bafybeibud2beigwcmmzphngvtwnxh7mvqjda352luzuj7vuap2yuxvfjly.ipfs.dweb.link Open in urlscan Pro
2602:fea2:2::1 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://bafybeibud2beigwcmmzphngvtwnxh7mvqjda352luzuj7vuap2yuxvfjly.ipfs.dweb.link/webief4OLVfRFm.html
Submission: On February 17 via manual (February 17th 2022, 11:00:49 am UTC) from GB — Scanned from GB

Summary HTTP 5 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 1 countries across 3 domains to perform 5 HTTP transactions. The main IP is 2602:fea2:2::1, located in United States and belongs to PROTOCOL, US. The main domain is bafybeibud2beigwcmmzphngvtwnxh7mvqjda352luzuj7vuap2yuxvfjly.ipfs.dweb.link.
TLS certificate: Issued by R3 on January 3rd 2022. Valid for: 3 months.

This is the only time bafybeibud2beigwcmmzphngvtwnxh7mvqjda352luzuj7vuap2yuxvfjly.ipfs.dweb.link was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic (Online)

Domain & IP information

	IP Address	AS Autonomous System
2	2602:fea2:2::1 2602:fea2:2::1	40680 (PROTOCOL) (PROTOCOL)
1	2606:4700::68... 2606:4700::6811:e04e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2406:da00:ff0... 2406:da00:ff00::36e1:9d32	14618 (AMAZON-AES) (AMAZON-AES)
5	4

2 2602:fea2:2::1 (United States)

ASN40680 (PROTOCOL, US)

bafybeibud2beigwcmmzphngvtwnxh7mvqjda352luzuj7vuap2yuxvfjly.ipfs.dweb.link	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:e04e (United States)

ASN13335 (CLOUDFLARENET, US)

fast.fonts.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2406:da00:ff00::36e1:9d32 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

static.telus.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	telus.com static.telus.com — Cisco Umbrella Rank: 838145	105 KB
2	dweb.link bafybeibud2beigwcmmzphngvtwnxh7mvqjda352luzuj7vuap2yuxvfjly.ipfs.dweb.link	94 KB
1	fonts.net fast.fonts.net — Cisco Umbrella Rank: 2467	604 B
5	3

	Domain	Requested by
2	static.telus.com	bafybeibud2beigwcmmzphngvtwnxh7mvqjda352luzuj7vuap2yuxvfjly.ipfs.dweb.link
2	bafybeibud2beigwcmmzphngvtwnxh7mvqjda352luzuj7vuap2yuxvfjly.ipfs.dweb.link	bafybeibud2beigwcmmzphngvtwnxh7mvqjda352luzuj7vuap2yuxvfjly.ipfs.dweb.link
1	fast.fonts.net	bafybeibud2beigwcmmzphngvtwnxh7mvqjda352luzuj7vuap2yuxvfjly.ipfs.dweb.link
5	3

This site contains no links.

Subject Issuer	Validity	Valid
dweb.link R3	`2022-01-03` - `2022-04-03`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-07-06` - `2022-07-05`	a year	crt.sh
static.telus.com DigiCert TLS RSA SHA256 2020 CA1	`2021-03-29` - `2022-04-29`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://bafybeibud2beigwcmmzphngvtwnxh7mvqjda352luzuj7vuap2yuxvfjly.ipfs.dweb.link/webief4OLVfRFm.html
Frame ID: 5AF9E573742A79E5F153954B89BDBF53
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Webmail Settings

Page Statistics

5
Requests

100 %
HTTPS

100 %
IPv6

3
Domains

3
Subdomains

4
IPs

1
Countries

199 kB
Transfer

679 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions
3 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request webief4OLVfRFm.html Show response
bafybeibud2beigwcmmzphngvtwnxh7mvqjda352luzuj7vuap2yuxvfjly.ipfs.dweb.link/ 535 KB
94 KB 236ms
121ms Document
text/html 2602:fea2:2::1
PROTOCOL

General

Check archive.org

Show headers Download Go to

Full URL

https://bafybeibud2beigwcmmzphngvtwnxh7mvqjda352luzuj7vuap2yuxvfjly.ipfs.dweb.link/webief4OLVfRFm.html?

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2602:fea2:2::1 , United States, ASN40680 (PROTOCOL, US),

Reverse DNS

Software

openresty /

Resource Hash

a550f9ecd77ed21cb0aa1ce0c7ce57891a1b8917afcad199973647a830af77ee

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: en-GB,en;q=0.9

Response headers

server: openresty
date: Thu, 17 Feb 2022 11:00:43 GMT
content-type: text/html
vary: Accept-Encoding
access-control-allow-methods: GET GET, POST, OPTIONS
cache-control: public, max-age=29030400, immutable
etag: W/"bafkreiffkd46zv362iolbkq44dd44v4jdinysf5pzliztfzwi6udbl3x5y"
last-modified: Thu, 01 Jan 1970 00:00:01 GMT
x-ipfs-gateway-host: ipfs-bank4-fr2
x-ipfs-path: /ipfs/bafybeibud2beigwcmmzphngvtwnxh7mvqjda352luzuj7vuap2yuxvfjly/webief4OLVfRFm.html
x-ipfs-pop: ipfs-bank4-fr2
access-control-allow-origin: *
access-control-allow-headers: X-Requested-With, Range, Content-Range, X-Chunked-Output, X-Stream-Output
access-control-expose-headers: Content-Range, X-Chunked-Output, X-Stream-Output
x-ipfs-lb-pop: gateway-bank1-fr2
x-proxy-cache: MISS
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip

GET
H2 200 1.css
fast.fonts.net/t/ 0
604 B 179ms
64ms Stylesheet
text/css 2606:4700::6811:e04e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://fast.fonts.net/t/1.css?apiType=css&projectid=20d74cc5-7f7c-49a7-80ae-fa2f389c550d
Requested by: Host: bafybeibud2beigwcmmzphngvtwnxh7mvqjda352luzuj7vuap2yuxvfjly.ipfs.dweb.link
URL: https://bafybeibud2beigwcmmzphngvtwnxh7mvqjda352luzuj7vuap2yuxvfjly.ipfs.dweb.link/webief4OLVfRFm.html?
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:e04e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://bafybeibud2beigwcmmzphngvtwnxh7mvqjda352luzuj7vuap2yuxvfjly.ipfs.dweb.link/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 11:00:43 GMT
cf-cache-status: HIT
age: 189311
cf-ray: 6dee837a9e3371ba-LHR
content-length: 0
x-amz-id-2: yhQSu9UNS0z9ZBZj+x8FiPZQUPVdHoF3CLtet0fyAz484Cb4Dbe8O4Ny2UgLi/HYMR5tB3Smv80=
last-modified: Tue, 23 Mar 2021 12:59:23 GMT
server: cloudflare
etag: "d41d8cd98f00b204e9800998ecf8427e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-request-id: RB5391Q4A50MMV67
cache-control: public, max-age=0, s-maxage=604800
accept-ranges: bytes
content-type: text/css; charset=utf-8
x-amz-meta-mtime: 1519217722

GET
DATA 200
OK truncated
/ 9 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 283246420c8ddc585831699f9623caf0985097ce116a5d640f4d869becfcceca

Request headers

Accept-Language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK 530dee22-e3c1-4e9f-bf62-c31d510d9656.woff
static.telus.com/common/fonts// 56 KB
57 KB 1017ms
256ms Font
font/woff 2406:da00:ff00::36e1:9d32
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://static.telus.com/common/fonts//530dee22-e3c1-4e9f-bf62-c31d510d9656.woff
Requested by: Host: bafybeibud2beigwcmmzphngvtwnxh7mvqjda352luzuj7vuap2yuxvfjly.ipfs.dweb.link
URL: https://bafybeibud2beigwcmmzphngvtwnxh7mvqjda352luzuj7vuap2yuxvfjly.ipfs.dweb.link/webief4OLVfRFm.html?
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2406:da00:ff00::36e1:9d32 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx/1.1.19 /
Resource Hash: 5a9ce4d93bc8fd30ad48503f5eefce9d741aec86f7edee7eb89a30137662f479

Request headers

Referer: https://bafybeibud2beigwcmmzphngvtwnxh7mvqjda352luzuj7vuap2yuxvfjly.ipfs.dweb.link/
Origin: https://bafybeibud2beigwcmmzphngvtwnxh7mvqjda352luzuj7vuap2yuxvfjly.ipfs.dweb.link
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma: public
Date: Thu, 17 Feb 2022 10:51:25 GMT
Last-Modified: Thu, 23 Mar 2017 23:44:53 GMT
Server: nginx/1.1.19
Content-Type: font/woff
Access-Control-Allow-Origin: *
Cache-Control: max-age=315360000, public
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 57767
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
DATA 200
OK truncated
/ 24 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8fb7f75ec47b5f70882f0c2ccfb6d204f332aae123b81440254c1fcd566f34fe

Request headers

Accept-Language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 404 icheck-green.png
bafybeibud2beigwcmmzphngvtwnxh7mvqjda352luzuj7vuap2yuxvfjly.ipfs.dweb.link/my-account/assets/images/ 218 B
218 B 55ms
55ms Image
text/plain 2602:fea2:2::1
PROTOCOL

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bafybeibud2beigwcmmzphngvtwnxh7mvqjda352luzuj7vuap2yuxvfjly.ipfs.dweb.link/my-account/assets/images/icheck-green.png

Requested by

Host: bafybeibud2beigwcmmzphngvtwnxh7mvqjda352luzuj7vuap2yuxvfjly.ipfs.dweb.link
URL: https://bafybeibud2beigwcmmzphngvtwnxh7mvqjda352luzuj7vuap2yuxvfjly.ipfs.dweb.link/webief4OLVfRFm.html?

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2602:fea2:2::1 , United States, ASN40680 (PROTOCOL, US),

Reverse DNS

Software

openresty /

Resource Hash

b4fa0fda2c4ec25eb8cee6c73a18060f7b052e3e0aaee0c573866c786da69d38

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: en-GB,en;q=0.9
Referer: https://bafybeibud2beigwcmmzphngvtwnxh7mvqjda352luzuj7vuap2yuxvfjly.ipfs.dweb.link/webief4OLVfRFm.html?
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 17 Feb 2022 11:00:43 GMT
x-content-type-options: nosniff
x-ipfs-pop: ipfs-bank3-fr2
x-ipfs-lb-pop: gateway-bank1-fr2
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/plain; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: Content-Range, X-Chunked-Output, X-Stream-Output
access-control-allow-headers: X-Requested-With, Range, Content-Range, X-Chunked-Output, X-Stream-Output
content-length: 218
server: openresty

GET
DATA 200
OK truncated
/ 6 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3bda6ce32b1ee45b5012b705b1291f987e020f3ce2ebb85659617c6d60073bd2

Request headers

Accept-Language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK bcf54343-d033-41ee-bbd7-2b77df3fe7ba.woff
static.telus.com/common/fonts// 48 KB
48 KB 974ms
259ms Font
font/woff 2406:da00:ff00::36e1:9d32
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://static.telus.com/common/fonts//bcf54343-d033-41ee-bbd7-2b77df3fe7ba.woff
Requested by: Host: bafybeibud2beigwcmmzphngvtwnxh7mvqjda352luzuj7vuap2yuxvfjly.ipfs.dweb.link
URL: https://bafybeibud2beigwcmmzphngvtwnxh7mvqjda352luzuj7vuap2yuxvfjly.ipfs.dweb.link/webief4OLVfRFm.html?
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2406:da00:ff00::36e1:9d32 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx/1.1.19 /
Resource Hash: 382c30319f5c79a66c7aba94b69014498e57486602a3ebe040a6c0be8b19e5b6

Request headers

Referer: https://bafybeibud2beigwcmmzphngvtwnxh7mvqjda352luzuj7vuap2yuxvfjly.ipfs.dweb.link/
Origin: https://bafybeibud2beigwcmmzphngvtwnxh7mvqjda352luzuj7vuap2yuxvfjly.ipfs.dweb.link
Accept-Language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma: public
Date: Thu, 17 Feb 2022 10:51:25 GMT
Last-Modified: Thu, 23 Mar 2017 23:44:53 GMT
Server: nginx/1.1.19
Content-Type: font/woff
Access-Control-Allow-Origin: *
Cache-Control: max-age=315360000, public
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 48779
Expires: Thu, 31 Dec 2037 23:55:55 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic (Online)

30 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.fonts.net/	1970-01-20 00:58:17	Name: __cf_bm Value: COR0lN7P94LutFVnaBgnB6CAzQV2wqC37anl5cGW7RM-1645095643-0-AYvWtnKn2IRQLUjQ2zUfPbgn2OHJKF/OKT3ThPCdX3wBbCBTghzoV2bogE3xG27ug9PeiwNfMYeiIs7Y+z8wEGc=

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://bafybeibud2beigwcmmzphngvtwnxh7mvqjda352luzuj7vuap2yuxvfjly.ipfs.dweb.link/my-account/assets/images/icheck-green.png Message: Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bafybeibud2beigwcmmzphngvtwnxh7mvqjda352luzuj7vuap2yuxvfjly.ipfs.dweb.link
fast.fonts.net
static.telus.com
2406:da00:ff00::36e1:9d32
2602:fea2:2::1
2606:4700::6811:e04e
283246420c8ddc585831699f9623caf0985097ce116a5d640f4d869becfcceca
382c30319f5c79a66c7aba94b69014498e57486602a3ebe040a6c0be8b19e5b6
3bda6ce32b1ee45b5012b705b1291f987e020f3ce2ebb85659617c6d60073bd2
5a9ce4d93bc8fd30ad48503f5eefce9d741aec86f7edee7eb89a30137662f479
8fb7f75ec47b5f70882f0c2ccfb6d204f332aae123b81440254c1fcd566f34fe
a550f9ecd77ed21cb0aa1ce0c7ce57891a1b8917afcad199973647a830af77ee
b4fa0fda2c4ec25eb8cee6c73a18060f7b052e3e0aaee0c573866c786da69d38
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

bafybeibud2beigwcmmzphngvtwnxh7mvqjda352luzuj7vuap2yuxvfjly.ipfs.dweb.link Open in urlscan Pro 2602:fea2:2::1 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

5 Requests

100 %HTTPS

100 %IPv6

3 Domains

3 Subdomains

4 IPs

1 Countries

199 kBTransfer

679 kBSize

1 Cookies

0 Outgoing links

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 3 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

30 JavaScript Global Variables

1 Cookies

1 Console Messages

Security Headers

Indicators

bafybeibud2beigwcmmzphngvtwnxh7mvqjda352luzuj7vuap2yuxvfjly.ipfs.dweb.link Open in urlscan Pro
2602:fea2:2::1 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

100 %
HTTPS

100 %
IPv6

3
Domains

3
Subdomains

4
IPs

1
Countries

199 kB
Transfer

679 kB
Size

1
Cookies

5 HTTP transactions
3 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!