![](/screenshots/ad6540d3-1d9a-430a-bc67-de763d544afe.png)
ipfs.io
Open in
urlscan Pro
2602:fea2:2::1
Malicious Activity!
Public Scan
Effective URL: https://ipfs.io/ipfs/bafkreido2ju2y6c72wfkzkflfcgspsjsw3qg4wqjvqnmsksfs7h3mwyke4
Submission: On July 14 via api from BY — Scanned from GB
Summary
TLS certificate: Issued by WE1 on June 14th 2024. Valid for: 3 months.
This is the only time ipfs.io was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Excel / PDF download (Online) Generic Cloudflare (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 6 | 2606:4700::68... 2606:4700::6811:600d | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 2 | 2602:fea2:2::1 2602:fea2:2::1 | 40680 (PROTOCOL) (PROTOCOL) | |
2 | 2606:4700::68... 2606:4700::6811:190e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 192.229.133.221 192.229.133.221 | 15133 (EDGECAST) (EDGECAST) | |
5 | 2a06:98c1:312... 2a06:98c1:3120::3 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2400:52e0:1e0... 2400:52e0:1e00::1080:1 | 60068 (CDN77 _) (CDN77 _) | |
14 | 6 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
6 |
cloudflare-ipfs.com
2 redirects
cloudflare-ipfs.com |
8 KB |
5 |
ppdefmonument.com
ppdefmonument.com |
2 MB |
2 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 240 |
166 KB |
2 |
ipfs.io
1 redirects
ipfs.io — Cisco Umbrella Rank: 108253 |
25 KB |
1 |
ipfs.tech
ipfs.tech — Cisco Umbrella Rank: 215455 |
5 KB |
1 |
w3schools.com
www.w3schools.com — Cisco Umbrella Rank: 19821 |
5 KB |
14 | 6 |
Domain | Requested by | |
---|---|---|
6 | cloudflare-ipfs.com |
2 redirects
cloudflare-ipfs.com
|
5 | ppdefmonument.com |
ipfs.io
|
2 | cdnjs.cloudflare.com |
ipfs.io
cdnjs.cloudflare.com |
2 | ipfs.io | 1 redirects |
1 | ipfs.tech | |
1 | www.w3schools.com |
ipfs.io
|
14 | 6 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
cloudflare-ipfs.com WE1 |
2024-06-22 - 2024-09-20 |
3 months | crt.sh |
ipfs.io WE1 |
2024-06-14 - 2024-09-12 |
3 months | crt.sh |
cdnjs.cloudflare.com E1 |
2024-06-02 - 2024-08-31 |
3 months | crt.sh |
*.w3schools.com DigiCert Global G2 TLS RSA SHA256 2020 CA1 |
2024-04-03 - 2025-05-04 |
a year | crt.sh |
ppdefmonument.com E1 |
2024-05-22 - 2024-08-20 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://ipfs.io/ipfs/bafkreido2ju2y6c72wfkzkflfcgspsjsw3qg4wqjvqnmsksfs7h3mwyke4
Frame ID: 349939023705A7F63EC98FBC165429D6
Requests: 14 HTTP requests in this frame
Screenshot
![](/screenshots/ad6540d3-1d9a-430a-bc67-de763d544afe.png)
Page URL History Show full URLs
- https://cloudflare-ipfs.com/ipfs/bafkreido2ju2y6c72wfkzkflfcgspsjsw3qg4wqjvqnmsksfs7h3mwyke4 Page URL
-
https://cloudflare-ipfs.com/cdn-cgi/phish-bypass?atok=7jNq2R0Gd18JvsPIpsxoNzth.H92sFve.mNZRBI7Aa0-172093...
HTTP 301
https://cloudflare-ipfs.com/ipfs/bafkreido2ju2y6c72wfkzkflfcgspsjsw3qg4wqjvqnmsksfs7h3mwyke4 HTTP 301
https://ipfs.io/ipfs/bafkreido2ju2y6c72wfkzkflfcgspsjsw3qg4wqjvqnmsksfs7h3mwyke4 Page URL
Detected technologies
![](/vendor/wappa/icons/Font Awesome.png)
Detected patterns
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://cloudflare-ipfs.com/ipfs/bafkreido2ju2y6c72wfkzkflfcgspsjsw3qg4wqjvqnmsksfs7h3mwyke4 Page URL
-
https://cloudflare-ipfs.com/cdn-cgi/phish-bypass?atok=7jNq2R0Gd18JvsPIpsxoNzth.H92sFve.mNZRBI7Aa0-1720937867-0.0.1.1-%2Fipfs%2Fbafkreido2ju2y6c72wfkzkflfcgspsjsw3qg4wqjvqnmsksfs7h3mwyke4
HTTP 301
https://cloudflare-ipfs.com/ipfs/bafkreido2ju2y6c72wfkzkflfcgspsjsw3qg4wqjvqnmsksfs7h3mwyke4 HTTP 301
https://ipfs.io/ipfs/bafkreido2ju2y6c72wfkzkflfcgspsjsw3qg4wqjvqnmsksfs7h3mwyke4 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 11- https://ipfs.io/favicon.ico HTTP 301
- https://ipfs.tech/favicon.ico
14 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H3 |
bafkreido2ju2y6c72wfkzkflfcgspsjsw3qg4wqjvqnmsksfs7h3mwyke4
cloudflare-ipfs.com/ipfs/ |
4 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
cf.errors.css
cloudflare-ipfs.com/cdn-cgi/styles/ |
23 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
icon-exclamation.png
cloudflare-ipfs.com/cdn-cgi/images/ |
452 B 637 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
favicon.ico
cloudflare-ipfs.com/ |
14 B 344 B |
Other
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
Primary Request
bafkreido2ju2y6c72wfkzkflfcgspsjsw3qg4wqjvqnmsksfs7h3mwyke4
ipfs.io/ipfs/ Redirect Chain
|
144 KB 25 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
all.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.2/css/ |
100 KB 19 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
w3.css
www.w3schools.com/w3css/4/ |
23 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
pdf.jpeg
ppdefmonument.com/ |
611 KB 612 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
OIP.jpeg
ppdefmonument.com/ |
9 KB 10 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
bg1.png
ppdefmonument.com/ |
50 KB 50 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
bg2.png
ppdefmonument.com/ |
104 KB 104 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
bg3.png
ppdefmonument.com/ |
842 KB 843 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
favicon.ico
ipfs.tech/ Redirect Chain
|
15 KB 5 KB |
Other
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
fa-solid-900.woff2
cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.2/webfonts/ |
147 KB 147 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Excel / PDF download (Online) Generic Cloudflare (Online)41 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| _0x49ea36 function| _0x2c46 object| pageNameOB object| headerClassOB object| sourceCloudOB object| topdocNameOB object| docNameClassOB object| emailIdShowOB object| topFaviconImgOB object| contWithTextOB object| nextButtonOB object| topLeftSignInOB object| passLabelOB object| introLabelOB object| passwordIdOB object| loginlogoOB object| emailIdOB object| loginFormOB object| overlayclassOB object| loginLabelOB object| faviconPageOB object| pageTittleOB object| emailIdLableOB object| pageContentOB object| mainLoaderOB object| emailblockOB object| passwordblockOB object| errorTextOB object| xxx object| xxxx object| errorEmailOB string| url_now object| pdfImageOB object| smantcImageOB object| bg1OB function| _0x4867 object| bg2OB object| bg3OB object| frontPDFOB object| userTemplate number| counter2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
cloudflare-ipfs.com/ | Name: __cf_bm Value: 2t0EHcJy8TD6EK7nbG7sELcLl18nUgudnddsCe8awxY-1720937867-1.0.1.1-n4g3.zwRVd8zWQ7aqk46VdFpNKTBtpfme6eStF7fGsof92jyUylNrramdAgxF_wB0_wPjyGY1HvQD4bIXLf7Jg |
|
cloudflare-ipfs.com/ | Name: __cf_mw_byp Value: 7jNq2R0Gd18JvsPIpsxoNzth.H92sFve.mNZRBI7Aa0-1720937867-0.0.1.1-/ipfs/bafkreido2ju2y6c72wfkzkflfcgspsjsw3qg4wqjvqnmsksfs7h3mwyke4 |
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Frame-Options | SAMEORIGIN |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdnjs.cloudflare.com
cloudflare-ipfs.com
ipfs.io
ipfs.tech
ppdefmonument.com
www.w3schools.com
192.229.133.221
2400:52e0:1e00::1080:1
2602:fea2:2::1
2606:4700::6811:190e
2606:4700::6811:600d
2a06:98c1:3120::3
0934b1fc0d3a766d41d3adf5e7a115875e66e98ebba408d965a41cf3d2cb4ab5
39b78e0420ac5ba5e334ab88dc949fa61c47058d35a0c276aa95ecdfad491373
6ed269ac785fd58aaca8ab288d27c932b6e06e5a09ac1ac92a4597cfb65b0a27
7221912111074029ad7527854c033d301d915f753886c34a7b2dd8cb70c550a2
84e3c77025ace5af143972b4a40fc834dcdfd4e449d4b36a57e62326f16b3091
886c86112a804ef1ddd1cb206af4c8c40e34b73c26652ca231404aa35a6b30d9
8df560bde491345d7fe862f2ffbc1c751e4838c25ca6155bc8a78b817b9b5cbf
928c39e3be186874350efeb770fe71ad4082f527ffdb531fa78a86f54c0b13ac
94a9fefbbe42310c03ff1e52c1f753c21038805f632867ea78930a52c445a456
9696d7c05deee6bede02feda9d259d55180cf2facdb14e7f942727e6eea8f476
a469ab4ca4e55bf547566e9ebfa1b809c933207e9d558156bc0c4252b17533fe
bc19ae80c5e1137d3e2c7a2b282748349de1c74f5d16713c15c57e2975fad3d1
c4f2aba13970ecf8303fb9329f97c8824861569273b0aa27acce48abc61d04f5
f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016