urlscan.io logo urlscan.io
SecurityTrails logo

ipfs.io Open in urlscan Pro
209.94.90.1  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://ironroofrestoration.com.au/report/sf_rand_string_mixed(3)/charles.lampe@blefa.com
Effective URL: https://ipfs.io/ipfs/QmZeBa5od8nMG4kfxUvu6h2jthg1xju4W38m9Tx7RiyBg6?filename=supportpost.html
Submission: On April 20 via automatic, source openphish — Scanned from AU
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 6 IPs in 3 countries across 6 domains to perform 9 HTTP transactions. The main IP is 209.94.90.1, located in United States and belongs to PROTOCOL, US. The main domain is ipfs.io. The Cisco Umbrella rank of the primary domain is 48658.
TLS certificate: Issued by R3 on March 27th 2023. Valid for: 3 months.
This is the only time ipfs.io was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

IP Address AS Autonomous System
1 2 104.21.86.16 13335 (CLOUDFLAR...)
1 2 209.94.90.1 40680 (PROTOCOL)
4 199.36.158.100 54113 (FASTLY)
1 104.17.25.14 13335 (CLOUDFLAR...)
1 2 103.180.114.1 200325 (BUNNYCDN)
1 13.107.246.71 8068 (MICROSOFT...)
9 6
2    104.21.86.16 (None, )

ASN13335 (CLOUDFLARENET, US)
ironroofrestoration.com.au
2    209.94.90.1 (United States)

ASN40680 (PROTOCOL, US)
ipfs.io
4    199.36.158.100 (United States)

ASN54113 (FASTLY, US)
cdn-jm-tools.web.app
1    104.17.25.14 (None, )

ASN13335 (CLOUDFLARENET, US)
cdnjs.cloudflare.com
2    103.180.114.1 (Australia)

ASN200325 (BUNNYCDN, SI)
ipfs.tech
1    13.107.246.71 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
aadcdn.msauth.net
Apex Domain
Subdomains		 Transfer
4 web.app
cdn-jm-tools.web.app
21 KB
2 ipfs.tech
ipfs.tech — Cisco Umbrella Rank: 164376
658 B
2 ipfs.io
ipfs.io — Cisco Umbrella Rank: 48658
8 KB
2 ironroofrestoration.com.au
ironroofrestoration.com.au
1 KB
1 msauth.net
aadcdn.msauth.net — Cisco Umbrella Rank: 2578
1 KB
1 cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 344
28 KB
9 6
Domain Requested by
4 cdn-jm-tools.web.app ipfs.io
2 ipfs.tech 1 redirects ipfs.io
2 ipfs.io 1 redirects
2 ironroofrestoration.com.au 1 redirects
1 aadcdn.msauth.net ipfs.io
1 cdnjs.cloudflare.com ipfs.io
9 6

This site contains links to these domains. Also see Links.

Domain
login.live.com
Subject Issuer Validity Valid
*.ironroofrestoration.com.au
GTS CA 1P5		 2023-03-04 -
2023-06-02		 3 months crt.sh
*.i.ipfs.io
R3		 2023-03-27 -
2023-06-25		 3 months crt.sh
web.app
GTS CA 1D4		 2023-03-06 -
2023-06-04		 3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2022-08-03 -
2023-08-02		 a year crt.sh
aadcdn.msauth.net
DigiCert SHA2 Secure Server CA		 2023-01-27 -
2024-01-27		 a year crt.sh

This page contains 1 frames:

Primary Page: https://ipfs.io/ipfs/QmZeBa5od8nMG4kfxUvu6h2jthg1xju4W38m9Tx7RiyBg6?filename=supportpost.html
Frame ID: 6D4084CF9E4273D628BCA5617C96F5A3
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Sign in to your Office365 account

Detected technologies

Overall confidence: 100%
Detected patterns
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

9
Requests

89 %
HTTPS

0 %
IPv6

6
Domains

6
Subdomains

6
IPs

3
Countries

58 kB
Transfer

220 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • http://ironroofrestoration.com.au/report/sf_rand_string_mixed(3)/charles.lampe@blefa.com HTTP 301
  • https://ironroofrestoration.com.au/report/sf_rand_string_mixed(3)/charles.lampe@blefa.com
Request Chain 6
  • https://ipfs.io/*https://aadcdn.msauth.net/shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg*/ HTTP 301
  • https://ipfs.tech/*https://aadcdn.msauth.net/shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg*/ HTTP 301
  • https://ipfs.tech/%2Ahttps:/aadcdn.msauth.net/shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg%2A/

9 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
charles.lampe@blefa.com
ironroofrestoration.com.au/report/sf_rand_string_mixed(3)/
Redirect Chain
  • http://ironroofrestoration.com.au/report/sf_rand_string_mixed(3)/charles.lampe@blefa.com
  • https://ironroofrestoration.com.au/report/sf_rand_string_mixed(3)/charles.lampe@blefa.com
0
585 B 		Document
General
Check archive.org
Download Go to
Full URL
https://ironroofrestoration.com.au/report/sf_rand_string_mixed(3)/charles.lampe@blefa.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.21.86.16 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language
en-AU,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
7badb16a1b4baae4-SYD
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Thu, 20 Apr 2023 13:21:54 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
refresh
0;url=https://ipfs.io/ipfs/QmZeBa5od8nMG4kfxUvu6h2jthg1xju4W38m9Tx7RiyBg6?filename=supportpost.html#email=charles.lampe@blefa.com
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vYAgoCZhpW7wDjPB%2B0XMetR12Wit0OpTKZBAuk4xZFuG5hVqkWnsQZRj1Cu5heeYwAgLYjj%2FHw03k7h%2BaUa7yTXyls7WTMTZ%2FOoarviR8X7SH%2FndcORowp30YGVsTN9UlKxkg9zfE1omG5%2FBMw%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare

Redirect headers

CF-RAY
7badb1681cdeaac4-SYD
Cache-Control
max-age=3600
Connection
keep-alive
Date
Thu, 20 Apr 2023 13:21:53 GMT
Expires
Thu, 20 Apr 2023 14:21:53 GMT
Location
https://ironroofrestoration.com.au/report/sf_rand_string_mixed(3)/charles.lampe@blefa.com
NEL
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZJoi7Cq9KmKarB%2BgPKBTsyFuDdw4o37HAXN9E3HhA%2BneMeLFiWduoM6%2F2DVdRjePlKio2%2BkyFYlvkYMCcwO7JiQI0dNvBEbhAv3KdwaBw8Q0cRPnS8uJW97Aigh26WJJ5RzANaHw2vpDyGWvnw%3D%3D"}],"group":"cf-nel","max_age":604800}
Server
cloudflare
Transfer-Encoding
chunked
Vary
Accept-Encoding
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
Primary Request QmZeBa5od8nMG4kfxUvu6h2jthg1xju4W38m9Tx7RiyBg6
ipfs.io/ipfs/ 		26 KB
7 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ipfs.io/ipfs/QmZeBa5od8nMG4kfxUvu6h2jthg1xju4W38m9Tx7RiyBg6?filename=supportpost.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
209.94.90.1 , United States, ASN40680 (PROTOCOL, US),
Reverse DNS
Software
openresty /
Resource Hash
63c00b2d6a926f918730d7ddb9101af150fd9df7389fcc1e4072cb8034028f40
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://ironroofrestoration.com.au/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language
en-AU,en;q=0.9

Response headers

access-control-allow-headers
X-Requested-With, Range, Content-Range, X-Chunked-Output, X-Stream-Output
access-control-allow-methods
GET GET, POST, OPTIONS
access-control-allow-origin
*
access-control-expose-headers
Content-Range, X-Chunked-Output, X-Stream-Output
cache-control
public, max-age=29030400, immutable
content-disposition
inline; filename="supportpost.html"; filename*=UTF-8''supportpost.html
content-encoding
gzip
content-type
text/html
date
Thu, 20 Apr 2023 13:21:55 GMT
etag
W/"QmZeBa5od8nMG4kfxUvu6h2jthg1xju4W38m9Tx7RiyBg6"
server
openresty
strict-transport-security
max-age=31536000; includeSubDomains; preload
timing-allow-origin
*
vary
Accept-Encoding
x-bfid
17d40e212449e89c1a2fa6719b1afbed
x-ipfs-datasize
27043
x-ipfs-gateway-host
ipfs-bank12-sg1
x-ipfs-lb-pop
gateway-bank1-sg1
x-ipfs-path
/ipfs/QmZeBa5od8nMG4kfxUvu6h2jthg1xju4W38m9Tx7RiyBg6
x-ipfs-pop
ipfs-bank12-sg1
x-ipfs-roots
QmZeBa5od8nMG4kfxUvu6h2jthg1xju4W38m9Tx7RiyBg6
x-proxy-cache
HIT
Converged_v21033_U7M7Fc-d_yiO2hIJng7nRg2.css
cdn-jm-tools.web.app/d..p/others/mi..cro---t/ 		100 KB
18 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdn-jm-tools.web.app/d..p/others/mi..cro---t/Converged_v21033_U7M7Fc-d_yiO2hIJng7nRg2.css
Requested by
Host: ipfs.io
URL: https://ipfs.io/ipfs/QmZeBa5od8nMG4kfxUvu6h2jthg1xju4W38m9Tx7RiyBg6?filename=supportpost.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
199.36.158.100 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
30c90ea15ddeec7d675ed3eaaf26e8283b908265c5a6a5ff00345d03c24233f0
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

accept-language
en-AU,en;q=0.9
Referer
https://ipfs.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-served-by
cache-syd10168-SYD
strict-transport-security
max-age=31556926; includeSubDomains; preload
content-encoding
gzip
date
Thu, 20 Apr 2023 13:21:56 GMT
last-modified
Sat, 25 Apr 2020 21:22:54 GMT
x-timer
S1681996916.312568,VS0,VE1
etag
"180ed6b42ce49176e493ebf3f2145e670be96178b9e2f60001e81532e32268cb"
vary
x-fh-requested-host, accept-encoding
x-cache
HIT
content-type
text/css; charset=utf-8
cache-control
max-age=3600
accept-ranges
bytes
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
18705
x-cache-hits
1
jquery.min.js
cdnjs.cloudflare.com/ajax/libs/jquery/3.5.0/ 		87 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/jquery/3.5.0/jquery.min.js
Requested by
Host: ipfs.io
URL: https://ipfs.io/ipfs/QmZeBa5od8nMG4kfxUvu6h2jthg1xju4W38m9Tx7RiyBg6?filename=supportpost.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c4dccdd9ae25b64078e0c73f273de94f8894d5c99e4741645ece29aeefc9c5a4
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

Referer
https://ipfs.io/
Origin
https://ipfs.io
accept-language
en-AU,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date
Thu, 20 Apr 2023 13:21:56 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
2416024
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
27964
last-modified
Mon, 04 May 2020 16:11:48 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03ec4-15d95"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WEeNHbKr3jz%2BX989UZYHJIg9bnB5BODptx9jccHqa7MbzlPLBCrDu4w5iAs1KtkOGYWH3ytCIR4U1QPMoRJsKb4FOf9pCJdXRdw4O6YGhoaweFuox7xB3DDbe3XZQcYK0nlNLD%2BR"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
7badb176f9cfa820-SYD
expires
Tue, 09 Apr 2024 13:21:56 GMT
microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
cdn-jm-tools.web.app/d..p/others/mi..cro---t/ 		4 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn-jm-tools.web.app/d..p/others/mi..cro---t/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
Requested by
Host: ipfs.io
URL: https://ipfs.io/ipfs/QmZeBa5od8nMG4kfxUvu6h2jthg1xju4W38m9Tx7RiyBg6?filename=supportpost.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
199.36.158.100 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

accept-language
en-AU,en;q=0.9
Referer
https://ipfs.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-served-by
cache-syd10168-SYD
strict-transport-security
max-age=31556926; includeSubDomains; preload
content-encoding
br
date
Thu, 20 Apr 2023 13:21:56 GMT
last-modified
Sat, 25 Apr 2020 21:22:54 GMT
x-timer
S1681996916.312869,VS0,VE1
etag
"2084deafc36fbaca40a6352319b3c1edb1262245428033547de6b82e0c2dcfe8-br"
vary
x-fh-requested-host, accept-encoding
x-cache
HIT
content-type
image/svg+xml
cache-control
max-age=3600
accept-ranges
bytes
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
1274
x-cache-hits
1
arrow_left_7cc096da6aa2dba3f81fcc1c8262157c.png
cdn-jm-tools.web.app/d..p/others/mi..cro---t/ 		240 B
357 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn-jm-tools.web.app/d..p/others/mi..cro---t/arrow_left_7cc096da6aa2dba3f81fcc1c8262157c.png
Requested by
Host: ipfs.io
URL: https://ipfs.io/ipfs/QmZeBa5od8nMG4kfxUvu6h2jthg1xju4W38m9Tx7RiyBg6?filename=supportpost.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
199.36.158.100 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
ab50358475adae73a435466c72d1a48ab124e8ae06614663716a46dce5ac8b83
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

accept-language
en-AU,en;q=0.9
Referer
https://ipfs.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-served-by
cache-syd10168-SYD
strict-transport-security
max-age=31556926; includeSubDomains; preload
date
Thu, 20 Apr 2023 13:21:56 GMT
last-modified
Sat, 25 Apr 2020 21:22:54 GMT
x-timer
S1681996916.313159,VS0,VE3
etag
"a512441fed43fc63c5a2bbce213d4081532632f57c75eb60cb7dd0e4a1126b38"
vary
x-fh-requested-host, accept-encoding
x-cache
HIT
content-type
image/png
cache-control
max-age=3600
accept-ranges
bytes
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
240
x-cache-hits
1
ellipsis_grey_2b5d393db04a5e6e1f739cb266e65b4c.svg
cdn-jm-tools.web.app/d..p/others/mi..cro---t/ 		915 B
342 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn-jm-tools.web.app/d..p/others/mi..cro---t/ellipsis_grey_2b5d393db04a5e6e1f739cb266e65b4c.svg
Requested by
Host: ipfs.io
URL: https://ipfs.io/ipfs/QmZeBa5od8nMG4kfxUvu6h2jthg1xju4W38m9Tx7RiyBg6?filename=supportpost.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
199.36.158.100 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
16c3f6531d0fa5b4d16e82abf066233b2a9f284c068c663699313c09f5e8d6e6
Security Headers
Name Value
Strict-Transport-Security max-age=31556926; includeSubDomains; preload

Request headers

accept-language
en-AU,en;q=0.9
Referer
https://ipfs.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-served-by
cache-syd10168-SYD
strict-transport-security
max-age=31556926; includeSubDomains; preload
content-encoding
br
date
Thu, 20 Apr 2023 13:21:56 GMT
last-modified
Sat, 25 Apr 2020 21:22:54 GMT
x-timer
S1681996916.313158,VS0,VE1
etag
"cf034e803491c0dbb1074332cd18fac418b94b0a139a7ddbf92ec40574951a8a-br"
vary
x-fh-requested-host, accept-encoding
x-cache
HIT
content-type
image/svg+xml
cache-control
max-age=3600
accept-ranges
bytes
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
230
x-cache-hits
1
/
ipfs.tech/%2Ahttps:/aadcdn.msauth.net/shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg%2A/
Redirect Chain
  • https://ipfs.io/*https://aadcdn.msauth.net/shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg*/
  • https://ipfs.tech/*https://aadcdn.msauth.net/shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg*/
  • https://ipfs.tech/%2Ahttps:/aadcdn.msauth.net/shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg%2A/
0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ipfs.tech/%2Ahttps:/aadcdn.msauth.net/shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg%2A/
Requested by
Host: ipfs.io
URL: https://ipfs.io/ipfs/QmZeBa5od8nMG4kfxUvu6h2jthg1xju4W38m9Tx7RiyBg6?filename=supportpost.html
Protocol
H2
Server
103.180.114.1 , Australia, ASN200325 (BUNNYCDN, SI),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-AU,en;q=0.9
Referer
https://ipfs.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Redirect headers

date
Thu, 20 Apr 2023 13:21:57 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
content-security-policy
upgrade-insecure-requests
cdn-edgestorageid
890
x-cache-status
HIT
cdn-cachedat
04/20/2023 13:21:57
cdn-pullzone
434994
content-length
144
x-xss-protection
0
x-request-id
f0d1ef801f423201028dc1bbc2ef73e6
referrer-policy
strict-origin-when-cross-origin
server
BunnyCDN-SYD1-890
cdn-proxyver
1.03
cdn-requestpullcode
301
content-type
text/html; charset=utf-8
location
/%2Ahttps:/aadcdn.msauth.net/shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg%2A/
cdn-cache
EXPIRED
cdn-uid
070ccd6e-b4b0-4c90-b45a-e26d7534205d
cache-control
max-age=60, stale-while-revalidate=3600
cdn-requestid
4639507fd9c224f352d4580bce0d137b
cdn-requestcountrycode
AU
cdn-status
301
cdn-requestpullsuccess
True
2_bc3d32a696895f78c19df6c717586a5d.svg
aadcdn.msauth.net/shared/1.0/content/images/backgrounds/ 		2 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://aadcdn.msauth.net/shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg
Requested by
Host: ipfs.io
URL: https://ipfs.io/ipfs/QmZeBa5od8nMG4kfxUvu6h2jthg1xju4W38m9Tx7RiyBg6?filename=supportpost.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
13.107.246.71 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68

Request headers

accept-language
en-AU,en;q=0.9
Referer
https://ipfs.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Thu, 20 Apr 2023 13:21:56 GMT
content-encoding
gzip
x-azure-ref-originshield
0Ep87ZAAAAADvuvo0kR1GQZv1vayy1DVMU1lEMDNFREdFMTgyMgAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY=
content-md5
DhdidjYrlCeaRJJRG/y9mA==
x-cache
TCP_HIT
content-length
673
x-ms-lease-status
unlocked
last-modified
Wed, 12 Feb 2020 22:01:30 GMT
etag
0x8D7B0071D86E386
x-azure-ref
0dTxBZAAAAAAf33RA06euQr5U2rSZC8c2Qk5FMDFFREdFMDgwOQAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY=
content-type
image/svg+xml
access-control-allow-origin
*
x-ms-request-id
40e0b472-401e-0053-3c2e-702946000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless function| $ function| jQuery boolean| first function| submit_form function| continue_function

0 Cookies

3 Console Messages

Source Level URL
Text
javascript warning URL: https://ipfs.io/ipfs/QmZeBa5od8nMG4kfxUvu6h2jthg1xju4W38m9Tx7RiyBg6?filename=supportpost.html
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://cdnjs.cloudflare.com/ajax/libs/jquery/3.5.0/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://ipfs.io/ipfs/QmZeBa5od8nMG4kfxUvu6h2jthg1xju4W38m9Tx7RiyBg6?filename=supportpost.html
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://cdnjs.cloudflare.com/ajax/libs/jquery/3.5.0/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
network error URL: https://ipfs.tech/%2Ahttps:/aadcdn.msauth.net/shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg%2A/
Message:
Failed to load resource: the server responded with a status of 404 ()