gateway.ipfs.io Open in urlscan Pro
2602:fea2:2::1  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request bafkreig4xdpdhfitgxv2jfifjak5ctkaeqdldf4m6m6chu2vvhc2x3txnu Show response gateway.ipfs.io/ipfs/	29 KB 9 KB	743ms 707ms	Document text/html	2602:fea2:2::1 PROTOCOL
General Check archive.org Show headers Download Go to Full URL https://gateway.ipfs.io/ipfs/bafkreig4xdpdhfitgxv2jfifjak5ctkaeqdldf4m6m6chu2vvhc2x3txnu Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2602:fea2:2::1 , United States, ASN40680 (PROTOCOL, US), Reverse DNS Software openresty / Resource Hash dcb8de33951335eba495054815d14d402406b1978cf33c23d355a9c5abee776d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.28 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers access-control-allow-headers Content-Type Range User-Agent X-Requested-With access-control-allow-methods GET HEAD OPTIONS access-control-allow-origin * access-control-expose-headers Content-Length Content-Range X-Chunked-Output X-Ipfs-Path X-Ipfs-Roots X-Stream-Output cache-control public, max-age=29030400, immutable content-encoding br content-type text/html date Wed, 31 Jan 2024 20:33:49 GMT etag "bafkreig4xdpdhfitgxv2jfifjak5ctkaeqdldf4m6m6chu2vvhc2x3txnu" server openresty strict-transport-security max-age=31536000; includeSubDomains; preload timing-allow-origin * vary Accept-Encoding x-bfid 3607e7893ba5340153eb698ac8de33c3 x-ipfs-lb-pop gateway-bank1-fr2 x-ipfs-path /ipfs/bafkreig4xdpdhfitgxv2jfifjak5ctkaeqdldf4m6m6chu2vvhc2x3txnu x-ipfs-pop ipfs-bank4-fr2 x-ipfs-roots bafkreig4xdpdhfitgxv2jfifjak5ctkaeqdldf4m6m6chu2vvhc2x3txnu x-proxy-cache MISS
GET H2	200	jquery-1.9.1.js Show response code.jquery.com/	262 KB 78 KB	82ms 8ms	Script application/javascript	2a04:4e42:600::649 FASTLY
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-1.9.1.js Requested by Host: gateway.ipfs.io URL: https://gateway.ipfs.io/ipfs/bafkreig4xdpdhfitgxv2jfifjak5ctkaeqdldf4m6m6chu2vvhc2x3txnu Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:600::649 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 7bd80d06c01c0340c1b9159b9b4a197db882ca18cbac8e9b9aa025e68f998d40 Request headers accept-language de-DE,de;q=0.9 Referer https://gateway.ipfs.io/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.28 Safari/537.36 Response headers date Wed, 31 Jan 2024 20:33:49 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish age 1309091 x-cache HIT, HIT content-length 79506 x-served-by cache-lga21952-LGA, cache-fra-eddf8230130-FRA last-modified Fri, 18 Oct 1991 12:00:00 GMT server nginx x-timer S1706733230.981766,VS0,VE0 etag W/"28feccc0-4185d" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=604800 accept-ranges bytes x-cache-hits 16, 41061
GET H2	200	crypto-js.min.js Show response cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/	47 KB 14 KB	51ms 34ms	Script application/javascript	2606:4700::6811:190e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js Requested by Host: gateway.ipfs.io URL: https://gateway.ipfs.io/ipfs/bafkreig4xdpdhfitgxv2jfifjak5ctkaeqdldf4m6m6chu2vvhc2x3txnu Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8e3b0117f4df4be452c0b6af5b8f0a0acf9d4ade23d08d55d7e312af22077762 Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://gateway.ipfs.io/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.28 Safari/537.36 Response headers date Wed, 31 Jan 2024 20:33:49 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} strict-transport-security max-age=15780000 age 5412351 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 13972 last-modified Sat, 14 Aug 2021 20:33:09 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "61182885-3694" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kIo60elM%2BrSXhHzitY79UBexVIZkOOpiF3Jyb7qQYTWV4uSvlywHV3%2BC143dXNv4WoGmiSgU7AGgmlTih4df4FDtCoCFbM10WA2sH%2F40eHYhrshEw2Jcdf6%2BQpHr9f3XzLhs6ovPeHC1kr6Tdk4JmSLe"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=30672000 accept-ranges bytes timing-allow-origin * cf-ray 84e4bb5f1c8237e9-FRA expires Mon, 20 Jan 2025 20:33:49 GMT
GET		preload-outlook.gif 2j1vh7t65r3.gakgalag.online/static/media/	0 0
GET H2	200	preload-outlook.gif 706iaway7ta.lkalzzop.online/static/media/	192 KB 193 KB	592ms 318ms	Image image/gif	2606:4700:3033::ac43:c119 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://706iaway7ta.lkalzzop.online/static/media/preload-outlook.gif Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3033::ac43:c119 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash c51ecfdbb39612d629bbbfa57896c63dc52971d7bcf78f1795944be16274a8eb Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://gateway.ipfs.io/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.28 Safari/537.36 Response headers date Wed, 31 Jan 2024 20:33:50 GMT x-content-type-options nosniff cf-cache-status MISS nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} content-disposition inline; filename="preload-outlook.gif" alt-svc h3=":443"; ma=86400 content-length 197044 x-xss-protection 1; mode=block referrer-policy same-origin last-modified Sat, 04 Nov 2023 22:18:46 GMT server cloudflare x-frame-options DENY vary origin, Accept-Encoding content-type image/gif report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lmx%2Fqd4yMFG6hB3Omp5q48ffIUGAGE8HgjVOuIr%2F8ukoY20vDpes3vbj%2FQYiXfb1AwyrCFyfor6xK9PX6jytjyeaXzR39swjXhKV4o%2FWr6ORpya51YRMOigsv%2FoJhxbhF7hOeyfloZXyo%2Fhma1dtNtDs7L209kZDgWk%3D"}],"group":"cf-nel","max_age":604800} cache-control max-age=14400 accept-ranges bytes cf-ray 84e4bb60ed9d728f-EWR
GET H/1.1	200 OK	/ Show response pro.ip-api.com/json/	312 B 468 B	39ms 7ms	XHR application/json	51.77.64.70 OVH
General Check archive.org Show headers Download Go to Full URL https://pro.ip-api.com/json/?key=pD3jjrEbn4o2CQ1 Requested by Host: code.jquery.com URL: https://code.jquery.com/jquery-1.9.1.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 51.77.64.70 , Germany, ASN16276 (OVH, FR), Reverse DNS de-fra-1.pro.ip-api.com Software / Resource Hash 755d02c2945efd776757f0c53bdf09ebfbb6f10c763add070d280ffb71ae51a1 Request headers Accept application/json, text/javascript, */*; q=0.01 Referer https://gateway.ipfs.io/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.28 Safari/537.36 Response headers Access-Control-Allow-Origin * Date Wed, 31 Jan 2024 20:33:50 GMT Content-Length 312 Content-Type application/json; charset=utf-8
POST		/ 2j1vh7t65r3.gakgalag.online/obufsssssssscaaatoion/	0 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

2j1vh7t65r3.gakgalag.online

URL

https://2j1vh7t65r3.gakgalag.online/static/media/preload-outlook.gif

Domain

2j1vh7t65r3.gakgalag.online

URL

https://2j1vh7t65r3.gakgalag.online/obufsssssssscaaatoion/

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

40 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| _0x230645 function| _0x2c61b6 function| _0x23be01 function| _0x570a8e function| _0x150ef function| _0xe59dbc function| _0xa10c7b function| _0x34c89c function| _0x36eb68 function| _0x4258fa function| _0x55669 function| _0xb3f866 function| _0x504513 function| _0x47bbe2 function| _0x237eb0 function| _0x2d768f function| _0x1cbd2e function| _0x596670 function| _0x4312f2 function| _0x564f89 function| _0x5e02d2 function| _0x5951a8 function| _0x569262 function| _0x302a54 function| _0x24ceee function| _0x239c function| _0x59af object| div1 string| Page_type string| IGOBZL string| cbbg string| fwjYbNLf string| kaka90nal string| ka45k459final2 string| kak0011afinal string| getjsonnn number| countttingerr object| CryptoJS function| $ function| jQuery

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://2j1vh7t65r3.gakgalag.online/static/media/preload-outlook.gif Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network	error	URL: https://2j1vh7t65r3.gakgalag.online/obufsssssssscaaatoion/ Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

2j1vh7t65r3.gakgalag.online
706iaway7ta.lkalzzop.online
cdnjs.cloudflare.com
code.jquery.com
gateway.ipfs.io
pro.ip-api.com
2j1vh7t65r3.gakgalag.online
2602:fea2:2::1
2606:4700:3033::ac43:c119
2606:4700::6811:190e
2a04:4e42:600::649
51.77.64.70
755d02c2945efd776757f0c53bdf09ebfbb6f10c763add070d280ffb71ae51a1
7bd80d06c01c0340c1b9159b9b4a197db882ca18cbac8e9b9aa025e68f998d40
8e3b0117f4df4be452c0b6af5b8f0a0acf9d4ade23d08d55d7e312af22077762
c51ecfdbb39612d629bbbfa57896c63dc52971d7bcf78f1795944be16274a8eb
dcb8de33951335eba495054815d14d402406b1978cf33c23d355a9c5abee776d