Report - bmwag-rt-prod2-t.campaign.adobe.com/r/?id=h2ccc12b,8d23fb3,492093b&p1=//estrellitatienda.com/dhbdidoz/jdbdjdb/Y3R1c2FuQHNnYWR2aXNvcnMuY29t

Report Overview

Visited public
2023-11-27 18:37:53
Tags
URL
bmwag-rt-prod2-t.campaign.adobe.com/r/?id=h2ccc12b,8d23fb3,492093b&p1=//estrellitatienda.com/dhbdidoz/jdbdjdb/Y3R1c2FuQHNnYWR2aXNvcnMuY29t
Finishing URL
ipfs.io/ipfs/bafkreiba3qcopgjydiatrxfkz2b7wg4iyegflqudrcxfdtczxtl5ulriee#ctusan@sgadvisors.com
IP / ASN
52.215.148.88
#16509 AMAZON-02
Title
ipfs.io/ipfs/bafkreiba3qcopgjydiatrxfkz2b7wg4iyegflqudrcxfdtczxtl5ulriee#ctusan@sgadvisors.com

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
5s11pbzkt6b.gkalga.online	unknown	unknown	No data	No data	457 B	198 kB	172.67.203.118
pzpkjtky7kf.ygaigakg.online	unknown	unknown	No data	No data	459 B	198 kB	172.67.217.27
cdnjs.cloudflare.com	235	2009-02-17	2015-04-17 22:46:33	2023-11-27 07:34:07	443 B	49 kB	104.17.25.14
add_shortcut	unknown	unknown	No data	No data	414 B	0 B	0.0.0.0
bmwag-rt-prod2-t.campaign.adobe.com	unknown	1986-11-17	2020-10-06 11:33:48	2023-11-27 10:40:32	604 B	943 B	52.215.148.88
estrellitatienda.com	unknown	unknown	No data	No data	532 B	362 B	178.159.36.102
ipfs.io	41400	2014-05-16	2015-09-09 06:41:36	2023-11-27 01:57:53	1.7 kB	36 kB	209.94.90.1
code.jquery.com	634	2005-12-10	2012-05-21 19:28:02	2023-11-27 08:05:54	409 B	80 kB	151.101.2.137

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2023-11-27 18:37:40	medium	Client IP	Internal IP	ET INFO Peer-to-Peer File Sharing Service Domain in DNS Lookup (ipfs .io)
2023-11-27 18:37:40	medium	Client IP	Internal IP	ET INFO Peer-to-Peer File Sharing Service Domain in DNS Lookup (ipfs .io)
2023-11-27 18:37:40	medium	Client IP	209.94.90.1	ET INFO Observed Peer-to-Peer File Sharing Service Domain (ipfs .io in TLS SNI)

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2023-11-27	medium	add_shortcut	Sinkholed

ThreatFox

No alerts detected

JavaScript (1)

	URL	From	Size	First Seen	Last Seen
	ipfs.io/ipfs/bafkreiba3qcopgjydiatrxfkz2b7wg4iyegflqudrcxfdtczxtl5ulriee#ctusan@sgadvisors.com	ScriptElement	14 kB	2023-11-27	2024-08-20
Pretty URL ipfs.io/ipfs/bafkreiba3qcopgjydiatrxfkz2b7wg4iyegflqudrcxfdtczxtl5ulriee#ctusan@sgadvisors.com IP 0.0.0.0 ASN #0 Introduced by scriptElement Embedded in HTML true Observations First Seen2023-11-27 18:59 Last Seen2024-08-20 17:42 Times Seen6 Hash bc44abf51f6afddd6cad7757abdfd5d1 d63644030f11e319d77ff04c48cf592a2de636b1 72cd4b644e011e9adf9ca490e64cc6951db52737ef4cec64fdc2ce61808452f9 Loading...

HTTP Transactions (10)

URL IP Response Size

bmwag-rt-prod2-t.campaign.adobe.com/r/?id=h2ccc12b,8d23fb3,492093b&p1=//estrellitatienda.com/dhbdidoz/jdbdjdb/Y3R1c2FuQHNnYWR2aXNvcnMuY29t

52.215.148.88

17 B

URL
bmwag-rt-prod2-t.campaign.adobe.com/r/?id=h2ccc12b,8d23fb3,492093b&p1=//estrellitatienda.com/dhbdidoz/jdbdjdb/Y3R1c2FuQHNnYWR2aXNvcnMuY29t
IP
52.215.148.88:0
ASN
#16509 AMAZON-02

File type
ASCII text, with no line terminators
Size
17 B (17 bytes)
Hash
edf537e37d4549950774190c58f93b76
4e2078632eccec8993f151be9338bbcb88ce6f58
afff9c63cfeacd26e5d4000edf576f1386d6729dca783eb45004f484a73a3514

HTTP Headers

GET /r/?id=h2ccc12b,8d23fb3,492093b&p1=//estrellitatienda.com/dhbdidoz/jdbdjdb/Y3R1c2FuQHNnYWR2aXNvcnMuY29t HTTP/1.1
Host: bmwag-rt-prod2-t.campaign.adobe.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 302 Found
Content-Type: text/plain; charset=utf-8
Date: Mon, 27 Nov 2023 18:37:35 GMT
Location: https:////estrellitatienda.com/dhbdidoz/jdbdjdb/Y3R1c2FuQHNnYWR2aXNvcnMuY29t
P3P: CP="CAO DSP COR CURa DEVa TAIa OUR BUS IND UNI COM NAV"
Permissions-Policy: geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self),payment=()
Referrer-Policy: strict-origin
Server: Apache
Set-Cookie: AMCV_B52D1CFE5330949C0A490D45%40AdobeOrg=MCMID%7C66191303679556976632875548362076061695; Domain=adobe.com; Path=/; Expires=Sat, 21-Dec-2024 18:37:35 GMT
nlid=2ccc12b|8d23fb3; Domain=adobe.com; Path=/
nllastdelid=8d23fb3; Domain=adobe.com; Path=/; Expires=Sat, 21-Dec-2024 18:37:35 GMT
Strict-Transport-Security: max-age=63072000; includeSubdomains;
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-Robots-Tag: noindex
Content-Length: 17
Connection: keep-alive

estrellitatienda.com/dhbdidoz/jdbdjdb/Y3R1c2FuQHNnYWR2aXNvcnMuY29t

178.159.36.102

168 B

URL
estrellitatienda.com/dhbdidoz/jdbdjdb/Y3R1c2FuQHNnYWR2aXNvcnMuY29t
IP
178.159.36.102:0
ASN
#213058 Private Internet Hosting LTD

File type
HTML document, ASCII text
Size
168 B (168 bytes)
Hash
a47d5a470d3ab2ec0fb3efc04c020e53
cc77a09c3db26b1e54b80e489366b5f310520a7f
ae800ddcaa2e25c084475423ee21a664a0b32e104749475272099ba4a44f4dff

HTTP Headers

GET /dhbdidoz/jdbdjdb/Y3R1c2FuQHNnYWR2aXNvcnMuY29t HTTP/1.1
Host: estrellitatienda.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Mon, 27 Nov 2023 18:37:36 GMT
Server: Apache
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

ipfs.io/favicon.ico

209.94.90.1

301 Moved Permanently

166 B

URL GET HTTP/2
ipfs.io/favicon.ico
IP
209.94.90.1:443
ASN
#40680 PROTOCOL

Requested by
https://ipfs.io/ipfs/bafkreiba3qcopgjydiatrxfkz2b7wg4iyegflqudrcxfdtczxtl5ulriee#ctusan@sgadvisors.com
Certificate
IssuerLet's Encrypt
Subjectdweb.link
Fingerprint8B:0B:A0:28:A6:81:DF:E9:49:F0:E9:A3:20:69:C6:07:BE:D6:16:2C
ValidityMon, 20 Nov 2023 14:59:23 GMT - Sun, 18 Feb 2024 14:59:22 GMT

File type
HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Size
166 B (166 bytes)
Hash
3ea1c8d079b38532a6e01a96216ba5e2
598d3ff91d3e252f1e13df8cf0348b270ff2da3f
87a9323ac85ce28867d5d7ce590c8f29b8d1a999961fca71bb33adef48683691

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: ipfs.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ipfs.io/ipfs/bafkreiba3qcopgjydiatrxfkz2b7wg4iyegflqudrcxfdtczxtl5ulriee
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 301 Moved Permanently
server: openresty
date: Mon, 27 Nov 2023 18:37:36 GMT
content-type: text/html
content-length: 166
location: https://ipfs.tech/favicon.ico
access-control-allow-origin: *
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: X-Requested-With, Range, Content-Range, X-Chunked-Output, X-Stream-Output
access-control-expose-headers: Content-Range, X-Chunked-Output, X-Stream-Output
x-ipfs-lb-pop: gateway-bank1-fr2
x-bfid: f4caa330c561044069c50ce7c7067684
strict-transport-security: max-age=31536000; includeSubDomains; preload
X-Firefox-Spdy: h2

ipfs.io/ipfs/bafkreiba3qcopgjydiatrxfkz2b7wg4iyegflqudrcxfdtczxtl5ulriee

209.94.90.1

19 kB

URL
ipfs.io/ipfs/bafkreiba3qcopgjydiatrxfkz2b7wg4iyegflqudrcxfdtczxtl5ulriee
IP
209.94.90.1:0
ASN
#40680 PROTOCOL

Certificate
IssuerLet's Encrypt
Subjectdweb.link
Fingerprint8B:0B:A0:28:A6:81:DF:E9:49:F0:E9:A3:20:69:C6:07:BE:D6:16:2C
ValidityMon, 20 Nov 2023 14:59:23 GMT - Sun, 18 Feb 2024 14:59:22 GMT

File type
gzip compressed data, from Unix\012- data
Size
19 kB (19287 bytes)
Hash
3dad662be108d79154e34a4daadf173a
71a1409154726c88cfbfd859f41912916926c949
068f8c7976587a901e24937dcd191c0b22fc150376af6554208d44d3c53c4776

HTTP Headers

GET /ipfs/bafkreiba3qcopgjydiatrxfkz2b7wg4iyegflqudrcxfdtczxtl5ulriee HTTP/1.1
Host: ipfs.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://estrellitatienda.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: openresty
date: Mon, 27 Nov 2023 18:37:36 GMT
content-type: text/html
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, OPTIONS, GET, POST, OPTIONS
cache-control: public, max-age=29030400, immutable
etag: W/"bafkreiba3qcopgjydiatrxfkz2b7wg4iyegflqudrcxfdtczxtl5ulriee"
x-ipfs-gateway-host: ipfs-bank4-fr2
x-ipfs-path: /ipfs/bafkreiba3qcopgjydiatrxfkz2b7wg4iyegflqudrcxfdtczxtl5ulriee
x-ipfs-roots: bafkreiba3qcopgjydiatrxfkz2b7wg4iyegflqudrcxfdtczxtl5ulriee
x-ipfs-pop: ipfs-bank4-fr2
timing-allow-origin: *
x-ipfs-datasize: 14305
access-control-allow-origin: *
access-control-allow-headers: X-Requested-With, Range, Content-Range, X-Chunked-Output, X-Stream-Output
access-control-expose-headers: Content-Range, X-Chunked-Output, X-Stream-Output
x-ipfs-lb-pop: gateway-bank1-fr2
x-bfid: 9fc8fc145622f648582080710016f535
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-proxy-cache: MISS
content-encoding: gzip
X-Firefox-Spdy: h2

code.jquery.com/jquery-1.9.1.js

151.101.2.137

200 OK

80 kB

URL GET HTTP/2
code.jquery.com/jquery-1.9.1.js
IP
151.101.2.137:443
ASN
#54113 FASTLY

Requested by
https://ipfs.io/ipfs/bafkreiba3qcopgjydiatrxfkz2b7wg4iyegflqudrcxfdtczxtl5ulriee#ctusan@sgadvisors.com
Certificate
IssuerSectigo Limited
Subject*.jquery.com
FingerprintD2:19:0A:AD:CE:BB:9C:61:17:5D:29:4B:A2:54:E8:C6:91:B8:F9:8D
ValidityTue, 11 Jul 2023 00:00:00 GMT - Sun, 14 Jul 2024 23:59:59 GMT

File type
ASCII text
Size
80 kB (79506 bytes)
Hash
08c235d357750c657ac1db7d1cf656a9
9257afd2d46c3a189ec0d40a45722701d47e9ca5
7bd80d06c01c0340c1b9159b9b4a197db882ca18cbac8e9b9aa025e68f998d40

HTTP Headers

GET /jquery-1.9.1.js HTTP/1.1
Host: code.jquery.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ipfs.io/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
content-type: application/javascript; charset=utf-8
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
etag: W/"28feccc0-4185d"
cache-control: public, max-age=31536000, stale-while-revalidate=604800
access-control-allow-origin: *
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
date: Mon, 27 Nov 2023 18:37:36 GMT
age: 6309635
x-served-by: cache-lga21952-LGA, cache-bma1663-BMA
x-cache: HIT, HIT
x-cache-hits: 62, 41278
x-timer: S1701110257.876663,VS0,VE0
vary: Accept-Encoding
content-length: 79506
X-Firefox-Spdy: h2

5s11pbzkt6b.gkalga.online/static/media/preload-outlook.gif

172.67.203.118

200 OK

197 kB

URL GET HTTP/2
5s11pbzkt6b.gkalga.online/static/media/preload-outlook.gif
IP
172.67.203.118:443
ASN
#13335 CLOUDFLARENET

Requested by
https://ipfs.io/ipfs/bafkreiba3qcopgjydiatrxfkz2b7wg4iyegflqudrcxfdtczxtl5ulriee#ctusan@sgadvisors.com
Certificate
IssuerGoogle Trust Services LLC
Subjectgkalga.online
Fingerprint1F:82:AF:73:DC:31:49:4D:81:12:E8:C1:0E:E7:2A:B0:80:58:74:1B
ValidityWed, 22 Nov 2023 15:01:19 GMT - Tue, 20 Feb 2024 15:01:18 GMT

File type
GIF image data, version 89a, 1580 x 720\012- data
Size
197 kB (197044 bytes)
Hash
5a82b5eee228b42593eb49c3a2d830ea
a958abaf7781997bfee5cf4a8bca6d3013dbb95a
c51ecfdbb39612d629bbbfa57896c63dc52971d7bcf78f1795944be16274a8eb

HTTP Headers

GET /static/media/preload-outlook.gif HTTP/1.1
Host: 5s11pbzkt6b.gkalga.online
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ipfs.io/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Mon, 27 Nov 2023 18:37:37 GMT
content-type: image/gif
content-length: 197044
content-disposition: inline; filename="preload-outlook.gif"
last-modified: Sat, 04 Nov 2023 22:18:46 GMT
x-frame-options: DENY
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
referrer-policy: same-origin
vary: origin, Accept-Encoding
cache-control: max-age=14400
cf-cache-status: MISS
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3uN%2FU8VCVl014IXj0ODRt6V0Awk2L5AVVHag8HxkpYK0Vplapvs%2Bl4McuplrK0HZqppUg6hCEHplVTqVEX1FCnmn1KSsPXdMU2Fn32FCkO7lNlASYdZ4oF50UZeEGJoiQHoJD1qSJ8ZyhEXs"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 82cc7bc18fed56a9-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

pzpkjtky7kf.ygaigakg.online/static/media/preload-outlook.gif

172.67.217.27

200 OK

197 kB

URL GET HTTP/2
pzpkjtky7kf.ygaigakg.online/static/media/preload-outlook.gif
IP
172.67.217.27:443
ASN
#13335 CLOUDFLARENET

Requested by
https://ipfs.io/ipfs/bafkreiba3qcopgjydiatrxfkz2b7wg4iyegflqudrcxfdtczxtl5ulriee#ctusan@sgadvisors.com
Certificate
IssuerLet's Encrypt
Subjectygaigakg.online
FingerprintB2:AE:04:32:E8:81:88:E1:72:69:87:D7:6D:71:9F:F0:B4:97:56:CB
ValidityTue, 14 Nov 2023 21:10:14 GMT - Mon, 12 Feb 2024 21:10:13 GMT

File type
GIF image data, version 89a, 1580 x 720\012- data
Size
197 kB (197044 bytes)
Hash
5a82b5eee228b42593eb49c3a2d830ea
a958abaf7781997bfee5cf4a8bca6d3013dbb95a
c51ecfdbb39612d629bbbfa57896c63dc52971d7bcf78f1795944be16274a8eb

HTTP Headers

GET /static/media/preload-outlook.gif HTTP/1.1
Host: pzpkjtky7kf.ygaigakg.online
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ipfs.io/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Mon, 27 Nov 2023 18:37:37 GMT
content-type: image/gif
content-length: 197044
content-disposition: inline; filename="preload-outlook.gif"
last-modified: Sat, 04 Nov 2023 22:18:46 GMT
x-frame-options: DENY
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
referrer-policy: same-origin
vary: origin, Accept-Encoding
cache-control: max-age=14400
cf-cache-status: MISS
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=V%2FWEu8jZ0uqi1ly0zR7ENbcyHErQwi3dL8uxotu%2Bs7mppGvvQXqqmPhNoRpiT%2FRtPwBQpJhrTJ1RinxrxGoXCFdRxd8tZNtT05yyDUMvbqbIzX13oUIaqdPViuzEQ%2BtGgiPk9eQ5coU6Qk9CFk0%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 82cc7bc199f55684-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js

104.17.25.14

200 OK

48 kB

URL GET HTTP/2
cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js
IP
104.17.25.14:443
ASN
#13335 CLOUDFLARENET

Requested by
https://ipfs.io/ipfs/bafkreiba3qcopgjydiatrxfkz2b7wg4iyegflqudrcxfdtczxtl5ulriee#ctusan@sgadvisors.com
Certificate
IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint7A:EA:B9:09:71:70:6C:87:C9:D3:82:74:8A:7B:B4:60:E5:40:2D:8D
ValidityMon, 03 Jul 2023 00:00:00 GMT - Tue, 02 Jul 2024 23:59:59 GMT

File type
ASCII text, with very long lines (48316), with no line terminators
Size
48 kB (48316 bytes)
Hash
2ca03ad87885ab983541092b87adb299
1a17f60bf776a8c468a185c1e8e985c41a50dc27
8e3b0117f4df4be452c0b6af5b8f0a0acf9d4ade23d08d55d7e312af22077762

HTTP Headers

GET /ajax/libs/crypto-js/4.1.1/crypto-js.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ipfs.io/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Mon, 27 Nov 2023 18:37:36 GMT
content-type: application/javascript; charset=utf-8
content-length: 13972
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "61182885-3694"
last-modified: Sat, 14 Aug 2021 20:33:09 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 317512
expires: Sat, 16 Nov 2024 18:37:36 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EJeGcS8x48V5qTgvcODPvxLNh4QlicdQM2wSDu%2FtvBd8RhzR0TOP6rQr3rs9WVtSmB%2Bjy6sNbi7QaqzfesmQIupE7ciNvmbI%2BCH%2Bx1jiFmpwjoG%2BL8l4KTPfEKA9ZPTk80SYvTIJ"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 82cc7bc178380b49-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

ipfs.io/ipfs/bafkreiba3qcopgjydiatrxfkz2b7wg4iyegflqudrcxfdtczxtl5ulriee

209.94.90.1

200 OK

14 kB

URL User Request GET HTTP/2
ipfs.io/ipfs/bafkreiba3qcopgjydiatrxfkz2b7wg4iyegflqudrcxfdtczxtl5ulriee
IP
209.94.90.1:443
ASN
#40680 PROTOCOL

Certificate
IssuerLet's Encrypt
Subjectdweb.link
Fingerprint8B:0B:A0:28:A6:81:DF:E9:49:F0:E9:A3:20:69:C6:07:BE:D6:16:2C
ValidityMon, 20 Nov 2023 14:59:23 GMT - Sun, 18 Feb 2024 14:59:22 GMT

File type
HTML document, ASCII text, with very long lines (14305), with no line terminators
Size
14 kB (14305 bytes)
Hash
65b2b37c4aaa4476c000de79c4f3f229
f65fbc5592354419477f860b81deb19234f270ff
20dc04e799381a0138dcaace83fb1b88c10c55c28388ae51cc59bcd7da2e2821

HTTP Headers

GET /ipfs/bafkreiba3qcopgjydiatrxfkz2b7wg4iyegflqudrcxfdtczxtl5ulriee HTTP/1.1
Host: ipfs.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://estrellitatienda.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: openresty
date: Mon, 27 Nov 2023 18:37:36 GMT
content-type: text/html
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, OPTIONS, GET, POST, OPTIONS
cache-control: public, max-age=29030400, immutable
etag: W/"bafkreiba3qcopgjydiatrxfkz2b7wg4iyegflqudrcxfdtczxtl5ulriee"
x-ipfs-gateway-host: ipfs-bank4-fr2
x-ipfs-path: /ipfs/bafkreiba3qcopgjydiatrxfkz2b7wg4iyegflqudrcxfdtczxtl5ulriee
x-ipfs-roots: bafkreiba3qcopgjydiatrxfkz2b7wg4iyegflqudrcxfdtczxtl5ulriee
x-ipfs-pop: ipfs-bank4-fr2
timing-allow-origin: *
x-ipfs-datasize: 14305
access-control-allow-origin: *
access-control-allow-headers: X-Requested-With, Range, Content-Range, X-Chunked-Output, X-Stream-Output
access-control-expose-headers: Content-Range, X-Chunked-Output, X-Stream-Output
x-ipfs-lb-pop: gateway-bank1-fr2
x-bfid: 9fc8fc145622f648582080710016f535
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-proxy-cache: MISS
content-encoding: gzip
X-Firefox-Spdy: h2

add_shortcut/

0.0.0.0

0 B

URL GET
add_shortcut/
IP
0.0.0.0:0
ASN
#0

Requested by
https://ipfs.io/ipfs/bafkreiba3qcopgjydiatrxfkz2b7wg4iyegflqudrcxfdtczxtl5ulriee#ctusan@sgadvisors.com

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET / HTTP/1.1
Host: add_shortcut
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ipfs.io/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (1)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (10)

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL

IP

ASN

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/2