pub-07d0eb50d76d4ce0bc86ab5515ea0239.r2.dev Open in urlscan Pro
2606:4700::6812:323  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request callback.html Show response pub-07d0eb50d76d4ce0bc86ab5515ea0239.r2.dev/	25 KB 25 KB	1024ms 985ms	Document text/html	2606:4700::6812:323 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://pub-07d0eb50d76d4ce0bc86ab5515ea0239.r2.dev/callback.html?folder=UqkDk4x4HZsnHdrtxQ3M&ledge Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:323 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6349fea70f4971e1db7c005f645dc38d7759af283baf942bb62220e6bfba8c6e Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.57 Safari/537.36 Response headers Accept-Ranges bytes CF-RAY 895a1da13e91910a-FRA Connection keep-alive Content-Length 25240 Content-Type text/html Date Tue, 18 Jun 2024 09:05:07 GMT ETag "c9186754d7ce1bffe6697e7a1c7356e0" Last-Modified Sat, 24 Feb 2024 14:05:00 GMT Server cloudflare Vary Accept-Encoding
GET H2	200	docusign.svg docucdn-a.akamaihd.net/olive/images/2.47.0/header-logos/	2 KB 1 KB	534ms 166ms	Image image/svg+xml	23.56.109.68 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://docucdn-a.akamaihd.net/olive/images/2.47.0/header-logos/docusign.svg Requested by Host: pub-07d0eb50d76d4ce0bc86ab5515ea0239.r2.dev URL: https://pub-07d0eb50d76d4ce0bc86ab5515ea0239.r2.dev/callback.html?folder=UqkDk4x4HZsnHdrtxQ3M&ledge Protocol H2 Security TLS 1.3, , AES_256_GCM Server 23.56.109.68 Paris, France, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a23-56-109-68.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash 7c5e35b0c8299b8660a9c4f4393c7af2ced0143540a1ecdf266d174b690b779b Security Headers Name Value X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.57 Safari/537.36 Response headers date Tue, 18 Jun 2024 09:05:08 GMT content-encoding gzip x-content-type-options nosniff last-modified Fri, 12 Aug 2022 19:56:41 GMT server AkamaiNetStorage etag "440fe9f91ffea5c808b75d74298423e7:1660684826.417675" vary Accept-Encoding content-type image/svg+xml access-control-allow-origin * cache-control max-age=30085887 accept-ranges bytes content-length 1257
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/2.2.4/	84 KB 30 KB	62ms 10ms	Script text/javascript	2a00:1450:4001:80e::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js Requested by Host: pub-07d0eb50d76d4ce0bc86ab5515ea0239.r2.dev URL: https://pub-07d0eb50d76d4ce0bc86ab5515ea0239.r2.dev/callback.html?folder=UqkDk4x4HZsnHdrtxQ3M&ledge Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.57 Safari/537.36 Response headers date Tue, 18 Jun 2024 08:39:18 GMT content-encoding gzip x-content-type-options nosniff age 1549 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 30028 x-xss-protection 0 last-modified Tue, 03 Mar 2020 19:15:00 GMT server sffe cross-origin-opener-policy same-origin; report-to="hosted-libraries-pushers" vary Accept-Encoding report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Wed, 18 Jun 2025 08:39:18 GMT
GET H2	200	/ Show response api.ipify.org/	22 B 155 B	137ms 107ms	XHR application/json	104.26.13.205 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://api.ipify.org/?format=json Requested by Host: ajax.googleapis.com URL: https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.13.205 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 96bc29b8bd45f0a3ab7cbf607c97e1cb6487493053743181d9b2911b50c60568 Request headers Accept application/json, text/javascript, */*; q=0.01 Referer Accept-Language de-DE,de;q=0.9;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.57 Safari/537.36 Response headers date Tue, 18 Jun 2024 09:05:08 GMT cf-cache-status DYNAMIC server cloudflare vary Origin content-type application/json access-control-allow-origin * cf-ray 895a1da91aeb3a86-FRA content-length 22
GET		/ logo.clearbit.com/	0 0
GET H/1.1	404 Not Found	favicon.ico pub-07d0eb50d76d4ce0bc86ab5515ea0239.r2.dev/	27 KB 27 KB	699ms 698ms	Other text/html	2606:4700::6812:323 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://pub-07d0eb50d76d4ce0bc86ab5515ea0239.r2.dev/favicon.ico Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:323 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 570a6631252b8a52df4de0e953ae77dbdf524dfc3637cda2840494a0d2b49499 Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.57 Safari/537.36 Response headers Date Tue, 18 Jun 2024 09:05:09 GMT Server cloudflare Connection keep-alive CF-RAY 895a1dab8c92910a-FRA Content-Length 27242 Vary Accept-Encoding Content-Type text/html

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

logo.clearbit.com

URL

https://logo.clearbit.com/

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: DocuSign (Online)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

undefined| event object| fence object| sharedStorage function| $ function| jQuery function| Z function| sendEmail function| tmsend

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	verbose	URL: https://pub-07d0eb50d76d4ce0bc86ab5515ea0239.r2.dev/callback.html?folder=UqkDk4x4HZsnHdrtxQ3M&ledge Message: [DOM] Password field is not contained in a form: (More info: https://goo.gl/9p2vKq) %o
network	error	URL: https://pub-07d0eb50d76d4ce0bc86ab5515ea0239.r2.dev/favicon.ico Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
api.ipify.org
docucdn-a.akamaihd.net
logo.clearbit.com
pub-07d0eb50d76d4ce0bc86ab5515ea0239.r2.dev
logo.clearbit.com
104.26.13.205
23.56.109.68
2606:4700::6812:323
2a00:1450:4001:80e::200a
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
570a6631252b8a52df4de0e953ae77dbdf524dfc3637cda2840494a0d2b49499
6349fea70f4971e1db7c005f645dc38d7759af283baf942bb62220e6bfba8c6e
7c5e35b0c8299b8660a9c4f4393c7af2ced0143540a1ecdf266d174b690b779b
96bc29b8bd45f0a3ab7cbf607c97e1cb6487493053743181d9b2911b50c60568