gateway.ipfs.io
Open in
urlscan Pro
209.94.90.1
Malicious Activity!
Public Scan
Submission: On July 11 via api from JP — Scanned from JP
Summary
TLS certificate: Issued by R3 on June 11th 2023. Valid for: 3 months.
This is the only time gateway.ipfs.io was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: DHL (Transportation)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 209.94.90.1 209.94.90.1 | 40680 (PROTOCOL) (PROTOCOL) | |
3 | 142.251.222.10 142.251.222.10 | 15169 (GOOGLE) (GOOGLE) | |
3 | 104.18.10.207 104.18.10.207 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 104.17.25.14 104.17.25.14 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 18.65.168.90 18.65.168.90 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 104.71.171.95 104.71.171.95 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
1 | 44.194.192.144 44.194.192.144 | 14618 (AMAZON-AES) (AMAZON-AES) | |
1 | 69.16.175.10 69.16.175.10 | 20446 (STACKPATH...) (STACKPATH-CDN) | |
1 | 104.18.26.170 104.18.26.170 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
16 | 10 |
ASN15169 (GOOGLE, US)
PTR: nrt13s71-in-f10.1e100.net
ajax.googleapis.com | |
firebasestorage.googleapis.com |
ASN16509 (AMAZON-02, US)
PTR: server-18-65-168-90.nrt57.r.cloudfront.net
prod-cdn.wetransfer.net |
ASN20940 (AKAMAI-ASN1, NL)
PTR: a104-71-171-95.deploy.static.akamaitechnologies.com
www.dhl.com |
ASN14618 (AMAZON-AES, US)
PTR: ec2-44-194-192-144.compute-1.amazonaws.com
e-10220.adzerk.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
3 |
bootstrapcdn.com
maxcdn.bootstrapcdn.com — Cisco Umbrella Rank: 1032 |
41 KB |
3 |
googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 433 firebasestorage.googleapis.com — Cisco Umbrella Rank: 6807 |
770 KB |
2 |
wetransfer.net
prod-cdn.wetransfer.net — Cisco Umbrella Rank: 42844 |
56 KB |
1 |
ipregistry.co
api.ipregistry.co — Cisco Umbrella Rank: 170895 |
1 KB |
1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 749 |
33 KB |
1 |
adzerk.net
e-10220.adzerk.net — Cisco Umbrella Rank: 37758 |
650 B |
1 |
dhl.com
www.dhl.com — Cisco Umbrella Rank: 44060 |
54 KB |
1 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 274 |
11 KB |
1 |
ipfs.io
gateway.ipfs.io — Cisco Umbrella Rank: 143192 |
47 KB |
16 | 9 |
Domain | Requested by | |
---|---|---|
3 | maxcdn.bootstrapcdn.com |
gateway.ipfs.io
|
2 | prod-cdn.wetransfer.net |
gateway.ipfs.io
prod-cdn.wetransfer.net |
2 | ajax.googleapis.com |
gateway.ipfs.io
|
1 | api.ipregistry.co |
gateway.ipfs.io
|
1 | firebasestorage.googleapis.com |
gateway.ipfs.io
|
1 | code.jquery.com |
gateway.ipfs.io
|
1 | e-10220.adzerk.net |
gateway.ipfs.io
|
1 | www.dhl.com |
gateway.ipfs.io
|
1 | cdnjs.cloudflare.com |
gateway.ipfs.io
|
1 | gateway.ipfs.io | |
16 | 10 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
dweb.link R3 |
2023-06-11 - 2023-09-09 |
3 months | crt.sh |
upload.video.google.com GTS CA 1C3 |
2023-06-19 - 2023-09-11 |
3 months | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2022-12-30 - 2023-12-30 |
a year | crt.sh |
wetransfer.net Amazon RSA 2048 M02 |
2023-02-27 - 2023-09-27 |
7 months | crt.sh |
www.dhl.com DPDHL Global TLS CA - I5 |
2023-04-20 - 2024-04-19 |
a year | crt.sh |
engine.moneymappress.com Amazon RSA 2048 M01 |
2023-07-10 - 2024-08-06 |
a year | crt.sh |
*.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2022-08-03 - 2023-07-14 |
a year | crt.sh |
ipregistry.co Cloudflare Inc ECC CA-3 |
2022-11-02 - 2023-11-02 |
a year | crt.sh |
This page contains 2 frames:
Primary Page:
https://gateway.ipfs.io/ipfs/bafybeicvygyuizdiv3d3wkzzjyacezugjlqrxzoedo2yyq2iexpstgnizy
Frame ID: DA9C9C3E3804C728196B598665EA3360
Requests: 15 HTTP requests in this frame
Frame:
https://firebasestorage.googleapis.com/v0/b/files-89657.appspot.com/o/qfiles%2Fcss%2Flhd.html?alt=media&token=1a550d36-c88b-4167-9286-c48709c4ec18
Frame ID: 6F18B8C1915FC22305BF9384657797E9
Requests: 2 HTTP requests in this frame
Screenshot
Page Title
Track & Trace Express | DHLDetected technologies
Bootstrap (Web Frameworks) ExpandDetected patterns
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Font Awesome (Font Scripts) Expand
Detected patterns
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Mautic (Marketing Automation) Expand
Detected patterns
- [^a-z]mtc.*\.js
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
16 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
bafybeicvygyuizdiv3d3wkzzjyacezugjlqrxzoedo2yyq2iexpstgnizy
gateway.ipfs.io/ipfs/ |
445 KB 47 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/1.12.4/ |
95 KB 33 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.js
maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/ |
36 KB 11 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
all.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.3/css/ |
58 KB 11 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/ |
118 KB 20 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
application-25ff49de.chunk.css
prod-cdn.wetransfer.net/packs/css/ |
406 KB 55 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wallpaper-a71fc0d7.chunk.css
prod-cdn.wetransfer.net/packs/css/ |
2 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dhl-logo.jpg
www.dhl.com/content/dam/dhl/global/core/images/teaser-image-main/ |
54 KB 54 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
i.gif
e-10220.adzerk.net/ |
43 B 650 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-1.12.0.min.js
code.jquery.com/ |
95 KB 33 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.js
maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/ |
36 KB 10 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.5.1/ |
87 KB 31 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
qfiles%2Fcss%2Flhd.html
firebasestorage.googleapis.com/v0/b/files-89657.appspot.com/o/ Frame 6F18 |
705 KB 706 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
ActiefGrotesque_W_Regular-1f437876.woff
prod-cdn.wetransfer.net/packs/media/actiefgrotesque/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
ActiefGrotesque_W_Medium-293e86f0.woff
prod-cdn.wetransfer.net/packs/media/actiefgrotesque/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
api.ipregistry.co/ |
2 KB 1 KB |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame 6F18 |
527 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- prod-cdn.wetransfer.net
- URL
- https://prod-cdn.wetransfer.net/packs/media/actiefgrotesque/ActiefGrotesque_W_Regular-1f437876.woff
- Domain
- prod-cdn.wetransfer.net
- URL
- https://prod-cdn.wetransfer.net/packs/media/actiefgrotesque/ActiefGrotesque_W_Medium-293e86f0.woff
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: DHL (Transportation)11 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 boolean| credentialless object| onbeforetoggle object| onscrollend function| $ function| jQuery object| jQuery1124010640819139546198 object| jQuery112002770619104724259 function| p function| T function| g2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
e-10220.adzerk.net/ | Name: azk Value: sp-30e4c573-536f-41c3-b5b3-474592fec12e |
|
e-10220.adzerk.net/ | Name: azk-ss Value: true |
10 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=31536000; includeSubDomains; preload |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
api.ipregistry.co
cdnjs.cloudflare.com
code.jquery.com
e-10220.adzerk.net
firebasestorage.googleapis.com
gateway.ipfs.io
maxcdn.bootstrapcdn.com
prod-cdn.wetransfer.net
www.dhl.com
prod-cdn.wetransfer.net
104.17.25.14
104.18.10.207
104.18.26.170
104.71.171.95
142.251.222.10
18.65.168.90
209.94.90.1
44.194.192.144
69.16.175.10
10014d54e03ca8121cad19cb5556d22e9571ea48ab83ff625abd6658371e96d7
307160c1a9ea716154e406cdf73ba99623840ae546006898023c6988f38da18f
53964478a7c634e8dad34ecc303dd8048d00dce4993906de1bacf67f663486ef
5f1ab65fe2ad6b381a1ae036716475bf78c9b2e309528cf22170c1ddeefddcbf
668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404
80f55b1758b62076fd45ee553aa98601e7bcfacd5d8821fb681c2c50f0135e19
8b232eb37b026089f2de8c30736b2b55e109a90fda3742fdfee46ec352017f75
8b24551f3c041157a88f5e489c4c144bb4341215aa0e09a42f78803ad3e491e9
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
b4894174e4ad4a02c49620d8c0d8d76d07d94ea41489fc55b7d7e6ade89d3da4
d82ed9880a42fa5b0dbe8a6804f727f8a1a8598f52b7030b8d2c755bee11ffd6
d87ddf917b7a1449ab45e2b8e3c98354629bdd65b6659c37e6023bbea1ce1386
f75e846cc83bd11432f4b1e21a45f31bc85283d11d372f7b19accd1bf6a2635c
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d