bafkreidu36lcewqv4zhhndf5wwlvupaugfxu5io3kle6vamg45nfgliapm.ipfs.dweb.link Open in urlscan Pro
209.94.90.3 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://bafkreidu36lcewqv4zhhndf5wwlvupaugfxu5io3kle6vamg45nfgliapm.ipfs.dweb.link/
Submission: On October 09 via api (October 9th 2024, 11:30:48 pm UTC) from CA — Scanned from CA

Summary HTTP 9 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 1 countries across 2 domains to perform 9 HTTP transactions. The main IP is 209.94.90.3, located in United States and belongs to PROTOCOL, US. The main domain is bafkreidu36lcewqv4zhhndf5wwlvupaugfxu5io3kle6vamg45nfgliapm.ipfs.dweb.link.
TLS certificate: Issued by E5 on August 12th 2024. Valid for: 3 months.

This is the only time bafkreidu36lcewqv4zhhndf5wwlvupaugfxu5io3kle6vamg45nfgliapm.ipfs.dweb.link was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: WeTransfer (Online)

Domain & IP information

	IP Address	AS Autonomous System
2	209.94.90.3 209.94.90.3	40680 (PROTOCOL) (PROTOCOL)
5	2606:4700:310... 2606:4700:310c::ac42:2edd	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	172.66.44.161 172.66.44.161	13335 (CLOUDFLAR...) (CLOUDFLARENET)
9	4

2 209.94.90.3 (United States)

ASN40680 (PROTOCOL, US)

bafkreidu36lcewqv4zhhndf5wwlvupaugfxu5io3kle6vamg45nfgliapm.ipfs.dweb.link	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2606:4700:310c::ac42:2edd (United States)

ASN13335 (CLOUDFLARENET, US)

cc-3ek.pages.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.66.44.161 (United States)

ASN13335 (CLOUDFLARENET, US)

thv-2hp.pages.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	pages.dev cc-3ek.pages.dev thv-2hp.pages.dev	1002 KB
2	dweb.link bafkreidu36lcewqv4zhhndf5wwlvupaugfxu5io3kle6vamg45nfgliapm.ipfs.dweb.link	66 KB
9	2

	Domain	Requested by
5	cc-3ek.pages.dev	bafkreidu36lcewqv4zhhndf5wwlvupaugfxu5io3kle6vamg45nfgliapm.ipfs.dweb.link
2	thv-2hp.pages.dev	bafkreidu36lcewqv4zhhndf5wwlvupaugfxu5io3kle6vamg45nfgliapm.ipfs.dweb.link
2	bafkreidu36lcewqv4zhhndf5wwlvupaugfxu5io3kle6vamg45nfgliapm.ipfs.dweb.link
9	3

This site contains no links.

Subject Issuer	Validity	Valid
dweb.link E5	`2024-08-12` - `2024-11-10`	3 months	crt.sh
cc-3ek.pages.dev WE1	`2024-10-06` - `2025-01-04`	3 months	crt.sh
thv-2hp.pages.dev WE1	`2024-10-06` - `2025-01-04`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://bafkreidu36lcewqv4zhhndf5wwlvupaugfxu5io3kle6vamg45nfgliapm.ipfs.dweb.link/
Frame ID: A0CF914F1693A465E006A1D4F8947F25
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

WeTransferaccount | WeTransfer

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

9
Requests

100 %
HTTPS

33 %
IPv6

2
Domains

3
Subdomains

4
IPs

1
Countries

1068 kB
Transfer

1443 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
3 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3 200 Primary Request / Show response
bafkreidu36lcewqv4zhhndf5wwlvupaugfxu5io3kle6vamg45nfgliapm.ipfs.dweb.link/ 310 KB
65 KB 89ms
46ms Document
text/html 209.94.90.3
PROTOCOL

General

Check archive.org

Show headers Download Go to

Full URL: https://bafkreidu36lcewqv4zhhndf5wwlvupaugfxu5io3kle6vamg45nfgliapm.ipfs.dweb.link/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 209.94.90.3 , United States, ASN40680 (PROTOCOL, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 74df96225a15e64e768cbdb5975a3c14316f4ea1db52c9ea8186e75a532d007b

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Content-Type Range User-Agent X-Requested-With
access-control-allow-methods: GET HEAD OPTIONS
access-control-allow-origin: *
access-control-expose-headers: Content-Length Content-Range X-Chunked-Output X-Ipfs-Path X-Ipfs-Roots X-Stream-Output
age: 39252
alt-svc: h3=":443"; ma=86400
cache-control: public, max-age=29030400, immutable
cf-cache-status: HIT
cf-ray: 8d0228faee5736ff-YYZ
content-encoding: br
content-type: text/html
date: Wed, 09 Oct 2024 23:30:43 GMT
server: cloudflare
vary: Accept-Encoding
x-ipfs-path: /ipfs/bafkreidu36lcewqv4zhhndf5wwlvupaugfxu5io3kle6vamg45nfgliapm/
x-ipfs-pop: rainbow-dc13-02
x-ipfs-roots: bafkreidu36lcewqv4zhhndf5wwlvupaugfxu5io3kle6vamg45nfgliapm

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1f39a1017906d512934d04cef8dbd816ebe0206eab872da92d30fdb554c84a89

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/svg+xml

GET
H2 200 bg.png
cc-3ek.pages.dev/ 783 KB
784 KB 317ms
254ms Image
image/png 2606:4700:310c::ac42:2edd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cc-3ek.pages.dev/bg.png

Requested by

Host: bafkreidu36lcewqv4zhhndf5wwlvupaugfxu5io3kle6vamg45nfgliapm.ipfs.dweb.link
URL: https://bafkreidu36lcewqv4zhhndf5wwlvupaugfxu5io3kle6vamg45nfgliapm.ipfs.dweb.link/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:310c::ac42:2edd , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

97915ef3518cf57623d185b62663441724cc9afdd8927518e45c36cffc84be2f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://bafkreidu36lcewqv4zhhndf5wwlvupaugfxu5io3kle6vamg45nfgliapm.ipfs.dweb.link/

Response headers

cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
etag: "2cfd5689dca667351388f92ec5d22b6e"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VQM1ZFPPGZ7j9DiK5wValzaKfiXdCTbdDpcKlUlolwTiCWqNi1GsJ%2FFXPt9jkJ3z6LwzRYTcIMxYbHnUU%2FPMA9G2cJKjDX04LsN02yauW5tUHhAEC1%2BReiaUXnoSboUQdbND57SQRcchk5fUpOuy"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8d0228fbecfba31a-YUL
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
content-length: 801710
date: Wed, 09 Oct 2024 23:30:43 GMT
content-type: image/png
vary: Accept-Encoding
server: cloudflare

GET
DATA 200
OK truncated
/ 4 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7b18f49b87cf2ce19da6e9ddff3b99cdbb7d79baaddc3911a2d9b5ca74538994

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/svg+xml

GET
H3 200 jquery.min.js Show response
thv-2hp.pages.dev/ 164 KB
40 KB 104ms
46ms Script
text/javascript 172.66.44.161
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://thv-2hp.pages.dev/jquery.min.js

Requested by

Host: bafkreidu36lcewqv4zhhndf5wwlvupaugfxu5io3kle6vamg45nfgliapm.ipfs.dweb.link
URL: https://bafkreidu36lcewqv4zhhndf5wwlvupaugfxu5io3kle6vamg45nfgliapm.ipfs.dweb.link/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.66.44.161 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

562892609732b7374aa3c5f488b555236db7a26a8f73c16624407fad46d946f8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://bafkreidu36lcewqv4zhhndf5wwlvupaugfxu5io3kle6vamg45nfgliapm.ipfs.dweb.link/

Response headers

cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
etag: W/"529a27b025e86819529a36abf159162d"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ug3M%2Br%2BLheW6LkpHWyuIL7UaMBb%2F9cMIEo1Rxs33%2BZ%2FpNArlmgc2GEC%2BUY5N3lcysFgMaNpVK4%2Far0brCYxJpAR%2FgvHpyTbrs8ACNHCvHPkDOiAUmh%2FhQQ%2Bir%2BF%2FlinfXjtyDA%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8d0228fbeb5a36a6-YYZ
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
date: Wed, 09 Oct 2024 23:30:43 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
server: cloudflare

GET
H3 200 script.min.js Show response
thv-2hp.pages.dev/ 6 KB
3 KB 101ms
45ms Script
text/javascript 172.66.44.161
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://thv-2hp.pages.dev/script.min.js

Requested by

Host: bafkreidu36lcewqv4zhhndf5wwlvupaugfxu5io3kle6vamg45nfgliapm.ipfs.dweb.link
URL: https://bafkreidu36lcewqv4zhhndf5wwlvupaugfxu5io3kle6vamg45nfgliapm.ipfs.dweb.link/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.66.44.161 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e32bab6ec0831dfdae1996567cbefe6f8c9668d302b660555f89982d07e1c397

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://bafkreidu36lcewqv4zhhndf5wwlvupaugfxu5io3kle6vamg45nfgliapm.ipfs.dweb.link/

Response headers

cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
etag: W/"fb338908fe4f964e837e0b08dd5c72b5"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eJhzwsomkoY378O12WUMkMkNwPE2S6uLLM2aI8DkBm0NLvBKRCrV1f8aOW1JuVYTrX3I6vmiQ%2BxUHQKkVqi2wW9K8y9VKPT%2Fv4DzXYqf8g9Ws0WW%2BtSNVrFl1SkdcXSGzmfZbg%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8d0228fbeb5936a6-YYZ
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
date: Wed, 09 Oct 2024 23:30:43 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
server: cloudflare

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6dbba1863bcfe251266f22a6c3b047f788a4851623c58c7b6b750809f0885dad

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/svg+xml

GET
H2 200 GT-Super-Display-Light.woff
cc-3ek.pages.dev/ 54 KB
55 KB 252ms
210ms Font
application/font-woff 2606:4700:310c::ac42:2edd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cc-3ek.pages.dev/GT-Super-Display-Light.woff

Requested by

Host: bafkreidu36lcewqv4zhhndf5wwlvupaugfxu5io3kle6vamg45nfgliapm.ipfs.dweb.link
URL: https://bafkreidu36lcewqv4zhhndf5wwlvupaugfxu5io3kle6vamg45nfgliapm.ipfs.dweb.link/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:310c::ac42:2edd , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

62e704e04089cc468b4bfdd61705d93959532d630e88de5ecef6064ebfd9d29e

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://bafkreidu36lcewqv4zhhndf5wwlvupaugfxu5io3kle6vamg45nfgliapm.ipfs.dweb.link
Referer: https://bafkreidu36lcewqv4zhhndf5wwlvupaugfxu5io3kle6vamg45nfgliapm.ipfs.dweb.link/

Response headers

cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
etag: W/"6a491dee078a89c780b38ee790f48a41"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Wmofq5he8J1xle3cAy0c3C4pogwvB2vRh3HcJz7F0nBTvTBKHPIALYZl3RDVv%2FOrLYaiMk5iwqHFDQTjnkLgk55RjYZIpKj10pWrEe%2B2i3XNO7SsCv5Lc8AUAtSKfSY7ANIrNgl2K35sjReIZcxY"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8d0228fbea85a2d8-YUL
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
date: Wed, 09 Oct 2024 23:30:43 GMT
content-type: application/font-woff
vary: Accept-Encoding
server: cloudflare

GET
H2 200 GT-Super-Display-Bold.woff
cc-3ek.pages.dev/ 58 KB
58 KB 256ms
214ms Font
application/font-woff 2606:4700:310c::ac42:2edd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cc-3ek.pages.dev/GT-Super-Display-Bold.woff

Requested by

Host: bafkreidu36lcewqv4zhhndf5wwlvupaugfxu5io3kle6vamg45nfgliapm.ipfs.dweb.link
URL: https://bafkreidu36lcewqv4zhhndf5wwlvupaugfxu5io3kle6vamg45nfgliapm.ipfs.dweb.link/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:310c::ac42:2edd , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b6046a8f13361f175a3717ef126c0d566f845a69ab36d997f33ed5397fdeb847

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://bafkreidu36lcewqv4zhhndf5wwlvupaugfxu5io3kle6vamg45nfgliapm.ipfs.dweb.link
Referer: https://bafkreidu36lcewqv4zhhndf5wwlvupaugfxu5io3kle6vamg45nfgliapm.ipfs.dweb.link/

Response headers

cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
etag: W/"ee15bd1ec4e070e78b7e92dae24de48d"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=I6Qp1%2FrkBrfQrTTniAyEvyBmJ9XqkrvD0hQkl1MSMHN9FrYV4IG9uwQS67I45QgvFSVh0cohIH2IIdHMiZAKg6fheKvKTwIStARGeD13%2FH89mCOV177qDinHP3ti8jLLBWDrwC4pGRa6d6dnuiW0"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8d0228fbea87a2d8-YUL
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
date: Wed, 09 Oct 2024 23:30:43 GMT
content-type: application/font-woff
vary: Accept-Encoding
server: cloudflare

GET
H2 200 ActiefGrotesque-Regular.woff
cc-3ek.pages.dev/ 30 KB
31 KB 238ms
197ms Font
application/font-woff 2606:4700:310c::ac42:2edd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cc-3ek.pages.dev/ActiefGrotesque-Regular.woff

Requested by

Host: bafkreidu36lcewqv4zhhndf5wwlvupaugfxu5io3kle6vamg45nfgliapm.ipfs.dweb.link
URL: https://bafkreidu36lcewqv4zhhndf5wwlvupaugfxu5io3kle6vamg45nfgliapm.ipfs.dweb.link/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:310c::ac42:2edd , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

eaddc3fb78d635f6abe0194b732e54a2fb4fc0c71669b50c98b02ac36feb813d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://bafkreidu36lcewqv4zhhndf5wwlvupaugfxu5io3kle6vamg45nfgliapm.ipfs.dweb.link
Referer: https://bafkreidu36lcewqv4zhhndf5wwlvupaugfxu5io3kle6vamg45nfgliapm.ipfs.dweb.link/

Response headers

cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
etag: W/"29ab82d0741efea564b3cfd506a37b72"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gSKkDKrtPfVnVu2TAhUJ8WrN%2BqHUptylnLVKd%2Bs8zU%2FBjJc7fShEQ4Yscr%2Ff32ViEbETd%2B3h8Z8C0l0EtsFn8YAS3hSmMPgw4rPYMSPpYQRpyKHvOXQSpTfEPw3836lQ2S61l0Ce2%2Bwme%2FaCYDF7"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8d0228fbfa88a2d8-YUL
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
date: Wed, 09 Oct 2024 23:30:43 GMT
content-type: application/font-woff
vary: Accept-Encoding
server: cloudflare

GET
H2 200 ActiefGrotesque-Medium.woff
cc-3ek.pages.dev/ 31 KB
32 KB 235ms
194ms Font
application/font-woff 2606:4700:310c::ac42:2edd
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cc-3ek.pages.dev/ActiefGrotesque-Medium.woff

Requested by

Host: bafkreidu36lcewqv4zhhndf5wwlvupaugfxu5io3kle6vamg45nfgliapm.ipfs.dweb.link
URL: https://bafkreidu36lcewqv4zhhndf5wwlvupaugfxu5io3kle6vamg45nfgliapm.ipfs.dweb.link/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:310c::ac42:2edd , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d88b3d358e709fc9e7691fd77af0bcad9d5c8fbe1f408259fe21de34dff97e27

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://bafkreidu36lcewqv4zhhndf5wwlvupaugfxu5io3kle6vamg45nfgliapm.ipfs.dweb.link
Referer: https://bafkreidu36lcewqv4zhhndf5wwlvupaugfxu5io3kle6vamg45nfgliapm.ipfs.dweb.link/

Response headers

cache-control: public, max-age=0, must-revalidate
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
etag: W/"839ff00046664abd76f6038ebc537e9a"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nD9o2Qu4jKTM%2F%2FdlsP9HdjrSSd4wUiRDcN4U2HEgv7koZkZwOqd9ioYCuCrVPUNR5Qj4amVo8vT%2BJqfH9CMW3gnDFLOWOqS13HFl47pD3c8ePkgLDkVVuvsH7ioTb8GQlmSRBBxVxYc13vxhrUC%2F"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8d0228fbfa8aa2d8-YUL
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
date: Wed, 09 Oct 2024 23:30:43 GMT
content-type: application/font-woff
vary: Accept-Encoding
server: cloudflare

GET
H3 404 favicon.ico
bafkreidu36lcewqv4zhhndf5wwlvupaugfxu5io3kle6vamg45nfgliapm.ipfs.dweb.link/assets/ 193 B
603 B 91ms
91ms Other
text/plain 209.94.90.3
PROTOCOL

General

Check archive.org

Show headers Download Go to

Full URL

https://bafkreidu36lcewqv4zhhndf5wwlvupaugfxu5io3kle6vamg45nfgliapm.ipfs.dweb.link/assets/favicon.ico

Protocol

Security

QUIC, , AES_128_GCM

Server

209.94.90.3 , United States, ASN40680 (PROTOCOL, US),

Reverse DNS

Software

cloudflare /

Resource Hash

390975c74f35657175c15290f20fe265a5a1c14fd030eb9ca15e861939b337bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://bafkreidu36lcewqv4zhhndf5wwlvupaugfxu5io3kle6vamg45nfgliapm.ipfs.dweb.link/

Response headers

access-control-expose-headers: Content-Length, Content-Range, X-Chunked-Output, X-Ipfs-Path, X-Ipfs-Roots, X-Stream-Output
content-encoding: br
x-ipfs-path: /ipfs/bafkreidu36lcewqv4zhhndf5wwlvupaugfxu5io3kle6vamg45nfgliapm/assets/favicon.ico
cf-cache-status: EXPIRED
x-content-type-options: nosniff
access-control-allow-methods: GET, HEAD, OPTIONS
cf-ray: 8d0228fe5b3a36ff-YYZ
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
date: Wed, 09 Oct 2024 23:30:43 GMT
content-type: text/plain; charset=utf-8
x-ipfs-pop: rainbow-dc13-04
vary: Accept-Encoding
server: cloudflare
access-control-allow-headers: Content-Type, Range, User-Agent, X-Requested-With

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: WeTransfer (Online)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			bafkreidu36lcewqv4zhhndf5wwlvupaugfxu5io3kle6vamg45nfgliapm.ipfs.dweb.link/	1970-01-21 00:09:59	Name: __cflb Value: 02DiuCwt9N2Y11sxHBMptC2H6qQZQdc3smfGe4E3CKTpx

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://bafkreidu36lcewqv4zhhndf5wwlvupaugfxu5io3kle6vamg45nfgliapm.ipfs.dweb.link/assets/favicon.ico Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bafkreidu36lcewqv4zhhndf5wwlvupaugfxu5io3kle6vamg45nfgliapm.ipfs.dweb.link
cc-3ek.pages.dev
thv-2hp.pages.dev
172.66.44.161
209.94.90.3
2606:4700:310c::ac42:2edd
1f39a1017906d512934d04cef8dbd816ebe0206eab872da92d30fdb554c84a89
390975c74f35657175c15290f20fe265a5a1c14fd030eb9ca15e861939b337bc
562892609732b7374aa3c5f488b555236db7a26a8f73c16624407fad46d946f8
62e704e04089cc468b4bfdd61705d93959532d630e88de5ecef6064ebfd9d29e
6dbba1863bcfe251266f22a6c3b047f788a4851623c58c7b6b750809f0885dad
74df96225a15e64e768cbdb5975a3c14316f4ea1db52c9ea8186e75a532d007b
7b18f49b87cf2ce19da6e9ddff3b99cdbb7d79baaddc3911a2d9b5ca74538994
97915ef3518cf57623d185b62663441724cc9afdd8927518e45c36cffc84be2f
b6046a8f13361f175a3717ef126c0d566f845a69ab36d997f33ed5397fdeb847
d88b3d358e709fc9e7691fd77af0bcad9d5c8fbe1f408259fe21de34dff97e27
e32bab6ec0831dfdae1996567cbefe6f8c9668d302b660555f89982d07e1c397
eaddc3fb78d635f6abe0194b732e54a2fb4fc0c71669b50c98b02ac36feb813d

bafkreidu36lcewqv4zhhndf5wwlvupaugfxu5io3kle6vamg45nfgliapm.ipfs.dweb.link Open in urlscan Pro 209.94.90.3 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

9 Requests

100 %HTTPS

33 %IPv6

2 Domains

3 Subdomains

4 IPs

1 Countries

1068 kBTransfer

1443 kBSize

1 Cookies

0 Outgoing links

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 3 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

1 Cookies

1 Console Messages

Indicators

bafkreidu36lcewqv4zhhndf5wwlvupaugfxu5io3kle6vamg45nfgliapm.ipfs.dweb.link Open in urlscan Pro
209.94.90.3 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

100 %
HTTPS

33 %
IPv6

2
Domains

3
Subdomains

4
IPs

1
Countries

1068 kB
Transfer

1443 kB
Size

1
Cookies

9 HTTP transactions
3 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!