pub-660ecf66ff9e4f3fafa62dc96e8e4b2b.r2.dev
Open in
urlscan Pro
104.18.3.35
Malicious Activity!
Public Scan
Submission Tags: @phish_report
Submission: On June 25 via api from FI — Scanned from FI
Summary
TLS certificate: Issued by E1 on June 3rd 2024. Valid for: 3 months.
This is the only time pub-660ecf66ff9e4f3fafa62dc96e8e4b2b.r2.dev was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Cloudflare (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 6 | 104.18.3.35 104.18.3.35 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
7 | 142.250.185.65 142.250.185.65 | 15169 (GOOGLE) (GOOGLE) | |
1 | 172.217.18.106 172.217.18.106 | 15169 (GOOGLE) (GOOGLE) | |
1 | 172.64.147.160 172.64.147.160 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 162.19.58.158 162.19.58.158 | 16276 (OVH) (OVH) | |
1 | 142.250.185.227 142.250.185.227 | 15169 (GOOGLE) (GOOGLE) | |
1 | 192.64.117.41 192.64.117.41 | 22612 (NAMECHEAP...) (NAMECHEAP-NET) | |
1 | 142.250.186.118 142.250.186.118 | 15169 (GOOGLE) (GOOGLE) | |
1 | 172.67.147.184 172.67.147.184 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 162.19.61.80 162.19.61.80 | 16276 (OVH) (OVH) | |
22 | 11 |
ASN15169 (GOOGLE, US)
PTR: fra16s48-in-f1.1e100.net
cdn.ampproject.org |
ASN15169 (GOOGLE, US)
PTR: zrh04s05-in-f106.1e100.net
fonts.googleapis.com |
ASN15169 (GOOGLE, US)
PTR: fra16s53-in-f3.1e100.net
fonts.gstatic.com |
ASN22612 (NAMECHEAP-NET, US)
PTR: business131-4.web-hosting.com
hokiselangit.pro |
ASN15169 (GOOGLE, US)
PTR: fra24s06-in-f22.1e100.net
play-lh.googleusercontent.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
ampproject.org
cdn.ampproject.org — Cisco Umbrella Rank: 486 |
97 KB |
6 |
r2.dev
1 redirects
pub-660ecf66ff9e4f3fafa62dc96e8e4b2b.r2.dev |
68 KB |
2 |
ibb.co
i.ibb.co — Cisco Umbrella Rank: 10821 |
1 MB |
1 |
postimg.cc
i.postimg.cc — Cisco Umbrella Rank: 18042 |
3 KB |
1 |
imgstorebumbum.xyz
imgstorebumbum.xyz |
44 KB |
1 |
googleusercontent.com
play-lh.googleusercontent.com — Cisco Umbrella Rank: 534 |
859 KB |
1 |
hokiselangit.pro
hokiselangit.pro |
374 KB |
1 |
gstatic.com
fonts.gstatic.com |
16 KB |
1 |
pixabay.com
cdn.pixabay.com — Cisco Umbrella Rank: 51730 |
29 KB |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 83 |
1 KB |
0 |
morrisonhotelgallery.com
Failed
slotgacormaxwin.morrisonhotelgallery.com Failed |
|
22 | 11 |
Domain | Requested by | |
---|---|---|
7 | cdn.ampproject.org |
pub-660ecf66ff9e4f3fafa62dc96e8e4b2b.r2.dev
cdn.ampproject.org |
6 | pub-660ecf66ff9e4f3fafa62dc96e8e4b2b.r2.dev |
1 redirects
pub-660ecf66ff9e4f3fafa62dc96e8e4b2b.r2.dev
|
2 | i.ibb.co |
pub-660ecf66ff9e4f3fafa62dc96e8e4b2b.r2.dev
|
1 | i.postimg.cc | |
1 | imgstorebumbum.xyz | |
1 | play-lh.googleusercontent.com |
pub-660ecf66ff9e4f3fafa62dc96e8e4b2b.r2.dev
|
1 | hokiselangit.pro |
pub-660ecf66ff9e4f3fafa62dc96e8e4b2b.r2.dev
|
1 | fonts.gstatic.com |
fonts.googleapis.com
|
1 | cdn.pixabay.com |
pub-660ecf66ff9e4f3fafa62dc96e8e4b2b.r2.dev
|
1 | fonts.googleapis.com |
pub-660ecf66ff9e4f3fafa62dc96e8e4b2b.r2.dev
|
0 | slotgacormaxwin.morrisonhotelgallery.com Failed |
pub-660ecf66ff9e4f3fafa62dc96e8e4b2b.r2.dev
|
22 | 11 |
This site contains links to these domains. Also see Links.
Domain |
---|
pertempuranhati.pro |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.r2.dev E1 |
2024-06-03 - 2024-09-01 |
3 months | crt.sh |
misc-sni.google.com WR2 |
2024-06-03 - 2024-08-26 |
3 months | crt.sh |
upload.video.google.com WR2 |
2024-06-03 - 2024-08-26 |
3 months | crt.sh |
pixabay.com Cloudflare Inc ECC CA-3 |
2024-02-12 - 2024-12-31 |
a year | crt.sh |
ibb.co R10 |
2024-06-21 - 2024-09-19 |
3 months | crt.sh |
*.gstatic.com WR2 |
2024-06-03 - 2024-08-26 |
3 months | crt.sh |
hokiselangit.pro Sectigo RSA Domain Validation Secure Server CA |
2023-12-05 - 2024-12-05 |
a year | crt.sh |
edgestatic.com WR2 |
2024-06-03 - 2024-08-26 |
3 months | crt.sh |
imgstorebumbum.xyz WE1 |
2024-06-12 - 2024-09-10 |
3 months | crt.sh |
postimg.cc R11 |
2024-06-21 - 2024-09-19 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://pub-660ecf66ff9e4f3fafa62dc96e8e4b2b.r2.dev/amplamongan.html
Frame ID: EDF2E78EBDE7125BF555CBCB6B8916BA
Requests: 24 HTTP requests in this frame
Screenshot
Page Title
DAFTAR SERTA LOGIN PERMAINAN SLOT GACOR TERLARIS TAHUN 2024Page URL History Show full URLs
- https://pub-660ecf66ff9e4f3fafa62dc96e8e4b2b.r2.dev/amplamongan.html Page URL
-
https://pub-660ecf66ff9e4f3fafa62dc96e8e4b2b.r2.dev/cdn-cgi/phish-bypass?atok=oTlErJ8h6_TB58TdHWYCdZkEb6tkfCRElhSJRdmCEzk-171930...
HTTP 301
https://pub-660ecf66ff9e4f3fafa62dc96e8e4b2b.r2.dev/amplamongan.html Page URL
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: Slot Thailand
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://pub-660ecf66ff9e4f3fafa62dc96e8e4b2b.r2.dev/amplamongan.html Page URL
-
https://pub-660ecf66ff9e4f3fafa62dc96e8e4b2b.r2.dev/cdn-cgi/phish-bypass?atok=oTlErJ8h6_TB58TdHWYCdZkEb6tkfCRElhSJRdmCEzk-1719302123-0.0.1.1-%2Famplamongan.html
HTTP 301
https://pub-660ecf66ff9e4f3fafa62dc96e8e4b2b.r2.dev/amplamongan.html Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
22 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
amplamongan.html
pub-660ecf66ff9e4f3fafa62dc96e8e4b2b.r2.dev/ |
4 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
cf.errors.css
pub-660ecf66ff9e4f3fafa62dc96e8e4b2b.r2.dev/cdn-cgi/styles/ |
23 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icon-exclamation.png
pub-660ecf66ff9e4f3fafa62dc96e8e4b2b.r2.dev/cdn-cgi/images/ |
452 B 889 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
favicon.ico
pub-660ecf66ff9e4f3fafa62dc96e8e4b2b.r2.dev/ |
27 KB 27 KB |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
amplamongan.html
pub-660ecf66ff9e4f3fafa62dc96e8e4b2b.r2.dev/ Redirect Chain
|
30 KB 31 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
v0.mjs
cdn.ampproject.org/ |
223 KB 62 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
amp-carousel-0.1.mjs
cdn.ampproject.org/v0/ |
33 KB 11 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
amp-install-serviceworker-0.1.mjs
cdn.ampproject.org/v0/ |
6 KB 2 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
amp-youtube-0.1.mjs
cdn.ampproject.org/v0/ |
31 KB 10 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
amp-accordion-0.1.mjs
cdn.ampproject.org/v0/ |
14 KB 5 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css2
fonts.googleapis.com/ |
3 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
14-25-02-330_512.gif
cdn.pixabay.com/animation/2023/04/03/14/25/ |
29 KB 29 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
hack303-play.png
i.ibb.co/PQvGwJt/ |
574 B 817 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ieVo2ZhZI2eCN5jzbjEETS9weq8-_d6T_POl0fRJeyWyosBO5XxjK9SL.woff2
fonts.gstatic.com/s/robotocondensed/v27/ |
15 KB 16 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo-seo.png
hokiselangit.pro/poto/ |
374 KB 374 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
amp-auto-lightbox-0.1.mjs
cdn.ampproject.org/rtv/012406071948000/v0/ |
7 KB 3 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
152 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
149 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
amp-loader-0.1.mjs
cdn.ampproject.org/rtv/012406071948000/v0/ |
12 KB 4 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
daftar-slot-gacor-hari-ini.jpg
slotgacormaxwin.morrisonhotelgallery.com/cdn/shop/files/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
slot-gacor-maxwin-server-GACOR.png
i.ibb.co/JcL3q3g/ |
1 MB 1 MB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
40vlREyEZiZFOHPtCjJYltn10CZULsPytn-PbKhz6etVqnmEEn07Y6EqD_5m-u7b-rE=w3840-h2160-rw
play-lh.googleusercontent.com/ |
858 KB 859 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
favicon.png
imgstorebumbum.xyz/image/ |
44 KB 44 KB |
Other
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
slot-gacor-gampang-menang-favicon.png
i.postimg.cc/MGtzh26x/ |
3 KB 3 KB |
Other
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- slotgacormaxwin.morrisonhotelgallery.com
- URL
- https://slotgacormaxwin.morrisonhotelgallery.com/cdn/shop/files/daftar-slot-gacor-hari-ini.jpg?v=1698739412
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Cloudflare (Online)16 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
undefined| event object| fence object| sharedStorage object| AMP object| AMP_CONFIG object| AMP_EXP object| __AMP_LOG object| __AMP_ERRORS function| __AMP_REPORT_ERROR object| __AMP_TOP object| __AMP_SERVICES object| __AMP__EXPERIMENT_TOGGLES object| __AMP_MODE boolean| __AMP_TAG object| __AMP_EXTENDED_ELEMENTS function| __AMP_BASE_CE_CLASS2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.pub-660ecf66ff9e4f3fafa62dc96e8e4b2b.r2.dev/ | Name: __cf_mw_byp Value: oTlErJ8h6_TB58TdHWYCdZkEb6tkfCRElhSJRdmCEzk-1719302123-0.0.1.1-/amplamongan.html |
|
.pixabay.com/ | Name: __cf_bm Value: FbILc5_orvlMBCRBRAoXqX2qrw4q1h3c6JTVhWsu.6g-1719302129-1.0.1.1-XWcoipQXJGMGCKF6A7hNpmuWoWPqTQS_WABf_In0as1XldoO3rY2Dc_rpyNpdTJMpgQunYjK5jBaU5Dxbl8kZw |
3 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Frame-Options | SAMEORIGIN |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn.ampproject.org
cdn.pixabay.com
fonts.googleapis.com
fonts.gstatic.com
hokiselangit.pro
i.ibb.co
i.postimg.cc
imgstorebumbum.xyz
play-lh.googleusercontent.com
pub-660ecf66ff9e4f3fafa62dc96e8e4b2b.r2.dev
slotgacormaxwin.morrisonhotelgallery.com
slotgacormaxwin.morrisonhotelgallery.com
104.18.3.35
142.250.185.227
142.250.185.65
142.250.186.118
162.19.58.158
162.19.61.80
172.217.18.106
172.64.147.160
172.67.147.184
192.64.117.41
049cb844f02b6529ffff3623141757e38b201cc22ec93a4787d621299bbe10ea
0fcd511e1e679f8e63a1ae82c96ac037b4b867053fb8a75eacfa73d1f9d5a6be
2acdbf0259b3538b9f9408713e13677daca0d9e77c3887031c618b9aa7fa28ce
2f461d7c5f430c11c094e149638812f65b26e03b1509a2dcc56f4a5a006d3991
3d3845e23a69bbf25b279f2aad019231039454366479fbbcbda10fcbc5a8f55d
4815c786c3094f5df8eaa5b8c1eb6dec8bd54c20b7959a091da806ded521d420
5349ac21660fc4e45f11e7478bf5eed21037d36228ec06325113de849ed223ba
570a6631252b8a52df4de0e953ae77dbdf524dfc3637cda2840494a0d2b49499
633a2ba230d676d9ec6f1c6a6dda4523525bf340cdedacdd438762301c49be4f
6a4d83bab98300c1f21df06e199710985d19c2f76471440850ceab83f2c693c1
6b7993f285b849b4f2d67dde531909028ad29db8f123db6870a3628241abbb74
71531f63fd4c0d93b77ccdccb1433384941156ac387e5aeb205e05b118b3869e
81d4af45a59c0e92ecc88c01a8096845d70d72c2fba8eace4f74b8eba605c202
8222dbb54f955a872712432c06539130fc4957e8e864b84b1397f08b73232f44
84e3c77025ace5af143972b4a40fc834dcdfd4e449d4b36a57e62326f16b3091
89980d6da11dc178f7f1fbe4ff47fde1f37163547229f8d1668284a187f56d4c
a38f447f0085918e8da8caa744cd31aba4e41063c18796ce3dcb109a6bc81539
a975310bae5d08fa81c95f0fe3c2736cef68dd33cae935e12bcda4bd7edc8ded
ae1afc351de89b184e08583f419583a2e5fc1de4103e0cc7b0615004265c56a7
cea6494bb7b68af458b958e408e8f2491427f0dcecddc932a807a6ed6d502630
ea4d2d0a14273348c41b259e556e98eb9e4e484876f09405a8d998ef8f293c7e
f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016
f398bf12bf2a5cbf3b30a2df9c1d9b246e768f4fc4e8a492f52a1b7e6c822b91