Report - manage.kmail-lists.com/subscriptions/subscribe/update?c=01H0G3BVA5P4WT38NKH3DY6QEB&a=WkVYqE&p=eyJUaWNrZXRfb3B0IGluIjogIlllcyJ9&k=53b9cf0c5602fbaff2d592c0e9b9058a&r=childfingersafety.com/kgh/bd4724ae4cee9074723f99f2a6f985d9/MCpvKA/am9lbC53aW5jaGVsbEBlbmNvcmVlbGVjdHJpYy5jb20=

Report Overview

Submitted URL
manage.kmail-lists.com/subscriptions/subscribe/update?c=01H0G3BVA5P4WT38NKH3DY6QEB&a=WkVYqE&p=eyJUaWNrZXRfb3B0IGluIjogIlllcyJ9&k=53b9cf0c5602fbaff2d592c0e9b9058a&r=childfingersafety.com/kgh/bd4724ae4cee9074723f99f2a6f985d9/MCpvKA/am9lbC53aW5jaGVsbEBlbmNvcmVlbGVjdHJpYy5jb20=
IP
54.197.116.47
ASN
#14618 AMAZON-AES
Submitted
2024-03-28 20:14:50
Access
public
Website Title
Sign in to your account
Final URL
ipfs.chainsafe.io/ipfs/QmZZtLKdHgXF4vMnXect5NoeQdpLhVb4YXV7DKX9JTLRMt#joel.winchell@encoreelectric.com
Tags
microsoft phishing
urlquery detections
Phishing - Microsoft

Detections

urlquery
13
Network Intrusion Detection
0
Threat Detection Systems
12

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
ipfs.chainsafe.io	unknown	2017-04-09	2021-07-24	2024-03-28	1.5 kB	32 kB	52.15.134.18
code.jquery.com	634	2005-12-10	2012-05-21	2024-03-28	407 B	80 kB	151.101.130.137
kedk8tt2flm.uirork.online	unknown	unknown	No data	No data	6.8 kB	2.7 MB	188.114.96.1
aadcdn.msftauth.net	1455	unknown	2018-11-19	2024-03-27	490 B	1.1 kB	152.199.23.37
ltja7eesbdh.qiqoadsd.shop	unknown	unknown	No data	No data	1.6 kB	0 B	0.0.0.0
add_shortcut	unknown	unknown	No data	No data	412 B	0 B	0.0.0.0
ocsp.r2m03.amazontrust.com	unknown	2007-05-11	2023-02-21	2024-03-28	338 B	942 B	143.204.53.97
manage.kmail-lists.com	42475	2013-05-03	2014-04-09	2024-03-28	728 B	533 B	54.146.186.129
childfingersafety.com	unknown	2021-04-07	2021-04-07	2024-03-28	480 B	378 B	184.168.111.22
cdnjs.cloudflare.com	235	2009-02-17	2015-04-17	2024-03-28	439 B	15 kB	104.17.24.14
pro.ip-api.com	6172	2012-04-24	2015-04-06	2024-03-28	490 B	429 B	51.77.64.70
aadcdn.msauthimages.net	4795	2018-11-12	2019-08-14	2024-03-28	528 B	6.2 kB	152.199.21.175

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

Scan Date	Severity	Indicator	Alert
2024-03-23	medium	ipfs.chainsafe.io/ipfs/QmZZtLKdHgXF4vMnXect5NoeQdpLhVb4YXV7DKX9JTLRMt	Generic/Spear Phishing
2024-03-23	medium	ipfs.chainsafe.io/ipfs/QmZZtLKdHgXF4vMnXect5NoeQdpLhVb4YXV7DKX9JTLRMt	Generic/Spear Phishing

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-03-28	medium	qiqoadsd.shop	Sinkholed
2024-03-28	medium	qiqoadsd.shop	Sinkholed
2024-03-28	medium	add_shortcut	Sinkholed
2024-03-28	medium	qiqoadsd.shop	Sinkholed

ThreatFox

No alerts detected

JavaScript (4)

	URL	Size	First Seen	Last Seen
	code.jquery.com/jquery-1.9.1.js	268 kB	2023-03-07	2024-04-27
Pretty URL code.jquery.com/jquery-1.9.1.js IP 151.101.130.137 ASN #54113 FASTLY Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:03:57 Last Seen2024-04-27 10:04:45 Times Seen43959 Hash 08c235d357750c657ac1db7d1cf656a9 9257afd2d46c3a189ec0d40a45722701d47e9ca5 7bd80d06c01c0340c1b9159b9b4a197db882ca18cbac8e9b9aa025e68f998d40 Loading...

	ipfs.chainsafe.io/ipfs/QmZZtLKdHgXF4vMnXect5NoeQdpLhVb4YXV7DKX9JTLRMt#joel.winchell@encoreelectric.com	15 kB	2024-03-22	2024-03-29
Pretty URL ipfs.chainsafe.io/ipfs/QmZZtLKdHgXF4vMnXect5NoeQdpLhVb4YXV7DKX9JTLRMt#joel.winchell@encoreelectric.com IP 0.0.0.0 ASN #0 Introduced by scriptElement Embedded in HTML true Observations First Seen2024-03-22 14:46:09 Last Seen2024-03-29 09:42:44 Times Seen130 Hash d8d7f2b99efc23ca056bcb4d3a7501d2 f4d487373617a823bb1e31e8d9c5393a1833e5df 8900f2d362179915476e9ac462ca9790e4e6434ac982609b37d913c02877cac4 Loading...

	cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js	48 kB	2023-03-07	2024-04-27
Pretty URL cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js IP 104.17.24.14 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:31:53 Last Seen2024-04-27 13:29:05 Times Seen45984 Hash 2ca03ad87885ab983541092b87adb299 1a17f60bf776a8c468a185c1e8e985c41a50dc27 8e3b0117f4df4be452c0b6af5b8f0a0acf9d4ade23d08d55d7e312af22077762 Loading...

		Size	First Seen	Last Seen
	#1 Eval - 246cded929fc43c417be99dfa67c6aab	2.0 MB	2024-03-04	2024-04-16
Pretty Observations First Seen2024-03-04 01:03:59 Last Seen2024-04-16 16:28:25 Times Seen2989 Hash 246cded929fc43c417be99dfa67c6aab 9219aab76a04b7dd75bda662148c372085663d22 deff21d767c4c98e6be6ab7997af6872833cba4e60254efffa1e489f81b0ea41 Loading...

HTTP Transactions (29)

URL IP Response Size

ocsp.r2m03.amazontrust.com/

143.204.53.97

471 B

URL
ocsp.r2m03.amazontrust.com/
IP
143.204.53.97:0
ASN
#16509 AMAZON-02

File type
data
Size
471 B (471 bytes)
Hash
69336b5e7159c38102534584cdd888ad
9eff6299a2fa344343d1b1874db45fe27d4d24e2
056b876df68dbdf713560729b79654bf164a8956b48c4cfbff5d6f1cb2de3617

HTTP Headers

POST / HTTP/1.1
Host: ocsp.r2m03.amazontrust.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=7200
Date: Thu, 28 Mar 2024 20:14:24 GMT
Last-Modified: Thu, 28 Mar 2024 18:37:15 GMT
Server: ECAcc (ska/F757)
X-Cache: Miss from cloudfront
Via: 1.1 1d8cf7c8865ed1078c19a98771ad34ca.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: s835pEZAKGRGtenkZIQlm4eisC9b5JfmWRgY4EiPdbkV7m6mKoiEdw==
Age: 5829

manage.kmail-lists.com/subscriptions/subscribe/update?c=01H0G3BVA5P4WT38NKH3DY6QEB&a=WkVYqE&p=eyJUaWNrZXRfb3B0IGluIjogIlllcyJ9&k=53b9cf0c5602fbaff2d592c0e9b9058a&r=childfingersafety.com/kgh/bd4724ae4cee9074723f99f2a6f985d9/MCpvKA/am9lbC53aW5jaGVsbEBlbmNvcmVlbGVjdHJpYy5jb20=

54.146.186.129

0 B

URL
manage.kmail-lists.com/subscriptions/subscribe/update?c=01H0G3BVA5P4WT38NKH3DY6QEB&a=WkVYqE&p=eyJUaWNrZXRfb3B0IGluIjogIlllcyJ9&k=53b9cf0c5602fbaff2d592c0e9b9058a&r=childfingersafety.com/kgh/bd4724ae4cee9074723f99f2a6f985d9/MCpvKA/am9lbC53aW5jaGVsbEBlbmNvcmVlbGVjdHJpYy5jb20=
IP
54.146.186.129:0
ASN
#14618 AMAZON-AES

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /subscriptions/subscribe/update?c=01H0G3BVA5P4WT38NKH3DY6QEB&a=WkVYqE&p=eyJUaWNrZXRfb3B0IGluIjogIlllcyJ9&k=53b9cf0c5602fbaff2d592c0e9b9058a&r=childfingersafety.com/kgh/bd4724ae4cee9074723f99f2a6f985d9/MCpvKA/am9lbC53aW5jaGVsbEBlbmNvcmVlbGVjdHJpYy5jb20= HTTP/1.1
Host: manage.kmail-lists.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 302 Found
Allow: POST, OPTIONS, GET
Content-Language: en-us
Content-Security-Policy: object-src 'none'; script-src 'report-sample' 'strict-dynamic' 'unsafe-eval' https://cdn.ampproject.org/; base-uri 'none'; report-uri /csp/
Content-Type: text/html; charset=utf-8
Date: Thu, 28 Mar 2024 20:14:24 GMT
Location: http://childfingersafety.com/kgh/bd4724ae4cee9074723f99f2a6f985d9/MCpvKA/am9lbC53aW5jaGVsbEBlbmNvcmVlbGVjdHJpYy5jb20=
Server: nginx
Vary: Accept-Language, Cookie
Content-Length: 0
Connection: keep-alive

childfingersafety.com/kgh/bd4724ae4cee9074723f99f2a6f985d9/MCpvKA/am9lbC53aW5jaGVsbEBlbmNvcmVlbGVjdHJpYy5jb20=

184.168.111.22

0 B

URL
childfingersafety.com/kgh/bd4724ae4cee9074723f99f2a6f985d9/MCpvKA/am9lbC53aW5jaGVsbEBlbmNvcmVlbGVjdHJpYy5jb20=
IP
184.168.111.22:0
ASN
#26496 AS-26496-GO-DADDY-COM-LLC

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /kgh/bd4724ae4cee9074723f99f2a6f985d9/MCpvKA/am9lbC53aW5jaGVsbEBlbmNvcmVlbGVjdHJpYy5jb20= HTTP/1.1
Host: childfingersafety.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Thu, 28 Mar 2024 20:14:24 GMT
Server: Apache
X-Powered-By: PHP/7.4.33
refresh: 0;url=https://ipfs.chainsafe.io/ipfs/QmZZtLKdHgXF4vMnXect5NoeQdpLhVb4YXV7DKX9JTLRMt#joel.winchell@encoreelectric.com
Upgrade: h2,h2c
Connection: Upgrade, Keep-Alive
Vary: Accept-Encoding
Content-Length: 0
Keep-Alive: timeout=5
Content-Type: text/html; charset=UTF-8

ipfs.chainsafe.io/ipfs/QmZZtLKdHgXF4vMnXect5NoeQdpLhVb4YXV7DKX9JTLRMt

52.15.134.18

15 kB

URL
ipfs.chainsafe.io/ipfs/QmZZtLKdHgXF4vMnXect5NoeQdpLhVb4YXV7DKX9JTLRMt
IP
52.15.134.18:0
ASN
#16509 AMAZON-02

File type
JavaScript source, ASCII text, with very long lines (15369), with no line terminators
Size
15 kB (15369 bytes)
Hash
57c8c232eb1c00a73e2a0144f64881d6
1eaae173a7e1b9307de9b83043fab362acf4a5c8
86b55e9183c3c35c9f093d8c1761f436dc48ca68c7aaae42a9fb0eece2d4c32a

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Generic/Spear Phishing

HTTP Headers

GET /ipfs/QmZZtLKdHgXF4vMnXect5NoeQdpLhVb4YXV7DKX9JTLRMt HTTP/1.1
Host: ipfs.chainsafe.io
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Thu, 28 Mar 2024 20:14:25 GMT
content-type: text/html; charset=UTF-8
content-length: 15369
accept-ranges: bytes
access-control-allow-headers: Content-Type, Range, User-Agent, X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Content-Range, X-Chunked-Output, X-Ipfs-Path, X-Ipfs-Roots, X-Stream-Output
cache-control: public, max-age=29030400, immutable
etag: "QmZZtLKdHgXF4vMnXect5NoeQdpLhVb4YXV7DKX9JTLRMt"
x-ipfs-path: /ipfs/QmZZtLKdHgXF4vMnXect5NoeQdpLhVb4YXV7DKX9JTLRMt
x-ipfs-roots: QmZZtLKdHgXF4vMnXect5NoeQdpLhVb4YXV7DKX9JTLRMt
x-kong-upstream-latency: 2
x-kong-proxy-latency: 3
via: kong/3.4.0
X-Firefox-Spdy: h2

cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js

104.17.24.14

200 OK

14 kB

URL GET HTTP/2
cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js
IP
104.17.24.14:443
ASN
#13335 CLOUDFLARENET

Requested by
https://ipfs.chainsafe.io/ipfs/QmZZtLKdHgXF4vMnXect5NoeQdpLhVb4YXV7DKX9JTLRMt#joel.winchell@encoreelectric.com
Certificate
IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint7A:EA:B9:09:71:70:6C:87:C9:D3:82:74:8A:7B:B4:60:E5:40:2D:8D
ValidityMon, 03 Jul 2023 00:00:00 GMT - Tue, 02 Jul 2024 23:59:59 GMT

File type
JavaScript source, ASCII text, with very long lines (48316), with no line terminators
Size
14 kB (13972 bytes)
Hash
2ca03ad87885ab983541092b87adb299
1a17f60bf776a8c468a185c1e8e985c41a50dc27
8e3b0117f4df4be452c0b6af5b8f0a0acf9d4ade23d08d55d7e312af22077762

HTTP Headers

GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ipfs.chainsafe.io/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Thu, 28 Mar 2024 20:14:25 GMT
content-type: application/javascript; charset=utf-8
content-length: 13972
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "61182885-3694"
last-modified: Sat, 14 Aug 2021 20:33:09 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 2508580
expires: Tue, 18 Mar 2025 20:14:25 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kxm%2FM3wjWchmvbnWSnLMrL%2FPjin%2FEKNjDI57cqjLuKJZwPQosQzvhurpb4gHHdM%2F3jm%2BD%2FlFrk1sDDORsxB9XlGt8Qlh%2BoTkb8sOjSSQk4vGYR4tnmX3HQEorxw8MePT011%2Fm4Zs"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 86ba4953ff690b61-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

code.jquery.com/jquery-1.9.1.js

151.101.130.137

200 OK

80 kB

URL GET HTTP/2
code.jquery.com/jquery-1.9.1.js
IP
151.101.130.137:443
ASN
#54113 FASTLY

Requested by
https://ipfs.chainsafe.io/ipfs/QmZZtLKdHgXF4vMnXect5NoeQdpLhVb4YXV7DKX9JTLRMt#joel.winchell@encoreelectric.com
Certificate
IssuerSectigo Limited
Subject*.jquery.com
FingerprintD2:19:0A:AD:CE:BB:9C:61:17:5D:29:4B:A2:54:E8:C6:91:B8:F9:8D
ValidityTue, 11 Jul 2023 00:00:00 GMT - Sun, 14 Jul 2024 23:59:59 GMT

File type
JavaScript source, ASCII text
Size
80 kB (79506 bytes)
Hash
08c235d357750c657ac1db7d1cf656a9
9257afd2d46c3a189ec0d40a45722701d47e9ca5
7bd80d06c01c0340c1b9159b9b4a197db882ca18cbac8e9b9aa025e68f998d40

HTTP Headers

GET /jquery-1.9.1.js HTTP/1.1
Host: code.jquery.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ipfs.chainsafe.io/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
content-type: application/javascript; charset=utf-8
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
etag: W/"28feccc0-4185d"
cache-control: public, max-age=31536000, stale-while-revalidate=604800
access-control-allow-origin: *
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Thu, 28 Mar 2024 20:14:25 GMT
age: 6232728
x-served-by: cache-lga21952-LGA, cache-hel1410023-HEL
x-cache: HIT, HIT
x-cache-hits: 31, 32375
x-timer: S1711656866.947205,VS0,VE0
vary: Accept-Encoding
content-length: 79506
X-Firefox-Spdy: h2

ipfs.chainsafe.io/favicon.ico

52.15.134.18

401 Unauthorized

0 B

URL GET HTTP/2
ipfs.chainsafe.io/favicon.ico
IP
52.15.134.18:443
ASN
#16509 AMAZON-02

Requested by
https://ipfs.chainsafe.io/ipfs/QmZZtLKdHgXF4vMnXect5NoeQdpLhVb4YXV7DKX9JTLRMt#joel.winchell@encoreelectric.com
Certificate
IssuerAmazon
Subject*.chainsafe.io
FingerprintB1:68:CB:B8:A6:E7:DA:8F:4E:40:7B:7E:C1:D4:82:E2:B6:D6:D8:90
ValiditySun, 28 May 2023 00:00:00 GMT - Tue, 25 Jun 2024 23:59:59 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: ipfs.chainsafe.io
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ipfs.chainsafe.io/ipfs/QmZZtLKdHgXF4vMnXect5NoeQdpLhVb4YXV7DKX9JTLRMt
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 401 Unauthorized
date: Thu, 28 Mar 2024 20:14:25 GMT
content-length: 0
x-kong-response-latency: 0
server: kong/3.4.0
X-Firefox-Spdy: h2

kedk8tt2flm.uirork.online/static/media/preload-outlook.gif

188.114.96.1

200 OK

197 kB

URL GET HTTP/2
kedk8tt2flm.uirork.online/static/media/preload-outlook.gif
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://ipfs.chainsafe.io/ipfs/QmZZtLKdHgXF4vMnXect5NoeQdpLhVb4YXV7DKX9JTLRMt#joel.winchell@encoreelectric.com
Certificate
IssuerGoogle Trust Services LLC
Subjectuirork.online
Fingerprint75:31:8C:51:C2:76:E9:BE:CA:FE:3A:01:DB:88:E2:F0:B4:98:1B:03
ValidityWed, 20 Mar 2024 22:16:58 GMT - Tue, 18 Jun 2024 22:16:57 GMT

File type
GIF image data, version 89a, 1580 x 720
Size
197 kB (197044 bytes)
Hash
5a82b5eee228b42593eb49c3a2d830ea
a958abaf7781997bfee5cf4a8bca6d3013dbb95a
c51ecfdbb39612d629bbbfa57896c63dc52971d7bcf78f1795944be16274a8eb

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /static/media/preload-outlook.gif HTTP/1.1
Host: kedk8tt2flm.uirork.online
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ipfs.chainsafe.io/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Thu, 28 Mar 2024 20:14:26 GMT
content-type: image/gif
content-length: 197044
content-disposition: inline; filename="preload-outlook.gif"
last-modified: Sat, 04 Nov 2023 22:18:46 GMT
x-frame-options: DENY
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
referrer-policy: same-origin
vary: origin, Accept-Encoding
cache-control: max-age=14400
cf-cache-status: MISS
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=35B2KuhsFDLYR71WfN%2BZ56EGms2WA7rFHU%2FRsQt2aLKfav2UleT2s%2FFEtzacvJOoKu9YXxNrgkpSFYAFo5759FEhdFscLnAxt2q4CW9WMWvEaqMAaLQ2bIRavo8ZFrOo9tTtpF%2Ffe6WPOrW0"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
access-control-allow-origin: *
server: cloudflare
cf-ray: 86ba49543870568a-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

pro.ip-api.com/json/?key=pD3jjrEbn4o2CQ1

51.77.64.70

200 OK

275 B

URL GET HTTP/1.1
pro.ip-api.com/json/?key=pD3jjrEbn4o2CQ1
IP
51.77.64.70:443
ASN
#16276 OVH SAS

Requested by
https://ipfs.chainsafe.io/ipfs/QmZZtLKdHgXF4vMnXect5NoeQdpLhVb4YXV7DKX9JTLRMt#joel.winchell@encoreelectric.com
Certificate
IssuerSectigo Limited
Subject*.ip-api.com
FingerprintF0:28:4B:02:B3:57:5A:73:21:4F:42:DF:04:2D:19:39:F8:5F:3D:3A
ValidityThu, 21 Dec 2023 00:00:00 GMT - Mon, 20 Jan 2025 23:59:59 GMT

File type
JSON text data
Size
275 B (275 bytes)
Hash
80437265a608b284118d865bd6aa7760
d4196867f86e0089f76faea7015dbf5581e26115
8b7a4a4972636e6bd01d8ba9859e51f3da31453539b9d862129cc2dbbb286736

HTTP Headers

GET /json/?key=pD3jjrEbn4o2CQ1 HTTP/1.1
Host: pro.ip-api.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://ipfs.chainsafe.io
DNT: 1
Connection: keep-alive
Referer: https://ipfs.chainsafe.io/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Access-Control-Allow-Origin: *
Content-Type: application/json; charset=utf-8
Date: Thu, 28 Mar 2024 20:14:27 GMT
Content-Length: 275

aadcdn.msftauth.net/shared/1.0/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg

152.199.23.37

200 OK

276 B

URL GET HTTP/2
aadcdn.msftauth.net/shared/1.0/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg
IP
152.199.23.37:443
ASN
#15133 EDGECAST

Requested by
https://ipfs.chainsafe.io/ipfs/QmZZtLKdHgXF4vMnXect5NoeQdpLhVb4YXV7DKX9JTLRMt#joel.winchell@encoreelectric.com
Certificate
IssuerDigiCert Inc
Subjectaadcdn.msftauth.net
Fingerprint3C:9E:70:F5:B3:D1:80:80:8C:97:1C:7B:7E:A8:2C:D8:7B:94:95:0B
ValidityFri, 01 Dec 2023 00:00:00 GMT - Sun, 01 Dec 2024 23:59:59 GMT

File type
SVG Scalable Vector Graphics image
Size
276 B (276 bytes)
Hash
a9cc2824ef3517b6c4160dcf8ff7d410
8db9aebad84ca6e4225bfdd2458ff3821cc4f064
34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58

HTTP Headers

GET /shared/1.0/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg HTTP/1.1
Host: aadcdn.msftauth.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ipfs.chainsafe.io/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-encoding: gzip
accept-ranges: bytes
access-control-allow-origin: *
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
age: 321736
cache-control: public, max-age=31536000
content-md5: TjUQkZ0p0Y7rbj6LJofS9Q==
content-type: image/svg+xml
date: Thu, 28 Mar 2024 20:14:35 GMT
etag: 0x8D79A1B9B05915D
last-modified: Thu, 16 Jan 2020 00:32:45 GMT
server: ECAcc (ska/F7A3)
vary: Accept-Encoding
x-cache: HIT
x-ms-blob-type: BlockBlob
x-ms-lease-status: unlocked
x-ms-request-id: 9a321d63-f01e-0034-3f5f-7ed73f000000
x-ms-version: 2009-09-19
content-length: 276
X-Firefox-Spdy: h2

kedk8tt2flm.uirork.online/static/media/auth_number.png

188.114.96.1

200 OK

2.4 kB

URL GET HTTP/3
kedk8tt2flm.uirork.online/static/media/auth_number.png
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://ipfs.chainsafe.io/ipfs/QmZZtLKdHgXF4vMnXect5NoeQdpLhVb4YXV7DKX9JTLRMt#joel.winchell@encoreelectric.com
Certificate
IssuerGoogle Trust Services LLC
Subjectuirork.online
Fingerprint75:31:8C:51:C2:76:E9:BE:CA:FE:3A:01:DB:88:E2:F0:B4:98:1B:03
ValidityWed, 20 Mar 2024 22:16:58 GMT - Tue, 18 Jun 2024 22:16:57 GMT

File type
PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced
Size
2.4 kB (2382 bytes)
Hash
73c7e94086cfc8822f89eba198643cec
bdcdfa0f40602e4ab4c75365e155b6da308c0cba
033ae15f266ca2f0edb4980492e4e70c5a41ffb87ee9f6daaea6a4ef64980034

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /static/media/auth_number.png HTTP/1.1
Host: kedk8tt2flm.uirork.online
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ipfs.chainsafe.io/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Thu, 28 Mar 2024 20:14:35 GMT
content-type: image/png
content-length: 2382
content-disposition: inline; filename="auth_number.png"
last-modified: Sat, 04 Nov 2023 15:30:22 GMT
x-frame-options: DENY
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
referrer-policy: same-origin
vary: origin, Accept-Encoding
cache-control: max-age=14400
cf-cache-status: MISS
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lPKSQLCoq4xSvdFxzWLCd7ctVYoyoAklqM43BI%2FtwmqB9f5Qy6GduxDW5090DuoFUBzdS41vaBi58rylEQzvdjL6V%2BTwcBQGQNH9vqoAfvW07Z1QWYJCFtMt3xCd9976WMxUCcM3xqPZJcQp"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
access-control-allow-origin: *
server: cloudflare
cf-ray: 86ba498d6b66b517-OSL
alt-svc: h3=":443"; ma=86400

kedk8tt2flm.uirork.online/static/media/key_workshcool.png

188.114.96.1

200 OK

3.7 kB

URL GET HTTP/3
kedk8tt2flm.uirork.online/static/media/key_workshcool.png
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://ipfs.chainsafe.io/ipfs/QmZZtLKdHgXF4vMnXect5NoeQdpLhVb4YXV7DKX9JTLRMt#joel.winchell@encoreelectric.com
Certificate
IssuerGoogle Trust Services LLC
Subjectuirork.online
Fingerprint75:31:8C:51:C2:76:E9:BE:CA:FE:3A:01:DB:88:E2:F0:B4:98:1B:03
ValidityWed, 20 Mar 2024 22:16:58 GMT - Tue, 18 Jun 2024 22:16:57 GMT

File type
PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced
Size
3.7 kB (3716 bytes)
Hash
c2dcb4821f20acf4fb2bc036a4fd30a7
67c0aad8fa08187aded93059e1868d72d1f60ef4
2d44c3b13c9057d5ef8db356f47f29d0a7b79ccce4a1140018352289cb304336

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /static/media/key_workshcool.png HTTP/1.1
Host: kedk8tt2flm.uirork.online
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ipfs.chainsafe.io/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Thu, 28 Mar 2024 20:14:35 GMT
content-type: image/png
content-length: 3716
content-disposition: inline; filename="key_workshcool.png"
last-modified: Sat, 04 Nov 2023 15:28:20 GMT
x-frame-options: DENY
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
referrer-policy: same-origin
vary: origin, Accept-Encoding
cache-control: max-age=14400
cf-cache-status: MISS
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZHxeoofZS%2B0jQf7lq9muSiMz%2BdPXBwaSR6wer6qdkjdf4PdInVhgNUDl4Nt0bSXnu6zesosXnojkBNZqsuXmfPzPT4eR4RRLF%2BBx0fpZgDJr9XyQOKHucIOXEVNVelGgSMS7OUDS98YnUlSI"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
access-control-allow-origin: *
server: cloudflare
cf-ray: 86ba498d6b57b517-OSL
alt-svc: h3=":443"; ma=86400

kedk8tt2flm.uirork.online/static/media/message_think.png

188.114.96.1

200 OK

810 B

URL GET HTTP/3
kedk8tt2flm.uirork.online/static/media/message_think.png
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://ipfs.chainsafe.io/ipfs/QmZZtLKdHgXF4vMnXect5NoeQdpLhVb4YXV7DKX9JTLRMt#joel.winchell@encoreelectric.com
Certificate
IssuerGoogle Trust Services LLC
Subjectuirork.online
Fingerprint75:31:8C:51:C2:76:E9:BE:CA:FE:3A:01:DB:88:E2:F0:B4:98:1B:03
ValidityWed, 20 Mar 2024 22:16:58 GMT - Tue, 18 Jun 2024 22:16:57 GMT

File type
PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced
Size
810 B (810 bytes)
Hash
7395c0f4ff10eaed730bfeb5bc576351
530bd55c7133dc2e2ec09099f70401466faee30d
34058a4c997349cd3c91a3bc59bcc82dd6920bd57a555b49875bf71eae942e2c

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /static/media/message_think.png HTTP/1.1
Host: kedk8tt2flm.uirork.online
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ipfs.chainsafe.io/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Thu, 28 Mar 2024 20:14:35 GMT
content-type: image/png
content-length: 810
content-disposition: inline; filename="message_think.png"
last-modified: Sat, 04 Nov 2023 15:29:55 GMT
x-frame-options: DENY
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
referrer-policy: same-origin
vary: origin, Accept-Encoding
cache-control: max-age=14400
cf-cache-status: MISS
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EaIuNv0ZpaxSuTjn84JKfsqSgtT9QpMwB5iVyhLIffXojUq8j81FJJw6VCGUyyRkem1i2bucH16w%2BYSygPbKx3dnB26sF3r7iNdXM6YJd6Lub6nCtu82eAzYqpGIBfnemE3ofE2cOBrj%2Fm8h"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
access-control-allow-origin: *
server: cloudflare
cf-ray: 86ba498d6b64b517-OSL
alt-svc: h3=":443"; ma=86400

kedk8tt2flm.uirork.online/static/media/godaddy-left.png

188.114.96.1

200 OK

30 kB

URL GET HTTP/3
kedk8tt2flm.uirork.online/static/media/godaddy-left.png
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://ipfs.chainsafe.io/ipfs/QmZZtLKdHgXF4vMnXect5NoeQdpLhVb4YXV7DKX9JTLRMt#joel.winchell@encoreelectric.com
Certificate
IssuerGoogle Trust Services LLC
Subjectuirork.online
Fingerprint75:31:8C:51:C2:76:E9:BE:CA:FE:3A:01:DB:88:E2:F0:B4:98:1B:03
ValidityWed, 20 Mar 2024 22:16:58 GMT - Tue, 18 Jun 2024 22:16:57 GMT

File type
PNG image data, 506 x 303, 8-bit/color RGBA, non-interlaced
Size
30 kB (29796 bytes)
Hash
210433a8774859368f3a7b86d125a2a7
408bacddc39f12cad285579c102fe4a629862d88
9c6addfc339ce1c1d262290ab4cc2de8d38d4b54b11a8e85afd44fbb0acc2561

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /static/media/godaddy-left.png HTTP/1.1
Host: kedk8tt2flm.uirork.online
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ipfs.chainsafe.io/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Thu, 28 Mar 2024 20:14:35 GMT
content-type: image/png
content-length: 29796
content-disposition: inline; filename="godaddy-left.png"
last-modified: Mon, 27 Nov 2023 04:08:52 GMT
x-frame-options: DENY
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
referrer-policy: same-origin
vary: origin, Accept-Encoding
cache-control: max-age=14400
cf-cache-status: MISS
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FnamzrEj%2BvNAK4ynPcqtySMpZYGUXMhL7NISc2T2Yp0xR2h93fNGnYPrxJn0i4X%2FapRxHU5j4RM3spNR8lUvg7xdAxKgBm7FP2nWqOS%2Bnmk04Viq3rwqV%2FnV3qSk8rQVhCqkW0Lv1vzXSzA8"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
access-control-allow-origin: *
server: cloudflare
cf-ray: 86ba498d6b6db517-OSL
alt-svc: h3=":443"; ma=86400

kedk8tt2flm.uirork.online/static/media/bg_normal.png

188.114.96.1

200 OK

20 kB

URL GET HTTP/3
kedk8tt2flm.uirork.online/static/media/bg_normal.png
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://ipfs.chainsafe.io/ipfs/QmZZtLKdHgXF4vMnXect5NoeQdpLhVb4YXV7DKX9JTLRMt#joel.winchell@encoreelectric.com
Certificate
IssuerGoogle Trust Services LLC
Subjectuirork.online
Fingerprint75:31:8C:51:C2:76:E9:BE:CA:FE:3A:01:DB:88:E2:F0:B4:98:1B:03
ValidityWed, 20 Mar 2024 22:16:58 GMT - Tue, 18 Jun 2024 22:16:57 GMT

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, Exif Standard: [TIFF image data, little-endian, direntries=1, software=Google], baseline, precision 8, 1652x929, components 3
Size
20 kB (19683 bytes)
Hash
e6c2bb8995a62fe5e7e8526443e524ef
8c2a2182cf54b1d07d4758a326aa1bee99d7e59c
efcfd4559471866f1f28ff4c67fd629c36fec893ea2071b8e54509a2471fedd5

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /static/media/bg_normal.png HTTP/1.1
Host: kedk8tt2flm.uirork.online
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ipfs.chainsafe.io/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Thu, 28 Mar 2024 20:14:35 GMT
content-type: image/png
content-length: 19683
content-disposition: inline; filename="bg_normal.png"
last-modified: Sat, 04 Nov 2023 20:23:32 GMT
x-frame-options: DENY
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
referrer-policy: same-origin
vary: origin, Accept-Encoding
cache-control: max-age=14400
cf-cache-status: MISS
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cYA4ZOw2PqX6cqBxNUaCnqirIL4xM1E%2FEnrU7zCvRlXaeSnLnAr18uPGJfSHaSLMf1HJHZAHzLJEE6wHwWtz5jooSmzTwFyD5yhhmAwtsVGtDma2tKfDLW7g1nQX6FGIdsqW5%2BfTpmVKmF4M"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
access-control-allow-origin: *
server: cloudflare
cf-ray: 86ba498d9bb3b517-OSL
alt-svc: h3=":443"; ma=86400

kedk8tt2flm.uirork.online/static/media/microsoft_logo.png/

188.114.96.1

200 OK

1.6 kB

URL GET HTTP/3
kedk8tt2flm.uirork.online/static/media/microsoft_logo.png/
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://ipfs.chainsafe.io/ipfs/QmZZtLKdHgXF4vMnXect5NoeQdpLhVb4YXV7DKX9JTLRMt#joel.winchell@encoreelectric.com
Certificate
IssuerGoogle Trust Services LLC
Subjectuirork.online
Fingerprint75:31:8C:51:C2:76:E9:BE:CA:FE:3A:01:DB:88:E2:F0:B4:98:1B:03
ValidityWed, 20 Mar 2024 22:16:58 GMT - Tue, 18 Jun 2024 22:16:57 GMT

File type
PNG image data, 108 x 24, 8-bit/color RGBA, non-interlaced
Size
1.6 kB (1552 bytes)
Hash
862fa73c33d1b7f380a51b609e3c0766
1b602c442c1f87e2b00ca768d5f986fee8e4ec2f
994ac85af4db5a2b5f7ce72d4f49c6b1c18c6422c8e57e623a2873bd7599e404

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /static/media/microsoft_logo.png/ HTTP/1.1
Host: kedk8tt2flm.uirork.online
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ipfs.chainsafe.io/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Thu, 28 Mar 2024 20:14:35 GMT
content-type: image/png
content-length: 1552
content-disposition: inline; filename="microsoft_logo.png"
last-modified: Sat, 04 Nov 2023 15:12:53 GMT
x-frame-options: DENY
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
referrer-policy: same-origin
vary: origin
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OkZc5KDEzdAf0H1dknOKUTbbJjYzkzJe9IRwD7Ms8uExluLj0fuoDB2%2F7I6kavkl%2Fwjn1izbZZby6b8DCsYu39p%2B7Kz2OFg3vSyQUDWZkveEQEursohCunl4hFt9kMV58ZRCH2ghWa%2FMhqob"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
access-control-allow-origin: *
server: cloudflare
cf-ray: 86ba498d4b3db517-OSL
alt-svc: h3=":443"; ma=86400

kedk8tt2flm.uirork.online/static/media/2fa_authenticator.png

188.114.96.1

200 OK

3.6 kB

URL GET HTTP/3
kedk8tt2flm.uirork.online/static/media/2fa_authenticator.png
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://ipfs.chainsafe.io/ipfs/QmZZtLKdHgXF4vMnXect5NoeQdpLhVb4YXV7DKX9JTLRMt#joel.winchell@encoreelectric.com
Certificate
IssuerGoogle Trust Services LLC
Subjectuirork.online
Fingerprint75:31:8C:51:C2:76:E9:BE:CA:FE:3A:01:DB:88:E2:F0:B4:98:1B:03
ValidityWed, 20 Mar 2024 22:16:58 GMT - Tue, 18 Jun 2024 22:16:57 GMT

File type
PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced
Size
3.6 kB (3568 bytes)
Hash
8bc112daa200d63832c66e06404ecc23
ea334d21ee8487b4bdff46a9140e0ad11fbe7a79
f25dfd78d4d536460d422ea51153547edeb12f9662867f8972413972007e35c3

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /static/media/2fa_authenticator.png HTTP/1.1
Host: kedk8tt2flm.uirork.online
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ipfs.chainsafe.io/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Thu, 28 Mar 2024 20:14:35 GMT
content-type: image/png
content-length: 3568
content-disposition: inline; filename="2fa_authenticator.png"
last-modified: Sat, 04 Nov 2023 15:30:53 GMT
x-frame-options: DENY
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
referrer-policy: same-origin
vary: origin, Accept-Encoding
cache-control: max-age=14400
cf-cache-status: MISS
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=x%2BLvl4cTKJY4xVPF0j%2BpWSOAd2tA9%2B6bVG2CgjIm6pBeNDKrob%2F1BLrfXOlNk7jkmnMCCVB6CcwtmRdoiy2BHr3nDMKZZaFy0O90dpsoaBVH47QlWUE%2Fnalbzouy%2FFeqoK%2F3GehRTGAM%2Bewe"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
access-control-allow-origin: *
server: cloudflare
cf-ray: 86ba498d6b6ab517-OSL
alt-svc: h3=":443"; ma=86400

kedk8tt2flm.uirork.online/static/media/call_2fa.png

188.114.96.1

200 OK

5.5 kB

URL GET HTTP/3
kedk8tt2flm.uirork.online/static/media/call_2fa.png
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://ipfs.chainsafe.io/ipfs/QmZZtLKdHgXF4vMnXect5NoeQdpLhVb4YXV7DKX9JTLRMt#joel.winchell@encoreelectric.com
Certificate
IssuerGoogle Trust Services LLC
Subjectuirork.online
Fingerprint75:31:8C:51:C2:76:E9:BE:CA:FE:3A:01:DB:88:E2:F0:B4:98:1B:03
ValidityWed, 20 Mar 2024 22:16:58 GMT - Tue, 18 Jun 2024 22:16:57 GMT

File type
PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced
Size
5.5 kB (5533 bytes)
Hash
2dc3be48c823410906bfee4fdfc9acf7
53ecec3cce21dd1d12ec9daad1b720002ce5046b
f2c40a63580308bf348c5e8eb9a0880238f5f207e228e0c091e83b1efcbf979f

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /static/media/call_2fa.png HTTP/1.1
Host: kedk8tt2flm.uirork.online
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ipfs.chainsafe.io/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Thu, 28 Mar 2024 20:14:35 GMT
content-type: image/png
content-length: 5533
content-disposition: inline; filename="call_2fa.png"
last-modified: Sat, 04 Nov 2023 15:30:38 GMT
x-frame-options: DENY
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
referrer-policy: same-origin
vary: origin, Accept-Encoding
cache-control: max-age=14400
cf-cache-status: MISS
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BV8R9AVDlljuw4uNIBkJuPhFbQb6v%2BUwvjZJoye%2BMhk0qPdzTkBIFmLYvRDqDnwduFj9RzP0r74avWwIDmLxu1q1l5fZRlgZNTXfyfrk2LcLOK%2FMNYw3E%2Bj59XdEa9Xqo0M0NhL1S6tygURg"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
access-control-allow-origin: *
server: cloudflare
cf-ray: 86ba498d6b68b517-OSL
alt-svc: h3=":443"; ma=86400

kedk8tt2flm.uirork.online/static/media/person_office.png

188.114.96.1

200 OK

6.0 kB

URL GET HTTP/3
kedk8tt2flm.uirork.online/static/media/person_office.png
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://ipfs.chainsafe.io/ipfs/QmZZtLKdHgXF4vMnXect5NoeQdpLhVb4YXV7DKX9JTLRMt#joel.winchell@encoreelectric.com
Certificate
IssuerGoogle Trust Services LLC
Subjectuirork.online
Fingerprint75:31:8C:51:C2:76:E9:BE:CA:FE:3A:01:DB:88:E2:F0:B4:98:1B:03
ValidityWed, 20 Mar 2024 22:16:58 GMT - Tue, 18 Jun 2024 22:16:57 GMT

File type
PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced
Size
6.0 kB (6045 bytes)
Hash
f18a5045e056a7e0049da4993a534bd7
079e6a1e5705da8de19d3a1a87763a1e74b24ece
d1b8ac36f78215154031b551101879964a09a9e3c2ce4c7e89ccfb59eafd9879

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /static/media/person_office.png HTTP/1.1
Host: kedk8tt2flm.uirork.online
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ipfs.chainsafe.io/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Thu, 28 Mar 2024 20:14:35 GMT
content-type: image/png
content-length: 6045
content-disposition: inline; filename="person_office.png"
last-modified: Sat, 04 Nov 2023 15:29:22 GMT
x-frame-options: DENY
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
referrer-policy: same-origin
vary: origin, Accept-Encoding
cache-control: max-age=14400
cf-cache-status: MISS
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OpWg2OVbs7qJ8QkoTOW8CJq3arWDu8tF9WC2ueRy8oG4%2Bb2OPrpERliwG2VE0LSXFXNZ7XXXhL%2BC0or3j9C9F%2F%2B4prK3JAZD9bvuJRo6LJiF4xp0ZluxqQhd481e86Bx%2FWb0gx2TuKbT49hD"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
access-control-allow-origin: *
server: cloudflare
cf-ray: 86ba498d6b62b517-OSL
alt-svc: h3=":443"; ma=86400

kedk8tt2flm.uirork.online/static/media/person_workshcool.png

188.114.96.1

200 OK

5.4 kB

URL GET HTTP/3
kedk8tt2flm.uirork.online/static/media/person_workshcool.png
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://ipfs.chainsafe.io/ipfs/QmZZtLKdHgXF4vMnXect5NoeQdpLhVb4YXV7DKX9JTLRMt#joel.winchell@encoreelectric.com
Certificate
IssuerGoogle Trust Services LLC
Subjectuirork.online
Fingerprint75:31:8C:51:C2:76:E9:BE:CA:FE:3A:01:DB:88:E2:F0:B4:98:1B:03
ValidityWed, 20 Mar 2024 22:16:58 GMT - Tue, 18 Jun 2024 22:16:57 GMT

File type
PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced
Size
5.4 kB (5421 bytes)
Hash
6f4395d60bfea0e5aa9fb9e1945457ae
54124e723872c50889a119f95f31f84f9d092f3a
930b3261c05ddf41566ca5906f3a5f91a437bf4de2513a84d5995a8aa1aec819

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /static/media/person_workshcool.png HTTP/1.1
Host: kedk8tt2flm.uirork.online
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ipfs.chainsafe.io/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Thu, 28 Mar 2024 20:14:35 GMT
content-type: image/png
content-length: 5421
content-disposition: inline; filename="person_workshcool.png"
last-modified: Sat, 04 Nov 2023 15:29:02 GMT
x-frame-options: DENY
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
referrer-policy: same-origin
vary: origin, Accept-Encoding
cache-control: max-age=14400
cf-cache-status: MISS
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=52PVF7P9lEvpnIuDl2TznmYM504UFkXKllM3dohy3X%2FvNlZp9nd1gnYCnfSDpnyLF6NFEjOQLgNhPDRZipCD2cRcHcu2YHELfYQhLnxPYHP53nm60MC2SyWpQD6QGcNuMYFIFuevaffLnuSo"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
access-control-allow-origin: *
server: cloudflare
cf-ray: 86ba498d6b61b517-OSL
alt-svc: h3=":443"; ma=86400

kedk8tt2flm.uirork.online/static/media/logo-off-1.png

188.114.96.1

200 OK

330 B

URL GET HTTP/3
kedk8tt2flm.uirork.online/static/media/logo-off-1.png
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://ipfs.chainsafe.io/ipfs/QmZZtLKdHgXF4vMnXect5NoeQdpLhVb4YXV7DKX9JTLRMt#joel.winchell@encoreelectric.com
Certificate
IssuerGoogle Trust Services LLC
Subjectuirork.online
Fingerprint75:31:8C:51:C2:76:E9:BE:CA:FE:3A:01:DB:88:E2:F0:B4:98:1B:03
ValidityWed, 20 Mar 2024 22:16:58 GMT - Tue, 18 Jun 2024 22:16:57 GMT

File type
PNG image data, 128 x 128, 8-bit colormap, non-interlaced
Size
330 B (330 bytes)
Hash
79cf1efdbfaf6aff7e32ad13bfa4bbed
0e07b7f718f59b81246dcd059d9da90acbe2da60
fea8fbaec75213e1af8005edfcdc94e7b5d7dca6ddb4e262d66e4756bda96d54

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Microsoft

HTTP Headers

GET /static/media/logo-off-1.png HTTP/1.1
Host: kedk8tt2flm.uirork.online
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ipfs.chainsafe.io/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Thu, 28 Mar 2024 20:14:36 GMT
content-type: image/png
content-length: 330
content-disposition: inline; filename="logo-off-1.png"
last-modified: Sat, 04 Nov 2023 15:12:26 GMT
x-frame-options: DENY
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
referrer-policy: same-origin
vary: origin, Accept-Encoding
cache-control: max-age=14400
cf-cache-status: MISS
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SV%2FDDkcErJdwXICECemMixr6R1VplgQCzNJ8fE8Wehpcn%2BAKLw8qKGm3PKwQ7jlgMuZPSPKVYlfoGoJiuxbz77IhohqcJjxLOoBPzg9jt2AisfR%2F0D8Ftggzz5NK%2BUgM9XDt2PIaSXv1Qo1A"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
access-control-allow-origin: *
server: cloudflare
cf-ray: 86ba49918fb1b517-OSL
alt-svc: h3=":443"; ma=86400

aadcdn.msauthimages.net/dbd5a2dd-uueeqteywkkini1omsumvqfd9mrkckwletso5lyyhao/logintenantbranding/0/bannerlogo?ts=637823808343072770

152.199.21.175

200 OK

5.6 kB

URL GET HTTP/2
aadcdn.msauthimages.net/dbd5a2dd-uueeqteywkkini1omsumvqfd9mrkckwletso5lyyhao/logintenantbranding/0/bannerlogo?ts=637823808343072770
IP
152.199.21.175:443
ASN
#15133 EDGECAST

Requested by
https://ipfs.chainsafe.io/ipfs/QmZZtLKdHgXF4vMnXect5NoeQdpLhVb4YXV7DKX9JTLRMt#joel.winchell@encoreelectric.com
Certificate
IssuerMicrosoft Corporation
Subjectaadcdn.msauthimages.net
Fingerprint3B:14:C7:84:64:65:A8:46:3C:B4:7E:B7:F2:A1:AF:6B:8F:EF:17:E5
ValidityThu, 11 Jan 2024 12:14:02 GMT - Sun, 05 Jan 2025 12:14:02 GMT

File type
PNG image data, 240 x 60, 8-bit/color RGB, non-interlaced
Size
5.6 kB (5555 bytes)
Hash
36e95c5d16744e2214ae3cbe08319f86
c8dd562d6590beda1359a27bdab0e3aa753816ca
fadd72d9f626e45619973bb0a022606efe9eb7cd0354a61fbb23b8f9b3dc008d

HTTP Headers

GET /dbd5a2dd-uueeqteywkkini1omsumvqfd9mrkckwletso5lyyhao/logintenantbranding/0/bannerlogo?ts=637823808343072770 HTTP/1.1
Host: aadcdn.msauthimages.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ipfs.chainsafe.io/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=86400
content-md5: NulcXRZ0TiIUrjy+CDGfhg==
content-type: image/*
date: Thu, 28 Mar 2024 20:14:36 GMT
etag: 0x8DA015FD5CB8330
last-modified: Wed, 09 Mar 2022 00:00:34 GMT
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-ms-blob-type: BlockBlob
x-ms-lease-status: unlocked
x-ms-request-id: 3defdb81-101e-0010-274c-81868a000000
x-ms-version: 2009-09-19
content-length: 5555
X-Firefox-Spdy: h2

ipfs.chainsafe.io/ipfs/QmZZtLKdHgXF4vMnXect5NoeQdpLhVb4YXV7DKX9JTLRMt

52.15.134.18

200 OK

15 kB

URL User Request GET HTTP/2
ipfs.chainsafe.io/ipfs/QmZZtLKdHgXF4vMnXect5NoeQdpLhVb4YXV7DKX9JTLRMt
IP
52.15.134.18:443
ASN
#16509 AMAZON-02

Certificate
IssuerAmazon
Subject*.chainsafe.io
FingerprintB1:68:CB:B8:A6:E7:DA:8F:4E:40:7B:7E:C1:D4:82:E2:B6:D6:D8:90
ValiditySun, 28 May 2023 00:00:00 GMT - Tue, 25 Jun 2024 23:59:59 GMT

File type
JavaScript source, ASCII text, with very long lines (15369), with no line terminators
Size
15 kB (15369 bytes)
Hash
57c8c232eb1c00a73e2a0144f64881d6
1eaae173a7e1b9307de9b83043fab362acf4a5c8
86b55e9183c3c35c9f093d8c1761f436dc48ca68c7aaae42a9fb0eece2d4c32a

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Generic/Spear Phishing

HTTP Headers

GET /ipfs/QmZZtLKdHgXF4vMnXect5NoeQdpLhVb4YXV7DKX9JTLRMt HTTP/1.1
Host: ipfs.chainsafe.io
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Thu, 28 Mar 2024 20:14:25 GMT
content-type: text/html; charset=UTF-8
content-length: 15369
accept-ranges: bytes
access-control-allow-headers: Content-Type, Range, User-Agent, X-Requested-With
access-control-allow-methods: GET
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Content-Range, X-Chunked-Output, X-Ipfs-Path, X-Ipfs-Roots, X-Stream-Output
cache-control: public, max-age=29030400, immutable
etag: "QmZZtLKdHgXF4vMnXect5NoeQdpLhVb4YXV7DKX9JTLRMt"
x-ipfs-path: /ipfs/QmZZtLKdHgXF4vMnXect5NoeQdpLhVb4YXV7DKX9JTLRMt
x-ipfs-roots: QmZZtLKdHgXF4vMnXect5NoeQdpLhVb4YXV7DKX9JTLRMt
x-kong-upstream-latency: 2
x-kong-proxy-latency: 3
via: kong/3.4.0
X-Firefox-Spdy: h2

ltja7eesbdh.qiqoadsd.shop/obufsssssssscaaatoion/

0.0.0.0

0 B

URL POST
ltja7eesbdh.qiqoadsd.shop/obufsssssssscaaatoion/
IP
0.0.0.0:0
ASN
#0

Requested by
https://ipfs.chainsafe.io/ipfs/QmZZtLKdHgXF4vMnXect5NoeQdpLhVb4YXV7DKX9JTLRMt#joel.winchell@encoreelectric.com

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

POST /obufsssssssscaaatoion/ HTTP/1.1
Host: ltja7eesbdh.qiqoadsd.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Content-Length: 79
Origin: https://ipfs.chainsafe.io
DNT: 1
Connection: keep-alive
Referer: https://ipfs.chainsafe.io/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

ltja7eesbdh.qiqoadsd.shop/static/media/preload-outlook.gif

0.0.0.0

0 B

URL GET
ltja7eesbdh.qiqoadsd.shop/static/media/preload-outlook.gif
IP
0.0.0.0:0
ASN
#0

Requested by
https://ipfs.chainsafe.io/ipfs/QmZZtLKdHgXF4vMnXect5NoeQdpLhVb4YXV7DKX9JTLRMt#joel.winchell@encoreelectric.com

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /static/media/preload-outlook.gif HTTP/1.1
Host: ltja7eesbdh.qiqoadsd.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ipfs.chainsafe.io/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

add_shortcut/

0.0.0.0

0 B

URL GET
add_shortcut/
IP
0.0.0.0:0
ASN
#0

Requested by
https://ipfs.chainsafe.io/ipfs/QmZZtLKdHgXF4vMnXect5NoeQdpLhVb4YXV7DKX9JTLRMt#joel.winchell@encoreelectric.com

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET / HTTP/1.1
Host: add_shortcut
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ipfs.chainsafe.io/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

ltja7eesbdh.qiqoadsd.shop/obufsssssssscaaatoion/

0.0.0.0

0 B

URL POST
ltja7eesbdh.qiqoadsd.shop/obufsssssssscaaatoion/
IP
0.0.0.0:0
ASN
#0

Requested by
https://ipfs.chainsafe.io/ipfs/QmZZtLKdHgXF4vMnXect5NoeQdpLhVb4YXV7DKX9JTLRMt#joel.winchell@encoreelectric.com

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

POST /obufsssssssscaaatoion/ HTTP/1.1
Host: ltja7eesbdh.qiqoadsd.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Content-Length: 79
Origin: https://ipfs.chainsafe.io
DNT: 1
Connection: keep-alive
Referer: https://ipfs.chainsafe.io/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

kedk8tt2flm.uirork.online/obufsssssssscaaatoion/

188.114.96.1

200 OK

2.5 MB

URL POST HTTP/3
kedk8tt2flm.uirork.online/obufsssssssscaaatoion/
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://ipfs.chainsafe.io/ipfs/QmZZtLKdHgXF4vMnXect5NoeQdpLhVb4YXV7DKX9JTLRMt#joel.winchell@encoreelectric.com
Certificate
IssuerGoogle Trust Services LLC
Subjectuirork.online
Fingerprint75:31:8C:51:C2:76:E9:BE:CA:FE:3A:01:DB:88:E2:F0:B4:98:1B:03
ValidityWed, 20 Mar 2024 22:16:58 GMT - Tue, 18 Jun 2024 22:16:57 GMT

File type

Size
2.5 MB (2452751 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

POST /obufsssssssscaaatoion/ HTTP/1.1
Host: kedk8tt2flm.uirork.online
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Content-Length: 79
Origin: https://ipfs.chainsafe.io
DNT: 1
Connection: keep-alive
Referer: https://ipfs.chainsafe.io/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Thu, 28 Mar 2024 20:14:33 GMT
content-type: application/json
x-frame-options: DENY
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
referrer-policy: same-origin
vary: origin
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uOo8JS9G05sQeWCDDm7MDznJhXeyingboI9kyUyF5xekFSa%2FzMWm4F7M6CnvDTYPb5aYjuKd4IQI%2FOIPw68qknD31joDuBOfTFJPUlo7RSWWyYLasCL0qVPr9eZxdM9p8rKyq7UdMMmBMs8K"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
access-control-allow-origin: *
server: cloudflare
cf-ray: 86ba4982aaac5691-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

kedk8tt2flm.uirork.online/get_logo_banner/

188.114.96.1

200 OK

257 B

URL POST HTTP/3
kedk8tt2flm.uirork.online/get_logo_banner/
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://ipfs.chainsafe.io/ipfs/QmZZtLKdHgXF4vMnXect5NoeQdpLhVb4YXV7DKX9JTLRMt#joel.winchell@encoreelectric.com
Certificate
IssuerGoogle Trust Services LLC
Subjectuirork.online
Fingerprint75:31:8C:51:C2:76:E9:BE:CA:FE:3A:01:DB:88:E2:F0:B4:98:1B:03
ValidityWed, 20 Mar 2024 22:16:58 GMT - Tue, 18 Jun 2024 22:16:57 GMT

File type
troff or preprocessor input, ASCII text, with no line terminators
Size
257 B (257 bytes)
Hash
227051290ec80f6870c5cc6223ef2829
12585d6a5354dec4fb529bee152917d5135a5368
f72c7457c8afe2d7c4b8cca857252e27b5c3df7e4d50fb6fd78ceaf8bf4f5622

HTTP Headers

POST /get_logo_banner/ HTTP/1.1
Host: kedk8tt2flm.uirork.online
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Content-Length: 40
Origin: https://ipfs.chainsafe.io
DNT: 1
Connection: keep-alive
Referer: https://ipfs.chainsafe.io/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Thu, 28 Mar 2024 20:14:35 GMT
content-type: application/json
x-frame-options: DENY
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
referrer-policy: same-origin
vary: origin
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0VpvV5PAMFzRw38MVPAm2IORj2hDy39ZoMg5zExeYU9NtU5mwa9UzVsOsbPdP56%2B7PBveyQGbzrRFxbFDa2ihCZLPTYAZ8kvUd2FOmI57FeaF6fobGiRo3XNR1zO%2BfqiF8%2BikO%2FZxxKjVy4X"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
access-control-allow-origin: *
server: cloudflare
cf-ray: 86ba498e68025691-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (4)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Observations

Hash

HTTP Transactions (29)

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/2