urlscan.io logo urlscan.io
SecurityTrails logo

cloudflare-ipfs.com Open in urlscan Pro
104.17.96.13  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://cloudflare-ipfs.com/ipfs/bafkreigz7uic7hoxg5kcy4o6fudusgvcl5drid6xm4qesnjjcqn6babzp4
Submission: On April 30 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 5 IPs in 2 countries across 6 domains to perform 6 HTTP transactions. The main IP is 104.17.96.13, located in and belongs to CLOUDFLARENET, US. The main domain is cloudflare-ipfs.com.
TLS certificate: Issued by E1 on April 24th 2024. Valid for: 3 months.
This is the only time cloudflare-ipfs.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Email (Online)

Domain & IP information

IP Address AS Autonomous System
1 104.17.96.13 13335 (CLOUDFLAR...)
1 2a04:4e42::649 54113 (FASTLY)
2 192.227.173.31 36352 (AS-COLOCR...)
1 152.199.19.160 15133 (EDGECAST)
6 5
Apex Domain
Subdomains		 Transfer
1 mdclb.co.uk
rec.mdclb.co.uk
395 B
1 aspnetcdn.com
ajax.aspnetcdn.com — Cisco Umbrella Rank: 2492
35 KB
1 kingtony-tw.com
cnrt.kingtony-tw.com
66 KB
1 jquery.com
code.jquery.com — Cisco Umbrella Rank: 767
31 KB
1 cloudflare-ipfs.com
cloudflare-ipfs.com
24 KB
0 clearbit.com Failed
logo.clearbit.com Failed
6 6
Domain Requested by
1 rec.mdclb.co.uk
1 ajax.aspnetcdn.com code.jquery.com
1 cnrt.kingtony-tw.com code.jquery.com
1 code.jquery.com cloudflare-ipfs.com
1 cloudflare-ipfs.com
0 logo.clearbit.com Failed
6 6

This site contains no links.

Subject Issuer Validity Valid
cloudflare-ipfs.com
E1		 2024-04-24 -
2024-07-23		 3 months crt.sh
*.jquery.com
Sectigo RSA Domain Validation Secure Server CA		 2023-07-11 -
2024-07-14		 a year crt.sh
cnrt.kingtony-tw.com
R3		 2024-04-26 -
2024-07-25		 3 months crt.sh
*.vo.msecnd.net
DigiCert SHA2 Secure Server CA		 2024-01-30 -
2025-01-30		 a year crt.sh
rec.mdclb.co.uk
R3		 2024-03-16 -
2024-06-14		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://cloudflare-ipfs.com/ipfs/bafkreigz7uic7hoxg5kcy4o6fudusgvcl5drid6xm4qesnjjcqn6babzp4
Frame ID: 1DD19088B97DC361848AED757DF57D34
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

6
Requests

83 %
HTTPS

25 %
IPv6

6
Domains

6
Subdomains

5
IPs

2
Countries

156 kB
Transfer

414 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request bafkreigz7uic7hoxg5kcy4o6fudusgvcl5drid6xm4qesnjjcqn6babzp4
cloudflare-ipfs.com/ipfs/ 		42 KB
24 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://cloudflare-ipfs.com/ipfs/bafkreigz7uic7hoxg5kcy4o6fudusgvcl5drid6xm4qesnjjcqn6babzp4
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.96.13 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d9fd102f9dd737542c71de2d07491aa25f47140fd76720493529141be080397f

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

access-control-allow-headers
Content-Type Range User-Agent X-Requested-With
access-control-allow-methods
GET
access-control-allow-origin
*
access-control-expose-headers
Content-Length Content-Range X-Chunked-Output X-Ipfs-Path X-Ipfs-Roots X-Stream-Output
age
39214
alt-svc
h3=":443"; ma=86400
cache-control
public, max-age=29030400, immutable
cf-cache-status
HIT
cf-ray
87c9340fa987fc6b-WAW
content-encoding
br
content-type
text/html
date
Tue, 30 Apr 2024 17:20:35 GMT
etag
W/"bafkreigz7uic7hoxg5kcy4o6fudusgvcl5drid6xm4qesnjjcqn6babzp4"
server
cloudflare
vary
Accept-Encoding
x-cf-ipfs-cache-status
hit
x-ipfs-path
/ipfs/bafkreigz7uic7hoxg5kcy4o6fudusgvcl5drid6xm4qesnjjcqn6babzp4
x-ipfs-roots
bafkreigz7uic7hoxg5kcy4o6fudusgvcl5drid6xm4qesnjjcqn6babzp4
jquery-3.6.4.min.js
code.jquery.com/ 		88 KB
31 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/jquery-3.6.4.min.js
Requested by
Host: cloudflare-ipfs.com
URL: https://cloudflare-ipfs.com/ipfs/bafkreigz7uic7hoxg5kcy4o6fudusgvcl5drid6xm4qesnjjcqn6babzp4
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
a0fe8723dcf55da64d06b25446d0a8513e52527c45afcb37073465f9c6f352af

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://cloudflare-ipfs.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 30 Apr 2024 17:20:36 GMT
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
age
19697027
x-cache
HIT, HIT
content-length
31011
x-served-by
cache-lga21953-LGA, cache-cph2320046-CPH
last-modified
Fri, 18 Oct 1991 12:00:00 GMT
server
nginx
x-timer
S1714497636.060506,VS0,VE0
etag
W/"28feccc0-15ec3"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=604800
accept-ranges
bytes
x-cache-hits
141, 6350
truncated
/ 		3 KB
0 		Script
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
085e51981bf54f2f84e954859c8bbe1c35b10877769bebb6f0a4bd7d7980d493

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

Content-Type
application/x-javascript
truncated
/ 		24 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
36409de11df7502c02c6eff4518855604c6a61231afd697b83d4e9e54658ed61

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

Content-Type
image/gif
session.php
cnrt.kingtony-tw.com/POST/ 		66 KB
66 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://cnrt.kingtony-tw.com/POST/session.php
Requested by
Host: code.jquery.com
URL: https://code.jquery.com/jquery-3.6.4.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
192.227.173.31 Buffalo, United States, ASN36352 (AS-COLOCROSSING, US),
Reverse DNS
ovarcicle.com
Software
Apache/2.4.56 (Debian) /
Resource Hash
a2d226166ca91c2ae576ce88d88c8e049fa4305200d2a1f23b15847d285df409

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8
Accept
*/*
Referer
https://cloudflare-ipfs.com/
sec-ch-ua-platform
"Win32"

Response headers

Date
Tue, 30 Apr 2024 17:20:36 GMT
Server
Apache/2.4.56 (Debian)
Transfer-Encoding
chunked
Access-Control-Allow-Methods
GET,POST,PUT,DELETE,OPTIONS
Content-Type
application/json
Access-Control-Allow-Origin
*
Access-Control-Allow-Credentials
true
Connection
Keep-Alive
Access-Control-Allow-Headers
Content-Type,Authorization,X-Requested-With
Keep-Alive
timeout=5, max=100
bootstrap.min.css
ajax.aspnetcdn.com/ajax/bootstrap/4.3.1/css/ 		152 KB
35 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://ajax.aspnetcdn.com/ajax/bootstrap/4.3.1/css/bootstrap.min.css
Requested by
Host: code.jquery.com
URL: https://code.jquery.com/jquery-3.6.4.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.19.160 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (frc/4CE1) /
Resource Hash
60b19e5da6a9234ff9220668a5ec1125c157a268513256188ee80f2d2c8d8d36
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://cloudflare-ipfs.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 30 Apr 2024 17:20:36 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
3158897
x-cache
HIT
content-length
35484
x-xss-protection
1; mode=block
last-modified
Mon, 04 Mar 2019 19:22:27 GMT
server
ECAcc (frc/4CE1)
etag
"bd1f889abfd2d41:0"
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public,max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
truncated
/ 		555 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
93f553f07040ccaa21c9fa7c4ec02e97aff4999acee2bd4bdf9860100a1ea08a

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		15 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
aba082654ed9a884ee14954d8a4085aff721d03989fcc16934f4d03cf6a55229

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

Content-Type
image/png
screen.php
rec.mdclb.co.uk/shot/ 		0
395 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rec.mdclb.co.uk/shot/screen.php?site=
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
192.227.173.31 Buffalo, United States, ASN36352 (AS-COLOCROSSING, US),
Reverse DNS
ovarcicle.com
Software
Apache/2.4.56 (Debian) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://cloudflare-ipfs.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Tue, 30 Apr 2024 17:20:37 GMT
Server
Apache/2.4.56 (Debian)
Access-Control-Allow-Methods
GET,POST,PUT,DELETE,OPTIONS
Content-Type
image/jpeg
Access-Control-Allow-Origin
*
Access-Control-Allow-Credentials
true
Connection
Keep-Alive
Keep-Alive
timeout=5, max=100
Access-Control-Allow-Headers
Content-Type,Authorization,X-Requested-With
Content-Length
0
www.
logo.clearbit.com/ 		0
0
truncated
/ 		24 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
6a6beae164a3397dd506f59af5261bb7662b9344a3225c0f4d7f857f54f4db13

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

Content-Type
image/png

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
logo.clearbit.com
URL
https://logo.clearbit.com/www.

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Email (Online)

14 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery function| _0xecdf function| _0x268bd4 function| _0x456ce6 function| _0x4cf6f7 function| _0x14b72f function| _0x2fae9f function| _0x1019 string| tgc string| url function| myCallback string| mtr string| dri

1 Cookies

Domain/Path Name / Value
cloudflare-ipfs.com/ Name: __cf_bm
Value: 5_VFcuid0W1nBHROA7TvucH9XIGC5R2__G2EConFMgg-1714497635-1.0.1.1-6yT2g5E8QyDTEaX2nuzk.C5DpMlyygywRGcG8z4PI1IIJjHK3iEpbo5aCehLm__mxltYU5IJauVkOzTU5ScTmw

1 Console Messages

Source Level URL
Text
recommendation verbose URL: https://cloudflare-ipfs.com/ipfs/bafkreigz7uic7hoxg5kcy4o6fudusgvcl5drid6xm4qesnjjcqn6babzp4
Message:
[DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o