jorropo.net Open in urlscan Pro
163.172.31.60  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
3 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request en.mail.html Show response jorropo.net/ipfs/bafybeiaooq6tyxtxgc5f235ptddsy576dyjpudvmue2v645vgcepkq64l4/	752 KB 202 KB	376ms 38ms	Document text/html	163.172.31.60 Online SAS
General Check archive.org Show headers Download Go to Full URL https://jorropo.net/ipfs/bafybeiaooq6tyxtxgc5f235ptddsy576dyjpudvmue2v645vgcepkq64l4/en.mail.html? Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 163.172.31.60 , France, ASN12876 (Online SAS, FR), Reverse DNS 163-172-31-60.rev.poneytelecom.eu Software nginx/1.22.1 / Resource Hash 1f6a807b806277d5873b713e8655e4613508112cc4e9316bddb4a5ee39ce34cc Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 accept-language fr-FR,fr;q=0.9 Response headers access-control-allow-headers Content-Type Range User-Agent X-Requested-With access-control-allow-methods GET access-control-allow-origin * access-control-expose-headers Content-Length Content-Range X-Chunked-Output X-Ipfs-Path X-Ipfs-Roots X-Stream-Output cache-control public, max-age=29030400, immutable content-encoding gzip content-type text/html date Wed, 18 Jan 2023 13:07:50 GMT etag W/"bafkreia7nkahxadco7kyoo3rh2dflzdbguebclge5eywxxnuuxxdttruzq" server nginx/1.22.1 x-ipfs-path /ipfs/bafybeiaooq6tyxtxgc5f235ptddsy576dyjpudvmue2v645vgcepkq64l4/en.mail.html x-ipfs-roots bafybeiaooq6tyxtxgc5f235ptddsy576dyjpudvmue2v645vgcepkq64l4,bafkreia7nkahxadco7kyoo3rh2dflzdbguebclge5eywxxnuuxxdttruzq
GET H2	200	bootstrap.min.css maxcdn.bootstrapcdn.com/bootstrap/4.3.1/css/	152 KB 24 KB	75ms 35ms	Stylesheet text/css	2606:4700::6812:bcf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://maxcdn.bootstrapcdn.com/bootstrap/4.3.1/css/bootstrap.min.css Requested by Host: jorropo.net URL: https://jorropo.net/ipfs/bafybeiaooq6tyxtxgc5f235ptddsy576dyjpudvmue2v645vgcepkq64l4/en.mail.html? Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 60b19e5da6a9234ff9220668a5ec1125c157a268513256188ee80f2d2c8d8d36 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language fr-FR,fr;q=0.9 Referer https://jorropo.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers date Wed, 18 Jan 2023 13:07:50 GMT strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff cf-cache-status HIT content-encoding br cdn-edgestorageid 951 age 13409275 cdn-cachedat 07/25/2022 03:11:26 cdn-pullzone 252412 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 last-modified Mon, 25 Jan 2021 22:04:08 GMT cdn-proxyver 1.02 cdn-requestpullcode 200 server cloudflare etag W/"a15c2ac3234aa8f6064ef9c1f7383c37" vary Accept-Encoding content-type text/css; charset=utf-8 access-control-allow-origin * cdn-cache HIT cdn-uid b1941f61-b576-4f40-80de-5677acb38f74 cache-control public, max-age=31919000 cdn-requestid 1ab1a8ef7ccbc6d297e0cd739cbffa38 timing-allow-origin * cdn-requestcountrycode FR cdn-status 200 cf-ray 78b78e501e60d6b2-CDG cdn-requestpullsuccess True
GET H2	200	jquery-2.0.3.min.js Show response lib.sinaapp.com/js/jquery/2.0.3/	82 KB 29 KB	2561ms 186ms	Script application/javascript	27.221.16.146 CHINA169-BACKBONE...
General Check archive.org Show headers Download Go to Full URL https://lib.sinaapp.com/js/jquery/2.0.3/jquery-2.0.3.min.js Requested by Host: jorropo.net URL: https://jorropo.net/ipfs/bafybeiaooq6tyxtxgc5f235ptddsy576dyjpudvmue2v645vgcepkq64l4/en.mail.html? Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 27.221.16.146 , China, ASN4837 (CHINA169-BACKBONE CHINA UNICOM China169 Backbone, CN), Reverse DNS Software nginx / Resource Hash b13cb5989e08fcb02314209d101e1102f3d299109bdc253b62aa1da21c9e38ba Request headers Referer https://jorropo.net/ accept-language fr-FR,fr;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Wed, 18 Jan 2023 13:07:52 GMT content-encoding gzip via 5219 last-modified Sat, 28 Mar 2020 03:02:31 GMT server nginx vary Accept-Encoding content-type application/javascript cache-control max-age=604800 sae-cache HIT from 27.221.16.146 accept-ranges bytes content-length 29332 expires Wed, 25 Jan 2023 13:07:52 GMT
GET DATA	200 OK	truncated /	555 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 93f553f07040ccaa21c9fa7c4ec02e97aff4999acee2bd4bdf9860100a1ea08a Request headers accept-language fr-FR,fr;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	15 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash aba082654ed9a884ee14954d8a4085aff721d03989fcc16934f4d03cf6a55229 Request headers accept-language fr-FR,fr;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	24 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 6a6beae164a3397dd506f59af5261bb7662b9344a3225c0f4d7f857f54f4db13 Request headers accept-language fr-FR,fr;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers Content-Type image/png
OPTIONS H2	204	standard screendot.io/api/	0 0	330ms 269ms	Preflight	2606:4700:3031::6815:50ba CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://screendot.io/api/standard?response=json&url=http://&delay=2&browserWidth=1600&browserHeight=1200 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3031::6815:50ba , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept */* Access-Control-Request-Headers authorization Access-Control-Request-Method GET Origin https://jorropo.net Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers access-control-allow-headers authorization access-control-allow-methods GET access-control-allow-origin * access-control-max-age 0 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 cache-control no-cache, private cf-cache-status DYNAMIC cf-ray 78b78e6229271542-CDG date Wed, 18 Jan 2023 13:07:53 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FXdDP4JIGOMM0xCRM%2FMO7yWAupTru19i8sl8fk07%2BGE7XapTLPUgmhJdGSsTprXbj9yptvJUR5j9a5HI9B7NxHE2SIwoJpWuKiB56hGB0E3VZoYg3tFwrxHeRij7qWf9ombtxwJn2F4RjCo%3D"}],"group":"cf-nel","max_age":604800} server cloudflare vary Access-Control-Request-Method, Access-Control-Request-Headers x-content-type-options nosniff x-frame-options SAMEORIGIN x-xss-protection 1; mode=block
GET H2	400	standard Show response screendot.io/api/	40 B 369 B	141ms 140ms	Fetch application/json	2606:4700:3031::6815:50ba CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://screendot.io/api/standard?response=json&url=http://&delay=2&browserWidth=1600&browserHeight=1200 Requested by Host: jorropo.net URL: https://jorropo.net/ipfs/bafybeiaooq6tyxtxgc5f235ptddsy576dyjpudvmue2v645vgcepkq64l4/en.mail.html? Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3031::6815:50ba , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dfefec49df5a567bd6c7997d0603b10fcd709e74acb9f0028c3c83f1ee488c5d Request headers Accept application/image Referer https://jorropo.net/ accept-language fr-FR,fr;q=0.9 Authorization Bearer nd2oa95Wwy5jajosaqbBG6sEUNMTiCq4Z2lVPg2e User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36 Response headers date Wed, 18 Jan 2023 13:07:53 GMT cf-cache-status DYNAMIC nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare x-ratelimit-remaining 28 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kWtX0qJj9dC8sFSuDspw89rjVz8ZbTlwvyy1AhzRtmIE0h9Qi0oJ%2FCIiUBr%2B2Iq%2BofH1emCoXYm192K55xps9Htv6fYyBQYpHu8XM08ineF%2FoCyEfGXpZVwDYBFlTSVtRmdqfw8IvhGVtqM%3D"}],"group":"cf-nel","max_age":604800} content-type application/json access-control-allow-origin * cache-control no-cache, private x-ratelimit-limit 30 cf-ray 78b78e63dba71542-CDG alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 40

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Email (Online)

20 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontentvisibilityautostatechange function| $ function| jQuery function| _0x47d05e function| _0x3b2977 function| _0x5230a7 function| _0x3bd460 function| _0x3e9b function| _0x31b1a4 function| _0x3c2b2a function| _0x5a3f75 string| tgc object| _0x391aa2 function| _0x5de3de object| _0x254bbe function| _0x38bf34 function| _0x456d string| dri function| _0x303f43 function| _0x44ffd8

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	URL: https://jorropo.net/ipfs/bafybeiaooq6tyxtxgc5f235ptddsy576dyjpudvmue2v645vgcepkq64l4/en.mail.html?(Line 1) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://lib.sinaapp.com/js/jquery/2.0.3/jquery-2.0.3.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://jorropo.net/ipfs/bafybeiaooq6tyxtxgc5f235ptddsy576dyjpudvmue2v645vgcepkq64l4/en.mail.html?(Line 1) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://lib.sinaapp.com/js/jquery/2.0.3/jquery-2.0.3.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
network	error	URL: https://screendot.io/api/standard?response=json&url=http://&delay=2&browserWidth=1600&browserHeight=1200 Message: Failed to load resource: the server responded with a status of 400 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

jorropo.net
lib.sinaapp.com
maxcdn.bootstrapcdn.com
screendot.io
163.172.31.60
2606:4700:3031::6815:50ba
2606:4700::6812:bcf
27.221.16.146
1f6a807b806277d5873b713e8655e4613508112cc4e9316bddb4a5ee39ce34cc
60b19e5da6a9234ff9220668a5ec1125c157a268513256188ee80f2d2c8d8d36
6a6beae164a3397dd506f59af5261bb7662b9344a3225c0f4d7f857f54f4db13
93f553f07040ccaa21c9fa7c4ec02e97aff4999acee2bd4bdf9860100a1ea08a
aba082654ed9a884ee14954d8a4085aff721d03989fcc16934f4d03cf6a55229
b13cb5989e08fcb02314209d101e1102f3d299109bdc253b62aa1da21c9e38ba
dfefec49df5a567bd6c7997d0603b10fcd709e74acb9f0028c3c83f1ee488c5d