![](/screenshots/3df8b240-0f57-4ea8-92ca-eb6ff3f5dd81.png)
pub-a813a19496764064ac75fda177993132.r2.dev
Open in
urlscan Pro
2606:4700::6812:223
Malicious Activity!
Public Scan
Submission: On July 03 via automatic, source phishtank — Scanned from DE
Summary
TLS certificate: Issued by E1 on June 3rd 2024. Valid for: 3 months.
This is the only time pub-a813a19496764064ac75fda177993132.r2.dev was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Outlook Web Access (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 | 2606:4700::68... 2606:4700::6812:223 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 38.34.185.163 38.34.185.163 | 18978 (ENZUINC-) (ENZUINC-) | |
5 | 3 |
ASN13335 (CLOUDFLARENET, US)
pub-a813a19496764064ac75fda177993132.r2.dev |
ASN18978 (ENZUINC-, US)
PTR: 163.185-34-38.rdns.scalabledns.com
code.jquery.com.de |
Apex Domain Subdomains |
Transfer | |
---|---|---|
2 |
com.de
code.jquery.com.de |
394 KB |
2 |
r2.dev
pub-a813a19496764064ac75fda177993132.r2.dev |
293 KB |
5 | 2 |
Domain | Requested by | |
---|---|---|
2 | code.jquery.com.de |
pub-a813a19496764064ac75fda177993132.r2.dev
code.jquery.com.de |
2 | pub-a813a19496764064ac75fda177993132.r2.dev | |
5 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.r2.dev E1 |
2024-06-03 - 2024-09-01 |
3 months | crt.sh |
code.jquery.com.de R11 |
2024-06-08 - 2024-09-06 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://pub-a813a19496764064ac75fda177993132.r2.dev/captcha.html
Frame ID: CDD5270E55C40E1E600894CDDBE72BBA
Requests: 9 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
5 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
captcha.html
pub-a813a19496764064ac75fda177993132.r2.dev/ |
266 KB 267 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-3.5.1.min.js
code.jquery.com.de/ |
394 KB 394 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
22 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
104 KB 0 |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
5 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ip.php
code.jquery.com.de/ |
31 B 336 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
favicon.ico
pub-a813a19496764064ac75fda177993132.r2.dev/ |
27 KB 27 KB |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET |
index.php
code.jquery.com.de/post/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- code.jquery.com.de
- URL
- https://code.jquery.com.de/post/index.php?title=OWA%20-%20INBOX&link=https://pub-a813a19496764064ac75fda177993132.r2.dev/captcha.html&time=2024-7-3%208:51:54&ip=80.255.7.119%20:%20Germany
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Outlook Web Access (Online)32 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
undefined| event object| fence object| sharedStorage string| RR4808 function| _0x2ae5ef function| _0x254969 function| _0x24a5 function| _0xb6cf function| _0x171d function| _0x391389 function| _0x3fa8 function| $ function| jQuery string| ndata string| pp string| catchh string| postt function| _0x3b7546 function| _0x182ab7 function| isBase64 function| _0x2239 function| _0x5b71 string| title string| em string| pa string| error1 string| error2 string| mm string| file string| dm object| data string| ipinfo0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
4 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
code.jquery.com.de
pub-a813a19496764064ac75fda177993132.r2.dev
code.jquery.com.de
2606:4700::6812:223
38.34.185.163
343a734145ecebd9a3d04745b2989f5dd9629b5d86521a5060fd9b533e36fa8a
3c788cb37e96c0e2254f121c7b3820562d988b7365df9606e5b21eee9297c362
570a6631252b8a52df4de0e953ae77dbdf524dfc3637cda2840494a0d2b49499
5f6d7f590f0cf1eede0bec2af5912fafe7c1eddcf68edbbf5aa397bef6c06094
a90c94ab06dfc865686a8e9919e4602ac90408fc1da90811c2eb7328915183f0
c529db49937d4fd3ff73c0baf73af34473efd2f2cf28f06e8dc30636e6a1b880
d9ed6586942003696afe4e52b09f343f8342244b51a9e175b75162d7e615207b
da3150acb9dc0f56005ce10e548a65bfef7d2bed580eb75838af96e44b82e6cc