bafybeifuz6up4rshhmcd2cgsnfhks6ekt5dfxth4e7agsij43ybxtgjyci.ipfs.dweb.link
Open in
urlscan Pro
209.94.90.2
Malicious Activity!
Public Scan
URL:
https://bafybeifuz6up4rshhmcd2cgsnfhks6ekt5dfxth4e7agsij43ybxtgjyci.ipfs.dweb.link/bb.html
Submission: On November 18 via automatic, source phishtank — Scanned from DE
Submission: On November 18 via automatic, source phishtank — Scanned from DE
Summary
This website contacted 3 IPs
in 2 countries
across 2 domains to perform 16 HTTP transactions.
The main IP is 209.94.90.2, located in
United States and
belongs to PROTOCOL, US.
The main domain is bafybeifuz6up4rshhmcd2cgsnfhks6ekt5dfxth4e7agsij43ybxtgjyci.ipfs.dweb.link.
TLS certificate: Issued by E5 on October 10th 2024. Valid for: 3 months.
This is the only time bafybeifuz6up4rshhmcd2cgsnfhks6ekt5dfxth4e7agsij43ybxtgjyci.ipfs.dweb.link was scanned on urlscan.io!
TLS certificate: Issued by E5 on October 10th 2024. Valid for: 3 months.
This is the only time bafybeifuz6up4rshhmcd2cgsnfhks6ekt5dfxth4e7agsij43ybxtgjyci.ipfs.dweb.link was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Email (Online)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 | 209.94.90.2 209.94.90.2 | 40680 (PROTOCOL) (PROTOCOL) | |
| 14 | 94.136.171.57 94.136.171.57 | 42831 (UKSERVERS...) (UKSERVERS-AS UK Dedicated Servers Limited) | |
| 16 | 3 |
1
209.94.90.2
(United States)
ASN40680 (PROTOCOL, US)
ASN40680 (PROTOCOL, US)
| bafybeifuz6up4rshhmcd2cgsnfhks6ekt5dfxth4e7agsij43ybxtgjyci.ipfs.dweb.link |
14
94.136.171.57
(United Kingdom)
ASN42831 (UKSERVERS-AS UK Dedicated Servers Limited, GB)
ASN42831 (UKSERVERS-AS UK Dedicated Servers Limited, GB)
| webmail.supremecluster.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 14 |
supremecluster.com
webmail.supremecluster.com |
259 KB |
| 1 |
dweb.link
bafybeifuz6up4rshhmcd2cgsnfhks6ekt5dfxth4e7agsij43ybxtgjyci.ipfs.dweb.link |
4 KB |
| 16 | 2 |
| Domain | Requested by | |
|---|---|---|
| 14 | webmail.supremecluster.com |
bafybeifuz6up4rshhmcd2cgsnfhks6ekt5dfxth4e7agsij43ybxtgjyci.ipfs.dweb.link
|
| 1 | bafybeifuz6up4rshhmcd2cgsnfhks6ekt5dfxth4e7agsij43ybxtgjyci.ipfs.dweb.link | |
| 16 | 2 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| dweb.link E5 |
2024-10-10 - 2025-01-08 |
3 months | crt.sh |
| webmail.supremecluster.com E6 |
2024-11-14 - 2025-02-12 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://bafybeifuz6up4rshhmcd2cgsnfhks6ekt5dfxth4e7agsij43ybxtgjyci.ipfs.dweb.link/bb.html
Frame ID: 1EE18C6514CA86DAE93DDA14BDC48E76
Requests: 16 HTTP requests in this frame
Screenshot
Page Title
Roundcube Webmail :: Welcome to Roundcube WebmailDetected technologies
RoundCube
(Web Mail)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <title>RoundCube
Bootstrap
(Web Frameworks)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
jQuery UI
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- jquery-ui.*\.js
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
16 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
bb.html
bafybeifuz6up4rshhmcd2cgsnfhks6ekt5dfxth4e7agsij43ybxtgjyci.ipfs.dweb.link/ |
11 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bootstrap.min.css
webmail.supremecluster.com/skins/elastic/deps/ |
157 KB 24 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
styles.css
webmail.supremecluster.com/skins/elastic/styles/ |
101 KB 19 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
framework.css
webmail.supremecluster.com/plugins/xframework/assets/styles/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery-ui.css
webmail.supremecluster.com/plugins/jqueryui/themes/elastic/ |
33 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery.min.js
webmail.supremecluster.com/program/js/ |
89 KB 31 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
common.min.js
webmail.supremecluster.com/program/js/ |
12 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
app.min.js
webmail.supremecluster.com/program/js/ |
168 KB 47 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jstz.min.js
webmail.supremecluster.com/program/js/ |
14 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
framework.min.js
webmail.supremecluster.com/plugins/xframework/assets/scripts/ |
12 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
xskin.min.js
webmail.supremecluster.com/plugins/xskin/assets/scripts/ |
4 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery-ui.min.js
webmail.supremecluster.com/plugins/jqueryui/js/ |
256 KB 69 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
logo.svg
webmail.supremecluster.com/skins/elastic/images/ |
888 B 735 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bootstrap.bundle.min.js
webmail.supremecluster.com/skins/elastic/deps/ |
82 KB 22 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ui.min.js
webmail.supremecluster.com/skins/elastic/ |
60 KB 20 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
favicon.ico
webmail.supremecluster.com/skins/elastic/images/ |
17 KB 2 KB |
Other
image/vnd.microsoft.icon |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- webmail.supremecluster.com
- URL
- https://webmail.supremecluster.com/plugins/xframework/assets/styles/framework.css?s=1506327547
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Email (Online)32 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery number| CONTROL_KEY number| SHIFT_KEY number| CONTROL_SHIFT_KEY function| roundcube_browser object| rcube_event function| rcube_event_engine function| rcube_check_email function| rcube_clone_object function| urlencode function| rcube_find_object function| rcube_mouse_is_over function| setCookie function| getCookie object| bw function| rcube_parse_query object| Base64 object| pattern function| rcube_webmail object| jstz object| rcmail function| x object| xsidebar object| xframework function| xsidebarLarry function| xsidebarElastic object| xskin object| bootstrap function| rcube_elastic_ui function| __newInst object| UI0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
bafybeifuz6up4rshhmcd2cgsnfhks6ekt5dfxth4e7agsij43ybxtgjyci.ipfs.dweb.link
webmail.supremecluster.com
webmail.supremecluster.com
209.94.90.2
94.136.171.57
061f93b16d52f124d1df7b15ba43942736b743f733c77a7cb82b8d2d2ae0fd03
0c07ab29e206a3328d77889da33b64f9ae5d6ea32d34c4a8fae78a64ba428760
19b51730c10082760e6d9b82c1342e60855f98d2666c64e4eb758d26b1a0c840
2b2d9c7a82f92976268b03e13c61f64ead91a3c63b97c59cef2acbf501f67618
360bc4a9894bbd41134a2eea27ee9251f649e6aa395c1836caaa2f90e123f91a
3cb5b7ae5053d743996378c35733560214d3d896ade5c0de0d8b13a97f43039e
45b30930d5752603cdff2d24aa942b5bbae3168f62e74e092cd9405ff10127f7
5587d48bf92e77d6abf71c25f39e248e6bc2e168595128b516b733e65eba1101
5641ed21773230a8110279658abac57bb5b4abc7bf4091946c5e61e8f0021f55
5ca2ab3ebd08b57576b15d32eae4bbe454d73d417365dc94c7d1c5c90110b401
6d4a06abcec56644378c6d2fd863200e5032361930240b6a19633f76ed5787e1
716ece8deb8412f7ec95ab395c92f6515bb8d8b792fd7480c014cdc6f063452a
7b30e499996ec4631848d3509d803d9311f5d71999212f2f4c1ca7af8f24eb69
b5c8efcc70542f970db5def97926121e9315e45ff3a73386bc933585da201222
c7be38b0d3dd4fd6954591e7c517d88fa0570535f46ffd91a43b7f5405767888