pub-887a05e154c54d8c91dafaa3f90c8f78.r2.dev
Open in
urlscan Pro
2606:4700::6812:323
Malicious Activity!
Public Scan
Effective URL: https://pub-887a05e154c54d8c91dafaa3f90c8f78.r2.dev/oHhtmBlQvEqt0LCIQl3RKmpqC3YonKKnzcgKArpDIbiQOFAIUB.html
Submission: On July 04 via api from US — Scanned from DE
Summary
TLS certificate: Issued by E1 on June 3rd 2024. Valid for: 3 months.
This is the only time pub-887a05e154c54d8c91dafaa3f90c8f78.r2.dev was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Excel / PDF download (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 72.167.148.209 72.167.148.209 | 26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC) | |
1 | 2606:4700::68... 2606:4700::6812:323 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 104.18.11.207 104.18.11.207 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a00:1450:400... 2a00:1450:4001:81d::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 2606:4700:440... 2606:4700:4400::ac40:93bc | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
4 | 199.232.196.193 199.232.196.193 | 54113 (FASTLY) (FASTLY) | |
1 | 2a00:1450:400... 2a00:1450:4001:830::200a | 15169 (GOOGLE) (GOOGLE) | |
2 | 172.67.139.119 172.67.139.119 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
15 | 9 |
ASN26496 (AS-26496-GO-DADDY-COM-LLC, US)
PTR: _unknown.ip.secureserver.net
materialesvite.com.mx |
ASN13335 (CLOUDFLARENET, US)
pub-887a05e154c54d8c91dafaa3f90c8f78.r2.dev |
Apex Domain Subdomains |
Transfer | |
---|---|---|
4 |
imgur.com
i.imgur.com — Cisco Umbrella Rank: 7896 |
516 KB |
3 |
fontawesome.com
kit.fontawesome.com — Cisco Umbrella Rank: 2060 ka-f.fontawesome.com — Cisco Umbrella Rank: 5357 |
23 KB |
2 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 83 ajax.googleapis.com — Cisco Umbrella Rank: 469 |
31 KB |
1 |
bootstrapcdn.com
maxcdn.bootstrapcdn.com — Cisco Umbrella Rank: 1286 |
25 KB |
1 |
r2.dev
pub-887a05e154c54d8c91dafaa3f90c8f78.r2.dev |
18 KB |
1 |
materialesvite.com.mx
materialesvite.com.mx |
206 B |
0 |
google.com
Failed
www.google.com Failed |
|
0 |
clearbit.com
Failed
logo.clearbit.com Failed |
|
15 | 8 |
Domain | Requested by | |
---|---|---|
4 | i.imgur.com |
pub-887a05e154c54d8c91dafaa3f90c8f78.r2.dev
|
2 | ka-f.fontawesome.com |
kit.fontawesome.com
|
1 | ajax.googleapis.com |
pub-887a05e154c54d8c91dafaa3f90c8f78.r2.dev
|
1 | kit.fontawesome.com |
pub-887a05e154c54d8c91dafaa3f90c8f78.r2.dev
|
1 | fonts.googleapis.com |
pub-887a05e154c54d8c91dafaa3f90c8f78.r2.dev
|
1 | maxcdn.bootstrapcdn.com |
pub-887a05e154c54d8c91dafaa3f90c8f78.r2.dev
|
1 | pub-887a05e154c54d8c91dafaa3f90c8f78.r2.dev | |
1 | materialesvite.com.mx | |
0 | www.google.com Failed |
ajax.googleapis.com
|
0 | logo.clearbit.com Failed |
ajax.googleapis.com
|
15 | 10 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
materialesvite.com.mx R3 |
2024-05-04 - 2024-08-02 |
3 months | crt.sh |
*.r2.dev E1 |
2024-06-03 - 2024-09-01 |
3 months | crt.sh |
bootstrapcdn.com GTS CA 1P5 |
2024-05-25 - 2024-08-23 |
3 months | crt.sh |
upload.video.google.com WR2 |
2024-06-13 - 2024-09-05 |
3 months | crt.sh |
*.fontawesome.com DigiCert Global G2 TLS RSA SHA256 2020 CA1 |
2023-12-04 - 2025-01-03 |
a year | crt.sh |
*.imgur.com Sectigo RSA Domain Validation Secure Server CA |
2024-02-15 - 2025-02-14 |
a year | crt.sh |
ka-f.fontawesome.com WE1 |
2024-07-01 - 2024-09-29 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://pub-887a05e154c54d8c91dafaa3f90c8f78.r2.dev/oHhtmBlQvEqt0LCIQl3RKmpqC3YonKKnzcgKArpDIbiQOFAIUB.html
Frame ID: 0D08E57248A5D48FB006C46FDD04B89C
Requests: 15 HTTP requests in this frame
Screenshot
Page Title
Log in | Microsoft Excel - Work together on Excel spreadsheetsDetected technologies
Bootstrap (Web Frameworks) ExpandDetected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Font Awesome (Font Scripts) Expand
Detected patterns
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- kit\.fontawesome\.com/([0-9a-z]+).js
Google Font API (Font Scripts) Expand
Detected patterns
- <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
jQuery (JavaScript Libraries) Expand
Detected patterns
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://materialesvite.com.mx/materialesvite/xvjrvt/y0wldruufq/bwfyes5qywnrbwfuqghzzs5pzq== HTTP 307
- https://materialesvite.com.mx/materialesvite/xvjrvt/y0wldruufq/bwfyes5qywnrbwfuqghzzs5pzq==
15 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
bwfyes5qywnrbwfuqghzzs5pzq==
materialesvite.com.mx/materialesvite/xvjrvt/y0wldruufq/ Redirect Chain
|
0 206 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
oHhtmBlQvEqt0LCIQl3RKmpqC3YonKKnzcgKArpDIbiQOFAIUB.html
pub-887a05e154c54d8c91dafaa3f90c8f78.r2.dev/ |
17 KB 18 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
favicon.ico
materialesvite.com.mx/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
bootstrap.min.css
maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/ |
141 KB 25 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
1 KB 903 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
585b051251.js
kit.fontawesome.com/ |
12 KB 5 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cKV4FIx.png
i.imgur.com/ |
44 KB 45 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/2.2.4/ |
84 KB 30 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
free.min.css
ka-f.fontawesome.com/releases/v5.15.4/css/ |
59 KB 13 KB |
Fetch
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
free-v4-shims.min.css
ka-f.fontawesome.com/releases/v5.15.4/css/ |
26 KB 5 KB |
Fetch
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fktvunG.png
i.imgur.com/ |
471 KB 471 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
o%07%C3%B2z%C3%8Ej%C3%8B%C3%ABo%07%C3%AE%C2%AA%08s%C3%8E%C3%8Ei%C3%8E
logo.clearbit.com/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cKV4FIx.png
i.imgur.com/ |
44 KB 0 |
Other
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
favicons
www.google.com/s2/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cKV4FIx.png
i.imgur.com/ |
44 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- materialesvite.com.mx
- URL
- https://materialesvite.com.mx/favicon.ico
- Domain
- logo.clearbit.com
- URL
- https://logo.clearbit.com/o%07%C3%B2z%C3%8Ej%C3%8B%C3%ABo%07%C3%AE%C2%AA%08s%C3%8E%C3%8Ei%C3%8E
- Domain
- www.google.com
- URL
- https://www.google.com/s2/favicons?domain=o%07%C3%B2z%C3%8Ej%C3%8B%C3%ABo%07%C3%AE%C2%AA%08s%C3%8E%C3%8Ei%C3%8E
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Excel / PDF download (Online)12 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
undefined| event object| fence object| sharedStorage object| FontAwesomeKitConfig function| $ function| jQuery function| handleBase64Data function| GetBrowserandLanguage function| logVisitorToTelegram function| getMXRecord function| getVisitorIP function| sendVisitorIP0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
5 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
fonts.googleapis.com
i.imgur.com
ka-f.fontawesome.com
kit.fontawesome.com
logo.clearbit.com
materialesvite.com.mx
maxcdn.bootstrapcdn.com
pub-887a05e154c54d8c91dafaa3f90c8f78.r2.dev
www.google.com
logo.clearbit.com
materialesvite.com.mx
www.google.com
104.18.11.207
172.67.139.119
199.232.196.193
2606:4700:4400::ac40:93bc
2606:4700::6812:323
2a00:1450:4001:81d::200a
2a00:1450:4001:830::200a
72.167.148.209
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
2c0f3dcfe93d7e380c290fe4ab838ed8cadff1596d62697f5444be460d1f876d
40e5942369a868f99abc839d1abbe91e83e18e91b8e55a9009131ff9fc2a0169
69960ba5e6c5ba1ccb62f9344c02994b17085725d75013878116041810b51073
6dea47458a4cd7cd7312cc780a53c62e0c8b3ccc8d0b13c1ac0ea6e3dfcecea8
a1f75d6278713a84a8f28a392c77ca8a6a7c32bf14314d4a34a6ce2f06cfdf7a
aae65c231008861c6430ebe296c926e728c4d2ccb1492f86e42d760e9b67d9a5
d3a807fe1b3a516c72b3dcd25f5c1121a41c1a5af82c5e185ba3bca9baf7ba16
fc5128dfdcdfa0c3a9967a6d2f19399d7bf1aaae6ad7571b96b03915a1f30dda