urlscan.io logo urlscan.io
SecurityTrails logo

ipfs.io Open in urlscan Pro
209.94.90.1  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://cloudflare-ipfs.com/ipfs/bafkreibegn25nte7brgbwnqlyto6vkohldxccq66n72n44zuerdsroioyi
Effective URL: https://ipfs.io/ipfs/bafkreibegn25nte7brgbwnqlyto6vkohldxccq66n72n44zuerdsroioyi
Submission: On May 17 via api from LU — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 5 IPs in 3 countries across 6 domains to perform 6 HTTP transactions. The main IP is 209.94.90.1, located in United States and belongs to PROTOCOL, US. The main domain is ipfs.io. The Cisco Umbrella rank of the primary domain is 65949.
TLS certificate: Issued by GTS CA 1P5 on April 16th 2024. Valid for: 3 months.
This is the only time ipfs.io was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

IP Address AS Autonomous System
1 1 104.17.96.13 13335 (CLOUDFLAR...)
1 209.94.90.1 40680 (PROTOCOL)
1 104.17.25.14 13335 (CLOUDFLAR...)
1 2a04:4e42:200... 54113 (FASTLY)
2 2a00:1450:400... 15169 (GOOGLE)
6 5
1    104.17.96.13 (None, )

ASN13335 (CLOUDFLARENET, US)
cloudflare-ipfs.com
1    209.94.90.1 (United States)

ASN40680 (PROTOCOL, US)
ipfs.io
1    104.17.25.14 (None, )

ASN13335 (CLOUDFLARENET, US)
cdnjs.cloudflare.com
1    2a04:4e42:200::649 (United States)

ASN54113 (FASTLY, US)
code.jquery.com
2    2a00:1450:4001:812::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
lh3.googleusercontent.com
Apex Domain
Subdomains		 Transfer
2 googleusercontent.com
lh3.googleusercontent.com — Cisco Umbrella Rank: 44
193 KB
1 jquery.com
code.jquery.com — Cisco Umbrella Rank: 776
78 KB
1 cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 237
14 KB
1 ipfs.io
ipfs.io — Cisco Umbrella Rank: 65949
31 KB
1 cloudflare-ipfs.com
cloudflare-ipfs.com
400 B
0 lopapscop.ws Failed
0cxc0oshvi96.lopapscop.ws Failed
6 6
Domain Requested by
2 lh3.googleusercontent.com
1 code.jquery.com ipfs.io
1 cdnjs.cloudflare.com ipfs.io
1 ipfs.io
1 cloudflare-ipfs.com 1 redirects
0 0cxc0oshvi96.lopapscop.ws Failed code.jquery.com
6 6

This site contains no links.

Subject Issuer Validity Valid
ipfs.io
GTS CA 1P5		 2024-04-16 -
2024-07-15		 3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2023-07-03 -
2024-07-02		 a year crt.sh
*.jquery.com
Sectigo RSA Domain Validation Secure Server CA		 2023-07-11 -
2024-07-14		 a year crt.sh
*.googleusercontent.com
WR2		 2024-05-06 -
2024-07-29		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://ipfs.io/ipfs/bafkreibegn25nte7brgbwnqlyto6vkohldxccq66n72n44zuerdsroioyi
Frame ID: 86439D700685B1247CD205AABF282595
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://cloudflare-ipfs.com/ipfs/bafkreibegn25nte7brgbwnqlyto6vkohldxccq66n72n44zuerdsroioyi HTTP 302
    https://ipfs.io/ipfs/bafkreibegn25nte7brgbwnqlyto6vkohldxccq66n72n44zuerdsroioyi Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

6
Requests

83 %
HTTPS

40 %
IPv6

6
Domains

6
Subdomains

5
IPs

3
Countries

316 kB
Transfer

561 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://cloudflare-ipfs.com/ipfs/bafkreibegn25nte7brgbwnqlyto6vkohldxccq66n72n44zuerdsroioyi HTTP 302
    https://ipfs.io/ipfs/bafkreibegn25nte7brgbwnqlyto6vkohldxccq66n72n44zuerdsroioyi Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request bafkreibegn25nte7brgbwnqlyto6vkohldxccq66n72n44zuerdsroioyi
ipfs.io/ipfs/
Redirect Chain
  • https://cloudflare-ipfs.com/ipfs/bafkreibegn25nte7brgbwnqlyto6vkohldxccq66n72n44zuerdsroioyi
  • https://ipfs.io/ipfs/bafkreibegn25nte7brgbwnqlyto6vkohldxccq66n72n44zuerdsroioyi
59 KB
31 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ipfs.io/ipfs/bafkreibegn25nte7brgbwnqlyto6vkohldxccq66n72n44zuerdsroioyi
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
209.94.90.1 , United States, ASN40680 (PROTOCOL, US),
Reverse DNS
Software
cloudflare /
Resource Hash
243375d6cc9f0c4c1b360bc4ddeaa9c758ee2143de6ff4de7334244728b90ec2

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

access-control-allow-headers
Content-Type Range User-Agent X-Requested-With
access-control-allow-methods
GET HEAD OPTIONS
access-control-allow-origin
*
access-control-expose-headers
Content-Length Content-Range X-Chunked-Output X-Ipfs-Path X-Ipfs-Roots X-Stream-Output
alt-svc
h3=":443"; ma=86400
cache-control
public, max-age=29030400, immutable
cf-cache-status
MISS
cf-ray
8851bf2c9a833605-FRA
content-encoding
br
content-type
text/html
date
Fri, 17 May 2024 07:03:17 GMT
server
cloudflare
vary
Accept-Encoding
x-ipfs-path
/ipfs/bafkreibegn25nte7brgbwnqlyto6vkohldxccq66n72n44zuerdsroioyi
x-ipfs-pop
rainbow-fr2-01
x-ipfs-roots
bafkreibegn25nte7brgbwnqlyto6vkohldxccq66n72n44zuerdsroioyi

Redirect headers

alt-svc
h3=":443"; ma=86400
cf-ray
8851bf2c188030e2-FRA
content-length
0
date
Fri, 17 May 2024 07:03:17 GMT
location
https://ipfs.io/ipfs/bafkreibegn25nte7brgbwnqlyto6vkohldxccq66n72n44zuerdsroioyi
server
cloudflare
vary
Accept-Encoding
crypto-js.min.js
cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/ 		47 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js
Requested by
Host: ipfs.io
URL: https://ipfs.io/ipfs/bafkreibegn25nte7brgbwnqlyto6vkohldxccq66n72n44zuerdsroioyi
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8e3b0117f4df4be452c0b6af5b8f0a0acf9d4ade23d08d55d7e312af22077762
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://ipfs.io/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 17 May 2024 07:03:17 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
21417
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
13972
last-modified
Sat, 14 Aug 2021 20:33:09 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"61182885-3694"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OIzy3TIpzEKJmk2%2FJfJGNFoF8nQjGJ%2BDo%2FjrGf1EE5%2FAfrccqnrj17JLciU43r0ALUnI5BDTbzHPXCT%2Fz2XfKjEF7KTmYcRHy0A1TzOdhxGELl4GKgdjJAMte67%2FzWUbP7w8OYC6"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
8851bf2d1ca81e57-FRA
expires
Wed, 07 May 2025 07:03:17 GMT
jquery-1.9.1.js
code.jquery.com/ 		262 KB
78 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/jquery-1.9.1.js
Requested by
Host: ipfs.io
URL: https://ipfs.io/ipfs/bafkreibegn25nte7brgbwnqlyto6vkohldxccq66n72n44zuerdsroioyi
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:200::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
7bd80d06c01c0340c1b9159b9b4a197db882ca18cbac8e9b9aa025e68f998d40

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://ipfs.io/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 17 May 2024 07:03:17 GMT
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
age
3554863
x-cache
HIT, HIT
content-length
79506
x-served-by
cache-lga21952-LGA, cache-fra-eddf8230074-FRA
last-modified
Fri, 18 Oct 1991 12:00:00 GMT
server
nginx
x-timer
S1715929397.355606,VS0,VE0
etag
W/"28feccc0-4185d"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=604800
accept-ranges
bytes
x-cache-hits
16, 5241
AJFCJaXhZo6cUCNh1ssNQzSV3jc1ppd5Vt2HN5GjHL82rJR25OrOigrMWVvBpwQN6BD4T_qHdwh2spOZ9bKA-BqcHsttYMUy5sxc-E99nKe9pgDJsCX0icydpRhjm97W_S4_6cism2sTCOp-Oxa807yjCEw=w1580-h720-s-no
lh3.googleusercontent.com/pw/ 		192 KB
193 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lh3.googleusercontent.com/pw/AJFCJaXhZo6cUCNh1ssNQzSV3jc1ppd5Vt2HN5GjHL82rJR25OrOigrMWVvBpwQN6BD4T_qHdwh2spOZ9bKA-BqcHsttYMUy5sxc-E99nKe9pgDJsCX0icydpRhjm97W_S4_6cism2sTCOp-Oxa807yjCEw=w1580-h720-s-no?authuser=0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
fife /
Resource Hash
c51ecfdbb39612d629bbbfa57896c63dc52971d7bcf78f1795944be16274a8eb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://ipfs.io/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 17 May 2024 07:03:17 GMT
x-content-type-options
nosniff
server
fife
etag
"v51"
vary
Origin
content-type
image/gif
access-control-expose-headers
Content-Length
cache-control
private, max-age=86400, no-transform
cross-origin-resource-policy
cross-origin
content-disposition
inline;filename="Flashback - Jul 5, 2023 00_04_12.gif"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
197044
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
AMWts8CjWLE-4lSHnzZVyyi38RiG_iHUev92wvk3GXVlZur4_v68tJc5TxPcsfc6Vo4P2_Sa5_Dg4wBjO9x0q0xYFQKyjpg1zURhvOLxyPhDhPJg_Z8XDFduSWtavIhhZp_z9dX4zrOp2jk9GCWUmL_6qus=s128-no
lh3.googleusercontent.com/pw/ 		330 B
646 B 		Other
General
Check archive.org
Download Go to
Full URL
https://lh3.googleusercontent.com/pw/AMWts8CjWLE-4lSHnzZVyyi38RiG_iHUev92wvk3GXVlZur4_v68tJc5TxPcsfc6Vo4P2_Sa5_Dg4wBjO9x0q0xYFQKyjpg1zURhvOLxyPhDhPJg_Z8XDFduSWtavIhhZp_z9dX4zrOp2jk9GCWUmL_6qus=s128-no
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
fife /
Resource Hash
fea8fbaec75213e1af8005edfcdc94e7b5d7dca6ddb4e262d66e4756bda96d54
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://ipfs.io/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 17 May 2024 07:03:17 GMT
x-content-type-options
nosniff
server
fife
etag
"v30"
vary
Origin
content-type
image/png
access-control-expose-headers
Content-Length
cache-control
private, max-age=86400, no-transform
cross-origin-resource-policy
cross-origin
content-disposition
inline;filename="logo-off-1.png"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
330
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
0cxc0oshvi96.lopapscop.ws/obufsssssssscaaatoion/ 		0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
0cxc0oshvi96.lopapscop.ws
URL
https://0cxc0oshvi96.lopapscop.ws/obufsssssssscaaatoion/

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

158 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| CryptoJS string| encrypted string| key string| iv object| keyBytes object| ivBytes object| decrypted string| decryptedString object| s string| isrGyvSu function| _0x23bf function| _0xc072f2 function| _0x121b3c function| _0x1def6f function| _0x56747f function| _0x2c1004 function| _0x58d4e3 function| _0x457e16 function| _0x345751 function| _0x27cc80 function| _0x3bafa1 function| _0x4aad06 function| _0x44fca6 function| _0x29a620 function| _0x36b92f function| _0x39c092 function| _0x3556d2 function| _0x350134 function| _0x332a72 function| _0x21c483 function| _0x46ea12 function| _0xf4b93c function| _0x537317 function| _0xce0a12 function| _0x172d2f function| _0x50e697 function| _0x350505 function| _0x458b17 function| _0x2f4892 function| _0x504c40 function| _0x53c45f function| _0x342a18 function| _0x3aee32 function| _0x4a15f5 function| _0x445373 function| _0x54cada function| _0x94541d function| _0x9f4cc5 function| _0x23d5b2 function| _0x24455a function| _0x15e8f4 function| _0x1266a6 function| _0x2201a3 function| _0x1afe10 function| _0x2e8abb function| _0x9b3c56 function| _0x2ae7ae function| _0x44e754 function| _0x36a9b4 function| _0x1d2059 function| _0x10564f function| _0x5df417 function| _0x2eabdd function| _0x2e1800 function| _0x26875b function| _0x517c9e function| _0x474f27 function| _0xc0d3d0 function| _0x415b18 function| _0x57c623 function| _0x21f6dd function| _0x48eb2c function| _0x1cecd2 function| _0x2b13ad function| _0x17ad53 function| _0x429aca function| _0x3c3620 function| _0x3afeec function| _0x598e1f function| _0x57431d function| _0x499929 function| _0x5a5ac4 function| _0x227a4c function| _0x5823e0 function| _0x4b6108 function| _0x2bf360 function| _0x5b9cc8 function| _0x512b08 function| _0x16aa6b function| _0x16eb91 function| _0x3f9b36 function| _0x179239 function| _0x3432fd function| _0x2f91d5 function| _0x28a204 function| _0x424b44 function| _0x356196 function| _0x2e977c function| _0x9fe1b3 function| _0x407cc3 function| _0x5358a5 function| _0x417c5a function| _0xd3ac5b function| _0xb188bd function| _0x37edf4 function| _0x2472be function| _0x41cc76 function| _0x17c1c4 function| _0x5d2863 function| _0x3b5b3b function| _0x482786 function| _0x5e00bf function| _0x4f267c function| _0x282911 function| _0x46ded3 function| _0x580ade function| _0x52797f function| _0x5e8a5e function| _0x3983bb function| _0x3fd14e function| _0x2469dc function| _0x434961 function| _0x29b0b2 function| _0x216995 function| _0x11bc67 function| _0x52ec95 function| _0x1f88c8 function| _0xce9b28 function| _0x200b16 function| _0x44a574 function| _0x4c682f function| _0x5da65a function| _0x42261d function| _0x2eec4c function| _0x101e1f function| _0xaf81eb function| _0x45398b function| _0x3dbaca function| _0xdcc4ab function| _0x169a28 function| _0x5f3c13 function| _0x5c0b17 function| _0x3ca936 function| _0x34bc64 function| _0x1ee27a function| _0x4f546b function| _0x5ba597 function| _0xa0e824 function| _0x11ea object| _0x4817 string| IGOBZL string| cbbg string| kaka90nal string| ka45k459final2 string| kak0011afinal number| countttingerr function| $ function| jQuery

1 Cookies

Domain/Path Name / Value
cloudflare-ipfs.com/ Name: __cf_bm
Value: TxDuAJMd36nklBXHDncPiIDglq0x159Z1SG8y6nlU.I-1715929397-1.0.1.1-DUbTKcAM.mzuIhBj8mzpJRmBEICi_0O1RMNzZXp.YL_fmwoGsXcwh5CaSGmaUUVUk1Y5Z8raGayj5cXHjz4O1Q