pub-006ccdc4b25446eea996c37666ac3aea.r2.dev Open in urlscan Pro
2606:4700::6812:223  Malicious Activity! Public Scan

2 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. http://vegtg.keysinstore.com/ Page URL
2. https://pub-59e0f36b6fab4dcdaac53c19b0129406.r2.dev/index.html Page URL
3. https://pub-006ccdc4b25446eea996c37666ac3aea.r2.dev/index.html Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
2 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	/ vegtg.keysinstore.com/	129 B 477 B	332ms 154ms	Document text/html	149.255.62.31 AWARESOFT
General Check archive.org Show headers Download Go to Full URL http://vegtg.keysinstore.com/ Protocol HTTP/1.1 Server 149.255.62.31 Bradford, United Kingdom, ASN34931 (AWARESOFT, GB), Reverse DNS cloud800.thundercloud.uk Software nginx / Resource Hash Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 accept-language en-GB,en;q=0.9 Response headers Cache-Control no-store, no-cache, must-revalidate Connection keep-alive Content-Type text/html; charset=UTF-8 Date Tue, 11 Jul 2023 08:45:18 GMT Expires Thu, 19 Nov 1981 08:52:00 GMT Pragma no-cache Server nginx Transfer-Encoding chunked
GET H/1.1	200 OK	index.html Show response pub-59e0f36b6fab4dcdaac53c19b0129406.r2.dev/	14 KB 6 KB	609ms 527ms	Document text/html	2606:4700::6812:223 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://pub-59e0f36b6fab4dcdaac53c19b0129406.r2.dev/index.html Requested by Host: vegtg.keysinstore.com URL: http://vegtg.keysinstore.com/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:223 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 5d0294ddd6328756dff224fd30c5b292721df38d79e7eda0a60fa070548fdf4a Request headers Referer http://vegtg.keysinstore.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 accept-language en-GB,en;q=0.9 Response headers CF-RAY 7e4fc4fe681c770d-LHR Connection keep-alive Content-Encoding gzip Content-Type text/html Date Tue, 11 Jul 2023 08:45:18 GMT ETag W/"8eb4073dc2cb62251aea65aa9bf812f5" Last-Modified Wed, 05 Jul 2023 15:16:34 GMT Server cloudflare Transfer-Encoding chunked Vary Accept-Encoding
GET H2	200	jquery.min.js Show response cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/	87 KB 28 KB	87ms 33ms	Script application/javascript	2606:4700::6811:180e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/jquery.min.js Requested by Host: pub-59e0f36b6fab4dcdaac53c19b0129406.r2.dev URL: https://pub-59e0f36b6fab4dcdaac53c19b0129406.r2.dev/index.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers accept-language en-GB,en;q=0.9 Referer https://pub-59e0f36b6fab4dcdaac53c19b0129406.r2.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Tue, 11 Jul 2023 08:45:19 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} strict-transport-security max-age=15780000 age 2429009 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 27938 last-modified Tue, 02 Mar 2021 18:58:36 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "603e8adc-15d9d" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=p07QPBB9QVcWtTLqKCSh8okX2td0T5sN3oK84EtblzWBIVOkgDGPQAsMr8Qtosg67UYhNaWAJimQN%2BlgJmNkt0LCB66K2qKwHtqNDDvDnprVi711n%2FNFjp0%2BJNnprO21GkuHsgqV651%2F8E%2FFQqvl7%2B1G"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=30672000 accept-ranges bytes timing-allow-origin * cf-ray 7e4fc5020cc823b1-LHR expires Sun, 30 Jun 2024 08:45:19 GMT
GET H2	200	css2 fonts.googleapis.com/	21 KB 1 KB	138ms 54ms	Stylesheet text/css	2a00:1450:4001:810::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css2?family=Inter:wght@100;200;300;400;500;600;700;800;900&display=swap Requested by Host: pub-59e0f36b6fab4dcdaac53c19b0129406.r2.dev URL: https://pub-59e0f36b6fab4dcdaac53c19b0129406.r2.dev/index.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash a021e5ef7022a556c759cca4e248f10383d65a1cd4df600dae57ea37ca481073 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers accept-language en-GB,en;q=0.9 Referer https://pub-59e0f36b6fab4dcdaac53c19b0129406.r2.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers strict-transport-security max-age=31536000 date Tue, 11 Jul 2023 08:45:19 GMT content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 x-xss-protection 0 last-modified Tue, 11 Jul 2023 08:08:12 GMT server ESF cross-origin-opener-policy same-origin-allow-popups x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Tue, 11 Jul 2023 08:45:19 GMT
GET H2	200	favicon_a_eupayfgghqiai7k9sol6lg2.ico aadcdn.msftauth.net/shared/1.0/content/images/	17 KB 17 KB	589ms 90ms	Image image/x-icon	2606:2800:21f:1b88:6342:f8de:86c:e98b EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msftauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico Requested by Host: pub-59e0f36b6fab4dcdaac53c19b0129406.r2.dev URL: https://pub-59e0f36b6fab4dcdaac53c19b0129406.r2.dev/index.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2606:2800:21f:1b88:6342:f8de:86c:e98b , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (bsb/27BE) / Resource Hash Request headers accept-language en-GB,en;q=0.9 Referer https://pub-59e0f36b6fab4dcdaac53c19b0129406.r2.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Tue, 11 Jul 2023 08:45:19 GMT content-md5 EuPayFgGHQiAI7K9SOL6lg== age 2047062 x-cache HIT content-length 17174 x-ms-lease-status unlocked last-modified Sun, 18 Oct 2020 03:02:30 GMT server ECAcc (bsb/27BE) etag 0x8D8731240E548EB content-type image/x-icon access-control-allow-origin * x-ms-request-id 51b5cb4d-f01e-0070-0535-a1e35e000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET DATA	200 OK	truncated /	586 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash fc95732d9ff3b17fcb3e64fd12c0d451c38e64e1a4b420c556a7feb756a0a3fa Request headers accept-language en-GB,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	187 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 4ddc1e33de02a96249bf85fc7b16e669317a81d8e2fc403ddb1ded6c465dd578 Request headers accept-language en-GB,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers Content-Type image/png
GET H/1.1	200 OK	Primary Request index.html Show response pub-006ccdc4b25446eea996c37666ac3aea.r2.dev/	194 KB 26 KB	398ms 299ms	Document text/html	2606:4700::6812:223 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://pub-006ccdc4b25446eea996c37666ac3aea.r2.dev/index.html Requested by Host: pub-59e0f36b6fab4dcdaac53c19b0129406.r2.dev URL: https://pub-59e0f36b6fab4dcdaac53c19b0129406.r2.dev/index.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:223 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ffc173432d8244683f67fbc2db5b6ee6777ee2cb84e077771c02a8c99cfdb1d5 Request headers Referer https://pub-59e0f36b6fab4dcdaac53c19b0129406.r2.dev/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 accept-language en-GB,en;q=0.9 Response headers CF-RAY 7e4fc506acd67333-LHR Connection keep-alive Content-Encoding gzip Content-Type text/html Date Tue, 11 Jul 2023 08:45:20 GMT ETag W/"a5812a61b437a402b5ce9e20fbd5fd23" Last-Modified Wed, 05 Jul 2023 15:15:45 GMT Server cloudflare Transfer-Encoding chunked Vary Accept-Encoding
GET H/1.1	200 OK	microsoft_logo.svg secure.aadcdn.microsoftonline-p.com/ests/2.1.8148.16/content/images/	4 KB 2 KB	188ms 38ms	Image image/svg+xml	2a02:26f0:480:981::35c1 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://secure.aadcdn.microsoftonline-p.com/ests/2.1.8148.16/content/images/microsoft_logo.svg?x=ee5c8d9fb6248c938fd0dc19370e90bd Requested by Host: pub-006ccdc4b25446eea996c37666ac3aea.r2.dev URL: https://pub-006ccdc4b25446eea996c37666ac3aea.r2.dev/index.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a02:26f0:480:981::35c1 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash 04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers accept-language en-GB,en;q=0.9 Referer https://pub-006ccdc4b25446eea996c37666ac3aea.r2.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers Date Tue, 11 Jul 2023 08:45:20 GMT Content-Encoding gzip Strict-Transport-Security max-age=31536000 Last-Modified Sat, 18 May 2019 23:35:05 GMT Content-MD5 nzaLxFgP7ZB3dfMcaybWzw== Vary Accept-Encoding Content-Type image/svg+xml Access-Control-Allow-Origin * Cache-Control public, max-age=523569 Connection keep-alive Content-Length 1435
GET H2	200	2_bc3d32a696895f78c19df6c717586a5d.svg aadcdn.msauth.net/shared/1.0/content/images/backgrounds/	2 KB 1 KB	135ms 29ms	Image image/svg+xml	2620:1ec:46::45 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msauth.net/shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg Requested by Host: pub-006ccdc4b25446eea996c37666ac3aea.r2.dev URL: https://pub-006ccdc4b25446eea996c37666ac3aea.r2.dev/index.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:46::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68 Request headers accept-language en-GB,en;q=0.9 Referer https://pub-006ccdc4b25446eea996c37666ac3aea.r2.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Tue, 11 Jul 2023 08:45:19 GMT content-encoding gzip content-md5 DhdidjYrlCeaRJJRG/y9mA== x-cache TCP_HIT content-length 673 x-ms-lease-status unlocked last-modified Wed, 12 Feb 2020 22:01:30 GMT etag 0x8D7B0071D86E386 x-azure-ref 0oBatZAAAAADFcPtGv7MeTaHA69a4WYjWTE9OMjFFREdFMTcwNgAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY= content-type image/svg+xml access-control-allow-origin * x-ms-request-id bd80696a-301e-004c-12ac-b3107b000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19
GET H/1.1	404 Not Found	prefetch(1).html Show response pub-006ccdc4b25446eea996c37666ac3aea.r2.dev/Sign%20in%20to%20your%20account_files/ Frame AEE4	27 KB 7 KB	144ms 144ms	Document text/html	2606:4700::6812:223 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://pub-006ccdc4b25446eea996c37666ac3aea.r2.dev/Sign%20in%20to%20your%20account_files/prefetch(1).html Requested by Host: pub-006ccdc4b25446eea996c37666ac3aea.r2.dev URL: https://pub-006ccdc4b25446eea996c37666ac3aea.r2.dev/index.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:223 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 570a6631252b8a52df4de0e953ae77dbdf524dfc3637cda2840494a0d2b49499 Request headers Referer https://pub-006ccdc4b25446eea996c37666ac3aea.r2.dev/index.html Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 accept-language en-GB,en;q=0.9 Response headers CF-RAY 7e4fc508bf347333-LHR Connection keep-alive Content-Encoding gzip Content-Type text/html Date Tue, 11 Jul 2023 08:45:20 GMT Server cloudflare Transfer-Encoding chunked Vary Accept-Encoding
GET H2	200	jquery-3.3.1.min.js Show response code.jquery.com/	85 KB 30 KB	117ms 32ms	Script application/javascript	2001:4de0:ac18::1:a:3a STACKPATH-CDN
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.3.1.min.js Requested by Host: pub-006ccdc4b25446eea996c37666ac3aea.r2.dev URL: https://pub-006ccdc4b25446eea996c37666ac3aea.r2.dev/index.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac18::1:a:3a , Netherlands, ASN20446 (STACKPATH-CDN, US), Reverse DNS Software nginx / Resource Hash 160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef Request headers accept-language en-GB,en;q=0.9 Referer https://pub-006ccdc4b25446eea996c37666ac3aea.r2.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36 Response headers date Tue, 11 Jul 2023 08:45:20 GMT content-encoding gzip last-modified Wed, 16 Feb 2022 10:50:39 GMT server nginx etag W/"620cd6ff-1538f" vary Accept-Encoding x-hw 1689065120.dop249.lo4.t,1689065120.cds084.lo4.hn,1689065120.cds261.lo4.c content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 30288

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 boolean| credentialless object| onbeforetoggle object| onscrollend function| $ function| jQuery string| emailParam function| goNext function| closeBox function| checkSubmit function| isEmail function| iserror function| isSuccess

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			vegtg.keysinstore.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 862ebfea7f619f84c8a11c4e99c7c963

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://pub-006ccdc4b25446eea996c37666ac3aea.r2.dev/Sign%20in%20to%20your%20account_files/prefetch(1).html Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aadcdn.msauth.net
aadcdn.msftauth.net
cdnjs.cloudflare.com
code.jquery.com
fonts.googleapis.com
pub-006ccdc4b25446eea996c37666ac3aea.r2.dev
pub-59e0f36b6fab4dcdaac53c19b0129406.r2.dev
secure.aadcdn.microsoftonline-p.com
vegtg.keysinstore.com
149.255.62.31
2001:4de0:ac18::1:a:3a
2606:2800:21f:1b88:6342:f8de:86c:e98b
2606:4700::6811:180e
2606:4700::6812:223
2620:1ec:46::45
2a00:1450:4001:810::200a
2a02:26f0:480:981::35c1
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
4ddc1e33de02a96249bf85fc7b16e669317a81d8e2fc403ddb1ded6c465dd578
570a6631252b8a52df4de0e953ae77dbdf524dfc3637cda2840494a0d2b49499
5d0294ddd6328756dff224fd30c5b292721df38d79e7eda0a60fa070548fdf4a
a021e5ef7022a556c759cca4e248f10383d65a1cd4df600dae57ea37ca481073
fc95732d9ff3b17fcb3e64fd12c0d451c38e64e1a4b420c556a7feb756a0a3fa
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e
ffc173432d8244683f67fbc2db5b6ee6777ee2cb84e077771c02a8c99cfdb1d5