pub-5a2296040faa461a95080730c6b44f31.r2.dev
Open in
urlscan Pro
104.18.3.35
Malicious Activity!
Public Scan
Submission: On July 25 via api from US — Scanned from CA
Summary
TLS certificate: Issued by E1 on June 3rd 2024. Valid for: 3 months.
This is the only time pub-5a2296040faa461a95080730c6b44f31.r2.dev was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: DocuSign (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 104.18.3.35 104.18.3.35 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 141.193.213.21 141.193.213.21 | 209242 (CLOUDFLAR...) (CLOUDFLARESPECTRUM Cloudflare) | |
1 | 172.67.161.35 172.67.161.35 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 104.21.42.250 104.21.42.250 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 13.107.246.40 13.107.246.40 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
1 | 173.194.66.95 173.194.66.95 | 15169 (GOOGLE) (GOOGLE) | |
7 | 7 |
ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US)
partner.zoom.us |
Apex Domain Subdomains |
Transfer | |
---|---|---|
1 |
googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 641 |
30 KB |
1 |
fusionsol.com
www.fusionsol.com |
358 KB |
1 |
cpanel.com
blog.cpanel.com |
44 KB |
1 |
freelogovectors.net
cdn.freelogovectors.net |
3 KB |
1 |
zoom.us
partner.zoom.us — Cisco Umbrella Rank: 919711 |
4 KB |
1 |
r2.dev
pub-5a2296040faa461a95080730c6b44f31.r2.dev |
253 KB |
0 |
pixabay.com
Failed
cdn.pixabay.com Failed |
|
7 | 7 |
Domain | Requested by | |
---|---|---|
1 | ajax.googleapis.com |
pub-5a2296040faa461a95080730c6b44f31.r2.dev
|
1 | www.fusionsol.com |
pub-5a2296040faa461a95080730c6b44f31.r2.dev
|
1 | blog.cpanel.com |
pub-5a2296040faa461a95080730c6b44f31.r2.dev
|
1 | cdn.freelogovectors.net |
pub-5a2296040faa461a95080730c6b44f31.r2.dev
|
1 | partner.zoom.us |
pub-5a2296040faa461a95080730c6b44f31.r2.dev
|
1 | pub-5a2296040faa461a95080730c6b44f31.r2.dev | |
0 | cdn.pixabay.com Failed |
pub-5a2296040faa461a95080730c6b44f31.r2.dev
|
7 | 7 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.r2.dev E1 |
2024-06-03 - 2024-09-01 |
3 months | crt.sh |
partner.zoom.us E5 |
2024-07-06 - 2024-10-04 |
3 months | crt.sh |
freelogovectors.net WE1 |
2024-06-15 - 2024-09-13 |
3 months | crt.sh |
cpanel.com WE1 |
2024-06-29 - 2024-09-27 |
3 months | crt.sh |
www.fusionsol.com DigiCert TLS RSA SHA256 2020 CA1 |
2023-12-07 - 2024-12-07 |
a year | crt.sh |
upload.video.google.com WR2 |
2024-07-01 - 2024-09-23 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://pub-5a2296040faa461a95080730c6b44f31.r2.dev/aviavtion.html
Frame ID: 33B2A18DE07CABC92931336FA35D5D76
Requests: 11 HTTP requests in this frame
Screenshot
Page Title
DocuSign Login - Enter your password to sign inDetected technologies
WordPress (CMS) ExpandDetected patterns
- /wp-(?:content|includes)/
jQuery (JavaScript Libraries) Expand
Detected patterns
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
7 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
aviavtion.html
pub-5a2296040faa461a95080730c6b44f31.r2.dev/ |
253 KB 253 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
DocuSign-Logo-Black2x.png
partner.zoom.us/wp-content/uploads/2022/05/ |
3 KB 4 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
docusign_logo-freelogovectors.net.svg
cdn.freelogovectors.net/svg17/ |
4 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Webmail-app.png
blog.cpanel.com/wp-content/uploads/2015/12/ |
44 KB 44 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
banner-docusign-2-1.png
www.fusionsol.com/wp-content/uploads/sites/2/2023/07/ |
358 KB 358 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
04-29-06-428_512.gif
cdn.pixabay.com/animation/2023/05/02/04/29/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/2.2.4/ |
84 KB 30 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
29 KB 29 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
30 KB 30 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
31 KB 31 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- cdn.pixabay.com
- URL
- https://cdn.pixabay.com/animation/2023/05/02/04/29/04-29-06-428_512.gif
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: DocuSign (Online)10 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery function| Z function| L50 function| L51 function| sendEmail function| tmsend function| _0xf5b6 function| _0x53ec function| tms20 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
blog.cpanel.com
cdn.freelogovectors.net
cdn.pixabay.com
partner.zoom.us
pub-5a2296040faa461a95080730c6b44f31.r2.dev
www.fusionsol.com
cdn.pixabay.com
104.18.3.35
104.21.42.250
13.107.246.40
141.193.213.21
172.67.161.35
173.194.66.95
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
1bf53b33743c5c45d6c944815f74cbf58b228806858fb6e3a0b86c1204f4be06
204a28c3bebc80bd13f805f114a9bf490794359f6fee70af075bd1f950a301b8
55cabfed27abb93cce6e9b66c9bd5a41fa746062e530eff212249c5e1b849f05
5b4fab3aedcdb87fe41473acec10cdbe5b3c9430dcf9985804ed81ec821891b8
7c5e35b0c8299b8660a9c4f4393c7af2ced0143540a1ecdf266d174b690b779b
8c1c29b2d0848cd0cda92a1766af713617707094153029bf2a10ce55abe69a9f
98dcc4ec9b1198b35a56a439bef6dd1ea639970635f6bb92b2a88e4b4af661ae
bb47e361f00dac7346e1f2d4806e55f73ff88385894a38fca2a1e032c25bed34
f2c05d1d723bd31646c2c5adb65c29f317feab778a02511fbdcbc180853ca042