pub-03bb804525264befbac4cc1e87ca3c79.r2.dev Open in urlscan Pro
2606:4700::6812:323  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
4 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request 2umfj7L4QK.html Show response pub-03bb804525264befbac4cc1e87ca3c79.r2.dev/	626 B 935 B	309ms 202ms	Document text/html	2606:4700::6812:323 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://pub-03bb804525264befbac4cc1e87ca3c79.r2.dev/2umfj7L4QK.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:323 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 57e3274db076a513a884eebc0e0e9c92f916e57be6c8b7c2d864f847dd42f82c Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" sec-ch-ua-mobile ?0 sec-ch-ua-platform "Win32" Response headers Accept-Ranges bytes CF-RAY 88fa947e7e149f1e-FRA Connection keep-alive Content-Length 626 Content-Type text/html Date Thu, 06 Jun 2024 18:49:02 GMT ETag "38bd393f9be3c14154ed67f225409300" Last-Modified Thu, 06 Jun 2024 15:59:49 GMT Server cloudflare Vary Accept-Encoding
GET H2	200	jquery-3.1.1.min.js Show response code.jquery.com/	85 KB 30 KB	157ms 47ms	Script application/javascript	2a04:4e42:400::649 FASTLY
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.1.1.min.js Requested by Host: pub-03bb804525264befbac4cc1e87ca3c79.r2.dev URL: https://pub-03bb804525264befbac4cc1e87ca3c79.r2.dev/2umfj7L4QK.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:400::649 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://pub-03bb804525264befbac4cc1e87ca3c79.r2.dev/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 06 Jun 2024 18:49:02 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish age 22899141 x-cache HIT, HIT content-length 30070 x-served-by cache-lga21947-LGA, cache-mxp6934-MXP last-modified Fri, 18 Oct 1991 12:00:00 GMT server nginx x-timer S1717699743.822368,VS0,VE0 etag W/"28feccc0-152b5" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=604800 accept-ranges bytes x-cache-hits 95, 40504
GET H3	200	DE Show response 6661b61d62a20.accicable.ru/	14 KB 6 KB	924ms 848ms	Script text/html	172.67.173.227 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://6661b61d62a20.accicable.ru/DE?c=m&Log.php&_=1717699742875 Requested by Host: code.jquery.com URL: https://code.jquery.com/jquery-3.1.1.min.js Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.173.227 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 117c0b11d7a5d03e031af48f6c46274c8412b8b93f1feb83742d882afe44961e Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://pub-03bb804525264befbac4cc1e87ca3c79.r2.dev/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Thu, 06 Jun 2024 18:49:03 GMT content-encoding br cf-cache-status DYNAMIC nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0TLCcq9yTZoSL%2FIN6IAe3pe01JZun0l8%2BJE%2FvScLJpM0cp%2BmeneFrsLcKB8JePWnIo4Lb%2BOJRAWWa0tcnu21mzKCJ1p5DW%2ByVenH7islI5pPs%2Fz9zAoipjoHxG9e8AlA1VVVhPa16%2FwfXw4e%2Fg%3D%3D"}],"group":"cf-nel","max_age":604800} content-type text/html; charset=UTF-8 access-control-allow-origin * cache-control no-store, no-cache, must-revalidate cf-ray 88fa9481afaf3803-FRA alt-svc h3=":443"; ma=86400 expires Thu, 19 Nov 1981 08:52:00 GMT
GET H3	200	crypto-js.min.js Show response cdnjs.cloudflare.com/ajax/libs/crypto-js/4.2.0/	59 KB 20 KB	125ms 63ms	Script application/javascript	104.17.24.14 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.2.0/crypto-js.min.js Requested by Host: 6661b61d62a20.accicable.ru URL: https://6661b61d62a20.accicable.ru/DE?c=m&Log.php&_=1717699742875 Protocol H3 Security QUIC, , AES_128_GCM Server 104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 769a555de553babc35a3338f344dd7aa16260c93cea2c7db290707c90484e7cc Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://pub-03bb804525264befbac4cc1e87ca3c79.r2.dev/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 06 Jun 2024 18:49:03 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} strict-transport-security max-age=15780000 age 190099 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 19621 last-modified Tue, 24 Oct 2023 23:03:52 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "65384d58-4ca5" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4tsyykq8uD5qpaD0CkvSY5T2eZNV1u40XVWHVOZ7mcFmf4wo%2FS3umXnfIHrVyjQd0puTtTPLoqkkS1otzeTDoTCX35KK1GcoGwK6X0yNLDC1MNvpkyQLUHFbCgxW2gE1xxtTDxsj"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=30672000 accept-ranges bytes timing-allow-origin * cf-ray 88fa94879d14bb8c-FRA expires Tue, 27 May 2025 18:49:03 GMT
GET H3	200	DE Show response 6661b61d62a20.accicable.ru/	13 KB 6 KB	815ms 809ms	Script text/html	172.67.173.227 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://6661b61d62a20.accicable.ru/DE?c=s&Log.php Requested by Host: 6661b61d62a20.accicable.ru URL: https://6661b61d62a20.accicable.ru/DE?c=m&Log.php&_=1717699742875 Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.173.227 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash bfe69814f0443352fcb277467c2a1d5f925ae091c001f8d1ef890e9aefd874d6 Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://pub-03bb804525264befbac4cc1e87ca3c79.r2.dev/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers pragma no-cache date Thu, 06 Jun 2024 18:49:04 GMT content-encoding br cf-cache-status DYNAMIC nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=21TFWwMIwzuJzqWXnmdo9Bucz%2Bicqpp3KWE2kiD2GCPHKxc8VEw3B1TwrwTfXycNCMzk9A0ii09qFdZad5ovFukelp5hHph5LQzLKDHO1oyHwJGqezvj%2BgV2t2ZWypUwSIC%2BYT2UqmIkqwpRpQ%3D%3D"}],"group":"cf-nel","max_age":604800} content-type text/html; charset=UTF-8 access-control-allow-origin * cache-control no-store, no-cache, must-revalidate cf-ray 88fa948739083803-FRA alt-svc h3=":443"; ma=86400 expires Thu, 19 Nov 1981 08:52:00 GMT
POST H3	200	DE Show response 6661b61d62a20.accicable.ru/	786 KB 594 KB	134ms 83ms	XHR text/html	172.67.173.227 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://6661b61d62a20.accicable.ru/DE?c=a&Log.php Requested by Host: code.jquery.com URL: https://code.jquery.com/jquery-3.1.1.min.js Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.173.227 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 165e6f077f6a93e8e24c1a4084a54c486e4d7277e379f2711f530905bf266c8f Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 Content-Type application/x-www-form-urlencoded; charset=UTF-8 Accept */* Referer https://pub-03bb804525264befbac4cc1e87ca3c79.r2.dev/ sec-ch-ua-platform "Win32" Response headers pragma no-cache date Thu, 06 Jun 2024 18:49:04 GMT content-encoding br cf-cache-status DYNAMIC nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SB1LAEtNUr6d2ptmhdaXgx%2BTnTMBfDrGqZ3qIv63g99jqw6sU37vbIRDypFCfRraFahTGyE1aX9Pv2EkOYXpkesmSxVtY6K%2FNAO%2B8N24ba4YrST%2BmbkMiXYQrBpy5cZ76w6fszwhBhs7pzMEWQ%3D%3D"}],"group":"cf-nel","max_age":604800} content-type text/html; charset=UTF-8 access-control-allow-origin * cache-control no-store, no-cache, must-revalidate cf-ray 88fa948cbccb65db-FRA alt-svc h3=":443"; ma=86400 expires Thu, 19 Nov 1981 08:52:00 GMT
GET H/1.1	404 Not Found	favicon.ico pub-03bb804525264befbac4cc1e87ca3c79.r2.dev/	27 KB 27 KB	178ms 178ms	Other text/html	2606:4700::6812:323 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://pub-03bb804525264befbac4cc1e87ca3c79.r2.dev/favicon.ico Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:323 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 570a6631252b8a52df4de0e953ae77dbdf524dfc3637cda2840494a0d2b49499 Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://pub-03bb804525264befbac4cc1e87ca3c79.r2.dev/2umfj7L4QK.html Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Thu, 06 Jun 2024 18:49:04 GMT Server cloudflare Connection keep-alive CF-RAY 88fa948c6d1a9f1e-FRA Content-Length 27242 Vary Accept-Encoding Content-Type text/html
GET H3	200	font-awesome.css cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/	37 KB 6 KB	100ms 54ms	Stylesheet text/css	104.17.24.14 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.css Requested by Host: 6661b61d62a20.accicable.ru URL: https://6661b61d62a20.accicable.ru/DE?c=s&Log.php Protocol H3 Security QUIC, , AES_128_GCM Server 104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 36e0a7e08bee65774168528938072c536437669c1b7458ac77976ec788e4439c Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://pub-03bb804525264befbac4cc1e87ca3c79.r2.dev/ Origin https://pub-03bb804525264befbac4cc1e87ca3c79.r2.dev Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 06 Jun 2024 18:49:05 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} strict-transport-security max-age=15780000 age 1295982 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 5884 last-modified Mon, 04 May 2020 16:10:07 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "5eb03e5f-9226" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=L0gpOrTKZhYI63vThXLWTNy5cRoQv112Skuwq040PEZGluKM9kHdEbUQ3N%2Bf7LrsIk%2B0rJLCSon5dQ%2BjhfGxPGEJeSWTlojMxPeProbH8JmD8MX3VEM9PXvV0f926inFurL6PMhQ"}],"group":"cf-nel","max_age":604800} content-type text/css; charset=utf-8 access-control-allow-origin * cache-control public, max-age=30672000 accept-ranges bytes timing-allow-origin * cf-ray 88fa9490bd028fca-FRA expires Tue, 27 May 2025 18:49:05 GMT
GET H2	200	jquery-3.1.1.min.js Show response code.jquery.com/	85 KB 0	0ms 0ms	Script application/javascript	2a04:4e42:400::649 FASTLY
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.1.1.min.js Requested by Host: 6661b61d62a20.accicable.ru URL: https://6661b61d62a20.accicable.ru/DE?c=s&Log.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:400::649 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash 85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://pub-03bb804525264befbac4cc1e87ca3c79.r2.dev/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-platform "Win32" Response headers date Thu, 06 Jun 2024 18:49:02 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish age 22899141 x-cache HIT, HIT content-length 30070 x-served-by cache-lga21947-LGA, cache-mxp6934-MXP last-modified Fri, 18 Oct 1991 12:00:00 GMT server nginx x-timer S1717699743.822368,VS0,VE0 etag W/"28feccc0-152b5" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=604800 accept-ranges bytes x-cache-hits 95, 40504
GET H2	200	picker_verify_fluent_authenticator_59892f1e05e3adf9fd2f71b42d92a27f.svg aadcdn.msauth.net/shared/1.0/content/images/	7 KB 3 KB	216ms 46ms	Image image/svg+xml	2620:1ec:bdf::43 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msauth.net/shared/1.0/content/images/picker_verify_fluent_authenticator_59892f1e05e3adf9fd2f71b42d92a27f.svg Requested by Host: 6661b61d62a20.accicable.ru URL: https://6661b61d62a20.accicable.ru/DE?c=s&Log.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2620:1ec:bdf::43 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash a7ee799dd5b6f6dbb70b043b766362a6724e71458f9839306c995f06b218c2f8 Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://pub-03bb804525264befbac4cc1e87ca3c79.r2.dev/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-ms-blob-type BlockBlob date Thu, 06 Jun 2024 18:49:05 GMT content-encoding gzip x-cache TCP_HIT x-fd-int-roxy-purgeid 4554691 content-length 2407 x-ms-lease-status unlocked last-modified Wed, 24 May 2023 10:11:49 GMT etag 0x8DB5C3F499A9B99 x-azure-ref 20240606T184905Z-16577d9575dq64g95y3g2rn0ys000000054000000000effk content-type image/svg+xml access-control-allow-origin * x-ms-request-id ba946588-d01e-000b-329b-b2c089000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	picker_verify_sms_27a6d18b56f46818420e60a773c36d4e.svg aadcdn.msauth.net/shared/1.0/content/images/	250 B 762 B	215ms 45ms	Image image/svg+xml	2620:1ec:bdf::43 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msauth.net/shared/1.0/content/images/picker_verify_sms_27a6d18b56f46818420e60a773c36d4e.svg Requested by Host: 6661b61d62a20.accicable.ru URL: https://6661b61d62a20.accicable.ru/DE?c=s&Log.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2620:1ec:bdf::43 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 8ed8f3acb9b87f99e42c74463d4e2be96ee85b8a87cd6eb874295ace420a5904 Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://pub-03bb804525264befbac4cc1e87ca3c79.r2.dev/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-ms-blob-type BlockBlob date Thu, 06 Jun 2024 18:49:05 GMT content-encoding gzip x-cache TCP_HIT x-cache-info L1_T2 x-fd-int-roxy-purgeid 4554691 content-length 199 x-ms-lease-status unlocked last-modified Fri, 17 Jan 2020 19:28:39 GMT etag 0x8D79B8374CE7F93 x-azure-ref 20240606T184905Z-16577d9575dq64g95y3g2rn0ys000000054000000000effg content-type image/svg+xml access-control-allow-origin * x-ms-request-id 2fcc5075-701e-003d-6510-b51b94000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	picker_verify_call_fe87496cc7a44412f7893a72099c120a.svg aadcdn.msauth.net/shared/1.0/content/images/	3 KB 2 KB	215ms 46ms	Image image/svg+xml	2620:1ec:bdf::43 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msauth.net/shared/1.0/content/images/picker_verify_call_fe87496cc7a44412f7893a72099c120a.svg Requested by Host: 6661b61d62a20.accicable.ru URL: https://6661b61d62a20.accicable.ru/DE?c=s&Log.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2620:1ec:bdf::43 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 55ce3b0ce5bc71339308107982cd7671f96014256ded0be36dc8062e64c847f1 Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://pub-03bb804525264befbac4cc1e87ca3c79.r2.dev/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-ms-blob-type BlockBlob date Thu, 06 Jun 2024 18:49:05 GMT content-encoding gzip x-cache TCP_HIT x-cache-info L1_T2 x-fd-int-roxy-purgeid 4554691 content-length 1173 x-ms-lease-status unlocked last-modified Fri, 17 Jan 2020 19:28:39 GMT etag 0x8D79B83749623C9 x-azure-ref 20240606T184905Z-16577d9575dq64g95y3g2rn0ys000000054000000000effh content-type image/svg+xml access-control-allow-origin * x-ms-request-id 44a4b9ba-d01e-001b-6679-b370ab000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	picker_verify_fluent_authenticator_b59c16ca9bf156438a8a96d45e33db64.svg aadcdn.msauth.net/shared/1.0/content/images/	7 KB 3 KB	214ms 45ms	Image image/svg+xml	2620:1ec:bdf::43 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msauth.net/shared/1.0/content/images/picker_verify_fluent_authenticator_b59c16ca9bf156438a8a96d45e33db64.svg Requested by Host: 6661b61d62a20.accicable.ru URL: https://6661b61d62a20.accicable.ru/DE?c=s&Log.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2620:1ec:bdf::43 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash a7ee799dd5b6f6dbb70b043b766362a6724e71458f9839306c995f06b218c2f8 Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://pub-03bb804525264befbac4cc1e87ca3c79.r2.dev/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-ms-blob-type BlockBlob date Thu, 06 Jun 2024 18:49:05 GMT content-encoding gzip x-cache TCP_HIT x-cache-info L1_T2 x-fd-int-roxy-purgeid 4554691 content-length 2407 x-ms-lease-status unlocked last-modified Fri, 11 Mar 2022 11:11:29 GMT etag 0x8DA034FE445C10D x-azure-ref 20240606T184905Z-16577d9575dq64g95y3g2rn0ys000000054000000000efff content-type image/svg+xml access-control-allow-origin * x-ms-request-id 7700afbe-701e-0079-5874-b3648d000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	picker_verify_call_c2616792e1950f83fdef6e72dab97293.svg aadcdn.msftauth.net/shared/1.0/content/images/	3 KB 2 KB	173ms 40ms	Image image/svg+xml	2606:2800:233:1cb7:261b:1f9c:2074:3c EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msftauth.net/shared/1.0/content/images/picker_verify_call_c2616792e1950f83fdef6e72dab97293.svg Requested by Host: 6661b61d62a20.accicable.ru URL: https://6661b61d62a20.accicable.ru/DE?c=s&Log.php Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (frc/4CF6) / Resource Hash 55ce3b0ce5bc71339308107982cd7671f96014256ded0be36dc8062e64c847f1 Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://pub-03bb804525264befbac4cc1e87ca3c79.r2.dev/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-ms-blob-type BlockBlob date Thu, 06 Jun 2024 18:49:05 GMT content-encoding gzip content-md5 XHrPYKKsqlxUvysuxtSE2A== age 6448588 x-cache HIT content-length 1173 x-ms-lease-status unlocked last-modified Wed, 24 May 2023 10:11:50 GMT server ECAcc (frc/4CF6) etag 0x8DB5C3F4A98E9BB vary Accept-Encoding content-type image/svg+xml access-control-allow-origin * x-ms-request-id 7e2cf0d4-f01e-005c-409b-7dcd0c000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET DATA	200 OK	truncated /	4 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	756 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 5d3357bd875b7335ace42e8ee3a64578e4253bed1a4e279109de403eedae3a69 Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	899 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash b7fcd37eaafe3f08647ed072d5289eadfff6c660a26cdef31532b3fcfb4a0bb2 Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	513 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58 Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 Response headers Content-Type image/svg+xml

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

22 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery string| t function| loadScript function| a0_0x4544 string| currentUrl function| a0_0x192ee9 function| a0_0x2497 object| CryptoJS function| a0_0x1f06 function| a0_0x129d string| caffeine string| ur function| Caffeine function| a0_0x58c9cf function| _0x5d71de string| em function| _0x3f21 undefined| re undefined| ba function| randomString function| _0x3c79

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

5 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://pub-03bb804525264befbac4cc1e87ca3c79.r2.dev/favicon.ico Message: Failed to load resource: the server responded with a status of 404 (Not Found)
javascript	warning	URL: https://6661b61d62a20.accicable.ru/DE?c=s&Log.php Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-3.1.1.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://6661b61d62a20.accicable.ru/DE?c=s&Log.php Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-3.1.1.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
recommendation	warning	URL: https://pub-03bb804525264befbac4cc1e87ca3c79.r2.dev/2umfj7L4QK.html Message: [DOM] Found 2 elements with non-unique id #idTxtBx_SAOTCC_OTC: (More info: https://goo.gl/9p2vKq) %o %o
recommendation	verbose	URL: https://pub-03bb804525264befbac4cc1e87ca3c79.r2.dev/2umfj7L4QK.html Message: [DOM] Password field is not contained in a form: (More info: https://goo.gl/9p2vKq) %o

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

6661b61d62a20.accicable.ru
aadcdn.msauth.net
aadcdn.msftauth.net
cdnjs.cloudflare.com
code.jquery.com
pub-03bb804525264befbac4cc1e87ca3c79.r2.dev
104.17.24.14
172.67.173.227
2606:2800:233:1cb7:261b:1f9c:2074:3c
2606:4700::6812:323
2620:1ec:bdf::43
2a04:4e42:400::649
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
117c0b11d7a5d03e031af48f6c46274c8412b8b93f1feb83742d882afe44961e
165e6f077f6a93e8e24c1a4084a54c486e4d7277e379f2711f530905bf266c8f
34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58
36e0a7e08bee65774168528938072c536437669c1b7458ac77976ec788e4439c
55ce3b0ce5bc71339308107982cd7671f96014256ded0be36dc8062e64c847f1
570a6631252b8a52df4de0e953ae77dbdf524dfc3637cda2840494a0d2b49499
57e3274db076a513a884eebc0e0e9c92f916e57be6c8b7c2d864f847dd42f82c
5d3357bd875b7335ace42e8ee3a64578e4253bed1a4e279109de403eedae3a69
769a555de553babc35a3338f344dd7aa16260c93cea2c7db290707c90484e7cc
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
8ed8f3acb9b87f99e42c74463d4e2be96ee85b8a87cd6eb874295ace420a5904
a7ee799dd5b6f6dbb70b043b766362a6724e71458f9839306c995f06b218c2f8
b7fcd37eaafe3f08647ed072d5289eadfff6c660a26cdef31532b3fcfb4a0bb2
bfe69814f0443352fcb277467c2a1d5f925ae091c001f8d1ef890e9aefd874d6