ipfs.io Open in urlscan Pro
2602:fea2:2::1  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
5 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request bafybeiam5gn5xfma72se5tmsc2a2hkpoh7bhwf4dnro4qx4ek5nvbr36si Show response ipfs.io/ipfs/	483 B 1 KB	1139ms 613ms	Document text/html	2602:fea2:2::1 PROTOCOL
General Check archive.org Show headers Download Go to Full URL https://ipfs.io/ipfs/bafybeiam5gn5xfma72se5tmsc2a2hkpoh7bhwf4dnro4qx4ek5nvbr36si Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2602:fea2:2::1 , United States, ASN40680 (PROTOCOL, US), Reverse DNS Software openresty / Resource Hash e98ca2cd98da86f9e655e66c534a5283098feae53a490e6853798199acd62dba Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36 accept-language en-US,en;q=0.9 Response headers access-control-allow-headers X-Requested-With, Range, Content-Range, X-Chunked-Output, X-Stream-Output access-control-allow-methods GET GET, POST, OPTIONS access-control-allow-origin * access-control-expose-headers Content-Range, X-Chunked-Output, X-Stream-Output cache-control public, max-age=29030400, immutable content-encoding gzip content-type text/html date Fri, 28 Apr 2023 04:59:59 GMT etag W/"bafybeiam5gn5xfma72se5tmsc2a2hkpoh7bhwf4dnro4qx4ek5nvbr36si" server openresty strict-transport-security max-age=31536000; includeSubDomains; preload timing-allow-origin * vary Accept-Encoding x-bfid df1963bda5bbcae0c0fa5dd2b68a2c8e x-ipfs-datasize 483 x-ipfs-gateway-host ipfs-bank23-dc13 x-ipfs-lb-pop gateway-bank1-dc13 x-ipfs-path /ipfs/bafybeiam5gn5xfma72se5tmsc2a2hkpoh7bhwf4dnro4qx4ek5nvbr36si x-ipfs-pop ipfs-bank23-dc13 x-ipfs-roots bafybeiam5gn5xfma72se5tmsc2a2hkpoh7bhwf4dnro4qx4ek5nvbr36si x-proxy-cache HIT
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/1.12.4/	95 KB 34 KB	218ms 65ms	Script text/javascript	2607:f8b0:4006:81c::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/1.12.4/jquery.min.js Requested by Host: ipfs.io URL: https://ipfs.io/ipfs/bafybeiam5gn5xfma72se5tmsc2a2hkpoh7bhwf4dnro4qx4ek5nvbr36si Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4006:81c::200a New York, United States, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language en-US,en;q=0.9 Referer https://ipfs.io/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36 Response headers date Wed, 26 Apr 2023 15:09:14 GMT content-encoding gzip x-content-type-options nosniff age 136245 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 33951 x-xss-protection 0 last-modified Tue, 03 Mar 2020 19:15:00 GMT server sffe cross-origin-opener-policy same-origin; report-to="hosted-libraries-pushers" vary Accept-Encoding report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Thu, 25 Apr 2024 15:09:14 GMT
GET H2	200	owa.js Show response viajesmasegosa.es/wp-content/uploads/2022/01/	8 KB 3 KB	906ms 156ms	Script application/javascript	213.227.130.171 LEASEWEB-NL-AMS-0...
General Check archive.org Show headers Download Go to Full URL https://viajesmasegosa.es/wp-content/uploads/2022/01/owa.js Requested by Host: ipfs.io URL: https://ipfs.io/ipfs/bafybeiam5gn5xfma72se5tmsc2a2hkpoh7bhwf4dnro4qx4ek5nvbr36si Protocol H2 Security TLS 1.3, , AES_128_GCM Server 213.227.130.171 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL), Reverse DNS s510.ams8.mysecurecloudhost.com Software LiteSpeed / Resource Hash 09f92be5ea64bea4ac9ff0b3682288f914c814a03b29b6a1a192a3d40e53bd5d Request headers accept-language en-US,en;q=0.9 Referer https://ipfs.io/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36 Response headers date Fri, 28 Apr 2023 05:00:00 GMT content-encoding br last-modified Tue, 11 Apr 2023 06:20:41 GMT server LiteSpeed vary Accept-Encoding,User-Agent content-type application/javascript cache-control public, max-age=604800 accept-ranges bytes alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" content-length 2324 expires Fri, 05 May 2023 05:00:00 GMT
POST H2	200	GetOwa.php Show response all4saleshop.com/	55 KB 23 KB	2267ms 1880ms	XHR text/html	213.227.130.171 LEASEWEB-NL-AMS-0...
General Check archive.org Show headers Download Go to Full URL https://all4saleshop.com/GetOwa.php Requested by Host: viajesmasegosa.es URL: https://viajesmasegosa.es/wp-content/uploads/2022/01/owa.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 213.227.130.171 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL), Reverse DNS s510.ams8.mysecurecloudhost.com Software LiteSpeed / Resource Hash 36654c461f9befc4538e04a32955ddc292ea97f5c81fdb1833ac6f256fbe3210 Request headers Referer https://ipfs.io/ accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36 Content-Type application/x-www-form-urlencoded Response headers access-control-allow-origin * date Fri, 28 Apr 2023 05:00:02 GMT content-encoding gzip server LiteSpeed alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" vary Accept-Encoding,User-Agent content-type text/html; charset=UTF-8
GET DATA	200 OK	truncated /	2 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash d9ed6586942003696afe4e52b09f343f8342244b51a9e175b75162d7e615207b Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	4 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 4de8fc175826d9f78fce9f9f2b71a63fe832fc7507e0394125c823b0909fa54a Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	6 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 6bd745cac7dd2e979f9e89dcd3c1ed3058812be0c88a06fc066360f74120b717 Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	1 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 07f38b8b8c1f96ed85ecd96988f0454a95d1f665427086a507c72e55ff3ce0e7 Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	761 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash c3a3dcdbf7b0771ccf2eb4c6688dd334cebb09b33331d8875550ad250221a45f Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36 Response headers Content-Type image/png
GET		segoeui-regular.ttf exchange.quadranet.com/owa/auth/15.0.1395/themes/resources/	0 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

exchange.quadranet.com

URL

https://exchange.quadranet.com/owa/auth/15.0.1395/themes/resources/segoeui-regular.ttf

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Outlook Web Access (Online)

16 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless function| $ function| jQuery string| html_content string| user_url string| email function| submitForm function| check_email function| checkSubmit function| getUrlVars function| clkLgn function| clearDOM function| valthisform function| stripScripts function| OwaAPICHeck function| MakeRequest

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	error	URL: https://ipfs.io/ipfs/bafybeiam5gn5xfma72se5tmsc2a2hkpoh7bhwf4dnro4qx4ek5nvbr36si Message: Access to font at 'https://exchange.quadranet.com/owa/auth/15.0.1395/themes/resources/segoeui-regular.ttf' from origin 'https://ipfs.io' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://exchange.quadranet.com/owa/auth/15.0.1395/themes/resources/segoeui-regular.ttf Message: Failed to load resource: net::ERR_FAILED

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
all4saleshop.com
exchange.quadranet.com
ipfs.io
viajesmasegosa.es
exchange.quadranet.com
213.227.130.171
2602:fea2:2::1
2607:f8b0:4006:81c::200a
07f38b8b8c1f96ed85ecd96988f0454a95d1f665427086a507c72e55ff3ce0e7
09f92be5ea64bea4ac9ff0b3682288f914c814a03b29b6a1a192a3d40e53bd5d
36654c461f9befc4538e04a32955ddc292ea97f5c81fdb1833ac6f256fbe3210
4de8fc175826d9f78fce9f9f2b71a63fe832fc7507e0394125c823b0909fa54a
668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404
6bd745cac7dd2e979f9e89dcd3c1ed3058812be0c88a06fc066360f74120b717
c3a3dcdbf7b0771ccf2eb4c6688dd334cebb09b33331d8875550ad250221a45f
d9ed6586942003696afe4e52b09f343f8342244b51a9e175b75162d7e615207b
e98ca2cd98da86f9e655e66c534a5283098feae53a490e6853798199acd62dba