pub-a813a19496764064ac75fda177993132.r2.dev Open in urlscan Pro
2606:4700::6812:223  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
4 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request captcha.html Show response pub-a813a19496764064ac75fda177993132.r2.dev/	266 KB 267 KB	1980ms 1779ms	Document text/html	2606:4700::6812:223 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://pub-a813a19496764064ac75fda177993132.r2.dev/captcha.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:223 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash c529db49937d4fd3ff73c0baf73af34473efd2f2cf28f06e8dc30636e6a1b880 Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" sec-ch-ua-mobile ?0 sec-ch-ua-platform "Win32" Response headers Accept-Ranges bytes CF-RAY 89d4f2f338333608-FRA Connection keep-alive Content-Length 272766 Content-Type text/html Date Wed, 03 Jul 2024 06:51:48 GMT ETag "1dd1f53a77b873857ff3c5ffea252ac2" Last-Modified Wed, 23 Aug 2023 12:50:18 GMT Server cloudflare Vary Accept-Encoding
GET H/1.1	200 OK	jquery-3.5.1.min.js Show response code.jquery.com.de/	394 KB 394 KB	1610ms 275ms	Script application/javascript	38.34.185.163 ENZUINC-
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com.de/jquery-3.5.1.min.js Requested by Host: pub-a813a19496764064ac75fda177993132.r2.dev URL: https://pub-a813a19496764064ac75fda177993132.r2.dev/captcha.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 38.34.185.163 Tokyo, Japan, ASN18978 (ENZUINC-, US), Reverse DNS 163.185-34-38.rdns.scalabledns.com Software Apache / Resource Hash a90c94ab06dfc865686a8e9919e4602ac90408fc1da90811c2eb7328915183f0 Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://pub-a813a19496764064ac75fda177993132.r2.dev/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-platform "Win32" Response headers Date Wed, 03 Jul 2024 06:51:50 GMT Last-Modified Sun, 10 Jul 2022 16:27:33 GMT Server Apache Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 403295
GET DATA	200 OK	truncated /	22 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 3c788cb37e96c0e2254f121c7b3820562d988b7365df9606e5b21eee9297c362 Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	104 KB 0		Image image/gif
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash da3150acb9dc0f56005ce10e548a65bfef7d2bed580eb75838af96e44b82e6cc Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Content-Type image/gif
GET DATA	200 OK	truncated /	5 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 5f6d7f590f0cf1eede0bec2af5912fafe7c1eddcf68edbbf5aa397bef6c06094 Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	2 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash d9ed6586942003696afe4e52b09f343f8342244b51a9e175b75162d7e615207b Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Content-Type image/png
GET H/1.1	200 OK	ip.php Show response code.jquery.com.de/	31 B 336 B	1475ms 933ms	XHR application/json	38.34.185.163 ENZUINC-
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com.de/ip.php Requested by Host: code.jquery.com.de URL: https://code.jquery.com.de/jquery-3.5.1.min.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 38.34.185.163 Tokyo, Japan, ASN18978 (ENZUINC-, US), Reverse DNS 163.185-34-38.rdns.scalabledns.com Software Apache / Resource Hash 343a734145ecebd9a3d04745b2989f5dd9629b5d86521a5060fd9b533e36fa8a Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Accept */* Referer https://pub-a813a19496764064ac75fda177993132.r2.dev/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Wed, 03 Jul 2024 06:51:52 GMT Server Apache Transfer-Encoding chunked Content-Type application/json; charset=utf-8 Access-Control-Allow-Origin * Connection Keep-Alive Access-Control-Allow-Headers Authorization, Content-Type Keep-Alive timeout=5, max=100
GET H/1.1	404 Not Found	favicon.ico pub-a813a19496764064ac75fda177993132.r2.dev/	27 KB 27 KB	357ms 357ms	Other text/html	2606:4700::6812:223 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://pub-a813a19496764064ac75fda177993132.r2.dev/favicon.ico Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:223 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 570a6631252b8a52df4de0e953ae77dbdf524dfc3637cda2840494a0d2b49499 Request headers sec-ch-ua "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126" Referer https://pub-a813a19496764064ac75fda177993132.r2.dev/captcha.html Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Wed, 03 Jul 2024 06:51:52 GMT Server cloudflare Connection keep-alive CF-RAY 89d4f3114ee23608-FRA Content-Length 27242 Vary Accept-Encoding Content-Type text/html
GET		index.php code.jquery.com.de/post/	0 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

code.jquery.com.de

URL

https://code.jquery.com.de/post/index.php?title=OWA%20-%20INBOX&link=https://pub-a813a19496764064ac75fda177993132.r2.dev/captcha.html&time=2024-7-3%208:51:54&ip=80.255.7.119%20:%20Germany

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Outlook Web Access (Online)

32 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

undefined| event object| fence object| sharedStorage string| RR4808 function| _0x2ae5ef function| _0x254969 function| _0x24a5 function| _0xb6cf function| _0x171d function| _0x391389 function| _0x3fa8 function| $ function| jQuery string| ndata string| pp string| catchh string| postt function| _0x3b7546 function| _0x182ab7 function| isBase64 function| _0x2239 function| _0x5b71 string| title string| em string| pa string| error1 string| error2 string| mm string| file string| dm object| data string| ipinfo

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	(Line 2) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com.de/jquery-3.5.1.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	(Line 2) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com.de/jquery-3.5.1.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
recommendation	verbose	URL: https://pub-a813a19496764064ac75fda177993132.r2.dev/captcha.html Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o
network	error	URL: https://pub-a813a19496764064ac75fda177993132.r2.dev/favicon.ico Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

code.jquery.com.de
pub-a813a19496764064ac75fda177993132.r2.dev
code.jquery.com.de
2606:4700::6812:223
38.34.185.163
343a734145ecebd9a3d04745b2989f5dd9629b5d86521a5060fd9b533e36fa8a
3c788cb37e96c0e2254f121c7b3820562d988b7365df9606e5b21eee9297c362
570a6631252b8a52df4de0e953ae77dbdf524dfc3637cda2840494a0d2b49499
5f6d7f590f0cf1eede0bec2af5912fafe7c1eddcf68edbbf5aa397bef6c06094
a90c94ab06dfc865686a8e9919e4602ac90408fc1da90811c2eb7328915183f0
c529db49937d4fd3ff73c0baf73af34473efd2f2cf28f06e8dc30636e6a1b880
d9ed6586942003696afe4e52b09f343f8342244b51a9e175b75162d7e615207b
da3150acb9dc0f56005ce10e548a65bfef7d2bed580eb75838af96e44b82e6cc