6lcibgf6e2sdyezk3kcntdfjxjvefauppg25zzbentx4rvm2ehyq.arweave.net Open in urlscan Pro
18.66.248.76 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://shapid-piock-1658.pages.dev/?cjs=2166desperate&psa
Effective URL:
https://6lcibgf6e2sdyezk3kcntdfjxjvefauppg25zzbentx4rvm2ehyq.arweave.net/8sSAmL4mpDwTKtqE2YypumpCgo95tdzkJGzvyNWaIfE/?ivh=ijtppdpawgneil&eca=
Submission: On August 30 via manual (August 30th 2024, 9:22:37 am UTC) from IN — Scanned from DE

Summary HTTP 13 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 1 countries across 3 domains to perform 13 HTTP transactions. The main IP is 18.66.248.76, located in United States and belongs to AMAZON-02, US. The main domain is 6lcibgf6e2sdyezk3kcntdfjxjvefauppg25zzbentx4rvm2ehyq.arweave.net.
TLS certificate: Issued by Amazon RSA 2048 M02 on July 31st 2024. Valid for: a year.

This is the only time 6lcibgf6e2sdyezk3kcntdfjxjvefauppg25zzbentx4rvm2ehyq.arweave.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: OneDrive (Online)

Domain & IP information

	IP Address	AS Autonomous System
3	2606:4700:310... 2606:4700:310c::ac42:2cd1	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6813:e663	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	18.66.248.119 18.66.248.119	16509 (AMAZON-02) (AMAZON-02)
8	18.66.248.76 18.66.248.76	16509 (AMAZON-02) (AMAZON-02)
13	4

3 2606:4700:310c::ac42:2cd1 (United States)

ASN13335 (CLOUDFLARENET, US)

shapid-piock-1658.pages.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6813:e663 (United States)

ASN13335 (CLOUDFLARENET, US)

instant.page	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.248.119 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-248-119.dus51.r.cloudfront.net

6lcibgf6e2sdyezk3kcntdfjxjvefauppg25zzbentx4rvm2ehyq.arweave.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 18.66.248.76 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-248-76.dus51.r.cloudfront.net

6lcibgf6e2sdyezk3kcntdfjxjvefauppg25zzbentx4rvm2ehyq.arweave.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ufsuelg3frmt4xrk4jqdhf7ewuojcw7t5d7eb4tnekcz7wegaqkq.arweave.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
4cqoqhebrsl3u7t3utgdgrpvtm6leoroejcjsuhvrseymwapujja.arweave.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
atoq672h6mapwgx56zuhctuncljwtvlp47hld47nzcljmnpog2wq.arweave.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
7eddi55gddwhzvsq4tealrbrvj65y7zx62hjjmeix34ay2aojarq.arweave.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cq3mxikkyp6ji4i2dbzzwer5uz35r3jks3h6tibdfzvrvuyua5bq.arweave.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
t6nmtdchkxhawrfo5zsq57xbe46euvn3jrb5rmu2j26vto7qy7va.arweave.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	arweave.net 6lcibgf6e2sdyezk3kcntdfjxjvefauppg25zzbentx4rvm2ehyq.arweave.net ufsuelg3frmt4xrk4jqdhf7ewuojcw7t5d7eb4tnekcz7wegaqkq.arweave.net 4cqoqhebrsl3u7t3utgdgrpvtm6leoroejcjsuhvrseymwapujja.arweave.net atoq672h6mapwgx56zuhctuncljwtvlp47hld47nzcljmnpog2wq.arweave.net 7eddi55gddwhzvsq4tealrbrvj65y7zx62hjjmeix34ay2aojarq.arweave.net cq3mxikkyp6ji4i2dbzzwer5uz35r3jks3h6tibdfzvrvuyua5bq.arweave.net t6nmtdchkxhawrfo5zsq57xbe46euvn3jrb5rmu2j26vto7qy7va.arweave.net	717 KB
3	pages.dev shapid-piock-1658.pages.dev	49 KB
1	instant.page instant.page — Cisco Umbrella Rank: 38837	1 KB
13	3

	Domain	Requested by
3	6lcibgf6e2sdyezk3kcntdfjxjvefauppg25zzbentx4rvm2ehyq.arweave.net	shapid-piock-1658.pages.dev
3	shapid-piock-1658.pages.dev	shapid-piock-1658.pages.dev
1	t6nmtdchkxhawrfo5zsq57xbe46euvn3jrb5rmu2j26vto7qy7va.arweave.net
1	cq3mxikkyp6ji4i2dbzzwer5uz35r3jks3h6tibdfzvrvuyua5bq.arweave.net
1	7eddi55gddwhzvsq4tealrbrvj65y7zx62hjjmeix34ay2aojarq.arweave.net
1	atoq672h6mapwgx56zuhctuncljwtvlp47hld47nzcljmnpog2wq.arweave.net
1	4cqoqhebrsl3u7t3utgdgrpvtm6leoroejcjsuhvrseymwapujja.arweave.net	6lcibgf6e2sdyezk3kcntdfjxjvefauppg25zzbentx4rvm2ehyq.arweave.net
1	ufsuelg3frmt4xrk4jqdhf7ewuojcw7t5d7eb4tnekcz7wegaqkq.arweave.net	6lcibgf6e2sdyezk3kcntdfjxjvefauppg25zzbentx4rvm2ehyq.arweave.net
1	instant.page	shapid-piock-1658.pages.dev
13	9

This site contains no links.

Subject Issuer	Validity	Valid
shapid-piock-1658.pages.dev WE1	`2024-08-22` - `2024-11-20`	3 months	crt.sh
instant.page WE1	`2024-07-06` - `2024-10-04`	3 months	crt.sh
arweave.net Amazon RSA 2048 M02	`2024-07-31` - `2025-08-29`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://6lcibgf6e2sdyezk3kcntdfjxjvefauppg25zzbentx4rvm2ehyq.arweave.net/8sSAmL4mpDwTKtqE2YypumpCgo95tdzkJGzvyNWaIfE/?ivh=ijtppdpawgneil&eca=
Frame ID: 7442263E01417A2802A41926391CA202
Requests: 12 HTTP requests in this frame

Frame: https://6lcibgf6e2sdyezk3kcntdfjxjvefauppg25zzbentx4rvm2ehyq.arweave.net/8sSAmL4mpDwTKtqE2YypumpCgo95tdzkJGzvyNWaIfE/?ivh=ijtppdpawgneil&eca=
Frame ID: 5EB8D349827F1CFB324561BC03D7D1DA
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Documents - Shared

Page URL History Show full URLs

https://shapid-piock-1658.pages.dev/?cjs=2166desperate&psa Page URL
https://6lcibgf6e2sdyezk3kcntdfjxjvefauppg25zzbentx4rvm2ehyq.arweave.net/8sSAmL4mpDwTKtqE2YypumpCgo95tdzkJGzvyNWaIfE/?ivh=ijtppdpawgneil&eca= Page URL

Page Statistics

13
Requests

100 %
HTTPS

50 %
IPv6

3
Domains

9
Subdomains

4
IPs

1
Countries

767 kB
Transfer

1081 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://shapid-piock-1658.pages.dev/?cjs=2166desperate&psa Page URL
https://6lcibgf6e2sdyezk3kcntdfjxjvefauppg25zzbentx4rvm2ehyq.arweave.net/8sSAmL4mpDwTKtqE2YypumpCgo95tdzkJGzvyNWaIfE/?ivh=ijtppdpawgneil&eca= Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3 200 / Show response
shapid-piock-1658.pages.dev/ 2 KB
2 KB 92ms
59ms Document
text/html 2606:4700:310c::ac42:2cd1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://shapid-piock-1658.pages.dev/?cjs=2166desperate&psa

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:310c::ac42:2cd1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b8c11e3978e310456f7bbdb10d8bdfc5f962a4bc8c7e350a0d9ad96112358ade

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
cache-control: public, max-age=0, must-revalidate
cf-ray: 8bb3b789afab9b6e-FRA
content-encoding: br
content-type: text/html; charset=utf-8
date: Fri, 30 Aug 2024 09:22:32 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=j2Cx5nseMODe3uVHkaA%2BcZGUJeJ64KJTrg1RGbXkMldBBgU9fTvm%2F8LdZPB553H6woTP5svO6uzxjdnCaND6hs2FTa9Bga6eAuSCZYUeMHihcGs0hlXsJpCHO11xF%2B%2FqU%2Bv6l26kQSMUzgR2sqJo2%2BiT0OaJgS9b0po%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
x-content-type-options: nosniff

GET
H3 200 index-0b2a0c45.js Show response
shapid-piock-1658.pages.dev/assets/ 140 KB
47 KB 48ms
47ms Script
application/javascript 2606:4700:310c::ac42:2cd1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://shapid-piock-1658.pages.dev/assets/index-0b2a0c45.js

Requested by

Host: shapid-piock-1658.pages.dev
URL: https://shapid-piock-1658.pages.dev/?cjs=2166desperate&psa

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:310c::ac42:2cd1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

719c2d7c7ca454658af137b59edc545dc304ed620b8b3189526ea4fb9ff2e9e2

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://shapid-piock-1658.pages.dev/?cjs=2166desperate&psa
Origin: https://shapid-piock-1658.pages.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Fri, 30 Aug 2024 09:22:32 GMT
content-encoding: br
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"2cc7c38a3fd9997a0fc3bc40492198c5"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5MYYGnXuw%2Bom5Oayh%2F5mZmbmfRypnHP7zi8SGxRXjdAtPLYBV%2BBd9k2oYDMEMsRY0P29UwR1Fjwkop9kFEVmzlYEGiNmgsATRA5FD34iV9D0Xf0poatrDxyQZQWW2eIXQpYj3H3Q3Mzp0wrB4%2BxDQkRWfcpNArIsu2c%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
cf-ray: 8bb3b78a083b9b6e-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 index-b9c8798f.css
shapid-piock-1658.pages.dev/assets/ 847 B
872 B 44ms
44ms Stylesheet
text/css 2606:4700:310c::ac42:2cd1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://shapid-piock-1658.pages.dev/assets/index-b9c8798f.css

Requested by

Host: shapid-piock-1658.pages.dev
URL: https://shapid-piock-1658.pages.dev/?cjs=2166desperate&psa

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:310c::ac42:2cd1 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b9c8798f228f20af1ed3acff490990093fc8340b9f82e2a870017486072152fa

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://shapid-piock-1658.pages.dev/?cjs=2166desperate&psa
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Fri, 30 Aug 2024 09:22:32 GMT
content-encoding: br
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"06012f26602f616446c1ff6471b3461b"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ffTgS55WHrUyMU1YK3NDC48RJoqhsRiG1TeAzR0b2hMzMdG6LW2V2qwugRcYoiMjeQWG8p80yJzDBkoGkzKZGyLOcuaEe5qw6Y%2BN7WnpsjNGU6shLQ%2Fhu7yAbu%2BtPPaTqx7uhvf3a1bOTB3agFA%2BMyjeIckW7%2BdtKR4%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
cf-ray: 8bb3b78a083d9b6e-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 5.2.0 Show response
instant.page/ 3 KB
1 KB 50ms
22ms Script
text/javascript 2606:4700::6813:e663
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://instant.page/5.2.0
Requested by: Host: shapid-piock-1658.pages.dev
URL: https://shapid-piock-1658.pages.dev/?cjs=2166desperate&psa
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6813:e663 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8b3644ac5b264c8d3d09222feeea6aa208432f4e46900037dd60bc9834b3c250

Request headers

Referer: https://shapid-piock-1658.pages.dev/
Origin: https://shapid-piock-1658.pages.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Fri, 30 Aug 2024 09:22:32 GMT
content-encoding: br
server: cloudflare
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=2592000
cf-ray: 8bb3b78a380e1bcf-FRA

GET
H2 200 /
6lcibgf6e2sdyezk3kcntdfjxjvefauppg25zzbentx4rvm2ehyq.arweave.net/8sSAmL4mpDwTKtqE2YypumpCgo95tdzkJGzvyNWaIfE/ Frame 5EB8 0
0 36ms
11ms Document
text/html 18.66.248.119
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://6lcibgf6e2sdyezk3kcntdfjxjvefauppg25zzbentx4rvm2ehyq.arweave.net/8sSAmL4mpDwTKtqE2YypumpCgo95tdzkJGzvyNWaIfE/?ivh=ijtppdpawgneil&eca=

Requested by

Host: shapid-piock-1658.pages.dev
URL: https://shapid-piock-1658.pages.dev/assets/index-0b2a0c45.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.248.119 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-248-119.dus51.r.cloudfront.net

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=3600; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://shapid-piock-1658.pages.dev/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 380991
cache-control: public,must-revalidate,max-age=2592000
content-length: 572
content-type: text/html; charset=utf-8
date: Sun, 25 Aug 2024 23:32:41 GMT
etag: 8sSAmL4mpDwTKtqE2YypumpCgo95tdzkJGzvyNWaIfE
strict-transport-security: max-age=3600; includeSubDomains; preload
vary: Origin
via: 1.1 6b2d62d60926d8d51fdcbcc94fce643a.cloudfront.net (CloudFront)
x-amz-cf-id: 9EP3RppiyFfhfWX1Qhp32a9i-wcVSjgUNwcbJIow97wD0DUNkj9gSA==
x-amz-cf-pop: DUS51-P1
x-cache: Hit from cloudfront
x-content-type-options: nosniff
x-trace: EMlMCJRkn
x-xss-protection: 1; mode=block

GET
H2 200 Primary Request / Show response
6lcibgf6e2sdyezk3kcntdfjxjvefauppg25zzbentx4rvm2ehyq.arweave.net/8sSAmL4mpDwTKtqE2YypumpCgo95tdzkJGzvyNWaIfE/ 572 B
1 KB 37ms
16ms Document
text/html 18.66.248.76
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://6lcibgf6e2sdyezk3kcntdfjxjvefauppg25zzbentx4rvm2ehyq.arweave.net/8sSAmL4mpDwTKtqE2YypumpCgo95tdzkJGzvyNWaIfE/?ivh=ijtppdpawgneil&eca=

Requested by

Host: shapid-piock-1658.pages.dev
URL: https://shapid-piock-1658.pages.dev/assets/index-0b2a0c45.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.248.76 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-248-76.dus51.r.cloudfront.net

Software

Resource Hash

527f13ea84fa2566a1d188d128439f20bf429d18412671f6f1ba3fd48eac378e

Security Headers

Name	Value
Strict-Transport-Security	max-age=3600; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://shapid-piock-1658.pages.dev/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 380992
cache-control: public,must-revalidate,max-age=2592000
content-length: 572
content-type: text/html; charset=utf-8
date: Sun, 25 Aug 2024 23:32:41 GMT
etag: 8sSAmL4mpDwTKtqE2YypumpCgo95tdzkJGzvyNWaIfE
strict-transport-security: max-age=3600; includeSubDomains; preload
vary: Origin
via: 1.1 63d9e08bce2adee06986125b699b4cec.cloudfront.net (CloudFront)
x-amz-cf-id: mk6xcIoscd1x2uLtTv0Tv9FGeawuySj26d2GRbCA_i8RCVibXHX0jA==
x-amz-cf-pop: DUS51-P1
x-cache: Hit from cloudfront
x-content-type-options: nosniff
x-trace: EMlMCJRkn
x-xss-protection: 1; mode=block

GET
H2 200 oWVCLNssWT5eKuJgM5fktRyRW_Po_kDybSKFn9iGBBU
ufsuelg3frmt4xrk4jqdhf7ewuojcw7t5d7eb4tnekcz7wegaqkq.arweave.net/ 5 KB
2 KB 16ms
12ms Stylesheet
text/css 18.66.248.76
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://ufsuelg3frmt4xrk4jqdhf7ewuojcw7t5d7eb4tnekcz7wegaqkq.arweave.net/oWVCLNssWT5eKuJgM5fktRyRW_Po_kDybSKFn9iGBBU

Requested by

Host: 6lcibgf6e2sdyezk3kcntdfjxjvefauppg25zzbentx4rvm2ehyq.arweave.net
URL: https://6lcibgf6e2sdyezk3kcntdfjxjvefauppg25zzbentx4rvm2ehyq.arweave.net/8sSAmL4mpDwTKtqE2YypumpCgo95tdzkJGzvyNWaIfE/?ivh=ijtppdpawgneil&eca=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.248.76 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-248-76.dus51.r.cloudfront.net

Software

Resource Hash

71b396d1fbd98b15448ae8f1bfa283942f5657c48709ed8ee370b9c2d3ed9cd1

Security Headers

Name	Value
Strict-Transport-Security	max-age=3600; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://6lcibgf6e2sdyezk3kcntdfjxjvefauppg25zzbentx4rvm2ehyq.arweave.net/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Fri, 30 Aug 2024 09:17:16 GMT
content-encoding: br
via: 1.1 63d9e08bce2adee06986125b699b4cec.cloudfront.net (CloudFront)
x-content-type-options: nosniff
strict-transport-security: max-age=3600; includeSubDomains; preload
x-amz-cf-pop: DUS51-P1
x-trace: M5MXhkH7WA
age: 317
vary: Accept-Encoding, Origin
x-cache: Hit from cloudfront
content-type: text/css; charset=utf-8
cache-control: public,must-revalidate,max-age=2592000
x-amz-cf-id: dl1s8zPfXNwl5-By29vL44q4x6iZIX_XOepzP6A-jt8Hi0P_wU-MNw==
x-xss-protection: 1; mode=block

GET
H2 200 4KDoHIGMl7p-e6TMM0X1mzyyOi4iRJlQ9YyJhlgPolI Show response
4cqoqhebrsl3u7t3utgdgrpvtm6leoroejcjsuhvrseymwapujja.arweave.net/ 300 KB
82 KB 36ms
12ms Script
application/x-javascript 18.66.248.76
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://4cqoqhebrsl3u7t3utgdgrpvtm6leoroejcjsuhvrseymwapujja.arweave.net/4KDoHIGMl7p-e6TMM0X1mzyyOi4iRJlQ9YyJhlgPolI

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.248.76 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-248-76.dus51.r.cloudfront.net

Software

Resource Hash

0b62152bb6e209ef8d1de97b1559c0e723ac28337df2b99e91d189411237c2fa

Security Headers

Name	Value
Strict-Transport-Security	max-age=3600; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://6lcibgf6e2sdyezk3kcntdfjxjvefauppg25zzbentx4rvm2ehyq.arweave.net/
Origin: https://6lcibgf6e2sdyezk3kcntdfjxjvefauppg25zzbentx4rvm2ehyq.arweave.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 25 Aug 2024 23:17:15 GMT
content-encoding: gzip
via: 1.1 acf8dc23ea92f292049638fbd5d718e2.cloudfront.net (CloudFront)
x-content-type-options: nosniff
strict-transport-security: max-age=3600; includeSubDomains; preload
x-amz-cf-pop: DUS51-P1
age: 381918
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
x-trace: pH77cfv_1
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
access-control-expose-headers: X-ArNS-TTL-Seconds,X-ArNS-Resolved-Id
cache-control: public,must-revalidate,max-age=2592000
x-amz-cf-id: AyMqEHSphx3P6FvX7xVhjsn_mTSJkhHlAyCa2dfNKiTdTJfJVLN6pQ==

GET
H2 200 BN0Pf0fzAPsa_fZocU6NEtNp1W_nzrHz7ciWljXuNq0
atoq672h6mapwgx56zuhctuncljwtvlp47hld47nzcljmnpog2wq.arweave.net/ 15 KB
15 KB 15ms
12ms Image
image/png 18.66.248.76
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://atoq672h6mapwgx56zuhctuncljwtvlp47hld47nzcljmnpog2wq.arweave.net/BN0Pf0fzAPsa_fZocU6NEtNp1W_nzrHz7ciWljXuNq0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.248.76 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-248-76.dus51.r.cloudfront.net

Software

Resource Hash

7253f301aa0fd63fad4935c51eba121f766a630a9f47b25d24cd7b281e3ca943

Security Headers

Name	Value
Strict-Transport-Security	max-age=3600; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://6lcibgf6e2sdyezk3kcntdfjxjvefauppg25zzbentx4rvm2ehyq.arweave.net/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 25 Aug 2024 20:48:42 GMT
via: 1.1 63d9e08bce2adee06986125b699b4cec.cloudfront.net (CloudFront)
x-content-type-options: nosniff
strict-transport-security: max-age=3600; includeSubDomains; preload
x-amz-cf-pop: DUS51-P1
age: 390832
x-cache: Hit from cloudfront
content-length: 14950
x-xss-protection: 1; mode=block
x-trace: Sk4UrEGfq
etag: BN0Pf0fzAPsa_fZocU6NEtNp1W_nzrHz7ciWljXuNq0
vary: Origin
content-type: image/png
cache-control: public,must-revalidate,max-age=2592000
accept-ranges: bytes
x-amz-cf-id: wEeTmizGxllK03IpuGwn_TWkXKOwtmyiW4tdXCyBIbcNLsDPXS6jCw==

GET
H2 200 -QY0d6YY7HzWUOTIBcQxqn3cfzf2jpSwiL74DGgOSCM
7eddi55gddwhzvsq4tealrbrvj65y7zx62hjjmeix34ay2aojarq.arweave.net/ 8 KB
8 KB 31ms
21ms Image
image/png 18.66.248.76
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://7eddi55gddwhzvsq4tealrbrvj65y7zx62hjjmeix34ay2aojarq.arweave.net/-QY0d6YY7HzWUOTIBcQxqn3cfzf2jpSwiL74DGgOSCM

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.248.76 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-248-76.dus51.r.cloudfront.net

Software

Resource Hash

5eedb987a0d26a60527854460e67bb0762de152f45b5be580de5aa21e524d309

Security Headers

Name	Value
Strict-Transport-Security	max-age=3600; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://6lcibgf6e2sdyezk3kcntdfjxjvefauppg25zzbentx4rvm2ehyq.arweave.net/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 25 Aug 2024 23:01:51 GMT
via: 1.1 63d9e08bce2adee06986125b699b4cec.cloudfront.net (CloudFront)
x-content-type-options: nosniff
strict-transport-security: max-age=3600; includeSubDomains; preload
x-amz-cf-pop: DUS51-P1
age: 382843
x-cache: Hit from cloudfront
content-length: 8183
x-xss-protection: 1; mode=block
x-trace: xhQrqTZs9
etag: -QY0d6YY7HzWUOTIBcQxqn3cfzf2jpSwiL74DGgOSCM
vary: Origin
content-type: image/png
cache-control: public,must-revalidate,max-age=2592000
accept-ranges: bytes
x-amz-cf-id: Nv1TnSsaVTTxkOqim53n8_3uyJq9SDrNbvgqz2Ty5JDXHI6j4jN2lA==

GET
H2 200 FDbLoUrD_JRxGhhzmxI9pnfY7SqWz-mgIy5rGtMUB0M
cq3mxikkyp6ji4i2dbzzwer5uz35r3jks3h6tibdfzvrvuyua5bq.arweave.net/ 603 KB
604 KB 25ms
16ms Image
image/gif 18.66.248.76
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cq3mxikkyp6ji4i2dbzzwer5uz35r3jks3h6tibdfzvrvuyua5bq.arweave.net/FDbLoUrD_JRxGhhzmxI9pnfY7SqWz-mgIy5rGtMUB0M

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.248.76 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-248-76.dus51.r.cloudfront.net

Software

Resource Hash

5fbc55c7aca8515003db933fbfc27147afea85b30c666bee69d1a535c6e5d7fe

Security Headers

Name	Value
Strict-Transport-Security	max-age=3600; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://6lcibgf6e2sdyezk3kcntdfjxjvefauppg25zzbentx4rvm2ehyq.arweave.net/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 25 Aug 2024 23:01:51 GMT
via: 1.1 63d9e08bce2adee06986125b699b4cec.cloudfront.net (CloudFront)
x-content-type-options: nosniff
strict-transport-security: max-age=3600; includeSubDomains; preload
x-amz-cf-pop: DUS51-P1
age: 382843
x-cache: Hit from cloudfront
content-length: 617715
x-xss-protection: 1; mode=block
x-trace: o7fI9lgIj
etag: FDbLoUrD_JRxGhhzmxI9pnfY7SqWz-mgIy5rGtMUB0M
vary: Origin
content-type: image/gif
cache-control: public,must-revalidate,max-age=2592000
accept-ranges: bytes
x-amz-cf-id: Xf2UFRhUplhzjRjLYeABpryUlE-lXZGnffCXuehsyod5C5Oywa7hgQ==

GET
H2 200 n5rJjEdVzgtEru5lDv7hJzxKVbtMQ9iymk69Wbvwx-o
t6nmtdchkxhawrfo5zsq57xbe46euvn3jrb5rmu2j26vto7qy7va.arweave.net/ 4 KB
4 KB 20ms
14ms Image
image/svg+xml 18.66.248.76
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t6nmtdchkxhawrfo5zsq57xbe46euvn3jrb5rmu2j26vto7qy7va.arweave.net/n5rJjEdVzgtEru5lDv7hJzxKVbtMQ9iymk69Wbvwx-o

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.248.76 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-248-76.dus51.r.cloudfront.net

Software

Resource Hash

edbb4350f8cf14ac0ddb276f154736d24574a9764a2e83b8f23926c4a9b5d504

Security Headers

Name	Value
Strict-Transport-Security	max-age=3600; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://6lcibgf6e2sdyezk3kcntdfjxjvefauppg25zzbentx4rvm2ehyq.arweave.net/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 25 Aug 2024 20:50:05 GMT
content-encoding: br
via: 1.1 63d9e08bce2adee06986125b699b4cec.cloudfront.net (CloudFront)
x-content-type-options: nosniff
strict-transport-security: max-age=3600; includeSubDomains; preload
x-amz-cf-pop: DUS51-P1
x-trace: 6NHHWtYSq
age: 390749
vary: Accept-Encoding, Origin
x-cache: Hit from cloudfront
content-type: image/svg+xml
cache-control: public,must-revalidate,max-age=2592000
x-amz-cf-id: ItTuCQQnqr0dL4KaK7bIx0927lvIKRvN5mztEhLWuiFxxzi8_Xr_fA==
x-xss-protection: 1; mode=block

GET
H2 204 favicon.ico
6lcibgf6e2sdyezk3kcntdfjxjvefauppg25zzbentx4rvm2ehyq.arweave.net/ 0
326 B 12ms
12ms Other
text/plain 18.66.248.76
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://6lcibgf6e2sdyezk3kcntdfjxjvefauppg25zzbentx4rvm2ehyq.arweave.net/favicon.ico

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.248.76 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-248-76.dus51.r.cloudfront.net

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=3600; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://6lcibgf6e2sdyezk3kcntdfjxjvefauppg25zzbentx4rvm2ehyq.arweave.net/8sSAmL4mpDwTKtqE2YypumpCgo95tdzkJGzvyNWaIfE/?ivh=ijtppdpawgneil&eca=
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 25 Aug 2024 23:32:43 GMT
via: 1.1 63d9e08bce2adee06986125b699b4cec.cloudfront.net (CloudFront)
x-content-type-options: nosniff
strict-transport-security: max-age=3600; includeSubDomains; preload
x-amz-cf-pop: DUS51-P1
x-trace: hZRaTW606N
age: 380991
vary: Origin
x-cache: Hit from cloudfront
x-amz-cf-id: 5cdJB8PdnQY-REghKKSLNlRXaZDiGZNXdU0V1H3l1RVLhj9KwBAMgg==
x-xss-protection: 1; mode=block

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: OneDrive (Online)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

4cqoqhebrsl3u7t3utgdgrpvtm6leoroejcjsuhvrseymwapujja.arweave.net
6lcibgf6e2sdyezk3kcntdfjxjvefauppg25zzbentx4rvm2ehyq.arweave.net
7eddi55gddwhzvsq4tealrbrvj65y7zx62hjjmeix34ay2aojarq.arweave.net
atoq672h6mapwgx56zuhctuncljwtvlp47hld47nzcljmnpog2wq.arweave.net
cq3mxikkyp6ji4i2dbzzwer5uz35r3jks3h6tibdfzvrvuyua5bq.arweave.net
instant.page
shapid-piock-1658.pages.dev
t6nmtdchkxhawrfo5zsq57xbe46euvn3jrb5rmu2j26vto7qy7va.arweave.net
ufsuelg3frmt4xrk4jqdhf7ewuojcw7t5d7eb4tnekcz7wegaqkq.arweave.net
18.66.248.119
18.66.248.76
2606:4700:310c::ac42:2cd1
2606:4700::6813:e663
0b62152bb6e209ef8d1de97b1559c0e723ac28337df2b99e91d189411237c2fa
527f13ea84fa2566a1d188d128439f20bf429d18412671f6f1ba3fd48eac378e
5eedb987a0d26a60527854460e67bb0762de152f45b5be580de5aa21e524d309
5fbc55c7aca8515003db933fbfc27147afea85b30c666bee69d1a535c6e5d7fe
719c2d7c7ca454658af137b59edc545dc304ed620b8b3189526ea4fb9ff2e9e2
71b396d1fbd98b15448ae8f1bfa283942f5657c48709ed8ee370b9c2d3ed9cd1
7253f301aa0fd63fad4935c51eba121f766a630a9f47b25d24cd7b281e3ca943
8b3644ac5b264c8d3d09222feeea6aa208432f4e46900037dd60bc9834b3c250
b8c11e3978e310456f7bbdb10d8bdfc5f962a4bc8c7e350a0d9ad96112358ade
b9c8798f228f20af1ed3acff490990093fc8340b9f82e2a870017486072152fa
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
edbb4350f8cf14ac0ddb276f154736d24574a9764a2e83b8f23926c4a9b5d504

6lcibgf6e2sdyezk3kcntdfjxjvefauppg25zzbentx4rvm2ehyq.arweave.net Open in urlscan Pro 18.66.248.76 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

13 Requests

100 %HTTPS

50 %IPv6

3 Domains

9 Subdomains

4 IPs

1 Countries

767 kBTransfer

1081 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

Security Headers

Indicators

6lcibgf6e2sdyezk3kcntdfjxjvefauppg25zzbentx4rvm2ehyq.arweave.net Open in urlscan Pro
18.66.248.76 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

13
Requests

100 %
HTTPS

50 %
IPv6

3
Domains

9
Subdomains

4
IPs

1
Countries

767 kB
Transfer

1081 kB
Size

0
Cookies

13 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!