urlscan.io logo urlscan.io
SecurityTrails logo

ipfs.io Open in urlscan Pro
2602:fea2:2::1  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://ipfs.io/ipfs/QmauC8srPszWehe8EAsnJh7ajvoJuZbhikn1AyeQgRiZm4?email=3mail@b.c
Effective URL: https://ipfs.io/ipfs/QmauC8srPszWehe8EAsnJh7ajvoJuZbhikn1AyeQgRiZm4?email=3mail@b.c
Submission: On January 15 via automatic, source openphish — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 8 IPs in 5 countries across 7 domains to perform 19 HTTP transactions. The main IP is 2602:fea2:2::1, located in United States and belongs to PROTOCOL, US. The main domain is ipfs.io. The Cisco Umbrella rank of the primary domain is 48503.
TLS certificate: Issued by R3 on January 10th 2023. Valid for: 3 months.
This is the only time ipfs.io was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Bank of America (Banking)

Domain & IP information

IP Address AS Autonomous System
1 2602:fea2:2::1 40680 (PROTOCOL)
7 104.18.26.27 13335 (CLOUDFLAR...)
1 34.251.201.224 16509 (AMAZON-02)
1 35.196.226.51 396982 (GOOGLE-CL...)
1 109.169.71.112 20860 (IOMART-AS)
1 2a00:1450:400... 15169 (GOOGLE)
1 104.237.62.211 18450 (WEBNX)
19 8
1    2602:fea2:2::1 (United States)

ASN40680 (PROTOCOL, US)
ipfs.io
7    104.18.26.27 (None, )

ASN13335 (CLOUDFLARENET, US)
www.visaprepaidprocessing.com
1    34.251.201.224 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-251-201-224.eu-west-1.compute.amazonaws.com
ppllabs.com
1    35.196.226.51 (North Charleston, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 51.226.196.35.bc.googleusercontent.com
risingsunopp.org
1    109.169.71.112 (United Kingdom)

ASN20860 (IOMART-AS, GB)
smtpjs.com
1    2a00:1450:4001:80f::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
ajax.googleapis.com
1    104.237.62.211 (El Segundo, United States)

ASN18450 (WEBNX, US)
PTR: hosted-by.racknerd.com
api.ipify.org
Apex Domain
Subdomains		 Transfer
7 visaprepaidprocessing.com
www.visaprepaidprocessing.com — Cisco Umbrella Rank: 250283
74 KB
1 ipify.org
api.ipify.org — Cisco Umbrella Rank: 2847
124 B
1 googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 292
30 KB
1 smtpjs.com
smtpjs.com — Cisco Umbrella Rank: 127263
1 KB
1 risingsunopp.org
risingsunopp.org
39 KB
1 ppllabs.com
ppllabs.com
1 ipfs.io
ipfs.io — Cisco Umbrella Rank: 48503
8 KB
19 7
Domain Requested by
7 www.visaprepaidprocessing.com ipfs.io
www.visaprepaidprocessing.com
1 api.ipify.org ajax.googleapis.com
1 ajax.googleapis.com ipfs.io
1 smtpjs.com ipfs.io
1 risingsunopp.org ipfs.io
1 ppllabs.com ipfs.io
1 ipfs.io
19 7

This site contains no links.

Subject Issuer Validity Valid
dweb.link
R3		 2023-01-10 -
2023-04-10		 3 months crt.sh
www.visaprepaidprocessing.com
Cloudflare Inc ECC CA-3		 2022-05-07 -
2023-05-07		 a year crt.sh
ppllabs.com
R3		 2022-11-24 -
2023-02-22		 3 months crt.sh
risingsunopp.org
R3		 2022-12-27 -
2023-03-27		 3 months crt.sh
smtpjs.com
R3		 2023-01-14 -
2023-04-14		 3 months crt.sh
upload.video.google.com
GTS CA 1C3		 2022-12-12 -
2023-03-06		 3 months crt.sh
*.ipify.org
Sectigo RSA Domain Validation Secure Server CA		 2022-02-07 -
2023-03-10		 a year crt.sh

This page contains 1 frames:

Primary Page: https://ipfs.io/ipfs/QmauC8srPszWehe8EAsnJh7ajvoJuZbhikn1AyeQgRiZm4?email=3mail@b.c
Frame ID: 9E0B5106B91BE4F0B97492901B71AA50
Requests: 19 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

EDD Login

Page URL History Show full URLs

  1. http://ipfs.io/ipfs/QmauC8srPszWehe8EAsnJh7ajvoJuZbhikn1AyeQgRiZm4?email=3mail@b.c HTTP 307
    https://ipfs.io/ipfs/QmauC8srPszWehe8EAsnJh7ajvoJuZbhikn1AyeQgRiZm4?email=3mail@b.c Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • /wp-(?:content|includes)/
Overall confidence: 100%
Detected patterns
  • <link[^>]+foundation[^>"]+css
  • <div [^>]*class="[^"]*(?:small|medium|large)-\d{1,2} columns
Overall confidence: 100%
Detected patterns
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

19
Requests

68 %
HTTPS

29 %
IPv6

7
Domains

7
Subdomains

8
IPs

5
Countries

151 kB
Transfer

536 kB
Size

3
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://ipfs.io/ipfs/QmauC8srPszWehe8EAsnJh7ajvoJuZbhikn1AyeQgRiZm4?email=3mail@b.c HTTP 307
    https://ipfs.io/ipfs/QmauC8srPszWehe8EAsnJh7ajvoJuZbhikn1AyeQgRiZm4?email=3mail@b.c Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

19 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request QmauC8srPszWehe8EAsnJh7ajvoJuZbhikn1AyeQgRiZm4
ipfs.io/ipfs/
Redirect Chain
  • http://ipfs.io/ipfs/QmauC8srPszWehe8EAsnJh7ajvoJuZbhikn1AyeQgRiZm4?email=3mail@b.c
  • https://ipfs.io/ipfs/QmauC8srPszWehe8EAsnJh7ajvoJuZbhikn1AyeQgRiZm4?email=3mail@b.c
42 KB
8 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ipfs.io/ipfs/QmauC8srPszWehe8EAsnJh7ajvoJuZbhikn1AyeQgRiZm4?email=3mail@b.c
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2602:fea2:2::1 , United States, ASN40680 (PROTOCOL, US),
Reverse DNS
Software
openresty /
Resource Hash
4c5cd3836711397408882a8fa0d116502e643954f56539a2cf30185abc08d027
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

access-control-allow-headers
X-Requested-With, Range, Content-Range, X-Chunked-Output, X-Stream-Output
access-control-allow-methods
GET GET, POST, OPTIONS
access-control-allow-origin
*
access-control-expose-headers
Content-Range, X-Chunked-Output, X-Stream-Output
cache-control
public, max-age=29030400, immutable
content-encoding
gzip
content-type
text/html
date
Sun, 15 Jan 2023 13:26:11 GMT
etag
W/"QmauC8srPszWehe8EAsnJh7ajvoJuZbhikn1AyeQgRiZm4"
server
openresty
strict-transport-security
max-age=31536000; includeSubDomains; preload
timing-allow-origin
*
vary
Accept-Encoding
x-ipfs-datasize
43355
x-ipfs-gateway-host
ipfs-bank13-fr2
x-ipfs-lb-pop
gateway-bank3-fr2
x-ipfs-path
/ipfs/QmauC8srPszWehe8EAsnJh7ajvoJuZbhikn1AyeQgRiZm4
x-ipfs-pop
ipfs-bank13-fr2
x-ipfs-roots
QmauC8srPszWehe8EAsnJh7ajvoJuZbhikn1AyeQgRiZm4
x-proxy-cache
HIT

Redirect headers

Cross-Origin-Resource-Policy
Cross-Origin
Location
https://ipfs.io/ipfs/QmauC8srPszWehe8EAsnJh7ajvoJuZbhikn1AyeQgRiZm4?email=3mail@b.c
Non-Authoritative-Reason
HSTS
css
www.visaprepaidprocessing.com/bundles/foundation/ 		2 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.visaprepaidprocessing.com/bundles/foundation/css?v=TgYukCV0BSpb98GObtBe6i9KeBqBppGV5EzParDKRD011
Requested by
Host: ipfs.io
URL: https://ipfs.io/ipfs/QmauC8srPszWehe8EAsnJh7ajvoJuZbhikn1AyeQgRiZm4?email=3mail@b.c
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
104.18.26.27 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9125b08d73099fe6cc8ec181f39edc63439b48442010ec2635791578f9e3b4ed
Security Headers
Name Value
Strict-Transport-Security max-age=3153600; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ipfs.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 15 Jan 2023 13:26:11 GMT
strict-transport-security
max-age=3153600; includeSubDomains
content-encoding
br
cf-cache-status
DYNAMIC
server
cloudflare
x-opnet-transaction-trace
a2_99749e8d-3490-4646-a323-252bd9e1f981-19028-436591
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
cache-control
no-cache
cf-ray
789ef1120c6dbb55-FRA
expires
-1
css
www.visaprepaidprocessing.com/bundles/ 		290 KB
47 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.visaprepaidprocessing.com/bundles/css?v=wAZASNxRNEHvELh5VVy5mcxHM2kaP7CFlrsQ-TKMrzc11
Requested by
Host: ipfs.io
URL: https://ipfs.io/ipfs/QmauC8srPszWehe8EAsnJh7ajvoJuZbhikn1AyeQgRiZm4?email=3mail@b.c
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
104.18.26.27 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6d926638fec19cfb6b7c198a7cbd5ba4933a966bc20aea5fb14db35c3318c46c
Security Headers
Name Value
Strict-Transport-Security max-age=3153600; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ipfs.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 15 Jan 2023 13:26:11 GMT
strict-transport-security
max-age=3153600; includeSubDomains
content-encoding
br
cf-cache-status
DYNAMIC
server
cloudflare
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
cache-control
no-cache
cf-ray
789ef1120c71bb55-FRA
expires
-1
preventEarlyClickCss
www.visaprepaidprocessing.com/bundles/ 		45 B
354 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.visaprepaidprocessing.com/bundles/preventEarlyClickCss?v=AjE3qz4xe4LPPh9UwnSuF7YqcFXF2UG5PMA-GpfTe5c11
Requested by
Host: ipfs.io
URL: https://ipfs.io/ipfs/QmauC8srPszWehe8EAsnJh7ajvoJuZbhikn1AyeQgRiZm4?email=3mail@b.c
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
104.18.26.27 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
42a0994f945e96989c7b09cd6d4c08fced929ce73f63396a83b3f071720c3c49
Security Headers
Name Value
Strict-Transport-Security max-age=3153600; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ipfs.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 15 Jan 2023 13:26:11 GMT
strict-transport-security
max-age=3153600; includeSubDomains
cf-cache-status
DYNAMIC
server
cloudflare
x-opnet-transaction-trace
a2_0c8349b5-37de-444f-bebf-d50e7832650a-13920-435820
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
cache-control
no-cache
cf-ray
789ef1120c74bb55-FRA
content-length
45
expires
-1
site.css
www.visaprepaidprocessing.com/content/PRC384/CP384-T03-019/_Styles/ 		65 KB
12 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.visaprepaidprocessing.com/content/PRC384/CP384-T03-019/_Styles/site.css
Requested by
Host: ipfs.io
URL: https://ipfs.io/ipfs/QmauC8srPszWehe8EAsnJh7ajvoJuZbhikn1AyeQgRiZm4?email=3mail@b.c
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
104.18.26.27 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9ac51812f3c5052b6c14281e132a55b2c5603b4170e8440cca32ebbff26fe866
Security Headers
Name Value
Strict-Transport-Security max-age=3153600; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ipfs.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date
Sun, 15 Jan 2023 13:26:11 GMT
strict-transport-security
max-age=3153600; includeSubDomains
content-encoding
br
cf-cache-status
REVALIDATED
last-modified
Mon, 11 May 2020 16:57:38 GMT
server
cloudflare
etag
W/"456f1a47b527d61:0"
x-opnet-transaction-trace
a2_ec9b58b8-8357-4787-9cf9-7e646f5577a7-33892-258901
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=14400
cf-ray
789ef1120c77bb55-FRA
expires
Sun, 15 Jan 2023 17:26:11 GMT
logo.png
www.visaprepaidprocessing.com/content/PRC384/CP384-T03-019/_Images/ 		8 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.visaprepaidprocessing.com/content/PRC384/CP384-T03-019/_Images/logo.png
Requested by
Host: ipfs.io
URL: https://ipfs.io/ipfs/QmauC8srPszWehe8EAsnJh7ajvoJuZbhikn1AyeQgRiZm4?email=3mail@b.c
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
104.18.26.27 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ad62eb85667532488d032273c196c7ea1c10e0897223c4b66cd38b8c5e5215a4
Security Headers
Name Value
Strict-Transport-Security max-age=3153600; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ipfs.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date
Sun, 15 Jan 2023 13:26:11 GMT
strict-transport-security
max-age=3153600; includeSubDomains
cf-cache-status
HIT
last-modified
Tue, 15 Oct 2019 14:27:22 GMT
server
cloudflare
age
2739
etag
"d8d87ca86483d51:0"
x-opnet-transaction-trace
a2_4008daaa-555e-4720-b487-5c3c8a14a5da-12676-260401
vary
Accept-Encoding
content-type
image/png
cache-control
public, max-age=14400
accept-ranges
bytes
cf-ray
789ef1120c78bb55-FRA
content-length
7719
expires
Sun, 15 Jan 2023 17:26:11 GMT
load.gif
ppllabs.com/wp-content/uploads/2018/10/ 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ppllabs.com/wp-content/uploads/2018/10/load.gif
Requested by
Host: ipfs.io
URL: https://ipfs.io/ipfs/QmauC8srPszWehe8EAsnJh7ajvoJuZbhikn1AyeQgRiZm4?email=3mail@b.c
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
34.251.201.224 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-251-201-224.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ipfs.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers
California-Emplorment-Development-Department.png
risingsunopp.org/wp-content/uploads/ 		38 KB
39 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://risingsunopp.org/wp-content/uploads/California-Emplorment-Development-Department.png
Requested by
Host: ipfs.io
URL: https://ipfs.io/ipfs/QmauC8srPszWehe8EAsnJh7ajvoJuZbhikn1AyeQgRiZm4?email=3mail@b.c
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.196.226.51 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
51.226.196.35.bc.googleusercontent.com
Software
nginx /
Resource Hash
e42a916188a514a0a199e43604cade7a8ea93c324b5b661a5dbb11055d10d459

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ipfs.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date
Sun, 15 Jan 2023 13:26:12 GMT
last-modified
Mon, 10 Jun 2019 17:08:24 GMT
server
nginx
etag
"5cfe8e88-9931"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
39217
EmailLogo.png
www.visaprepaidprocessing.com/content/PRC384/_images/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.visaprepaidprocessing.com/content/PRC384/_images/EmailLogo.png
Requested by
Host: ipfs.io
URL: https://ipfs.io/ipfs/QmauC8srPszWehe8EAsnJh7ajvoJuZbhikn1AyeQgRiZm4?email=3mail@b.c
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
104.18.26.27 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
db86fe978fad3c304c1c8b6ab1f65f409c16137076caec52fdfba3a18fbeebdb

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ipfs.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date
Sun, 15 Jan 2023 13:26:11 GMT
cf-cache-status
HIT
last-modified
Thu, 27 Aug 2020 16:15:23 GMT
server
cloudflare
age
5953
etag
"805f2c448d7cd61:0"
x-opnet-transaction-trace
a2_b65f5aaf-8ce7-4b07-ad29-24cc3b93b184-22500-1159409
vary
Accept-Encoding
content-type
image/png
cache-control
public, max-age=14400
accept-ranges
bytes
cf-ray
789ef1120c7abb55-FRA
content-length
3908
expires
Sun, 15 Jan 2023 17:26:11 GMT
smtp.js
smtpjs.com/v3/ 		871 B
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://smtpjs.com/v3/smtp.js
Requested by
Host: ipfs.io
URL: https://ipfs.io/ipfs/QmauC8srPszWehe8EAsnJh7ajvoJuZbhikn1AyeQgRiZm4?email=3mail@b.c
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
109.169.71.112 , United Kingdom, ASN20860 (IOMART-AS, GB),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
1fd711cb491a361ef91e29c50de0680a4b156c0b34bb91e18570d0037263a776

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ipfs.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date
Sun, 15 Jan 2023 13:26:10 GMT
last-modified
Tue, 10 Nov 2020 17:17:51 GMT
server
Microsoft-IIS/10.0
etag
"162f436b85b7d61:0"
x-powered-by
ASP.NET
content-type
application/javascript
access-control-allow-origin
*
accept-ranges
bytes
content-length
871
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.2.1/ 		85 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.min.js
Requested by
Host: ipfs.io
URL: https://ipfs.io/ipfs/QmauC8srPszWehe8EAsnJh7ajvoJuZbhikn1AyeQgRiZm4?email=3mail@b.c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ipfs.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

date
Sat, 14 Jan 2023 22:14:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
54731
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
30306
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 19:15:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="hosted-libraries-pushers"
vary
Accept-Encoding
report-to
{"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 14 Jan 2024 22:14:00 GMT
print
www.visaprepaidprocessing.com/bundles/css/ 		2 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.visaprepaidprocessing.com/bundles/css/print?v=JPgM1hk5e3sLqXHZFVWtkkRA7MMTcH6t30yiIk5dBDo11
Requested by
Host: ipfs.io
URL: https://ipfs.io/ipfs/QmauC8srPszWehe8EAsnJh7ajvoJuZbhikn1AyeQgRiZm4?email=3mail@b.c
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
104.18.26.27 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5e2aabe93299c82250d8d6952e7eec0d120c95b45ddc24175f187dd530543205
Security Headers
Name Value
Strict-Transport-Security max-age=3153600; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ipfs.io/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 15 Jan 2023 13:26:11 GMT
strict-transport-security
max-age=3153600; includeSubDomains
content-encoding
br
cf-cache-status
DYNAMIC
server
cloudflare
x-opnet-transaction-trace
a2_dd4aceb7-fde6-441f-afef-ea533747dc67-1032-438000
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
cache-control
no-cache
cf-ray
789ef1122cb5bb55-FRA
expires
-1
OpenSans-Regular-webfont.woff
www.visaprepaidprocessing.com/Content/_Fonts/ 		0
0
Connections.woff
www.visaprepaidprocessing.com/content/PRC384/_Fonts/ 		0
0
OpenSans-Bold-webfont.woff
www.visaprepaidprocessing.com/Content/_Fonts/ 		0
0
/
api.ipify.org/ 		23 B
124 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://api.ipify.org/?format=json
Requested by
Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.237.62.211 El Segundo, United States, ASN18450 (WEBNX, US),
Reverse DNS
hosted-by.racknerd.com
Software
/
Resource Hash
301dbb41f4ca7dc136bbdd4edbe288efb9cc0adbfc0a6884c7fd14e4c95a0b15

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://ipfs.io/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.74 Safari/537.36

Response headers

access-control-allow-origin
*
date
Sun, 15 Jan 2023 13:26:12 GMT
access-control-allow-credentials
true
content-length
23
vary
Origin
content-type
application/json
OpenSans-Bold-webfont.ttf
www.visaprepaidprocessing.com/Content/_Fonts/ 		0
0
OpenSans-Regular-webfont.ttf
www.visaprepaidprocessing.com/Content/_Fonts/ 		0
0
Connections.ttf
www.visaprepaidprocessing.com/content/PRC384/_Fonts/ 		0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
www.visaprepaidprocessing.com
URL
https://www.visaprepaidprocessing.com/Content/_Fonts/OpenSans-Regular-webfont.woff
Domain
www.visaprepaidprocessing.com
URL
https://www.visaprepaidprocessing.com/content/PRC384/_Fonts/Connections.woff
Domain
www.visaprepaidprocessing.com
URL
https://www.visaprepaidprocessing.com/Content/_Fonts/OpenSans-Bold-webfont.woff
Domain
www.visaprepaidprocessing.com
URL
https://www.visaprepaidprocessing.com/Content/_Fonts/OpenSans-Bold-webfont.ttf
Domain
www.visaprepaidprocessing.com
URL
https://www.visaprepaidprocessing.com/Content/_Fonts/OpenSans-Regular-webfont.ttf
Domain
www.visaprepaidprocessing.com
URL
https://www.visaprepaidprocessing.com/content/PRC384/_Fonts/Connections.ttf

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Bank of America (Banking)

12 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontentvisibilityautostatechange object| Email function| sendEmailL function| sendEmailC function| sendEmail function| sendEmail2 function| sendEmail3 function| sendEmail4 function| sendEmail5 function| sendEmail6 function| $ function| jQuery

3 Cookies

Domain/Path Name / Value
.visaprepaidprocessing.com/ Name: __cfruid
Value: 5c2fce4af6e6ab8402385624550eac0f6899a4a5-1673789171
www.visaprepaidprocessing.com/ Name: __cflb
Value: 0H28uxchcBYFcUJ7agzKikmQw5nqRP4zZd9XveYFuhe
.visaprepaidprocessing.com/ Name: __cf_bm
Value: POCdZteNxb7ETHZ.BW4V.kH.EzCiV3.Qb.hulsNiEZM-1673789171-0-AX20MXjrIku9ol+U98cqwwYWGFMxLiqCJDc+Ls9Zkjaz1/59vFRqKrTpCYsxIxEQYh/JOxa9cBwn3TKGuCLyO88=

13 Console Messages

Source Level URL
Text
network error URL: https://ppllabs.com/wp-content/uploads/2018/10/load.gif
Message:
Failed to load resource: the server responded with a status of 404 ()
javascript error URL: https://ipfs.io/ipfs/QmauC8srPszWehe8EAsnJh7ajvoJuZbhikn1AyeQgRiZm4?email=3mail@b.c
Message:
Access to font at 'https://www.visaprepaidprocessing.com/Content/_Fonts/OpenSans-Bold-webfont.woff' from origin 'https://ipfs.io' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://www.visaprepaidprocessing.com/Content/_Fonts/OpenSans-Bold-webfont.woff
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: https://ipfs.io/ipfs/QmauC8srPszWehe8EAsnJh7ajvoJuZbhikn1AyeQgRiZm4?email=3mail@b.c
Message:
Access to font at 'https://www.visaprepaidprocessing.com/Content/_Fonts/OpenSans-Regular-webfont.woff' from origin 'https://ipfs.io' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://www.visaprepaidprocessing.com/Content/_Fonts/OpenSans-Regular-webfont.woff
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: https://ipfs.io/ipfs/QmauC8srPszWehe8EAsnJh7ajvoJuZbhikn1AyeQgRiZm4?email=3mail@b.c
Message:
Access to font at 'https://www.visaprepaidprocessing.com/content/PRC384/_Fonts/Connections.woff' from origin 'https://ipfs.io' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://www.visaprepaidprocessing.com/content/PRC384/_Fonts/Connections.woff
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: https://ipfs.io/ipfs/QmauC8srPszWehe8EAsnJh7ajvoJuZbhikn1AyeQgRiZm4?email=3mail@b.c
Message:
Access to font at 'https://www.visaprepaidprocessing.com/Content/_Fonts/OpenSans-Regular-webfont.ttf' from origin 'https://ipfs.io' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://www.visaprepaidprocessing.com/Content/_Fonts/OpenSans-Regular-webfont.ttf
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: https://ipfs.io/ipfs/QmauC8srPszWehe8EAsnJh7ajvoJuZbhikn1AyeQgRiZm4?email=3mail@b.c
Message:
Access to font at 'https://www.visaprepaidprocessing.com/Content/_Fonts/OpenSans-Bold-webfont.ttf' from origin 'https://ipfs.io' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://www.visaprepaidprocessing.com/Content/_Fonts/OpenSans-Bold-webfont.ttf
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: https://ipfs.io/ipfs/QmauC8srPszWehe8EAsnJh7ajvoJuZbhikn1AyeQgRiZm4?email=3mail@b.c
Message:
Access to font at 'https://www.visaprepaidprocessing.com/content/PRC384/_Fonts/Connections.ttf' from origin 'https://ipfs.io' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://www.visaprepaidprocessing.com/content/PRC384/_Fonts/Connections.ttf
Message:
Failed to load resource: net::ERR_FAILED

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload