urlscan.io logo urlscan.io
SecurityTrails logo

bafybeiaims3e3njf6woi6xdbknqgal2l7f4xamjuoe5lnkidjr7yubu5ui.ipfs.w3s.link Open in urlscan Pro
2606:4700::6812:1634  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://u30385788.ct.sendgrid.net/ls/click?upn=oOATeWDIk4MWzEirqic4dBL8wXat1Tb0vEsoS3630lf3UKiKxGIXv6DDsxYoqOIi6owcz6GjFFlVMxBGivk...
Effective URL: https://bafybeiaims3e3njf6woi6xdbknqgal2l7f4xamjuoe5lnkidjr7yubu5ui.ipfs.w3s.link/blacksea235_owa4647.html
Submission: On November 29 via manual from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 1 countries across 3 domains to perform 1 HTTP transactions. The main IP is 2606:4700::6812:1634, located in United States and belongs to CLOUDFLARENET, US. The main domain is bafybeiaims3e3njf6woi6xdbknqgal2l7f4xamjuoe5lnkidjr7yubu5ui.ipfs.w3s.link.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on July 18th 2022. Valid for: a year.
This is the only time bafybeiaims3e3njf6woi6xdbknqgal2l7f4xamjuoe5lnkidjr7yubu5ui.ipfs.w3s.link was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Outlook Web Access (Online)

Domain & IP information

IP Address AS Autonomous System
1 1 167.89.123.122 11377 (SENDGRID)
1 1 3.89.11.108 14618 (AMAZON-AES)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 2

This site contains links to these domains. Also see Links.

Domain
office.com
Subject Issuer Validity Valid
w3s.link
Cloudflare Inc ECC CA-3		 2022-07-18 -
2023-07-17		 a year crt.sh

This page contains 1 frames:

Primary Page: https://bafybeiaims3e3njf6woi6xdbknqgal2l7f4xamjuoe5lnkidjr7yubu5ui.ipfs.w3s.link/blacksea235_owa4647.html
Frame ID: BD7A31097765337B80FB0CC1D73BDC29
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Outlook

Page URL History Show full URLs

  1. https://u30385788.ct.sendgrid.net/ls/click?upn=oOATeWDIk4MWzEirqic4dBL8wXat1Tb0vEsoS3630lf3UKiKxGIXv6DDsxYoqOI... HTTP 302
    https://sahara-group.lt.emlnk.com/Prod/link-tracker?notrack=1&redirectUrl=aHR0cHMlM0ElMkYlMkZiYWZ5YmVpYWltczNl... HTTP 302
    https://bafybeiaims3e3njf6woi6xdbknqgal2l7f4xamjuoe5lnkidjr7yubu5ui.ipfs.w3s.link/blacksea235_owa4647.html Page URL

Page Statistics

1
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

2
IPs

1
Countries

31 kB
Transfer

103 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://u30385788.ct.sendgrid.net/ls/click?upn=oOATeWDIk4MWzEirqic4dBL8wXat1Tb0vEsoS3630lf3UKiKxGIXv6DDsxYoqOIi6owcz6GjFFlVMxBGivk6vu3FwD09OaIDshOJPyV8txGnt9XNIBl-2Fn8-2BLomm9hamt6wulqsDGQQvfOqgmaSPIFvke4QbiJVqaniFl2KNGmPqZC6v2CZmsFnP4Mz1MWexNPK8P6Um-2BInD3rfpkBiGLGb8NXw9-2BAhhmHK6fJ3IFhOensD7w5TaFTEjvEhBdfngUjGxwPXN-2FmjJ7yxEPe2kFqfZI71nOSB78-2BFeAz9lUyUqXukugVFm0pfNVIHxMUtWfXTcHFBPeNK19tW1k-2FWICZWGM3Nic-2F-2Bf3-2FHvl-2FCm-2FPeKGOfIqcjV39MoJ-2BB25ZkHF3FvC-2FBj8Edpi1kIQxYZcSDl95K4FbTS8bQcu-2FCBNVHg-2Fsu4kM-2FBviqtkIUNKl2NqbJjYxlOFAIaTBvyW3Co68xSz2Uifm10rzQXwu9A1g23r8DPYMdvMn1YLYfOqpkYlOsh1XzmKB3e4WdtJew5dMzm4ELF0ffAZKtvJarJqKN-2FMCtJ3mRr2OLqPetJKAI6E427eCR3GBAXM4iJzU4ZCWQWK-2BQ4KAcqV3T3OWKcjN6urXPiZbJnROs4Le0GXGU0lDccRaVxgK9BSDwZ1N2-2BCvQ-3D-3DXV0c_Pf9CtrQ1SAbq-2BFE3DOyo6uIuhrC7jPnmWDv47e-2Fb1HKW4U-2B-2F9cZ62rxaF9wjLlI-2BzKBUFoBgdPO-2B2NEOYkjZHymDcjQz-2FisEpcs-2BbVnu-2BuzknIn-2BvVNe8SoJH-2BYzN101iY0CDnorK69v4gbMImzoEZpXS6O9E-2FHe6-2FHUiETe-2BSFMyyUFJixxJHJWBjg234VIZvOxYxSsv5o74D80sXIAAnxzJGKDWvrrIXhstpXZStws9wgEKCgYdNldv3qYn6qR2iJeHo87P1kS7a0p4Lu-2FALxadcLtEJ8xb-2BNjjQlfuDyy77sWKb-2F3crwwBAL8koaLsX5Jz6u21JYqUEWTcTrSW82EVZtkSJfZ7h59yls-2BKiUMTTOg0FVze7xLxdLeAWbP6i6PE6tkeo6O0NCv-2BRWA9WtalbzOvXQCHHwgOn04VeYxYgEkGasZiKxP-2FBjurchxDp30wOf8f9tFoWYchPCHDas-2FeWvLjZ1c-2Fj1VJRJ8Vme-2FbsJU6Ytsui9vOaCdP-2FSuP0pJFtVq9lKK1iI5a8vZ8olh0jpry1hGqZ5plH2bYBECsC3ivd2HnoWzKbNHEcH1BEXs5FhwQFv8TkpHKDx0UkQ8deAvWUoNeH9iQy8xdnLh8fatPNjn6WIea7Kfk2FeglJnxxIOjf988lFFUIuNooQRd51n4hgy61engaF-2FEXxPvUmaTUMLqdnbB6fnIgtXv-2FEtEIDuoQrgNZfXns88-2BvSkuTn73FdNzk7WsVGocz9zXWw6ZVmpHu1UJsqqn-2F-2FihW9S2sGRBOv2nTBZnz4aj39U7EegPaf2pNLHYZVheWmVWyKOhsGy85DSoj-2B8f2kCZe9PLodSae6Sw4bMc50ecIZntFI-2FWagHyU-2F-2FB18U8yWTogPvxrOIxlFI56FO2w1fj4C9P3uY-2BVYjXdoS47ECtA-3D-3D HTTP 302
    https://sahara-group.lt.emlnk.com/Prod/link-tracker?notrack=1&redirectUrl=aHR0cHMlM0ElMkYlMkZiYWZ5YmVpYWltczNlM25qZjZ3b2k2eGRia25xZ2FsMmw3ZjR4YW1qdW9lNWxua2lkanI3eXVidTV1aS5pcGZzLnczcy5saW5rJTJGYmxhY2tzZWEyMzVfb3dhNDY0Ny5odG1s&sig=ALwa3Ypb8Hqg9E1eKGPZcthm9ACJwNmiz2LjkAh7oXur&iat=1669713306&a=%7C%7C477942057%7C%7C&account=sahara-group%2Eactivehosted%2Ecom&email=C%2Bppi6RSmWL9Ul27iTHQ9zihdglESk4JySzbr0PNmjQ%3D&s=bWF0dGFAc21zYWV4cHJlc3MuY29t&i=2A4A1A4 HTTP 302
    https://bafybeiaims3e3njf6woi6xdbknqgal2l7f4xamjuoe5lnkidjr7yubu5ui.ipfs.w3s.link/blacksea235_owa4647.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

1 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request blacksea235_owa4647.html
bafybeiaims3e3njf6woi6xdbknqgal2l7f4xamjuoe5lnkidjr7yubu5ui.ipfs.w3s.link/
Redirect Chain
  • https://u30385788.ct.sendgrid.net/ls/click?upn=oOATeWDIk4MWzEirqic4dBL8wXat1Tb0vEsoS3630lf3UKiKxGIXv6DDsxYoqOIi6owcz6GjFFlVMxBGivk6vu3FwD09OaIDshOJPyV8txGnt9XNIBl-2Fn8-2BLomm9hamt6wulqsDGQQvfOqgmaS...
  • https://sahara-group.lt.emlnk.com/Prod/link-tracker?notrack=1&redirectUrl=aHR0cHMlM0ElMkYlMkZiYWZ5YmVpYWltczNlM25qZjZ3b2k2eGRia25xZ2FsMmw3ZjR4YW1qdW9lNWxua2lkanI3eXVidTV1aS5pcGZzLnczcy5saW5rJTJGYmx...
  • https://bafybeiaims3e3njf6woi6xdbknqgal2l7f4xamjuoe5lnkidjr7yubu5ui.ipfs.w3s.link/blacksea235_owa4647.html
81 KB
31 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://bafybeiaims3e3njf6woi6xdbknqgal2l7f4xamjuoe5lnkidjr7yubu5ui.ipfs.w3s.link/blacksea235_owa4647.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1634 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d35207b98cf983a18abc145bbed02e2647ecdcd4349ae8f664239c07791a53e4

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

access-control-allow-methods
GET
access-control-allow-origin
*
access-control-expose-headers
Link
cache-control
public, max-age=29030400, immutable
cf-ray
771b75ce2dffbbe5-FRA
content-encoding
gzip
content-type
text/html
date
Tue, 29 Nov 2022 12:48:53 GMT
etag
W/"bafkreigtkid3tdhzqoqyvpaulo7nalrgi7wnzvbutlupmzbdtqdxsgst4q"
server
cloudflare
server-timing
request;dur=401
vary
Accept-Encoding
x-dotstorage-anchor
74c9992c01196e21103938252016913f8d8537ede3e20a189576457b77b46153
x-dotstorage-resolution-id
https://freeway.dag.haus
x-dotstorage-resolution-layer
dotstorage-race
x-freeway-version
1.5.3

Redirect headers

content-length
0
content-type
application/json
date
Tue, 29 Nov 2022 12:48:53 GMT
location
https://bafybeiaims3e3njf6woi6xdbknqgal2l7f4xamjuoe5lnkidjr7yubu5ui.ipfs.w3s.link/blacksea235_owa4647.html
x-amz-apigw-id
cXTkXEQ0oAMFiPQ=
x-amzn-requestid
5dc5fc1a-709a-481e-a496-ba33765a1eb1
x-amzn-trace-id
Root=1-6385ffb5-6080a835501a7554133640d6;Sampled=0
truncated
/ 		6 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
6bd745cac7dd2e979f9e89dcd3c1ed3058812be0c88a06fc066360f74120b717

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		2 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d9ed6586942003696afe4e52b09f343f8342244b51a9e175b75162d7e615207b

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		4 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
4de8fc175826d9f78fce9f9f2b71a63fe832fc7507e0394125c823b0909fa54a

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		8 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
a7c14ee84d81a536a4cd54e3a144f388f2174a4a5c409ae118ea49f0da6b4aa6

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		1 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
07f38b8b8c1f96ed85ecd96988f0454a95d1f665427086a507c72e55ff3ce0e7

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		1 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
6710ee6e22d5e3e82f70554804806c37aac5789b110d944383ea393d93eb627a

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.121 Safari/537.36

Response headers

Content-Type
image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Outlook Web Access (Online)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| _0xa188 object| emailInput object| passwordInput function| ValidateEmail function| redirrectPage function| _0x4e57 number| counter

0 Cookies