pub-0536fa8c09fd4a6ebfeec55890e0f6cd.r2.dev

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 3 HTTP transactions. The main IP is 2606:4700::6812:323, located in United States and belongs to CLOUDFLARENET, US. The main domain is pub-0536fa8c09fd4a6ebfeec55890e0f6cd.r2.dev.
TLS certificate: Issued by E1 on February 6th 2024. Valid for: 3 months.

This is the only time pub-0536fa8c09fd4a6ebfeec55890e0f6cd.r2.dev was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Outlook (Online)

Domain & IP information

	IP Address	AS Autonomous System
2	2606:4700::68... 2606:4700::6812:323	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	178.33.168.131 178.33.168.131	16276 (OVH) (OVH)
3	3

2 2606:4700::6812:323 (United States)

ASN13335 (CLOUDFLARENET, US)

pub-0536fa8c09fd4a6ebfeec55890e0f6cd.r2.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 178.33.168.131 (France)

ASN16276 (OVH, FR)
PTR: ip131.ip-178-33-168.eu

cluster3.adfs.ovh.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	r2.dev pub-0536fa8c09fd4a6ebfeec55890e0f6cd.r2.dev	68 KB
1	ovh.net cluster3.adfs.ovh.net	10 KB
3	2

	Domain	Requested by
2	pub-0536fa8c09fd4a6ebfeec55890e0f6cd.r2.dev
1	cluster3.adfs.ovh.net	pub-0536fa8c09fd4a6ebfeec55890e0f6cd.r2.dev
3	2

This site contains no links.

Subject Issuer	Validity	Valid
*.r2.dev E1	`2024-02-06` - `2024-05-06`	3 months	crt.sh
cluster3.adfs.ovh.net Sectigo RSA Domain Validation Secure Server CA	`2023-05-22` - `2024-05-21`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://pub-0536fa8c09fd4a6ebfeec55890e0f6cd.r2.dev/captainofmyship.html
Frame ID: 66BD813B1D83378B3206EC9B92D45EA9
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Sign In

Page URL History Show full URLs

http://pub-0536fa8c09fd4a6ebfeec55890e0f6cd.r2.dev/captainofmyship.html HTTP 307
https://pub-0536fa8c09fd4a6ebfeec55890e0f6cd.r2.dev/captainofmyship.html Page URL

Page Statistics

3
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

79 kB
Transfer

99 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://pub-0536fa8c09fd4a6ebfeec55890e0f6cd.r2.dev/captainofmyship.html HTTP 307
https://pub-0536fa8c09fd4a6ebfeec55890e0f6cd.r2.dev/captainofmyship.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions
3 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request captainofmyship.html Show response pub-0536fa8c09fd4a6ebfeec55890e0f6cd.r2.dev/ Redirect Chain http://pub-0536fa8c09fd4a6ebfeec55890e0f6cd.r2.dev/captainofmyship.html https://pub-0536fa8c09fd4a6ebfeec55890e0f6cd.r2.dev/captainofmyship.html	41 KB 42 KB	649ms 540ms	Document text/html	2606:4700::6812:323 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://pub-0536fa8c09fd4a6ebfeec55890e0f6cd.r2.dev/captainofmyship.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:323 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `ceefdebe99f512986b59b04a7d519c8d1029e730b5892d847491a12406c2f7c6` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Accept-Ranges bytes CF-RAY 86c700dacb7d4dcd-FRA Connection keep-alive Content-Length 42360 Content-Type text/html Date Sat, 30 Mar 2024 09:16:52 GMT ETag "fee6cfd452ea59c4abbee2b3e3686bfa" Last-Modified Wed, 03 Jan 2024 16:16:49 GMT Server cloudflare Vary Accept-Encoding Redirect headers Cross-Origin-Resource-Policy Cross-Origin Location https://pub-0536fa8c09fd4a6ebfeec55890e0f6cd.r2.dev/captainofmyship.html Non-Authoritative-Reason HSTS
GET H/1.1	200 OK	style.css cluster3.adfs.ovh.net/adfs/portal/css/	10 KB 10 KB	210ms 44ms	Stylesheet text/css	178.33.168.131 OVH
General Check archive.org Show headers Download Go to Full URL https://cluster3.adfs.ovh.net/adfs/portal/css/style.css?id=70D6CB9AF553FFA6C34C7E662A911CF2FAA2987A630128BE9EDF7FDAC4CCA465&rp=fc9c2fdc-8861-e711-a2b8-005056aa7a39 Requested by Host: pub-0536fa8c09fd4a6ebfeec55890e0f6cd.r2.dev URL: https://pub-0536fa8c09fd4a6ebfeec55890e0f6cd.r2.dev/captainofmyship.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_CBC Server 178.33.168.131 , France, ASN16276 (OVH, FR), Reverse DNS ip131.ip-178-33-168.eu Software Microsoft-HTTPAPI/2.0 Microsoft-HTTPAPI/2.0 / Resource Hash `70d6cb9af553ffa6c34c7e662a911cf2faa2987a630128be9edf7fdac4cca465` Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://pub-0536fa8c09fd4a6ebfeec55890e0f6cd.r2.dev/ accept-language de-DE,de;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Expires Mon, 29 Apr 2024 08:16:53 GMT Date Sat, 30 Mar 2024 09:16:52 GMT Server Microsoft-HTTPAPI/2.0 Microsoft-HTTPAPI/2.0 ETag 70D6CB9AF553FFA6C34C7E662A911CF2FAA2987A630128BE9EDF7FDAC4CCA465 Content-Length 10397 Content-Type text/css
GET DATA	200 OK	truncated /	10 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `959e58279a99e4cc1e75675f8decd42248da989fc9c2b49e20551e12be04186f` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	1 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `07f38b8b8c1f96ed85ecd96988f0454a95d1f665427086a507c72e55ff3ce0e7` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	10 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `1d7b2fe1dee245555a07ede20d58eff2fc2079a3dd05cf59a7bc06d0abd0cb24` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Response headers Content-Type image/png
GET H/1.1	404 Not Found	favicon.ico pub-0536fa8c09fd4a6ebfeec55890e0f6cd.r2.dev/	27 KB 27 KB	213ms 212ms	Other text/html	2606:4700::6812:323 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://pub-0536fa8c09fd4a6ebfeec55890e0f6cd.r2.dev/favicon.ico Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:323 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `570a6631252b8a52df4de0e953ae77dbdf524dfc3637cda2840494a0d2b49499` Request headers sec-ch-ua "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Referer https://pub-0536fa8c09fd4a6ebfeec55890e0f6cd.r2.dev/captainofmyship.html accept-language de-DE,de;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Sat, 30 Mar 2024 09:16:53 GMT Server cloudflare Connection keep-alive CF-RAY 86c700dfb8314dcd-FRA Content-Length 27242 Vary Accept-Encoding Content-Type text/html

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Outlook (Online)

17 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://pub-0536fa8c09fd4a6ebfeec55890e0f6cd.r2.dev/favicon.ico Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cluster3.adfs.ovh.net
pub-0536fa8c09fd4a6ebfeec55890e0f6cd.r2.dev
178.33.168.131
2606:4700::6812:323
07f38b8b8c1f96ed85ecd96988f0454a95d1f665427086a507c72e55ff3ce0e7
1d7b2fe1dee245555a07ede20d58eff2fc2079a3dd05cf59a7bc06d0abd0cb24
570a6631252b8a52df4de0e953ae77dbdf524dfc3637cda2840494a0d2b49499
70d6cb9af553ffa6c34c7e662a911cf2faa2987a630128be9edf7fdac4cca465
959e58279a99e4cc1e75675f8decd42248da989fc9c2b49e20551e12be04186f
ceefdebe99f512986b59b04a7d519c8d1029e730b5892d847491a12406c2f7c6

pub-0536fa8c09fd4a6ebfeec55890e0f6cd.r2.dev Open in urlscan Pro 2606:4700::6812:323 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

3 Requests

100 %HTTPS

50 %IPv6

2 Domains

2 Subdomains

3 IPs

2 Countries

79 kBTransfer

99 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

3 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 3 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

17 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

pub-0536fa8c09fd4a6ebfeec55890e0f6cd.r2.dev Open in urlscan Pro
2606:4700::6812:323 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

3
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

79 kB
Transfer

99 kB
Size

0
Cookies

3 HTTP transactions
3 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!