api.gateway.ethswarm.org Open in urlscan Pro
3.68.172.36  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
4 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response api.gateway.ethswarm.org/bzz/a788c75a1bcea2db3ab5b1f587d0758f415f3e02ea339a58619244d388654f43/	106 KB 107 KB	186ms 22ms	Document text/html	3.68.172.36 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://api.gateway.ethswarm.org/bzz/a788c75a1bcea2db3ab5b1f587d0758f415f3e02ea339a58619244d388654f43/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 3.68.172.36 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-68-172-36.eu-central-1.compute.amazonaws.com Software / Express Resource Hash f29a8c3b6bbfe109c09a30c305126197d93578eeb31397ca6f05fdf52ddb48c6 Security Headers Name Value Strict-Transport-Security max-age=15724800; includeSubDomains Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers accept-ranges bytes access-control-allow-credentials true access-control-allow-headers DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization Swarm-Collection,Swarm-Index-Document,Swarm-Postage-Batch-Id,Swarm-Encrypt access-control-allow-methods GET, POST, OPTIONS access-control-allow-origin * access-control-expose-headers Content-Disposition access-control-max-age 1728000 content-disposition inline; filename="index3.html" content-length 108584 content-type text/html; charset=utf-8 date Tue, 24 Oct 2023 08:47:16 GMT etag "19cdad771fa152cfbb788074bc507a01ac086bdbbf7bf70fd94b62f25f2a4407" last-modified Tue, 24 Oct 2023 08:47:16 GMT strict-transport-security max-age=15724800; includeSubDomains x-powered-by Express
GET DATA	200 OK	truncated /	16 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 2d1c6efc7ba8d7b7a3bd04a9e11a7761c112e4bbc23f74937749067acea91d70 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	55 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 42171d76548498998da88f032aba50a028b9481fd7004a9a3b5d3b8d98fe48a2 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 Response headers Content-Type image/png
GET H2	200	jquery-3.5.0.js Show response code.jquery.com/	281 KB 83 KB	340ms 13ms	Script application/javascript	151.101.2.137 FASTLY
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.5.0.js Requested by Host: api.gateway.ethswarm.org URL: https://api.gateway.ethswarm.org/bzz/a788c75a1bcea2db3ab5b1f587d0758f415f3e02ea339a58619244d388654f43/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.2.137 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash aff01a147aeccc9b70a5efad1f2362fd709f3316296ec460d94aa7d31decdb37 Request headers accept-language de-DE,de;q=0.9 Referer https://api.gateway.ethswarm.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 Response headers date Tue, 24 Oct 2023 08:47:16 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish age 3336612 x-cache HIT, HIT content-length 84374 x-served-by cache-lga21959-LGA, cache-fra-eddf8230139-FRA last-modified Fri, 18 Oct 1991 12:00:00 GMT server nginx x-timer S1698137237.562709,VS0,VE0 etag W/"28feccc0-463a1" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=604800 accept-ranges bytes x-cache-hits 25, 19579
GET H2	200	jquery-3.6.0.min.js Show response code.jquery.com/	87 KB 30 KB	350ms 23ms	Script application/javascript	151.101.2.137 FASTLY
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.6.0.min.js Requested by Host: api.gateway.ethswarm.org URL: https://api.gateway.ethswarm.org/bzz/a788c75a1bcea2db3ab5b1f587d0758f415f3e02ea339a58619244d388654f43/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.2.137 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e Request headers accept-language de-DE,de;q=0.9 Referer https://api.gateway.ethswarm.org/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 Response headers date Tue, 24 Oct 2023 08:47:16 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish age 2899137 x-cache HIT, HIT content-length 30875 x-served-by cache-lga21931-LGA, cache-fra-eddf8230139-FRA last-modified Fri, 18 Oct 1991 12:00:00 GMT server nginx x-timer S1698137237.562854,VS0,VE0 etag W/"28feccc0-15d9d" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=604800 accept-ranges bytes x-cache-hits 11, 1111183
GET DATA	200 OK	truncated /	558 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 578254b8c8e53db6ffe80754d29a9db454d8818885ac826b11e9b95389618b5b Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	520 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 2172033cc841f94e32ca4412cd380e43d873a9e74e54aee03f0d26ed72d20be5 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 Response headers Content-Type image/png
GET H2	200	/ Show response ipinfo.io/	266 B 531 B	196ms 146ms	XHR application/json	34.117.59.81 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://ipinfo.io/ Requested by Host: code.jquery.com URL: https://code.jquery.com/jquery-3.6.0.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 34.117.59.81 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 81.59.117.34.bc.googleusercontent.com Software / Resource Hash 1223a9289629e0b58962b6e9507712e21ee521c02cc9dc319dea9efee49b2974 Security Headers Name Value Strict-Transport-Security max-age=2592000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept application/json, text/javascript, */*; q=0.01 Referer https://api.gateway.ethswarm.org/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36 Response headers date Tue, 24 Oct 2023 08:47:16 GMT strict-transport-security max-age=2592000; includeSubDomains x-content-type-options nosniff referrer-policy strict-origin-when-cross-origin content-encoding gzip via 1.1 google x-frame-options SAMEORIGIN vary Accept-Encoding content-type application/json; charset=utf-8 access-control-allow-origin * x-envoy-upstream-service-time 3 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 x-xss-protection 1; mode=block

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Email (Online)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery object| url string| hash string| hasherror string| email string| error number| count

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			api.gateway.ethswarm.org/bzz/a788c75a1bcea2db3ab5b1f587d0758f415f3e02ea339a58619244d388654f43	1970-01-20 15:43:43	Name: SWARMGATEWAY Value: 56ad835620a12888f215cded018d2e78|14e11ea03cd4c35a8af9c45c9721a2e4

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api.gateway.ethswarm.org
code.jquery.com
ipinfo.io
151.101.2.137
3.68.172.36
34.117.59.81
1223a9289629e0b58962b6e9507712e21ee521c02cc9dc319dea9efee49b2974
2172033cc841f94e32ca4412cd380e43d873a9e74e54aee03f0d26ed72d20be5
2d1c6efc7ba8d7b7a3bd04a9e11a7761c112e4bbc23f74937749067acea91d70
42171d76548498998da88f032aba50a028b9481fd7004a9a3b5d3b8d98fe48a2
578254b8c8e53db6ffe80754d29a9db454d8818885ac826b11e9b95389618b5b
aff01a147aeccc9b70a5efad1f2362fd709f3316296ec460d94aa7d31decdb37
f29a8c3b6bbfe109c09a30c305126197d93578eeb31397ca6f05fdf52ddb48c6
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e