clear-sign-ledger-activation.com
Open in
urlscan Pro
172.67.155.219
Malicious Activity!
Public Scan
Effective URL: https://clear-sign-ledger-activation.com/
Submission: On December 13 via manual from IN — Scanned from DE
Summary
TLS certificate: Issued by WE1 on December 13th 2024. Valid for: 3 months.
This is the only time clear-sign-ledger-activation.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Ledger (Crypto Exchange)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 3.108.180.245 3.108.180.245 | 16509 (AMAZON-02) (AMAZON-02) | |
2 2 | 104.244.154.95 104.244.154.95 | 40676 (AS40676) (AS40676) | |
1 6 | 172.67.155.219 172.67.155.219 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 2606:4700::68... 2606:4700::6812:ba1f | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 2 | 2606:4700::68... 2606:4700::6812:15c4 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a04:4e42:200... 2a04:4e42:200::649 | 54113 (FASTLY) (FASTLY) | |
9 | 5 |
ASN16509 (AMAZON-02, US)
PTR: ec2-3-108-180-245.ap-south-1.compute.amazonaws.com
hd002188.r.ap-south-1.awstrack.me |
ASN40676 (AS40676, US)
PTR: fivestringscpus.securityframe.com
munozcarranza.com |
ASN13335 (CLOUDFLARENET, US)
www.ledger.com | |
ledger-wp-website-s3-prd.ledger.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
6 |
clear-sign-ledger-activation.com
1 redirects
clear-sign-ledger-activation.com |
908 KB |
2 |
ledger.com
1 redirects
www.ledger.com — Cisco Umbrella Rank: 51810 ledger-wp-website-s3-prd.ledger.com — Cisco Umbrella Rank: 601869 |
7 KB |
2 |
jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 318 |
4 KB |
2 |
munozcarranza.com
2 redirects
munozcarranza.com |
485 B |
1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 847 |
30 KB |
1 |
awstrack.me
1 redirects
hd002188.r.ap-south-1.awstrack.me |
143 B |
9 | 6 |
Domain | Requested by | |
---|---|---|
6 | clear-sign-ledger-activation.com |
1 redirects
clear-sign-ledger-activation.com
|
2 | cdn.jsdelivr.net |
clear-sign-ledger-activation.com
cdn.jsdelivr.net |
2 | munozcarranza.com | 2 redirects |
1 | code.jquery.com |
clear-sign-ledger-activation.com
|
1 | ledger-wp-website-s3-prd.ledger.com |
clear-sign-ledger-activation.com
|
1 | www.ledger.com | 1 redirects |
1 | hd002188.r.ap-south-1.awstrack.me | 1 redirects |
9 | 7 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.ledger.com |
shop.ledger.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
clear-sign-ledger-activation.com WE1 |
2024-12-13 - 2025-03-13 |
3 months | crt.sh |
*.jsdelivr.net Sectigo RSA Domain Validation Secure Server CA |
2024-05-04 - 2025-05-04 |
a year | crt.sh |
*.jquery.com Sectigo ECC Domain Validation Secure Server CA |
2024-06-25 - 2025-06-25 |
a year | crt.sh |
This page contains 2 frames:
Primary Page:
https://clear-sign-ledger-activation.com/
Frame ID: CC1C60B1AF5DAA17D4AECCD99AF07ED0
Requests: 8 HTTP requests in this frame
Frame:
https://clear-sign-ledger-activation.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/f9063374b04d/main.js
Frame ID: 4C93BDC9050A83F3BD53E2D7295F03EB
Requests: 2 HTTP requests in this frame
Screenshot
Page Title
Ledger RecoverPage URL History Show full URLs
-
https://hd002188.r.ap-south-1.awstrack.me/L0/https:%2F%2Fmunozcarranza.com%2Fled/2/01090193bfbcffa3-380874ab-8540-46c5...
HTTP 302
https://munozcarranza.com/led HTTP 301
https://munozcarranza.com/led/ HTTP 302
https://clear-sign-ledger-activation.com/ Page URL
Detected technologies
jQuery (JavaScript Libraries) ExpandDetected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
jsDelivr (CDN) Expand
Detected patterns
- <link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
- //cdn\.jsdelivr\.net/
Page Statistics
4 Outgoing links
These are links going to different origins than the main page.
Search URL Search Domain Scan URL
Title: Terms and Conditions
Search URL Search Domain Scan URL
Title: Ledger's privacy policy
Search URL Search Domain Scan URL
Title: Cookie statement
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://hd002188.r.ap-south-1.awstrack.me/L0/https:%2F%2Fmunozcarranza.com%2Fled/2/01090193bfbcffa3-380874ab-8540-46c5-9394-c9d997768e93-000000/TbwVcrdX6S4T41Jba15DS42PoxM=185
HTTP 302
https://munozcarranza.com/led HTTP 301
https://munozcarranza.com/led/ HTTP 302
https://clear-sign-ledger-activation.com/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 2- https://www.ledger.com/wp-content/uploads/2023/03/Recover-X-coincover.png HTTP 301
- https://ledger-wp-website-s3-prd.ledger.com/uploads/2023/03/Recover-X-coincover.png
- https://clear-sign-ledger-activation.com/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
- https://clear-sign-ledger-activation.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/f9063374b04d/main.js
9 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H3 |
Primary Request
/
clear-sign-ledger-activation.com/ Redirect Chain
|
25 KB 9 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
all.css
clear-sign-ledger-activation.com/assets/ |
527 KB 264 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
tabler-flags.min.css
cdn.jsdelivr.net/npm/@tabler/core@1.0.0-beta17/dist/css/ |
16 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Recover-X-coincover.png
ledger-wp-website-s3-prd.ledger.com/uploads/2023/03/ Redirect Chain
|
6 KB 6 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
rcv.png
clear-sign-ledger-activation.com/assets/ |
627 KB 628 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.7.1.min.js
code.jquery.com/ |
85 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
us.svg
cdn.jsdelivr.net/npm/@tabler/core@1.0.0-beta17/dist/img/flags/ |
6 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
main.js
clear-sign-ledger-activation.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/f9063374b04d/ Frame 4C93 Redirect Chain
|
9 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
8f15dda608f8d2c3
clear-sign-ledger-activation.com/cdn-cgi/challenge-platform/h/g/jsd/r/ Frame 4C93 |
0 1 KB |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Ledger (Crypto Exchange)3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 function| $ function| jQuery3 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.ledger.com/ | Name: __cf_bm Value: GfMS0hzWv5Jwbk0wyLY9Zoq2yiVqNYMzOO4hVCXA6M0-1734091982-1.0.1.1-V6xjfSabsvPZZ2udfLjhaJtPlq93xE04BWAM2saGiNOLAjc2AtVHdRnhM.FIX4pJdFcZu7phMbhZAYS5hxsT5Q |
|
clear-sign-ledger-activation.com/ | Name: preferredLanguage Value: us |
|
.clear-sign-ledger-activation.com/ | Name: cf_clearance Value: u2E386hk5w1YYVpeA4Khaej3rQZ_q9Eq.zR2ymZBnJQ-1734091982-1.2.1.1-JyaahxO8Hl6g1YIR9HKq0oL0MoxksrPAfARF6_orMSvHPmBdzpSMwIMBVFWOe4RpJQX8.Kn0WI60_5BR12v6mxE8vI5.xY4hZpO8.QhOQYq_duKXNw5iSEdkXwRlArdgtDBy4ncmRQyQ2GnaRwKw7WFD.dlwjv6JAx3LH2_ExXiXKUxgD1UHul6oKqAIM1R4owjYtDAdxKJFbzIlLZrOj34F3G47Pz.fdv49sFIvqGJY2gtGOqFwgJBEIdSC5A_7otm3F1tzTYSTGpMiXwHb7HJev1ynrgO8Zg3Pl57DrIZkTnk6DVpKSKdWm5NpZfIbjMUe9ScxSAhHMnM0LH70iAsfLl.8W_5Z9DMN8gK9j9GReHesUzQPcL5_wg6eycd_ |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn.jsdelivr.net
clear-sign-ledger-activation.com
code.jquery.com
hd002188.r.ap-south-1.awstrack.me
ledger-wp-website-s3-prd.ledger.com
munozcarranza.com
www.ledger.com
104.244.154.95
172.67.155.219
2606:4700::6812:15c4
2606:4700::6812:ba1f
2a04:4e42:200::649
3.108.180.245
16bb9349be3ec2e7ae77fe74d212a9fc9fcc90d9648508bf9f47ba125c8508d8
24859811f0d8052e5979a146e00930a379b14745e480f40b20f1d9ccd79b99e0
2bf3d55743060b78c5353985c7b2f6e9dfe78a80fcbaae68c4e3565643df655a
3897ab7614a8854eec84bd75838fa6e257b4d59f8af84c911ab8cf174b39b19a
6552a4b9f71781c535cdff96d123190ff285cf1e7e561a24a9d897a8ed3c8496
c3fa3bed7b6ad01f1e21e09e957b87a1b7b5558c5434aa7224e6800c8af14492
db49bb7df4fabcd2d71d78376495747b9c978c06b6f6899ab95b61398f1d1c6e
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a
fcacd1755b15afa9dd5df1a44b8df433319b775c96c77975c96d4c4656c0b3d4