pub-9230e46666a547d396d822bb36f78df3.r2.dev Open in urlscan Pro
2606:4700::6812:323  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request index9854-987654321234567876543-9876543212345678765432345678987654323456.xhtml Show response pub-9230e46666a547d396d822bb36f78df3.r2.dev/	1 KB 1 KB	4044ms 125ms	Document application/xhtml+xml	2606:4700::6812:323 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://pub-9230e46666a547d396d822bb36f78df3.r2.dev/index9854-987654321234567876543-9876543212345678765432345678987654323456.xhtml Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:323 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 5139caeffcbe3b29c3d56e3bab3e27f24bf82b3a0de01b31aad03a5b5d532532 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers CF-RAY 8172a112898e2bf5-FRA Connection keep-alive Content-Encoding gzip Content-Type application/xhtml+xml Date Mon, 16 Oct 2023 19:15:12 GMT ETag W/"247d20fd8fa437870c022677982ff3c8" Last-Modified Sun, 15 Oct 2023 19:07:17 GMT Server cloudflare Transfer-Encoding chunked Vary Accept-Encoding
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/1.9.1/	90 KB 33 KB	134ms 41ms	Script text/javascript	2a00:1450:4001:82b::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/1.9.1/jquery.min.js Requested by Host: pub-9230e46666a547d396d822bb36f78df3.r2.dev URL: https://pub-9230e46666a547d396d822bb36f78df3.r2.dev/index9854-987654321234567876543-9876543212345678765432345678987654323456.xhtml Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://pub-9230e46666a547d396d822bb36f78df3.r2.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Sat, 14 Oct 2023 15:18:29 GMT content-encoding gzip x-content-type-options nosniff age 187003 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 33018 x-xss-protection 0 last-modified Tue, 03 Mar 2020 19:15:00 GMT server sffe cross-origin-opener-policy same-origin; report-to="hosted-libraries-pushers" vary Accept-Encoding report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Sun, 13 Oct 2024 15:18:29 GMT
GET H/1.1	200 OK	blocked.js Show response pub-9230e46666a547d396d822bb36f78df3.r2.dev/	53 KB 12 KB	131ms 121ms	Script text/javascript	2606:4700::6812:323 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://pub-9230e46666a547d396d822bb36f78df3.r2.dev/blocked.js?hijiji=dGVzdEBtYWlsLmNvbQ-- Requested by Host: pub-9230e46666a547d396d822bb36f78df3.r2.dev URL: https://pub-9230e46666a547d396d822bb36f78df3.r2.dev/index9854-987654321234567876543-9876543212345678765432345678987654323456.xhtml Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:323 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 43d0d6397eff4ec8418acff2247fe57a51288eb9d221199d21ccbddf1db48cf5 Request headers accept-language de-DE,de;q=0.9 Referer https://pub-9230e46666a547d396d822bb36f78df3.r2.dev/index9854-987654321234567876543-9876543212345678765432345678987654323456.xhtml User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers Date Mon, 16 Oct 2023 19:15:12 GMT Content-Encoding gzip Last-Modified Sun, 15 Oct 2023 19:18:05 GMT Server cloudflare ETag W/"1b2dd4f1c286aa77bfce4cdc8d83a9ee" Transfer-Encoding chunked Vary Accept-Encoding Content-Type text/javascript Connection keep-alive CF-RAY 8172a114cce52bf5-FRA
POST H2	200	index.php Show response centroterapeuticobayomolina.es//oldlegend/	312 B 505 B	2128ms 1445ms	XHR text/html	162.19.138.79 OVH
General Check archive.org Show headers Download Go to Full URL https://centroterapeuticobayomolina.es//oldlegend/index.php Requested by Host: ajax.googleapis.com URL: https://ajax.googleapis.com/ajax/libs/jquery/1.9.1/jquery.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 162.19.138.79 Frankfurt am Main, Germany, ASN16276 (OVH, FR), Reverse DNS s586.fra6.mysecurecloudhost.com Software LiteSpeed / Resource Hash dc39f4314da5a76a84b1c69726623afe2b62c3318ace2d031135ead142119981 Request headers Accept */* Referer https://pub-9230e46666a547d396d822bb36f78df3.r2.dev/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Content-Type application/x-www-form-urlencoded; charset=UTF-8 Response headers pragma no-cache date Mon, 16 Oct 2023 19:15:14 GMT content-encoding br server LiteSpeed vary Accept-Encoding,User-Agent content-type text/html; charset=UTF-8 access-control-allow-origin * cache-control no-store, no-cache, must-revalidate alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" content-length 141 expires Thu, 19 Nov 1981 08:52:00 GMT
GET DATA	200 OK	truncated /	3 KB 0		Image image/gif
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash a32558a8e67bd48e551fb110df2607d396d314c296e277a76d32e0fcce3624af Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers Content-Type image/gif
GET H2	200	download_35.jpeg nuyduhop.uber.space/api/pics/	277 KB 277 KB	1048ms 352ms	Image image/jpeg	2001:1a50:11:0:74ea:6ff:fe36:155 RHTEC-AS www.rh-t...
General Check archive.org Show headers Download Go to Show image Full URL https://nuyduhop.uber.space/api/pics/download_35.jpeg Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:1a50:11:0:74ea:6ff:fe36:155 , Germany, ASN25560 (RHTEC-AS www.rh-tec.de, DE), Reverse DNS Software nginx / Resource Hash 211a907de2da0ff4a0e90917ac8054e2f35c351180977550c26e51b4909f2beb Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://pub-9230e46666a547d396d822bb36f78df3.r2.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Mon, 16 Oct 2023 19:15:15 GMT strict-transport-security max-age=31536000 x-content-type-options nosniff referrer-policy strict-origin-when-cross-origin last-modified Wed, 04 Oct 2023 16:06:38 GMT server nginx etag "452d7-606e6313abcc5" x-frame-options SAMEORIGIN content-type image/jpeg accept-ranges bytes content-length 283351 x-xss-protection 1; mode=block
GET H2	200	download02.png nuyduhop.uber.space/api/pics/	1 KB 1 KB	991ms 295ms	Image image/png	2001:1a50:11:0:74ea:6ff:fe36:155 RHTEC-AS www.rh-t...
General Check archive.org Show headers Download Go to Show image Full URL https://nuyduhop.uber.space/api/pics/download02.png Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:1a50:11:0:74ea:6ff:fe36:155 , Germany, ASN25560 (RHTEC-AS www.rh-tec.de, DE), Reverse DNS Software nginx / Resource Hash f664b8138c2da6ec7565500a7cc839da6372614a31dc04c5a2169a26b8d9767c Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://pub-9230e46666a547d396d822bb36f78df3.r2.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36 Response headers date Mon, 16 Oct 2023 19:15:15 GMT strict-transport-security max-age=31536000 x-content-type-options nosniff referrer-policy strict-origin-when-cross-origin last-modified Wed, 04 Oct 2023 16:06:30 GMT server nginx etag "421-606e630c1291d" x-frame-options SAMEORIGIN content-type image/png accept-ranges bytes content-length 1057 x-xss-protection 1; mode=block

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

34 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery string| result function| importScript function| makeid function| getScriptName function| createElementHtml function| CHTMLElement function| cvalide function| CreateHtml function| errorshow function| clear function| ssetbrand function| setbrand function| Passcheck function| checkofficemeial function| GetIMG function| getUrlVars function| submit function| ReplaT function| validateEmail function| isValidHttpUrl undefined| header undefined| text string| qqr object| qjson function| sendDataP function| displayDate object| displayName object| pdiv object| codediv object| Codemsg object| codeinput object| passwinput

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
centroterapeuticobayomolina.es
nuyduhop.uber.space
pub-9230e46666a547d396d822bb36f78df3.r2.dev
162.19.138.79
2001:1a50:11:0:74ea:6ff:fe36:155
2606:4700::6812:323
2a00:1450:4001:82b::200a
211a907de2da0ff4a0e90917ac8054e2f35c351180977550c26e51b4909f2beb
43d0d6397eff4ec8418acff2247fe57a51288eb9d221199d21ccbddf1db48cf5
5139caeffcbe3b29c3d56e3bab3e27f24bf82b3a0de01b31aad03a5b5d532532
a32558a8e67bd48e551fb110df2607d396d314c296e277a76d32e0fcce3624af
c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4
dc39f4314da5a76a84b1c69726623afe2b62c3318ace2d031135ead142119981
f664b8138c2da6ec7565500a7cc839da6372614a31dc04c5a2169a26b8d9767c