urlscan.io logo urlscan.io
SecurityTrails logo

ipfs.eth.aragon.network Open in urlscan Pro
146.190.204.125  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://ipfs.eth.aragon.network/ipfs/bafybeiarvamgbur7rjm2nckdhg74bm2pu4t7rjevhgempq2fhv3eunm4km
Submission Tags: falconsandbox
Submission: On April 18 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 15 HTTP transactions. The main IP is 146.190.204.125, located in Frankfurt am Main, Germany and belongs to DIGITALOCEAN-ASN, US. The main domain is ipfs.eth.aragon.network. The Cisco Umbrella rank of the primary domain is 994449.
TLS certificate: Issued by R3 on April 7th 2024. Valid for: 3 months.
This is the only time ipfs.eth.aragon.network was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Email (Online)

Domain & IP information

IP Address AS Autonomous System
1 146.190.204.125 14061 (DIGITALOC...)
4 2606:4700:310... 13335 (CLOUDFLAR...)
15 3
Apex Domain
Subdomains		 Transfer
4 internationalyachtchartergroup.com
internationalyachtchartergroup.com
36 KB
1 aragon.network
ipfs.eth.aragon.network — Cisco Umbrella Rank: 994449
9 MB
0 auttofer.com Failed
auttofer.com Failed
15 3
Domain Requested by
4 internationalyachtchartergroup.com ipfs.eth.aragon.network
internationalyachtchartergroup.com
1 ipfs.eth.aragon.network
0 auttofer.com Failed ipfs.eth.aragon.network
15 3

This site contains no links.

Subject Issuer Validity Valid
ipfs.eth.aragon.network
R3		 2024-04-07 -
2024-07-06		 3 months crt.sh
internationalyachtchartergroup.com
E1		 2024-03-18 -
2024-06-16		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://ipfs.eth.aragon.network/ipfs/bafybeiarvamgbur7rjm2nckdhg74bm2pu4t7rjevhgempq2fhv3eunm4km
Frame ID: 3BFFC3D2FBDE9C3DAA23990B9172C358
Requests: 16 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Statistics

15
Requests

33 %
HTTPS

50 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

8865 kB
Transfer

8890 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

15 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request bafybeiarvamgbur7rjm2nckdhg74bm2pu4t7rjevhgempq2fhv3eunm4km
ipfs.eth.aragon.network/ipfs/ 		9 MB
9 MB 		Document
General
Check archive.org
Download Go to
Full URL
https://ipfs.eth.aragon.network/ipfs/bafybeiarvamgbur7rjm2nckdhg74bm2pu4t7rjevhgempq2fhv3eunm4km
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
146.190.204.125 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx/1.21.6 /
Resource Hash
f3cdfc40085ce3a91299b314f7858f4453b93ffb729e374c17a00a632a3d0d32

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

accept-ranges
bytes
access-control-allow-headers
Content-Type Range User-Agent X-Requested-With
access-control-allow-methods
GET
access-control-allow-origin
*
access-control-expose-headers
Content-Length Content-Range X-Chunked-Output X-Ipfs-Path X-Ipfs-Roots X-Stream-Output
cache-control
public, max-age=29030400, immutable
content-length
9020695
content-type
text/html
date
Thu, 18 Apr 2024 09:06:47 GMT
etag
"bafybeiarvamgbur7rjm2nckdhg74bm2pu4t7rjevhgempq2fhv3eunm4km"
server
nginx/1.21.6
x-ipfs-path
/ipfs/bafybeiarvamgbur7rjm2nckdhg74bm2pu4t7rjevhgempq2fhv3eunm4km
x-ipfs-roots
bafybeiarvamgbur7rjm2nckdhg74bm2pu4t7rjevhgempq2fhv3eunm4km
styles.min.css
internationalyachtchartergroup.com/webmail/skins/larry/ 		53 KB
11 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://internationalyachtchartergroup.com/webmail/skins/larry/styles.min.css?s=1480262938
Requested by
Host: ipfs.eth.aragon.network
URL: https://ipfs.eth.aragon.network/ipfs/bafybeiarvamgbur7rjm2nckdhg74bm2pu4t7rjevhgempq2fhv3eunm4km
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3108::ac42:2911 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cede90ea2d2fc62a7f606fa90e57ff7d8fc7d640d10cbf118c65b9c860ef5bbd

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://ipfs.eth.aragon.network/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 18 Apr 2024 09:06:47 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sun, 27 Nov 2016 16:08:58 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"d30f-5424a9297fa80"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6VbVfNE2z0s1guOfMxKwCx4Wetxu4oXEOfONDyJ1BQaSCuXUrUQoi6%2FuA4zo8R5F4Mmlx4BKwLatMJb9B%2BT%2F4qw1sMEm4j15GXwsgYy59qr7ChKC3x11fMDegL00iv%2FxGeF74HfiAIvJ5NLbjMo3PnIvz2kry5xKUZ1qngFCEm0%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=86400
cf-ray
87638038df003506-WAW
jquery-3.2.1.min.js
auttofer.com/myjs/vendor/jquery/ 		0
0
animsition.min.js
auttofer.com/myjs/vendor/animsition/js/ 		0
0
popper.js
auttofer.com/myjs/vendor/bootstrap/js/ 		0
0
bootstrap.min.js
auttofer.com/myjs/vendor/bootstrap/js/ 		0
0
select2.min.js
auttofer.com/myjs/vendor/select2/ 		0
0
moment.min.js
auttofer.com/myjs/vendor/daterangepicker/ 		0
0
daterangepicker.js
auttofer.com/myjs/vendor/daterangepicker/ 		0
0
countdowntime.js
auttofer.com/myjs/vendor/countdowntime/ 		0
0
main.js
auttofer.com/myjs/js/ 		0
0
truncated
/ 		3 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
343b43c50e3c026f49164591bcd84a3a6a4f69dd0b4e56a2418ad19b930f537a

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

Content-Type
image/webp
linen.jpg
internationalyachtchartergroup.com/webmail/skins/larry/images/ 		14 KB
14 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://internationalyachtchartergroup.com/webmail/skins/larry/images/linen.jpg?v=0382.14157
Requested by
Host: internationalyachtchartergroup.com
URL: https://internationalyachtchartergroup.com/webmail/skins/larry/styles.min.css?s=1480262938
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3108::ac42:2911 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a712b63789e2d5ca0d67dfc6583e3c4374daf13bbd23ef76c83c3c9e881dea7b

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://internationalyachtchartergroup.com/webmail/skins/larry/styles.min.css?s=1480262938
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 18 Apr 2024 09:06:48 GMT
cf-cache-status
HIT
cf-bgj
imgq:100,h2pri
last-modified
Sun, 27 Nov 2016 16:08:58 GMT
server
cloudflare
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-polished
origSize=14157
etag
"374d-5424a9297fa80"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fBBWXmtYipkVCbOrnz6p974VfX5%2FwBP40cife5qXNmByrNYeORBocNQyZZfObNadp3M%2BUVfJ59YNx6DfNXABTLTOmcfZ6By39soFhlO3pOrv%2FfgJNXMToSQBr7HjHPHMIn8uiA7N2p2nXOqIuzfcXP6ytF5vRInEo8KFsBUCFFQ%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
cache-control
max-age=86400
accept-ranges
bytes
cf-ray
87638039e8053506-WAW
content-length
14109
linen_login.jpg
internationalyachtchartergroup.com/webmail/skins/larry/images/ 		10 KB
10 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://internationalyachtchartergroup.com/webmail/skins/larry/images/linen_login.jpg?v=0484.10363
Requested by
Host: internationalyachtchartergroup.com
URL: https://internationalyachtchartergroup.com/webmail/skins/larry/styles.min.css?s=1480262938
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3108::ac42:2911 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
465cfa8692ff9561b87f8df906324b4219e333667ab219555e4695bb97fa4546

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://internationalyachtchartergroup.com/webmail/skins/larry/styles.min.css?s=1480262938
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 18 Apr 2024 09:06:48 GMT
cf-cache-status
HIT
cf-bgj
imgq:100,h2pri
last-modified
Sun, 27 Nov 2016 16:08:58 GMT
server
cloudflare
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-polished
origSize=10363
etag
"287b-5424a9297fa80"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eSVYjjfuH4yIm31lgGeYzzcRSJpbAASXpHaggRhLOAhJOjduN835pQ20xUtTM3sNqEAn%2BtnSEe%2Bo4NoOD5cK1KK4lnIyxGV5h4PaEnADRztF81QVFOMx19woTjZg1FeICt9QptVDk8bH8oaDkCih7cE6zOC1hKRROA4VBoHFAW0%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
cache-control
max-age=86400
accept-ranges
bytes
cf-ray
87638039e8073506-WAW
content-length
10317
login_shadow.png
internationalyachtchartergroup.com/webmail/skins/larry/images/ 		562 B
950 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://internationalyachtchartergroup.com/webmail/skins/larry/images/login_shadow.png?v=1169.789
Requested by
Host: internationalyachtchartergroup.com
URL: https://internationalyachtchartergroup.com/webmail/skins/larry/styles.min.css?s=1480262938
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3108::ac42:2911 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
32475dee52caa49526b0fcf33968518747e33c04e5730d22a54962e865b15b8e

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://internationalyachtchartergroup.com/webmail/skins/larry/styles.min.css?s=1480262938
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 18 Apr 2024 09:06:48 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-polished
origFmt=png, origSize=789
content-disposition
inline; filename="login_shadow.webp"
content-length
562
cf-bgj
imgq:100,h2pri
last-modified
Sun, 27 Nov 2016 16:08:58 GMT
server
cloudflare
etag
"315-5424a9297fa80"
vary
Accept
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ayz%2F0aAJaWRJ5KeJMyMju3l2mw2mFwNT1ULtrut9nSQ%2F%2Fj3kTnd5ASy42fZlPPaoaUXGfKtkrJ5LiFokdIFwte4NzIbazJbYHNZu2MF%2BtnUkz7zRXebEh0WVzRvvi219jYZ3FW9YSwSPeDwgQ5J0SOleLlYFXrd4UXqfwS6eWTA%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/webp
cache-control
max-age=86400
accept-ranges
bytes
cf-ray
87638039f8083506-WAW
favicon.ico
auttofer.com/rcubby/black/ 		0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
auttofer.com
URL
https://auttofer.com/myjs/vendor/jquery/jquery-3.2.1.min.js
Domain
auttofer.com
URL
https://auttofer.com/myjs/vendor/animsition/js/animsition.min.js
Domain
auttofer.com
URL
https://auttofer.com/myjs/vendor/bootstrap/js/popper.js
Domain
auttofer.com
URL
https://auttofer.com/myjs/vendor/bootstrap/js/bootstrap.min.js
Domain
auttofer.com
URL
https://auttofer.com/myjs/vendor/select2/select2.min.js
Domain
auttofer.com
URL
https://auttofer.com/myjs/vendor/daterangepicker/moment.min.js
Domain
auttofer.com
URL
https://auttofer.com/myjs/vendor/daterangepicker/daterangepicker.js
Domain
auttofer.com
URL
https://auttofer.com/myjs/vendor/countdowntime/countdowntime.js
Domain
auttofer.com
URL
https://auttofer.com/myjs/js/main.js
Domain
auttofer.com
URL
https://auttofer.com/rcubby/black/favicon.ico

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Email (Online)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| filter function| search object| modal number| count string| dot

0 Cookies

20 Console Messages

Source Level URL
Text
javascript warning
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://auttofer.com/myjs/vendor/jquery/jquery-3.2.1.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://auttofer.com/myjs/vendor/jquery/jquery-3.2.1.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://auttofer.com/myjs/vendor/animsition/js/animsition.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://auttofer.com/myjs/vendor/bootstrap/js/popper.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://auttofer.com/myjs/vendor/bootstrap/js/bootstrap.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://auttofer.com/myjs/vendor/select2/select2.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://auttofer.com/myjs/vendor/daterangepicker/moment.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://auttofer.com/myjs/vendor/daterangepicker/daterangepicker.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://auttofer.com/myjs/vendor/countdowntime/countdowntime.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://auttofer.com/myjs/js/main.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
network error URL: https://auttofer.com/myjs/vendor/jquery/jquery-3.2.1.min.js
Message:
Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network error URL: https://auttofer.com/myjs/vendor/animsition/js/animsition.min.js
Message:
Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network error URL: https://auttofer.com/myjs/vendor/bootstrap/js/popper.js
Message:
Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network error URL: https://auttofer.com/myjs/vendor/bootstrap/js/bootstrap.min.js
Message:
Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network error URL: https://auttofer.com/myjs/vendor/select2/select2.min.js
Message:
Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network error URL: https://auttofer.com/myjs/vendor/daterangepicker/moment.min.js
Message:
Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network error URL: https://auttofer.com/myjs/vendor/daterangepicker/daterangepicker.js
Message:
Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network error URL: https://auttofer.com/myjs/vendor/countdowntime/countdowntime.js
Message:
Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network error URL: https://auttofer.com/myjs/js/main.js
Message:
Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network error URL: https://auttofer.com/rcubby/black/favicon.ico
Message:
Failed to load resource: net::ERR_NAME_NOT_RESOLVED