urlscan.io logo urlscan.io
SecurityTrails logo

ipfs.io Open in urlscan Pro
209.94.90.1  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://cloudflare-ipfs.com/ipfs/bafkreibm2c232v5uuz7vkxcdkwdjye6oaoasxg5zkye7y3oyodm6olulou
Effective URL: https://ipfs.io/ipfs/bafkreibm2c232v5uuz7vkxcdkwdjye6oaoasxg5zkye7y3oyodm6olulou
Submission: On May 17 via api from LU — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 5 IPs in 3 countries across 6 domains to perform 7 HTTP transactions. The main IP is 209.94.90.1, located in United States and belongs to PROTOCOL, US. The main domain is ipfs.io. The Cisco Umbrella rank of the primary domain is 65949.
TLS certificate: Issued by GTS CA 1P5 on April 16th 2024. Valid for: 3 months.
This is the only time ipfs.io was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

IP Address AS Autonomous System
1 1 104.17.96.13 13335 (CLOUDFLAR...)
1 209.94.90.1 40680 (PROTOCOL)
1 104.17.25.14 13335 (CLOUDFLAR...)
1 2a04:4e42:600... 54113 (FASTLY)
2 2a00:1450:400... 15169 (GOOGLE)
7 5
1    104.17.96.13 (None, )

ASN13335 (CLOUDFLARENET, US)
cloudflare-ipfs.com
1    209.94.90.1 (United States)

ASN40680 (PROTOCOL, US)
ipfs.io
1    104.17.25.14 (None, )

ASN13335 (CLOUDFLARENET, US)
cdnjs.cloudflare.com
1    2a04:4e42:600::649 (United States)

ASN54113 (FASTLY, US)
code.jquery.com
2    2a00:1450:4001:812::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
lh3.googleusercontent.com
Apex Domain
Subdomains		 Transfer
2 googleusercontent.com
lh3.googleusercontent.com — Cisco Umbrella Rank: 44
193 KB
1 jquery.com
code.jquery.com — Cisco Umbrella Rank: 776
78 KB
1 cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 237
14 KB
1 ipfs.io
ipfs.io — Cisco Umbrella Rank: 65949
37 KB
1 cloudflare-ipfs.com
cloudflare-ipfs.com
399 B
0 lkalzzop.online Failed
lkalzzop.online Failed
7 6
Domain Requested by
2 lh3.googleusercontent.com
1 code.jquery.com ipfs.io
1 cdnjs.cloudflare.com ipfs.io
1 ipfs.io
1 cloudflare-ipfs.com 1 redirects
0 lkalzzop.online Failed code.jquery.com
7 6

This site contains no links.

Subject Issuer Validity Valid
ipfs.io
GTS CA 1P5		 2024-04-16 -
2024-07-15		 3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2023-07-03 -
2024-07-02		 a year crt.sh
*.jquery.com
Sectigo RSA Domain Validation Secure Server CA		 2023-07-11 -
2024-07-14		 a year crt.sh
*.googleusercontent.com
WR2		 2024-05-06 -
2024-07-29		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://ipfs.io/ipfs/bafkreibm2c232v5uuz7vkxcdkwdjye6oaoasxg5zkye7y3oyodm6olulou
Frame ID: 47CC786984FA206E5ED902D08466AAE8
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://cloudflare-ipfs.com/ipfs/bafkreibm2c232v5uuz7vkxcdkwdjye6oaoasxg5zkye7y3oyodm6olulou HTTP 302
    https://ipfs.io/ipfs/bafkreibm2c232v5uuz7vkxcdkwdjye6oaoasxg5zkye7y3oyodm6olulou Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

7
Requests

71 %
HTTPS

40 %
IPv6

6
Domains

6
Subdomains

5
IPs

3
Countries

323 kB
Transfer

555 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://cloudflare-ipfs.com/ipfs/bafkreibm2c232v5uuz7vkxcdkwdjye6oaoasxg5zkye7y3oyodm6olulou HTTP 302
    https://ipfs.io/ipfs/bafkreibm2c232v5uuz7vkxcdkwdjye6oaoasxg5zkye7y3oyodm6olulou Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request bafkreibm2c232v5uuz7vkxcdkwdjye6oaoasxg5zkye7y3oyodm6olulou
ipfs.io/ipfs/
Redirect Chain
  • https://cloudflare-ipfs.com/ipfs/bafkreibm2c232v5uuz7vkxcdkwdjye6oaoasxg5zkye7y3oyodm6olulou
  • https://ipfs.io/ipfs/bafkreibm2c232v5uuz7vkxcdkwdjye6oaoasxg5zkye7y3oyodm6olulou
53 KB
37 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ipfs.io/ipfs/bafkreibm2c232v5uuz7vkxcdkwdjye6oaoasxg5zkye7y3oyodm6olulou
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
209.94.90.1 , United States, ASN40680 (PROTOCOL, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2cd0b5bd57b4a67f555c4355869c13ce03812b9bb95609fc6dd870d9e72e8b75

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

access-control-allow-headers
Content-Type Range User-Agent X-Requested-With
access-control-allow-methods
GET HEAD OPTIONS
access-control-allow-origin
*
access-control-expose-headers
Content-Length Content-Range X-Chunked-Output X-Ipfs-Path X-Ipfs-Roots X-Stream-Output
alt-svc
h3=":443"; ma=86400
cache-control
public, max-age=29030400, immutable
cf-cache-status
MISS
cf-ray
8851c2c45ff34522-TXL
content-encoding
br
content-type
text/html
date
Fri, 17 May 2024 07:05:44 GMT
server
cloudflare
vary
Accept-Encoding
x-ipfs-path
/ipfs/bafkreibm2c232v5uuz7vkxcdkwdjye6oaoasxg5zkye7y3oyodm6olulou
x-ipfs-pop
rainbow-fr2-03
x-ipfs-roots
bafkreibm2c232v5uuz7vkxcdkwdjye6oaoasxg5zkye7y3oyodm6olulou

Redirect headers

alt-svc
h3=":443"; ma=86400
cf-ray
8851c2c39c6c3533-WAW
content-length
0
date
Fri, 17 May 2024 07:05:44 GMT
location
https://ipfs.io/ipfs/bafkreibm2c232v5uuz7vkxcdkwdjye6oaoasxg5zkye7y3oyodm6olulou
server
cloudflare
vary
Accept-Encoding
crypto-js.min.js
cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/ 		47 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js
Requested by
Host: ipfs.io
URL: https://ipfs.io/ipfs/bafkreibm2c232v5uuz7vkxcdkwdjye6oaoasxg5zkye7y3oyodm6olulou
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8e3b0117f4df4be452c0b6af5b8f0a0acf9d4ade23d08d55d7e312af22077762
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://ipfs.io/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 17 May 2024 07:05:44 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
21564
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
13972
last-modified
Sat, 14 Aug 2021 20:33:09 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"61182885-3694"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=krzzM9C080fL5ZdAtKjfzKOTiOGApN5vZbrxvAvariksq5UzsoEBSvPgle9rEvfDaQtoBs19Mj3GMKBy5RxBAAH%2FqX9YVm%2BklBYDYII%2BoJ4vU5NZUHOgtD5MH%2FhEwVIXmtn4x6A9"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
8851c2c5aa11a06d-FRA
expires
Wed, 07 May 2025 07:05:44 GMT
jquery-1.9.1.js
code.jquery.com/ 		262 KB
78 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/jquery-1.9.1.js
Requested by
Host: ipfs.io
URL: https://ipfs.io/ipfs/bafkreibm2c232v5uuz7vkxcdkwdjye6oaoasxg5zkye7y3oyodm6olulou
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:600::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
7bd80d06c01c0340c1b9159b9b4a197db882ca18cbac8e9b9aa025e68f998d40

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://ipfs.io/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 17 May 2024 07:05:44 GMT
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
age
10505405
x-cache
HIT, HIT
content-length
79506
x-served-by
cache-lga21952-LGA, cache-mxp6970-MXP
last-modified
Fri, 18 Oct 1991 12:00:00 GMT
server
nginx
x-timer
S1715929545.812968,VS0,VE0
etag
W/"28feccc0-4185d"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=604800
accept-ranges
bytes
x-cache-hits
6, 2079
AJFCJaXhZo6cUCNh1ssNQzSV3jc1ppd5Vt2HN5GjHL82rJR25OrOigrMWVvBpwQN6BD4T_qHdwh2spOZ9bKA-BqcHsttYMUy5sxc-E99nKe9pgDJsCX0icydpRhjm97W_S4_6cism2sTCOp-Oxa807yjCEw=w1580-h720-s-no
lh3.googleusercontent.com/pw/ 		192 KB
193 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lh3.googleusercontent.com/pw/AJFCJaXhZo6cUCNh1ssNQzSV3jc1ppd5Vt2HN5GjHL82rJR25OrOigrMWVvBpwQN6BD4T_qHdwh2spOZ9bKA-BqcHsttYMUy5sxc-E99nKe9pgDJsCX0icydpRhjm97W_S4_6cism2sTCOp-Oxa807yjCEw=w1580-h720-s-no?authuser=0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
fife /
Resource Hash
c51ecfdbb39612d629bbbfa57896c63dc52971d7bcf78f1795944be16274a8eb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://ipfs.io/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 17 May 2024 07:05:45 GMT
x-content-type-options
nosniff
server
fife
etag
"v51"
vary
Origin
content-type
image/gif
access-control-expose-headers
Content-Length
cache-control
private, max-age=86400, no-transform
cross-origin-resource-policy
cross-origin
content-disposition
inline;filename="Flashback - Jul 5, 2023 00_04_12.gif"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
197044
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
AMWts8CjWLE-4lSHnzZVyyi38RiG_iHUev92wvk3GXVlZur4_v68tJc5TxPcsfc6Vo4P2_Sa5_Dg4wBjO9x0q0xYFQKyjpg1zURhvOLxyPhDhPJg_Z8XDFduSWtavIhhZp_z9dX4zrOp2jk9GCWUmL_6qus=s128-no
lh3.googleusercontent.com/pw/ 		330 B
439 B 		Other
General
Check archive.org
Download Go to
Full URL
https://lh3.googleusercontent.com/pw/AMWts8CjWLE-4lSHnzZVyyi38RiG_iHUev92wvk3GXVlZur4_v68tJc5TxPcsfc6Vo4P2_Sa5_Dg4wBjO9x0q0xYFQKyjpg1zURhvOLxyPhDhPJg_Z8XDFduSWtavIhhZp_z9dX4zrOp2jk9GCWUmL_6qus=s128-no
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
fife /
Resource Hash
fea8fbaec75213e1af8005edfcdc94e7b5d7dca6ddb4e262d66e4756bda96d54
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://ipfs.io/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 17 May 2024 07:05:45 GMT
x-content-type-options
nosniff
server
fife
etag
"v30"
vary
Origin
content-type
image/png
access-control-expose-headers
Content-Length
cache-control
private, max-age=86400, no-transform
cross-origin-resource-policy
cross-origin
content-disposition
inline;filename="logo-off-1.png"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
330
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
lkalzzop.online/obufsssssssscaaatoion/ 		0
0
/
lkalzzop.online/obufsssssssscaaatoion/ 		0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
lkalzzop.online
URL
https://lkalzzop.online/obufsssssssscaaatoion/
Domain
lkalzzop.online
URL
https://lkalzzop.online/obufsssssssscaaatoion/

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

179 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

string| qZsSJgnc string| lBNsGmBy string| zGEdjYUv string| LJxKjxaY string| KYAptAAP string| jMibdcEs string| suPRoGcK string| ixMJpeEC string| ECcRrTJC string| ahtEleqp string| bgzoYMjz string| npgKdDQm string| zrjtdxJU string| fSjvoera string| oxXnvCpa string| AUgjVzhw string| qyKxObmD string| KnhFTHlE string| NPItyAGV string| fvmtpzph string| cbDeidAs string| iEkqhhcx string| dboECRVR string| IAnaDrxS string| zxKsklID string| CViEzYka string| KPkadVmX string| oCXMUjeR string| FtaWPKpJ string| ssdFgNMW string| VqktlAvL string| kQDZeJiI string| cLcmoFuk string| HgEbORLT string| nBBQgakS string| muKEdgQd string| vWCrFyVh string| RQhxuoaP string| jVXTkgok string| cATVutzE string| EJuMgxuN string| lDIpJHiZ string| TSJXmkqW string| MaYGtvso string| aczEfIGE string| KtYmQHix string| hGuDdxOZ string| FDvQssGF string| jSnYmSmY string| VHeXsuHZ string| mSdihrGP string| FfPAhBtW string| QWDmNbLY string| yEzoECPa string| fIDlQkQI string| OyGOtrdg string| cDmagkZP string| QNOupwJa string| KMiaapuc string| QkZYExOL string| MOrRrUZV string| DiNvOWtH string| hWbDPENw string| jYHvpdDk string| yMfBTaPG string| jteYCvuh string| XkRwcNfw string| FwlJttaO string| WwuYOAJP string| aKrDYLXj string| hsxGtugE string| TSEDznVu string| ilfHaImf string| lsBKnuxf string| ZMQdiDEP string| ugoYPsJV string| pMxzFnyh string| teZjDjzv string| dCfHGYzF string| AoEkUnhg string| gHaROQXM string| FgZbxeLK string| XxPzVewd string| ztXLZBUj string| AZUAYIMl string| TiFKSzPK string| AqjIehIm string| GNemgELh string| CvwXDbqS string| BZZMpDIr string| cfczCWxw string| qhZEQULk string| zAJuZYwg string| NAAGQoiY string| FqvqaywW string| fAYgjVRU string| IwPjxEJh string| fwDUccCZ string| dVXweQVt string| unkPxWaN string| BdsqvoEx string| rKUhzdoP string| fiUlEfBz string| doiRQGkX string| bLAiqJbi string| MCVjdgJw string| kRGkotZf string| QoPnWzFI string| iMXPZfnf string| oCNIMcOG string| CRxkepCo string| MdQrHXKw string| ZVfsGbbC string| ULlkqrvL string| xHEyLziy string| VHPNYGbb string| OHIvUvUG string| gxkfewbh string| qTbwHgxi string| GtGcoMnY string| VICFKVfV string| amfxlaFl string| ekcrcjnp string| kUzTQGDC string| uZAQRZdi string| lWtRChyw string| PFjqVkEk string| sTAzEhLp string| ZhqAIzkz string| EHBJFjPW string| ZKJblsDi string| tYsanmEI string| iZfTfdRy string| UYuFxvAN string| KnLqPQlc string| SMyMkpgo string| zaJESPiw object| CryptoJS object| decrypted object| key function| _0x5abe function| _0x2d89 function| _0x4e9d43 function| _0x467682 function| _0x165ef8 function| _0x20a158 function| _0x2ae76a function| _0x2679ad function| _0xd3a34e function| _0x3652d2 function| _0x4ab35d function| _0x3b8393 function| _0x81fec4 function| _0xbdfda4 function| _0x1623b4 function| _0x5381eb function| _0x58a1db function| _0xcce77b function| _0x59056c function| _0x308d3f function| _0x623da6 function| _0x158ffa function| _0x14ec81 function| _0xd41309 function| _0x31bde4 function| _0x919ad0 function| _0x2dbb38 function| _0x523505 function| _0xb17d5e function| _0x3b6124 object| _0x5435 string| IGOBZL string| cbbg string| kaka90nal string| ka45k459final2 string| kak0011afinal number| countttingerr function| $ function| jQuery

1 Cookies

Domain/Path Name / Value
cloudflare-ipfs.com/ Name: __cf_bm
Value: QWsYVsfvtb1NKbActttpmnep8MSIC7aomIvMmh7sxDE-1715929544-1.0.1.1-4n33NvIKld3qBUo2JE4qVG7zoJj7.41fJL_TuwFNtKaHpJqgF12j.zTvxqpgs7XG_KK7LgGnN9vqI3V0lQof3w

4 Console Messages

Source Level URL
Text
javascript warning URL: https://ipfs.io/ipfs/bafkreibm2c232v5uuz7vkxcdkwdjye6oaoasxg5zkye7y3oyodm6olulou(Line 5)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://ipfs.io/ipfs/bafkreibm2c232v5uuz7vkxcdkwdjye6oaoasxg5zkye7y3oyodm6olulou(Line 5)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
network error URL: https://lkalzzop.online/obufsssssssscaaatoion/
Message:
Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network error URL: https://lkalzzop.online/obufsssssssscaaatoion/
Message:
Failed to load resource: net::ERR_NAME_NOT_RESOLVED