pub-d1b0b7d98d8148258622b749aff1f314.r2.dev Open in urlscan Pro
2606:4700::6812:323 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://pub-d1b0b7d98d8148258622b749aff1f314.r2.dev/kjhhj.html
Submission: On June 26 via manual (June 26th 2024, 5:06:33 pm UTC) from US — Scanned from US

Summary HTTP 12 Redirects Behaviour Indicators

Summary

This website contacted 6 IPs in 2 countries across 7 domains to perform 12 HTTP transactions. The main IP is 2606:4700::6812:323, located in United States and belongs to CLOUDFLARENET, US. The main domain is pub-d1b0b7d98d8148258622b749aff1f314.r2.dev.
TLS certificate: Issued by E1 on June 3rd 2024. Valid for: 3 months.

This is the only time pub-d1b0b7d98d8148258622b749aff1f314.r2.dev was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
2	2606:4700::68... 2606:4700::6812:323	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2 2	2620:1ec:a92:... 2620:1ec:a92::156	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
3	2603:1036:300... 2603:1036:3000:60::15	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
4	2620:1ec:29:1... 2620:1ec:29:1::38	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	2a04:4e42:400... 2a04:4e42:400::649	54113 (FASTLY) (FASTLY)
1	172.67.74.152 172.67.74.152	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	109.169.71.112 109.169.71.112	20860 (IOMART-AS) (IOMART-AS)
12	6

2 2606:4700::6812:323 (United States)

ASN13335 (CLOUDFLARENET, US)

pub-d1b0b7d98d8148258622b749aff1f314.r2.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:1ec:a92::156 (United States) 2 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

www.office.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2603:1036:3000:60::15 (Chicago, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

login.microsoftonline.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2620:1ec:29:1::38 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

aadcdn.msauth.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:400::649 (United States)

ASN54113 (FASTLY, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.67.74.152 (United States)

ASN13335 (CLOUDFLARENET, US)

api.ipify.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 109.169.71.112 (United Kingdom)

ASN20860 (IOMART-AS, GB)

smtpjs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	msauth.net aadcdn.msauth.net — Cisco Umbrella Rank: 1015	4 KB
3	microsoftonline.com login.microsoftonline.com — Cisco Umbrella Rank: 11
2	office.com 2 redirects www.office.com — Cisco Umbrella Rank: 3023	1 KB
2	r2.dev pub-d1b0b7d98d8148258622b749aff1f314.r2.dev	135 KB
1	smtpjs.com smtpjs.com — Cisco Umbrella Rank: 151627	1 KB
1	ipify.org api.ipify.org — Cisco Umbrella Rank: 2418	169 B
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 816	30 KB
12	7

	Domain	Requested by
4	aadcdn.msauth.net	pub-d1b0b7d98d8148258622b749aff1f314.r2.dev
3	login.microsoftonline.com	pub-d1b0b7d98d8148258622b749aff1f314.r2.dev
2	www.office.com	2 redirects
2	pub-d1b0b7d98d8148258622b749aff1f314.r2.dev
1	smtpjs.com	pub-d1b0b7d98d8148258622b749aff1f314.r2.dev
1	api.ipify.org	pub-d1b0b7d98d8148258622b749aff1f314.r2.dev
1	code.jquery.com	pub-d1b0b7d98d8148258622b749aff1f314.r2.dev
12	7

This site contains no links.

Subject Issuer	Validity	Valid
*.r2.dev E1	`2024-06-03` - `2024-09-01`	3 months	crt.sh
stamp2.login.microsoftonline.com DigiCert SHA2 Secure Server CA	`2024-05-27` - `2025-05-27`	a year	crt.sh
aadcdn.msauth.net DigiCert SHA2 Secure Server CA	`2024-04-30` - `2025-04-30`	a year	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2023-07-11` - `2024-07-14`	a year	crt.sh
ipify.org GTS CA 1P5	`2024-05-19` - `2024-08-17`	3 months	crt.sh
smtpjs.com R10	`2024-06-08` - `2024-09-06`	3 months	crt.sh

This page contains 4 frames:

Primary Page: https://pub-d1b0b7d98d8148258622b749aff1f314.r2.dev/kjhhj.html
Frame ID: 11F51BAD5D8B951870C0FB58115DBDDF
Requests: 9 HTTP requests in this frame

Frame: https://login.microsoftonline.com/common/oauth2/logout?post_logout_redirect_uri=https%3A%2F%2Fwww.office.com%2F&state=jeHpy6KBkTgl2FjZzBmS1nYjBs3elh4Z_h-x-vkVOjIW91GPUF870KckUTp1wbF3oT5Uhf4a1Fc6iBoMTXWjEuk-XGNT-c5uHWVmw0HKvwEOprOmgOmF3JjekyXj5L8a&x-client-SKU=ID_NET8_0&x-client-ver=7.3.1.0
Frame ID: 535FB6F08D5E2300695C840D91871A1F
Requests: 1 HTTP requests in this frame

Frame: https://login.microsoftonline.com/common/oauth2/logout?post_logout_redirect_uri=https%3A%2F%2Fwww.office.com%2F&state=TTt8_tcTQOEaQ2LcWYIQecIwghy2VA9bgdW5ql0X0oqa2QbjjXCN0Wh9Eiu1Zx-fQz_SssGwXZNpLkMw9oVFk4VKClVygd3yUVlCn1bvetTjDLsnFq9fyzUOuj3ohY0u&x-client-SKU=ID_NET8_0&x-client-ver=7.3.1.0
Frame ID: B3CED00CE335C3787FD62B487D5B3CDD
Requests: 1 HTTP requests in this frame

Frame: https://login.microsoftonline.com/logout.srf?ct=1548343592&rver=64.4.6456.0&lc=1033&id=501392
Frame ID: 5E4B54E7A08BE97EC262BD562117F995
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

12
Requests

100 %
HTTPS

71 %
IPv6

7
Domains

7
Subdomains

6
IPs

2
Countries

170 kB
Transfer

223 kB
Size

14
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://www.office.com/estslogout?ru=/ HTTP 302
https://login.microsoftonline.com/common/oauth2/logout?post_logout_redirect_uri=https%3A%2F%2Fwww.office.com%2F&state=jeHpy6KBkTgl2FjZzBmS1nYjBs3elh4Z_h-x-vkVOjIW91GPUF870KckUTp1wbF3oT5Uhf4a1Fc6iBoMTXWjEuk-XGNT-c5uHWVmw0HKvwEOprOmgOmF3JjekyXj5L8a&x-client-SKU=ID_NET8_0&x-client-ver=7.3.1.0

Request Chain 1

https://www.office.com/estslogout?post_logout_redirect_uri=https%3A%2F%2Fwww.office.com%2F HTTP 302
https://login.microsoftonline.com/common/oauth2/logout?post_logout_redirect_uri=https%3A%2F%2Fwww.office.com%2F&state=TTt8_tcTQOEaQ2LcWYIQecIwghy2VA9bgdW5ql0X0oqa2QbjjXCN0Wh9Eiu1Zx-fQz_SssGwXZNpLkMw9oVFk4VKClVygd3yUVlCn1bvetTjDLsnFq9fyzUOuj3ohY0u&x-client-SKU=ID_NET8_0&x-client-ver=7.3.1.0

12 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request kjhhj.html Show response
pub-d1b0b7d98d8148258622b749aff1f314.r2.dev/ 108 KB
108 KB 613ms
254ms Document
text/html 2606:4700::6812:323
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://pub-d1b0b7d98d8148258622b749aff1f314.r2.dev/kjhhj.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:323 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 184b6f6ff931582fc906b0b502b685bc1055d74ff5336adce2c8039f68b48d4a

Request headers

Accept-Language: en-US,en;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

Accept-Ranges: bytes
CF-RAY: 899ec9badaed4217-EWR
Connection: keep-alive
Content-Length: 110085
Content-Type: text/html
Date: Wed, 26 Jun 2024 17:06:27 GMT
ETag: "26f0f256359a65bc2fbb07fc3ebe4be2"
Last-Modified: Wed, 26 Jun 2024 14:50:02 GMT
Server: cloudflare
Vary: Accept-Encoding

GET
H2

200

logout
login.microsoftonline.com/common/oauth2/ Frame 535F
Redirect Chain

https://www.office.com/estslogout?ru=/
https://login.microsoftonline.com/common/oauth2/logout?post_logout_redirect_uri=https%3A%2F%2Fwww.office.com%2F&state=jeHpy6KBkTgl2FjZzBmS1nYjBs3elh4Z_h-x-vkVOjIW91GPUF870KckUTp1wbF3oT5Uhf4a1Fc6iBo...

0
0

134ms
134ms

Document
text/html

2603:1036:3000:60::15
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://login.microsoftonline.com/common/oauth2/logout?post_logout_redirect_uri=https%3A%2F%2Fwww.office.com%2F&state=jeHpy6KBkTgl2FjZzBmS1nYjBs3elh4Z_h-x-vkVOjIW91GPUF870KckUTp1wbF3oT5Uhf4a1Fc6iBoMTXWjEuk-XGNT-c5uHWVmw0HKvwEOprOmgOmF3JjekyXj5L8a&x-client-SKU=ID_NET8_0&x-client-ver=7.3.1.0

Requested by

Host: pub-d1b0b7d98d8148258622b749aff1f314.r2.dev
URL: https://pub-d1b0b7d98d8148258622b749aff1f314.r2.dev/kjhhj.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2603:1036:3000:60::15 Chicago, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-US,en;q=0.9;q=0.9
Referer: https://pub-d1b0b7d98d8148258622b749aff1f314.r2.dev/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

cache-control: no-store, no-cache
content-encoding: gzip
content-length: 11292
content-type: text/html; charset=utf-8
date: Wed, 26 Jun 2024 17:06:27 GMT
expires: -1
link: <https://aadcdn.msftauth.net>; rel=preconnect; crossorigin,<https://aadcdn.msftauth.net>; rel=dns-prefetch,<https://aadcdn.msauth.net>; rel=dns-prefetch
nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}
p3p: CP="DSP CUR OTPi IND OTRi ONL FIN"
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+chi"}]}
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: on
x-ms-clitelem: 1,0,0,,
x-ms-ests-server: 2.1.18348.7 - NCUS ProdSlices
x-ms-request-id: 62773f0b-42e5-4021-8b59-d255be8a2800
x-ms-srs: 1.P
x-xss-protection: 0

Redirect headers

cache-control: no-cache
content-encoding: gzip
content-length: 0
content-type: text/html; charset=utf-8
date: Wed, 26 Jun 2024 17:06:27 GMT
location: https://login.microsoftonline.com/common/oauth2/logout?post_logout_redirect_uri=https%3A%2F%2Fwww.office.com%2F&state=jeHpy6KBkTgl2FjZzBmS1nYjBs3elh4Z_h-x-vkVOjIW91GPUF870KckUTp1wbF3oT5Uhf4a1Fc6iBoMTXWjEuk-XGNT-c5uHWVmw0HKvwEOprOmgOmF3JjekyXj5L8a&x-client-SKU=ID_NET8_0&x-client-ver=7.3.1.0
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
request-context: appId=
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-msedge-ref: Ref A: 0C188BF27DA743B4B43C9A9FA7C2F6F0 Ref B: EWR311000107009 Ref C: 2024-06-26T17:06:28Z
x-ua-compatible: IE=edge,chrome=1
x-xss-protection: 1; mode=block

GET
H2

200

logout
login.microsoftonline.com/common/oauth2/ Frame B3CE
Redirect Chain

https://www.office.com/estslogout?post_logout_redirect_uri=https%3A%2F%2Fwww.office.com%2F
https://login.microsoftonline.com/common/oauth2/logout?post_logout_redirect_uri=https%3A%2F%2Fwww.office.com%2F&state=TTt8_tcTQOEaQ2LcWYIQecIwghy2VA9bgdW5ql0X0oqa2QbjjXCN0Wh9Eiu1Zx-fQz_SssGwXZNpLkM...

0
0

188ms
188ms

Document
text/html

2603:1036:3000:60::15
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://login.microsoftonline.com/common/oauth2/logout?post_logout_redirect_uri=https%3A%2F%2Fwww.office.com%2F&state=TTt8_tcTQOEaQ2LcWYIQecIwghy2VA9bgdW5ql0X0oqa2QbjjXCN0Wh9Eiu1Zx-fQz_SssGwXZNpLkMw9oVFk4VKClVygd3yUVlCn1bvetTjDLsnFq9fyzUOuj3ohY0u&x-client-SKU=ID_NET8_0&x-client-ver=7.3.1.0

Requested by

Host: pub-d1b0b7d98d8148258622b749aff1f314.r2.dev
URL: https://pub-d1b0b7d98d8148258622b749aff1f314.r2.dev/kjhhj.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2603:1036:3000:60::15 Chicago, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-US,en;q=0.9;q=0.9
Referer: https://pub-d1b0b7d98d8148258622b749aff1f314.r2.dev/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

cache-control: no-store, no-cache
content-encoding: gzip
content-length: 11296
content-type: text/html; charset=utf-8
date: Wed, 26 Jun 2024 17:06:27 GMT
expires: -1
link: <https://aadcdn.msftauth.net>; rel=preconnect; crossorigin,<https://aadcdn.msftauth.net>; rel=dns-prefetch,<https://aadcdn.msauth.net>; rel=dns-prefetch
nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}
p3p: CP="DSP CUR OTPi IND OTRi ONL FIN"
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+chi"}]}
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: on
x-ms-clitelem: 1,0,0,,
x-ms-ests-server: 2.1.18348.7 - WUS3 ProdSlices
x-ms-request-id: 2012949a-721d-4c1b-8299-b5f1db7d1401
x-ms-srs: 1.P
x-xss-protection: 0

Redirect headers

cache-control: no-cache
content-encoding: gzip
content-length: 0
content-type: text/html; charset=utf-8
date: Wed, 26 Jun 2024 17:06:27 GMT
location: https://login.microsoftonline.com/common/oauth2/logout?post_logout_redirect_uri=https%3A%2F%2Fwww.office.com%2F&state=TTt8_tcTQOEaQ2LcWYIQecIwghy2VA9bgdW5ql0X0oqa2QbjjXCN0Wh9Eiu1Zx-fQz_SssGwXZNpLkMw9oVFk4VKClVygd3yUVlCn1bvetTjDLsnFq9fyzUOuj3ohY0u&x-client-SKU=ID_NET8_0&x-client-ver=7.3.1.0
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
request-context: appId=
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-msedge-ref: Ref A: F0BC649F3F8E4B21BAB01BC359854446 Ref B: EWR311000107009 Ref C: 2024-06-26T17:06:28Z
x-ua-compatible: IE=edge,chrome=1
x-xss-protection: 1; mode=block

GET
H2 200 logout.srf
login.microsoftonline.com/ Frame 5E4B 0
0 719ms
193ms Document
text/html 2603:1036:3000:60::15
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://login.microsoftonline.com/logout.srf?ct=1548343592&rver=64.4.6456.0&lc=1033&id=501392

Requested by

Host: pub-d1b0b7d98d8148258622b749aff1f314.r2.dev
URL: https://pub-d1b0b7d98d8148258622b749aff1f314.r2.dev/kjhhj.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2603:1036:3000:60::15 Chicago, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: en-US,en;q=0.9;q=0.9
Referer: https://pub-d1b0b7d98d8148258622b749aff1f314.r2.dev/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

cache-control: no-store, no-cache
content-encoding: gzip
content-length: 11149
content-type: text/html; charset=utf-8
date: Wed, 26 Jun 2024 17:06:27 GMT
expires: -1
link: <https://aadcdn.msauth.net>; rel=preconnect; crossorigin,<https://aadcdn.msauth.net>; rel=dns-prefetch,<https://aadcdn.msftauth.net>; rel=dns-prefetch
nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}
p3p: CP="DSP CUR OTPi IND OTRi ONL FIN"
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+chi"}]}
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: on
x-ms-ests-server: 2.1.18348.7 - SCUS ProdSlices
x-ms-request-id: b9e4f8c3-7343-4f12-b141-06c1a96cbe00
x-ms-srs: 1.P
x-xss-protection: 0

GET
H2 200 microsoft_logo_ed9c9eb0dce17d752bedea6b5acda6d9.png
aadcdn.msauth.net/ests/2.1/content/images/ 1 KB
2 KB 518ms
102ms Image
image/png 2620:1ec:29:1::38
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aadcdn.msauth.net/ests/2.1/content/images/microsoft_logo_ed9c9eb0dce17d752bedea6b5acda6d9.png
Requested by: Host: pub-d1b0b7d98d8148258622b749aff1f314.r2.dev
URL: https://pub-d1b0b7d98d8148258622b749aff1f314.r2.dev/kjhhj.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:29:1::38 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: f664b8138c2da6ec7565500a7cc839da6372614a31dc04c5a2169a26b8d9767c

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://pub-d1b0b7d98d8148258622b749aff1f314.r2.dev/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 26 Jun 2024 17:06:28 GMT
x-cache: TCP_HIT
x-cache-info: L1_T2
x-fd-int-roxy-purgeid: 4554691
content-length: 1057
x-ms-lease-status: unlocked
last-modified: Fri, 02 Nov 2018 20:25:31 GMT
etag: 0x8D641015620C409
x-azure-ref: 20240626T170628Z-r1b54d58cd7bkz54b0rgsxs3bg00000003q000000000d4dq
content-type: image/png
access-control-allow-origin: *
x-ms-request-id: b055f29d-e01e-0054-05e4-c42aa5000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=604800
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H2 200 arrow_left_7cc096da6aa2dba3f81fcc1c8262157c.png
aadcdn.msauth.net/ests/2.1/content/images/ 240 B
766 B 515ms
100ms Image
image/png 2620:1ec:29:1::38
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aadcdn.msauth.net/ests/2.1/content/images/arrow_left_7cc096da6aa2dba3f81fcc1c8262157c.png
Requested by: Host: pub-d1b0b7d98d8148258622b749aff1f314.r2.dev
URL: https://pub-d1b0b7d98d8148258622b749aff1f314.r2.dev/kjhhj.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:29:1::38 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: ab50358475adae73a435466c72d1a48ab124e8ae06614663716a46dce5ac8b83

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://pub-d1b0b7d98d8148258622b749aff1f314.r2.dev/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 26 Jun 2024 17:06:28 GMT
x-cache: TCP_HIT
x-cache-info: L1_T2
x-fd-int-roxy-purgeid: 4554691
content-length: 240
x-ms-lease-status: unlocked
last-modified: Fri, 02 Nov 2018 20:25:10 GMT
etag: 0x8D64101494D74DC
x-azure-ref: 20240626T170628Z-r1b54d58cd7bkz54b0rgsxs3bg00000003q000000000d4dm
content-type: image/png
access-control-allow-origin: *
x-ms-request-id: 295d1354-601e-0070-2fe4-c4179e000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=604800
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H2 200 ellipsis_white_0ad43084800fd8b50a2576b5173746fe.png
aadcdn.msauth.net/ests/2.1/content/images/ 207 B
717 B 892ms
477ms Image
image/png 2620:1ec:29:1::38
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aadcdn.msauth.net/ests/2.1/content/images/ellipsis_white_0ad43084800fd8b50a2576b5173746fe.png
Requested by: Host: pub-d1b0b7d98d8148258622b749aff1f314.r2.dev
URL: https://pub-d1b0b7d98d8148258622b749aff1f314.r2.dev/kjhhj.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:29:1::38 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 2c03ee38a4eba6a047c3a5bacb3eb461efe14be8acd46ae772350a4dea2f0175

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://pub-d1b0b7d98d8148258622b749aff1f314.r2.dev/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 26 Jun 2024 17:06:28 GMT
x-cache: TCP_MISS
x-fd-int-roxy-purgeid: 4554691
content-length: 207
x-ms-lease-status: unlocked
last-modified: Fri, 02 Nov 2018 20:25:24 GMT
etag: 0x8D6410151EBB082
x-azure-ref: 20240626T170628Z-r1b54d58cd7bkz54b0rgsxs3bg00000003q000000000d4dn
content-type: image/png
access-control-allow-origin: *
x-ms-request-id: 8273d26b-e01e-0078-59eb-c74f8f000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=604800
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H2 200 jquery-3.1.1.min.js Show response
code.jquery.com/ 85 KB
30 KB 402ms
94ms Script
application/javascript 2a04:4e42:400::649
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.1.1.min.js
Requested by: Host: pub-d1b0b7d98d8148258622b749aff1f314.r2.dev
URL: https://pub-d1b0b7d98d8148258622b749aff1f314.r2.dev/kjhhj.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:400::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: 85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://pub-d1b0b7d98d8148258622b749aff1f314.r2.dev/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 26 Jun 2024 17:06:28 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
age: 16879173
x-cache: HIT, HIT
content-length: 30070
x-served-by: cache-lga21947-LGA, cache-ewr18148-EWR
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
server: nginx
x-timer: S1719421588.305057,VS0,VE0
etag: W/"28feccc0-152b5"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=604800
accept-ranges: bytes
x-cache-hits: 29471, 2647

GET
H2 200 / Show response
api.ipify.org/ 34 B
169 B 723ms
417ms Script
application/javascript 172.67.74.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://api.ipify.org/?format=jsonp&callback=getPublic
Requested by: Host: pub-d1b0b7d98d8148258622b749aff1f314.r2.dev
URL: https://pub-d1b0b7d98d8148258622b749aff1f314.r2.dev/kjhhj.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.74.152 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8e8ffd4012db4c7705ad9773ff4fe4b5384fb83efe9482d702a8162754740c24

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://pub-d1b0b7d98d8148258622b749aff1f314.r2.dev/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 26 Jun 2024 17:06:28 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 899ec9beece08c89-EWR
content-length: 34
vary: Origin
content-type: application/javascript

GET
H2 200 smtp.js Show response
smtpjs.com/v3/ 871 B
1 KB 728ms
238ms Script
application/javascript 109.169.71.112
IOMART-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://smtpjs.com/v3/smtp.js
Requested by: Host: pub-d1b0b7d98d8148258622b749aff1f314.r2.dev
URL: https://pub-d1b0b7d98d8148258622b749aff1f314.r2.dev/kjhhj.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 109.169.71.112 , United Kingdom, ASN20860 (IOMART-AS, GB),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 1fd711cb491a361ef91e29c50de0680a4b156c0b34bb91e18570d0037263a776

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://pub-d1b0b7d98d8148258622b749aff1f314.r2.dev/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 26 Jun 2024 17:06:28 GMT
last-modified: Fri, 15 Mar 2024 10:08:42 GMT
server: Microsoft-IIS/10.0
etag: "b65c4ac2c076da1:0"
x-powered-by: ASP.NET
content-type: application/javascript
access-control-allow-origin: *
accept-ranges: bytes
content-length: 871

GET
H2 200 2_bc3d32a696895f78c19df6c717586a5d.svg
aadcdn.msauth.net/ests/2.1/content/images/backgrounds/ 2 KB
1 KB 509ms
100ms Image
image/svg+xml 2620:1ec:29:1::38
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aadcdn.msauth.net/ests/2.1/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg
Requested by: Host: pub-d1b0b7d98d8148258622b749aff1f314.r2.dev
URL: https://pub-d1b0b7d98d8148258622b749aff1f314.r2.dev/kjhhj.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:29:1::38 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://pub-d1b0b7d98d8148258622b749aff1f314.r2.dev/
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 26 Jun 2024 17:06:28 GMT
content-encoding: gzip
x-cache: TCP_HIT
x-cache-info: L1_T2
x-fd-int-roxy-purgeid: 4554691
content-length: 673
x-ms-lease-status: unlocked
last-modified: Thu, 13 Feb 2020 02:05:12 GMT
etag: 0x8D7B0292911C366
x-azure-ref: 20240626T170628Z-r1b54d58cd7bkz54b0rgsxs3bg00000003q000000000d4dp
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: 065a24d8-e01e-0068-36f8-c3ffad000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H/1.1 404
Not Found favicon.ico
pub-d1b0b7d98d8148258622b749aff1f314.r2.dev/ 27 KB
27 KB 192ms
192ms Other
text/html 2606:4700::6812:323
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://pub-d1b0b7d98d8148258622b749aff1f314.r2.dev/favicon.ico
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:323 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 570a6631252b8a52df4de0e953ae77dbdf524dfc3637cda2840494a0d2b49499

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://pub-d1b0b7d98d8148258622b749aff1f314.r2.dev/kjhhj.html
Accept-Language: en-US,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 26 Jun 2024 17:06:29 GMT
Server: cloudflare
Connection: keep-alive
CF-RAY: 899ec9c5d9074217-EWR
Content-Length: 27242
Vary: Accept-Encoding
Content-Type: text/html

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

16 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

14 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
www.office.com/	1970-01-20 21:37:30	Name: OH.DCAffinity Value: OH-eus
www.office.com/	1969-12-31 23:59:59	Name: OH.SID Value: 1adbd503-b0db-4735-83ca-200412f196bd
www.office.com/	1970-01-21 06:22:37	Name: OH.FLID Value: 18dc7944-9440-49b2-af6f-495668315bd0
login.microsoftonline.com/	1970-01-21 07:13:01	Name: ESTSSSOTILES Value: 1
login.microsoftonline.com/	1970-01-21 07:13:01	Name: AADSSOTILES Value: 1
login.microsoftonline.com/	1969-12-31 23:59:59	Name: ESTSAUTHLIGHT Value: +
login.microsoftonline.com/	1969-12-31 23:59:59	Name: x-ms-gateway-slice Value: estsfd
login.microsoftonline.com/	1969-12-31 23:59:59	Name: stsservicecookie Value: estsfd
.login.microsoftonline.com/	1969-12-31 23:59:59	Name: SignInStateCookie Value: CAgABFgIAAAApTwJmzXqdR4BN2miheQMYAgDs_wUA9P9MBiDNDwc9M2_XUQmMq60aXJuvTQOuST3m6KQeZjfiy-oK-yZ9x_2WTPZNMncZbKqNOG_uJ6aHPw
.login.microsoftonline.com/	1970-01-20 23:46:37	Name: ESTSAUTHPERSISTENT Value: AgABFwQAAAApTwJmzXqdR4BN2miheQMYAgDs_wUA9P9a8DoRzlMG-39b1H-6Y5CV7aMec6kYYUY9fNwF0ZphlUDcZ-JdhiOQ3gvrn4kO2KW8DpjRoM2k8Q
.login.microsoftonline.com/	1969-12-31 23:59:59	Name: ESTSAUTH Value: AgABFwQAAAApTwJmzXqdR4BN2miheQMYAgDs_wUA9P-ECy26TDB8pGJHPJaDTERgJJOIDBM_MFb5AKhkYJ47P4wvfltAbK7lCB983Xat35HgUtb7kjx-hA
login.microsoftonline.com/	1970-01-20 22:20:13	Name: buid Value: AQABGgEAAAApTwJmzXqdR4BN2miheQMYkmlh7-Ah3nsyfYPhVDaPzsz3CiNjsZDgqAOM054vpka7s0BvpDUMJu3hyw5zd3AwZH0QXcF7wBibRThLZ5BFniXkF5kBYnnbY9wGdsKrbekgAA
login.microsoftonline.com/	1970-01-20 22:20:13	Name: fpc Value: Arv-JsbuGYZPgWAO-KZhOr0
.login.microsoftonline.com/	1969-12-31 23:59:59	Name: esctx Value: PAQABBwEAAAApTwJmzXqdR4BN2miheQMYF63T2VfpE_KhwCrAgGRCXmNBhwZVER_NI8XatvaNEHLojnTa8LejNjCVgdARPcj7jMWJOMS2U61PmIW6JEVK4g7318GWUhkkUcHVkevq-MgRl70oWHzexl1GdqwFx7SZXHy7oa3DXc9iE9K9KvydfOuMGRKITAmQWuJ9ZKdtjCMgAA

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	verbose	URL: https://pub-d1b0b7d98d8148258622b749aff1f314.r2.dev/kjhhj.html Message: [DOM] Password field is not contained in a form: (More info: https://goo.gl/9p2vKq) %o
network	error	URL: https://pub-d1b0b7d98d8148258622b749aff1f314.r2.dev/favicon.ico Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aadcdn.msauth.net
api.ipify.org
code.jquery.com
login.microsoftonline.com
pub-d1b0b7d98d8148258622b749aff1f314.r2.dev
smtpjs.com
www.office.com
109.169.71.112
172.67.74.152
2603:1036:3000:60::15
2606:4700::6812:323
2620:1ec:29:1::38
2620:1ec:a92::156
2a04:4e42:400::649
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68
184b6f6ff931582fc906b0b502b685bc1055d74ff5336adce2c8039f68b48d4a
1fd711cb491a361ef91e29c50de0680a4b156c0b34bb91e18570d0037263a776
2c03ee38a4eba6a047c3a5bacb3eb461efe14be8acd46ae772350a4dea2f0175
570a6631252b8a52df4de0e953ae77dbdf524dfc3637cda2840494a0d2b49499
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
8e8ffd4012db4c7705ad9773ff4fe4b5384fb83efe9482d702a8162754740c24
ab50358475adae73a435466c72d1a48ab124e8ae06614663716a46dce5ac8b83
f664b8138c2da6ec7565500a7cc839da6372614a31dc04c5a2169a26b8d9767c

pub-d1b0b7d98d8148258622b749aff1f314.r2.dev Open in urlscan Pro 2606:4700::6812:323 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

12 Requests

100 %HTTPS

71 %IPv6

7 Domains

7 Subdomains

6 IPs

2 Countries

170 kBTransfer

223 kBSize

14 Cookies

0 Outgoing links

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

16 JavaScript Global Variables

14 Cookies

2 Console Messages

Indicators

pub-d1b0b7d98d8148258622b749aff1f314.r2.dev Open in urlscan Pro
2606:4700::6812:323 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

100 %
HTTPS

71 %
IPv6

7
Domains

7
Subdomains

6
IPs

2
Countries

170 kB
Transfer

223 kB
Size

14
Cookies

12 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!