urlscan.io logo urlscan.io
SecurityTrails logo

pub-ac7c2ee2784d41ac91a1feef98615b2c.r2.dev Open in urlscan Pro
104.18.3.35  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://pub-320778df5f504f5389d38ac70216cf19.r2.dev/index.html
Effective URL: https://pub-ac7c2ee2784d41ac91a1feef98615b2c.r2.dev/index.html
Submission Tags: @phish_report
Submission: On May 28 via api from FI — Scanned from FI
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 2 countries across 8 domains to perform 6 HTTP transactions. The main IP is 104.18.3.35, located in and belongs to CLOUDFLARENET, US. The main domain is pub-ac7c2ee2784d41ac91a1feef98615b2c.r2.dev.
TLS certificate: Issued by E1 on April 5th 2024. Valid for: 3 months.
This is the only time pub-ac7c2ee2784d41ac91a1feef98615b2c.r2.dev was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
3 104.18.3.35 13335 (CLOUDFLAR...)
1 1 172.67.75.122 13335 (CLOUDFLAR...)
2 2 66.29.145.52 22612 (NAMECHEAP...)
2 2 172.67.176.174 13335 (CLOUDFLAR...)
2 2 188.114.96.3 ()
6 2
3    104.18.3.35 (None, )

ASN13335 (CLOUDFLARENET, US)
pub-320778df5f504f5389d38ac70216cf19.r2.dev
pub-ac7c2ee2784d41ac91a1feef98615b2c.r2.dev
1    172.67.75.122 (United States)

ASN13335 (CLOUDFLARENET, US)
t.ly
2    66.29.145.52 (United States)

ASN22612 (NAMECHEAP-NET, US)
tly.mrusco.com
2    172.67.176.174 (United States)

ASN13335 (CLOUDFLARENET, US)
ma-seok-do.xyz
2    188.114.96.3 (None, )

ASN- ()
ma-dongseok.xyz
Apex Domain
Subdomains		 Transfer
3 r2.dev
pub-320778df5f504f5389d38ac70216cf19.r2.dev
pub-ac7c2ee2784d41ac91a1feef98615b2c.r2.dev
27 KB
2 ma-dongseok.xyz
ma-dongseok.xyz
455 B
2 ma-seok-do.xyz
ma-seok-do.xyz
437 B
2 mrusco.com
tly.mrusco.com
527 B
1 t.ly
t.ly — Cisco Umbrella Rank: 45098
1 KB
0 ampproject.org Failed
cdn.ampproject.org Failed
0 googleapis.com Failed
fonts.googleapis.com Failed
0 imagedelivery.net Failed
imagedelivery.net Failed
6 8
Domain Requested by
2 ma-dongseok.xyz 2 redirects
2 ma-seok-do.xyz 2 redirects
2 tly.mrusco.com 2 redirects
2 pub-320778df5f504f5389d38ac70216cf19.r2.dev
1 pub-ac7c2ee2784d41ac91a1feef98615b2c.r2.dev
1 t.ly 1 redirects
0 cdn.ampproject.org Failed pub-ac7c2ee2784d41ac91a1feef98615b2c.r2.dev
0 fonts.googleapis.com Failed pub-ac7c2ee2784d41ac91a1feef98615b2c.r2.dev
0 imagedelivery.net Failed pub-ac7c2ee2784d41ac91a1feef98615b2c.r2.dev
6 9

This site contains no links.

Subject Issuer Validity Valid
*.r2.dev
E1		 2024-04-05 -
2024-07-04		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://pub-ac7c2ee2784d41ac91a1feef98615b2c.r2.dev/index.html
Frame ID: C666E7BDB13899F6D82FA60883B7AF93
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://pub-320778df5f504f5389d38ac70216cf19.r2.dev/index.html Page URL
  2. https://t.ly/Jivb6 HTTP 302
    http://tly.mrusco.com/hogiak HTTP 307
    https://tly.mrusco.com/hogiak HTTP 302
    https://ma-seok-do.xyz/ HTTP 301
    https://ma-dongseok.xyz/ HTTP 301
    https://pub-ac7c2ee2784d41ac91a1feef98615b2c.r2.dev/index.html HTTP 307
    http://tly.mrusco.com/hogiak HTTP 302
    https://ma-seok-do.xyz/ HTTP 301
    https://ma-dongseok.xyz/ HTTP 301
    https://pub-ac7c2ee2784d41ac91a1feef98615b2c.r2.dev/index.html Page URL

Page Statistics

6
Requests

50 %
HTTPS

0 %
IPv6

8
Domains

9
Subdomains

2
IPs

2
Countries

27 kB
Transfer

42 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://pub-320778df5f504f5389d38ac70216cf19.r2.dev/index.html Page URL
  2. https://t.ly/Jivb6 HTTP 302
    http://tly.mrusco.com/hogiak HTTP 307
    https://tly.mrusco.com/hogiak HTTP 302
    https://ma-seok-do.xyz/ HTTP 301
    https://ma-dongseok.xyz/ HTTP 301
    https://pub-ac7c2ee2784d41ac91a1feef98615b2c.r2.dev/index.html HTTP 307
    http://tly.mrusco.com/hogiak HTTP 302
    https://ma-seok-do.xyz/ HTTP 301
    https://ma-dongseok.xyz/ HTTP 301
    https://pub-ac7c2ee2784d41ac91a1feef98615b2c.r2.dev/index.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
index.html
pub-320778df5f504f5389d38ac70216cf19.r2.dev/ 		127 B
436 B 		Document
General
Check archive.org
Download Go to
Full URL
https://pub-320778df5f504f5389d38ac70216cf19.r2.dev/index.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
104.18.3.35 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Accept-Language
fi-FI,fi;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

Accept-Ranges
bytes
CF-RAY
88b14373aff64e13-HEL
Connection
keep-alive
Content-Length
127
Content-Type
text/html
Date
Tue, 28 May 2024 21:16:02 GMT
ETag
"7c40829259dd78a020ea1afb5851dabf"
Last-Modified
Wed, 01 May 2024 00:33:48 GMT
Server
cloudflare
Vary
Accept-Encoding
Primary Request index.html
pub-ac7c2ee2784d41ac91a1feef98615b2c.r2.dev/
Redirect Chain
  • https://t.ly/Jivb6
  • http://tly.mrusco.com/hogiak
  • https://tly.mrusco.com/hogiak
  • https://ma-seok-do.xyz/
  • https://ma-dongseok.xyz/
  • https://pub-ac7c2ee2784d41ac91a1feef98615b2c.r2.dev/index.html
  • http://tly.mrusco.com/hogiak
  • https://ma-seok-do.xyz/
  • https://ma-dongseok.xyz/
  • https://pub-ac7c2ee2784d41ac91a1feef98615b2c.r2.dev/index.html
15 KB
0 		Document
General
Check archive.org
Download Go to
Full URL
https://pub-ac7c2ee2784d41ac91a1feef98615b2c.r2.dev/index.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
104.18.3.35 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Accept-Language
fi-FI,fi;q=0.9;q=0.9
Referer
https://pub-320778df5f504f5389d38ac70216cf19.r2.dev/index.html
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

Accept-Ranges
bytes
CF-RAY
88b143951db870f8-HEL
Connection
keep-alive
Content-Length
15562
Content-Type
text/html
Date
Tue, 28 May 2024 21:16:08 GMT
ETag
"f74d3274690bcd93d1fc9691c5895aa6"
Last-Modified
Tue, 28 May 2024 05:44:28 GMT
Server
cloudflare
Vary
Accept-Encoding

Redirect headers

cache-control
max-age=3600
cf-ray
88b1438e6d8e376e-HEL
content-length
167
content-type
text/html
date
Tue, 28 May 2024 21:16:06 GMT
expires
Tue, 28 May 2024 22:16:06 GMT
location
https://pub-ac7c2ee2784d41ac91a1feef98615b2c.r2.dev/index.html
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=krn1UUDQAo7Ez2o635nq39TmKGACbwfbCaovjuDZCPFUmr7Iq60Vh4TtgQqYfatyymeNAkNeTZyjdd2MLsUHsysvQyutdKpgZJQ8dgt%2F%2BwZNUZIef9BM2hx07qIM%2Fsj%2FF3I%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
favicon.ico
pub-320778df5f504f5389d38ac70216cf19.r2.dev/ 		27 KB
27 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://pub-320778df5f504f5389d38ac70216cf19.r2.dev/favicon.ico
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
104.18.3.35 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://pub-320778df5f504f5389d38ac70216cf19.r2.dev/index.html
Accept-Language
fi-FI,fi;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Tue, 28 May 2024 21:16:03 GMT
Server
cloudflare
Connection
keep-alive
CF-RAY
88b143774d064e13-HEL
Content-Length
27242
Vary
Accept-Encoding
Content-Type
text/html
public
imagedelivery.net/tqEyS-vlTMhKtRbTaDoEfg/e2a35137-b601-4150-2cc5-f4c85bb42a00/ 		0
0
css2
fonts.googleapis.com/ 		0
0
v0.js
cdn.ampproject.org/ 		0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
imagedelivery.net
URL
https://imagedelivery.net/tqEyS-vlTMhKtRbTaDoEfg/e2a35137-b601-4150-2cc5-f4c85bb42a00/public
Domain
fonts.googleapis.com
URL
https://fonts.googleapis.com/css2?family=Noto+Sans:wght@400;700&display=swap
Domain
cdn.ampproject.org
URL
https://cdn.ampproject.org/v0.js

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Domain/Path Name / Value
t.ly/ Name: XSRF-TOKEN
Value: eyJpdiI6IkUyUzR3clkrbzZ0NU5QQW1aNWtkdXc9PSIsInZhbHVlIjoibWRWMVV1TlNjSkk0NFkweHBnUXEyakdNRzhBUjVmVHpZY3FOV3JGbDM5Vk5jZmpDZ2hCTVRiOTF0RHEwY09VaDV2WmN2WWhQaFhwaEhWZGl2OEJHNGRZUXdUYzBONU56UG1LNWFidTlKdHZ1d1RRSU9PMjFmUDF0d1BieStOWkwiLCJtYWMiOiI4ZjIwMjRiMDMzZDliOWMxMmFiOTBjYjVjNDNlZjkyOWEzMjkyMWYyMWVjOTdlMDhkZjE3YmRhNTViYzQ2MDQxIiwidGFnIjoiIn0%3D
t.ly/ Name: tly_session
Value: eyJpdiI6IkVIKzRwaU8wNngvQmdCdWs2aFJsUGc9PSIsInZhbHVlIjoiWFViVUU1SXd3SFVrRWNtT2JqRVlBTHdtZHlsQm1Fa2p0ckJNSkxaZXoxNXlhR2tYMkVDSHM4K2IzREk0aUdmNS8wT0V1Nm5ITVNnN21obFloWkJHelZSUENVcThGRVNQWHRIVm1LajhLTW1oS1lGTGZKZlBmcVE2QjVtc256U0MiLCJtYWMiOiJlZWIzNzdhODhlMzM2ZjgzMjExMjM3N2ZlNGI2YmZmNmVlNjI3ZWUxNjk3NDYwMWQwZTlkNzE3YzA1NTZlZmY2IiwidGFnIjoiIn0%3D

1 Console Messages

Source Level URL
Text
network error URL: https://pub-320778df5f504f5389d38ac70216cf19.r2.dev/favicon.ico
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)