ipfs.io - urlscan.io

Summary

This website contacted 5 IPs in 2 countries across 4 domains to perform 5 HTTP transactions. The main IP is 2602:fea2:2::1, located in United States and belongs to PROTOCOL, US. The main domain is ipfs.io. The Cisco Umbrella rank of the primary domain is 96870.
TLS certificate: Issued by WE1 on December 9th 2024. Valid for: 3 months.

This is the only time ipfs.io was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Email (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 3	2602:fea2:2::1 2602:fea2:2::1	40680 (PROTOCOL) (PROTOCOL)
1	2606:4700::68... 2606:4700::6812:acf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:831::200a	15169 (GOOGLE) (GOOGLE)
1	2400:52e0:1e0... 2400:52e0:1e00::1080:1	60068 (CDN77 Dat...) (CDN77 Datacamp Limited)
5	5

3 2602:fea2:2::1 (United States) 1 redirects

ASN40680 (PROTOCOL, US)

ipfs.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:acf (United States)

ASN13335 (CLOUDFLARENET, US)

stackpath.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:831::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2400:52e0:1e00::1080:1 (Germany)

ASN60068 (CDN77 Datacamp Limited, GB)

ipfs.tech	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	ipfs.io 1 redirects ipfs.io — Cisco Umbrella Rank: 96870	22 KB
1	ipfs.tech ipfs.tech — Cisco Umbrella Rank: 265642	5 KB
1	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 415	30 KB
1	bootstrapcdn.com stackpath.bootstrapcdn.com — Cisco Umbrella Rank: 3370	28 KB
5	4

	Domain	Requested by
3	ipfs.io	1 redirects ipfs.io
1	ipfs.tech
1	ajax.googleapis.com	ipfs.io
1	stackpath.bootstrapcdn.com	ipfs.io
5	4

This site contains no links.

Subject Issuer	Validity	Valid
ipfs.io WE1	`2024-12-09` - `2025-03-09`	3 months	crt.sh
bootstrapcdn.com WE1	`2024-11-18` - `2025-02-16`	3 months	crt.sh
upload.video.google.com WR2	`2024-11-04` - `2025-01-27`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://ipfs.io/ipfs/bafybeifyfuhyllulzls4mmfkcavt7f6v6fokzgu54sehlzzekg7ixt427q/indexL.html
Frame ID: 5CE55A000C8FBCE9896A5C971E9135FF
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Webmail Portal Access

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

5
Requests

80 %
HTTPS

100 %
IPv6

4
Domains

4
Subdomains

5
IPs

2
Countries

84 kB
Transfer

306 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 4

https://ipfs.io/favicon.ico HTTP 301
https://ipfs.tech/favicon.ico

5 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3 200 Primary Request indexL.html Show response
ipfs.io/ipfs/bafybeifyfuhyllulzls4mmfkcavt7f6v6fokzgu54sehlzzekg7ixt427q/ 34 KB
20 KB 70ms
39ms Document
text/html 2602:fea2:2::1
PROTOCOL

General

Check archive.org

Show headers Download Go to

Full URL: https://ipfs.io/ipfs/bafybeifyfuhyllulzls4mmfkcavt7f6v6fokzgu54sehlzzekg7ixt427q/indexL.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2602:fea2:2::1 , United States, ASN40680 (PROTOCOL, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3e7097bef0ffa15fc448386b0eec0f7d16b6f1db21899325c4f918b5464b578f

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Content-Type Range User-Agent X-Requested-With
access-control-allow-methods: GET HEAD OPTIONS
access-control-allow-origin: *
access-control-expose-headers: Content-Length Content-Range X-Chunked-Output X-Ipfs-Path X-Ipfs-Roots X-Stream-Output
age: 18754
alt-svc: h3=":443"; ma=86400
cache-control: public, max-age=29030400, immutable
cf-cache-status: HIT
cf-ray: 8f135de639719bf4-FRA
content-encoding: br
content-type: text/html
date: Fri, 13 Dec 2024 04:56:17 GMT
priority: u=0,i
server: cloudflare
server-timing: cfExtPri
vary: Accept-Encoding
x-ipfs-path: /ipfs/bafybeifyfuhyllulzls4mmfkcavt7f6v6fokzgu54sehlzzekg7ixt427q/indexL.html
x-ipfs-pop: rainbow-fr2-02
x-ipfs-roots: bafybeifyfuhyllulzls4mmfkcavt7f6v6fokzgu54sehlzzekg7ixt427q,bafkreib6ocl354h7ufp4isbynmhoyd35c23pdwzbrgjslrhzdc2ums2xr4

GET
H3 200 bootstrap.min.css
stackpath.bootstrapcdn.com/bootstrap/4.5.2/css/ 157 KB
28 KB 55ms
30ms Stylesheet
text/css 2606:4700::6812:acf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://stackpath.bootstrapcdn.com/bootstrap/4.5.2/css/bootstrap.min.css

Requested by

Host: ipfs.io
URL: https://ipfs.io/ipfs/bafybeifyfuhyllulzls4mmfkcavt7f6v6fokzgu54sehlzzekg7ixt427q/indexL.html

Protocol

H3

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5b0fbe5b7ad705f6a937c4998ad02f73d8f0d976fe231b74aef0ec996990c93a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://ipfs.io/

Response headers

cdn-status: 200
content-encoding: br
cf-cache-status: HIT
etag: W/"816af0eddd3b4822c2756227c7e7b7ee"
age: 873973
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Fri, 13 Dec 2024 04:56:17 GMT
last-modified: Mon, 25 Jan 2021 22:04:11 GMT
content-type: text/css; charset=utf-8
vary: Accept-Encoding
cdn-cache: HIT
cdn-cachedat: 05/29/2024 18:09:57
cdn-requestpullcode: 200
priority: u=0,i=?0
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=31919000
cdn-requestpullsuccess: True
timing-allow-origin: *
cdn-requesttime: 0
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid: 061a0a53f527e1164261c24aa36ff27e
cross-origin-resource-policy: cross-origin
cdn-pullzone: 252412
cdn-proxyver: 1.04
cf-ray: 8f135de6ac39d38e-FRA
access-control-allow-origin: *
cdn-edgestorageid: 865
server: cloudflare
cdn-requestcountrycode: DE

GET
DATA 200
OK truncated
/ 16 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2d1c6efc7ba8d7b7a3bd04a9e11a7761c112e4bbc23f74937749067acea91d70

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/2.2.4/ 84 KB
30 KB 78ms
22ms Script
text/javascript 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js

Requested by

Host: ipfs.io
URL: https://ipfs.io/ipfs/bafybeifyfuhyllulzls4mmfkcavt7f6v6fokzgu54sehlzzekg7ixt427q/indexL.html

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://ipfs.io/

Response headers

content-encoding: gzip
age: 271436
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
x-content-type-options: nosniff
expires: Wed, 10 Dec 2025 01:32:21 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 10 Dec 2024 01:32:21 GMT
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
accept-ranges: bytes
access-control-allow-origin: *
content-length: 30028
x-xss-protection: 0
server: sffe

GET
H3 422 bg-image.jpg
ipfs.io/ipfs/img/ 1 KB
1 KB 35ms
35ms Image
text/html 2602:fea2:2::1
PROTOCOL

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ipfs.io/ipfs/img/bg-image.jpg
Requested by: Host: ipfs.io
URL: https://ipfs.io/ipfs/bafybeifyfuhyllulzls4mmfkcavt7f6v6fokzgu54sehlzzekg7ixt427q/indexL.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2602:fea2:2::1 , United States, ASN40680 (PROTOCOL, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e8856cc684816077ba936a597766af108ad049a09a854f1def9147ee772d7dc8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://ipfs.io/ipfs/bafybeifyfuhyllulzls4mmfkcavt7f6v6fokzgu54sehlzzekg7ixt427q/indexL.html

Response headers

cf-cache-status: MISS
cf-ray: 8f135de709ca9bf4-FRA
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Fri, 13 Dec 2024 04:56:17 GMT
content-type: text/html
x-ipfs-pop: rainbow-fr2-01
server: cloudflare
priority: u=3,i
vary: Accept-Encoding

GET
H2

200

favicon.ico
ipfs.tech/
Redirect Chain

https://ipfs.io/favicon.ico
https://ipfs.tech/favicon.ico

15 KB
5 KB

75ms
21ms

Other
image/x-icon

2400:52e0:1e00::1080:1
CDN77 Datacamp Li...

General

Check archive.org

Show headers Download Go to

Full URL

https://ipfs.tech/favicon.ico

Protocol

H2

Server

2400:52e0:1e00::1080:1 , Germany, ASN60068 (CDN77 Datacamp Limited, GB),

Reverse DNS

Software

BunnyCDN-DE1-1080 /

Resource Hash

94a9fefbbe42310c03ff1e52c1f753c21038805f632867ea78930a52c445a456

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://ipfs.io/

Response headers

cdn-status: 200
x-request-id: 55fc21d217c1c0d1abcf4c5c220da5c0
access-control-expose-headers: Content-Length, Content-Range, X-Chunked-Output, X-Ipfs-Path, X-Ipfs-Roots, X-Stream-Output
content-encoding: br
x-ipfs-path: /ipfs/bafybeig2htkx6trji2aast7x6bdymzdgm4gc4ouvp25n7fufr55nitci3y/favicon.ico
etag: W/"QmULFXXZMtQ2wCXDU6L8d9R4bYiQi7GpENhhZFF7ctPJDT"
x-content-type-options: nosniff
x-ipfs-roots: bafybeig2htkx6trji2aast7x6bdymzdgm4gc4ouvp25n7fufr55nitci3y,QmULFXXZMtQ2wCXDU6L8d9R4bYiQi7GpENhhZFF7ctPJDT
cdn-cachedat: 12/08/2024 23:03:47
content-type: image/x-icon
x-cache-status: HIT
cdn-cache: HIT
cache-control: max-age=60, stale-while-revalidate=3600
cdn-requestpullsuccess: True
cdn-pullzone: 2016121
referrer-policy: strict-origin-when-cross-origin
cdn-proxyver: 1.06
x-xss-protection: 0
cdn-edgestorageid: 1082
server: BunnyCDN-DE1-1080
cdn-requestcountrycode: DE
access-control-allow-methods: GET, HEAD, OPTIONS
date: Fri, 13 Dec 2024 04:56:17 GMT
vary: Accept-Encoding
access-control-allow-headers: Content-Type, Range, User-Agent, X-Requested-With
cdn-requestpullcode: 200
strict-transport-security: max-age=31536000; includeSubDomains
content-security-policy: upgrade-insecure-requests
cdn-requesttime: 0
cdn-uid: 070ccd6e-b4b0-4c90-b45a-e26d7534205d
cdn-requestid: 87c70fab59f532b86abfd006fdce975b
access-control-allow-origin: *

Redirect headers

server: cloudflare
location: https://ipfs.tech/favicon.ico
cf-cache-status: HIT
age: 13
cf-ray: 8f135de749e79bf4-FRA
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Fri, 13 Dec 2024 04:56:17 GMT
content-type: text/html
x-ipfs-pop: rainbow-fr2-02
vary: Accept-Encoding
priority: u=1,i

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Email (Online)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 function| $ function| jQuery

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	warning	URL: about:blank Message: An iframe which has both allow-scripts and allow-same-origin for its sandbox attribute can escape its sandboxing.
network	error	URL: https://ipfs.io/ipfs/img/bg-image.jpg Message: Failed to load resource: the server responded with a status of 422 ()
recommendation	verbose	URL: https://ipfs.io/ipfs/bafybeifyfuhyllulzls4mmfkcavt7f6v6fokzgu54sehlzzekg7ixt427q/indexL.html#redacted_email Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
ipfs.io
ipfs.tech
stackpath.bootstrapcdn.com
2400:52e0:1e00::1080:1
2602:fea2:2::1
2606:4700::6812:acf
2a00:1450:4001:831::200a
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
2d1c6efc7ba8d7b7a3bd04a9e11a7761c112e4bbc23f74937749067acea91d70
3e7097bef0ffa15fc448386b0eec0f7d16b6f1db21899325c4f918b5464b578f
5b0fbe5b7ad705f6a937c4998ad02f73d8f0d976fe231b74aef0ec996990c93a
94a9fefbbe42310c03ff1e52c1f753c21038805f632867ea78930a52c445a456
e8856cc684816077ba936a597766af108ad049a09a854f1def9147ee772d7dc8

ipfs.io Open in urlscan Pro 2602:fea2:2::1 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

5 Requests

80 %HTTPS

100 %IPv6

4 Domains

4 Subdomains

5 IPs

2 Countries

84 kBTransfer

306 kBSize

0 Cookies

0 Outgoing links

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

0 Cookies

3 Console Messages

Indicators

ipfs.io Open in urlscan Pro
2602:fea2:2::1 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

80 %
HTTPS

100 %
IPv6

4
Domains

4
Subdomains

5
IPs

2
Countries

84 kB
Transfer

306 kB
Size

0
Cookies

5 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!