pub-830eb35c9df644b680648e4b664fe241.r2.dev
Open in
urlscan Pro
2606:4700::6812:323
Malicious Activity!
Public Scan
Effective URL: https://pub-830eb35c9df644b680648e4b664fe241.r2.dev/index.html
Submission: On July 18 via manual from IN — Scanned from GB
Summary
TLS certificate: Issued by E1 on June 3rd 2024. Valid for: 3 months.
This is the only time pub-830eb35c9df644b680648e4b664fe241.r2.dev was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: American Express (Financial) Generic Email (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 93.184.221.165 93.184.221.165 | 15133 (EDGECAST) (EDGECAST) | |
1 | 2606:4700::68... 2606:4700::6812:323 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 54.251.46.224 54.251.46.224 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | () () | ||
12 | 2a05:d014:58f... 2a05:d014:58f:6200::64 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 2a00:1450:400... 2a00:1450:4001:831::200a | 15169 (GOOGLE) (GOOGLE) | |
2 | 2a04:4e42::649 2a04:4e42::649 | 54113 (FASTLY) (FASTLY) | |
1 | 104.17.25.14 104.17.25.14 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 23.36.235.165 23.36.235.165 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
23 | 10 |
ASN13335 (CLOUDFLARENET, US)
pub-830eb35c9df644b680648e4b664fe241.r2.dev |
ASN16509 (AMAZON-02, US)
PTR: ec2-54-251-46-224.ap-southeast-1.compute.amazonaws.com
dehygienique.izenoondemand.com |
ASN16509 (AMAZON-02, US)
themes-app.netlify.app |
ASN16625 (AKAMAI-AS, US)
PTR: a23-36-235-165.deploy.static.akamaitechnologies.com
icm.aexp-static.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
12 |
netlify.app
themes-app.netlify.app — Cisco Umbrella Rank: 701516 |
48 KB |
2 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 1211 |
108 KB |
2 |
izenoondemand.com
dehygienique.izenoondemand.com |
96 KB |
2 |
r2.dev
pub-830eb35c9df644b680648e4b664fe241.r2.dev |
927 B |
1 |
aexp-static.com
icm.aexp-static.com — Cisco Umbrella Rank: 22942 |
4 KB |
1 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 336 |
7 KB |
1 |
googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 641 |
30 KB |
1 |
t.co
t.co — Cisco Umbrella Rank: 979 |
576 B |
23 | 8 |
Domain | Requested by | |
---|---|---|
12 | themes-app.netlify.app |
pub-830eb35c9df644b680648e4b664fe241.r2.dev
|
2 | code.jquery.com |
pub-830eb35c9df644b680648e4b664fe241.r2.dev
|
2 | dehygienique.izenoondemand.com |
pub-830eb35c9df644b680648e4b664fe241.r2.dev
|
2 | pub-830eb35c9df644b680648e4b664fe241.r2.dev |
t.co
dehygienique.izenoondemand.com |
1 | icm.aexp-static.com |
pub-830eb35c9df644b680648e4b664fe241.r2.dev
|
1 | cdnjs.cloudflare.com |
pub-830eb35c9df644b680648e4b664fe241.r2.dev
|
1 | ajax.googleapis.com |
pub-830eb35c9df644b680648e4b664fe241.r2.dev
|
1 | t.co | |
23 | 8 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
t.co DigiCert Global G2 TLS RSA SHA256 2020 CA1 |
2024-05-08 - 2025-05-07 |
a year | crt.sh |
*.r2.dev E1 |
2024-06-03 - 2024-09-01 |
3 months | crt.sh |
*.izenoondemand.com Go Daddy Secure Certificate Authority - G2 |
2023-12-17 - 2025-01-17 |
a year | crt.sh |
*.netlify.app DigiCert Global G2 TLS RSA SHA256 2020 CA1 |
2024-01-15 - 2025-02-14 |
a year | crt.sh |
upload.video.google.com WR2 |
2024-06-24 - 2024-09-16 |
3 months | crt.sh |
*.jquery.com Sectigo ECC Domain Validation Secure Server CA |
2024-06-25 - 2025-06-25 |
a year | crt.sh |
cdnjs.cloudflare.com E1 |
2024-06-02 - 2024-08-31 |
3 months | crt.sh |
m.americanexpress.com DigiCert SHA2 Extended Validation Server CA |
2024-03-06 - 2025-03-06 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://pub-830eb35c9df644b680648e4b664fe241.r2.dev/index.html
Frame ID: 3D850398C657B516E407EDC9BE7E3119
Requests: 23 HTTP requests in this frame
Screenshot
Page Title
Log in to My Account | American Express USPage URL History Show full URLs
- https://t.co/JWGJIClQ7b Page URL
- https://pub-830eb35c9df644b680648e4b664fe241.r2.dev/index.html Page URL
Detected technologies
Amex Express Checkout (Payment processors) ExpandDetected patterns
- aexp-static\.com
Popper (Miscellaneous) Expand
Detected patterns
- <script [^>]*src="[^"]*/popper\.js/([0-9.]+)
- /popper\.js/([0-9.]+)
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://t.co/JWGJIClQ7b Page URL
- https://pub-830eb35c9df644b680648e4b664fe241.r2.dev/index.html Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
23 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
JWGJIClQ7b
t.co/ |
341 B 576 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
index.html
pub-830eb35c9df644b680648e4b664fe241.r2.dev/ |
618 B 927 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquerys.js
dehygienique.izenoondemand.com/cache/themes/amx/ |
281 KB 83 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
basicblob.js
dehygienique.izenoondemand.com/cache/themes/amx/ |
54 KB 13 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET BLOB |
6c9a6d83-023a-4cb1-8e19-41c838f0667e
https://pub-830eb35c9df644b680648e4b664fe241.r2.dev/ |
40 KB 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
favicon.ico
pub-830eb35c9df644b680648e4b664fe241.r2.dev/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.css
themes-app.netlify.app/css/ |
8 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/2.2.4/ |
84 KB 30 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.1.1.min.js
code.jquery.com/ |
85 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.3.1.js
code.jquery.com/ |
265 KB 79 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
popper.min.js
cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/ |
19 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mt2.png
themes-app.netlify.app/img/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
se.png
themes-app.netlify.app/img/ |
693 B 779 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dl.webp
themes-app.netlify.app/img/ |
9 KB 9 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
3CSC_INTL_300x190.png
icm.aexp-static.com/content/dam/one-amex/one-identity/images/ |
4 KB 4 KB |
Image
image/avif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dw.png
themes-app.netlify.app/img/ |
9 KB 9 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
tn.gif
themes-app.netlify.app/img/ |
12 KB 12 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fc.png
themes-app.netlify.app/img/ |
644 B 731 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
tw.png
themes-app.netlify.app/img/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
in.png
themes-app.netlify.app/img/ |
8 KB 8 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
li.png
themes-app.netlify.app/img/ |
764 B 851 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
yt.png
themes-app.netlify.app/img/ |
984 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icon.ico
themes-app.netlify.app/img/ |
1 KB 1 KB |
Other
image/vnd.microsoft.icon |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- pub-830eb35c9df644b680648e4b664fe241.r2.dev
- URL
- https://pub-830eb35c9df644b680648e4b664fe241.r2.dev/favicon.ico
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: American Express (Financial) Generic Email (Online)3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery function| Popper1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.t.co/ | Name: muc Value: e6a07c9b-305c-4c4e-910d-044154c10842 |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=0 |
X-Xss-Protection | 0 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
cdnjs.cloudflare.com
code.jquery.com
dehygienique.izenoondemand.com
icm.aexp-static.com
pub-830eb35c9df644b680648e4b664fe241.r2.dev
t.co
themes-app.netlify.app
pub-830eb35c9df644b680648e4b664fe241.r2.dev
104.17.25.14
23.36.235.165
2606:4700::6812:323
2a00:1450:4001:831::200a
2a04:4e42::649
2a05:d014:58f:6200::64
54.251.46.224
93.184.221.165
011871b672950332066994d18aaac9d923bc85df3ef22b296b3107df50261887
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
0cd60fcc520da13e49b81375e1ebc9d8aad06f64b48e2cb420ac4eec5a5fdeeb
0dd86bb0857e24e36c8d1574a9575b4d4d09201b84e49a5b5bdb69355e26d96b
1c18890e44f53c9b0b4a22a56dff0b32e84b5fa38ec1721e6b580f9d26fd7820
265d3f591d92fadfe95f4660c382ee64a23538a7353b9880434205a102833de0
416a3b2c3bf16d64f6b5b6d0f7b079df2267614dd6847fc2f3271b4409233c37
428a13dcd90b9a52dac690a578092e1b24e6121952668d4bcf001a6287c880dd
50ded9570fa6f2a244d56fb49094b56bbe1026bb59ccf22b9b333b1697d4c46c
5c5381a437e62da458e251201a5c46af59e750b8f40470b77d00ce9fcf08fc6b
5cb5e693ba5e56c274a113f77c50becb662d18324b2ed681432f60ee4761de3d
5ec6db3d6764748f167de1790472377b58d8ae922e19c0f49d83d41f11c466cd
677a6a5da6f0e85f66c5232fc39ffd285ed010a9498c40cdd7e56d2ff0b7e7da
6819027230b9bd9ef6fd5df3e969effa33c2fac9c1dfca8701a706c64cad04e9
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66
c000ce3efd67b43d573f0270ec30bb3854908f0672a8e08a6809a3680b7b8542
d1dc4be2bb732742015d6ed477b2fc6fbde466a07a4cf57124a22c3a447a93b0
d31c57f28cc14b6362f61488eb82a0d2e00f0fa5899765495e1ca871a4e3ea2d
d8aa24ecc6cecb1a60515bc093f1c9da38a0392612d9ab8ae0f7f36e6eee1fad
f0b9ddd609984ee9e126a239094a99879263459a16ff038fafeb5aed18cc872f