bafkreicwiql3zqxbs4pgyfg6moi34s3gapiqncovtpamnpb6zffx5mzyqa.ipfs.dweb.link Open in urlscan Pro
2602:fea2:2::1  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response bafkreicwiql3zqxbs4pgyfg6moi34s3gapiqncovtpamnpb6zffx5mzyqa.ipfs.dweb.link/	28 KB 10 KB	222ms 106ms	Document text/html	2602:fea2:2::1 PROTOCOL
General Check archive.org Show headers Download Go to Full URL https://bafkreicwiql3zqxbs4pgyfg6moi34s3gapiqncovtpamnpb6zffx5mzyqa.ipfs.dweb.link/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2602:fea2:2::1 , United States, ASN40680 (PROTOCOL, US), Reverse DNS Software openresty / Resource Hash 564417bcc2e1971e6c14de6391be4b6603d10689d59bc0c6bc3ec94b7eb33880 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36 accept-language en-US,en;q=0.9 Response headers access-control-allow-headers X-Requested-With, Range, Content-Range, X-Chunked-Output, X-Stream-Output access-control-allow-methods GET HEAD OPTIONS GET, POST, OPTIONS access-control-allow-origin * access-control-expose-headers Content-Range, X-Chunked-Output, X-Stream-Output cache-control public, max-age=29030400, immutable content-encoding gzip content-type text/html date Sat, 28 Oct 2023 16:42:35 GMT etag W/"bafkreicwiql3zqxbs4pgyfg6moi34s3gapiqncovtpamnpb6zffx5mzyqa" server openresty strict-transport-security max-age=31536000; includeSubDomains; preload timing-allow-origin * vary Accept-Encoding x-ipfs-gateway-host ipfs-bank6-dc13 x-ipfs-lb-pop gateway-bank3-dc13 x-ipfs-path /ipfs/bafkreicwiql3zqxbs4pgyfg6moi34s3gapiqncovtpamnpb6zffx5mzyqa/ x-ipfs-pop ipfs-bank6-dc13 x-ipfs-roots bafkreicwiql3zqxbs4pgyfg6moi34s3gapiqncovtpamnpb6zffx5mzyqa x-proxy-cache MISS
GET H2	200	jquery-1.9.1.js Show response code.jquery.com/	262 KB 78 KB	87ms 26ms	Script application/javascript	2a04:4e42:400::649 FASTLY
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-1.9.1.js Requested by Host: bafkreicwiql3zqxbs4pgyfg6moi34s3gapiqncovtpamnpb6zffx5mzyqa.ipfs.dweb.link URL: https://bafkreicwiql3zqxbs4pgyfg6moi34s3gapiqncovtpamnpb6zffx5mzyqa.ipfs.dweb.link/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:400::649 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 7bd80d06c01c0340c1b9159b9b4a197db882ca18cbac8e9b9aa025e68f998d40 Request headers accept-language en-US,en;q=0.9 Referer https://bafkreicwiql3zqxbs4pgyfg6moi34s3gapiqncovtpamnpb6zffx5mzyqa.ipfs.dweb.link/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36 Response headers date Sat, 28 Oct 2023 16:42:36 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish age 3709149 x-cache HIT, HIT content-length 79506 x-served-by cache-lga21952-LGA, cache-mia-kmia1760032-MIA last-modified Fri, 18 Oct 1991 12:00:00 GMT server nginx x-timer S1698511356.076478,VS0,VE0 etag W/"28feccc0-4185d" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=604800 accept-ranges bytes x-cache-hits 757, 2606
GET H2	200	crypto-js.min.js Show response cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/	47 KB 14 KB	97ms 38ms	Script application/javascript	2606:4700::6811:190e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js Requested by Host: bafkreicwiql3zqxbs4pgyfg6moi34s3gapiqncovtpamnpb6zffx5mzyqa.ipfs.dweb.link URL: https://bafkreicwiql3zqxbs4pgyfg6moi34s3gapiqncovtpamnpb6zffx5mzyqa.ipfs.dweb.link/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8e3b0117f4df4be452c0b6af5b8f0a0acf9d4ade23d08d55d7e312af22077762 Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers accept-language en-US,en;q=0.9 Referer https://bafkreicwiql3zqxbs4pgyfg6moi34s3gapiqncovtpamnpb6zffx5mzyqa.ipfs.dweb.link/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36 Response headers date Sat, 28 Oct 2023 16:42:36 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} strict-transport-security max-age=15780000 age 4399597 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 13972 last-modified Thu, 22 Jun 2023 10:57:57 GMT server cloudflare cf-cdnjs-via cfworker/r2 etag "64942935-3694" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JJWWhbZl7VN%2BrdaBhg8Xrgn51h4%2BLVxj9v6MrTqViFA2OdzDUBRdCe8RIMtDuoRlK%2Bi7UE0t2jLGWDDVfkJwrP6wY38SBB5Zw8%2FwLsOiZqc%2FtabVOIsDof7c57wcX%2BY%2FfNUpkwkm4%2FEcMEPP4RIN63N5"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=30672000 accept-ranges bytes timing-allow-origin * cf-ray 81d4a2077f885c75-MIA expires Thu, 17 Oct 2024 16:42:36 GMT
GET H2	200	AJFCJaXhZo6cUCNh1ssNQzSV3jc1ppd5Vt2HN5GjHL82rJR25OrOigrMWVvBpwQN6BD4T_qHdwh2spOZ9bKA-BqcHsttYMUy5sxc-E99nKe9pgDJsCX0icydpRhjm97W_S4_6cism2sTCOp-Oxa807yjCEw=w1580-h720-s-no lh3.googleusercontent.com/pw/	192 KB 193 KB	337ms 229ms	Image image/gif	2607:f8b0:4004:c07::84 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://lh3.googleusercontent.com/pw/AJFCJaXhZo6cUCNh1ssNQzSV3jc1ppd5Vt2HN5GjHL82rJR25OrOigrMWVvBpwQN6BD4T_qHdwh2spOZ9bKA-BqcHsttYMUy5sxc-E99nKe9pgDJsCX0icydpRhjm97W_S4_6cism2sTCOp-Oxa807yjCEw=w1580-h720-s-no?authuser=0 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4004:c07::84 Washington, United States, ASN15169 (GOOGLE, US), Reverse DNS Software fife / Resource Hash c51ecfdbb39612d629bbbfa57896c63dc52971d7bcf78f1795944be16274a8eb Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language en-US,en;q=0.9 Referer https://bafkreicwiql3zqxbs4pgyfg6moi34s3gapiqncovtpamnpb6zffx5mzyqa.ipfs.dweb.link/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36 Response headers date Sat, 28 Oct 2023 16:42:36 GMT x-content-type-options nosniff server fife etag "v51" vary Origin content-type image/gif access-control-expose-headers Content-Length cache-control private, max-age=86400, no-transform cross-origin-resource-policy cross-origin content-disposition inline;filename="Flashback - Jul 5, 2023 00_04_12.gif" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 197044 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H/1.1	200 OK	/ Show response pro.ip-api.com/json/	287 B 443 B	218ms 51ms	XHR application/json	208.95.112.2 TUT-AS
General Check archive.org Show headers Download Go to Full URL https://pro.ip-api.com/json/?key=pD3jjrEbn4o2CQ1 Requested by Host: code.jquery.com URL: https://code.jquery.com/jquery-1.9.1.js Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_256_CBC Server 208.95.112.2 , United States, ASN53334 (TUT-AS, US), Reverse DNS Software / Resource Hash 8c69748d724cac4e6c0ec5628526937a41e0b85ffb12fe69dc4b495206fb2378 Request headers Accept application/json, text/javascript, */*; q=0.01 Referer https://bafkreicwiql3zqxbs4pgyfg6moi34s3gapiqncovtpamnpb6zffx5mzyqa.ipfs.dweb.link/ accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36 Response headers Access-Control-Allow-Origin * Date Sat, 28 Oct 2023 16:42:37 GMT Content-Length 287 Content-Type application/json; charset=utf-8
POST H2	200	/ 142vhbszv5f.jdjdmxnx.online/obufsssssssscaaatoion/	316 KB 0	316ms 236ms	XHR application/json	2606:4700:3033::ac43:cdb1 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://142vhbszv5f.jdjdmxnx.online/obufsssssssscaaatoion/ Requested by Host: code.jquery.com URL: https://code.jquery.com/jquery-1.9.1.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3033::ac43:cdb1 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 1; mode=block Request headers Accept application/json, text/javascript, */*; q=0.01 Referer https://bafkreicwiql3zqxbs4pgyfg6moi34s3gapiqncovtpamnpb6zffx5mzyqa.ipfs.dweb.link/ accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36 Content-Type application/x-www-form-urlencoded; charset=UTF-8 Response headers date Sat, 28 Oct 2023 16:42:37 GMT content-encoding br x-content-type-options nosniff referrer-policy same-origin cf-cache-status DYNAMIC nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary origin x-frame-options DENY content-type application/json access-control-allow-origin * report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lvCA1z7ftYTPsvtrvO1bSWgatTETBU8QrnfxurYxCaQYDUsH4LlfYrUvF%2BpbGVZQpUYxtoNyQCoOWAywqV6CnpRde1gsZGlorc61rZmO80VcQkzAMbCIsJP70lzZzvLzRMhLBq3oOw%2BrMzjljh%2BhnRdj48k1GD9klMo%3D"}],"group":"cf-nel","max_age":604800} cf-ray 81d4a20f4cc42594-MIA alt-svc h3=":443"; ma=86400 x-xss-protection 1; mode=block

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

16 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture function| _0xcd603a function| _0x3182f6 function| _0x269c function| _0x944f string| IGOBZL string| cbbg string| UzEqFLCo string| kaka90nal string| ka45k459final2 string| kak0011afinal string| getjsonnn number| countttingerr object| CryptoJS function| $ function| jQuery

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

142vhbszv5f.jdjdmxnx.online
bafkreicwiql3zqxbs4pgyfg6moi34s3gapiqncovtpamnpb6zffx5mzyqa.ipfs.dweb.link
cdnjs.cloudflare.com
code.jquery.com
lh3.googleusercontent.com
pro.ip-api.com
208.95.112.2
2602:fea2:2::1
2606:4700:3033::ac43:cdb1
2606:4700::6811:190e
2607:f8b0:4004:c07::84
2a04:4e42:400::649
564417bcc2e1971e6c14de6391be4b6603d10689d59bc0c6bc3ec94b7eb33880
7bd80d06c01c0340c1b9159b9b4a197db882ca18cbac8e9b9aa025e68f998d40
8c69748d724cac4e6c0ec5628526937a41e0b85ffb12fe69dc4b495206fb2378
8e3b0117f4df4be452c0b6af5b8f0a0acf9d4ade23d08d55d7e312af22077762
c51ecfdbb39612d629bbbfa57896c63dc52971d7bcf78f1795944be16274a8eb