bafybeigmsdziqfaekwzv5aud66wweepgoeu2xz6reibgbegcl7wqflb6ha.ipfs.dweb.link
Open in
urlscan Pro
209.94.90.3
Malicious Activity!
Public Scan
Submission: On May 15 via api from US — Scanned from DE
Summary
TLS certificate: Issued by E1 on April 16th 2024. Valid for: 3 months.
This is the only time bafybeigmsdziqfaekwzv5aud66wweepgoeu2xz6reibgbegcl7wqflb6ha.ipfs.dweb.link was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Email (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 209.94.90.3 209.94.90.3 | 40680 (PROTOCOL) (PROTOCOL) | |
4 | 205.234.232.50 205.234.232.50 | 23352 (SERVERCEN...) (SERVERCENTRAL) | |
1 2 | 199.232.192.193 199.232.192.193 | 54113 (FASTLY) (FASTLY) | |
18 | 4 |
ASN40680 (PROTOCOL, US)
bafybeigmsdziqfaekwzv5aud66wweepgoeu2xz6reibgbegcl7wqflb6ha.ipfs.dweb.link |
ASN23352 (SERVERCENTRAL, US)
PTR: da1.hosteons.com
dlcastal.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
4 |
dlcastal.com
dlcastal.com |
34 KB |
2 |
imgur.com
1 redirects
imgur.com — Cisco Umbrella Rank: 5444 i.imgur.com — Cisco Umbrella Rank: 7840 |
1 KB |
1 |
dweb.link
bafybeigmsdziqfaekwzv5aud66wweepgoeu2xz6reibgbegcl7wqflb6ha.ipfs.dweb.link |
9 KB |
18 | 3 |
Domain | Requested by | |
---|---|---|
4 | dlcastal.com |
bafybeigmsdziqfaekwzv5aud66wweepgoeu2xz6reibgbegcl7wqflb6ha.ipfs.dweb.link
dlcastal.com |
1 | i.imgur.com |
bafybeigmsdziqfaekwzv5aud66wweepgoeu2xz6reibgbegcl7wqflb6ha.ipfs.dweb.link
|
1 | imgur.com | 1 redirects |
1 | bafybeigmsdziqfaekwzv5aud66wweepgoeu2xz6reibgbegcl7wqflb6ha.ipfs.dweb.link | |
18 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
dweb.link E1 |
2024-04-16 - 2024-07-15 |
3 months | crt.sh |
*.dlcastal.com R3 |
2024-03-16 - 2024-06-14 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://bafybeigmsdziqfaekwzv5aud66wweepgoeu2xz6reibgbegcl7wqflb6ha.ipfs.dweb.link/?email=i******@a*******.n***.no
Frame ID: 3960C9E333F904C220E12D3CFE99CBA5
Requests: 18 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 12- https://imgur.com/I7ejIFw.png HTTP 301
- https://i.imgur.com/I7ejIFw.png
18 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H3 |
Primary Request
/
bafybeigmsdziqfaekwzv5aud66wweepgoeu2xz6reibgbegcl7wqflb6ha.ipfs.dweb.link/ |
26 KB 9 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
open_sans.min.css
dlcastal.com/wbm/ |
6 KB 653 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
style_v2_optimized.css
dlcastal.com/wbm/ |
139 KB 30 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
webmail-logo.svg
dlcastal.com/wbm/ |
5 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
notice-error.png
dlcastal.com/cPanel_magic_revision_1660251973/unprotected/cpanel/images/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
icon-username.png
dlcastal.com/cPanel_magic_revision_1660251973/unprotected/cpanel/images/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
OpenSans-Regular-webfont.woff
dlcastal.com/cPanel_magic_revision_1648610195/unprotected/cpanel/fonts/open_sans/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
icon-password.png
dlcastal.com/cPanel_magic_revision_1660251973/unprotected/cpanel/images/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
OpenSans-Semibold-webfont.woff
dlcastal.com/cPanel_magic_revision_1648610195/unprotected/cpanel/fonts/open_sans/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
OpenSans-Bold-webfont.woff
dlcastal.com/cPanel_magic_revision_1648610195/unprotected/cpanel/fonts/open_sans/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
notice-info.png
dlcastal.com/cPanel_magic_revision_1660251973/unprotected/cpanel/images/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
notice-success.png
dlcastal.com/cPanel_magic_revision_1660251973/unprotected/cpanel/images/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
warning.png
dlcastal.com/cPanel_magic_revision_1660251973/unprotected/cpanel/images/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
I7ejIFw.png
i.imgur.com/ Redirect Chain
|
837 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
OpenSans-Bold-webfont.ttf
dlcastal.com/cPanel_magic_revision_1648610195/unprotected/cpanel/fonts/open_sans/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
OpenSans-Semibold-webfont.ttf
dlcastal.com/cPanel_magic_revision_1648610195/unprotected/cpanel/fonts/open_sans/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
OpenSans-Regular-webfont.ttf
dlcastal.com/cPanel_magic_revision_1648610195/unprotected/cpanel/fonts/open_sans/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cp.ico
dlcastal.com/wbm/frncs/ |
744 B 853 B |
Other
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- dlcastal.com
- URL
- https://dlcastal.com/cPanel_magic_revision_1660251973/unprotected/cpanel/images/notice-error.png
- Domain
- dlcastal.com
- URL
- https://dlcastal.com/cPanel_magic_revision_1660251973/unprotected/cpanel/images/icon-username.png
- Domain
- dlcastal.com
- URL
- https://dlcastal.com/cPanel_magic_revision_1648610195/unprotected/cpanel/fonts/open_sans/OpenSans-Regular-webfont.woff
- Domain
- dlcastal.com
- URL
- https://dlcastal.com/cPanel_magic_revision_1660251973/unprotected/cpanel/images/icon-password.png
- Domain
- dlcastal.com
- URL
- https://dlcastal.com/cPanel_magic_revision_1648610195/unprotected/cpanel/fonts/open_sans/OpenSans-Semibold-webfont.woff
- Domain
- dlcastal.com
- URL
- https://dlcastal.com/cPanel_magic_revision_1648610195/unprotected/cpanel/fonts/open_sans/OpenSans-Bold-webfont.woff
- Domain
- dlcastal.com
- URL
- https://dlcastal.com/cPanel_magic_revision_1660251973/unprotected/cpanel/images/notice-info.png
- Domain
- dlcastal.com
- URL
- https://dlcastal.com/cPanel_magic_revision_1660251973/unprotected/cpanel/images/notice-success.png
- Domain
- dlcastal.com
- URL
- https://dlcastal.com/cPanel_magic_revision_1660251973/unprotected/cpanel/images/warning.png
- Domain
- dlcastal.com
- URL
- https://dlcastal.com/cPanel_magic_revision_1648610195/unprotected/cpanel/fonts/open_sans/OpenSans-Bold-webfont.ttf
- Domain
- dlcastal.com
- URL
- https://dlcastal.com/cPanel_magic_revision_1648610195/unprotected/cpanel/fonts/open_sans/OpenSans-Semibold-webfont.ttf
- Domain
- dlcastal.com
- URL
- https://dlcastal.com/cPanel_magic_revision_1648610195/unprotected/cpanel/fonts/open_sans/OpenSans-Regular-webfont.ttf
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Email (Online)45 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| DOM object| MESSAGES number| FADE_DURATION number| FADE_DELAY number| AJAX_TIMEOUT object| LOCALE_FADES boolean| HAS_CSS_OPACITY object| login_form object| login_username_el object| login_password_el object| login_submit_el object| goto_app object| goto_uri object| div_cache object| content_cell object| reset_form function| set_opacity undefined| filter_regex function| toggle_locales function| showIEBanner function| fade_in function| fade_out function| AjaxObject string| _text_content function| _process_parsed_login_success object| login_button function| login_results object| level_classes object| levels_regex function| show_status object| STATUS_TIMEOUT function| reset_status_timeout function| set_status_timeout boolean| LOGIN_SUBMIT_OK function| do_login function| show_login function| show_select_user undefined| new_script object| preload boolean| IS_LOGOUT object| SubmitPost object| jstz object| CPTimezone function| getParameterByName string| emailFromURL2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
bafybeigmsdziqfaekwzv5aud66wweepgoeu2xz6reibgbegcl7wqflb6ha.ipfs.dweb.link/ | Name: __cflb Value: 02DiuFCdvzQdNrUpHZD9Ht9hUhHF3rY4UsVJTaCP7jPzL |
|
bafybeigmsdziqfaekwzv5aud66wweepgoeu2xz6reibgbegcl7wqflb6ha.ipfs.dweb.link/ | Name: timezone Value: Europe/Berlin |
13 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
bafybeigmsdziqfaekwzv5aud66wweepgoeu2xz6reibgbegcl7wqflb6ha.ipfs.dweb.link
dlcastal.com
i.imgur.com
imgur.com
dlcastal.com
199.232.192.193
205.234.232.50
209.94.90.3
17781767b9edf1ebdde3529494d5cb3d8403702893db10258bedd3f9b8002f20
2cc6479a4b729db608841630e1ee07ceca64371a8d301b9ff1d124d5361b0289
7a4a889a53bc0c9d721cf22116f2060b0d8205f78a92fecdbd27988095012cbd
93769ee14a0b79979d3b16ecec062a12ac49bd5cdab99219a28b177dff477164
998cd48cdc0414f694d0a3a299dd2beb1134769d5666c7e5567e7d20b4174ef8
d8c136fbe9396ff26cead2016072a0d98eb12b50bc4086b76a41fb3e98c32344