bafybeiam5gn5xfma72se5tmsc2a2hkpoh7bhwf4dnro4qx4ek5nvbr36si.ipfs.dweb.link Open in urlscan Pro
209.94.90.1  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
5 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	MK1166091 Show response tt.petmark.es/APIBuckinghamshire83kr4c076K/Milton-Keynes/	0 551 B	440ms 222ms	Document text/html	41.185.64.21 ZA-1-Grid
General Check archive.org Show headers Download Go to Full URL http://tt.petmark.es/APIBuckinghamshire83kr4c076K/Milton-Keynes/MK1166091 Protocol HTTP/1.1 Server 41.185.64.21 , South Africa, ASN36943 (ZA-1-Grid, ZA), Reverse DNS act16-cvps01.hostserv.co.za Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 accept-language se-SE,se;q=0.9 Response headers Content-Length 0 Content-Type text/html; charset=UTF-8 Date Wed, 03 May 2023 20:04:33 GMT Server nginx refresh 0;url=https://bafybeiam5gn5xfma72se5tmsc2a2hkpoh7bhwf4dnro4qx4ek5nvbr36si.ipfs.dweb.link?alt=media&token=1b81a229-bd05-40e1-b6ff-cc50f3b500d3&mOQUja4HVsrZTY7hy3D1E8tAlFL6bG20nWu9MBgipoPSRJfvkw=lVVIhxkc03a7RpirmCk1miZgqFgI9Kn9LoJHM8GPGd12DNoBsapzUHsXqberAxbu76QjwAyfn4lEhjfUuFdJ5vY4QWXSORwez5Z6&email=MK1166091&ND4o4QlLMvck3I0JsXdAODejNupMgSFmXn1EPAr5jtlR6Pz9Hq8h2Wbf9Z3Tt5GRba8yo2GuBnLIUSK7aWxvq6YCCs71cVeyJFOH
GET H2	200	Primary Request / Show response bafybeiam5gn5xfma72se5tmsc2a2hkpoh7bhwf4dnro4qx4ek5nvbr36si.ipfs.dweb.link/	483 B 1008 B	174ms 54ms	Document text/html	209.94.90.1 PROTOCOL
General Check archive.org Show headers Download Go to Full URL https://bafybeiam5gn5xfma72se5tmsc2a2hkpoh7bhwf4dnro4qx4ek5nvbr36si.ipfs.dweb.link/?alt=media&token=1b81a229-bd05-40e1-b6ff-cc50f3b500d3&mOQUja4HVsrZTY7hy3D1E8tAlFL6bG20nWu9MBgipoPSRJfvkw=lVVIhxkc03a7RpirmCk1miZgqFgI9Kn9LoJHM8GPGd12DNoBsapzUHsXqberAxbu76QjwAyfn4lEhjfUuFdJ5vY4QWXSORwez5Z6&email=MK1166091&ND4o4QlLMvck3I0JsXdAODejNupMgSFmXn1EPAr5jtlR6Pz9Hq8h2Wbf9Z3Tt5GRba8yo2GuBnLIUSK7aWxvq6YCCs71cVeyJFOH Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 209.94.90.1 , United States, ASN40680 (PROTOCOL, US), Reverse DNS Software openresty / Resource Hash e98ca2cd98da86f9e655e66c534a5283098feae53a490e6853798199acd62dba Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers Referer http://tt.petmark.es/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 accept-language se-SE,se;q=0.9 Response headers access-control-allow-headers X-Requested-With, Range, Content-Range, X-Chunked-Output, X-Stream-Output access-control-allow-methods GET GET, POST, OPTIONS access-control-allow-origin * access-control-expose-headers Content-Range, X-Chunked-Output, X-Stream-Output cache-control public, max-age=29030400, immutable content-encoding gzip content-type text/html date Wed, 03 May 2023 20:04:33 GMT etag W/"bafybeiam5gn5xfma72se5tmsc2a2hkpoh7bhwf4dnro4qx4ek5nvbr36si" server openresty strict-transport-security max-age=31536000; includeSubDomains; preload timing-allow-origin * vary Accept-Encoding x-ipfs-gateway-host ipfs-bank9-am6 x-ipfs-lb-pop gateway-bank2-am6 x-ipfs-path /ipfs/bafybeiam5gn5xfma72se5tmsc2a2hkpoh7bhwf4dnro4qx4ek5nvbr36si/ x-ipfs-pop ipfs-bank9-am6 x-ipfs-roots bafybeiam5gn5xfma72se5tmsc2a2hkpoh7bhwf4dnro4qx4ek5nvbr36si x-proxy-cache MISS
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/1.12.4/	95 KB 34 KB	181ms 57ms	Script text/javascript	142.250.185.170 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/1.12.4/jquery.min.js Requested by Host: bafybeiam5gn5xfma72se5tmsc2a2hkpoh7bhwf4dnro4qx4ek5nvbr36si.ipfs.dweb.link URL: https://bafybeiam5gn5xfma72se5tmsc2a2hkpoh7bhwf4dnro4qx4ek5nvbr36si.ipfs.dweb.link/?alt=media&token=1b81a229-bd05-40e1-b6ff-cc50f3b500d3&mOQUja4HVsrZTY7hy3D1E8tAlFL6bG20nWu9MBgipoPSRJfvkw=lVVIhxkc03a7RpirmCk1miZgqFgI9Kn9LoJHM8GPGd12DNoBsapzUHsXqberAxbu76QjwAyfn4lEhjfUuFdJ5vY4QWXSORwez5Z6&email=MK1166091&ND4o4QlLMvck3I0JsXdAODejNupMgSFmXn1EPAr5jtlR6Pz9Hq8h2Wbf9Z3Tt5GRba8yo2GuBnLIUSK7aWxvq6YCCs71cVeyJFOH Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.185.170 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s51-in-f10.1e100.net Software sffe / Resource Hash 668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language se-SE,se;q=0.9 Referer https://bafybeiam5gn5xfma72se5tmsc2a2hkpoh7bhwf4dnro4qx4ek5nvbr36si.ipfs.dweb.link/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers date Tue, 02 May 2023 17:47:30 GMT content-encoding gzip x-content-type-options nosniff age 94623 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 33951 x-xss-protection 0 last-modified Tue, 03 Mar 2020 19:15:00 GMT server sffe cross-origin-opener-policy same-origin; report-to="hosted-libraries-pushers" vary Accept-Encoding report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Wed, 01 May 2024 17:47:30 GMT
GET H2	200	owa.js Show response viajesmasegosa.es/wp-content/uploads/2022/01/	8 KB 3 KB	157ms 51ms	Script application/javascript	213.227.130.171 LEASEWEB-NL-AMS-0...
General Check archive.org Show headers Download Go to Full URL https://viajesmasegosa.es/wp-content/uploads/2022/01/owa.js Requested by Host: bafybeiam5gn5xfma72se5tmsc2a2hkpoh7bhwf4dnro4qx4ek5nvbr36si.ipfs.dweb.link URL: https://bafybeiam5gn5xfma72se5tmsc2a2hkpoh7bhwf4dnro4qx4ek5nvbr36si.ipfs.dweb.link/?alt=media&token=1b81a229-bd05-40e1-b6ff-cc50f3b500d3&mOQUja4HVsrZTY7hy3D1E8tAlFL6bG20nWu9MBgipoPSRJfvkw=lVVIhxkc03a7RpirmCk1miZgqFgI9Kn9LoJHM8GPGd12DNoBsapzUHsXqberAxbu76QjwAyfn4lEhjfUuFdJ5vY4QWXSORwez5Z6&email=MK1166091&ND4o4QlLMvck3I0JsXdAODejNupMgSFmXn1EPAr5jtlR6Pz9Hq8h2Wbf9Z3Tt5GRba8yo2GuBnLIUSK7aWxvq6YCCs71cVeyJFOH Protocol H2 Security TLS 1.3, , AES_128_GCM Server 213.227.130.171 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL), Reverse DNS s510.ams8.mysecurecloudhost.com Software LiteSpeed / Resource Hash 09f92be5ea64bea4ac9ff0b3682288f914c814a03b29b6a1a192a3d40e53bd5d Request headers accept-language se-SE,se;q=0.9 Referer https://bafybeiam5gn5xfma72se5tmsc2a2hkpoh7bhwf4dnro4qx4ek5nvbr36si.ipfs.dweb.link/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers date Wed, 03 May 2023 20:04:33 GMT content-encoding br last-modified Tue, 11 Apr 2023 06:20:41 GMT server LiteSpeed vary Accept-Encoding,User-Agent content-type application/javascript cache-control public, max-age=604800 accept-ranges bytes alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" content-length 2324 expires Wed, 10 May 2023 20:04:33 GMT
POST H2	200	GetOwa.php Show response all4saleshop.com/	55 KB 23 KB	1923ms 1813ms	XHR text/html	213.227.130.171 LEASEWEB-NL-AMS-0...
General Check archive.org Show headers Download Go to Full URL https://all4saleshop.com/GetOwa.php Requested by Host: viajesmasegosa.es URL: https://viajesmasegosa.es/wp-content/uploads/2022/01/owa.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 213.227.130.171 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL), Reverse DNS s510.ams8.mysecurecloudhost.com Software LiteSpeed / Resource Hash 36654c461f9befc4538e04a32955ddc292ea97f5c81fdb1833ac6f256fbe3210 Request headers Referer https://bafybeiam5gn5xfma72se5tmsc2a2hkpoh7bhwf4dnro4qx4ek5nvbr36si.ipfs.dweb.link/ accept-language se-SE,se;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Content-Type application/x-www-form-urlencoded Response headers access-control-allow-origin * date Wed, 03 May 2023 20:04:35 GMT content-encoding gzip server LiteSpeed alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" vary Accept-Encoding,User-Agent content-type text/html; charset=UTF-8
GET DATA	200 OK	truncated /	2 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash d9ed6586942003696afe4e52b09f343f8342244b51a9e175b75162d7e615207b Request headers accept-language se-SE,se;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	4 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 4de8fc175826d9f78fce9f9f2b71a63fe832fc7507e0394125c823b0909fa54a Request headers accept-language se-SE,se;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	6 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 6bd745cac7dd2e979f9e89dcd3c1ed3058812be0c88a06fc066360f74120b717 Request headers accept-language se-SE,se;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	1 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 07f38b8b8c1f96ed85ecd96988f0454a95d1f665427086a507c72e55ff3ce0e7 Request headers accept-language se-SE,se;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	761 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash c3a3dcdbf7b0771ccf2eb4c6688dd334cebb09b33331d8875550ad250221a45f Request headers accept-language se-SE,se;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36 Response headers Content-Type image/png
GET		segoeui-regular.ttf exchange.quadranet.com/owa/auth/15.0.1395/themes/resources/	0 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

exchange.quadranet.com

URL

https://exchange.quadranet.com/owa/auth/15.0.1395/themes/resources/segoeui-regular.ttf

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Outlook Web Access (Online)

17 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless function| $ function| jQuery string| html_content string| user_url string| email function| submitForm function| check_email function| checkSubmit function| getUrlVars function| clkLgn function| clearDOM function| valthisform function| stripScripts function| OwaAPICHeck function| MakeRequest string| value

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	error	URL: https://bafybeiam5gn5xfma72se5tmsc2a2hkpoh7bhwf4dnro4qx4ek5nvbr36si.ipfs.dweb.link/?alt=media&token=1b81a229-bd05-40e1-b6ff-cc50f3b500d3&mOQUja4HVsrZTY7hy3D1E8tAlFL6bG20nWu9MBgipoPSRJfvkw=lVVIhxkc03a7RpirmCk1miZgqFgI9Kn9LoJHM8GPGd12DNoBsapzUHsXqberAxbu76QjwAyfn4lEhjfUuFdJ5vY4QWXSORwez5Z6&email=MK1166091&ND4o4QlLMvck3I0JsXdAODejNupMgSFmXn1EPAr5jtlR6Pz9Hq8h2Wbf9Z3Tt5GRba8yo2GuBnLIUSK7aWxvq6YCCs71cVeyJFOH Message: Access to font at 'https://exchange.quadranet.com/owa/auth/15.0.1395/themes/resources/segoeui-regular.ttf' from origin 'https://bafybeiam5gn5xfma72se5tmsc2a2hkpoh7bhwf4dnro4qx4ek5nvbr36si.ipfs.dweb.link' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://exchange.quadranet.com/owa/auth/15.0.1395/themes/resources/segoeui-regular.ttf Message: Failed to load resource: net::ERR_FAILED

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
all4saleshop.com
bafybeiam5gn5xfma72se5tmsc2a2hkpoh7bhwf4dnro4qx4ek5nvbr36si.ipfs.dweb.link
exchange.quadranet.com
tt.petmark.es
viajesmasegosa.es
exchange.quadranet.com
142.250.185.170
209.94.90.1
213.227.130.171
41.185.64.21
07f38b8b8c1f96ed85ecd96988f0454a95d1f665427086a507c72e55ff3ce0e7
09f92be5ea64bea4ac9ff0b3682288f914c814a03b29b6a1a192a3d40e53bd5d
36654c461f9befc4538e04a32955ddc292ea97f5c81fdb1833ac6f256fbe3210
4de8fc175826d9f78fce9f9f2b71a63fe832fc7507e0394125c823b0909fa54a
668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404
6bd745cac7dd2e979f9e89dcd3c1ed3058812be0c88a06fc066360f74120b717
c3a3dcdbf7b0771ccf2eb4c6688dd334cebb09b33331d8875550ad250221a45f
d9ed6586942003696afe4e52b09f343f8342244b51a9e175b75162d7e615207b
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e98ca2cd98da86f9e655e66c534a5283098feae53a490e6853798199acd62dba