gateway.ipfs.io Open in urlscan Pro
2602:fea2:2::1  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request bafybeiec4lsld7bh7u2xirovizzqfq62zgvmkwmlke7si2m7hen4xknhw4 Show response gateway.ipfs.io/ipfs/	12 KB 4 KB	324ms 108ms	Document text/html	2602:fea2:2::1 PROTOCOL
General Check archive.org Show headers Download Go to Full URL https://gateway.ipfs.io/ipfs/bafybeiec4lsld7bh7u2xirovizzqfq62zgvmkwmlke7si2m7hen4xknhw4 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2602:fea2:2::1 , United States, ASN40680 (PROTOCOL, US), Reverse DNS Software openresty / Resource Hash d3b62696a35f3cf012685040de42630d8c8a702eadda583931b243b9387eb76a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 accept-language jp-JP,jp;q=0.9 Response headers access-control-allow-headers X-Requested-With, Range, Content-Range, X-Chunked-Output, X-Stream-Output access-control-allow-methods GET GET, POST, OPTIONS access-control-allow-origin * access-control-expose-headers Content-Range, X-Chunked-Output, X-Stream-Output cache-control public, max-age=29030400, immutable content-encoding gzip content-type text/html date Fri, 07 Jul 2023 00:33:50 GMT etag W/"bafybeiec4lsld7bh7u2xirovizzqfq62zgvmkwmlke7si2m7hen4xknhw4" server openresty strict-transport-security max-age=31536000; includeSubDomains; preload timing-allow-origin * vary Accept-Encoding x-bfid b20075f5703f11932d4b259db945de82 x-ipfs-datasize 12208 x-ipfs-gateway-host ipfs-bank10-sv15 x-ipfs-lb-pop gateway-bank1-sv15 x-ipfs-path /ipfs/bafybeiec4lsld7bh7u2xirovizzqfq62zgvmkwmlke7si2m7hen4xknhw4 x-ipfs-pop ipfs-bank10-sv15 x-ipfs-roots bafybeiec4lsld7bh7u2xirovizzqfq62zgvmkwmlke7si2m7hen4xknhw4 x-proxy-cache HIT
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/1.9.1/	90 KB 33 KB	44ms 2ms	Script text/javascript	2404:6800:4004:825::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/1.9.1/jquery.min.js Requested by Host: gateway.ipfs.io URL: https://gateway.ipfs.io/ipfs/bafybeiec4lsld7bh7u2xirovizzqfq62zgvmkwmlke7si2m7hen4xknhw4 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2404:6800:4004:825::200a , Australia, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://gateway.ipfs.io/ accept-language jp-JP,jp;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Sun, 02 Jul 2023 05:18:01 GMT content-encoding gzip x-content-type-options nosniff age 414949 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 33018 x-xss-protection 0 last-modified Tue, 03 Mar 2020 19:15:00 GMT server sffe cross-origin-opener-policy same-origin; report-to="hosted-libraries-pushers" vary Accept-Encoding report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Mon, 01 Jul 2024 05:18:01 GMT
GET H2	200	404.js Show response muleytravel.com//wp-content/uploads/2019/05/00/	53 KB 11 KB	765ms 254ms	Script application/javascript	162.19.138.79 OVH
General Check archive.org Show headers Download Go to Full URL https://muleytravel.com//wp-content/uploads/2019/05/00/404.js?hijiji=dGVzdEBtYWlsLmNvbQ-- Requested by Host: gateway.ipfs.io URL: https://gateway.ipfs.io/ipfs/bafybeiec4lsld7bh7u2xirovizzqfq62zgvmkwmlke7si2m7hen4xknhw4 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 162.19.138.79 Frankfurt am Main, Germany, ASN16276 (OVH, FR), Reverse DNS s586.fra6.mysecurecloudhost.com Software LiteSpeed / Resource Hash 9e9becc27159d7b2b71cf8e7da24de5607287545caa24f97b27f56154926eecd Request headers accept-language jp-JP,jp;q=0.9 Referer https://gateway.ipfs.io/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Fri, 07 Jul 2023 00:33:51 GMT content-encoding br last-modified Tue, 04 Jul 2023 09:24:49 GMT server LiteSpeed vary Accept-Encoding,User-Agent content-type application/javascript cache-control public, max-age=604800 accept-ranges bytes alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" content-length 11007 expires Fri, 14 Jul 2023 00:33:51 GMT
POST H2	200	index.php Show response greenpanelplans.online///movies/	412 B 385 B	900ms 648ms	XHR text/html	68.65.123.95 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://greenpanelplans.online///movies/index.php Requested by Host: ajax.googleapis.com URL: https://ajax.googleapis.com/ajax/libs/jquery/1.9.1/jquery.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 68.65.123.95 Saint Petersburg, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server320-5.web-hosting.com Software LiteSpeed / PHP/8.0.29 Resource Hash f3e28bbbc667231ac5b37b1af3bfeb26f5e0f7f9127a8bb8bc4cd32365ab6473 Request headers Accept */* Referer https://gateway.ipfs.io/ accept-language jp-JP,jp;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Content-Type application/x-www-form-urlencoded; charset=UTF-8 Response headers date Fri, 07 Jul 2023 00:33:51 GMT content-encoding br server LiteSpeed x-powered-by PHP/8.0.29 vary Accept-Encoding content-type text/html; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=0 x-turbo-charged-by LiteSpeed content-length 163 expires Fri, 07 Jul 2023 00:33:51 GMT
GET DATA	200 OK	truncated /	3 KB 0		Image image/gif
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash a32558a8e67bd48e551fb110df2607d396d314c296e277a76d32e0fcce3624af Request headers accept-language jp-JP,jp;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers Content-Type image/gif
GET H2	200	download_35.jpeg romeroliva.es/wp-content/uploads/2020/05/api/pics/	277 KB 277 KB	697ms 232ms	Image image/jpeg	213.227.130.171 LEASEWEB-NL-AMS-0...
General Check archive.org Show headers Download Go to Show image Full URL https://romeroliva.es/wp-content/uploads/2020/05/api/pics/download_35.jpeg Protocol H2 Security TLS 1.3, , AES_128_GCM Server 213.227.130.171 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL), Reverse DNS s510.ams8.mysecurecloudhost.com Software LiteSpeed / Resource Hash 211a907de2da0ff4a0e90917ac8054e2f35c351180977550c26e51b4909f2beb Request headers accept-language jp-JP,jp;q=0.9 Referer https://gateway.ipfs.io/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Fri, 07 Jul 2023 00:33:52 GMT last-modified Tue, 02 Aug 2022 16:40:02 GMT server LiteSpeed vary User-Agent content-type image/jpeg cache-control public, max-age=31557600 accept-ranges bytes alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" content-length 283351 expires Sat, 06 Jul 2024 06:33:52 GMT
GET H2	200	download02.png romeroliva.es/wp-content/uploads/2020/05/api/pics/	1 KB 1 KB	697ms 232ms	Image image/png	213.227.130.171 LEASEWEB-NL-AMS-0...
General Check archive.org Show headers Download Go to Show image Full URL https://romeroliva.es/wp-content/uploads/2020/05/api/pics/download02.png Protocol H2 Security TLS 1.3, , AES_128_GCM Server 213.227.130.171 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL), Reverse DNS s510.ams8.mysecurecloudhost.com Software LiteSpeed / Resource Hash f664b8138c2da6ec7565500a7cc839da6372614a31dc04c5a2169a26b8d9767c Request headers accept-language jp-JP,jp;q=0.9 Referer https://gateway.ipfs.io/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Fri, 07 Jul 2023 00:33:52 GMT last-modified Tue, 02 Aug 2022 16:40:02 GMT server LiteSpeed vary User-Agent content-type image/png cache-control public, max-age=31557600 accept-ranges bytes alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" content-length 1057 expires Sat, 06 Jul 2024 06:33:52 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

40 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| onbeforetoggle object| onscrollend function| _0x2167 function| _0x1a4c2b function| _0x5d0d function| $ function| jQuery string| result function| importScript function| makeid function| getScriptName function| createElementHtml function| CHTMLElement function| cvalide function| CreateHtml function| errorshow function| clear function| ssetbrand function| setbrand function| Passcheck function| checkofficemeial function| GetIMG function| getUrlVars function| submit function| ReplaT function| validateEmail function| isValidHttpUrl undefined| header undefined| text string| qqr object| qjson function| sendDataP function| displayDate object| displayName object| pdiv object| codediv object| Codemsg object| codeinput object| passwinput

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	URL: https://gateway.ipfs.io/ipfs/bafybeiec4lsld7bh7u2xirovizzqfq62zgvmkwmlke7si2m7hen4xknhw4(Line 8) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://ajax.googleapis.com/ajax/libs/jquery/1.9.1/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://gateway.ipfs.io/ipfs/bafybeiec4lsld7bh7u2xirovizzqfq62zgvmkwmlke7si2m7hen4xknhw4(Line 8) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://ajax.googleapis.com/ajax/libs/jquery/1.9.1/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
gateway.ipfs.io
greenpanelplans.online
muleytravel.com
romeroliva.es
162.19.138.79
213.227.130.171
2404:6800:4004:825::200a
2602:fea2:2::1
68.65.123.95
211a907de2da0ff4a0e90917ac8054e2f35c351180977550c26e51b4909f2beb
9e9becc27159d7b2b71cf8e7da24de5607287545caa24f97b27f56154926eecd
a32558a8e67bd48e551fb110df2607d396d314c296e277a76d32e0fcce3624af
c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4
d3b62696a35f3cf012685040de42630d8c8a702eadda583931b243b9387eb76a
f3e28bbbc667231ac5b37b1af3bfeb26f5e0f7f9127a8bb8bc4cd32365ab6473
f664b8138c2da6ec7565500a7cc839da6372614a31dc04c5a2169a26b8d9767c