bafkreifthophxn3rfo646kzcylodadmnnhyg3h2t2wzrqi7mqnuc3str2m.ipfs.dweb.link
Open in
urlscan Pro
209.94.90.1
Malicious Activity!
Public Scan
Submission: On July 22 via api from US — Scanned from US
Summary
TLS certificate: Issued by R3 on June 11th 2023. Valid for: 3 months.
This is the only time bafkreifthophxn3rfo646kzcylodadmnnhyg3h2t2wzrqi7mqnuc3str2m.ipfs.dweb.link was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 209.94.90.1 209.94.90.1 | 40680 (PROTOCOL) (PROTOCOL) | |
1 | 104.17.25.14 104.17.25.14 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 69.16.175.42 69.16.175.42 | 20446 (STACKPATH...) (STACKPATH-CDN) | |
10 | 172.217.13.161 172.217.13.161 | 15169 (GOOGLE) (GOOGLE) | |
1 | 172.67.193.237 172.67.193.237 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 152.199.4.44 152.199.4.44 | 15133 (EDGECAST) (EDGECAST) | |
15 | 6 |
ASN40680 (PROTOCOL, US)
bafkreifthophxn3rfo646kzcylodadmnnhyg3h2t2wzrqi7mqnuc3str2m.ipfs.dweb.link |
ASN15169 (GOOGLE, US)
PTR: yul03s04-in-f1.1e100.net
lh3.googleusercontent.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
10 |
googleusercontent.com
lh3.googleusercontent.com — Cisco Umbrella Rank: 111 |
242 KB |
1 |
msftauth.net
aadcdn.msftauth.net — Cisco Umbrella Rank: 1029 |
669 B |
1 |
lkalzzop.online
lkalzzop.online |
72 KB |
1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 724 |
78 KB |
1 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 261 |
14 KB |
1 |
dweb.link
bafkreifthophxn3rfo646kzcylodadmnnhyg3h2t2wzrqi7mqnuc3str2m.ipfs.dweb.link |
40 KB |
15 | 6 |
Domain | Requested by | |
---|---|---|
10 | lh3.googleusercontent.com | |
1 | aadcdn.msftauth.net | |
1 | lkalzzop.online |
code.jquery.com
|
1 | code.jquery.com |
bafkreifthophxn3rfo646kzcylodadmnnhyg3h2t2wzrqi7mqnuc3str2m.ipfs.dweb.link
|
1 | cdnjs.cloudflare.com |
bafkreifthophxn3rfo646kzcylodadmnnhyg3h2t2wzrqi7mqnuc3str2m.ipfs.dweb.link
|
1 | bafkreifthophxn3rfo646kzcylodadmnnhyg3h2t2wzrqi7mqnuc3str2m.ipfs.dweb.link | |
15 | 6 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
dweb.link R3 |
2023-06-11 - 2023-09-09 |
3 months | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2023-07-03 - 2024-07-02 |
a year | crt.sh |
*.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2023-07-11 - 2024-07-14 |
a year | crt.sh |
*.googleusercontent.com GTS CA 1C3 |
2023-07-03 - 2023-09-25 |
3 months | crt.sh |
lkalzzop.online E1 |
2023-05-25 - 2023-08-23 |
3 months | crt.sh |
aadcdn.msftauth.net DigiCert SHA2 Secure Server CA |
2023-01-31 - 2024-01-31 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://bafkreifthophxn3rfo646kzcylodadmnnhyg3h2t2wzrqi7mqnuc3str2m.ipfs.dweb.link/
Frame ID: FE83948AF3B118625F5493A67AF2750A
Requests: 15 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
15 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
bafkreifthophxn3rfo646kzcylodadmnnhyg3h2t2wzrqi7mqnuc3str2m.ipfs.dweb.link/ |
57 KB 40 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
crypto-js.min.js
cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/ |
47 KB 14 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-1.9.1.js
code.jquery.com/ |
262 KB 78 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
AJFCJaXhZo6cUCNh1ssNQzSV3jc1ppd5Vt2HN5GjHL82rJR25OrOigrMWVvBpwQN6BD4T_qHdwh2spOZ9bKA-BqcHsttYMUy5sxc-E99nKe9pgDJsCX0icydpRhjm97W_S4_6cism2sTCOp-Oxa807yjCEw=w1580-h720-s-no
lh3.googleusercontent.com/pw/ |
192 KB 193 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
/
lkalzzop.online/obufsssssssscaaatoion/ |
928 KB 72 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
AMWts8C1y-LmqPwr79FSVd9YMV5yeje6h34dtqg8n1c7UYT__udX1hIixqqaItUS-Vtl4epJI-2Qtycgc0GgiWtrFAFZIVdjRD8HShOpZsK0Vucx0qiSJ9iKKAd1_ocqVqIgMtn1jlLj4HB4Ap_2ZUiwAnk=w108-h24-no
lh3.googleusercontent.com/pw/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
AMWts8CNmlIjdTtHgPdAMoSG4uyQnKbGT1407U5GJD9BBD5gOhyThvxN7ptqzSc9OV7GvMrNxsLjt_kin2qpj8tlLu4VPG_UA8XrdDZZYTEJRXHQkb_glHR4oYOoSP3tDH1rPkDWcGOdNw-zacvrmMF7NU0=s150-no
lh3.googleusercontent.com/pw/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
AMWts8DXuoTCchIiCUMSjRAC76eUjCoJ1Hj726Mdu1LszHJglP2MLf_RoCW0uZpRXU92HCp7sJJtRW1SSsaUhnE1muSBc8avCHEqEHuLdsuLbYPj0hMJ1kVq-hZ1eYf_w6QcxuCHVVBR-siBvHZM2G9Rlbw=s150-no
lh3.googleusercontent.com/pw/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
AMWts8CLLNnGpj7_FWohqCPJSzzgHwWUwFqF-CN0acr9XqBJvbhlCprvfnAvLav0gAOr0ez63QMTk6WPV7V7rT_ZZ7E5ueysaU99HDwu7huiWEUvbNO3mDIklTKmUuxN9sPyZMwDPt-T39tp9ZO2Pq53dRI=s150-no
lh3.googleusercontent.com/pw/ |
6 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg
aadcdn.msftauth.net/shared/1.0/content/images/ |
513 B 669 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
AMWts8AK-lOypWQRHV6CblnIhwum5iMC-2fHJehOkF8BqfFCgB1DZT2LI30pbRIC605sfh4PyJS0qLFawTwXAyFCgEjDlPQe4GThYYbbx5CB-urZNnpa1Uhn-GrOGG5UcX6f5GsSPkypixgkdMoOBFlQqZ4=s150-no
lh3.googleusercontent.com/pw/ |
810 B 947 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
AMWts8Cql-_FqT-vTMz5KecPfNkES17GUcAhZtgXLH0x4Wv9Lj4vnoCGPorATuuzvKe5c-hTrhXFnWh6cu4TC2cJjWKbnr2Fq-avQW5Q1oqvrNCP29CvGjXZZkxpkBgWTjA6DBjYlYpLr5-pfWHOb04OsBY=s150-no
lh3.googleusercontent.com/pw/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
AMWts8CPpl_w_5Fj80z5l9jlYET_SacByn_w9oXKdt92XWEATpkaTNMXRjd49krHesOb3FAHMXEQBD5153gSMnAZGOmXwR9Rp_K_-6jVQvTb4qi9QggArKoSZ61C-gpBRHxrTvoFunjzMPQhEspfqSTvD-o=s150-no
lh3.googleusercontent.com/pw/ |
5 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
AMWts8BB5eL1vbp9dPEQCSEMJxM3Y9agty2fbo3XhD76Dz3OBAH0vp3VSA07-yrArrrYp5TuF80R6HzDKK65oJ8-tv7Px-SFgTOIBONfJYbApe2ilHyCEg9LRrwu52XsghVBZuQtpKdlw0j9iUdY8MqKhVU=s150-no
lh3.googleusercontent.com/pw/ |
3 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
AMWts8D8e5caxJov7GOp1rwDQidEks3V2UuXk1O7PZDbHZa5IL_i0KpG0ekmdhUvoDq55PguGPsZ-IFD0DpviH169WF09S-C8-tYQlW5MiYBzUesaWNDrAhwB3xLJo66GKNcYquCnPMjb1AN4oiTdyMOkvI=w1652-h929-no
lh3.googleusercontent.com/pw/ |
19 KB 19 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)301 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
string| wfDhAXFW string| gBIKYhYw string| EYDIOrTC string| ShsPXRCz string| AJlcDtJI string| kbFGgMij string| SkLYaKOa string| ZwVdUEyV string| clhwsQrf string| UvZyZhKZ string| MQBFcloK string| eyaDXTbs string| nyoKMagV string| JxNdjPrL string| xVFuSIlt string| fyZLgdtz string| sfyrDTMT string| SYBaHvaf string| fVdFnxzP string| oLmqxUFo string| AqcPcQIn string| knorMygq string| SxriUEoS string| JhYNjNZk string| mLknUhgS string| VtTJPoaZ string| ZIspvnoW string| EQejdROG string| hgSFEBki string| kGifNhDu string| hUftWGrr string| ZsvzvGMg string| RvLIANck string| EtDEPElQ string| Rpjgsezt string| MlwitxWw string| PwIxPCIg string| gQapBHfs string| ImGarqsj string| LkEAZJyk string| NaeZVKkT string| JDTUAPIJ string| uEdjCPZK string| ngQPaBGH string| mGWMJsEq string| GBgWkkEy string| lHteZock string| krXLHZMM string| RcNYCVZq string| kRGXRRCD string| BWKoNjQi string| LobsMVqA string| aJXirevi string| fxOUEISi string| oqFJVPbf string| VNNLceUA string| MNDggpWc string| UALobIHQ string| VKCBFdKr string| LfscXqHz string| AkOhyhBE string| PvkeFQZx string| QqqChXEv string| whVSBGuW string| wAdpkZpe string| fmhrWspH string| IZSYtkUG string| hzMiDgJB string| QTdwmsNd string| MTCszKzS string| FuNtUYAR string| dlFfBwSf string| XdFvvpYS string| qoibQtqY string| JGOBhikg string| JnYvxwgo string| WChEWNfh string| UZkmoWlS string| uiihQfon string| UWKFrlKb string| ksRRxibe string| FXRVDJgx string| qGdkKNlh string| WdMGarSs string| bFDlthSR string| hGNpqWHg string| xEEtWSRP string| IrLJJXvz string| pfuRnWFv string| CMBSDiaC string| EBFfDxkk string| AqqGqLbG string| jzSiYdFV string| DYNnJGQk string| hJjlcndX string| KDGFSLBC string| ViGBXVUe string| hZlKJDLF string| mtPNczSP string| ayieJTZP string| HzUUuaCo string| DNRmYNaj string| PcQoeLZo string| CcAVVJQA string| wiGdNFBA string| sJJiGztG string| hModQHIJ string| rTDGRvQA string| ieVouHCx string| oryzpmna string| wnGIgsCZ string| jkBgKhCA string| IEQLYQfj string| KdnZHjtm string| pAKeHPag string| FDnMkYoK string| jTaJjVxF string| ezNntFYw string| IpuQyeSK string| YJJNnjfB string| tWhijNHn string| WElFbtUd string| YwfCRUlz string| YrMYWArh string| UoAKzdWv string| ocQAKyim string| HelUobxg string| YsaDstwU string| WXtbFLwv string| lmAfkREV string| dnheQVef string| VKkhwQtw string| oBWJBGQp string| LfyzjBLc string| cxJjpWCa string| gFHCwefV string| MpNUUsZR string| ZdxcNxcL string| iiPimRPR string| sASREYDd string| NmjYOYGc string| kLXQmMiy string| cijPxzxy string| dkwYdKNJ string| pTyZbjrZ string| pGotYOeO string| xKTfjLNi object| CryptoJS object| decrypted object| key function| _0x3440 function| _0x35a4c7 function| _0x3776f9 function| _0x4e6030 function| _0xbb0e76 function| _0x31b828 function| _0x50a0fc function| _0x1b7580 function| _0x2fbcf4 function| _0x27a45e function| _0x5b0056 function| _0x546dc8 function| _0x133bf3 function| _0x3ae71f function| _0x5856e9 function| _0x226a94 function| _0x3806aa function| _0x4cf543 function| _0x299909 function| _0x2a19e8 function| _0x40c279 function| _0x1a09fa function| _0x11030e function| _0x16d8b4 function| _0x3b491d function| _0x1a69ed function| _0x287717 function| _0x375718 function| _0x9ff6f4 function| _0x3b5534 function| _0x143ee4 function| _0x49a999 function| _0x4fadbd function| _0x42fd1f function| _0x48d18f function| _0x106a1b function| _0x22c942 function| _0x3df983 function| _0x17b022 function| _0x56defb function| _0x4de071 function| _0x56a928 function| _0x3e5d2e function| _0x39830b function| _0x1f1815 function| _0x4aced0 function| _0x1510e2 function| _0x674b31 function| _0x4caf41 function| _0x56660d function| _0x198d15 function| _0x53eb4d function| _0x3bed6a function| _0x3e640e function| _0x5392e5 function| _0x4b9823 function| _0x24c0d8 function| _0x179818 function| _0x294868 function| _0x3e5715 function| _0x1108cc function| _0xc8ffa4 function| _0x2dbd84 function| _0x320530 function| _0x27c835 function| _0x514c10 function| _0x3ba5f2 function| _0x7ace0d function| _0x40f06c function| _0x1f2f5b function| _0x5e1c42 function| _0x49deff function| _0xc0d76 function| _0x57788c function| _0x44da10 function| _0x2e8a6d function| _0xb9a87c function| _0x17c0d6 function| _0x5a5cc3 function| _0x4619a8 function| _0x4db27e function| _0x19371a function| _0x451fb7 function| _0x431c4b function| _0x3327de function| _0x1cfe2a function| _0x8ecb85 function| _0x5cc6f1 function| _0x13d6b6 function| _0x46e874 function| _0x4f5f06 function| _0x462a31 function| _0xb9ac10 function| _0x5787e2 function| _0x396548 function| _0x1a78cf function| _0x2b1e41 function| _0x2621cc function| _0x44a627 function| _0x1b8bb2 function| _0x4fdd4b function| _0x726b4d function| _0x13a738 function| _0x24dca3 function| _0x16acbc function| _0x457070 function| _0x27bedb function| _0x90156d function| _0x5db3ea function| _0x5f5d9e function| _0xaafdb5 function| _0x166b1d function| _0x382c84 function| _0x3274b5 function| _0x51d851 function| _0x52cb27 function| _0x2428b0 function| _0x3e7f39 function| _0x2e3995 function| _0x2b5a15 function| _0x3d3027 function| _0x6ffd77 function| _0x47b714 function| _0xe6062d function| _0x186b4f function| _0x552cbf function| _0x2cbe41 function| _0x230a2b function| _0x46479e function| _0x454597 function| _0x4b79d9 function| _0x220423 function| _0x431fa3 function| _0x166f34 function| _0x228b44 function| _0x5f5104 function| _0x59e2eb function| _0x4c21 object| _0xa077 string| IGOBZL string| cbbg string| kaka90nal string| ka45k459final2 string| kak0011afinal number| countttingerr function| $ function| jQuery string| kakakaafinal string| getjsonnn number| counterror number| dalizk0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=31536000; includeSubDomains; preload |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
aadcdn.msftauth.net
bafkreifthophxn3rfo646kzcylodadmnnhyg3h2t2wzrqi7mqnuc3str2m.ipfs.dweb.link
cdnjs.cloudflare.com
code.jquery.com
lh3.googleusercontent.com
lkalzzop.online
104.17.25.14
152.199.4.44
172.217.13.161
172.67.193.237
209.94.90.1
69.16.175.42
033ae15f266ca2f0edb4980492e4e70c5a41ffb87ee9f6daaea6a4ef64980034
2d44c3b13c9057d5ef8db356f47f29d0a7b79ccce4a1140018352289cb304336
34058a4c997349cd3c91a3bc59bcc82dd6920bd57a555b49875bf71eae942e2c
34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58
7bd80d06c01c0340c1b9159b9b4a197db882ca18cbac8e9b9aa025e68f998d40
8e3b0117f4df4be452c0b6af5b8f0a0acf9d4ade23d08d55d7e312af22077762
930b3261c05ddf41566ca5906f3a5f91a437bf4de2513a84d5995a8aa1aec819
994ac85af4db5a2b5f7ce72d4f49c6b1c18c6422c8e57e623a2873bd7599e404
b13e4bfdccc28dc4b28733f02099beb91f8dbd3299c883a99dac7b619379d822
b33b9e7bb7712bbdcf2b22c2dc300d8d69f06d9f53d5b31823ec83682dca71d3
c51ecfdbb39612d629bbbfa57896c63dc52971d7bcf78f1795944be16274a8eb
d1b8ac36f78215154031b551101879964a09a9e3c2ce4c7e89ccfb59eafd9879
efcfd4559471866f1f28ff4c67fd629c36fec893ea2071b8e54509a2471fedd5
f25dfd78d4d536460d422ea51153547edeb12f9662867f8972413972007e35c3
f2c40a63580308bf348c5e8eb9a0880238f5f207e228e0c091e83b1efcbf979f