bafybeiat77wu6wlasdqqeyfv2xi6kulpzmj4ytge4pqfv3hef4srw25uyi.ipfs.dweb.link
Open in
urlscan Pro
2602:fea2:2::1
Malicious Activity!
Public Scan
Effective URL: https://bafybeiat77wu6wlasdqqeyfv2xi6kulpzmj4ytge4pqfv3hef4srw25uyi.ipfs.dweb.link/wetn.html
Submission: On February 29 via api from US — Scanned from US
Summary
TLS certificate: Issued by R3 on February 6th 2024. Valid for: 3 months.
This is the only time bafybeiat77wu6wlasdqqeyfv2xi6kulpzmj4ytge4pqfv3hef4srw25uyi.ipfs.dweb.link was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: WeTransfer (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 2602:fea2:2::1 2602:fea2:2::1 | 40680 (PROTOCOL) (PROTOCOL) | |
7 | 2606:4700:310... 2606:4700:310c::ac42:2c54 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
8 | 3 |
ASN40680 (PROTOCOL, US)
bafybeiat77wu6wlasdqqeyfv2xi6kulpzmj4ytge4pqfv3hef4srw25uyi.ipfs.dweb.link |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
pages.dev
sdfvgbh.pages.dev |
1001 KB |
1 |
dweb.link
bafybeiat77wu6wlasdqqeyfv2xi6kulpzmj4ytge4pqfv3hef4srw25uyi.ipfs.dweb.link |
69 KB |
8 | 2 |
Domain | Requested by | |
---|---|---|
7 | sdfvgbh.pages.dev |
bafybeiat77wu6wlasdqqeyfv2xi6kulpzmj4ytge4pqfv3hef4srw25uyi.ipfs.dweb.link
|
1 | bafybeiat77wu6wlasdqqeyfv2xi6kulpzmj4ytge4pqfv3hef4srw25uyi.ipfs.dweb.link | |
8 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
dweb.link R3 |
2024-02-06 - 2024-05-06 |
3 months | crt.sh |
sdfvgbh.pages.dev GTS CA 1P5 |
2024-01-09 - 2024-04-08 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://bafybeiat77wu6wlasdqqeyfv2xi6kulpzmj4ytge4pqfv3hef4srw25uyi.ipfs.dweb.link/wetn.html
Frame ID: 90480BCB7E90ECF71F38B0E5DBD11B6D
Requests: 11 HTTP requests in this frame
Screenshot
Page Title
WeTransferaccount | WeTransferPage URL History Show full URLs
-
http://bafybeiat77wu6wlasdqqeyfv2xi6kulpzmj4ytge4pqfv3hef4srw25uyi.ipfs.dweb.link/wetn.html
HTTP 307
https://bafybeiat77wu6wlasdqqeyfv2xi6kulpzmj4ytge4pqfv3hef4srw25uyi.ipfs.dweb.link/wetn.html Page URL
Detected technologies
jQuery (JavaScript Libraries) ExpandDetected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://bafybeiat77wu6wlasdqqeyfv2xi6kulpzmj4ytge4pqfv3hef4srw25uyi.ipfs.dweb.link/wetn.html
HTTP 307
https://bafybeiat77wu6wlasdqqeyfv2xi6kulpzmj4ytge4pqfv3hef4srw25uyi.ipfs.dweb.link/wetn.html Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
8 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
wetn.html
bafybeiat77wu6wlasdqqeyfv2xi6kulpzmj4ytge4pqfv3hef4srw25uyi.ipfs.dweb.link/ Redirect Chain
|
307 KB 69 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bg.png
sdfvgbh.pages.dev/ |
783 KB 784 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
4 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
sdfvgbh.pages.dev/ |
164 KB 40 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
script.min.js
sdfvgbh.pages.dev/ |
6 KB 2 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
GT-Super-Display-Light.woff
sdfvgbh.pages.dev/ |
54 KB 55 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
GT-Super-Display-Bold.woff
sdfvgbh.pages.dev/ |
58 KB 58 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ActiefGrotesque-Regular.woff
sdfvgbh.pages.dev/ |
30 KB 31 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ActiefGrotesque-Medium.woff
sdfvgbh.pages.dev/ |
31 KB 32 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: WeTransfer (Online)2 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=31536000; includeSubDomains; preload |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
bafybeiat77wu6wlasdqqeyfv2xi6kulpzmj4ytge4pqfv3hef4srw25uyi.ipfs.dweb.link
sdfvgbh.pages.dev
2602:fea2:2::1
2606:4700:310c::ac42:2c54
1f39a1017906d512934d04cef8dbd816ebe0206eab872da92d30fdb554c84a89
562892609732b7374aa3c5f488b555236db7a26a8f73c16624407fad46d946f8
623160e7d4659dfed50e861f6fa14ab0386e03510a166002b4e8e884a5c11130
62e704e04089cc468b4bfdd61705d93959532d630e88de5ecef6064ebfd9d29e
6dbba1863bcfe251266f22a6c3b047f788a4851623c58c7b6b750809f0885dad
7b18f49b87cf2ce19da6e9ddff3b99cdbb7d79baaddc3911a2d9b5ca74538994
97915ef3518cf57623d185b62663441724cc9afdd8927518e45c36cffc84be2f
b6046a8f13361f175a3717ef126c0d566f845a69ab36d997f33ed5397fdeb847
d88b3d358e709fc9e7691fd77af0bcad9d5c8fbe1f408259fe21de34dff97e27
e3a6268bcd3c4272e3a1004dbc662655f0b5dccf4dc68a3f6a9a7a7389b3183e
eaddc3fb78d635f6abe0194b732e54a2fb4fc0c71669b50c98b02ac36feb813d