![](/screenshots/a16a43de-d8ab-4edb-aa16-c6e02cfa4e16.png)
bafkreicqqienrfhwmi7xcurlyo7k3cst7jtzeddbwpssy6gotghl7lmn7u.ipfs.dweb.link
Open in
urlscan Pro
2602:fea2:2::2
Malicious Activity!
Public Scan
Effective URL: https://bafkreicqqienrfhwmi7xcurlyo7k3cst7jtzeddbwpssy6gotghl7lmn7u.ipfs.dweb.link/
Submission Tags: falconsandbox
Submission: On August 23 via api from US — Scanned from DE
Summary
TLS certificate: Issued by E5 on August 12th 2024. Valid for: 3 months.
This is the only time bafkreicqqienrfhwmi7xcurlyo7k3cst7jtzeddbwpssy6gotghl7lmn7u.ipfs.dweb.link was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 2602:fea2:2::2 2602:fea2:2::2 | 40680 (PROTOCOL) (PROTOCOL) | |
1 | 2606:4700::68... 2606:4700::6811:180e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a04:4e42::649 2a04:4e42::649 | 54113 (FASTLY) (FASTLY) | |
2 | 2a00:1450:400... 2a00:1450:4001:81d::2001 | 15169 (GOOGLE) (GOOGLE) | |
9 | 5 |
ASN40680 (PROTOCOL, US)
bafkreicqqienrfhwmi7xcurlyo7k3cst7jtzeddbwpssy6gotghl7lmn7u.ipfs.dweb.link |
ASN15169 (GOOGLE, US)
lh3.googleusercontent.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
2 |
googleusercontent.com
lh3.googleusercontent.com — Cisco Umbrella Rank: 129 |
193 KB |
1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 1211 |
78 KB |
1 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 336 |
14 KB |
1 |
dweb.link
bafkreicqqienrfhwmi7xcurlyo7k3cst7jtzeddbwpssy6gotghl7lmn7u.ipfs.dweb.link |
38 KB |
0 |
kfakaaag.top
Failed
kfakaaag.top Failed |
|
0 |
kgkagkgaga.ws
Failed
kgkagkgaga.ws Failed |
|
9 | 6 |
Domain | Requested by | |
---|---|---|
2 | lh3.googleusercontent.com | |
1 | code.jquery.com |
bafkreicqqienrfhwmi7xcurlyo7k3cst7jtzeddbwpssy6gotghl7lmn7u.ipfs.dweb.link
|
1 | cdnjs.cloudflare.com |
bafkreicqqienrfhwmi7xcurlyo7k3cst7jtzeddbwpssy6gotghl7lmn7u.ipfs.dweb.link
|
1 | bafkreicqqienrfhwmi7xcurlyo7k3cst7jtzeddbwpssy6gotghl7lmn7u.ipfs.dweb.link | |
0 | kfakaaag.top Failed |
code.jquery.com
|
0 | kgkagkgaga.ws Failed |
code.jquery.com
|
9 | 6 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
dweb.link E5 |
2024-08-12 - 2024-11-10 |
3 months | crt.sh |
cdnjs.cloudflare.com WE1 |
2024-07-31 - 2024-10-29 |
3 months | crt.sh |
*.jquery.com Sectigo ECC Domain Validation Secure Server CA |
2024-06-25 - 2025-06-25 |
a year | crt.sh |
*.googleusercontent.com WR2 |
2024-07-30 - 2024-10-22 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://bafkreicqqienrfhwmi7xcurlyo7k3cst7jtzeddbwpssy6gotghl7lmn7u.ipfs.dweb.link/
Frame ID: 09443E86BA410A65A2674E48FE3C549A
Requests: 9 HTTP requests in this frame
Screenshot
![](/screenshots/a16a43de-d8ab-4edb-aa16-c6e02cfa4e16.png)
Page URL History Show full URLs
-
http://bafkreicqqienrfhwmi7xcurlyo7k3cst7jtzeddbwpssy6gotghl7lmn7u.ipfs.dweb.link/
HTTP 307
https://bafkreicqqienrfhwmi7xcurlyo7k3cst7jtzeddbwpssy6gotghl7lmn7u.ipfs.dweb.link/ Page URL
Detected technologies
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://bafkreicqqienrfhwmi7xcurlyo7k3cst7jtzeddbwpssy6gotghl7lmn7u.ipfs.dweb.link/
HTTP 307
https://bafkreicqqienrfhwmi7xcurlyo7k3cst7jtzeddbwpssy6gotghl7lmn7u.ipfs.dweb.link/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
9 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
bafkreicqqienrfhwmi7xcurlyo7k3cst7jtzeddbwpssy6gotghl7lmn7u.ipfs.dweb.link/ Redirect Chain
|
53 KB 38 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
crypto-js.min.js
cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/ |
47 KB 14 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-1.9.1.js
code.jquery.com/ |
262 KB 78 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
AJFCJaXhZo6cUCNh1ssNQzSV3jc1ppd5Vt2HN5GjHL82rJR25OrOigrMWVvBpwQN6BD4T_qHdwh2spOZ9bKA-BqcHsttYMUy5sxc-E99nKe9pgDJsCX0icydpRhjm97W_S4_6cism2sTCOp-Oxa807yjCEw=w1580-h720-s-no
lh3.googleusercontent.com/pw/ |
192 KB 193 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
AMWts8CjWLE-4lSHnzZVyyi38RiG_iHUev92wvk3GXVlZur4_v68tJc5TxPcsfc6Vo4P2_Sa5_Dg4wBjO9x0q0xYFQKyjpg1zURhvOLxyPhDhPJg_Z8XDFduSWtavIhhZp_z9dX4zrOp2jk9GCWUmL_6qus=s128-no
lh3.googleusercontent.com/pw/ |
330 B 646 B |
Other
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST |
/
kgkagkgaga.ws/obufsssssssscaaatoion/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
POST |
/
kgkagkgaga.ws/obufsssssssscaaatoion/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
POST |
/
kfakaaag.top/obufsssssssscaaatoion/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
POST |
/
kfakaaag.top/obufsssssssscaaatoion/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- kgkagkgaga.ws
- URL
- https://kgkagkgaga.ws/obufsssssssscaaatoion/
- Domain
- kgkagkgaga.ws
- URL
- https://kgkagkgaga.ws/obufsssssssscaaatoion/
- Domain
- kfakaaag.top
- URL
- https://kfakaaag.top/obufsssssssscaaatoion/
- Domain
- kfakaaag.top
- URL
- https://kfakaaag.top/obufsssssssscaaatoion/
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)150 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| CryptoJS object| decrypted object| key function| _0x249f78 function| _0xec2024 function| _0x50d663 function| _0xcbc3ae function| _0x40e63f function| _0x534dbf function| _0x22bea5 function| _0x5a7241 function| _0x1e46f6 function| _0x183e01 function| _0x250359 function| _0x2922e9 function| _0x264550 function| _0x28ce68 function| _0x28e7cc function| _0x5ad4d6 function| _0x1f8fab function| _0x2813f8 function| _0x1b7cf1 function| _0xe4442f function| _0x27f572 function| _0x41bda7 function| _0x1df266 function| _0x18cb69 function| _0x2be46d function| _0x5910eb function| _0x476016 function| _0x3d2725 function| _0x45ad75 function| _0x3ffdd0 function| _0x4a8973 function| _0x585832 function| _0x29b338 function| _0x340ee8 function| _0x57ed81 function| _0x4ac5f9 function| _0x557a31 function| _0x4e6998 function| _0x2f70e6 function| _0x3296af function| _0x3c4143 function| _0x37678f function| _0x320401 function| _0x25c296 function| _0x1811ea function| _0x4a88f5 function| _0x40fe7f function| _0xead57e function| _0x3e9847 function| _0x49d5e2 function| _0x6a439a function| _0x712ba4 function| _0x198323 function| _0x3ded7c function| _0x2b4466 function| _0x5f16bb function| _0x2a875e function| _0x30b5bb function| _0x577995 function| _0x3936dc function| _0x277256 function| _0x206517 function| _0x19bb17 function| _0x5baa0c function| _0x125791 function| _0x2a7381 function| _0x416364 function| _0x1a85b2 function| _0x4f2914 function| _0x3a559d function| _0x555414 function| _0x57e1be function| _0x2b42cd function| _0x5a525f function| _0x3f9bae function| _0x5b55ec function| _0x37569f function| _0x2c7519 function| _0x1be764 function| _0x50c9eb function| _0x47d73b function| _0x110f6d function| _0x28c3ad function| _0x1934ac function| _0x393e90 function| _0x78ba70 function| _0x585164 function| _0x192434 function| _0x39c91a function| _0x1bc8d6 function| _0x60657b function| _0x10419f function| _0x22fd8b function| _0x4ad562 function| _0x5cd58b function| _0x5385a0 function| _0x3b1a67 function| _0x4c72ce function| _0x5d13d0 function| _0x224a01 function| _0x5e95b4 function| _0x395b26 function| _0x4d13c1 function| _0x3d08b1 function| _0x308694 function| _0x1bf46d function| _0x4e91ae function| _0x31e76f function| _0x497844 function| _0x413e04 function| _0x4e87a5 function| _0xfb547b function| _0x4eaadd function| _0x34e156 function| _0x5dee51 function| _0x59571d function| _0x1d4ad1 function| _0x2020d5 function| _0x5eae87 function| _0x188b3b function| _0x4b8f85 function| _0x57a1f1 function| _0x14a71d function| _0x249ba0 function| _0x4ffbd7 function| _0x36c4cf function| _0xb05753 function| _0xa584b2 function| _0x4fdda7 function| _0x58d4a9 function| _0x41729d function| _0x4805da function| _0x1a4674 function| _0x1a8359 function| _0x3bd378 function| _0x219df0 function| _0x58d28e function| _0x26c4 function| _0x494f object| _0xd876 string| IGOBZL string| kaka90nal string| ka45k459final2 string| kak0011afinal number| countttingerr function| $ function| jQuery0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
6 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
bafkreicqqienrfhwmi7xcurlyo7k3cst7jtzeddbwpssy6gotghl7lmn7u.ipfs.dweb.link
cdnjs.cloudflare.com
code.jquery.com
kfakaaag.top
kgkagkgaga.ws
lh3.googleusercontent.com
kfakaaag.top
kgkagkgaga.ws
2602:fea2:2::2
2606:4700::6811:180e
2a00:1450:4001:81d::2001
2a04:4e42::649
508208d894f6623f71522bc3bead8a53fa67920c61b3e52c78ce998ebfad8dfd
7bd80d06c01c0340c1b9159b9b4a197db882ca18cbac8e9b9aa025e68f998d40
8e3b0117f4df4be452c0b6af5b8f0a0acf9d4ade23d08d55d7e312af22077762
c51ecfdbb39612d629bbbfa57896c63dc52971d7bcf78f1795944be16274a8eb
fea8fbaec75213e1af8005edfcdc94e7b5d7dca6ddb4e262d66e4756bda96d54