bafybeiam5gn5xfma72se5tmsc2a2hkpoh7bhwf4dnro4qx4ek5nvbr36si.ipfs.dweb.link
Open in
urlscan Pro
2602:fea2:2::1
Malicious Activity!
Public Scan
Effective URL: https://bafybeiam5gn5xfma72se5tmsc2a2hkpoh7bhwf4dnro4qx4ek5nvbr36si.ipfs.dweb.link/?alt=media&token=1b81a229-bd05-40e1-b6ff-cc50f3b500d3&DvRxAgyBUa4ho8YMI9rPZsc5KOluJ1eqjmW3b7S0NX...
Submission: On May 05 via automatic, source openphish — Scanned from ES
Summary
TLS certificate: Issued by R3 on March 27th 2023. Valid for: 3 months.
This is the only time bafybeiam5gn5xfma72se5tmsc2a2hkpoh7bhwf4dnro4qx4ek5nvbr36si.ipfs.dweb.link was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Outlook Web Access (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 41.185.64.21 41.185.64.21 | 36943 (ZA-1-Grid) (ZA-1-Grid) | |
1 | 2602:fea2:2::1 2602:fea2:2::1 | 40680 (PROTOCOL) (PROTOCOL) | |
1 | 2a00:1450:400... 2a00:1450:4001:806::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 213.227.130.171 213.227.130.171 | 60781 (LEASEWEB-...) (LEASEWEB-NL-AMS-01 Netherlands) | |
1 | 213.227.130.170 213.227.130.170 | 60781 (LEASEWEB-...) (LEASEWEB-NL-AMS-01 Netherlands) | |
6 | 6 |
ASN36943 (ZA-1-Grid, ZA)
PTR: act16-cvps01.hostserv.co.za
tt.petmark.es |
ASN40680 (PROTOCOL, US)
bafybeiam5gn5xfma72se5tmsc2a2hkpoh7bhwf4dnro4qx4ek5nvbr36si.ipfs.dweb.link |
ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL)
PTR: s510.ams8.mysecurecloudhost.com
viajesmasegosa.es |
ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL)
PTR: s510.ams8.mysecurecloudhost.com
mosaicovintage.es |
Apex Domain Subdomains |
Transfer | |
---|---|---|
1 |
mosaicovintage.es
mosaicovintage.es |
23 KB |
1 |
viajesmasegosa.es
viajesmasegosa.es |
3 KB |
1 |
googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 328 |
34 KB |
1 |
dweb.link
bafybeiam5gn5xfma72se5tmsc2a2hkpoh7bhwf4dnro4qx4ek5nvbr36si.ipfs.dweb.link |
1008 B |
1 |
petmark.es
tt.petmark.es |
551 B |
0 |
quadranet.com
Failed
exchange.quadranet.com Failed |
|
6 | 6 |
Domain | Requested by | |
---|---|---|
1 | mosaicovintage.es |
viajesmasegosa.es
|
1 | viajesmasegosa.es |
bafybeiam5gn5xfma72se5tmsc2a2hkpoh7bhwf4dnro4qx4ek5nvbr36si.ipfs.dweb.link
|
1 | ajax.googleapis.com |
bafybeiam5gn5xfma72se5tmsc2a2hkpoh7bhwf4dnro4qx4ek5nvbr36si.ipfs.dweb.link
|
1 | bafybeiam5gn5xfma72se5tmsc2a2hkpoh7bhwf4dnro4qx4ek5nvbr36si.ipfs.dweb.link | |
1 | tt.petmark.es | |
0 | exchange.quadranet.com Failed |
bafybeiam5gn5xfma72se5tmsc2a2hkpoh7bhwf4dnro4qx4ek5nvbr36si.ipfs.dweb.link
|
6 | 6 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.i.ipfs.io R3 |
2023-03-27 - 2023-06-25 |
3 months | crt.sh |
upload.video.google.com GTS CA 1C3 |
2023-04-17 - 2023-07-10 |
3 months | crt.sh |
cpanel.viajesmasegosa.es R3 |
2023-03-26 - 2023-06-24 |
3 months | crt.sh |
autodiscover.mosaicovintage.es R3 |
2023-04-11 - 2023-07-10 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://bafybeiam5gn5xfma72se5tmsc2a2hkpoh7bhwf4dnro4qx4ek5nvbr36si.ipfs.dweb.link/?alt=media&token=1b81a229-bd05-40e1-b6ff-cc50f3b500d3&DvRxAgyBUa4ho8YMI9rPZsc5KOluJ1eqjmW3b7S0NX6QEfkCnL=7FXECw2fzII5eDlQWJwLPf0tscLuhB6THb46tFoM0jqixRgmmPsCUSgGOYdq33948Je7vr2U1dVnkKBWhjQcYrGDZHAyTN89EiAo&email=3mail@b.c&9fOGNgDa11R98nk5uE7LAPX0T3hMT82dUpXegHYByWScIGtyKvIzkBirodRaQJcUwo4uEvqhVCVj6sinFKmwlMQDHx3JPZfjbYsx
Frame ID: 192EA92239C4483E4579B553D5A43C23
Requests: 11 HTTP requests in this frame
Screenshot
Page Title
Outlook Web AppDetected technologies
WordPress (CMS) ExpandDetected patterns
- /wp-(?:content|includes)/
jQuery (JavaScript Libraries) Expand
Detected patterns
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
6 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
3mail@b.c
tt.petmark.es/apibuckinghamshireg0g5apami6/milton-keynes/mk1153701/ |
0 551 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
/
bafybeiam5gn5xfma72se5tmsc2a2hkpoh7bhwf4dnro4qx4ek5nvbr36si.ipfs.dweb.link/ |
483 B 1008 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/1.12.4/ |
95 KB 34 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
owa.js
viajesmasegosa.es/wp-content/uploads/2022/01/ |
8 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
Owa.php
mosaicovintage.es/wp-content/uploads/2022/09/09/ |
55 KB 23 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
4 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
6 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
761 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
segoeui-regular.ttf
exchange.quadranet.com/owa/auth/15.0.1395/themes/resources/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- exchange.quadranet.com
- URL
- https://exchange.quadranet.com/owa/auth/15.0.1395/themes/resources/segoeui-regular.ttf
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Outlook Web Access (Online)17 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless function| $ function| jQuery string| html_content string| user_url string| email function| submitForm function| check_email function| checkSubmit function| getUrlVars function| clkLgn function| clearDOM function| valthisform function| stripScripts function| OwaAPICHeck function| MakeRequest string| value0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
bafybeiam5gn5xfma72se5tmsc2a2hkpoh7bhwf4dnro4qx4ek5nvbr36si.ipfs.dweb.link
exchange.quadranet.com
mosaicovintage.es
tt.petmark.es
viajesmasegosa.es
exchange.quadranet.com
213.227.130.170
213.227.130.171
2602:fea2:2::1
2a00:1450:4001:806::200a
41.185.64.21
07f38b8b8c1f96ed85ecd96988f0454a95d1f665427086a507c72e55ff3ce0e7
4de8fc175826d9f78fce9f9f2b71a63fe832fc7507e0394125c823b0909fa54a
668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404
6bd745cac7dd2e979f9e89dcd3c1ed3058812be0c88a06fc066360f74120b717
ba94ecc9a626a14b24a2ff445bc936d9dc6767f14f8eadfbc46605d2c6d15c46
c3a3dcdbf7b0771ccf2eb4c6688dd334cebb09b33331d8875550ad250221a45f
d9ed6586942003696afe4e52b09f343f8342244b51a9e175b75162d7e615207b
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e98ca2cd98da86f9e655e66c534a5283098feae53a490e6853798199acd62dba
e9cedc7bd7fc6c4f9231e340244ac5ecf63415d6bcc0e357b9c638e16d8dbf99