TLS certificate: Issued by E1 on February 25th 2024. Valid for: 3 months.
This is the only time cloudflare-ipfs.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: WeTransfer (Online)

Domain & IP information

IP Address AS Autonomous System
2 2606:4700:310... 13335 (CLOUDFLAR...)
4 2606:4700::68... 13335 (CLOUDFLAR...)
6 2
Apex Domain
Subdomains		 Transfer
4 cloudflare-ipfs.com
cloudflare-ipfs.com
956 KB
2 pages.dev
raspy-pine-2197.pages.dev
48 KB
6 2
Domain Requested by
4 cloudflare-ipfs.com raspy-pine-2197.pages.dev
cloudflare-ipfs.com
2 raspy-pine-2197.pages.dev raspy-pine-2197.pages.dev
6 2

This site contains no links.

Subject Issuer Validity Valid
raspy-pine-2197.pages.dev
GTS CA 1P5		 2024-02-22 -
2024-05-22		 3 months crt.sh
cloudflare-ipfs.com
E1		 2024-02-25 -
2024-05-25		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://cloudflare-ipfs.com/ipfs/QmcUzHrhN4GVnPjdEoPBSWZyFyudxG2CXzCe6sZJf34qpm/?cos=deirik&epi=c***************.j*********@g****.com
Frame ID: A4C6663643C0C117D7BCC33E11180853
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

WeTransfer - Send Large Files & Share Photos Online - Up to 2GB Free

Page URL History Show full URLs

  1. http://raspy-pine-2197.pages.dev/?djc=lrkips&psa=c***************.j*********@g****.com HTTP 307
    https://raspy-pine-2197.pages.dev/?djc=lrkips&psa=c***************.j*********@g****.com Page URL
  2. https://cloudflare-ipfs.com/ipfs/QmcUzHrhN4GVnPjdEoPBSWZyFyudxG2CXzCe6sZJf34qpm/?cos=deirik&epi=c*******... Page URL

Page Statistics

6
Requests

100 %
HTTPS

100 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

1004 kB
Transfer

1320 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://raspy-pine-2197.pages.dev/?djc=lrkips&psa=c***************.j*********@g****.com HTTP 307
    https://raspy-pine-2197.pages.dev/?djc=lrkips&psa=c***************.j*********@g****.com Page URL
  2. https://cloudflare-ipfs.com/ipfs/QmcUzHrhN4GVnPjdEoPBSWZyFyudxG2CXzCe6sZJf34qpm/?cos=deirik&epi=c***************.j*********@g****.com Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • http://raspy-pine-2197.pages.dev/?djc=lrkips&psa=c***************.j*********@g****.com HTTP 307
  • https://raspy-pine-2197.pages.dev/?djc=lrkips&psa=c***************.j*********@g****.com

6 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
raspy-pine-2197.pages.dev/
Redirect Chain
  • http://raspy-pine-2197.pages.dev/?djc=lrkips&psa=c***************.j*********@g****.com
  • https://raspy-pine-2197.pages.dev/?djc=lrkips&psa=c***************.j*********@g****.com
1 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://raspy-pine-2197.pages.dev/?djc=lrkips&psa=c***************.j*********@g****.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:310c::ac42:2f3d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0e590d6ca73863ed74c4896d5a37b0830203f87c54f767bf2b14f3780cdbbfee
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36
accept-language
en-US,en;q=0.9

Response headers

access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
cache-control
public, max-age=0, must-revalidate
cf-ray
8699d4eeb8c84bc9-BUF
content-encoding
br
content-type
text/html; charset=utf-8
date
Sun, 24 Mar 2024 21:42:34 GMT
etag
W/"448fbd517c7b7f869659568d5330181a"
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy
strict-origin-when-cross-origin
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6IQ6WLj2YqLNGMV7uEm7KPYvHg8q37hgD%2BzxbyFz4HY4dO61x0tdsgX8FWDkfXQSF4Wo3%2BHWMkmot8kzv6NM4zUPyoNDRBuOfoK1TRJmd5R8ImL4TU7ZhwHi6wIcrylz8MWupsaNuhP%2F4RgzaBYpdME%2BhnCcq6yC"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
x-content-type-options
nosniff

Redirect headers

Cross-Origin-Resource-Policy
Cross-Origin
Location
https://raspy-pine-2197.pages.dev/?djc=lrkips&psa=c***************.j*********@g****.com
Non-Authoritative-Reason
HSTS
index-2292bcd2.js
raspy-pine-2197.pages.dev/assets/ 		140 KB
47 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://raspy-pine-2197.pages.dev/assets/index-2292bcd2.js
Requested by
Host: raspy-pine-2197.pages.dev
URL: https://raspy-pine-2197.pages.dev/?djc=lrkips&psa=c***************.j*********@g****.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:310c::ac42:2f3d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
065cdd5e029139174cbd72fa4c798171dd348206270515637e2f6db10661ba56
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://raspy-pine-2197.pages.dev/?djc=lrkips&psa=c***************.j*********@g****.com
Origin
https://raspy-pine-2197.pages.dev
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date
Sun, 24 Mar 2024 21:42:34 GMT
content-encoding
br
referrer-policy
strict-origin-when-cross-origin
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"fab1b4228f3eb5d4c941443653d7cd79"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EQhI0RC1V6peUVXAoJNvNkqPc899xaoT5HclUcLcsW6f%2FB2WN3bG6TfK5v6vKHlT7kwqDlZICVxMqt%2BEZVuwsllDHXWV%2BefUyt4qRDDAhpq47DrSG5Av%2Bjaasb%2BLbM0YdePrMBJ2eRklOpdM7qFxApxHMdabYRUE"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=0, must-revalidate
cf-ray
8699d4ef491c4bc9-BUF
alt-svc
h3=":443"; ma=86400
Primary Request /
cloudflare-ipfs.com/ipfs/QmcUzHrhN4GVnPjdEoPBSWZyFyudxG2CXzCe6sZJf34qpm/ 		476 B
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://cloudflare-ipfs.com/ipfs/QmcUzHrhN4GVnPjdEoPBSWZyFyudxG2CXzCe6sZJf34qpm/?cos=deirik&epi=c***************.j*********@g****.com
Requested by
Host: raspy-pine-2197.pages.dev
URL: https://raspy-pine-2197.pages.dev/assets/index-2292bcd2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:600d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1a02564964c0a574ed22f029886c9048b21d93531a10f89d2e19c3a59b952436

Request headers

Referer
https://raspy-pine-2197.pages.dev/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36
accept-language
en-US,en;q=0.9

Response headers

access-control-allow-headers
Content-Type Range User-Agent X-Requested-With
access-control-allow-methods
GET
access-control-allow-origin
*
access-control-expose-headers
Content-Length Content-Range X-Chunked-Output X-Ipfs-Path X-Ipfs-Roots X-Stream-Output
age
33172
alt-svc
h3=":443"; ma=86400
cache-control
public, max-age=29030400, immutable
cf-cache-status
HIT
cf-ray
8699d503985c4bc6-BUF
content-encoding
br
content-type
text/html
date
Sun, 24 Mar 2024 21:42:37 GMT
etag
W/"QmcUzHrhN4GVnPjdEoPBSWZyFyudxG2CXzCe6sZJf34qpm"
server
cloudflare
vary
Accept-Encoding
x-cf-ipfs-cache-status
hit
x-ipfs-path
/ipfs/QmcUzHrhN4GVnPjdEoPBSWZyFyudxG2CXzCe6sZJf34qpm/
x-ipfs-roots
QmcUzHrhN4GVnPjdEoPBSWZyFyudxG2CXzCe6sZJf34qpm
index-ee34c7d8.js
cloudflare-ipfs.com/ipfs/QmcUzHrhN4GVnPjdEoPBSWZyFyudxG2CXzCe6sZJf34qpm/assets/ 		304 KB
84 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cloudflare-ipfs.com/ipfs/QmcUzHrhN4GVnPjdEoPBSWZyFyudxG2CXzCe6sZJf34qpm/assets/index-ee34c7d8.js
Requested by
Host: cloudflare-ipfs.com
URL: https://cloudflare-ipfs.com/ipfs/QmcUzHrhN4GVnPjdEoPBSWZyFyudxG2CXzCe6sZJf34qpm/?cos=deirik&epi=c***************.j*********@g****.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:600d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e6e05248c9817038d283d784cd430de06b66a0dfda3df0153886de48631bd2f0

Request headers

Referer
https://cloudflare-ipfs.com/ipfs/QmcUzHrhN4GVnPjdEoPBSWZyFyudxG2CXzCe6sZJf34qpm/?cos=deirik&epi=c***************.j*********@g****.com
Origin
https://cloudflare-ipfs.com
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date
Sun, 24 Mar 2024 21:42:37 GMT
content-encoding
br
cf-cache-status
HIT
age
68
x-cf-ipfs-cache-status
hit
alt-svc
h3=":443"; ma=86400
server
cloudflare
x-ipfs-roots
QmcUzHrhN4GVnPjdEoPBSWZyFyudxG2CXzCe6sZJf34qpm,QmXmtEkrSEt4f6kfwd7fby2wK5iea7PVrhMLtPZ8NGP7Xc,QmYx55jxgRaKdjT5JtKDA4kT3WaFEG8UUkfuTcRBySDbsP
etag
W/"QmYx55jxgRaKdjT5JtKDA4kT3WaFEG8UUkfuTcRBySDbsP"
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
text/javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
Content-Length, Content-Range, X-Chunked-Output, X-Ipfs-Path, X-Ipfs-Roots, X-Stream-Output
cache-control
public, max-age=29030400, immutable
x-ipfs-path
/ipfs/QmcUzHrhN4GVnPjdEoPBSWZyFyudxG2CXzCe6sZJf34qpm/assets/index-ee34c7d8.js
cf-ray
8699d503f8894bc6-BUF
access-control-allow-headers
Content-Type, Range, User-Agent, X-Requested-With
index-879eae18.css
cloudflare-ipfs.com/ipfs/QmcUzHrhN4GVnPjdEoPBSWZyFyudxG2CXzCe6sZJf34qpm/assets/ 		6 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cloudflare-ipfs.com/ipfs/QmcUzHrhN4GVnPjdEoPBSWZyFyudxG2CXzCe6sZJf34qpm/assets/index-879eae18.css
Requested by
Host: cloudflare-ipfs.com
URL: https://cloudflare-ipfs.com/ipfs/QmcUzHrhN4GVnPjdEoPBSWZyFyudxG2CXzCe6sZJf34qpm/?cos=deirik&epi=c***************.j*********@g****.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:600d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
879eae18e421a157fc5600b6355bc39372cff642df5c6bf8a28a1c337d929767

Request headers

accept-language
en-US,en;q=0.9
Referer
https://cloudflare-ipfs.com/ipfs/QmcUzHrhN4GVnPjdEoPBSWZyFyudxG2CXzCe6sZJf34qpm/?cos=deirik&epi=c***************.j*********@g****.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date
Sun, 24 Mar 2024 21:42:37 GMT
content-encoding
br
cf-cache-status
HIT
age
68
x-cf-ipfs-cache-status
hit
alt-svc
h3=":443"; ma=86400
server
cloudflare
x-ipfs-roots
QmcUzHrhN4GVnPjdEoPBSWZyFyudxG2CXzCe6sZJf34qpm,QmXmtEkrSEt4f6kfwd7fby2wK5iea7PVrhMLtPZ8NGP7Xc,QmQZN21VuqnC6LHKocQhbhEih88yGrfa3u5B4pfmbcMZYG
etag
W/"QmQZN21VuqnC6LHKocQhbhEih88yGrfa3u5B4pfmbcMZYG"
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
text/css; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
Content-Length, Content-Range, X-Chunked-Output, X-Ipfs-Path, X-Ipfs-Roots, X-Stream-Output
cache-control
public, max-age=29030400, immutable
x-ipfs-path
/ipfs/QmcUzHrhN4GVnPjdEoPBSWZyFyudxG2CXzCe6sZJf34qpm/assets/index-879eae18.css
cf-ray
8699d503f8844bc6-BUF
access-control-allow-headers
Content-Type, Range, User-Agent, X-Requested-With
___bg.png
cloudflare-ipfs.com/ipfs/QmcUzHrhN4GVnPjdEoPBSWZyFyudxG2CXzCe6sZJf34qpm/ 		869 KB
869 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cloudflare-ipfs.com/ipfs/QmcUzHrhN4GVnPjdEoPBSWZyFyudxG2CXzCe6sZJf34qpm/___bg.png
Requested by
Host: cloudflare-ipfs.com
URL: https://cloudflare-ipfs.com/ipfs/QmcUzHrhN4GVnPjdEoPBSWZyFyudxG2CXzCe6sZJf34qpm/assets/index-879eae18.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6811:600d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0cd23bab23486b059049ff1b3d98521e30afc349ac5dc46501cbb3530d47ff74

Request headers

accept-language
en-US,en;q=0.9
Referer
https://cloudflare-ipfs.com/ipfs/QmcUzHrhN4GVnPjdEoPBSWZyFyudxG2CXzCe6sZJf34qpm/assets/index-879eae18.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date
Sun, 24 Mar 2024 21:42:37 GMT
cf-cache-status
HIT
age
68
x-cf-ipfs-cache-status
hit
alt-svc
h3=":443"; ma=86400
content-length
889398
server
cloudflare
x-ipfs-roots
QmcUzHrhN4GVnPjdEoPBSWZyFyudxG2CXzCe6sZJf34qpm,QmQG9MFNPFRzC2UTCvBPvPAetYyssKvL1VriSisVo5sE6C
etag
"QmQG9MFNPFRzC2UTCvBPvPAetYyssKvL1VriSisVo5sE6C"
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
image/png
access-control-allow-origin
*
access-control-expose-headers
Content-Length, Content-Range, X-Chunked-Output, X-Ipfs-Path, X-Ipfs-Roots, X-Stream-Output
cache-control
public, max-age=29030400, immutable
x-ipfs-path
/ipfs/QmcUzHrhN4GVnPjdEoPBSWZyFyudxG2CXzCe6sZJf34qpm/___bg.png
accept-ranges
bytes
cf-ray
8699d5046eb84bc0-BUF
access-control-allow-headers
Content-Type, Range, User-Agent, X-Requested-With

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: WeTransfer (Online)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Domain/Path Name / Value
cloudflare-ipfs.com/ Name: __cf_bm
Value: olFgZbDxpS_x_A6WmPczOFOsXHD7GfFDiXsJvuTIgZ8-1711316557-1.0.1.1-HOWgdUPuzND79t7AA19_d.ArK9lBwQVZvG3RDgbekd7IYDi6AVeh1VdxDKlwoMtXYqbjTCxSSJPcQzArqMYLZg

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff