pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev Open in urlscan Pro
2606:4700::6812:223 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev/gexa.html
Effective URL:
https://pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev/gexa.html
Submission: On May 01 via api (May 1st 2024, 12:07:19 am UTC) from US — Scanned from DE

Summary HTTP 12 Redirects Behaviour Indicators

Summary

This website contacted 6 IPs in 4 countries across 7 domains to perform 12 HTTP transactions. The main IP is 2606:4700::6812:223, located in United States and belongs to CLOUDFLARENET, US. The main domain is pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev.
TLS certificate: Issued by E1 on April 5th 2024. Valid for: 3 months.

This is the only time pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
2	2606:4700::68... 2606:4700::6812:223	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2 2	2620:1ec:a92:... 2620:1ec:a92::156	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
3	2603:1027:1:1... 2603:1027:1:158::8	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
4	2620:1ec:46::45 2620:1ec:46::45	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	2a04:4e42::649 2a04:4e42::649	54113 (FASTLY) (FASTLY)
1	104.26.12.205 104.26.12.205	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	109.169.71.112 109.169.71.112	20860 (IOMART-AS) (IOMART-AS)
12	6

2 2606:4700::6812:223 (United States)

ASN13335 (CLOUDFLARENET, US)

pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:1ec:a92::156 (United States) 2 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

www.office.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2603:1027:1:158::8 (Amsterdam, Netherlands)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

login.microsoftonline.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2620:1ec:46::45 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

aadcdn.msauth.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42::649 (United States)

ASN54113 (FASTLY, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.26.12.205 (None, )

ASN13335 (CLOUDFLARENET, US)

api.ipify.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 109.169.71.112 (United Kingdom)

ASN20860 (IOMART-AS, GB)

smtpjs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	msauth.net aadcdn.msauth.net — Cisco Umbrella Rank: 841	4 KB
3	microsoftonline.com login.microsoftonline.com — Cisco Umbrella Rank: 10
2	office.com 2 redirects www.office.com — Cisco Umbrella Rank: 3027	1 KB
2	r2.dev pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev	135 KB
1	smtpjs.com smtpjs.com — Cisco Umbrella Rank: 126003	1 KB
1	ipify.org api.ipify.org — Cisco Umbrella Rank: 2959	168 B
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 767	30 KB
12	7

	Domain	Requested by
4	aadcdn.msauth.net	pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev
3	login.microsoftonline.com	pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev
2	www.office.com	2 redirects
2	pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev
1	smtpjs.com	pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev
1	api.ipify.org	pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev
1	code.jquery.com	pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev
12	7

This site contains no links.

Subject Issuer	Validity	Valid
*.r2.dev E1	`2024-04-05` - `2024-07-04`	3 months	crt.sh
stamp2.login.microsoftonline.com DigiCert SHA2 Secure Server CA	`2024-04-04` - `2025-04-04`	a year	crt.sh
aadcdn.msauth.net DigiCert SHA2 Secure Server CA	`2024-04-30` - `2025-04-30`	a year	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2023-07-11` - `2024-07-14`	a year	crt.sh
ipify.org GTS CA 1P5	`2024-03-21` - `2024-06-19`	3 months	crt.sh
smtpjs.com R3	`2024-04-09` - `2024-07-08`	3 months	crt.sh

This page contains 4 frames:

Primary Page: https://pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev/gexa.html
Frame ID: B5EBC7A8A53AFA63D718A977DE74FBF1
Requests: 9 HTTP requests in this frame

Frame: https://login.microsoftonline.com/common/oauth2/logout?post_logout_redirect_uri=https%3A%2F%2Fwww.office.com%2F&state=As2JFAVI2NxzarGwFq5wUl0tpiPHX7-xRg4nHLDCcA55LzIHM7SnWQ9odsBwB7zzjvchne5US9DQq-4UPSqlxtlWVghmMQ3yTpRf_JGiL5JIOfpx02VudHG--9yRR9ew&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0
Frame ID: C41F55FE4FBA6E216EA668A7E3DA7189
Requests: 1 HTTP requests in this frame

Frame: https://login.microsoftonline.com/common/oauth2/logout?post_logout_redirect_uri=https%3A%2F%2Fwww.office.com%2F&state=shtehuEe1m2Maa3QFsKCl6snZKOkIEEfrRlWrx6dLRnLQahYITlhPikQECn4dw4PzueT72EIdov5IwNit5oHIrF_X7nSQTOlLFDG-Xi-XYkc8F8DnEAkDXrrTdof0Cy-&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0
Frame ID: 5ED8D4197567C4A661EA45D20A2E347D
Requests: 1 HTTP requests in this frame

Frame: https://login.microsoftonline.com/logout.srf?ct=1548343592&rver=64.4.6456.0&lc=1033&id=501392
Frame ID: F60223DCC22C3A2D6E99249B8407F1E2
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev/gexa.html HTTP 307
https://pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev/gexa.html Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

12
Requests

100 %
HTTPS

71 %
IPv6

7
Domains

7
Subdomains

6
IPs

4
Countries

170 kB
Transfer

223 kB
Size

14
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev/gexa.html HTTP 307
https://pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev/gexa.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://www.office.com/estslogout?ru=/ HTTP 302
https://login.microsoftonline.com/common/oauth2/logout?post_logout_redirect_uri=https%3A%2F%2Fwww.office.com%2F&state=As2JFAVI2NxzarGwFq5wUl0tpiPHX7-xRg4nHLDCcA55LzIHM7SnWQ9odsBwB7zzjvchne5US9DQq-4UPSqlxtlWVghmMQ3yTpRf_JGiL5JIOfpx02VudHG--9yRR9ew&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0

Request Chain 1

https://www.office.com/estslogout?post_logout_redirect_uri=https%3A%2F%2Fwww.office.com%2F HTTP 302
https://login.microsoftonline.com/common/oauth2/logout?post_logout_redirect_uri=https%3A%2F%2Fwww.office.com%2F&state=shtehuEe1m2Maa3QFsKCl6snZKOkIEEfrRlWrx6dLRnLQahYITlhPikQECn4dw4PzueT72EIdov5IwNit5oHIrF_X7nSQTOlLFDG-Xi-XYkc8F8DnEAkDXrrTdof0Cy-&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0

12 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request gexa.html Show response
pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev/
Redirect Chain

http://pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev/gexa.html
https://pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev/gexa.html

107 KB
108 KB

322ms
224ms

Document
text/html

2606:4700::6812:223
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev/gexa.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:223 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: abe10d4a2ac2c3197f554c9fe296e5e8c41b3c5f751ceb3cbf2f38533734e7fd

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

Accept-Ranges: bytes
CF-RAY: 87cb87baae6a3609-FRA
Connection: keep-alive
Content-Length: 110079
Content-Type: text/html
Date: Wed, 01 May 2024 00:07:14 GMT
ETag: "57a043530b430da57863b0a729795631"
Last-Modified: Wed, 24 Jan 2024 15:25:10 GMT
Server: cloudflare
Vary: Accept-Encoding

Redirect headers

Cross-Origin-Resource-Policy: Cross-Origin
Location: https://pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev/gexa.html
Non-Authoritative-Reason: HSTS

GET
H2

200

logout
login.microsoftonline.com/common/oauth2/ Frame C41F
Redirect Chain

https://www.office.com/estslogout?ru=/
https://login.microsoftonline.com/common/oauth2/logout?post_logout_redirect_uri=https%3A%2F%2Fwww.office.com%2F&state=As2JFAVI2NxzarGwFq5wUl0tpiPHX7-xRg4nHLDCcA55LzIHM7SnWQ9odsBwB7zzjvchne5US9DQq-4...

0
0

93ms
93ms

Document
text/html

2603:1027:1:158::8
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://login.microsoftonline.com/common/oauth2/logout?post_logout_redirect_uri=https%3A%2F%2Fwww.office.com%2F&state=As2JFAVI2NxzarGwFq5wUl0tpiPHX7-xRg4nHLDCcA55LzIHM7SnWQ9odsBwB7zzjvchne5US9DQq-4UPSqlxtlWVghmMQ3yTpRf_JGiL5JIOfpx02VudHG--9yRR9ew&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0

Requested by

Host: pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev
URL: https://pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev/gexa.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2603:1027:1:158::8 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

cache-control: no-store, no-cache
content-encoding: gzip
content-length: 11576
content-type: text/html; charset=utf-8
date: Wed, 01 May 2024 00:07:14 GMT
expires: -1
link: <https://aadcdn.msauth.net>; rel=preconnect; crossorigin,<https://aadcdn.msauth.net>; rel=dns-prefetch,<https://aadcdn.msftauth.net>; rel=dns-prefetch
nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}
p3p: CP="DSP CUR OTPi IND OTRi ONL FIN"
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+ams2"}]}
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: on
x-ms-clitelem: 1,0,0,,
x-ms-ests-server: 2.1.17910.13 - NEULR1 ProdSlices
x-ms-request-id: eb130c42-5034-45ad-a632-858d17ed2d00
x-ms-srs: 1.P
x-xss-protection: 0

Redirect headers

cache-control: no-cache
content-encoding: gzip
content-length: 0
content-type: text/html; charset=utf-8
date: Wed, 01 May 2024 00:07:14 GMT
location: https://login.microsoftonline.com/common/oauth2/logout?post_logout_redirect_uri=https%3A%2F%2Fwww.office.com%2F&state=As2JFAVI2NxzarGwFq5wUl0tpiPHX7-xRg4nHLDCcA55LzIHM7SnWQ9odsBwB7zzjvchne5US9DQq-4UPSqlxtlWVghmMQ3yTpRf_JGiL5JIOfpx02VudHG--9yRR9ew&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
request-context: appId=
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-msedge-ref: Ref A: 62D91081AA894F2A9AEDC45FBE6F9C6C Ref B: AMS231032606025 Ref C: 2024-05-01T00:07:14Z
x-ua-compatible: IE=edge,chrome=1
x-xss-protection: 1; mode=block

GET
H2

200

logout
login.microsoftonline.com/common/oauth2/ Frame 5ED8
Redirect Chain

https://www.office.com/estslogout?post_logout_redirect_uri=https%3A%2F%2Fwww.office.com%2F
https://login.microsoftonline.com/common/oauth2/logout?post_logout_redirect_uri=https%3A%2F%2Fwww.office.com%2F&state=shtehuEe1m2Maa3QFsKCl6snZKOkIEEfrRlWrx6dLRnLQahYITlhPikQECn4dw4PzueT72EIdov5IwN...

0
0

91ms
91ms

Document
text/html

2603:1027:1:158::8
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://login.microsoftonline.com/common/oauth2/logout?post_logout_redirect_uri=https%3A%2F%2Fwww.office.com%2F&state=shtehuEe1m2Maa3QFsKCl6snZKOkIEEfrRlWrx6dLRnLQahYITlhPikQECn4dw4PzueT72EIdov5IwNit5oHIrF_X7nSQTOlLFDG-Xi-XYkc8F8DnEAkDXrrTdof0Cy-&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0

Requested by

Host: pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev
URL: https://pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev/gexa.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2603:1027:1:158::8 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

cache-control: no-store, no-cache
content-encoding: gzip
content-length: 11566
content-type: text/html; charset=utf-8
date: Wed, 01 May 2024 00:07:14 GMT
expires: -1
link: <https://aadcdn.msauth.net>; rel=preconnect; crossorigin,<https://aadcdn.msauth.net>; rel=dns-prefetch,<https://aadcdn.msftauth.net>; rel=dns-prefetch
nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}
p3p: CP="DSP CUR OTPi IND OTRi ONL FIN"
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+ams2"}]}
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: on
x-ms-clitelem: 1,0,0,,
x-ms-ests-server: 2.1.17910.13 - FRC ProdSlices
x-ms-request-id: 58a68e25-6693-4876-82a6-db854e843a00
x-ms-srs: 1.P
x-xss-protection: 0

Redirect headers

cache-control: no-cache
content-encoding: gzip
content-length: 0
content-type: text/html; charset=utf-8
date: Wed, 01 May 2024 00:07:14 GMT
location: https://login.microsoftonline.com/common/oauth2/logout?post_logout_redirect_uri=https%3A%2F%2Fwww.office.com%2F&state=shtehuEe1m2Maa3QFsKCl6snZKOkIEEfrRlWrx6dLRnLQahYITlhPikQECn4dw4PzueT72EIdov5IwNit5oHIrF_X7nSQTOlLFDG-Xi-XYkc8F8DnEAkDXrrTdof0Cy-&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
request-context: appId=
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-msedge-ref: Ref A: 5809AA3A7FDC470CAF7C8DAEBF6772E1 Ref B: AMS231032606025 Ref C: 2024-05-01T00:07:14Z
x-ua-compatible: IE=edge,chrome=1
x-xss-protection: 1; mode=block

GET
H2 200 logout.srf
login.microsoftonline.com/ Frame F602 0
0 205ms
58ms Document
text/html 2603:1027:1:158::8
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://login.microsoftonline.com/logout.srf?ct=1548343592&rver=64.4.6456.0&lc=1033&id=501392

Requested by

Host: pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev
URL: https://pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev/gexa.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2603:1027:1:158::8 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

cache-control: no-store, no-cache
content-encoding: gzip
content-length: 11161
content-type: text/html; charset=utf-8
date: Wed, 01 May 2024 00:07:14 GMT
expires: -1
link: <https://aadcdn.msauth.net>; rel=preconnect; crossorigin,<https://aadcdn.msauth.net>; rel=dns-prefetch,<https://aadcdn.msftauth.net>; rel=dns-prefetch
nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}
p3p: CP="DSP CUR OTPi IND OTRi ONL FIN"
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+ams2"}]}
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: on
x-ms-ests-server: 2.1.17910.13 - FRC ProdSlices
x-ms-request-id: 5ba23126-95e1-4eaa-92c9-2587da8f3a00
x-ms-srs: 1.P
x-xss-protection: 0

GET
H2 200 microsoft_logo_ed9c9eb0dce17d752bedea6b5acda6d9.png
aadcdn.msauth.net/ests/2.1/content/images/ 1 KB
2 KB 187ms
42ms Image
image/png 2620:1ec:46::45
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aadcdn.msauth.net/ests/2.1/content/images/microsoft_logo_ed9c9eb0dce17d752bedea6b5acda6d9.png
Requested by: Host: pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev
URL: https://pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev/gexa.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:46::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: f664b8138c2da6ec7565500a7cc839da6372614a31dc04c5a2169a26b8d9767c

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 01 May 2024 00:07:14 GMT
x-cache: TCP_HIT
x-cache-info: L1_T2
x-fd-int-roxy-purgeid: 4554691
content-length: 1057
x-ms-lease-status: unlocked
last-modified: Fri, 02 Nov 2018 20:25:31 GMT
etag: 0x8D641015620C409
x-azure-ref: 20240501T000714Z-15ff4544644cf55pw2xfa90hsc000000031g00000000ae0e
content-type: image/png
access-control-allow-origin: *
x-ms-request-id: bacf78dc-e01e-0010-2146-9b55bc000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=604800
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H2 200 arrow_left_7cc096da6aa2dba3f81fcc1c8262157c.png
aadcdn.msauth.net/ests/2.1/content/images/ 240 B
764 B 188ms
42ms Image
image/png 2620:1ec:46::45
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aadcdn.msauth.net/ests/2.1/content/images/arrow_left_7cc096da6aa2dba3f81fcc1c8262157c.png
Requested by: Host: pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev
URL: https://pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev/gexa.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:46::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: ab50358475adae73a435466c72d1a48ab124e8ae06614663716a46dce5ac8b83

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 01 May 2024 00:07:14 GMT
x-cache: TCP_HIT
x-cache-info: L1_T2
x-fd-int-roxy-purgeid: 4554691
content-length: 240
x-ms-lease-status: unlocked
last-modified: Fri, 02 Nov 2018 20:25:10 GMT
etag: 0x8D64101494D74DC
x-azure-ref: 20240501T000714Z-15ff4544644cf55pw2xfa90hsc000000031g00000000ae0g
content-type: image/png
access-control-allow-origin: *
x-ms-request-id: 78e427dc-701e-002d-5c46-9babb6000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=604800
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H2 200 ellipsis_white_0ad43084800fd8b50a2576b5173746fe.png
aadcdn.msauth.net/ests/2.1/content/images/ 207 B
731 B 188ms
42ms Image
image/png 2620:1ec:46::45
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aadcdn.msauth.net/ests/2.1/content/images/ellipsis_white_0ad43084800fd8b50a2576b5173746fe.png
Requested by: Host: pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev
URL: https://pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev/gexa.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:46::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 2c03ee38a4eba6a047c3a5bacb3eb461efe14be8acd46ae772350a4dea2f0175

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 01 May 2024 00:07:14 GMT
x-cache: TCP_HIT
x-cache-info: L1_T2
x-fd-int-roxy-purgeid: 4554691
content-length: 207
x-ms-lease-status: unlocked
last-modified: Fri, 02 Nov 2018 20:25:24 GMT
etag: 0x8D6410151EBB082
x-azure-ref: 20240501T000714Z-15ff4544644cf55pw2xfa90hsc000000031g00000000ae0d
content-type: image/png
access-control-allow-origin: *
x-ms-request-id: e5dab48d-601e-004c-1246-9bc296000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=604800
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H2 200 jquery-3.1.1.min.js Show response
code.jquery.com/ 85 KB
30 KB 121ms
38ms Script
application/javascript 2a04:4e42::649
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.1.1.min.js
Requested by: Host: pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev
URL: https://pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev/gexa.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: 85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 00:07:14 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
age: 19721433
x-cache: HIT, HIT
content-length: 30070
x-served-by: cache-lga21947-LGA, cache-cph2320022-CPH
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
server: nginx
x-timer: S1714522035.694077,VS0,VE0
etag: W/"28feccc0-152b5"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=604800
accept-ranges: bytes
x-cache-hits: 88, 18177

GET
H2 200 / Show response
api.ipify.org/ 33 B
168 B 218ms
130ms Script
application/javascript 104.26.12.205
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://api.ipify.org/?format=jsonp&callback=getPublic
Requested by: Host: pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev
URL: https://pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev/gexa.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.26.12.205 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ff26221f792f293a6f093cdfc5cae11f5f890fce88daa021ec21c259d92fa7db

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 00:07:14 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 87cb87bceca89f12-FRA
content-length: 33
vary: Origin
content-type: application/javascript

GET
H2 200 smtp.js Show response
smtpjs.com/v3/ 871 B
1 KB 143ms
43ms Script
application/javascript 109.169.71.112
IOMART-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://smtpjs.com/v3/smtp.js
Requested by: Host: pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev
URL: https://pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev/gexa.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 109.169.71.112 , United Kingdom, ASN20860 (IOMART-AS, GB),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 1fd711cb491a361ef91e29c50de0680a4b156c0b34bb91e18570d0037263a776

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 00:07:13 GMT
last-modified: Fri, 15 Mar 2024 10:08:42 GMT
server: Microsoft-IIS/10.0
etag: "b65c4ac2c076da1:0"
x-powered-by: ASP.NET
content-type: application/javascript
access-control-allow-origin: *
accept-ranges: bytes
content-length: 871

GET
H2 200 2_bc3d32a696895f78c19df6c717586a5d.svg
aadcdn.msauth.net/ests/2.1/content/images/backgrounds/ 2 KB
1 KB 186ms
42ms Image
image/svg+xml 2620:1ec:46::45
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aadcdn.msauth.net/ests/2.1/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg
Requested by: Host: pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev
URL: https://pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev/gexa.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:46::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 01 May 2024 00:07:14 GMT
content-encoding: gzip
x-cache: TCP_HIT
x-cache-info: L1_T2
x-fd-int-roxy-purgeid: 4554691
content-length: 673
x-ms-lease-status: unlocked
last-modified: Thu, 13 Feb 2020 02:05:12 GMT
etag: 0x8D7B0292911C366
x-azure-ref: 20240501T000714Z-15ff4544644cf55pw2xfa90hsc000000031g00000000ae0f
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: baf72812-a01e-0050-4a46-9b86ad000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H/1.1 404
Not Found favicon.ico
pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev/ 27 KB
27 KB 188ms
187ms Other
text/html 2606:4700::6812:223
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev/favicon.ico
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:223 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 570a6631252b8a52df4de0e953ae77dbdf524dfc3637cda2840494a0d2b49499

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev/gexa.html
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 01 May 2024 00:07:15 GMT
Server: cloudflare
Connection: keep-alive
CF-RAY: 87cb87bf694c3609-FRA
Content-Length: 27242
Vary: Accept-Encoding
Content-Type: text/html

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

14 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
www.office.com/	1970-01-20 20:15:50	Name: OH.DCAffinity Value: OH-weu
www.office.com/	1969-12-31 23:59:59	Name: OH.SID Value: 602d0f68-4708-49ac-93a7-df88fea8be43
www.office.com/	1970-01-21 05:00:58	Name: OH.FLID Value: 9dd80f0a-6cb7-4d88-bf50-f4f5c4a5e850
login.microsoftonline.com/	1970-01-21 05:51:22	Name: ESTSSSOTILES Value: 1
login.microsoftonline.com/	1970-01-21 05:51:22	Name: AADSSOTILES Value: 1
login.microsoftonline.com/	1969-12-31 23:59:59	Name: ESTSAUTHLIGHT Value: +
login.microsoftonline.com/	1969-12-31 23:59:59	Name: x-ms-gateway-slice Value: estsfd
login.microsoftonline.com/	1969-12-31 23:59:59	Name: stsservicecookie Value: estsfd
.login.microsoftonline.com/	1969-12-31 23:59:59	Name: SignInStateCookie Value: CAgABFgIAAADnfolhJpSnRYB1SVj-Hgd8AgDs_wUA9P9aeVA7iXl-_xSM5AsTNCGM7C-DUytRSUv5H0vqJ3aJMchByIlcLbM3eotomdYmqYPNrfmX9Na3_Q
.login.microsoftonline.com/	1970-01-20 22:24:58	Name: ESTSAUTHPERSISTENT Value: AgABFwQAAADnfolhJpSnRYB1SVj-Hgd8AgDs_wUA9P_s3ZDPtQGApN5exJuICrIUGH1cnXlb00FY0DtdxCDkETgvTSUq3SL2QAwxebpuhtuRbMJRKvJSEg
.login.microsoftonline.com/	1969-12-31 23:59:59	Name: ESTSAUTH Value: AgABFwQAAADnfolhJpSnRYB1SVj-Hgd8AgDs_wUA9P9ZIRfar4m-VtLevtvt2d021yht9eK6TL6JE-INRP1GL86DWNRCv9J-LuzpXhusFavWvZwZeo6WVw
login.microsoftonline.com/	1970-01-20 20:58:34	Name: buid Value: AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8Qd40b0KZnkqAwyYsxpoyvmd_p9kLWrrCNuoQeJRXVNyKggKdlmnGP-bnmoWgPhp150iXxrcnDJjDZzZB-hz7ePmSr2tH4K2zBb4Tdw2O4fogAA
login.microsoftonline.com/	1970-01-20 20:58:34	Name: fpc Value: AsE_LIM6UChHis7V2nlO6x4
.login.microsoftonline.com/	1969-12-31 23:59:59	Name: esctx Value: PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8PRL6JHS1DKWF51nP7RQtKv1F5_jpvJt8CE_zMlOAV7tvkDQlduNPpSah5HitM2pEef_gyCwwajMAExv9VQdcJgPMh3Jt0CchVpfhMirRW79NtLZDW2rFYJ8J6YippEliBy9agSVSZqRyWF3AxyKxivdGJw_znGEDKLN4N-pMLhUgAA

41 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	URL: https://pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev/gexa.html Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev/gexa.html Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev/gexa.html Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev/gexa.html Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev/gexa.html Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev/gexa.html Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev/gexa.html Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev/gexa.html Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev/gexa.html Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev/gexa.html Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev/gexa.html Message: Third-party cookie will be blocked. Learn more in the Issues tab.
recommendation	verbose	URL: https://pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev/gexa.html Message: [DOM] Password field is not contained in a form: (More info: https://goo.gl/9p2vKq) %o
other	warning	URL: https://pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev/gexa.html Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev/gexa.html Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev/gexa.html Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev/gexa.html Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev/gexa.html Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev/gexa.html Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev/gexa.html Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev/gexa.html Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev/gexa.html Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev/gexa.html Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev/gexa.html Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev/gexa.html Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev/gexa.html Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev/gexa.html Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev/gexa.html Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev/gexa.html Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev/gexa.html Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev/gexa.html Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev/gexa.html Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev/gexa.html Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev/gexa.html Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev/gexa.html Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev/gexa.html Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev/gexa.html Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev/gexa.html Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev/gexa.html Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev/gexa.html Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev/gexa.html Message: Third-party cookie will be blocked. Learn more in the Issues tab.
network	error	URL: https://pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev/favicon.ico Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aadcdn.msauth.net
api.ipify.org
code.jquery.com
login.microsoftonline.com
pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev
smtpjs.com
www.office.com
104.26.12.205
109.169.71.112
2603:1027:1:158::8
2606:4700::6812:223
2620:1ec:46::45
2620:1ec:a92::156
2a04:4e42::649
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68
1fd711cb491a361ef91e29c50de0680a4b156c0b34bb91e18570d0037263a776
2c03ee38a4eba6a047c3a5bacb3eb461efe14be8acd46ae772350a4dea2f0175
570a6631252b8a52df4de0e953ae77dbdf524dfc3637cda2840494a0d2b49499
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
ab50358475adae73a435466c72d1a48ab124e8ae06614663716a46dce5ac8b83
abe10d4a2ac2c3197f554c9fe296e5e8c41b3c5f751ceb3cbf2f38533734e7fd
f664b8138c2da6ec7565500a7cc839da6372614a31dc04c5a2169a26b8d9767c
ff26221f792f293a6f093cdfc5cae11f5f890fce88daa021ec21c259d92fa7db

pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev Open in urlscan Pro 2606:4700::6812:223 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

12 Requests

100 %HTTPS

71 %IPv6

7 Domains

7 Subdomains

6 IPs

4 Countries

170 kBTransfer

223 kBSize

14 Cookies

0 Outgoing links

Page URL History

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

13 JavaScript Global Variables

14 Cookies

41 Console Messages

Indicators

pub-239ca9e3d2bc4f30a3a8759e85918696.r2.dev Open in urlscan Pro
2606:4700::6812:223 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

100 %
HTTPS

71 %
IPv6

7
Domains

7
Subdomains

6
IPs

4
Countries

170 kB
Transfer

223 kB
Size

14
Cookies

12 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!