bafybeif66f3rjo7qq6w3ccrgvn5cbmyze7korokglhyydwq443smbabfqi.ipfs.thirdwebgateway.com Open in urlscan Pro
2606:4700::6812:f44  Malicious Activity! Public Scan

URL: https://bafybeif66f3rjo7qq6w3ccrgvn5cbmyze7korokglhyydwq443smbabfqi.ipfs.thirdwebgateway.com/homefront.html
Submission: On July 09 via api from JP — Scanned from JP

Summary

This website contacted 6 IPs in 2 countries across 5 domains to perform 8 HTTP transactions. The main IP is 2606:4700::6812:f44, located in United States and belongs to CLOUDFLARENET, US. The main domain is bafybeif66f3rjo7qq6w3ccrgvn5cbmyze7korokglhyydwq443smbabfqi.ipfs.thirdwebgateway.com.
TLS certificate: Issued by E1 on July 3rd 2023. Valid for: 3 months.
This is the only time bafybeif66f3rjo7qq6w3ccrgvn5cbmyze7korokglhyydwq443smbabfqi.ipfs.thirdwebgateway.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Rackspace (Online)

Domain & IP information

Apex Domain
Subdomains
Transfer
2 gstatic.com
fonts.gstatic.com
31 KB
2 emailsrvr.com
static.emailsrvr.com — Cisco Umbrella Rank: 157807
39 KB
2 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 88
ajax.googleapis.com — Cisco Umbrella Rank: 433
31 KB
1 bootstrapcdn.com
stackpath.bootstrapcdn.com — Cisco Umbrella Rank: 2767
15 KB
1 thirdwebgateway.com
bafybeif66f3rjo7qq6w3ccrgvn5cbmyze7korokglhyydwq443smbabfqi.ipfs.thirdwebgateway.com
8 KB
8 5
Domain Requested by
2 fonts.gstatic.com fonts.googleapis.com
2 static.emailsrvr.com bafybeif66f3rjo7qq6w3ccrgvn5cbmyze7korokglhyydwq443smbabfqi.ipfs.thirdwebgateway.com
1 stackpath.bootstrapcdn.com bafybeif66f3rjo7qq6w3ccrgvn5cbmyze7korokglhyydwq443smbabfqi.ipfs.thirdwebgateway.com
1 ajax.googleapis.com bafybeif66f3rjo7qq6w3ccrgvn5cbmyze7korokglhyydwq443smbabfqi.ipfs.thirdwebgateway.com
1 fonts.googleapis.com bafybeif66f3rjo7qq6w3ccrgvn5cbmyze7korokglhyydwq443smbabfqi.ipfs.thirdwebgateway.com
1 bafybeif66f3rjo7qq6w3ccrgvn5cbmyze7korokglhyydwq443smbabfqi.ipfs.thirdwebgateway.com
8 6

This site contains no links.

Subject Issuer Validity Valid
thirdwebgateway.com
E1
2023-07-03 -
2023-10-01
3 months crt.sh
upload.video.google.com
GTS CA 1C3
2023-06-19 -
2023-09-11
3 months crt.sh
sni9278gl.wpc.edgecastcdn.net
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2023-04-27 -
2024-05-27
a year crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2022-12-30 -
2023-12-30
a year crt.sh
*.gstatic.com
GTS CA 1C3
2023-06-19 -
2023-09-11
3 months crt.sh

This page contains 1 frames:

Primary Page: https://bafybeif66f3rjo7qq6w3ccrgvn5cbmyze7korokglhyydwq443smbabfqi.ipfs.thirdwebgateway.com/homefront.html
Frame ID: 05F8A301286341BCD341902839EBFECB
Requests: 8 HTTP requests in this frame

Screenshot

Page Title

Rackspace Webmail: Hosted Email for Business

Detected technologies

Overall confidence: 100%
Detected patterns
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Overall confidence: 100%
Detected patterns
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

8
Requests

100 %
HTTPS

100 %
IPv6

5
Domains

6
Subdomains

6
IPs

2
Countries

124 kB
Transfer

244 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request homefront.html
bafybeif66f3rjo7qq6w3ccrgvn5cbmyze7korokglhyydwq443smbabfqi.ipfs.thirdwebgateway.com/
32 KB
8 KB
Document
General
Full URL
https://bafybeif66f3rjo7qq6w3ccrgvn5cbmyze7korokglhyydwq443smbabfqi.ipfs.thirdwebgateway.com/homefront.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:f44 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
435e39aaddcea39e4de24b36e403a4571b18dd4222c9c1ccc9af90b181a2e790
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language
jp-JP,jp;q=0.9

Response headers

access-control-allow-headers
X-Requested-With, Range, Content-Range, X-Chunked-Output, X-Stream-Output
access-control-allow-methods
GET, OPTIONS, HEAD
access-control-allow-origin
*
access-control-expose-headers
Content-Range, X-Chunked-Output, X-Stream-Output
age
1112
cache-control
public, max-age=29030400
cf-cache-status
HIT
cf-ray
7e4432e639fc25e6-NRT
content-encoding
gzip
content-type
text/html
cross-origin-resource-policy
cross-origin
date
Sun, 09 Jul 2023 23:03:11 GMT
expires
Sun, 09 Jun 2024 23:03:11 GMT
last-modified
Sun, 09 Jul 2023 22:44:39 GMT
server
cloudflare
strict-transport-security
max-age=31536000; includeSubDomains; preload
timing-allow-origin
*
vary
Origin, Accept-Encoding
x-bfid
5d3eb7f2ea04eb6c12407636f4c5cac7
x-ipfs-datasize
33168
x-ipfs-gateway-host
ipfs-bank16-sg1
x-ipfs-lb-pop
gateway-bank2-sg1
x-ipfs-path
/ipfs/bafybeif66f3rjo7qq6w3ccrgvn5cbmyze7korokglhyydwq443smbabfqi/homefront.html
x-ipfs-pop
ipfs-bank16-sg1
x-ipfs-roots
bafybeif66f3rjo7qq6w3ccrgvn5cbmyze7korokglhyydwq443smbabfqi,QmfRDNQ5gwAhDTmDufUUmEyRYqRqtJNt2uBMjPLx7vCyCM
x-proxy-cache
HIT
css
fonts.googleapis.com/
8 KB
1 KB
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Roboto:100,400,500,700
Requested by
Host: bafybeif66f3rjo7qq6w3ccrgvn5cbmyze7korokglhyydwq443smbabfqi.ipfs.thirdwebgateway.com
URL: https://bafybeif66f3rjo7qq6w3ccrgvn5cbmyze7korokglhyydwq443smbabfqi.ipfs.thirdwebgateway.com/homefront.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2404:6800:4004:822::200a , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
0771512c57f3416f6cc6a7b15d2104ef02565621b7707e15ecbbcb1f95a13275
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://bafybeif66f3rjo7qq6w3ccrgvn5cbmyze7korokglhyydwq443smbabfqi.ipfs.thirdwebgateway.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Sun, 09 Jul 2023 23:03:11 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Sun, 09 Jul 2023 23:03:11 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Sun, 09 Jul 2023 23:03:11 GMT
Rackspace_Technology_Logo_RGB_WHT.png
static.emailsrvr.com/beta_apps_rackspace_com/images/
8 KB
8 KB
Image
General
Full URL
https://static.emailsrvr.com/beta_apps_rackspace_com/images/Rackspace_Technology_Logo_RGB_WHT.png
Requested by
Host: bafybeif66f3rjo7qq6w3ccrgvn5cbmyze7korokglhyydwq443smbabfqi.ipfs.thirdwebgateway.com
URL: https://bafybeif66f3rjo7qq6w3ccrgvn5cbmyze7korokglhyydwq443smbabfqi.ipfs.thirdwebgateway.com/homefront.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:247:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (tka/8909) / ASP.NET
Resource Hash
97669a98a4d13725fbefcfd567ea8adf12fc3c06eef40e71d824bb47267ccb18

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://bafybeif66f3rjo7qq6w3ccrgvn5cbmyze7korokglhyydwq443smbabfqi.ipfs.thirdwebgateway.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Sun, 09 Jul 2023 23:03:11 GMT
last-modified
Mon, 13 Jul 2020 19:51:24 GMT
server
ECAcc (tka/8909)
age
489512
etag
"ffe73fd4e59d61:0"
x-powered-by
ASP.NET
x-cache
HIT
content-type
image/png
cache-control
max-age=300
accept-ranges
bytes
content-length
8173
expires
Sun, 09 Jul 2023 23:08:11 GMT
Suspicious-Email-Banner.jpg
static.emailsrvr.com/apps_rackspace_com/images/
31 KB
31 KB
Image
General
Full URL
https://static.emailsrvr.com/apps_rackspace_com/images/Suspicious-Email-Banner.jpg
Requested by
Host: bafybeif66f3rjo7qq6w3ccrgvn5cbmyze7korokglhyydwq443smbabfqi.ipfs.thirdwebgateway.com
URL: https://bafybeif66f3rjo7qq6w3ccrgvn5cbmyze7korokglhyydwq443smbabfqi.ipfs.thirdwebgateway.com/homefront.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:247:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (tka/8908) / ASP.NET
Resource Hash
ee608b4a41a47f8df45dd1d505afb39cb7293e7a33c094b756764a85d67fca47

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://bafybeif66f3rjo7qq6w3ccrgvn5cbmyze7korokglhyydwq443smbabfqi.ipfs.thirdwebgateway.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Sun, 09 Jul 2023 23:03:11 GMT
last-modified
Fri, 28 Sep 2018 18:18:39 GMT
server
ECAcc (tka/8908)
age
593017
etag
"5b1d4cae5757d41:0"
x-powered-by
ASP.NET
x-cache
HIT
content-type
image/jpeg
cache-control
max-age=300
accept-ranges
bytes
content-length
31715
expires
Sun, 09 Jul 2023 23:08:11 GMT
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/2.2.4/
84 KB
30 KB
Script
General
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js
Requested by
Host: bafybeif66f3rjo7qq6w3ccrgvn5cbmyze7korokglhyydwq443smbabfqi.ipfs.thirdwebgateway.com
URL: https://bafybeif66f3rjo7qq6w3ccrgvn5cbmyze7korokglhyydwq443smbabfqi.ipfs.thirdwebgateway.com/homefront.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2404:6800:4004:827::200a , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://bafybeif66f3rjo7qq6w3ccrgvn5cbmyze7korokglhyydwq443smbabfqi.ipfs.thirdwebgateway.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Sun, 09 Jul 2023 07:35:34 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
55657
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
30028
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 19:15:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="hosted-libraries-pushers"
vary
Accept-Encoding
report-to
{"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges
bytes
timing-allow-origin
*
expires
Mon, 08 Jul 2024 07:35:34 GMT
bootstrap.min.js
stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/
50 KB
15 KB
Script
General
Full URL
https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js
Requested by
Host: bafybeif66f3rjo7qq6w3ccrgvn5cbmyze7korokglhyydwq443smbabfqi.ipfs.thirdwebgateway.com
URL: https://bafybeif66f3rjo7qq6w3ccrgvn5cbmyze7korokglhyydwq443smbabfqi.ipfs.thirdwebgateway.com/homefront.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://bafybeif66f3rjo7qq6w3ccrgvn5cbmyze7korokglhyydwq443smbabfqi.ipfs.thirdwebgateway.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Sun, 09 Jul 2023 23:03:11 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
cdn-edgestorageid
753
age
19165952
cdn-cachedat
10/23/2021 07:57:57
cdn-pullzone
252412
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
last-modified
Mon, 25 Jan 2021 22:04:06 GMT
cdn-proxyver
1.0
cdn-requestpullcode
200
server
cloudflare
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cdn-cache
HIT
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cache-control
public, max-age=31919000
cdn-requestid
b8e02cd75e736c4fac8dd42eaaabad8a
timing-allow-origin
*
cdn-requestcountrycode
US
cdn-status
200
cf-ray
7e4432e669e1af5a-NRT
cdn-requestpullsuccess
True
KFOkCnqEu92Fr1MmgVxIIzI.woff2
fonts.gstatic.com/s/roboto/v30/
15 KB
16 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v30/KFOkCnqEu92Fr1MmgVxIIzI.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:100,400,500,700
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2404:6800:4004:80b::2003 , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
0f303f31706d39866cced9dcc17b61fb8423674278d7f6051d66b3a79ffbca18
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://bafybeif66f3rjo7qq6w3ccrgvn5cbmyze7korokglhyydwq443smbabfqi.ipfs.thirdwebgateway.com
accept-language
jp-JP,jp;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Sat, 08 Jul 2023 17:08:14 GMT
x-content-type-options
nosniff
age
107697
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
15764
x-xss-protection
0
last-modified
Wed, 11 May 2022 19:24:35 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 07 Jul 2024 17:08:14 GMT
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/
15 KB
16 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:100,400,500,700
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2404:6800:4004:80b::2003 , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://bafybeif66f3rjo7qq6w3ccrgvn5cbmyze7korokglhyydwq443smbabfqi.ipfs.thirdwebgateway.com
accept-language
jp-JP,jp;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Sat, 08 Jul 2023 18:53:11 GMT
x-content-type-options
nosniff
age
101400
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
15744
x-xss-protection
0
last-modified
Wed, 11 May 2022 19:24:48 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 07 Jul 2024 18:53:11 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Rackspace (Online)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| onbeforetoggle object| onscrollend function| $ function| jQuery object| bootstrap

0 Cookies

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload