clear-sign-ledger-activation.com Open in urlscan Pro
172.67.155.219  Malicious Activity! Public Scan

Submitted URL: https://hd002188.r.ap-south-1.awstrack.me/L0/https:%2F%2Fmunozcarranza.com%2Fled/2/01090193bfbcffa3-380874ab-8540-46c5-9394-c9d997768e93-0...
Effective URL: https://clear-sign-ledger-activation.com/
Submission: On December 13 via manual from IN — Scanned from DE

Summary

This website contacted 5 IPs in 2 countries across 6 domains to perform 9 HTTP transactions. The main IP is 172.67.155.219, located in United States and belongs to CLOUDFLARENET, US. The main domain is clear-sign-ledger-activation.com.
TLS certificate: Issued by WE1 on December 13th 2024. Valid for: 3 months.
This is the only time clear-sign-ledger-activation.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Ledger (Crypto Exchange)

Domain & IP information

IP Address AS Autonomous System
1 1 3.108.180.245 16509 (AMAZON-02)
2 2 104.244.154.95 40676 (AS40676)
1 6 172.67.155.219 13335 (CLOUDFLAR...)
2 2606:4700::68... 13335 (CLOUDFLAR...)
1 2 2606:4700::68... 13335 (CLOUDFLAR...)
1 2a04:4e42:200... 54113 (FASTLY)
9 5
Apex Domain
Subdomains
Transfer
6 clear-sign-ledger-activation.com
clear-sign-ledger-activation.com
908 KB
2 ledger.com
www.ledger.com — Cisco Umbrella Rank: 51810
ledger-wp-website-s3-prd.ledger.com — Cisco Umbrella Rank: 601869
7 KB
2 jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 318
4 KB
2 munozcarranza.com
munozcarranza.com
485 B
1 jquery.com
code.jquery.com — Cisco Umbrella Rank: 847
30 KB
1 awstrack.me
hd002188.r.ap-south-1.awstrack.me
143 B
9 6
Domain Requested by
6 clear-sign-ledger-activation.com 1 redirects clear-sign-ledger-activation.com
2 cdn.jsdelivr.net clear-sign-ledger-activation.com
cdn.jsdelivr.net
2 munozcarranza.com 2 redirects
1 code.jquery.com clear-sign-ledger-activation.com
1 ledger-wp-website-s3-prd.ledger.com clear-sign-ledger-activation.com
1 www.ledger.com 1 redirects
1 hd002188.r.ap-south-1.awstrack.me 1 redirects
9 7

This site contains links to these domains. Also see Links.

Domain
www.ledger.com
shop.ledger.com
Subject Issuer Validity Valid
clear-sign-ledger-activation.com
WE1
2024-12-13 -
2025-03-13
3 months crt.sh
*.jsdelivr.net
Sectigo RSA Domain Validation Secure Server CA
2024-05-04 -
2025-05-04
a year crt.sh
*.jquery.com
Sectigo ECC Domain Validation Secure Server CA
2024-06-25 -
2025-06-25
a year crt.sh

This page contains 2 frames:

Primary Page: https://clear-sign-ledger-activation.com/
Frame ID: CC1C60B1AF5DAA17D4AECCD99AF07ED0
Requests: 8 HTTP requests in this frame

Frame: https://clear-sign-ledger-activation.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/f9063374b04d/main.js
Frame ID: 4C93BDC9050A83F3BD53E2D7295F03EB
Requests: 2 HTTP requests in this frame

Screenshot

Page Title

Ledger Recover

Page URL History Show full URLs

  1. https://hd002188.r.ap-south-1.awstrack.me/L0/https:%2F%2Fmunozcarranza.com%2Fled/2/01090193bfbcffa3-380874ab-8540-46c5... HTTP 302
    https://munozcarranza.com/led HTTP 301
    https://munozcarranza.com/led/ HTTP 302
    https://clear-sign-ledger-activation.com/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Overall confidence: 100%
Detected patterns
  • <link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
  • //cdn\.jsdelivr\.net/

Page Statistics

9
Requests

78 %
HTTPS

50 %
IPv6

6
Domains

7
Subdomains

5
IPs

2
Countries

947 kB
Transfer

1302 kB
Size

3
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://hd002188.r.ap-south-1.awstrack.me/L0/https:%2F%2Fmunozcarranza.com%2Fled/2/01090193bfbcffa3-380874ab-8540-46c5-9394-c9d997768e93-000000/TbwVcrdX6S4T41Jba15DS42PoxM=185 HTTP 302
    https://munozcarranza.com/led HTTP 301
    https://munozcarranza.com/led/ HTTP 302
    https://clear-sign-ledger-activation.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 2
  • https://www.ledger.com/wp-content/uploads/2023/03/Recover-X-coincover.png HTTP 301
  • https://ledger-wp-website-s3-prd.ledger.com/uploads/2023/03/Recover-X-coincover.png
Request Chain 7
  • https://clear-sign-ledger-activation.com/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
  • https://clear-sign-ledger-activation.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/f9063374b04d/main.js

9 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
clear-sign-ledger-activation.com/
Redirect Chain
  • https://hd002188.r.ap-south-1.awstrack.me/L0/https:%2F%2Fmunozcarranza.com%2Fled/2/01090193bfbcffa3-380874ab-8540-46c5-9394-c9d997768e93-000000/TbwVcrdX6S4T41Jba15DS42PoxM=185
  • https://munozcarranza.com/led
  • https://munozcarranza.com/led/
  • https://clear-sign-ledger-activation.com/
25 KB
9 KB
Document
General
Full URL
https://clear-sign-ledger-activation.com/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.155.219 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PHP/8.3.14 PleskLin
Resource Hash
6552a4b9f71781c535cdff96d123190ff285cf1e7e561a24a9d897a8ed3c8496

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
8f15dda608f8d2c3-FRA
content-encoding
zstd
content-type
text/html; charset=UTF-8
date
Fri, 13 Dec 2024 12:13:01 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
priority
u=0,i
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=f4rYb3s5vblIa0GnXAYNlDZHdxrQuzBTJc2GiFx3AaQ44xxCggP0%2BM1Et6tSduncXwhO1pPBDwNfm7RH6PJT2RVvU%2Fmq7SPcTDOSrlsiyf6AEp45uMuIBbQDFCpEE3gd4EdzED0ysoft3m%2BwrpFlQC3l7w%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
server-timing
cfL4;desc="?proto=QUIC&rtt=10661&min_rtt=7301&rtt_var=7616&sent=12&recv=10&lost=0&retrans=0&sent_bytes=4177&recv_bytes=4497&delivery_rate=877&cwnd=12000&unsent_bytes=0&cid=622e05fb0c840a8a&ts=159&x=1" cfExtPri cfHdrFlush;dur=0
vary
Accept-Encoding
x-powered-by
PHP/8.3.14 PleskLin

Redirect headers

Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8
Date
Fri, 13 Dec 2024 12:13:01 GMT
Keep-Alive
timeout=5
Location
https://clear-sign-ledger-activation.com/
Server
Apache
Transfer-Encoding
chunked
all.css
clear-sign-ledger-activation.com/assets/
527 KB
264 KB
Stylesheet
General
Full URL
https://clear-sign-ledger-activation.com/assets/all.css?v=242
Requested by
Host: clear-sign-ledger-activation.com
URL: https://clear-sign-ledger-activation.com/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.155.219 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PleskLin
Resource Hash
16bb9349be3ec2e7ae77fe74d212a9fc9fcc90d9648508bf9f47ba125c8508d8

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://clear-sign-ledger-activation.com/

Response headers

content-encoding
zstd
cf-cache-status
HIT
etag
W/"673ccb7a-83ad9"
age
2736
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1GCVjQgpPztxCQeoGqguA8EnUPmW8oqYn4tttmABX86dS8hhc9f02Mx8oZAvvagAuMtkJfYCCgTJGd3%2F3jO6dBCgjvqnZh3EB6q7orrR2U1yPfzI%2FZBepiA1tsJ%2FIVMAxvidj0dyWWjtUB7poW6QttQKug%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=9111&min_rtt=7203&rtt_var=3533&sent=23&recv=17&lost=0&retrans=0&sent_bytes=13992&recv_bytes=5382&delivery_rate=1359343&cwnd=12000&unsent_bytes=0&cid=622e05fb0c840a8a&ts=201&x=1", cfExtPri, cfHdrFlush;dur=0
date
Fri, 13 Dec 2024 12:13:01 GMT
content-type
text/css
last-modified
Tue, 19 Nov 2024 17:31:38 GMT
vary
Accept-Encoding
priority
u=0,i=?0
cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
8f15dda71b70d2c3-FRA
x-powered-by
PleskLin
server
cloudflare
tabler-flags.min.css
cdn.jsdelivr.net/npm/@tabler/core@1.0.0-beta17/dist/css/
16 KB
2 KB
Stylesheet
General
Full URL
https://cdn.jsdelivr.net/npm/@tabler/core@1.0.0-beta17/dist/css/tabler-flags.min.css
Requested by
Host: clear-sign-ledger-activation.com
URL: https://clear-sign-ledger-activation.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:ba1f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2bf3d55743060b78c5353985c7b2f6e9dfe78a80fcbaae68c4e3565643df655a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://clear-sign-ledger-activation.com/

Response headers

access-control-expose-headers
*
content-encoding
br
cf-cache-status
HIT
etag
W/"3e26-eVUhG+09kjEYgXHul87MuSyQW6w"
age
9354941
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5RT3bjolkSLPBUHi4%2FERjsd8w%2FbBxVfGLn%2FgwYP50Pnh%2B6qYVOHegHnQvCIelSUdmk8L4yPMWrPvt4Vni3m%2Fhxjx8HWl0BGoH9taN9D4jKqrjyzuSBzDIdtupyoSV5I%2Bdc7vPoCDY%2FvriFbCxDg%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
x-jsd-version-type
version
alt-svc
h3=":443"; ma=86400
x-cache
HIT, HIT
date
Fri, 13 Dec 2024 12:13:01 GMT
content-type
text/css; charset=utf-8
x-served-by
cache-fra-etou8220152-FRA, cache-lga21951-LGA
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin
*
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy
cross-origin
cf-ray
8f15dda758a518d5-FRA
accept-ranges
bytes
access-control-allow-origin
*
content-length
1257
server
cloudflare
x-jsd-version
1.0.0-beta17
Recover-X-coincover.png
ledger-wp-website-s3-prd.ledger.com/uploads/2023/03/
Redirect Chain
  • https://www.ledger.com/wp-content/uploads/2023/03/Recover-X-coincover.png
  • https://ledger-wp-website-s3-prd.ledger.com/uploads/2023/03/Recover-X-coincover.png
6 KB
6 KB
Image
General
Full URL
https://ledger-wp-website-s3-prd.ledger.com/uploads/2023/03/Recover-X-coincover.png
Requested by
Host: clear-sign-ledger-activation.com
URL: https://clear-sign-ledger-activation.com/
Protocol
H2
Server
2606:4700::6812:15c4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c3fa3bed7b6ad01f1e21e09e957b87a1b7b5558c5434aa7224e6800c8af14492

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

cf-bgj
imgq:100,h2pri
etag
"5eeea311b3bcfb87b05a632241a30e3e"
x-amz-version-id
_j_wEYUGgS49fUQ9Q9QMKfp4QaOV79If
cf-cache-status
HIT
age
1064
expires
Fri, 13 Dec 2024 16:13:02 GMT
cf-polished
origFmt=png, origSize=14352
date
Fri, 13 Dec 2024 12:13:02 GMT
content-type
image/webp
content-disposition
inline; filename="Recover-X-coincover.webp"
vary
Accept
last-modified
Mon, 04 Mar 2024 10:02:34 GMT
x-amz-id-2
ebapzRHw4un+dQBiP+A9VkEgVuP2AB0frTN3Dq323DJJ9Nrth+N+pzmzrg0YiqTa85Pb9M9M4KM=
x-amz-replication-status
COMPLETED
cache-control
public, max-age=14400
x-amz-request-id
SHQHYGNDPDCC1QV8
cf-ray
8f15dda7de7ddc6e-FRA
accept-ranges
bytes
content-length
5778
server
cloudflare
x-amz-server-side-encryption
AES256

Redirect headers

access-control-max-age
1728000
cf-cache-status
HIT
age
3996
access-control-allow-methods
GET, PUT, POST, DELETE, PATCH, OPTIONS
expires
Fri, 13 Dec 2024 16:13:02 GMT
date
Fri, 13 Dec 2024 12:13:02 GMT
content-type
text/html
vary
Accept-Encoding
access-control-allow-headers
DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization
strict-transport-security
max-age=31536000; includeSubDomains
cache-control
public, max-age=14400
location
https://ledger-wp-website-s3-prd.ledger.com/uploads/2023/03/Recover-X-coincover.png
access-control-allow-credentials
true
cf-ray
8f15dda78dc9dc6e-FRA
access-control-allow-origin
*
server
cloudflare
rcv.png
clear-sign-ledger-activation.com/assets/
627 KB
628 KB
Image
General
Full URL
https://clear-sign-ledger-activation.com/assets/rcv.png
Requested by
Host: clear-sign-ledger-activation.com
URL: https://clear-sign-ledger-activation.com/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.155.219 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PleskLin
Resource Hash
3897ab7614a8854eec84bd75838fa6e257b4d59f8af84c911ab8cf174b39b19a

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

cf-cache-status
HIT
etag
"65dc5eac-9caf1"
age
2736
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sLOk4FsNMfrtOH59jPQySnXJ2tW7ysotj%2FbNs0IDDqZtGnkeeEwQgBVnkvfyD9Bh2HC6N9v3CADqsWwpl3mI1QvtNK8UJMKup%2FZyTWV3RGArfrGoGM2IJasvS1hjTT63T641Dz3HOgZrltmKR9qEOIS0wA%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=9111&min_rtt=7203&rtt_var=3533&sent=34&recv=17&lost=0&retrans=0&sent_bytes=25992&recv_bytes=5382&delivery_rate=1359343&cwnd=12000&unsent_bytes=0&cid=622e05fb0c840a8a&ts=206&x=1", cfExtPri, cfHdrFlush;dur=4
date
Fri, 13 Dec 2024 12:13:01 GMT
content-type
image/png
last-modified
Mon, 26 Feb 2024 09:49:32 GMT
vary
Accept-Encoding
priority
u=2,i
cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
8f15dda71b74d2c3-FRA
accept-ranges
bytes
content-length
641777
x-powered-by
PleskLin
server
cloudflare
jquery-3.7.1.min.js
code.jquery.com/
85 KB
30 KB
Script
General
Full URL
https://code.jquery.com/jquery-3.7.1.min.js
Requested by
Host: clear-sign-ledger-activation.com
URL: https://clear-sign-ledger-activation.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:200::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

content-encoding
gzip
etag
W/"28feccc0-155ed"
age
3272131
x-cache
HIT, HIT
date
Fri, 13 Dec 2024 12:13:02 GMT
content-type
application/javascript; charset=utf-8
last-modified
Fri, 18 Oct 1991 12:00:00 GMT
x-cache-hits
90678, 76443
x-served-by
cache-lga21978-LGA, cache-mad2200094-MAD
vary
Accept-Encoding
cache-control
public, max-age=31536000, stale-while-revalidate=604800
x-timer
S1734091982.071941,VS0,VE0
cross-origin-resource-policy
cross-origin
via
1.1 varnish, 1.1 varnish
accept-ranges
bytes
access-control-allow-origin
*
content-length
30336
server
nginx
truncated
/
2 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
24859811f0d8052e5979a146e00930a379b14745e480f40b20f1d9ccd79b99e0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/svg+xml
us.svg
cdn.jsdelivr.net/npm/@tabler/core@1.0.0-beta17/dist/img/flags/
6 KB
2 KB
Image
General
Full URL
https://cdn.jsdelivr.net/npm/@tabler/core@1.0.0-beta17/dist/img/flags/us.svg
Requested by
Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/npm/@tabler/core@1.0.0-beta17/dist/css/tabler-flags.min.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:ba1f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
db49bb7df4fabcd2d71d78376495747b9c978c06b6f6899ab95b61398f1d1c6e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://cdn.jsdelivr.net/npm/@tabler/core@1.0.0-beta17/dist/css/tabler-flags.min.css

Response headers

access-control-expose-headers
*
content-encoding
br
cf-cache-status
HIT
etag
W/"1785-vgJJg25MAAFN5Ebs+Aodo7+Z55k"
age
8887499
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=j1eXzomMl4uCtF%2B5RGKNAMPqJDf0qjnhqNj3MYq891JNQtuESp2fNw9SNbRn0WGoPjUm8OCpz0d5CKC3HVgeyhKIi%2Fs4kM2wNVP%2FuhvQH8AzgQxlZDLpAsFCIWaVZVCMTkiPMjTwYOtI1OiX8xE%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
x-jsd-version-type
version
alt-svc
h3=":443"; ma=86400
x-cache
HIT, HIT
date
Fri, 13 Dec 2024 12:13:02 GMT
content-type
image/svg+xml
x-served-by
cache-fra-eddf8230066-FRA, cache-lga21977-LGA
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin
*
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy
cross-origin
cf-ray
8f15dda7c8f618d5-FRA
accept-ranges
bytes
access-control-allow-origin
*
content-length
1227
server
cloudflare
x-jsd-version
1.0.0-beta17
main.js
clear-sign-ledger-activation.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/f9063374b04d/ Frame 4C93
Redirect Chain
  • https://clear-sign-ledger-activation.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
  • https://clear-sign-ledger-activation.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/f9063374b04d/main.js?
9 KB
5 KB
Script
General
Full URL
https://clear-sign-ledger-activation.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/f9063374b04d/main.js?
Protocol
H3
Server
172.67.155.219 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fcacd1755b15afa9dd5df1a44b8df433319b775c96c77975c96d4c4656c0b3d4
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

cache-control
max-age=14400, stale-if-error=10800, stale-while-revalidate=10800, public
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
zstd
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xssiaG%2BF0wYipSN3MlWNvcRPM9XmIBdCBXqQOe4ZtsppSJqNvR8zd9CH9Gg%2BjcPMqkN%2F%2FGBRzWb6A1ghJetDEIvN42kOnLaYI1QhUJTNZD0AmlqOT%2FUL6i0%2FrDc8pWkFczPDo5qImlAlqvdI1ojgkWoznw%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
cf-ray
8f15dda8af68d2c3-FRA
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=15907&min_rtt=7203&rtt_var=6581&sent=832&recv=137&lost=20&retrans=20&sent_bytes=972810&recv_bytes=11266&delivery_rate=48259&cwnd=342720&unsent_bytes=0&cid=622e05fb0c840a8a&ts=448&x=1", cfExtPri, cfHdrFlush;dur=0
date
Fri, 13 Dec 2024 12:13:02 GMT
content-type
application/javascript; charset=UTF-8
vary
Accept-Encoding
server
cloudflare
priority
u=3,i=?0

Redirect headers

cache-control
max-age=300, stale-if-error=10800, stale-while-revalidate=10800, public
location
/cdn-cgi/challenge-platform/h/g/scripts/jsd/f9063374b04d/main.js?
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9nQTTsrEksvYCKLoXOwunvsr4eYOuU2SSONYZ8yTVl6wRs3MzlQpTrOQ6z8fDX%2BWsMVmIVpUbXxoynb%2FnYxD4vpBGE%2F1T4lHAM3A9scx4aSGFjPoG16FedFHxbSgL3yj7xEkGJddZww0BW8AhrPrafp0jg%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
8f15dda87ec9d2c3-FRA
access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
content-length
0
server-timing
cfL4;desc="?proto=QUIC&rtt=17071&min_rtt=7203&rtt_var=5670&sent=830&recv=135&lost=20&retrans=20&sent_bytes=972039&recv_bytes=10911&delivery_rate=3119617&cwnd=342720&unsent_bytes=0&cid=622e05fb0c840a8a&ts=411&x=1", cfExtPri, cfHdrFlush;dur=0
date
Fri, 13 Dec 2024 12:13:02 GMT
vary
Accept-Encoding
server
cloudflare
priority
u=3,i=?0
8f15dda608f8d2c3
clear-sign-ledger-activation.com/cdn-cgi/challenge-platform/h/g/jsd/r/ Frame 4C93
0
1 KB
XHR
General
Full URL
https://clear-sign-ledger-activation.com/cdn-cgi/challenge-platform/h/g/jsd/r/8f15dda608f8d2c3
Requested by
Host: clear-sign-ledger-activation.com
URL: https://clear-sign-ledger-activation.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.155.219 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type
application/json
Referer

Response headers

nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yEqLzoKc7QmcwZta4bOPg%2FsKQsq10d1TYfUYOdWu63fIbnNZz8JqX5MC3WBhGk2P%2BU01Psl29zJXRsgswzMFQB1NRqMws3O2PRxOpU39GtWnicG4nwZ4LL94wcdr%2B89kMRJDCrdOtJZpznAYcr%2BLsGSnaA%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
8f15dda9eaa3d2c3-FRA
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=14960&min_rtt=7203&rtt_var=6829&sent=852&recv=153&lost=20&retrans=20&sent_bytes=978217&recv_bytes=28481&delivery_rate=309586&cwnd=342720&unsent_bytes=0&cid=622e05fb0c840a8a&ts=663&x=1", cfExtPri, cfHdrFlush;dur=0
content-length
0
date
Fri, 13 Dec 2024 12:13:02 GMT
content-type
text/plain; charset=UTF-8
server
cloudflare
priority
u=1,i

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Ledger (Crypto Exchange)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 function| $ function| jQuery

3 Cookies

Domain/Path Name / Value
.ledger.com/ Name: __cf_bm
Value: GfMS0hzWv5Jwbk0wyLY9Zoq2yiVqNYMzOO4hVCXA6M0-1734091982-1.0.1.1-V6xjfSabsvPZZ2udfLjhaJtPlq93xE04BWAM2saGiNOLAjc2AtVHdRnhM.FIX4pJdFcZu7phMbhZAYS5hxsT5Q
clear-sign-ledger-activation.com/ Name: preferredLanguage
Value: us
.clear-sign-ledger-activation.com/ Name: cf_clearance
Value: u2E386hk5w1YYVpeA4Khaej3rQZ_q9Eq.zR2ymZBnJQ-1734091982-1.2.1.1-JyaahxO8Hl6g1YIR9HKq0oL0MoxksrPAfARF6_orMSvHPmBdzpSMwIMBVFWOe4RpJQX8.Kn0WI60_5BR12v6mxE8vI5.xY4hZpO8.QhOQYq_duKXNw5iSEdkXwRlArdgtDBy4ncmRQyQ2GnaRwKw7WFD.dlwjv6JAx3LH2_ExXiXKUxgD1UHul6oKqAIM1R4owjYtDAdxKJFbzIlLZrOj34F3G47Pz.fdv49sFIvqGJY2gtGOqFwgJBEIdSC5A_7otm3F1tzTYSTGpMiXwHb7HJev1ynrgO8Zg3Pl57DrIZkTnk6DVpKSKdWm5NpZfIbjMUe9ScxSAhHMnM0LH70iAsfLl.8W_5Z9DMN8gK9j9GReHesUzQPcL5_wg6eycd_