bafkreic3q22kc74bfvphsgju7py6rdtn5iczd7f6zkh3giwf6ijppmylra.ipfs.dweb.link
Open in
urlscan Pro
2602:fea2:2::1
Malicious Activity!
Public Scan
Effective URL: https://bafkreic3q22kc74bfvphsgju7py6rdtn5iczd7f6zkh3giwf6ijppmylra.ipfs.dweb.link/
Submission: On July 28 via manual from US — Scanned from DE
Summary
TLS certificate: Issued by R3 on June 11th 2023. Valid for: 3 months.
This is the only time bafkreic3q22kc74bfvphsgju7py6rdtn5iczd7f6zkh3giwf6ijppmylra.ipfs.dweb.link was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 201.224.58.176 201.224.58.176 | 11556 (Cable & W...) (Cable & Wireless Panama) | |
1 2 | 104.161.94.249 104.161.94.249 | 53755 (IOFLOOD) (IOFLOOD) | |
1 | 2602:fea2:2::1 2602:fea2:2::1 | 40680 (PROTOCOL) (PROTOCOL) | |
1 | 2606:4700::68... 2606:4700::6811:180e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2001:4de0:ac1... 2001:4de0:ac18::1:a:3a | 20446 (STACKPATH...) (STACKPATH-CDN) | |
1 | 2a00:1450:400... 2a00:1450:4001:80f::2001 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a06:98c1:312... 2a06:98c1:3120::3 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
6 | 6 |
ASN11556 (Cable & Wireless Panama, PA)
PTR: multiservicios.cwpanama.com
bclientes.cwpanama.com |
ASN53755 (IOFLOOD, US)
PTR: we.love.servers.at.ioflood.net
ctt.reinforcemen.com |
ASN40680 (PROTOCOL, US)
bafkreic3q22kc74bfvphsgju7py6rdtn5iczd7f6zkh3giwf6ijppmylra.ipfs.dweb.link |
ASN15169 (GOOGLE, US)
lh3.googleusercontent.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
2 |
reinforcemen.com
1 redirects
ctt.reinforcemen.com |
754 B |
1 |
kgkagkgaga.ws
kgkagkgaga.ws — Cisco Umbrella Rank: 908817 |
|
1 |
googleusercontent.com
lh3.googleusercontent.com — Cisco Umbrella Rank: 107 |
193 KB |
1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 743 |
78 KB |
1 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 265 |
14 KB |
1 |
dweb.link
bafkreic3q22kc74bfvphsgju7py6rdtn5iczd7f6zkh3giwf6ijppmylra.ipfs.dweb.link |
30 KB |
1 |
cwpanama.com
1 redirects
bclientes.cwpanama.com |
457 B |
6 | 7 |
Domain | Requested by | |
---|---|---|
2 | ctt.reinforcemen.com | 1 redirects |
1 | kgkagkgaga.ws |
code.jquery.com
|
1 | lh3.googleusercontent.com | |
1 | code.jquery.com |
ctt.reinforcemen.com
|
1 | cdnjs.cloudflare.com |
bafkreic3q22kc74bfvphsgju7py6rdtn5iczd7f6zkh3giwf6ijppmylra.ipfs.dweb.link
|
1 | bafkreic3q22kc74bfvphsgju7py6rdtn5iczd7f6zkh3giwf6ijppmylra.ipfs.dweb.link |
ctt.reinforcemen.com
|
1 | bclientes.cwpanama.com | 1 redirects |
6 | 7 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
dweb.link R3 |
2023-06-11 - 2023-09-09 |
3 months | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2023-07-03 - 2024-07-02 |
a year | crt.sh |
*.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2023-07-11 - 2024-07-14 |
a year | crt.sh |
*.googleusercontent.com GTS CA 1C3 |
2023-07-10 - 2023-10-02 |
3 months | crt.sh |
kgkagkgaga.ws E1 |
2023-07-20 - 2023-10-18 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://bafkreic3q22kc74bfvphsgju7py6rdtn5iczd7f6zkh3giwf6ijppmylra.ipfs.dweb.link/
Frame ID: E5FC8C0C0E3E99BC5B5385F264156566
Requests: 6 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://bclientes.cwpanama.com/customers/module.php/core/loginuserpass.php?AuthState=_f6522b387362565de2fd6...
HTTP 302
http://ctt.reinforcemen.com/ctt Page URL
-
http://ctt.reinforcemen.com/red.php?e=163797072657373776f6f647465616d406374742e636f6d
HTTP 302
https://bafkreic3q22kc74bfvphsgju7py6rdtn5iczd7f6zkh3giwf6ijppmylra.ipfs.dweb.link/ Page URL
Detected technologies
jQuery (JavaScript Libraries) ExpandDetected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://bclientes.cwpanama.com/customers/module.php/core/loginuserpass.php?AuthState=_f6522b387362565de2fd6c90c667dff1393e050975%3Ahttp://ctt.reinforcemen.com/ctt
HTTP 302
http://ctt.reinforcemen.com/ctt Page URL
-
http://ctt.reinforcemen.com/red.php?e=163797072657373776f6f647465616d406374742e636f6d
HTTP 302
https://bafkreic3q22kc74bfvphsgju7py6rdtn5iczd7f6zkh3giwf6ijppmylra.ipfs.dweb.link/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://bclientes.cwpanama.com/customers/module.php/core/loginuserpass.php?AuthState=_f6522b387362565de2fd6c90c667dff1393e050975%3Ahttp://ctt.reinforcemen.com/ctt HTTP 302
- http://ctt.reinforcemen.com/ctt
6 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
ctt
ctt.reinforcemen.com/ Redirect Chain
|
164 B 373 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
/
bafkreic3q22kc74bfvphsgju7py6rdtn5iczd7f6zkh3giwf6ijppmylra.ipfs.dweb.link/ Redirect Chain
|
39 KB 30 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
crypto-js.min.js
cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/ |
47 KB 14 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-1.9.1.js
code.jquery.com/ |
262 KB 78 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
AJFCJaXhZo6cUCNh1ssNQzSV3jc1ppd5Vt2HN5GjHL82rJR25OrOigrMWVvBpwQN6BD4T_qHdwh2spOZ9bKA-BqcHsttYMUy5sxc-E99nKe9pgDJsCX0icydpRhjm97W_S4_6cism2sTCOp-Oxa807yjCEw=w1580-h720-s-no
lh3.googleusercontent.com/pw/ |
192 KB 193 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
/
kgkagkgaga.ws/obufsssssssscaaatoion/ |
87 KB 0 |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)159 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| CryptoJS string| RjvFbeSO function| _0x319b function| _0x4f1cd8 function| _0x2e1884 function| _0x11f764 function| _0x1b71d1 function| _0x18223d function| _0x292960 function| _0x3dc860 function| _0x29bcd1 function| _0x2c6481 function| _0xe1208b function| _0x2936f7 function| _0x2c4b27 function| _0x23e5f4 function| _0x127e8b function| _0x15a274 function| _0x671b7 function| _0x32fb38 function| _0x1feb31 function| _0x2df521 function| _0x334792 function| _0x685cc7 function| _0x15c0cd function| _0x4e1095 function| _0x31404e function| _0x524e66 function| _0x445ff8 function| _0x1928ee function| _0x440513 function| _0x5ae499 function| _0x27367a function| _0x3c5833 function| _0x40bd09 function| _0x509fb0 function| _0x22e5f2 function| _0x5bbf9c function| _0x1f3ace function| _0x4e4faa function| _0x30c855 function| _0x371daf function| _0x30cc27 function| _0x24b7fe function| _0x5bc806 function| _0x2c5065 function| _0x58a4ce function| _0x2bf013 function| _0x32ce21 function| _0x2e234f function| _0x22c8fe function| _0x4cd391 function| _0x6836b4 function| _0x1c94aa function| _0x58bd12 function| _0x52c291 function| _0x234f79 function| _0x98821a function| _0x975b2d function| _0x259bb4 function| _0x490977 function| _0x5f388b function| _0x479424 function| _0x55bda7 function| _0x49bad1 function| _0x112af function| _0xbf7070 function| _0x182dc3 function| _0x19a2e8 function| _0x54e5aa function| _0x142909 function| _0x2e9929 function| _0x1f4bfa function| _0x29c0e0 function| _0x30269a function| _0x3d9688 function| _0x3bd9b7 function| _0xcdf1de function| _0x29f198 function| _0x3e10de function| _0x2edcee function| _0x1d6e4e function| _0x127589 function| _0x4527ed function| _0x47f372 function| _0x224dfc function| _0x1fd11d function| _0x4197a2 function| _0x4311f1 function| _0x537fd0 function| _0x5487f9 function| _0x590c73 function| _0x46fccf function| _0x279aec function| _0x48944f function| _0x4addd2 function| _0xbb5285 function| _0x2863ee function| _0x4a4929 function| _0x276b34 function| _0xd03ea9 function| _0xe2b60e function| _0x145022 function| _0x7b27d9 function| _0x27614d function| _0x17964e function| _0x5e8c22 function| _0x11aec6 function| _0x5db6ce function| _0xa7fc9b function| _0x205478 function| _0x4d2e3a function| _0xef077d function| _0x37a4f9 function| _0x538584 function| _0x510fc6 function| _0x58ff10 function| _0x3984d6 function| _0x8f39ab function| _0x3091b7 function| _0xb661c function| _0x2c318e function| _0x1eb9f0 function| _0x383c63 function| _0x165cea function| _0x8e4ad2 function| _0x53e6d2 function| _0x8c44f7 function| _0x4c8600 function| _0x16b67f function| _0x6a6cb0 function| _0x23c56a function| _0xdee039 function| _0xed258f function| _0x5b8f65 function| _0x215f44 function| _0x43402e function| _0x2405c2 function| _0x28cb44 function| _0xa22477 function| _0x2dae8e function| _0x3e11c8 function| _0xe66f1 function| _0x105b60 function| _0x325462 function| _0x531db8 function| _0x190a31 function| _0x4ced0a function| _0x5409e1 function| _0x5c04 object| _0x9ca9 string| IGOBZL string| cbbg string| kaka90nal string| ka45k459final2 string| kak0011afinal number| countttingerr function| $ function| jQuery1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
bclientes.cwpanama.com/ | Name: PHPSESSID Value: 5685a56bb25cc561692fc2bc5ccda071 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
bafkreic3q22kc74bfvphsgju7py6rdtn5iczd7f6zkh3giwf6ijppmylra.ipfs.dweb.link
bclientes.cwpanama.com
cdnjs.cloudflare.com
code.jquery.com
ctt.reinforcemen.com
kgkagkgaga.ws
lh3.googleusercontent.com
104.161.94.249
2001:4de0:ac18::1:a:3a
201.224.58.176
2602:fea2:2::1
2606:4700::6811:180e
2a00:1450:4001:80f::2001
2a06:98c1:3120::3
5b86b4a17f812d5e791934fbf1e88e6dea0591fcbeca8fb322c5f212f7b30b88
7bd80d06c01c0340c1b9159b9b4a197db882ca18cbac8e9b9aa025e68f998d40
8e3b0117f4df4be452c0b6af5b8f0a0acf9d4ade23d08d55d7e312af22077762
c51ecfdbb39612d629bbbfa57896c63dc52971d7bcf78f1795944be16274a8eb