ipfs.io Open in urlscan Pro
2602:fea2:2::1 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://votlng-curvefinance.com/
Effective URL:
https://ipfs.io/ipfs/QmRzPuc6T5Qr2bgYKVu1kwLQhmtTmE9fTiFtH1rLib6pMu/
Submission: On June 19 via manual (June 19th 2024, 9:40:38 pm UTC) from US — Scanned from DE

Summary HTTP 10 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 1 countries across 4 domains to perform 10 HTTP transactions. The main IP is 2602:fea2:2::1, located in United States and belongs to PROTOCOL, US. The main domain is ipfs.io. The Cisco Umbrella rank of the primary domain is 87085.
TLS certificate: Issued by WE1 on June 14th 2024. Valid for: 3 months.

This is the only time ipfs.io was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Crypto (Crypto Exchange)

Domain & IP information

	IP Address	AS Autonomous System
1 1	2606:4700:303... 2606:4700:3035::ac43:8bb7	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2602:fea2:2::1 2602:fea2:2::1	40680 (PROTOCOL) (PROTOCOL)
5	76.76.21.142 76.76.21.142	16509 (AMAZON-02) (AMAZON-02)
10	3

1 2606:4700:3035::ac43:8bb7 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

votlng-curvefinance.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2602:fea2:2::1 (United States)

ASN40680 (PROTOCOL, US)

ipfs.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 76.76.21.142 (Walnut, United States)

ASN16509 (AMAZON-02, US)

classic.curve.fi	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	curve.fi classic.curve.fi	199 KB
1	ipfs.io ipfs.io — Cisco Umbrella Rank: 87085	57 KB
1	votlng-curvefinance.com 1 redirects votlng-curvefinance.com	497 B
0	ipfs.tech Failed ipfs.tech Failed
10	4

	Domain	Requested by
5	classic.curve.fi	ipfs.io
1	ipfs.io	ipfs.io
1	votlng-curvefinance.com	1 redirects
0	ipfs.tech Failed	ipfs.io
10	4

This site contains no links.

Subject Issuer	Validity	Valid
ipfs.io WE1	`2024-06-14` - `2024-09-12`	3 months	crt.sh
classic.curve.fi R3	`2024-05-04` - `2024-08-02`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://ipfs.io/ipfs/QmRzPuc6T5Qr2bgYKVu1kwLQhmtTmE9fTiFtH1rLib6pMu/
Frame ID: 4C1E386204D267E82A8AF2D7063384B8
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://votlng-curvefinance.com/ HTTP 301
https://ipfs.io/ipfs/QmRzPuc6T5Qr2bgYKVu1kwLQhmtTmE9fTiFtH1rLib6pMu/ Page URL

Page Statistics

10
Requests

60 %
HTTPS

67 %
IPv6

4
Domains

4
Subdomains

3
IPs

1
Countries

256 kB
Transfer

436 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://votlng-curvefinance.com/ HTTP 301
https://ipfs.io/ipfs/QmRzPuc6T5Qr2bgYKVu1kwLQhmtTmE9fTiFtH1rLib6pMu/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://ipfs.io/css/app.aa124228.css HTTP 301
https://ipfs.tech/css/app.aa124228.css

Request Chain 1

https://ipfs.io/js/app.8ac9f6e9.js HTTP 301
https://ipfs.tech/js/app.8ac9f6e9.js

Request Chain 2

https://ipfs.io/js/chunk-vendors.d97fb712.js HTTP 301
https://ipfs.tech/js/chunk-vendors.d97fb712.js

10 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3

200

Primary Request / Show response
ipfs.io/ipfs/QmRzPuc6T5Qr2bgYKVu1kwLQhmtTmE9fTiFtH1rLib6pMu/
Redirect Chain

https://votlng-curvefinance.com/
https://ipfs.io/ipfs/QmRzPuc6T5Qr2bgYKVu1kwLQhmtTmE9fTiFtH1rLib6pMu/

91 KB
57 KB

79ms
45ms

Document
text/html

2602:fea2:2::1
PROTOCOL

General

Check archive.org

Show headers Download Go to

Full URL: https://ipfs.io/ipfs/QmRzPuc6T5Qr2bgYKVu1kwLQhmtTmE9fTiFtH1rLib6pMu/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2602:fea2:2::1 , United States, ASN40680 (PROTOCOL, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 073ee97556efc30cdf04f6ea070e23b635c95eee5903b6df1515d8ebfc6df2a0

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

access-control-allow-headers: Content-Type Range User-Agent X-Requested-With
access-control-allow-methods: GET HEAD OPTIONS
access-control-allow-origin: *
access-control-expose-headers: Content-Length Content-Range X-Chunked-Output X-Ipfs-Path X-Ipfs-Roots X-Stream-Output
age: 67868
alt-svc: h3=":443"; ma=86400
cache-control: public, max-age=29030400, immutable
cf-cache-status: HIT
cf-ray: 8966acc078cd71b3-FRA
content-encoding: br
content-location: /ipfs/QmRzPuc6T5Qr2bgYKVu1kwLQhmtTmE9fTiFtH1rLib6pMu/?format=json
content-type: text/html
date: Wed, 19 Jun 2024 21:39:58 GMT
server: cloudflare
vary: Accept-Encoding
x-ipfs-path: /ipfs/QmRzPuc6T5Qr2bgYKVu1kwLQhmtTmE9fTiFtH1rLib6pMu/
x-ipfs-pop: rainbow-am6-01
x-ipfs-roots: QmRzPuc6T5Qr2bgYKVu1kwLQhmtTmE9fTiFtH1rLib6pMu

Redirect headers

access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8966ac6a0a082bb0-FRA
date: Wed, 19 Jun 2024 21:39:58 GMT
location: https://ipfs.io/ipfs/QmRzPuc6T5Qr2bgYKVu1kwLQhmtTmE9fTiFtH1rLib6pMu/
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UZjHJ7WZ8caBTDXODbpkAvhkTY82mkI1dbTF%2BSHek4P9g4mTewhECp9WlT6BAkdlqFyPTbHGDV%2BWdyVGFsUSY2na5qD2IkevAlN8bBPuO8K79%2FKZoUKvph5n%2F9ndGPbururHQCHaSAUSmnsrhr1jXm%2Biy3t5Vg%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

GET

app.aa124228.css
ipfs.tech/css/
Redirect Chain

https://ipfs.io/css/app.aa124228.css
https://ipfs.tech/css/app.aa124228.css

0
0

GET

app.8ac9f6e9.js
ipfs.tech/js/
Redirect Chain

https://ipfs.io/js/app.8ac9f6e9.js
https://ipfs.tech/js/app.8ac9f6e9.js

0
0

GET

chunk-vendors.d97fb712.js
ipfs.tech/js/
Redirect Chain

https://ipfs.io/js/chunk-vendors.d97fb712.js
https://ipfs.tech/js/chunk-vendors.d97fb712.js

0
0

GET
H2 200 app.aa124228.css
classic.curve.fi/css/ 22 KB
6 KB 110ms
35ms Stylesheet
text/css 76.76.21.142
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://classic.curve.fi/css/app.aa124228.css

Requested by

Host: ipfs.io
URL: https://ipfs.io/ipfs/QmRzPuc6T5Qr2bgYKVu1kwLQhmtTmE9fTiFtH1rLib6pMu/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

76.76.21.142 Walnut, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Vercel /

Resource Hash

96637882555d185c82c8ca4367066a8a1bab251bafdd4bfebef7a3fa705a3733

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://ipfs.io/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 19 Jun 2024 21:39:58 GMT
content-encoding: br
strict-transport-security: max-age=63072000
server: Vercel
x-vercel-id: fra1::ww9kw-1718833198282-ab95d0095ec5
age: 3062085
etag: W/"d086294b0d29db83410452a90277e494"
x-vercel-cache: HIT
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
content-disposition: inline; filename="app.aa124228.css"

GET
H2 200 chunk-012c4385.f741bd35.css
classic.curve.fi/css/ 1004 B
701 B 108ms
33ms Stylesheet
text/css 76.76.21.142
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://classic.curve.fi/css/chunk-012c4385.f741bd35.css

Requested by

Host: ipfs.io
URL: https://ipfs.io/ipfs/QmRzPuc6T5Qr2bgYKVu1kwLQhmtTmE9fTiFtH1rLib6pMu/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

76.76.21.142 Walnut, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Vercel /

Resource Hash

b7b6f09684dc4454d00f56993fd17e345f8556fad3a88ff536089305079c1abf

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://ipfs.io/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 19 Jun 2024 21:39:58 GMT
content-encoding: br
strict-transport-security: max-age=63072000
server: Vercel
x-vercel-id: fra1::hk8m9-1718833198282-dfeb655c16fe
age: 3062084
etag: W/"cf4dd5afabcb46c16502dc8395985a6d"
x-vercel-cache: HIT
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
content-disposition: inline; filename="chunk-012c4385.f741bd35.css"

GET
H2 200 chunk-4e7f17cf.19781dd2.css
classic.curve.fi/css/ 1 KB
540 B 131ms
57ms Stylesheet
text/css 76.76.21.142
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://classic.curve.fi/css/chunk-4e7f17cf.19781dd2.css

Requested by

Host: ipfs.io
URL: https://ipfs.io/ipfs/QmRzPuc6T5Qr2bgYKVu1kwLQhmtTmE9fTiFtH1rLib6pMu/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

76.76.21.142 Walnut, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Vercel /

Resource Hash

a7c0c291bea84d8b753a198fa8b3a5b7c36ab10321f56bd3f8905939013f9f9b

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://ipfs.io/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 19 Jun 2024 21:39:58 GMT
content-encoding: br
strict-transport-security: max-age=63072000
server: Vercel
x-vercel-id: fra1::t679c-1718833198282-841618a4200a
age: 3042260
etag: W/"e54eabe9e19006cf5b70ef7ccd093251"
x-vercel-cache: HIT
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
content-disposition: inline; filename="chunk-4e7f17cf.19781dd2.css"

GET main.js
ipfs.io/ipfs/QmRzPuc6T5Qr2bgYKVu1kwLQhmtTmE9fTiFtH1rLib6pMu/scripts/ 0
0

GET
H2 200 logo.png
classic.curve.fi/ 146 KB
146 KB 132ms
58ms Image
image/png 76.76.21.142
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://classic.curve.fi/logo.png

Requested by

Host: ipfs.io
URL: https://ipfs.io/ipfs/QmRzPuc6T5Qr2bgYKVu1kwLQhmtTmE9fTiFtH1rLib6pMu/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

76.76.21.142 Walnut, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Vercel /

Resource Hash

2d692bb02f158d5b6ac9d4868241fcf308f9df835e1ea8764a0edafab14fbd5e

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://ipfs.io/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 19 Jun 2024 21:39:58 GMT
strict-transport-security: max-age=63072000
server: Vercel
x-vercel-id: fra1::sz7gg-1718833198286-0a3c06843f1f
age: 3061337
etag: "880525b53c7f18f962eec01934d93b1e"
x-vercel-cache: HIT
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
content-disposition: inline; filename="logo.png"
accept-ranges: bytes
content-length: 149346

GET
H2 200 logo_optimized.svg
classic.curve.fi/logos/ 175 KB
46 KB 112ms
38ms Image
image/svg+xml 76.76.21.142
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://classic.curve.fi/logos/logo_optimized.svg

Requested by

Host: ipfs.io
URL: https://ipfs.io/ipfs/QmRzPuc6T5Qr2bgYKVu1kwLQhmtTmE9fTiFtH1rLib6pMu/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

76.76.21.142 Walnut, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Vercel /

Resource Hash

e714e68f9546cf2a86f7d4c89a16057846e63123854877a3accae810e3aca559

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://ipfs.io/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 19 Jun 2024 21:39:58 GMT
content-encoding: br
strict-transport-security: max-age=63072000
server: Vercel
x-vercel-id: fra1::plbcv-1718833198282-4f2507114732
age: 3061337
etag: W/"bed13c6881b283be292ef3e7a6136d22"
x-vercel-cache: HIT
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
content-disposition: inline; filename="logo_optimized.svg"

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: ipfs.tech
URL: https://ipfs.tech/css/app.aa124228.css

Domain: ipfs.tech
URL: https://ipfs.tech/js/app.8ac9f6e9.js

Domain: ipfs.tech
URL: https://ipfs.tech/js/chunk-vendors.d97fb712.js

Domain: ipfs.io
URL: https://ipfs.io/ipfs/QmRzPuc6T5Qr2bgYKVu1kwLQhmtTmE9fTiFtH1rLib6pMu/scripts/main.js

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Crypto (Crypto Exchange)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

undefined| event object| fence object| sharedStorage

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

classic.curve.fi
ipfs.io
ipfs.tech
votlng-curvefinance.com
ipfs.io
ipfs.tech
2602:fea2:2::1
2606:4700:3035::ac43:8bb7
76.76.21.142
073ee97556efc30cdf04f6ea070e23b635c95eee5903b6df1515d8ebfc6df2a0
2d692bb02f158d5b6ac9d4868241fcf308f9df835e1ea8764a0edafab14fbd5e
96637882555d185c82c8ca4367066a8a1bab251bafdd4bfebef7a3fa705a3733
a7c0c291bea84d8b753a198fa8b3a5b7c36ab10321f56bd3f8905939013f9f9b
b7b6f09684dc4454d00f56993fd17e345f8556fad3a88ff536089305079c1abf
e714e68f9546cf2a86f7d4c89a16057846e63123854877a3accae810e3aca559

ipfs.io Open in urlscan Pro 2602:fea2:2::1 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Page Statistics

10 Requests

60 %HTTPS

67 %IPv6

4 Domains

4 Subdomains

3 IPs

1 Countries

256 kBTransfer

436 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

0 Cookies

Indicators

ipfs.io Open in urlscan Pro
2602:fea2:2::1 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

60 %
HTTPS

67 %
IPv6

4
Domains

4
Subdomains

3
IPs

1
Countries

256 kB
Transfer

436 kB
Size

0
Cookies

10 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!