pub-c665c8b4c9704b06942abefb6da4dfba.r2.dev

Summary

This website contacted 2 IPs in 3 countries across 3 domains to perform 5 HTTP transactions. The main IP is 2606:4700::6812:323, located in United States and belongs to CLOUDFLARENET, US. The main domain is pub-c665c8b4c9704b06942abefb6da4dfba.r2.dev.
TLS certificate: Issued by E1 on April 17th 2023. Valid for: 3 months.

This is the only time pub-c665c8b4c9704b06942abefb6da4dfba.r2.dev was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Cloudflare (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 1	3.75.252.117 3.75.252.117	16509 (AMAZON-02) (AMAZON-02)
1	148.72.207.47 148.72.207.47	26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC)
1 5	2606:4700::68... 2606:4700::6812:323	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	2

1 3.75.252.117 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-3-75-252-117.eu-central-1.compute.amazonaws.com

e.targito.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 148.72.207.47 (Singapore)

ASN26496 (AS-26496-GO-DADDY-COM-LLC, US)
PTR: 47.207.72.148.host.secureserver.net

ninegrapes.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2606:4700::6812:323 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

pub-c665c8b4c9704b06942abefb6da4dfba.r2.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	r2.dev 1 redirects pub-c665c8b4c9704b06942abefb6da4dfba.r2.dev	15 KB
1	ninegrapes.com ninegrapes.com	323 B
1	targito.com 1 redirects e.targito.com — Cisco Umbrella Rank: 874542	819 B
5	3

	Domain	Requested by
5	pub-c665c8b4c9704b06942abefb6da4dfba.r2.dev	1 redirects pub-c665c8b4c9704b06942abefb6da4dfba.r2.dev
1	ninegrapes.com
1	e.targito.com	1 redirects
5	3

This site contains links to these domains. Also see Links.

Domain
developers.cloudflare.com

Subject Issuer	Validity	Valid
ninegrapes.com cPanel, Inc. Certification Authority	`2023-05-01` - `2023-07-30`	3 months	crt.sh
*.r2.dev E1	`2023-04-17` - `2023-07-16`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://pub-c665c8b4c9704b06942abefb6da4dfba.r2.dev/authorisee.html?email=balaganapathi.cp@lohiagroup.com
Frame ID: 5636A9D11910B57801DD408B380F060C
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Not Found

Page URL History Show full URLs

https://pub-c665c8b4c9704b06942abefb6da4dfba.r2.dev/authorisee.html?email=balaganapathi.cp@lohiagroup.com Page URL
https://pub-c665c8b4c9704b06942abefb6da4dfba.r2.dev/cdn-cgi/phish-bypass?atok=qKpT89saitmVZqhmT_OF4sXT7eVUpzpVMNIVnwqWoTg-168482... HTTP 301
https://pub-c665c8b4c9704b06942abefb6da4dfba.r2.dev/authorisee.html?email=balaganapathi.cp@lohiagroup.com Page URL

Page Statistics

5
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

2
IPs

3
Countries

15 kB
Transfer

55 kB
Size

7
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://developers.cloudflare.com/r2/data-access/public-buckets/
Title: Public Access

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://pub-c665c8b4c9704b06942abefb6da4dfba.r2.dev/authorisee.html?email=balaganapathi.cp@lohiagroup.com Page URL
https://pub-c665c8b4c9704b06942abefb6da4dfba.r2.dev/cdn-cgi/phish-bypass?atok=qKpT89saitmVZqhmT_OF4sXT7eVUpzpVMNIVnwqWoTg-1684826806-0-%2Fauthorisee.html%3Femail%3Dbalaganapathi.cp%40lohiagroup.com HTTP 301
https://pub-c665c8b4c9704b06942abefb6da4dfba.r2.dev/authorisee.html?email=balaganapathi.cp@lohiagroup.com Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://e.targito.com/c?a=7838d2ad-c0ac-4398-b6af-ea62c78427ea&o=megaknihy_cz&m=e24d843c-46e0-448f-b9dc-dad648861167&c=ad16a225-640c-4304-9e8b-2a177b75d7a9&d=1661194854&l=product_btn_5&u=https%3A%2F%2Fninegrapes.com%2Fnew%2Fse%2Fcb4t8k%2F%2F%2F%2FYmFsYWdhbmFwYXRoaS5jcEBsb2hpYWdyb3VwLmNvbQ== HTTP 302
https://ninegrapes.com/new/se/cb4t8k////YmFsYWdhbmFwYXRoaS5jcEBsb2hpYWdyb3VwLmNvbQ==

5 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

YmFsYWdhbmFwYXRoaS5jcEBsb2hpYWdyb3VwLmNvbQ==
ninegrapes.com/new/se/cb4t8k////
Redirect Chain

https://e.targito.com/c?a=7838d2ad-c0ac-4398-b6af-ea62c78427ea&o=megaknihy_cz&m=e24d843c-46e0-448f-b9dc-dad648861167&c=ad16a225-640c-4304-9e8b-2a177b75d7a9&d=1661194854&l=product_btn_5&u=https%3A%2...
https://ninegrapes.com/new/se/cb4t8k////YmFsYWdhbmFwYXRoaS5jcEBsb2hpYWdyb3VwLmNvbQ==

0
323 B

577ms
217ms

Document
text/html

148.72.207.47
AS-26496-GO-DADDY...

General

Check archive.org

Show headers Download Go to

Full URL: https://ninegrapes.com/new/se/cb4t8k////YmFsYWdhbmFwYXRoaS5jcEBsb2hpYWdyb3VwLmNvbQ==
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 148.72.207.47 , Singapore, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS: 47.207.72.148.host.secureserver.net
Software: Apache /
Resource Hash

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Date: Tue, 23 May 2023 07:26:46 GMT
Keep-Alive: timeout=5, max=100
Server: Apache
Transfer-Encoding: chunked
refresh: 0;url=https://pub-c665c8b4c9704b06942abefb6da4dfba.r2.dev/authorisee.html?email=balaganapathi.cp@lohiagroup.com

Redirect headers

content-length: 0
date: Tue, 23 May 2023 07:26:45 GMT
location: https://ninegrapes.com/new/se/cb4t8k////YmFsYWdhbmFwYXRoaS5jcEBsb2hpYWdyb3VwLmNvbQ==
server: Kestrel

GET
H/1.1 200
OK authorisee.html Show response
pub-c665c8b4c9704b06942abefb6da4dfba.r2.dev/ 4 KB
2 KB 46ms
13ms Document
text/html 2606:4700::6812:323
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://pub-c665c8b4c9704b06942abefb6da4dfba.r2.dev/authorisee.html?email=balaganapathi.cp@lohiagroup.com

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:323 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6af5e25f61005fb68194b5deaf522e52f2f3f81cfbacc82a69dd78eed4939312

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://ninegrapes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

CF-RAY: 7cbb9293ef046993-FRA
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html; charset=UTF-8
Date: Tue, 23 May 2023 07:26:46 GMT
Server: cloudflare
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN

GET
H/1.1 200
OK cf.errors.css
pub-c665c8b4c9704b06942abefb6da4dfba.r2.dev/cdn-cgi/styles/ 24 KB
5 KB 9ms
9ms Stylesheet
text/css 2606:4700::6812:323
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://pub-c665c8b4c9704b06942abefb6da4dfba.r2.dev/cdn-cgi/styles/cf.errors.css

Requested by

Host: pub-c665c8b4c9704b06942abefb6da4dfba.r2.dev
URL: https://pub-c665c8b4c9704b06942abefb6da4dfba.r2.dev/authorisee.html?email=balaganapathi.cp@lohiagroup.com

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:323 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1103290e25ebda2712abe344a87facbac00ddaba712729be9fe5feef807bf91b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pub-c665c8b4c9704b06942abefb6da4dfba.r2.dev/authorisee.html?email=balaganapathi.cp@lohiagroup.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Date: Tue, 23 May 2023 07:26:46 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Thu, 18 May 2023 12:46:56 GMT
Server: cloudflare
ETag: W/"64661e40-5e44"
Transfer-Encoding: chunked
X-Frame-Options: DENY
Content-Type: text/css
Vary: Accept-Encoding
Cache-Control: max-age=7200, public
Connection: keep-alive
CF-RAY: 7cbb92940f1e6993-FRA
Expires: Tue, 23 May 2023 09:26:46 GMT

GET
H/1.1 200
OK icon-exclamation.png
pub-c665c8b4c9704b06942abefb6da4dfba.r2.dev/cdn-cgi/images/ 452 B
889 B 9ms
9ms Image
image/png 2606:4700::6812:323
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pub-c665c8b4c9704b06942abefb6da4dfba.r2.dev/cdn-cgi/images/icon-exclamation.png?1376755637

Requested by

Host: pub-c665c8b4c9704b06942abefb6da4dfba.r2.dev
URL: https://pub-c665c8b4c9704b06942abefb6da4dfba.r2.dev/cdn-cgi/styles/cf.errors.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:323 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pub-c665c8b4c9704b06942abefb6da4dfba.r2.dev/cdn-cgi/styles/cf.errors.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Date: Tue, 23 May 2023 07:26:46 GMT
X-Content-Type-Options: nosniff
Last-Modified: Thu, 18 May 2023 12:46:56 GMT
Server: cloudflare
ETag: "64661e40-1c4"
X-Frame-Options: DENY
Vary: Accept-Encoding
Content-Type: image/png
Cache-Control: max-age=7200, public
Connection: keep-alive
Accept-Ranges: bytes
CF-RAY: 7cbb92942f3e6993-FRA
Content-Length: 452
Expires: Tue, 23 May 2023 09:26:46 GMT

GET
H/1.1

404
Not Found

Primary Request authorisee.html Show response
pub-c665c8b4c9704b06942abefb6da4dfba.r2.dev/
Redirect Chain

https://pub-c665c8b4c9704b06942abefb6da4dfba.r2.dev/cdn-cgi/phish-bypass?atok=qKpT89saitmVZqhmT_OF4sXT7eVUpzpVMNIVnwqWoTg-1684826806-0-%2Fauthorisee.html%3Femail%3Dbalaganapathi.cp%40lohiagroup.com
https://pub-c665c8b4c9704b06942abefb6da4dfba.r2.dev/authorisee.html?email=balaganapathi.cp@lohiagroup.com

27 KB
7 KB

138ms
138ms

Document
text/html

2606:4700::6812:323
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://pub-c665c8b4c9704b06942abefb6da4dfba.r2.dev/authorisee.html?email=balaganapathi.cp@lohiagroup.com
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:323 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 570a6631252b8a52df4de0e953ae77dbdf524dfc3637cda2840494a0d2b49499

Request headers

Referer: https://pub-c665c8b4c9704b06942abefb6da4dfba.r2.dev/authorisee.html?email=balaganapathi.cp@lohiagroup.com
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

CF-RAY: 7cbb92ae19f66993-FRA
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html
Date: Tue, 23 May 2023 07:26:50 GMT
Server: cloudflare
Transfer-Encoding: chunked
Vary: Accept-Encoding

Redirect headers

CF-RAY: 7cbb92ae09e26993-FRA
Cache-Control: private, no-cache
Connection: keep-alive
Content-Length: 167
Content-Type: text/html
Date: Tue, 23 May 2023 07:26:50 GMT
Location: https://pub-c665c8b4c9704b06942abefb6da4dfba.r2.dev/authorisee.html?email=balaganapathi.cp@lohiagroup.com
Server: cloudflare
X-Content-Type-Options: nosniff
X-Frame-Options: DENY

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Cloudflare (Online)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless

7 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.targito.com/	1970-01-20 21:36:26	Name: 7838d2ad-c0ac-4398-b6af-ea62c78427ea Value: ad16a225-640c-4304-9e8b-2a177b75d7a9
.targito.com/	1970-01-20 21:36:26	Name: trgid_megaknihy_cz Value: ad16a225-640c-4304-9e8b-2a177b75d7a9
.targito.com/	1970-01-20 12:01:53	Name: 7838d2ad-c0ac-4398-b6af-ea62c78427ea_m Value: e24d843c-46e0-448f-b9dc-dad648861167
.targito.com/	1970-01-20 12:01:53	Name: trgm_megaknihy_cz Value: e24d843c-46e0-448f-b9dc-dad648861167
.targito.com/	1970-01-20 12:01:53	Name: 7838d2ad-c0ac-4398-b6af-ea62c78427ea_d Value: 1661194854
.targito.com/	1970-01-20 12:01:53	Name: trgd_megaknihy_cz Value: 1661194854
.pub-c665c8b4c9704b06942abefb6da4dfba.r2.dev/	1970-01-20 12:01:53	Name: __cf_mw_byp Value: qKpT89saitmVZqhmT_OF4sXT7eVUpzpVMNIVnwqWoTg-1684826806-0-/authorisee.html?email=balaganapathi.cp@lohiagroup.com

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://pub-c665c8b4c9704b06942abefb6da4dfba.r2.dev/authorisee.html?email=balaganapathi.cp@lohiagroup.com Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

e.targito.com
ninegrapes.com
pub-c665c8b4c9704b06942abefb6da4dfba.r2.dev
148.72.207.47
2606:4700::6812:323
3.75.252.117
1103290e25ebda2712abe344a87facbac00ddaba712729be9fe5feef807bf91b
570a6631252b8a52df4de0e953ae77dbdf524dfc3637cda2840494a0d2b49499
6af5e25f61005fb68194b5deaf522e52f2f3f81cfbacc82a69dd78eed4939312
f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016

pub-c665c8b4c9704b06942abefb6da4dfba.r2.dev Open in urlscan Pro 2606:4700::6812:323 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

5 Requests

100 %HTTPS

33 %IPv6

3 Domains

3 Subdomains

2 IPs

3 Countries

15 kBTransfer

55 kBSize

7 Cookies

1 Outgoing links

Page URL History

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

7 Cookies

1 Console Messages

Indicators

pub-c665c8b4c9704b06942abefb6da4dfba.r2.dev Open in urlscan Pro
2606:4700::6812:323 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

2
IPs

3
Countries

15 kB
Transfer

55 kB
Size

7
Cookies

5 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!