ipfs.io Open in urlscan Pro
2602:fea2:2::1  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

2 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request bafybeibxpzkjt55rfzpbbsebtaj6tocipra3kfktehvs2ijzmnoi6e7ixu Show response ipfs.io/ipfs/	545 KB 93 KB	116ms 58ms	Document text/html	2602:fea2:2::1 PROTOCOL
General Check archive.org Show headers Download Go to Full URL https://ipfs.io/ipfs/bafybeibxpzkjt55rfzpbbsebtaj6tocipra3kfktehvs2ijzmnoi6e7ixu Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2602:fea2:2::1 , United States, ASN40680 (PROTOCOL, US), Reverse DNS Software openresty / Resource Hash bf544743c63c104dbf99cef408e98815813f537f0b17fbc47eebb957a53d42f6 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers access-control-allow-headers Content-Type Range User-Agent X-Requested-With access-control-allow-methods GET HEAD OPTIONS access-control-allow-origin * access-control-expose-headers Content-Length Content-Range X-Chunked-Output X-Ipfs-Path X-Ipfs-Roots X-Stream-Output cache-control public, max-age=29030400, immutable content-encoding gzip content-type text/html date Mon, 19 Feb 2024 20:32:51 GMT etag W/"bafybeibxpzkjt55rfzpbbsebtaj6tocipra3kfktehvs2ijzmnoi6e7ixu" server openresty timing-allow-origin * vary Accept-Encoding x-ipfs-datasize 557937 x-ipfs-path /ipfs/bafybeibxpzkjt55rfzpbbsebtaj6tocipra3kfktehvs2ijzmnoi6e7ixu x-ipfs-pop ipfs-bank5-fr2 x-ipfs-roots bafybeibxpzkjt55rfzpbbsebtaj6tocipra3kfktehvs2ijzmnoi6e7ixu x-proxy-cache HIT
GET DATA	200 OK	truncated /	391 KB 0		Stylesheet text/css
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash cd2a081f45571ad28411acc42d1a29ab1cfb487bfeb9e70dfc8647e8a3f6a161 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36 Response headers Content-Type text/css
GET H2	200	wetransfer-workmark-website.png blog.thunderbird.net/files/2019/05/	2 KB 3 KB	135ms 41ms	Image image/webp	141.193.213.11 CLOUDFLARESPECTRU...
General Check archive.org Show headers Download Go to Show image Full URL https://blog.thunderbird.net/files/2019/05/wetransfer-workmark-website.png Requested by Host: ipfs.io URL: https://ipfs.io/ipfs/bafybeibxpzkjt55rfzpbbsebtaj6tocipra3kfktehvs2ijzmnoi6e7ixu Protocol H2 Security TLS 1.3, , AES_128_GCM Server 141.193.213.11 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 7ffe32277afc717076324e7b1f7178dc3a07901cf54f8851f57fb1cef0441ec8 Security Headers Name Value X-Frame-Options SAMEORIGIN Request headers accept-language de-DE,de;q=0.9 Referer https://ipfs.io/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36 Response headers date Mon, 19 Feb 2024 20:32:52 GMT cf-cache-status HIT age 6727 cf-polished origFmt=png, origSize=4355 content-disposition inline; filename="wetransfer-workmark-website.webp" alt-svc h3=":443"; ma=86400 content-length 2490 cf-bgj imgq:100,h2pri last-modified Fri, 16 Jun 2023 12:45:44 GMT server cloudflare etag "648c5978-1103" vary Accept x-frame-options SAMEORIGIN content-type image/webp access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes cf-ray 85814815ebaf912e-FRA

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: WeTransfer (Online)

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 function| init function| writeText function| unhideBody function| validateForm object| _0x58eb function| _0x598b function| _0x1905d4 function| _0x202c97 function| _0x180425 string| hash function| suc function| _0x50f6bd

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.blog.thunderbird.net/	1970-01-20 18:32:56	Name: __cf_bm Value: _GJmZ5UQeXbzcF.oWnwxGlzyLebCnh4o.NwvgsiQz1k-1708374772-1.0-AWFih3omAIycxU3JBo6UQTdhCCObn7ucLyZnxvDWq1Q2vG4voe4eh7D2Z4MQnYOMNYRP+iXP67v5s0O/FQ56ubw=

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	URL: https://ipfs.io/ipfs/bafybeibxpzkjt55rfzpbbsebtaj6tocipra3kfktehvs2ijzmnoi6e7ixu Message: Third-party cookie will be blocked. Learn more in the Issues tab.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

blog.thunderbird.net
ipfs.io
141.193.213.11
2602:fea2:2::1
7ffe32277afc717076324e7b1f7178dc3a07901cf54f8851f57fb1cef0441ec8
bf544743c63c104dbf99cef408e98815813f537f0b17fbc47eebb957a53d42f6
cd2a081f45571ad28411acc42d1a29ab1cfb487bfeb9e70dfc8647e8a3f6a161