bafybeiadoxciih5qed4fmisuacz4ohssxbzpr6mqgbjdq43kbqna74j3bq.ipfs.dweb.link Open in urlscan Pro
2602:fea2:2::1  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
6 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response bafybeiadoxciih5qed4fmisuacz4ohssxbzpr6mqgbjdq43kbqna74j3bq.ipfs.dweb.link/	336 KB 150 KB	286ms 135ms	Document text/html	2602:fea2:2::1 PROTOCOL
General Check archive.org Show headers Download Go to Full URL https://bafybeiadoxciih5qed4fmisuacz4ohssxbzpr6mqgbjdq43kbqna74j3bq.ipfs.dweb.link/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2602:fea2:2::1 , United States, ASN40680 (PROTOCOL, US), Reverse DNS Software openresty / Resource Hash e024e1368e0bd6836581ffd285aff03bd4c07792d5ae7cb309d884b5bd1e53c6 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36 accept-language fi-FI,fi;q=0.9 Response headers access-control-allow-headers X-Requested-With, Range, Content-Range, X-Chunked-Output, X-Stream-Output access-control-allow-methods GET GET, POST, OPTIONS access-control-allow-origin * access-control-expose-headers Content-Range, X-Chunked-Output, X-Stream-Output cache-control public, max-age=29030400, immutable content-encoding gzip content-type text/html date Fri, 24 Mar 2023 18:53:40 GMT etag W/"bafybeiadoxciih5qed4fmisuacz4ohssxbzpr6mqgbjdq43kbqna74j3bq" server openresty strict-transport-security max-age=31536000; includeSubDomains; preload timing-allow-origin * vary Accept-Encoding x-ipfs-gateway-host ipfs-bank7-fr2 x-ipfs-lb-pop gateway-bank3-fr2 x-ipfs-path /ipfs/bafybeiadoxciih5qed4fmisuacz4ohssxbzpr6mqgbjdq43kbqna74j3bq/ x-ipfs-pop ipfs-bank7-fr2 x-ipfs-roots bafybeiadoxciih5qed4fmisuacz4ohssxbzpr6mqgbjdq43kbqna74j3bq x-proxy-cache HIT
GET H/1.1	200 OK	w3.css restauranttrelleborg-group.name.ng/review/	23 KB 23 KB	564ms 207ms	Stylesheet text/css	192.3.190.242 AS-COLOCROSSING
General Check archive.org Show headers Download Go to Full URL https://restauranttrelleborg-group.name.ng/review/w3.css Requested by Host: bafybeiadoxciih5qed4fmisuacz4ohssxbzpr6mqgbjdq43kbqna74j3bq.ipfs.dweb.link URL: https://bafybeiadoxciih5qed4fmisuacz4ohssxbzpr6mqgbjdq43kbqna74j3bq.ipfs.dweb.link/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 192.3.190.242 , United States, ASN36352 (AS-COLOCROSSING, US), Reverse DNS wgh18.wghservers.com Software Apache / Resource Hash c4f2aba13970ecf8303fb9329f97c8824861569273b0aa27acce48abc61d04f5 Request headers accept-language fi-FI,fi;q=0.9 Referer https://bafybeiadoxciih5qed4fmisuacz4ohssxbzpr6mqgbjdq43kbqna74j3bq.ipfs.dweb.link/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36 Response headers Date Fri, 24 Mar 2023 18:53:41 GMT Last-Modified Sun, 16 Oct 2022 11:54:04 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 23427
GET		all.min.css bafybeiadoxciih5qed4fmisuacz4ohssxbzpr6mqgbjdq43kbqna74j3bq.ipfs.dweb.link/cdnjs.cloudflare.com/ajax/libs/font-awesome/6.1.1/css/	0 0
GET H/1.1	200 OK	plausible.js Show response analytics.tiiny.site/js/	1 KB 2 KB	238ms 78ms	Script application/javascript	3.10.126.206 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://analytics.tiiny.site/js/plausible.js Requested by Host: bafybeiadoxciih5qed4fmisuacz4ohssxbzpr6mqgbjdq43kbqna74j3bq.ipfs.dweb.link URL: https://bafybeiadoxciih5qed4fmisuacz4ohssxbzpr6mqgbjdq43kbqna74j3bq.ipfs.dweb.link/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.10.126.206 London, United Kingdom, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-10-126-206.eu-west-2.compute.amazonaws.com Software nginx/1.20.0 / Resource Hash 7eec3429c76cb48e5fd457c5afb71b7cf34bc4298d53023bae8aea715443b4a9 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language fi-FI,fi;q=0.9 Referer https://bafybeiadoxciih5qed4fmisuacz4ohssxbzpr6mqgbjdq43kbqna74j3bq.ipfs.dweb.link/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36 Response headers Date Fri, 24 Mar 2023 18:53:41 GMT x-content-type-options nosniff Server nginx/1.20.0 Content-Type application/javascript access-control-allow-origin * cache-control max-age=0, private, must-revalidate cross-origin-resource-policy cross-origin Connection keep-alive Content-Length 1332
GET DATA	200 OK	truncated /	11 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 72824f3fe09c1e718f8ef2726b7ac44591443f2e6d6c68cc2faf2a2a042dd933 Request headers accept-language fi-FI,fi;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	10 KB 0		Image image/jpeg
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash c387092aa56fb5837772d45151eb6aead41d77472959d8c14dc2df043d50e3c3 Request headers accept-language fi-FI,fi;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36 Response headers Content-Type image/jpeg
GET DATA	200 OK	truncated /	4 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 5d06241f1eebbe8cf9c32e2fd9fcede046757997ae44d122ea6756474d3af05a Request headers accept-language fi-FI,fi;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	8 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash b6801179664e6f0c5a76912cc463466cb9a3539168b2b0b71de26fd307af7384 Request headers accept-language fi-FI,fi;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	40 KB 0		Image image/jpeg
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 3c980cd344c939662b52e4fa1c4e5a5f987d4323205a264212a32bf161e07597 Request headers accept-language fi-FI,fi;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36 Response headers Content-Type image/jpeg
GET DATA	200 OK	truncated /	17 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 910799ca3f14106d049f818aaa24d5cf84ae915ddb43d5a34dd2920894546d8e Request headers accept-language fi-FI,fi;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36 Response headers Content-Type image/png
GET H2	200	arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg logincdn.msauth.net/shared/1.0/content/images/	513 B 671 B	239ms 49ms	Image image/svg+xml	192.229.221.185 EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://logincdn.msauth.net/shared/1.0/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg Requested by Host: bafybeiadoxciih5qed4fmisuacz4ohssxbzpr6mqgbjdq43kbqna74j3bq.ipfs.dweb.link URL: https://bafybeiadoxciih5qed4fmisuacz4ohssxbzpr6mqgbjdq43kbqna74j3bq.ipfs.dweb.link/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.229.221.185 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (ska/F7A3) / Resource Hash 34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58 Request headers accept-language fi-FI,fi;q=0.9 Referer https://bafybeiadoxciih5qed4fmisuacz4ohssxbzpr6mqgbjdq43kbqna74j3bq.ipfs.dweb.link/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Fri, 24 Mar 2023 18:53:41 GMT content-encoding gzip content-md5 TjUQkZ0p0Y7rbj6LJofS9Q== age 23905951 x-cache HIT content-length 276 x-ms-lease-status unlocked last-modified Wed, 22 Jan 2020 00:32:44 GMT server ECAcc (ska/F7A3) etag 0x8D79ED2994A7074 vary Accept-Encoding content-type image/svg+xml access-control-allow-origin * x-ms-request-id 39131501-701e-0017-6715-857961000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H/1.1	200 OK	jquery-3.6.0.min.js Show response restauranttrelleborg-group.name.ng/review/	87 KB 88 KB	491ms 163ms	Script application/javascript	192.3.190.242 AS-COLOCROSSING
General Check archive.org Show headers Download Go to Full URL https://restauranttrelleborg-group.name.ng/review/jquery-3.6.0.min.js Requested by Host: bafybeiadoxciih5qed4fmisuacz4ohssxbzpr6mqgbjdq43kbqna74j3bq.ipfs.dweb.link URL: https://bafybeiadoxciih5qed4fmisuacz4ohssxbzpr6mqgbjdq43kbqna74j3bq.ipfs.dweb.link/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 192.3.190.242 , United States, ASN36352 (AS-COLOCROSSING, US), Reverse DNS wgh18.wghservers.com Software Apache / Resource Hash ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e Request headers accept-language fi-FI,fi;q=0.9 Referer https://bafybeiadoxciih5qed4fmisuacz4ohssxbzpr6mqgbjdq43kbqna74j3bq.ipfs.dweb.link/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36 Response headers Date Fri, 24 Mar 2023 18:53:41 GMT Last-Modified Fri, 12 Aug 2022 13:47:02 GMT Server Apache Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 89501
POST H/1.1	202 Accepted	event Show response analytics.tiiny.site/api/	2 B 363 B	284ms 133ms	XHR text/plain	3.10.126.206 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://analytics.tiiny.site/api/event Requested by Host: analytics.tiiny.site URL: https://analytics.tiiny.site/js/plausible.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.10.126.206 London, United Kingdom, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-10-126-206.eu-west-2.compute.amazonaws.com Software nginx/1.20.0 / Resource Hash 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df Request headers Referer https://bafybeiadoxciih5qed4fmisuacz4ohssxbzpr6mqgbjdq43kbqna74j3bq.ipfs.dweb.link/ accept-language fi-FI,fi;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36 Content-Type text/plain Response headers Date Fri, 24 Mar 2023 18:53:42 GMT Server nginx/1.20.0 Content-Type text/plain; charset=utf-8 access-control-allow-origin * access-control-expose-headers cache-control max-age=0, private, must-revalidate access-control-allow-credentials true Connection keep-alive Content-Length 2 x-request-id F09vuAEIbUESbaUBvs1i

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

bafybeiadoxciih5qed4fmisuacz4ohssxbzpr6mqgbjdq43kbqna74j3bq.ipfs.dweb.link

URL

https://bafybeiadoxciih5qed4fmisuacz4ohssxbzpr6mqgbjdq43kbqna74j3bq.ipfs.dweb.link/cdnjs.cloudflare.com/ajax/libs/font-awesome/6.1.1/css/all.min.css

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

26 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless function| _0x4acd function| _0x4f45 string| email_var object| bodyDIV function| ValidateEmail function| redirrectPage number| counter function| backArrow function| onChangeFunction function| $ function| jQuery function| _0x16a9 function| _0x7b0203 function| _0x3ca630 function| _0x21947c function| _0x5bbb function| _0x24a7c6 function| _0x25bb55 function| _0x51468e function| _0x6b87fa function| _0x1d592b function| _0x53a076 function| _0x3cef7c function| _0x4f5efa function| plausible

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	URL: https://bafybeiadoxciih5qed4fmisuacz4ohssxbzpr6mqgbjdq43kbqna74j3bq.ipfs.dweb.link/(Line 2046) Message: Refused to apply style from 'https://bafybeiadoxciih5qed4fmisuacz4ohssxbzpr6mqgbjdq43kbqna74j3bq.ipfs.dweb.link/cdnjs.cloudflare.com/ajax/libs/font-awesome/6.1.1/css/all.min.css' because its MIME type ('text/plain') is not a supported stylesheet MIME type, and strict MIME checking is enabled.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

analytics.tiiny.site
bafybeiadoxciih5qed4fmisuacz4ohssxbzpr6mqgbjdq43kbqna74j3bq.ipfs.dweb.link
logincdn.msauth.net
restauranttrelleborg-group.name.ng
bafybeiadoxciih5qed4fmisuacz4ohssxbzpr6mqgbjdq43kbqna74j3bq.ipfs.dweb.link
192.229.221.185
192.3.190.242
2602:fea2:2::1
3.10.126.206
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58
3c980cd344c939662b52e4fa1c4e5a5f987d4323205a264212a32bf161e07597
5d06241f1eebbe8cf9c32e2fd9fcede046757997ae44d122ea6756474d3af05a
72824f3fe09c1e718f8ef2726b7ac44591443f2e6d6c68cc2faf2a2a042dd933
7eec3429c76cb48e5fd457c5afb71b7cf34bc4298d53023bae8aea715443b4a9
910799ca3f14106d049f818aaa24d5cf84ae915ddb43d5a34dd2920894546d8e
b6801179664e6f0c5a76912cc463466cb9a3539168b2b0b71de26fd307af7384
c387092aa56fb5837772d45151eb6aead41d77472959d8c14dc2df043d50e3c3
c4f2aba13970ecf8303fb9329f97c8824861569273b0aa27acce48abc61d04f5
e024e1368e0bd6836581ffd285aff03bd4c07792d5ae7cb309d884b5bd1e53c6
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e