cloudflare-ipfs.com - urlscan.io

Summary

This website contacted 4 IPs in 6 countries across 5 domains to perform 5 HTTP transactions. The main IP is 104.17.96.13, located in and belongs to CLOUDFLARENET, US. The main domain is cloudflare-ipfs.com.
TLS certificate: Issued by E1 on April 24th 2024. Valid for: 3 months.

This is the only time cloudflare-ipfs.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Email (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 1	185.179.24.113 185.179.24.113	203576 (INTERNETB...) (INTERNETBILISIM)
1	104.17.96.13 104.17.96.13	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a04:4e42:200... 2a04:4e42:200::485	54113 (FASTLY) (FASTLY)
1 1	223.130.192.248 223.130.192.248	23576 (NHN-AS-KR...) (NHN-AS-KR NAVER Cloud Corp.)
1	2.19.216.214 2.19.216.214	16625 (AKAMAI-AS) (AKAMAI-AS)
2	2a00:1450:400... 2a00:1450:4001:81d::2004	15169 (GOOGLE) (GOOGLE)
5	4

1 185.179.24.113 (Turkey) 1 redirects

ASN203576 (INTERNETBILISIM, TR)
PTR: da6.megatrhost.com

semsvakfi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.17.96.13 (None, )

ASN13335 (CLOUDFLARENET, US)

cloudflare-ipfs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:200::485 (United States)

ASN54113 (FASTLY, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 223.130.192.248 (Korea, Republic Of) 1 redirects

ASN23576 (NHN-AS-KR NAVER Cloud Corp., KR)

naver.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.19.216.214 (Prague, Czech Republic)

ASN16625 (AKAMAI-AS, US)
PTR: a2-19-216-214.deploy.static.akamaitechnologies.com

www.naver.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:81d::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

t1.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	gstatic.com t1.gstatic.com	1 KB
2	naver.com 1 redirects naver.com — Cisco Umbrella Rank: 6881 www.naver.com — Cisco Umbrella Rank: 45492	122 B
1	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 310	33 KB
1	cloudflare-ipfs.com cloudflare-ipfs.com	3 KB
1	semsvakfi.com 1 redirects semsvakfi.com	337 B
5	5

	Domain	Requested by
2	t1.gstatic.com
1	www.naver.com	cdn.jsdelivr.net
1	naver.com	1 redirects
1	cdn.jsdelivr.net	cloudflare-ipfs.com
1	cloudflare-ipfs.com
1	semsvakfi.com	1 redirects
5	6

This site contains no links.

Subject Issuer	Validity	Valid
cloudflare-ipfs.com E1	`2024-04-24` - `2024-07-23`	3 months	crt.sh
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2023 Q3	`2023-09-27` - `2024-10-28`	a year	crt.sh
ssl.pstatic.net GeoTrust RSA CA 2018	`2023-08-01` - `2024-08-01`	a year	crt.sh
*.gstatic.com WR2	`2024-05-06` - `2024-07-29`	3 months	crt.sh

This page contains 2 frames:

Primary Page: https://cloudflare-ipfs.com/ipfs/bafkreiadoy5ut2paxullvgr6m7hz53csagbvszglguo7kwyj6jegf5oo3e?e=test@naver.com
Frame ID: 5AB0C1630FE4797EB85E766956959359
Requests: 4 HTTP requests in this frame

Frame: https://www.naver.com/
Frame ID: E66F3EF17CFD7C26CCB1B902A941FD98
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Webmail Login Portal - NAVER

Page URL History Show full URLs

https://semsvakfi.com/b/Au.php?e=test@naver.com HTTP 302
https://cloudflare-ipfs.com/ipfs/bafkreiadoy5ut2paxullvgr6m7hz53csagbvszglguo7kwyj6jegf5oo3e?e=test@nave... Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

//cdn\.jsdelivr\.net/

Page Statistics

5
Requests

100 %
HTTPS

33 %
IPv6

5
Domains

6
Subdomains

4
IPs

6
Countries

37 kB
Transfer

95 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://semsvakfi.com/b/Au.php?e=test@naver.com HTTP 302
https://cloudflare-ipfs.com/ipfs/bafkreiadoy5ut2paxullvgr6m7hz53csagbvszglguo7kwyj6jegf5oo3e?e=test@naver.com Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1

https://naver.com/ HTTP 301
https://www.naver.com/

5 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3

200

Primary Request bafkreiadoy5ut2paxullvgr6m7hz53csagbvszglguo7kwyj6jegf5oo3e Show response
cloudflare-ipfs.com/ipfs/
Redirect Chain

https://semsvakfi.com/b/Au.php?e=test@naver.com
https://cloudflare-ipfs.com/ipfs/bafkreiadoy5ut2paxullvgr6m7hz53csagbvszglguo7kwyj6jegf5oo3e?e=test@naver.com

6 KB
3 KB

61ms
40ms

Document
text/html

104.17.96.13
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cloudflare-ipfs.com/ipfs/bafkreiadoy5ut2paxullvgr6m7hz53csagbvszglguo7kwyj6jegf5oo3e?e=test@naver.com
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.17.96.13 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 03763b49e9e0bd16ba9a3e67cf9eec5201835964cb351df55b09f24862f5ced9

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

access-control-allow-headers: Content-Type Range User-Agent X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-expose-headers: Content-Length Content-Range X-Chunked-Output X-Ipfs-Path X-Ipfs-Roots X-Stream-Output
age: 34091
alt-svc: h3=":443"; ma=86400
cache-control: public, max-age=29030400, immutable
cf-cache-status: HIT
cf-ray: 884faded1d9f3614-FRA
content-encoding: br
content-type: text/html
date: Fri, 17 May 2024 01:01:59 GMT
etag: W/"bafkreiadoy5ut2paxullvgr6m7hz53csagbvszglguo7kwyj6jegf5oo3e"
server: cloudflare
vary: Accept-Encoding
x-cf-ipfs-cache-status: hit
x-ipfs-path: /ipfs/bafkreiadoy5ut2paxullvgr6m7hz53csagbvszglguo7kwyj6jegf5oo3e
x-ipfs-roots: bafkreiadoy5ut2paxullvgr6m7hz53csagbvszglguo7kwyj6jegf5oo3e

Redirect headers

alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
cache-control: no-cache, no-store, must-revalidate, max-age=0
content-length: 0
content-type: text/html; charset=UTF-8
date: Fri, 17 May 2024 01:01:58 GMT
location: https://cloudflare-ipfs.com/ipfs/bafkreiadoy5ut2paxullvgr6m7hz53csagbvszglguo7kwyj6jegf5oo3e?e=test@naver.com
server: LiteSpeed
vary: User-Agent

GET
H2 200 jquery.min.js Show response
cdn.jsdelivr.net/npm/jquery@3.6.4/dist/ 88 KB
33 KB 29ms
6ms Script
application/javascript 2a04:4e42:200::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/jquery@3.6.4/dist/jquery.min.js

Requested by

Host: cloudflare-ipfs.com
URL: https://cloudflare-ipfs.com/ipfs/bafkreiadoy5ut2paxullvgr6m7hz53csagbvszglguo7kwyj6jegf5oo3e?e=test@naver.com

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:200::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

/

Resource Hash

a0fe8723dcf55da64d06b25446d0a8513e52527c45afcb37073465f9c6f352af

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://cloudflare-ipfs.com/
Origin: https://cloudflare-ipfs.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Fri, 17 May 2024 01:01:59 GMT
x-content-type-options: nosniff
content-encoding: br
age: 859244
x-jsd-version: 3.6.4
x-cache: HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 32857
x-served-by: cache-fra-etou8220091-FRA
x-jsd-version-type: version
etag: W/"15ec3-7aRnR8cdOKiAvuRPmkOcOFi7j5k"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges: bytes
timing-allow-origin: *

GET
H2

200

/
www.naver.com/ Frame E66F
Redirect Chain

https://naver.com/
https://www.naver.com/

0
0

686ms
367ms

Document
text/html

2.19.216.214
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.naver.com/

Requested by

Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/npm/jquery@3.6.4/dist/jquery.min.js

Protocol

H2

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2.19.216.214 Prague, Czech Republic, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-19-216-214.deploy.static.akamaitechnologies.com

Software

nfront /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://cloudflare-ipfs.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-length: 35793
content-type: text/html; charset=UTF-8
date: Fri, 17 May 2024 01:02:00 GMT
pragma: no-cache
referrer-policy: unsafe-url
server: nfront
strict-transport-security: max-age=63072000; includeSubdomains
vary: Accept-Encoding
x-frame-options: DENY
x-xss-protection: 1; mode=block

Redirect headers

content-length: 162
content-type: text/html
date: Fri, 17 May 2024 01:02:00 GMT
location: https://www.naver.com/
referrer-policy: unsafe-url
server: nfront

GET
H2 200 faviconV2
t1.gstatic.com/ 658 B
1 KB 47ms
7ms Image
image/png 2a00:1450:4001:81d::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t1.gstatic.com/faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,SIZE,URL&size=64&url=http://naver.com

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

79d6c6efa232a3ae07cbed48efd7d090d56926ff0850353ad394fed82a452919

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://cloudflare-ipfs.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 17 May 2024 00:52:09 GMT
x-content-type-options: nosniff
age: 590
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/media-favicon
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 658
x-xss-protection: 0
last-modified: Sat, 09 Apr 2022 04:16:36 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="media-favicon"
report-to: {"group":"media-favicon","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/media-favicon"}]}
content-type: image/png
cache-control: public, max-age=604800
accept-ranges: bytes
content-location: https://s.pstatic.net/static/www/mobile/edit/20220408_0/upload_16493972759253VFbg.png
expires: Fri, 24 May 2024 00:52:09 GMT

GET
H2 200 faviconV2
t1.gstatic.com/ 658 B
0 47ms
47ms Other
image/png 2a00:1450:4001:81d::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://t1.gstatic.com/faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,SIZE,URL&size=64&url=http://naver.com

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

79d6c6efa232a3ae07cbed48efd7d090d56926ff0850353ad394fed82a452919

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://cloudflare-ipfs.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 17 May 2024 00:52:09 GMT
x-content-type-options: nosniff
age: 590
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/media-favicon
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 658
x-xss-protection: 0
last-modified: Sat, 09 Apr 2022 04:16:36 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="media-favicon"
report-to: {"group":"media-favicon","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/media-favicon"}]}
content-type: image/png
cache-control: public, max-age=604800
accept-ranges: bytes
content-location: https://s.pstatic.net/static/www/mobile/edit/20220408_0/upload_16493972759253VFbg.png
expires: Fri, 24 May 2024 00:52:09 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Email (Online)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 function| $ function| jQuery

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			cloudflare-ipfs.com/	1970-01-20 20:38:29	Name: __cf_bm Value: BjdkWfKwp0POrsoifWXeVDvck4N4abHZjRi36Ls9Rt4-1715907719-1.0.1.1-TZGAY34_qy5j30jIUDuViPM9r1P.XshoFL3xHh6D7crGQyQ_xmvt982a_mJkVMuvbEmdRNIUxMQKiS_.KmxT8w

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	warning	URL: about:blank Message: An iframe which has both allow-scripts and allow-same-origin for its sandbox attribute can escape its sandboxing.
recommendation	verbose	URL: https://cloudflare-ipfs.com/ipfs/bafkreiadoy5ut2paxullvgr6m7hz53csagbvszglguo7kwyj6jegf5oo3e?e=test@naver.com Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.jsdelivr.net
cloudflare-ipfs.com
naver.com
semsvakfi.com
t1.gstatic.com
www.naver.com
104.17.96.13
185.179.24.113
2.19.216.214
223.130.192.248
2a00:1450:4001:81d::2004
2a04:4e42:200::485
03763b49e9e0bd16ba9a3e67cf9eec5201835964cb351df55b09f24862f5ced9
79d6c6efa232a3ae07cbed48efd7d090d56926ff0850353ad394fed82a452919
a0fe8723dcf55da64d06b25446d0a8513e52527c45afcb37073465f9c6f352af

cloudflare-ipfs.com Open in urlscan Pro 104.17.96.13 Malicious Activity! Private Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

5 Requests

100 %HTTPS

33 %IPv6

5 Domains

6 Subdomains

4 IPs

6 Countries

37 kBTransfer

95 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

1 Cookies

2 Console Messages

Indicators

cloudflare-ipfs.com Open in urlscan Pro
104.17.96.13 Malicious Activity! Private Scan

Screenshot
Live screenshot

Full Image

5
Requests

100 %
HTTPS

33 %
IPv6

5
Domains

6
Subdomains

4
IPs

6
Countries

37 kB
Transfer

95 kB
Size

1
Cookies

5 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!