qiwlr-ayaaa-aaaad-qcxaa-cai.ic0.app Open in urlscan Pro
145.40.68.46  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://qiwlr-ayaaa-aaaad-qcxaa-cai.ic0.app/ Page URL
2. https://qiwlr-ayaaa-aaaad-qcxaa-cai.ic0.app/ Page URL
3. https://qiwlr-ayaaa-aaaad-qcxaa-cai.ic0.app/ Page URL
4. https://qiwlr-ayaaa-aaaad-qcxaa-cai.ic0.app/ Page URL
5. https://qiwlr-ayaaa-aaaad-qcxaa-cai.ic0.app/ Page URL
6. https://qiwlr-ayaaa-aaaad-qcxaa-cai.ic0.app/ Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	/ Show response qiwlr-ayaaa-aaaad-qcxaa-cai.ic0.app/	1022 B 824 B	210ms 14ms	Document text/html	145.40.68.46 PACKET
General Check archive.org Show headers Download Go to Full URL https://qiwlr-ayaaa-aaaad-qcxaa-cai.ic0.app/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 145.40.68.46 Amsterdam, Netherlands, ASN54825 (PACKET, US), Reverse DNS am6-bnm00 Software nginx/1.21.3 / Resource Hash ee3a4d94bb9b2f0d79bc04f71e03f4ebf2d4c34aa89c3a36851a1c9b68ec5b97 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 1; mode=block Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 accept-language nl-NL,nl;q=0.9 Response headers content-encoding gzip content-type text/html date Wed, 29 Jun 2022 12:16:17 GMT etag W/"621fea81-3fe" last-modified Wed, 02 Mar 2022 22:06:57 GMT server nginx/1.21.3 strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff x-frame-options DENY x-xss-protection 1; mode=block
GET H2	200	296-26e345bf062260d8b274.js Show response qiwlr-ayaaa-aaaad-qcxaa-cai.ic0.app/	993 B 1 KB	17ms 16ms	Script application/javascript	145.40.68.46 PACKET
General Check archive.org Show headers Download Go to Full URL https://qiwlr-ayaaa-aaaad-qcxaa-cai.ic0.app/296-26e345bf062260d8b274.js Requested by Host: qiwlr-ayaaa-aaaad-qcxaa-cai.ic0.app URL: https://qiwlr-ayaaa-aaaad-qcxaa-cai.ic0.app/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 145.40.68.46 Amsterdam, Netherlands, ASN54825 (PACKET, US), Reverse DNS am6-bnm00 Software nginx/1.21.3 / Resource Hash c7c6ee78889c1b4938dc716a2b5b9ef4e9e1b20b819eb4d0957589f959c7c5bc Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 1; mode=block Request headers accept-language nl-NL,nl;q=0.9 Referer https://qiwlr-ayaaa-aaaad-qcxaa-cai.ic0.app/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Wed, 29 Jun 2022 12:16:17 GMT x-content-type-options nosniff last-modified Tue, 21 Dec 2021 15:22:10 GMT server nginx/1.21.3 etag "61c1f122-3e1" x-frame-options DENY content-type application/javascript strict-transport-security max-age=31536000; includeSubDomains; preload accept-ranges bytes content-length 993 x-xss-protection 1; mode=block
GET H2	200	/ Show response qiwlr-ayaaa-aaaad-qcxaa-cai.ic0.app/	1022 B 823 B	14ms 14ms	Document text/html	145.40.68.46 PACKET
General Check archive.org Show headers Download Go to Full URL https://qiwlr-ayaaa-aaaad-qcxaa-cai.ic0.app/ Requested by Host: qiwlr-ayaaa-aaaad-qcxaa-cai.ic0.app URL: https://qiwlr-ayaaa-aaaad-qcxaa-cai.ic0.app/296-26e345bf062260d8b274.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 145.40.68.46 Amsterdam, Netherlands, ASN54825 (PACKET, US), Reverse DNS am6-bnm00 Software nginx/1.21.3 / Resource Hash ee3a4d94bb9b2f0d79bc04f71e03f4ebf2d4c34aa89c3a36851a1c9b68ec5b97 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 1; mode=block Request headers Referer https://qiwlr-ayaaa-aaaad-qcxaa-cai.ic0.app/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 accept-language nl-NL,nl;q=0.9 Response headers content-encoding gzip content-type text/html date Wed, 29 Jun 2022 12:16:18 GMT etag W/"621fea81-3fe" last-modified Wed, 02 Mar 2022 22:06:57 GMT server nginx/1.21.3 strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff x-frame-options DENY x-xss-protection 1; mode=block
GET H2	200	296-26e345bf062260d8b274.js Show response qiwlr-ayaaa-aaaad-qcxaa-cai.ic0.app/	993 B 1 KB	15ms 14ms	Script application/javascript	145.40.68.46 PACKET
General Check archive.org Show headers Download Go to Full URL https://qiwlr-ayaaa-aaaad-qcxaa-cai.ic0.app/296-26e345bf062260d8b274.js Requested by Host: qiwlr-ayaaa-aaaad-qcxaa-cai.ic0.app URL: https://qiwlr-ayaaa-aaaad-qcxaa-cai.ic0.app/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 145.40.68.46 Amsterdam, Netherlands, ASN54825 (PACKET, US), Reverse DNS am6-bnm00 Software nginx/1.21.3 / Resource Hash c7c6ee78889c1b4938dc716a2b5b9ef4e9e1b20b819eb4d0957589f959c7c5bc Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 1; mode=block Request headers accept-language nl-NL,nl;q=0.9 Referer https://qiwlr-ayaaa-aaaad-qcxaa-cai.ic0.app/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Wed, 29 Jun 2022 12:16:18 GMT x-content-type-options nosniff last-modified Tue, 21 Dec 2021 15:22:10 GMT server nginx/1.21.3 etag "61c1f122-3e1" x-frame-options DENY content-type application/javascript strict-transport-security max-age=31536000; includeSubDomains; preload accept-ranges bytes content-length 993 x-xss-protection 1; mode=block
GET H2	200	/ Show response qiwlr-ayaaa-aaaad-qcxaa-cai.ic0.app/	1022 B 823 B	13ms 13ms	Document text/html	145.40.68.46 PACKET
General Check archive.org Show headers Download Go to Full URL https://qiwlr-ayaaa-aaaad-qcxaa-cai.ic0.app/ Requested by Host: qiwlr-ayaaa-aaaad-qcxaa-cai.ic0.app URL: https://qiwlr-ayaaa-aaaad-qcxaa-cai.ic0.app/296-26e345bf062260d8b274.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 145.40.68.46 Amsterdam, Netherlands, ASN54825 (PACKET, US), Reverse DNS am6-bnm00 Software nginx/1.21.3 / Resource Hash ee3a4d94bb9b2f0d79bc04f71e03f4ebf2d4c34aa89c3a36851a1c9b68ec5b97 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 1; mode=block Request headers Referer https://qiwlr-ayaaa-aaaad-qcxaa-cai.ic0.app/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 accept-language nl-NL,nl;q=0.9 Response headers content-encoding gzip content-type text/html date Wed, 29 Jun 2022 12:16:18 GMT etag W/"621fea81-3fe" last-modified Wed, 02 Mar 2022 22:06:57 GMT server nginx/1.21.3 strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff x-frame-options DENY x-xss-protection 1; mode=block
GET H2	200	296-26e345bf062260d8b274.js Show response qiwlr-ayaaa-aaaad-qcxaa-cai.ic0.app/	993 B 1 KB	13ms 13ms	Script application/javascript	145.40.68.46 PACKET
General Check archive.org Show headers Download Go to Full URL https://qiwlr-ayaaa-aaaad-qcxaa-cai.ic0.app/296-26e345bf062260d8b274.js Requested by Host: qiwlr-ayaaa-aaaad-qcxaa-cai.ic0.app URL: https://qiwlr-ayaaa-aaaad-qcxaa-cai.ic0.app/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 145.40.68.46 Amsterdam, Netherlands, ASN54825 (PACKET, US), Reverse DNS am6-bnm00 Software nginx/1.21.3 / Resource Hash c7c6ee78889c1b4938dc716a2b5b9ef4e9e1b20b819eb4d0957589f959c7c5bc Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 1; mode=block Request headers accept-language nl-NL,nl;q=0.9 Referer https://qiwlr-ayaaa-aaaad-qcxaa-cai.ic0.app/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Wed, 29 Jun 2022 12:16:18 GMT x-content-type-options nosniff last-modified Tue, 21 Dec 2021 15:22:10 GMT server nginx/1.21.3 etag "61c1f122-3e1" x-frame-options DENY content-type application/javascript strict-transport-security max-age=31536000; includeSubDomains; preload accept-ranges bytes content-length 993 x-xss-protection 1; mode=block
GET H2	200	/ Show response qiwlr-ayaaa-aaaad-qcxaa-cai.ic0.app/	1022 B 823 B	14ms 13ms	Document text/html	145.40.68.46 PACKET
General Check archive.org Show headers Download Go to Full URL https://qiwlr-ayaaa-aaaad-qcxaa-cai.ic0.app/ Requested by Host: qiwlr-ayaaa-aaaad-qcxaa-cai.ic0.app URL: https://qiwlr-ayaaa-aaaad-qcxaa-cai.ic0.app/296-26e345bf062260d8b274.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 145.40.68.46 Amsterdam, Netherlands, ASN54825 (PACKET, US), Reverse DNS am6-bnm00 Software nginx/1.21.3 / Resource Hash ee3a4d94bb9b2f0d79bc04f71e03f4ebf2d4c34aa89c3a36851a1c9b68ec5b97 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 1; mode=block Request headers Referer https://qiwlr-ayaaa-aaaad-qcxaa-cai.ic0.app/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 accept-language nl-NL,nl;q=0.9 Response headers content-encoding gzip content-type text/html date Wed, 29 Jun 2022 12:16:19 GMT etag W/"621fea81-3fe" last-modified Wed, 02 Mar 2022 22:06:57 GMT server nginx/1.21.3 strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff x-frame-options DENY x-xss-protection 1; mode=block
GET H2	200	296-26e345bf062260d8b274.js Show response qiwlr-ayaaa-aaaad-qcxaa-cai.ic0.app/	993 B 1 KB	14ms 13ms	Script application/javascript	145.40.68.46 PACKET
General Check archive.org Show headers Download Go to Full URL https://qiwlr-ayaaa-aaaad-qcxaa-cai.ic0.app/296-26e345bf062260d8b274.js Requested by Host: qiwlr-ayaaa-aaaad-qcxaa-cai.ic0.app URL: https://qiwlr-ayaaa-aaaad-qcxaa-cai.ic0.app/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 145.40.68.46 Amsterdam, Netherlands, ASN54825 (PACKET, US), Reverse DNS am6-bnm00 Software nginx/1.21.3 / Resource Hash c7c6ee78889c1b4938dc716a2b5b9ef4e9e1b20b819eb4d0957589f959c7c5bc Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 1; mode=block Request headers accept-language nl-NL,nl;q=0.9 Referer https://qiwlr-ayaaa-aaaad-qcxaa-cai.ic0.app/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Wed, 29 Jun 2022 12:16:19 GMT x-content-type-options nosniff last-modified Tue, 21 Dec 2021 15:22:10 GMT server nginx/1.21.3 etag "61c1f122-3e1" x-frame-options DENY content-type application/javascript strict-transport-security max-age=31536000; includeSubDomains; preload accept-ranges bytes content-length 993 x-xss-protection 1; mode=block
GET H2	200	/ Show response qiwlr-ayaaa-aaaad-qcxaa-cai.ic0.app/	1022 B 823 B	14ms 13ms	Document text/html	145.40.68.46 PACKET
General Check archive.org Show headers Download Go to Full URL https://qiwlr-ayaaa-aaaad-qcxaa-cai.ic0.app/ Requested by Host: qiwlr-ayaaa-aaaad-qcxaa-cai.ic0.app URL: https://qiwlr-ayaaa-aaaad-qcxaa-cai.ic0.app/296-26e345bf062260d8b274.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 145.40.68.46 Amsterdam, Netherlands, ASN54825 (PACKET, US), Reverse DNS am6-bnm00 Software nginx/1.21.3 / Resource Hash ee3a4d94bb9b2f0d79bc04f71e03f4ebf2d4c34aa89c3a36851a1c9b68ec5b97 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 1; mode=block Request headers Referer https://qiwlr-ayaaa-aaaad-qcxaa-cai.ic0.app/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 accept-language nl-NL,nl;q=0.9 Response headers content-encoding gzip content-type text/html date Wed, 29 Jun 2022 12:16:20 GMT etag W/"621fea81-3fe" last-modified Wed, 02 Mar 2022 22:06:57 GMT server nginx/1.21.3 strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff x-frame-options DENY x-xss-protection 1; mode=block
GET H2	200	296-26e345bf062260d8b274.js Show response qiwlr-ayaaa-aaaad-qcxaa-cai.ic0.app/	993 B 1 KB	15ms 15ms	Script application/javascript	145.40.68.46 PACKET
General Check archive.org Show headers Download Go to Full URL https://qiwlr-ayaaa-aaaad-qcxaa-cai.ic0.app/296-26e345bf062260d8b274.js Requested by Host: qiwlr-ayaaa-aaaad-qcxaa-cai.ic0.app URL: https://qiwlr-ayaaa-aaaad-qcxaa-cai.ic0.app/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 145.40.68.46 Amsterdam, Netherlands, ASN54825 (PACKET, US), Reverse DNS am6-bnm00 Software nginx/1.21.3 / Resource Hash c7c6ee78889c1b4938dc716a2b5b9ef4e9e1b20b819eb4d0957589f959c7c5bc Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 1; mode=block Request headers accept-language nl-NL,nl;q=0.9 Referer https://qiwlr-ayaaa-aaaad-qcxaa-cai.ic0.app/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Wed, 29 Jun 2022 12:16:20 GMT x-content-type-options nosniff last-modified Tue, 21 Dec 2021 15:22:10 GMT server nginx/1.21.3 etag "61c1f122-3e1" x-frame-options DENY content-type application/javascript strict-transport-security max-age=31536000; includeSubDomains; preload accept-ranges bytes content-length 993 x-xss-protection 1; mode=block
GET H2	200	Primary Request / Show response qiwlr-ayaaa-aaaad-qcxaa-cai.ic0.app/	1022 B 823 B	14ms 13ms	Document text/html	145.40.68.46 PACKET
General Check archive.org Show headers Download Go to Full URL https://qiwlr-ayaaa-aaaad-qcxaa-cai.ic0.app/ Requested by Host: qiwlr-ayaaa-aaaad-qcxaa-cai.ic0.app URL: https://qiwlr-ayaaa-aaaad-qcxaa-cai.ic0.app/296-26e345bf062260d8b274.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 145.40.68.46 Amsterdam, Netherlands, ASN54825 (PACKET, US), Reverse DNS am6-bnm00 Software nginx/1.21.3 / Resource Hash ee3a4d94bb9b2f0d79bc04f71e03f4ebf2d4c34aa89c3a36851a1c9b68ec5b97 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 1; mode=block Request headers Referer https://qiwlr-ayaaa-aaaad-qcxaa-cai.ic0.app/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 accept-language nl-NL,nl;q=0.9 Response headers content-encoding gzip content-type text/html date Wed, 29 Jun 2022 12:16:21 GMT etag W/"621fea81-3fe" last-modified Wed, 02 Mar 2022 22:06:57 GMT server nginx/1.21.3 strict-transport-security max-age=31536000; includeSubDomains; preload x-content-type-options nosniff x-frame-options DENY x-xss-protection 1; mode=block
GET H2	200	296-26e345bf062260d8b274.js Show response qiwlr-ayaaa-aaaad-qcxaa-cai.ic0.app/	993 B 1 KB	14ms 14ms	Script application/javascript	145.40.68.46 PACKET
General Check archive.org Show headers Download Go to Full URL https://qiwlr-ayaaa-aaaad-qcxaa-cai.ic0.app/296-26e345bf062260d8b274.js Requested by Host: qiwlr-ayaaa-aaaad-qcxaa-cai.ic0.app URL: https://qiwlr-ayaaa-aaaad-qcxaa-cai.ic0.app/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 145.40.68.46 Amsterdam, Netherlands, ASN54825 (PACKET, US), Reverse DNS am6-bnm00 Software nginx/1.21.3 / Resource Hash c7c6ee78889c1b4938dc716a2b5b9ef4e9e1b20b819eb4d0957589f959c7c5bc Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 1; mode=block Request headers accept-language nl-NL,nl;q=0.9 Referer https://qiwlr-ayaaa-aaaad-qcxaa-cai.ic0.app/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers date Wed, 29 Jun 2022 12:16:21 GMT x-content-type-options nosniff last-modified Tue, 21 Dec 2021 15:22:10 GMT server nginx/1.21.3 etag "61c1f122-3e1" x-frame-options DENY content-type application/javascript strict-transport-security max-age=31536000; includeSubDomains; preload accept-ranges bytes content-length 993 x-xss-protection 1; mode=block

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic (Online)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

qiwlr-ayaaa-aaaad-qcxaa-cai.ic0.app
145.40.68.46
c7c6ee78889c1b4938dc716a2b5b9ef4e9e1b20b819eb4d0957589f959c7c5bc
ee3a4d94bb9b2f0d79bc04f71e03f4ebf2d4c34aa89c3a36851a1c9b68ec5b97