pub-1a04e7ed1e964459b476b559dee7a4e6.r2.dev
Open in
urlscan Pro
2606:4700::6812:223
Malicious Activity!
Public Scan
URL:
https://pub-1a04e7ed1e964459b476b559dee7a4e6.r2.dev/slsindex.html.html
Submission: On July 09 via api from US — Scanned from DE
Submission: On July 09 via api from US — Scanned from DE
Summary
This website contacted 3 IPs
in 1 countries
across 2 domains to perform 16 HTTP transactions.
The main IP is 2606:4700::6812:223, located in
United States and
belongs to CLOUDFLARENET, US.
The main domain is pub-1a04e7ed1e964459b476b559dee7a4e6.r2.dev.
TLS certificate: Issued by E1 on June 3rd 2024. Valid for: 3 months.
This is the only time pub-1a04e7ed1e964459b476b559dee7a4e6.r2.dev was scanned on urlscan.io!
TLS certificate: Issued by E1 on June 3rd 2024. Valid for: 3 months.
This is the only time pub-1a04e7ed1e964459b476b559dee7a4e6.r2.dev was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Email (Online)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 | 2606:4700::68... 2606:4700::6812:223 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
| 14 | 198.23.53.48 198.23.53.48 | 32748 (STEADFAST) (STEADFAST) | |
| 16 | 3 |
1
2606:4700::6812:223
(United States)
ASN13335 (CLOUDFLARENET, US)
ASN13335 (CLOUDFLARENET, US)
| pub-1a04e7ed1e964459b476b559dee7a4e6.r2.dev |
14
198.23.53.48
(United States)
ASN32748 (STEADFAST, US)
PTR: hosted.by.liquidnetlimited.com
ASN32748 (STEADFAST, US)
PTR: hosted.by.liquidnetlimited.com
| webmail.supremecluster.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 14 |
supremecluster.com
webmail.supremecluster.com |
758 KB |
| 1 |
r2.dev
pub-1a04e7ed1e964459b476b559dee7a4e6.r2.dev |
11 KB |
| 16 | 2 |
| Domain | Requested by | |
|---|---|---|
| 14 | webmail.supremecluster.com |
pub-1a04e7ed1e964459b476b559dee7a4e6.r2.dev
|
| 1 | pub-1a04e7ed1e964459b476b559dee7a4e6.r2.dev | |
| 16 | 2 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| *.r2.dev E1 |
2024-06-03 - 2024-09-01 |
3 months | crt.sh |
| webmail.supremecluster.com R3 |
2024-05-23 - 2024-08-21 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://pub-1a04e7ed1e964459b476b559dee7a4e6.r2.dev/slsindex.html.html
Frame ID: A3CCAB15BE6E80EE03C30C7FCF14FC70
Requests: 16 HTTP requests in this frame
Screenshot
Page Title
Roundcube Webmail : Welcome to ....Detected technologies
RoundCube
(Web Mail)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <title>RoundCube
Bootstrap
(Web Frameworks)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
jQuery UI
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- jquery-ui.*\.js
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
16 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
slsindex.html.html
pub-1a04e7ed1e964459b476b559dee7a4e6.r2.dev/ |
10 KB 11 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bootstrap.min.css
webmail.supremecluster.com/skins/elastic/deps/ |
157 KB 26 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
styles.css
webmail.supremecluster.com/skins/elastic/styles/ |
101 KB 21 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
framework.css
webmail.supremecluster.com/plugins/xframework/assets/styles/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery-ui.css
webmail.supremecluster.com/plugins/jqueryui/themes/elastic/ |
33 KB 9 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery.min.js
webmail.supremecluster.com/program/js/ |
89 KB 89 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
common.min.js
webmail.supremecluster.com/program/js/ |
12 KB 13 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
app.min.js
webmail.supremecluster.com/program/js/ |
168 KB 168 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jstz.min.js
webmail.supremecluster.com/program/js/ |
14 KB 14 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
framework.min.js
webmail.supremecluster.com/plugins/xframework/assets/scripts/ |
12 KB 13 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
xskin.min.js
webmail.supremecluster.com/plugins/xskin/assets/scripts/ |
4 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery-ui.min.js
webmail.supremecluster.com/plugins/jqueryui/js/ |
256 KB 257 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
logo.svg
webmail.supremecluster.com/skins/elastic/images/ |
888 B 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bootstrap.bundle.min.js
webmail.supremecluster.com/skins/elastic/deps/ |
82 KB 82 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
ui.min.js
webmail.supremecluster.com/skins/elastic/ |
60 KB 60 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
favicon.ico
webmail.supremecluster.com/skins/elastic/images/ |
17 KB 2 KB |
Other
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- webmail.supremecluster.com
- URL
- https://webmail.supremecluster.com/plugins/xframework/assets/styles/framework.css?s=1506327547
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Email (Online)36 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery number| CONTROL_KEY number| SHIFT_KEY number| CONTROL_SHIFT_KEY function| roundcube_browser object| rcube_event function| rcube_event_engine function| rcube_check_email function| rcube_clone_object function| urlencode function| rcube_find_object function| rcube_mouse_is_over function| setCookie function| getCookie object| bw function| rcube_parse_query object| Base64 object| pattern function| rcube_webmail object| jstz object| _$_7612 object| rcmail function| x object| xsidebar object| xframework function| xsidebarLarry function| xsidebarElastic object| xskin object| _$_ad59 object| bootstrap function| rcube_elastic_ui function| __newInst object| UI object| _$_e5ef object| _$_dc640 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
pub-1a04e7ed1e964459b476b559dee7a4e6.r2.dev
webmail.supremecluster.com
webmail.supremecluster.com
198.23.53.48
2606:4700::6812:223
061f93b16d52f124d1df7b15ba43942736b743f733c77a7cb82b8d2d2ae0fd03
0c07ab29e206a3328d77889da33b64f9ae5d6ea32d34c4a8fae78a64ba428760
19b51730c10082760e6d9b82c1342e60855f98d2666c64e4eb758d26b1a0c840
24161ab6a7864849a9842c4345f5a93fb23154b92fa5d717cb77d3f7f684715e
2b2d9c7a82f92976268b03e13c61f64ead91a3c63b97c59cef2acbf501f67618
360bc4a9894bbd41134a2eea27ee9251f649e6aa395c1836caaa2f90e123f91a
3cb5b7ae5053d743996378c35733560214d3d896ade5c0de0d8b13a97f43039e
45b30930d5752603cdff2d24aa942b5bbae3168f62e74e092cd9405ff10127f7
5587d48bf92e77d6abf71c25f39e248e6bc2e168595128b516b733e65eba1101
5641ed21773230a8110279658abac57bb5b4abc7bf4091946c5e61e8f0021f55
716ece8deb8412f7ec95ab395c92f6515bb8d8b792fd7480c014cdc6f063452a
7b30e499996ec4631848d3509d803d9311f5d71999212f2f4c1ca7af8f24eb69
b5c8efcc70542f970db5def97926121e9315e45ff3a73386bc933585da201222
ed1bacadaf41ca5f37b2befa276864606ab3308dba31df85209a63c43daca2e4
f41ecf98cb50845771b2573972c1c1c61c0b5e67670cfc608c6ac95e0d3378b8