pub-7cb1770bb7274498b86dfff3570e75e8.r2.dev
Open in
urlscan Pro
172.66.0.235
Malicious Activity!
Public Scan
Submission: On September 30 via api from AU — Scanned from AU
Summary
TLS certificate: Issued by E5 on September 29th 2024. Valid for: 3 months.
This is the only time pub-7cb1770bb7274498b86dfff3570e75e8.r2.dev was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Email (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 172.66.0.235 172.66.0.235 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
8 | 104.18.6.145 104.18.6.145 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 104.18.25.163 104.18.25.163 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 104.17.24.14 104.17.24.14 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
12 | 4 |
ASN13335 (CLOUDFLARENET, US)
pub-7cb1770bb7274498b86dfff3570e75e8.r2.dev |
Apex Domain Subdomains |
Transfer | |
---|---|---|
8 |
fleek.co
storageapi.fleek.co — Cisco Umbrella Rank: 681708 |
220 KB |
2 |
gyazo.com
i.gyazo.com — Cisco Umbrella Rank: 54064 |
13 KB |
1 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 257 |
27 KB |
1 |
r2.dev
pub-7cb1770bb7274498b86dfff3570e75e8.r2.dev |
6 KB |
12 | 4 |
Domain | Requested by | |
---|---|---|
8 | storageapi.fleek.co |
pub-7cb1770bb7274498b86dfff3570e75e8.r2.dev
storageapi.fleek.co |
2 | i.gyazo.com |
pub-7cb1770bb7274498b86dfff3570e75e8.r2.dev
|
1 | cdnjs.cloudflare.com |
pub-7cb1770bb7274498b86dfff3570e75e8.r2.dev
|
1 | pub-7cb1770bb7274498b86dfff3570e75e8.r2.dev | |
12 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.r2.dev E5 |
2024-09-29 - 2024-12-28 |
3 months | crt.sh |
fleek.co Cloudflare Inc ECC CA-3 |
2024-01-29 - 2024-12-31 |
a year | crt.sh |
gyazo.com WE1 |
2024-09-27 - 2024-12-26 |
3 months | crt.sh |
cdnjs.cloudflare.com WE1 |
2024-09-28 - 2024-12-27 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://pub-7cb1770bb7274498b86dfff3570e75e8.r2.dev/fgfyi.html
Frame ID: AA094AFC58509921E4395AEBB0EE08DB
Requests: 12 HTTP requests in this frame
Screenshot
Page Title
Official E-mail Systems ®: Welcome!Detected technologies
Bootstrap (Web Frameworks) ExpandDetected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
jQuery (JavaScript Libraries) Expand
Detected patterns
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
12 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
fgfyi.html
pub-7cb1770bb7274498b86dfff3570e75e8.r2.dev/ |
6 KB 6 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
storageapi.fleek.co/7e7b17e1-2ce2-49cc-9400-d686af64bcf3-bucket/css/ |
152 KB 23 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
styles.css
storageapi.fleek.co/7e7b17e1-2ce2-49cc-9400-d686af64bcf3-bucket/css/ |
101 KB 19 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
storageapi.fleek.co/7e7b17e1-2ce2-49cc-9400-d686af64bcf3-bucket/js/ |
87 KB 31 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
common.min.js
storageapi.fleek.co/7e7b17e1-2ce2-49cc-9400-d686af64bcf3-bucket/js/ |
13 KB 5 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
app.min.js
storageapi.fleek.co/7e7b17e1-2ce2-49cc-9400-d686af64bcf3-bucket/js/ |
168 KB 48 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
c945f7048ab78f62a1aa6b53858f9ba8.png
i.gyazo.com/ |
13 KB 13 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ui.min.js
storageapi.fleek.co/7e7b17e1-2ce2-49cc-9400-d686af64bcf3-bucket/js/ |
59 KB 19 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
jquery.min.js
cdnjs.cloudflare.com/ajax/libs/jquery/3.3.1/ |
85 KB 27 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fa-solid-900.woff2
storageapi.fleek.co/7e7b17e1-2ce2-49cc-9400-d686af64bcf3-bucket/fonts/ |
74 KB 74 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
c945f7048ab78f62a1aa6b53858f9ba8.png
i.gyazo.com/ |
13 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
favicon.ico
storageapi.fleek.co/7e7b17e1-2ce2-49cc-9400-d686af64bcf3-bucket/img/ |
2 KB 841 B |
Other
image/vnd.microsoft.icon |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Email (Online)22 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery number| CONTROL_KEY number| SHIFT_KEY number| CONTROL_SHIFT_KEY function| roundcube_browser object| rcube_event function| rcube_event_engine function| rcube_check_email function| rcube_clone_object function| urlencode function| rcube_find_object function| rcube_mouse_is_over function| setCookie function| getCookie object| bw function| rcube_parse_query object| Base64 function| rcube_webmail object| rcmail function| rcube_elastic_ui object| UI1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
i.gyazo.com/ | Name: Gyazo_cfwoker Value: i |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdnjs.cloudflare.com
i.gyazo.com
pub-7cb1770bb7274498b86dfff3570e75e8.r2.dev
storageapi.fleek.co
104.17.24.14
104.18.25.163
104.18.6.145
172.66.0.235
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
21745e23ab210373deba89f3d0e235a5c3a71476e85e9ce8fabdf26c40065168
3d1202a7e500916ee408ff8de5cc9ad745768f3451f6f039a5d12aac7b3bb231
542ac2738d21d5ea4a39cd05efc447c3b5ca553f212f1bff44215d3f5f007a6f
57cd8ca9ca6e635c103951b8339f8661e3dbc6eded99c082c6ea1df8e866e9e4
753efdc34aa0463369369e8beba0129f264d71a02a2035a197599b5faf3889f2
8bbe0dfa5901fcb59116c40902ce85af62214ac7c6fe71f0331d27946027d6c4
978f0f7e4b935e437563451dcf7eafaba6ea3f519e75d2309e13da2be491eaff
cd398be1a91817126cef10224738e624358edf6f08043abad7e60c1aaeccc8d0
e49ef33af7ca609820d8d986f7c908a590993a3671982b68528021331c4e7cfe
f9ddd1e64827cb0fa09d74aa581ecfd468212261fa170ec9baddbd678389b342