ipfs.io Open in urlscan Pro
209.94.90.1 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://zuskl.net/?id=google.auth.Adfjguirojs==Jh7dbwJ12io3d4dotQS5MZWhta3VobEBGVVNBLmRl
Effective URL:
https://ipfs.io/ipfs/bafybeihjdvbty64ynejtt3jl4vxsd5drovhowujfc26ah2z4clcps6tzeu/qgb5z.html
Submission: On November 11 via manual (November 11th 2024, 2:43:12 pm UTC) from DE — Scanned from CA

Summary HTTP 15 Redirects Behaviour Indicators

Summary

This website contacted 11 IPs in 2 countries across 12 domains to perform 15 HTTP transactions. The main IP is 209.94.90.1, located in United States and belongs to PROTOCOL, US. The main domain is ipfs.io. The Cisco Umbrella rank of the primary domain is 122139.
TLS certificate: Issued by WE1 on October 11th 2024. Valid for: 3 months.

This is the only time ipfs.io was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Email (Online)

Domain & IP information

	IP Address	AS Autonomous System
2	74.50.80.103 74.50.80.103	19318 (IS-AS-1) (IS-AS-1)
1	2607:f1c0:100... 2607:f1c0:100f:f000::2c3	8560 (IONOS-AS ...) (IONOS-AS This is the joint network for IONOS)
1	209.94.90.1 209.94.90.1	40680 (PROTOCOL) (PROTOCOL)
3	104.18.10.207 104.18.10.207	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2607:f8b0:400... 2607:f8b0:4006:81e::200a	15169 (GOOGLE) (GOOGLE)
1 1	3.168.73.12 3.168.73.12	16509 (AMAZON-02) (AMAZON-02)
1	18.238.55.29 18.238.55.29	16509 (AMAZON-02) (AMAZON-02)
1	2a04:4e42:200... 2a04:4e42:200::649	54113 (FASTLY) (FASTLY)
1	104.17.25.14 104.17.25.14	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2607:f8b0:400... 2607:f8b0:4006:822::200a	15169 (GOOGLE) (GOOGLE)
1	2a04:4e42:200... 2a04:4e42:200::485	54113 (FASTLY) (FASTLY)
15	11

2 74.50.80.103 (United States)

ASN19318 (IS-AS-1, US)

zuskl.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f1c0:100f:f000::2c3 (United States)

ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE)

www.superiorlawncareusa.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 209.94.90.1 (United States)

ASN40680 (PROTOCOL, US)

ipfs.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.18.10.207 (None, )

ASN13335 (CLOUDFLARENET, US)

stackpath.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
maxcdn.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:81e::200a (United States)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.168.73.12 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: server-3-168-73-12.jfk50.r.cloudfront.net

cdn.glitch.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.238.55.29 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-238-55-29.jfk52.r.cloudfront.net

cdn.glitch.me	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:200::649 (United States)

ASN54113 (FASTLY, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.17.25.14 (None, )

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:822::200a (United States)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:200::485 (United States)

ASN54113 (FASTLY, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	bootstrapcdn.com stackpath.bootstrapcdn.com — Cisco Umbrella Rank: 3270 maxcdn.bootstrapcdn.com — Cisco Umbrella Rank: 1113	57 KB
2	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 30 ajax.googleapis.com — Cisco Umbrella Rank: 412	31 KB
2	zuskl.net zuskl.net	1 KB
1	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 311	1 KB
1	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 220	7 KB
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 791	24 KB
1	glitch.me cdn.glitch.me — Cisco Umbrella Rank: 89351	8 KB
1	glitch.com 1 redirects cdn.glitch.com — Cisco Umbrella Rank: 98333	446 B
1	ipfs.io ipfs.io — Cisco Umbrella Rank: 122139	7 KB
1	superiorlawncareusa.com www.superiorlawncareusa.com	137 KB
0	clearbit.com Failed logo.clearbit.com Failed
0	fusa.de Failed fusa.de Failed
15	12

	Domain	Requested by
2	stackpath.bootstrapcdn.com	ipfs.io
2	zuskl.net
1	cdn.jsdelivr.net	ipfs.io
1	ajax.googleapis.com	ipfs.io
1	maxcdn.bootstrapcdn.com	ipfs.io
1	cdnjs.cloudflare.com	ipfs.io
1	code.jquery.com	ipfs.io
1	cdn.glitch.me	ipfs.io
1	cdn.glitch.com	1 redirects
1	fonts.googleapis.com	ipfs.io
1	ipfs.io
1	www.superiorlawncareusa.com	zuskl.net
0	logo.clearbit.com Failed	ipfs.io
0	fusa.de Failed	ajax.googleapis.com
15	14

This site contains no links.

Subject Issuer	Validity	Valid
zuskl.net E5	`2024-11-10` - `2025-02-08`	3 months	crt.sh
*.superiorlawncareusa.com Sectigo RSA Domain Validation Secure Server CA	`2024-10-05` - `2025-10-19`	a year	crt.sh
ipfs.io WE1	`2024-10-11` - `2025-01-09`	3 months	crt.sh
bootstrapcdn.com WE1	`2024-09-20` - `2024-12-19`	3 months	crt.sh
upload.video.google.com WR2	`2024-10-07` - `2024-12-30`	3 months	crt.sh
*.jquery.com Sectigo ECC Domain Validation Secure Server CA	`2024-06-25` - `2025-06-25`	a year	crt.sh
cdnjs.cloudflare.com WE1	`2024-09-28` - `2024-12-27`	3 months	crt.sh
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2024 Q3	`2024-07-30` - `2025-08-31`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://ipfs.io/ipfs/bafybeihjdvbty64ynejtt3jl4vxsd5drovhowujfc26ah2z4clcps6tzeu/qgb5z.html
Frame ID: 29E0A1F69B11C1E1F08F867E08B32872
Requests: 15 HTTP requests in this frame

Frame: https://fusa.de/
Frame ID: A816CF19C82BF254C05F05545D261FE5
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Sign-in

Page URL History Show full URLs

https://zuskl.net/?id=google.auth.Adfjguirojs==Jh7dbwJ12io3d4dotQS5MZWhta3VobEBGVVNBLmRl Page URL
https://ipfs.io/ipfs/bafybeihjdvbty64ynejtt3jl4vxsd5drovhowujfc26ah2z4clcps6tzeu/qgb5z.html Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Popper (Miscellaneous) Expand

Overall confidence: 100%
Detected patterns

<script [^>]*src="[^"]*/popper\.js/([0-9.]+)
/popper\.js/([0-9.]+)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

//cdn\.jsdelivr\.net/

Page Statistics

15
Requests

80 %
HTTPS

45 %
IPv6

12
Domains

14
Subdomains

11
IPs

2
Countries

273 kB
Transfer

588 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://zuskl.net/?id=google.auth.Adfjguirojs==Jh7dbwJ12io3d4dotQS5MZWhta3VobEBGVVNBLmRl Page URL
https://ipfs.io/ipfs/bafybeihjdvbty64ynejtt3jl4vxsd5drovhowujfc26ah2z4clcps6tzeu/qgb5z.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 5

https://cdn.glitch.com/e4905575-fbae-45d8-bc6c-e33b4a167082%2Fajax-loader35fd.gif?v=1617145491470 HTTP 301
https://cdn.glitch.me/e4905575-fbae-45d8-bc6c-e33b4a167082%2Fajax-loader35fd.gif

15 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 / Show response
zuskl.net/ 562 B
708 B 124ms
36ms Document
text/html 74.50.80.103
IS-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://zuskl.net/?id=google.auth.Adfjguirojs==Jh7dbwJ12io3d4dotQS5MZWhta3VobEBGVVNBLmRl
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 74.50.80.103 , United States, ASN19318 (IS-AS-1, US),
Reverse DNS
Software: LiteSpeed /
Resource Hash: 10013a6304760c0263572d715cb0a61b92fc229a4637a2ba854a264ea5b40854

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-encoding: gzip
content-length: 375
content-type: text/html; charset=UTF-8
date: Mon, 11 Nov 2024 14:43:08 GMT
refresh: 3; https://ipfs.io/ipfs/bafybeihjdvbty64ynejtt3jl4vxsd5drovhowujfc26ah2z4clcps6tzeu/qgb5z.html#A.Lehmkuhl@FUSA.de
server: LiteSpeed
vary: Accept-Encoding

GET
H2 200 loading-gif-png-5.gif
www.superiorlawncareusa.com/wp-content/uploads/2020/05/ 136 KB
137 KB 175ms
70ms Image
image/gif 2607:f1c0:100f:f000::2c3
IONOS-AS This is ...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.superiorlawncareusa.com/wp-content/uploads/2020/05/loading-gif-png-5.gif
Requested by: Host: zuskl.net
URL: https://zuskl.net/?id=google.auth.Adfjguirojs==Jh7dbwJ12io3d4dotQS5MZWhta3VobEBGVVNBLmRl
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2607:f1c0:100f:f000::2c3 , United States, ASN8560 (IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE., DE),
Reverse DNS
Software: Apache /
Resource Hash: fedd1fb82b84388842da3755d3b8da143446afe92bc4a2f9cfe5ce962cc71e88

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://zuskl.net/

Response headers

cache-control: max-age=10368000, public
expires: Tue, 11 Mar 2025 14:43:08 GMT
accept-ranges: bytes
content-length: 139441
date: Mon, 11 Nov 2024 14:43:08 GMT
content-type: image/gif
vary: Accept-Encoding
server: Apache
last-modified: Thu, 14 May 2020 16:52:52 GMT

GET
H2 404 favicon.ico
zuskl.net/ 1 KB
799 B 33ms
33ms Other
text/html 74.50.80.103
IS-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://zuskl.net/favicon.ico
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 74.50.80.103 , United States, ASN19318 (IS-AS-1, US),
Reverse DNS
Software: LiteSpeed /
Resource Hash: 679e7e62b81267c93d0778083ae0fd0efe24172ff0ac581835b54165b3d9ed43

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://zuskl.net/?id=google.auth.Adfjguirojs==Jh7dbwJ12io3d4dotQS5MZWhta3VobEBGVVNBLmRl

Response headers

cache-control: private, no-cache, max-age=0
content-encoding: gzip
pragma: no-cache
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
date: Mon, 11 Nov 2024 14:43:08 GMT
content-type: text/html
vary: Accept-Encoding
server: LiteSpeed

GET
H3 200 Primary Request qgb5z.html Show response
ipfs.io/ipfs/bafybeihjdvbty64ynejtt3jl4vxsd5drovhowujfc26ah2z4clcps6tzeu/ 16 KB
7 KB 94ms
52ms Document
text/html 209.94.90.1
PROTOCOL

General

Check archive.org

Show headers Download Go to

Full URL: https://ipfs.io/ipfs/bafybeihjdvbty64ynejtt3jl4vxsd5drovhowujfc26ah2z4clcps6tzeu/qgb5z.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 209.94.90.1 , United States, ASN40680 (PROTOCOL, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5243c6b62c4ca908225715caebc6206a92dc549bdbc6242b867660ede485a2ad

Request headers

Referer: https://zuskl.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Content-Type Range User-Agent X-Requested-With
access-control-allow-methods: GET HEAD OPTIONS
access-control-allow-origin: *
access-control-expose-headers: Content-Length Content-Range X-Chunked-Output X-Ipfs-Path X-Ipfs-Roots X-Stream-Output
age: 43739
alt-svc: h3=":443"; ma=86400
cache-control: public, max-age=29030400, immutable
cf-cache-status: HIT
cf-ray: 8e0f0da00846ab87-YYZ
content-encoding: br
content-type: text/html
date: Mon, 11 Nov 2024 14:43:12 GMT
server: cloudflare
vary: Accept-Encoding
x-ipfs-path: /ipfs/bafybeihjdvbty64ynejtt3jl4vxsd5drovhowujfc26ah2z4clcps6tzeu/qgb5z.html
x-ipfs-pop: rainbow-dc13-01
x-ipfs-roots: bafybeihjdvbty64ynejtt3jl4vxsd5drovhowujfc26ah2z4clcps6tzeu,bafkreicsipdlmlcmveecevyvzlv4midkslofjg63yyscxbtwmdw6jbncvu

GET
H3 200 bootstrap.min.css
stackpath.bootstrapcdn.com/bootstrap/4.3.1/css/ 152 KB
27 KB 96ms
46ms Stylesheet
text/css 104.18.10.207
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://stackpath.bootstrapcdn.com/bootstrap/4.3.1/css/bootstrap.min.css

Requested by

Host: ipfs.io
URL: https://ipfs.io/ipfs/bafybeihjdvbty64ynejtt3jl4vxsd5drovhowujfc26ah2z4clcps6tzeu/qgb5z.html

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.10.207 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

60b19e5da6a9234ff9220668a5ec1125c157a268513256188ee80f2d2c8d8d36

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://ipfs.io
Referer: https://ipfs.io/

Response headers

cdn-status: 200
content-encoding: br
cf-cache-status: HIT
etag: W/"a15c2ac3234aa8f6064ef9c1f7383c37"
age: 41461
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Mon, 11 Nov 2024 14:43:12 GMT
last-modified: Mon, 25 Jan 2021 22:04:08 GMT
content-type: text/css; charset=utf-8
vary: Accept-Encoding, Accept-Encoding
cdn-cache: HIT
cdn-cachedat: 07/31/2024 17:12:32
cdn-requestpullcode: 200
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=31919000
cdn-requestpullsuccess: True
timing-allow-origin: *
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid: 94294ec452e9edae87e0366de677eec0
cross-origin-resource-policy: cross-origin
cdn-pullzone: 252412
cdn-proxyver: 1.04
cf-ray: 8e0f0da0bbd4a1f0-YYZ
access-control-allow-origin: *
cdn-edgestorageid: 1068
server: cloudflare
cdn-requestcountrycode: US

GET
H2 200 css
fonts.googleapis.com/ 1 KB
959 B 108ms
44ms Stylesheet
text/css 2607:f8b0:4006:81e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Archivo+Narrow&display=swap

Requested by

Host: ipfs.io
URL: https://ipfs.io/ipfs/bafybeihjdvbty64ynejtt3jl4vxsd5drovhowujfc26ah2z4clcps6tzeu/qgb5z.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81e::200a , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

88f23b85d81514d63da43985d4e8be67c1d4235e42768ebdc3783f88fb36c1e0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://ipfs.io/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 11 Nov 2024 14:43:12 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 11 Nov 2024 14:43:12 GMT
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified: Mon, 11 Nov 2024 14:38:16 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H/1.1

200
OK

e4905575-fbae-45d8-bc6c-e33b4a167082%2Fajax-loader35fd.gif
cdn.glitch.me/
Redirect Chain

https://cdn.glitch.com/e4905575-fbae-45d8-bc6c-e33b4a167082%2Fajax-loader35fd.gif?v=1617145491470
https://cdn.glitch.me/e4905575-fbae-45d8-bc6c-e33b4a167082%2Fajax-loader35fd.gif

8 KB
8 KB

93ms
25ms

Image
image/gif

18.238.55.29
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.glitch.me/e4905575-fbae-45d8-bc6c-e33b4a167082%2Fajax-loader35fd.gif

Requested by

Host: ipfs.io
URL: https://ipfs.io/ipfs/bafybeihjdvbty64ynejtt3jl4vxsd5drovhowujfc26ah2z4clcps6tzeu/qgb5z.html

Protocol

HTTP/1.1

Server

18.238.55.29 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-238-55-29.jfk52.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

6ad159790587aeed2e2598356ea659fe327c99976f7243899b011695b9ad526f

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://ipfs.io/

Response headers

Content-Security-Policy: script-src 'none'
Cache-Control: max-age=31536000
ETag: "08a3028fda91d443f4d5e93307c96fcd"
Age: 7925772
Connection: keep-alive
Via: 1.1 6ecf35677ede41c0a96f262ec39b4894.cloudfront.net (CloudFront)
X-Cache: Hit from cloudfront
Content-Length: 7825
X-Amz-Cf-Id: FY5cqFp3y1-bqo_9YEh-G3H6eiDQGZnG-9ZzoR1rXldCSdwz4S6k6Q==
Date: Sun, 11 Aug 2024 21:07:00 GMT
Content-Type: image/gif
Last-Modified: Tue, 30 Mar 2021 23:04:50 GMT
Server: AmazonS3
X-Amz-Cf-Pop: JFK52-P4
Vary: Origin

Redirect headers

Location: https://cdn.glitch.me/e4905575-fbae-45d8-bc6c-e33b4a167082%2Fajax-loader35fd.gif
Age: 33229
Connection: keep-alive
Via: 1.1 a830c4d835a3be700150fe894f9bffd4.cloudfront.net (CloudFront)
X-Cache: Hit from cloudfront
Content-Length: 0
X-Amz-Cf-Id: SPtFVMUItGJQ-5XLj_lzEiRb39aJ0e232He-UC9EwXTCk0Q4e8jKxw==
Date: Mon, 11 Nov 2024 05:29:24 GMT
X-Amz-Cf-Pop: JFK50-P9
Vary: Origin
Server: AmazonS3

GET
H2 200 jquery-3.2.1.slim.min.js Show response
code.jquery.com/ 68 KB
24 KB 79ms
17ms Script
application/javascript 2a04:4e42:200::649
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.2.1.slim.min.js
Requested by: Host: ipfs.io
URL: https://ipfs.io/ipfs/bafybeihjdvbty64ynejtt3jl4vxsd5drovhowujfc26ah2z4clcps6tzeu/qgb5z.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:200::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: 9365920887b11b33a3dc4ba28a0f93951f200341263e3b9cefd384798e4be398

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://ipfs.io
Referer: https://ipfs.io/

Response headers

content-encoding: gzip
etag: W/"28feccc0-10fdd"
age: 1668215
x-cache: HIT, HIT
date: Mon, 11 Nov 2024 14:43:12 GMT
content-type: application/javascript; charset=utf-8
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
x-cache-hits: 42285, 5242
x-served-by: cache-lga21984-LGA, cache-yul1970070-YUL
vary: Accept-Encoding
cache-control: public, max-age=31536000, stale-while-revalidate=604800
x-timer: S1731336192.122839,VS0,VE0
cross-origin-resource-policy: cross-origin
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
access-control-allow-origin: *
content-length: 23856
server: nginx

GET
H3 200 popper.min.js Show response
cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/ 19 KB
7 KB 78ms
41ms Script
application/javascript 104.17.25.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js

Requested by

Host: ipfs.io
URL: https://ipfs.io/ipfs/bafybeihjdvbty64ynejtt3jl4vxsd5drovhowujfc26ah2z4clcps6tzeu/qgb5z.html

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://ipfs.io
Referer: https://ipfs.io/

Response headers

cf-cdnjs-via: cfworker/kv
content-encoding: br
cf-cache-status: HIT
etag: "5eb03fa9-4af4"
age: 457578
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BQ%2FY%2FJPBLF%2F4rxBFK5Q1uF%2Bg5p%2FNCySn9Smfon0DUrWz6a3V41PeboZZ1Kzs4olMWm8UdEu%2Fusm86ASUgu1XRrvb%2F%2BTul8G7BU5Xf6jOrrtIzJ1SJaVvK2VETtuBvmgD%2B1k3ZWee"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Sat, 01 Nov 2025 14:43:12 GMT
alt-svc: h3=":443"; ma=86400
date: Mon, 11 Nov 2024 14:43:12 GMT
content-type: application/javascript; charset=utf-8
last-modified: Mon, 04 May 2020 16:15:37 GMT
vary: Accept-Encoding
strict-transport-security: max-age=15780000
cache-control: public, max-age=30672000
timing-allow-origin: *
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy: cross-origin
cf-ray: 8e0f0da0e867ab16-YYZ
accept-ranges: bytes
access-control-allow-origin: *
content-length: 6157
server: cloudflare

GET
H3 200 bootstrap.min.js Show response
maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/ 48 KB
15 KB 76ms
39ms Script
application/javascript 104.18.10.207
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js

Requested by

Host: ipfs.io
URL: https://ipfs.io/ipfs/bafybeihjdvbty64ynejtt3jl4vxsd5drovhowujfc26ah2z4clcps6tzeu/qgb5z.html

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.10.207 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://ipfs.io
Referer: https://ipfs.io/

Response headers

cdn-status: 200
content-encoding: gzip
cf-cache-status: HIT
etag: W/"14d449eb8876fa55e1ef3c2cc52b0c17"
age: 833104
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Mon, 11 Nov 2024 14:43:12 GMT
last-modified: Mon, 25 Jan 2021 22:04:04 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
cdn-cache: HIT
cdn-cachedat: 01/15/2024 23:55:45
cdn-requestpullcode: 200
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=31919000
cdn-requestpullsuccess: True
timing-allow-origin: *
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid: 1e3cec95a1f2a990ec5aa084b13d2d67
cross-origin-resource-policy: cross-origin
cdn-pullzone: 252412
cdn-proxyver: 1.04
cf-ray: 8e0f0da0ec02a1f0-YYZ
access-control-allow-origin: *
cdn-edgestorageid: 845
server: cloudflare
cdn-requestcountrycode: US

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/2.2.4/ 84 KB
30 KB 110ms
27ms Script
text/javascript 2607:f8b0:4006:822::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js

Requested by

Host: ipfs.io
URL: https://ipfs.io/ipfs/bafybeihjdvbty64ynejtt3jl4vxsd5drovhowujfc26ah2z4clcps6tzeu/qgb5z.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:822::200a , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://ipfs.io/

Response headers

content-encoding: gzip
age: 408212
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
x-content-type-options: nosniff
expires: Thu, 06 Nov 2025 21:19:40 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 06 Nov 2024 21:19:40 GMT
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
accept-ranges: bytes
access-control-allow-origin: *
content-length: 30028
x-xss-protection: 0
server: sffe

GET
H3 200 bootstrap.min.js Show response
stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/ 50 KB
15 KB 63ms
33ms Script
application/javascript 104.18.10.207
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js

Requested by

Host: ipfs.io
URL: https://ipfs.io/ipfs/bafybeihjdvbty64ynejtt3jl4vxsd5drovhowujfc26ah2z4clcps6tzeu/qgb5z.html

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.10.207 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://ipfs.io/

Response headers

cdn-status: 200
content-encoding: br
cf-cache-status: HIT
etag: "67176c242e1bdc20603c878dee836df3"
age: 807435
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
date: Mon, 11 Nov 2024 14:43:12 GMT
last-modified: Mon, 25 Jan 2021 22:04:06 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
cdn-cache: HIT
cdn-cachedat: 10/04/2024 02:53:43
cdn-requestpullcode: 200
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=31919000
cdn-requestpullsuccess: True
timing-allow-origin: *
cdn-requesttime: 0
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid: 3103fbaec57f696fc9c2ffb078e0a058
cross-origin-resource-policy: cross-origin
cdn-pullzone: 252412
cdn-proxyver: 1.04
cf-ray: 8e0f0da0de18aab0-YYZ
access-control-allow-origin: *
cdn-edgestorageid: 1029
server: cloudflare
cdn-requestcountrycode: US

GET
H2 200 jquery.session.min.js Show response
cdn.jsdelivr.net/npm/jquery.session@1.0.0/ 2 KB
1 KB 72ms
17ms Script
application/javascript 2a04:4e42:200::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/jquery.session@1.0.0/jquery.session.min.js

Requested by

Host: ipfs.io
URL: https://ipfs.io/ipfs/bafybeihjdvbty64ynejtt3jl4vxsd5drovhowujfc26ah2z4clcps6tzeu/qgb5z.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:200::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

76ad6584ac5bdd459939dc7532fae7c2bdd8e22d773ff16d2306f42a1ffc569c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://ipfs.io/

Response headers

access-control-expose-headers: *
content-encoding: br
etag: W/"91d-mUGbC+S4VCL/hIcOVNvYpS3G2rE"
age: 723015
x-content-type-options: nosniff
x-jsd-version-type: version
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
x-cache: HIT, HIT
date: Mon, 11 Nov 2024 14:43:12 GMT
content-type: application/javascript; charset=utf-8
x-served-by: cache-fra-eddf8230025-FRA, cache-yul1970044-YUL
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
content-length: 840
x-jsd-version: 1.0.0

GET
DATA 200
OK truncated
/ 3 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f7459fa37c7cddcf84d3bf3fb4e30474715eb0258ec7c34e70791265b8fffc65

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET /
fusa.de/ Frame A816 0
0

GET FUSA.de
logo.clearbit.com/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: fusa.de
URL: https://fusa.de/

Domain: logo.clearbit.com
URL: https://logo.clearbit.com/FUSA.de

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Email (Online)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			ipfs.io/	1970-01-21 00:55:36	Name: __session:0.0012615097635613193: Value: https:

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://zuskl.net/favicon.ico Message: Failed to load resource: the server responded with a status of 404 ()
recommendation	verbose	URL: https://ipfs.io/ipfs/bafybeihjdvbty64ynejtt3jl4vxsd5drovhowujfc26ah2z4clcps6tzeu/qgb5z.html#A.Lehmkuhl@FUSA.de Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
cdn.glitch.com
cdn.glitch.me
cdn.jsdelivr.net
cdnjs.cloudflare.com
code.jquery.com
fonts.googleapis.com
fusa.de
ipfs.io
logo.clearbit.com
maxcdn.bootstrapcdn.com
stackpath.bootstrapcdn.com
www.superiorlawncareusa.com
zuskl.net
fusa.de
logo.clearbit.com
104.17.25.14
104.18.10.207
18.238.55.29
209.94.90.1
2607:f1c0:100f:f000::2c3
2607:f8b0:4006:81e::200a
2607:f8b0:4006:822::200a
2a04:4e42:200::485
2a04:4e42:200::649
3.168.73.12
74.50.80.103
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
10013a6304760c0263572d715cb0a61b92fc229a4637a2ba854a264ea5b40854
5243c6b62c4ca908225715caebc6206a92dc549bdbc6242b867660ede485a2ad
56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4
60b19e5da6a9234ff9220668a5ec1125c157a268513256188ee80f2d2c8d8d36
679e7e62b81267c93d0778083ae0fd0efe24172ff0ac581835b54165b3d9ed43
6ad159790587aeed2e2598356ea659fe327c99976f7243899b011695b9ad526f
76ad6584ac5bdd459939dc7532fae7c2bdd8e22d773ff16d2306f42a1ffc569c
88f23b85d81514d63da43985d4e8be67c1d4235e42768ebdc3783f88fb36c1e0
9365920887b11b33a3dc4ba28a0f93951f200341263e3b9cefd384798e4be398
a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66
e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b
f7459fa37c7cddcf84d3bf3fb4e30474715eb0258ec7c34e70791265b8fffc65
fedd1fb82b84388842da3755d3b8da143446afe92bc4a2f9cfe5ce962cc71e88

ipfs.io Open in urlscan Pro 209.94.90.1 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

15 Requests

80 %HTTPS

45 %IPv6

12 Domains

14 Subdomains

11 IPs

2 Countries

273 kBTransfer

588 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

15 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

6 JavaScript Global Variables

1 Cookies

2 Console Messages

Indicators

ipfs.io Open in urlscan Pro
209.94.90.1 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

15
Requests

80 %
HTTPS

45 %
IPv6

12
Domains

14
Subdomains

11
IPs

2
Countries

273 kB
Transfer

588 kB
Size

1
Cookies

15 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!