cloudflare-ipfs.com
Open in
urlscan Pro
104.17.96.13
Malicious Activity!
Public Scan
Submission: On May 02 via manual from NZ — Scanned from NZ
Summary
TLS certificate: Issued by E1 on April 24th 2024. Valid for: 3 months.
This is the only time cloudflare-ipfs.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Spark (Telecommunication)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 104.17.96.13 104.17.96.13 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
24 | 146.171.248.36 146.171.248.36 | 2570 (TAS-SPARK...) (TAS-SPARK-NZ Spark New Zealand Trading Ltd) | |
1 | 54.251.87.99 54.251.87.99 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 18.138.216.154 18.138.216.154 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 2a04:4e42:400... 2a04:4e42:400::649 | 54113 (FASTLY) (FASTLY) | |
1 2 | 172.217.24.38 172.217.24.38 | 15169 (GOOGLE) (GOOGLE) | |
29 | 6 |
ASN2570 (TAS-SPARK-NZ Spark New Zealand Trading Ltd, NZ)
www.spark.co.nz |
ASN16509 (AMAZON-02, US)
PTR: ec2-54-251-87-99.ap-southeast-1.compute.amazonaws.com
pixel.everesttech.net |
ASN16509 (AMAZON-02, US)
PTR: ec2-18-138-216-154.ap-southeast-1.compute.amazonaws.com
cm.everesttech.net |
ASN15169 (GOOGLE, US)
PTR: syd15s20-in-f6.1e100.net
8015196.fls.doubleclick.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
24 |
spark.co.nz
www.spark.co.nz |
859 KB |
2 |
doubleclick.net
1 redirects
8015196.fls.doubleclick.net |
552 B |
2 |
everesttech.net
pixel.everesttech.net — Cisco Umbrella Rank: 5895 cm.everesttech.net — Cisco Umbrella Rank: 1310 |
1 KB |
1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 767 |
30 KB |
1 |
cloudflare-ipfs.com
cloudflare-ipfs.com |
17 KB |
29 | 5 |
Domain | Requested by | |
---|---|---|
24 | www.spark.co.nz |
cloudflare-ipfs.com
www.spark.co.nz |
2 | 8015196.fls.doubleclick.net |
1 redirects
cloudflare-ipfs.com
|
1 | code.jquery.com |
cloudflare-ipfs.com
|
1 | cm.everesttech.net |
cloudflare-ipfs.com
|
1 | pixel.everesttech.net |
cloudflare-ipfs.com
|
1 | cloudflare-ipfs.com | |
29 | 6 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.sparkdigital.co.nz |
www.spark.co.nz |
www.sparknz.co.nz |
www.sparklab.co.nz |
www.facebook.com |
twitter.com |
www.youtube.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
cloudflare-ipfs.com E1 |
2024-04-24 - 2024-07-23 |
3 months | crt.sh |
www.spark.co.nz Entrust Certification Authority - L1K |
2023-06-26 - 2024-07-12 |
a year | crt.sh |
*.tmogul.com Amazon RSA 2048 M03 |
2024-04-16 - 2025-05-15 |
a year | crt.sh |
*.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2023-07-11 - 2024-07-14 |
a year | crt.sh |
*.doubleclick.net WR2 |
2024-04-16 - 2024-07-09 |
3 months | crt.sh |
This page contains 2 frames:
Primary Page:
https://cloudflare-ipfs.com/ipfs/bafybeigluihsnf7vr2bnjd4ijwyu5b55vz7qcyqnm7hj2xxq5ktfdqhabq/
Frame ID: 90BA7C2CDEEC8563B4CF08A00178E32F
Requests: 28 HTTP requests in this frame
Frame:
https://8015196.fls.doubleclick.net/activityi;dc_pre=CO6Nkcn77YUDFTarZgIdbg4KYA;u1=www.spark.co.nz%2Fxtramail%2Fsignin;cat=allpg0;src=8015196;u10=GA1.1.1206693221.1691407191;type=stwd
Frame ID: 7E0D262CC97A6DAEE31056ACFF075098
Requests: 1 HTTP requests in this frame
Screenshot
Page Title
Xtra Mail sign in | Spark NZDetected technologies
Adobe Experience Manager (CMS) ExpandDetected patterns
- /etc/designs/
- /etc\.clientlibs/
ZURB Foundation (Web Frameworks) Expand
Detected patterns
- <link[^>]+foundation[^>"]+css
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
11 Outgoing links
These are links going to different origins than the main page.
Title: Medium and Enterprise Business
Search URL Search Domain Scan URL
Title: Spark 5G
Search URL Search Domain Scan URL
Title: Spark New Zealand
Search URL Search Domain Scan URL
Title: Spark Foundation
Search URL Search Domain Scan URL
Title: Spark Lab
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Title: Spark New Zealand
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 26- https://8015196.fls.doubleclick.net/activityi;u1=www.spark.co.nz%2Fxtramail%2Fsignin;cat=allpg0;src=8015196;u10=GA1.1.1206693221.1691407191;type=stwd HTTP 302
- https://8015196.fls.doubleclick.net/activityi;dc_pre=CO6Nkcn77YUDFTarZgIdbg4KYA;u1=www.spark.co.nz%2Fxtramail%2Fsignin;cat=allpg0;src=8015196;u10=GA1.1.1206693221.1691407191;type=stwd
29 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H3 |
Primary Request
/
cloudflare-ipfs.com/ipfs/bafybeigluihsnf7vr2bnjd4ijwyu5b55vz7qcyqnm7hj2xxq5ktfdqhabq/ |
171 KB 17 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
main.css
www.spark.co.nz/etc.clientlibs/foundation/clientlibs/ |
11 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
clientlib-all.css
www.spark.co.nz/etc/designs/onespark/ |
840 KB 111 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
clientlib-all.css
www.spark.co.nz/etc/designs/sparklabs/ |
10 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
clientlib-sparkv2.css
www.spark.co.nz/etc/designs/onespark/ |
116 KB 16 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
clientlib-forms.css
www.spark.co.nz/etc/designs/spark-responsive/ |
7 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
xtramail-sign-in.css
www.spark.co.nz/etc/designs/xtramail/clientlib_xtramail/ |
38 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
xtramail-delete-account.css
www.spark.co.nz/etc/designs/xtramail/clientlib_xtramail/ |
37 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
widgets.min.css
www.spark.co.nz/content/dam/kb/public/css/ |
111 KB 19 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
gwc-default.css
www.spark.co.nz/content/dam/kb/public/css/ |
48 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
shopping-disabled.svg
www.spark.co.nz/content/dam/telecomcms/responsive/icons-svg/ |
962 B 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
shopping.svg
www.spark.co.nz/content/dam/telecomcms/responsive/icons-svg/ |
2 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
purple.svg
www.spark.co.nz/content/dam/sparkdigital/images/logo/ |
34 KB 11 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
beyond-binary-banner-tile-v3.jpg
www.spark.co.nz/content/dam/telecomcms/images/Campaigns/beyond-binary/ |
117 KB 118 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
tct-netflix-vas-570x332.jpg
www.spark.co.nz/content/dam/spark/images/product-images/subscriptions/Netflix/ |
55 KB 56 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
young_boy_headphones_Spark_D4_S9-1Dx-0028.jpg
www.spark.co.nz/content/dam/patternlibrary/image-repo/young-boy-headphones/ |
217 KB 218 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
xbox-vas.jpg
www.spark.co.nz/content/dam/spark/images/product-images/subscriptions/xbox/ |
151 KB 152 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
template-background.css
www.spark.co.nz/content/dam/telecomcms/css/help/ |
125 B 901 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
shielded.png
www.spark.co.nz/content/dam/onespark/icon-images/ |
5 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
t
pixel.everesttech.net/10009/ |
128 B 796 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
cm
cm.everesttech.net/ |
0 446 B |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icon-chat-hover.png
www.spark.co.nz/content/dam/kb/public/images/ |
10 KB 11 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.6.0.min.js
code.jquery.com/ |
87 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
f26faddb-86cc-4477-a253-1e1287684336.woff
www.spark.co.nz/content/dam/kb/public/font/avenir/ |
24 KB 25 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
91b50bbb-9aa1-4d54-9159-ec6f19d14a7c.woff
www.spark.co.nz/content/dam/kb/public/font/avenir/ |
24 KB 25 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
spark-icon-family.woff
www.spark.co.nz/content/dam/sparkresponsive/font/Fontello/ |
28 KB 29 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
b8e906a1-f5e8-4bf1-8e80-82c646ca4d5f.woff
www.spark.co.nz/content/dam/kb/public/font/avenir/ |
24 KB 25 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
activityi;dc_pre=CO6Nkcn77YUDFTarZgIdbg4KYA;u1=www.spark.co.nz%2Fxtramail%2Fsignin;cat=allpg0;src=8015196;u10=GA1.1.1206693221.1691407191;type=stwd
8015196.fls.doubleclick.net/ Frame 7E0D Redirect Chain
|
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
favicon_32.png
www.spark.co.nz/ |
4 KB 5 KB |
Other
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Spark (Telecommunication)3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 function| $ function| jQuery6 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
cloudflare-ipfs.com/ | Name: __cf_bm Value: .caBecdLzX2zs1Q.eH4ZwPt6e0RxuRN6uGfKKBt9jY0-1714618474-1.0.1.1-yKfT3hsoagBrAUNlLuTbWBicbIT7i5Jt7yigRTnhNAZsCDnHEhdX2IynM5KsTkVPakFl1Subo1hWXZIxvdJv3Q |
|
.everesttech.net/ | Name: everest_g_v2 Value: g_surferid~ZjMAawAABBNK8C@9 |
|
.everesttech.net/ | Name: everest_session_v2 Value: ZjMAawAABBNK8C@9 |
|
.doubleclick.net/ | Name: receive-cookie-deprecation Value: 1 |
|
.doubleclick.net/ | Name: ar_debug Value: 1 |
|
.doubleclick.net/ | Name: IDE Value: AHWqTUlkSrn9dP2pto0_FzueE5uDVbu-0mOvbpz0SBZSbhRh-D4eAwG5deGl0S33 |
13 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
8015196.fls.doubleclick.net
cloudflare-ipfs.com
cm.everesttech.net
code.jquery.com
pixel.everesttech.net
www.spark.co.nz
104.17.96.13
146.171.248.36
172.217.24.38
18.138.216.154
2a04:4e42:400::649
54.251.87.99
1ec646367adfa9d202390de7a9b06c95e70d48801fe3f6458ea96a5fe347f7b1
1f67d403afe57df8c4941bbd977715a916142489e79419bf9c420a13584513c4
2ad4b265bfd0bb0ae91aaf7181fed42ee0191971e61b0f7ddaac52bf272b71b6
2d98b01da0724db55fe327b97a09ef64c25598eb8d8194414e63de0e82a20d3d
35160acc270f5c78438eed08fa690c6486ee1dbf9f14eb477d36d7efd4f04c21
38529a00acbf801562baceae9dcf6130744572a378985ab3ffb877238dced261
451472aef3827da537a6ae5d25a84830ae6af144c855d3a2c66af966f5dbbde8
4589441ac97df1033c946f3403b0199cfb05e8ba3e406e21013d1af6965dd06a
4b91ad0b85c39f6789caf49cec4beb06b7b9f0e4d0ac8feff0de8f79fdd12d97
4d899b6b03c228edf05bda2e1107e08a20d446fdaad7b4276a936ae75827a7c5
534fe5896097c5f707e499a35e69ee58fe0c7aed220e42e2341db6f0afe71a5a
597577e553630e1a1a757b9a233376cc1c0ea7e590a796b708103f8b077b0631
5a33b1b08faa141fe7a21f91a0f8bd26fb72c4f6ab530de586c1890efed6ff77
5c85b9b27a03314d530cc6f1cc103fc9d9e8f10e64194c5e5568802d3c300bdb
620660f45d9afea331852f7c4ef47e924069518bbf332b0fda09568f4f51bccf
652157d63f0cfa78dc31d968ac6b0482a88db20d28a6fa3bea62e57c79c822cc
6df8cab166b5abbb4a4ff8e8b39f7246ef677afd86fc906c03e8d4ece2248a95
77bbfa0cb24fc3fbd863563814a419f68661054ada740bc501a03bea5d7ce7cc
8cd0112b63387703de5702e3604c364adad1548f16f995fcc9c75ecef36f9119
934c1c0474bd19feb129e9137984bc634cb53bd410b491a6b8b27c26383359bd
a468d97017c7c9d0a1a2c3d12d302e213ed8c7c7a0a401588c87b00876c0675f
bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f
c11b977cd2ba3b6c3a1907314f67ccaec9fcdafa813f82f077d6dc71c7b22d99
cf41c230e0e8be878e310aa6b846a0ab4d354f19c879c615113d45ff58dc2577
d65da0384164d3caeeee36b2e8b7b5da42e1183d4575725a3bd05213e786ec55
e1feb0cfb8121d6c37a4e8797daba314869376e63581c4e5d2ee36039a430a06
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e