bafybeicvygyuizdiv3d3wkzzjyacezugjlqrxzoedo2yyq2iexpstgnizy.ipfs.dweb.link
Open in
urlscan Pro
2602:fea2:2::1
Malicious Activity!
Public Scan
Effective URL: https://bafybeicvygyuizdiv3d3wkzzjyacezugjlqrxzoedo2yyq2iexpstgnizy.ipfs.dweb.link/
Submission: On July 11 via api from JP — Scanned from JP
Summary
TLS certificate: Issued by R3 on June 11th 2023. Valid for: 3 months.
This is the only time bafybeicvygyuizdiv3d3wkzzjyacezugjlqrxzoedo2yyq2iexpstgnizy.ipfs.dweb.link was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: DHL (Transportation)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 54.205.81.162 54.205.81.162 | 14618 (AMAZON-AES) (AMAZON-AES) | |
1 | 2602:fea2:2::1 2602:fea2:2::1 | 40680 (PROTOCOL) (PROTOCOL) | |
2 | 2404:6800:400... 2404:6800:4004:823::200a | 15169 (GOOGLE) (GOOGLE) | |
3 | 2606:4700::68... 2606:4700::6812:bcf | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2606:4700::68... 2606:4700::6811:190e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 18.65.168.90 18.65.168.90 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 2600:140b:500... 2600:140b:5000:988::4b3f | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
1 | 44.194.192.144 44.194.192.144 | 14618 (AMAZON-AES) (AMAZON-AES) | |
1 | 2001:4de0:ac1... 2001:4de0:ac18::1:a:3b | 20446 (STACKPATH...) (STACKPATH-CDN) | |
1 | 2404:6800:400... 2404:6800:4004:811::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 2606:4700::68... 2606:4700::6812:1baa | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
16 | 11 |
ASN14618 (AMAZON-AES, US)
PTR: ec2-54-205-81-162.compute-1.amazonaws.com
bafybeicvygyuizdiv3d3wkzzjyacezugjlqrxzoedo2yyq2iexpstgnizy.ipfs.infura-ipfs.io |
ASN40680 (PROTOCOL, US)
bafybeicvygyuizdiv3d3wkzzjyacezugjlqrxzoedo2yyq2iexpstgnizy.ipfs.dweb.link |
ASN16509 (AMAZON-02, US)
PTR: server-18-65-168-90.nrt57.r.cloudfront.net
prod-cdn.wetransfer.net |
ASN14618 (AMAZON-AES, US)
PTR: ec2-44-194-192-144.compute-1.amazonaws.com
e-10220.adzerk.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
3 |
bootstrapcdn.com
maxcdn.bootstrapcdn.com — Cisco Umbrella Rank: 1032 |
41 KB |
3 |
googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 433 firebasestorage.googleapis.com — Cisco Umbrella Rank: 6807 |
770 KB |
2 |
wetransfer.net
prod-cdn.wetransfer.net — Cisco Umbrella Rank: 42844 |
56 KB |
1 |
ipregistry.co
api.ipregistry.co — Cisco Umbrella Rank: 170895 |
1 KB |
1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 749 |
33 KB |
1 |
adzerk.net
e-10220.adzerk.net — Cisco Umbrella Rank: 37758 |
652 B |
1 |
dhl.com
www.dhl.com — Cisco Umbrella Rank: 44060 |
54 KB |
1 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 274 |
11 KB |
1 |
dweb.link
bafybeicvygyuizdiv3d3wkzzjyacezugjlqrxzoedo2yyq2iexpstgnizy.ipfs.dweb.link |
47 KB |
1 |
infura-ipfs.io
1 redirects
bafybeicvygyuizdiv3d3wkzzjyacezugjlqrxzoedo2yyq2iexpstgnizy.ipfs.infura-ipfs.io |
278 B |
16 | 10 |
Domain | Requested by | |
---|---|---|
3 | maxcdn.bootstrapcdn.com |
bafybeicvygyuizdiv3d3wkzzjyacezugjlqrxzoedo2yyq2iexpstgnizy.ipfs.dweb.link
|
2 | prod-cdn.wetransfer.net |
bafybeicvygyuizdiv3d3wkzzjyacezugjlqrxzoedo2yyq2iexpstgnizy.ipfs.dweb.link
prod-cdn.wetransfer.net |
2 | ajax.googleapis.com |
bafybeicvygyuizdiv3d3wkzzjyacezugjlqrxzoedo2yyq2iexpstgnizy.ipfs.dweb.link
|
1 | api.ipregistry.co |
bafybeicvygyuizdiv3d3wkzzjyacezugjlqrxzoedo2yyq2iexpstgnizy.ipfs.dweb.link
|
1 | firebasestorage.googleapis.com |
bafybeicvygyuizdiv3d3wkzzjyacezugjlqrxzoedo2yyq2iexpstgnizy.ipfs.dweb.link
|
1 | code.jquery.com |
bafybeicvygyuizdiv3d3wkzzjyacezugjlqrxzoedo2yyq2iexpstgnizy.ipfs.dweb.link
|
1 | e-10220.adzerk.net |
bafybeicvygyuizdiv3d3wkzzjyacezugjlqrxzoedo2yyq2iexpstgnizy.ipfs.dweb.link
|
1 | www.dhl.com |
bafybeicvygyuizdiv3d3wkzzjyacezugjlqrxzoedo2yyq2iexpstgnizy.ipfs.dweb.link
|
1 | cdnjs.cloudflare.com |
bafybeicvygyuizdiv3d3wkzzjyacezugjlqrxzoedo2yyq2iexpstgnizy.ipfs.dweb.link
|
1 | bafybeicvygyuizdiv3d3wkzzjyacezugjlqrxzoedo2yyq2iexpstgnizy.ipfs.dweb.link | |
1 | bafybeicvygyuizdiv3d3wkzzjyacezugjlqrxzoedo2yyq2iexpstgnizy.ipfs.infura-ipfs.io | 1 redirects |
16 | 11 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
dweb.link R3 |
2023-06-11 - 2023-09-09 |
3 months | crt.sh |
upload.video.google.com GTS CA 1C3 |
2023-06-19 - 2023-09-11 |
3 months | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2022-12-30 - 2023-12-30 |
a year | crt.sh |
wetransfer.net Amazon RSA 2048 M02 |
2023-02-27 - 2023-09-27 |
7 months | crt.sh |
www.dhl.com DPDHL Global TLS CA - I5 |
2023-04-20 - 2024-04-19 |
a year | crt.sh |
engine.moneymappress.com Amazon RSA 2048 M01 |
2023-07-10 - 2024-08-06 |
a year | crt.sh |
*.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2022-08-03 - 2023-07-14 |
a year | crt.sh |
ipregistry.co Cloudflare Inc ECC CA-3 |
2022-11-02 - 2023-11-02 |
a year | crt.sh |
This page contains 2 frames:
Primary Page:
https://bafybeicvygyuizdiv3d3wkzzjyacezugjlqrxzoedo2yyq2iexpstgnizy.ipfs.dweb.link/
Frame ID: FE22FDBB009E9CF66B2D802E98D7F87A
Requests: 15 HTTP requests in this frame
Frame:
https://firebasestorage.googleapis.com/v0/b/files-89657.appspot.com/o/qfiles%2Fcss%2Flhd.html?alt=media&token=1a550d36-c88b-4167-9286-c48709c4ec18
Frame ID: 163A51B176A893EF3B6C78591FE61A8C
Requests: 2 HTTP requests in this frame
Screenshot
Page Title
Track & Trace Express | DHLPage URL History Show full URLs
-
https://bafybeicvygyuizdiv3d3wkzzjyacezugjlqrxzoedo2yyq2iexpstgnizy.ipfs.infura-ipfs.io/
HTTP 301
https://bafybeicvygyuizdiv3d3wkzzjyacezugjlqrxzoedo2yyq2iexpstgnizy.ipfs.dweb.link/ Page URL
Detected technologies
Bootstrap (Web Frameworks) ExpandDetected patterns
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Font Awesome (Font Scripts) Expand
Detected patterns
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Mautic (Marketing Automation) Expand
Detected patterns
- [^a-z]mtc.*\.js
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://bafybeicvygyuizdiv3d3wkzzjyacezugjlqrxzoedo2yyq2iexpstgnizy.ipfs.infura-ipfs.io/
HTTP 301
https://bafybeicvygyuizdiv3d3wkzzjyacezugjlqrxzoedo2yyq2iexpstgnizy.ipfs.dweb.link/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
16 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
bafybeicvygyuizdiv3d3wkzzjyacezugjlqrxzoedo2yyq2iexpstgnizy.ipfs.dweb.link/ Redirect Chain
|
445 KB 47 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/1.12.4/ |
95 KB 34 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.js
maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/ |
36 KB 11 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
all.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.3/css/ |
58 KB 11 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/ |
118 KB 20 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
application-25ff49de.chunk.css
prod-cdn.wetransfer.net/packs/css/ |
406 KB 55 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wallpaper-a71fc0d7.chunk.css
prod-cdn.wetransfer.net/packs/css/ |
2 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dhl-logo.jpg
www.dhl.com/content/dam/dhl/global/core/images/teaser-image-main/ |
54 KB 54 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
i.gif
e-10220.adzerk.net/ |
43 B 652 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-1.12.0.min.js
code.jquery.com/ |
95 KB 33 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.js
maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/ |
36 KB 10 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.5.1/ |
87 KB 30 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
qfiles%2Fcss%2Flhd.html
firebasestorage.googleapis.com/v0/b/files-89657.appspot.com/o/ Frame 163A |
705 KB 706 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
ActiefGrotesque_W_Regular-1f437876.woff
prod-cdn.wetransfer.net/packs/media/actiefgrotesque/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
ActiefGrotesque_W_Medium-293e86f0.woff
prod-cdn.wetransfer.net/packs/media/actiefgrotesque/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
api.ipregistry.co/ |
2 KB 1 KB |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame 163A |
527 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- prod-cdn.wetransfer.net
- URL
- https://prod-cdn.wetransfer.net/packs/media/actiefgrotesque/ActiefGrotesque_W_Regular-1f437876.woff
- Domain
- prod-cdn.wetransfer.net
- URL
- https://prod-cdn.wetransfer.net/packs/media/actiefgrotesque/ActiefGrotesque_W_Medium-293e86f0.woff
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: DHL (Transportation)11 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 boolean| credentialless object| onbeforetoggle object| onscrollend function| $ function| jQuery object| jQuery112405217006769536086 object| jQuery112004375546092098517 function| p function| T function| g2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
e-10220.adzerk.net/ | Name: azk Value: sp-30e4c573-536f-41c3-b5b3-474592fec12e |
|
e-10220.adzerk.net/ | Name: azk-ss Value: true |
10 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=31536000; includeSubDomains; preload |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
api.ipregistry.co
bafybeicvygyuizdiv3d3wkzzjyacezugjlqrxzoedo2yyq2iexpstgnizy.ipfs.dweb.link
bafybeicvygyuizdiv3d3wkzzjyacezugjlqrxzoedo2yyq2iexpstgnizy.ipfs.infura-ipfs.io
cdnjs.cloudflare.com
code.jquery.com
e-10220.adzerk.net
firebasestorage.googleapis.com
maxcdn.bootstrapcdn.com
prod-cdn.wetransfer.net
www.dhl.com
prod-cdn.wetransfer.net
18.65.168.90
2001:4de0:ac18::1:a:3b
2404:6800:4004:811::200a
2404:6800:4004:823::200a
2600:140b:5000:988::4b3f
2602:fea2:2::1
2606:4700::6811:190e
2606:4700::6812:1baa
2606:4700::6812:bcf
44.194.192.144
54.205.81.162
10014d54e03ca8121cad19cb5556d22e9571ea48ab83ff625abd6658371e96d7
307160c1a9ea716154e406cdf73ba99623840ae546006898023c6988f38da18f
53964478a7c634e8dad34ecc303dd8048d00dce4993906de1bacf67f663486ef
5f1ab65fe2ad6b381a1ae036716475bf78c9b2e309528cf22170c1ddeefddcbf
668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404
80f55b1758b62076fd45ee553aa98601e7bcfacd5d8821fb681c2c50f0135e19
89b802c7508f3bfbe6f62543479645d962ea7387d967e302f2fa2f4c2262df1b
8b24551f3c041157a88f5e489c4c144bb4341215aa0e09a42f78803ad3e491e9
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
b4894174e4ad4a02c49620d8c0d8d76d07d94ea41489fc55b7d7e6ade89d3da4
d82ed9880a42fa5b0dbe8a6804f727f8a1a8598f52b7030b8d2c755bee11ffd6
d87ddf917b7a1449ab45e2b8e3c98354629bdd65b6659c37e6023bbea1ce1386
f75e846cc83bd11432f4b1e21a45f31bc85283d11d372f7b19accd1bf6a2635c
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d