ipfs.io
Open in
urlscan Pro
209.94.90.1
Malicious Activity!
Public Scan
Effective URL: https://ipfs.io/ipfs/bafkreiaryrfbglxlliixy4cbj5hsyu5oqoy4ya4do7vfv4h6fzd75ddpby
Submission: On May 26 via manual from JP — Scanned from JP
Summary
TLS certificate: Issued by GTS CA 1P5 on April 16th 2024. Valid for: 3 months.
This is the only time ipfs.io was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Email (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 104.17.96.13 104.17.96.13 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 209.94.90.1 209.94.90.1 | 40680 (PROTOCOL) (PROTOCOL) | |
14 | 198.23.53.48 198.23.53.48 | 32748 (STEADFAST) (STEADFAST) | |
16 | 3 |
ASN32748 (STEADFAST, US)
PTR: hosted.by.liquidnetlimited.com
webmail.supremecluster.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
14 |
supremecluster.com
webmail.supremecluster.com |
758 KB |
1 |
ipfs.io
ipfs.io — Cisco Umbrella Rank: 65949 |
4 KB |
1 |
cloudflare-ipfs.com
1 redirects
cloudflare-ipfs.com |
403 B |
16 | 3 |
Domain | Requested by | |
---|---|---|
14 | webmail.supremecluster.com |
ipfs.io
|
1 | ipfs.io | |
1 | cloudflare-ipfs.com | 1 redirects |
16 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
ipfs.io GTS CA 1P5 |
2024-04-16 - 2024-07-15 |
3 months | crt.sh |
webmail.supremecluster.com R3 |
2024-05-23 - 2024-08-21 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://ipfs.io/ipfs/bafkreiaryrfbglxlliixy4cbj5hsyu5oqoy4ya4do7vfv4h6fzd75ddpby
Frame ID: B2B6503FDCD9B643E5E8ECE2AC394A34
Requests: 16 HTTP requests in this frame
Screenshot
Page Title
Roundcube Webmail : Welcome to ....Page URL History Show full URLs
-
https://cloudflare-ipfs.com/ipfs/bafkreiaryrfbglxlliixy4cbj5hsyu5oqoy4ya4do7vfv4h6fzd75ddpby
HTTP 302
https://ipfs.io/ipfs/bafkreiaryrfbglxlliixy4cbj5hsyu5oqoy4ya4do7vfv4h6fzd75ddpby Page URL
Detected technologies
RoundCube (Web Mail) ExpandDetected patterns
- <title>RoundCube
Bootstrap (Web Frameworks) Expand
Detected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
jQuery UI (JavaScript Libraries) Expand
Detected patterns
- jquery-ui.*\.js
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://cloudflare-ipfs.com/ipfs/bafkreiaryrfbglxlliixy4cbj5hsyu5oqoy4ya4do7vfv4h6fzd75ddpby
HTTP 302
https://ipfs.io/ipfs/bafkreiaryrfbglxlliixy4cbj5hsyu5oqoy4ya4do7vfv4h6fzd75ddpby Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
16 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H3 |
Primary Request
bafkreiaryrfbglxlliixy4cbj5hsyu5oqoy4ya4do7vfv4h6fzd75ddpby
ipfs.io/ipfs/ Redirect Chain
|
10 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bootstrap.min.css
webmail.supremecluster.com/skins/elastic/deps/ |
157 KB 26 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
styles.css
webmail.supremecluster.com/skins/elastic/styles/ |
101 KB 21 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET |
framework.css
webmail.supremecluster.com/plugins/xframework/assets/styles/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-ui.css
webmail.supremecluster.com/plugins/jqueryui/themes/elastic/ |
33 KB 9 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.min.js
webmail.supremecluster.com/program/js/ |
89 KB 89 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
common.min.js
webmail.supremecluster.com/program/js/ |
12 KB 13 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
app.min.js
webmail.supremecluster.com/program/js/ |
168 KB 168 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jstz.min.js
webmail.supremecluster.com/program/js/ |
14 KB 14 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
framework.min.js
webmail.supremecluster.com/plugins/xframework/assets/scripts/ |
12 KB 13 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
xskin.min.js
webmail.supremecluster.com/plugins/xskin/assets/scripts/ |
4 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-ui.min.js
webmail.supremecluster.com/plugins/jqueryui/js/ |
256 KB 257 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo.svg
webmail.supremecluster.com/skins/elastic/images/ |
888 B 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bootstrap.bundle.min.js
webmail.supremecluster.com/skins/elastic/deps/ |
82 KB 82 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ui.min.js
webmail.supremecluster.com/skins/elastic/ |
60 KB 60 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
favicon.ico
webmail.supremecluster.com/skins/elastic/images/ |
17 KB 2 KB |
Other
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- webmail.supremecluster.com
- URL
- https://webmail.supremecluster.com/plugins/xframework/assets/styles/framework.css?s=1506327547
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Email (Online)36 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery number| CONTROL_KEY number| SHIFT_KEY number| CONTROL_SHIFT_KEY function| roundcube_browser object| rcube_event function| rcube_event_engine function| rcube_check_email function| rcube_clone_object function| urlencode function| rcube_find_object function| rcube_mouse_is_over function| setCookie function| getCookie object| bw function| rcube_parse_query object| Base64 object| pattern function| rcube_webmail object| jstz object| _$_56b7 object| rcmail function| x object| xsidebar object| xframework function| xsidebarLarry function| xsidebarElastic object| xskin object| _$_3c0c object| bootstrap function| rcube_elastic_ui function| __newInst object| UI object| _$_477c object| _$_be051 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
cloudflare-ipfs.com/ | Name: __cf_bm Value: w6KjCLS0L0_z3yPrXlpnvd6dFqlXc1n0HQDjIoCQT60-1716767235-1.0.1.1-TCEd51tdNPeGjtwV2A8t8jCXy887m9Mg4RD0JFiwnzkEZO3f6UqGIuZLhL24BZujFSRpjC7OfvPdOTrgVvmnwg |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cloudflare-ipfs.com
ipfs.io
webmail.supremecluster.com
webmail.supremecluster.com
104.17.96.13
198.23.53.48
209.94.90.1
0c07ab29e206a3328d77889da33b64f9ae5d6ea32d34c4a8fae78a64ba428760
11c44a132eeb5a117c70414f4f2c53ae83b1cc038377ea5af0fe2e47fe8c6f0e
19b51730c10082760e6d9b82c1342e60855f98d2666c64e4eb758d26b1a0c840
2b2d9c7a82f92976268b03e13c61f64ead91a3c63b97c59cef2acbf501f67618
360bc4a9894bbd41134a2eea27ee9251f649e6aa395c1836caaa2f90e123f91a
3cb5b7ae5053d743996378c35733560214d3d896ade5c0de0d8b13a97f43039e
45b30930d5752603cdff2d24aa942b5bbae3168f62e74e092cd9405ff10127f7
5587d48bf92e77d6abf71c25f39e248e6bc2e168595128b516b733e65eba1101
5641ed21773230a8110279658abac57bb5b4abc7bf4091946c5e61e8f0021f55
716ece8deb8412f7ec95ab395c92f6515bb8d8b792fd7480c014cdc6f063452a
7b30e499996ec4631848d3509d803d9311f5d71999212f2f4c1ca7af8f24eb69
a8e9036221176bf3ea5fefaaaae97a3fadecf1b25c5b8ace450a63b1af4a6047
b5c8efcc70542f970db5def97926121e9315e45ff3a73386bc933585da201222
f41ecf98cb50845771b2573972c1c1c61c0b5e67670cfc608c6ac95e0d3378b8
f6920be076e276011b2657ce645ad7a0e5ff667f7dfdf7aa97e4b92a01078ac2