pub-7b45cf3835c940eebae7c0a13a7ccb2a.r2.dev
Open in
urlscan Pro
2606:4700::6812:323
Malicious Activity!
Public Scan
Submission: On July 03 via automatic, source phishtank — Scanned from DE
Summary
TLS certificate: Issued by E1 on June 3rd 2024. Valid for: 3 months.
This is the only time pub-7b45cf3835c940eebae7c0a13a7ccb2a.r2.dev was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: DocuSign (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 2606:4700::68... 2606:4700::6812:323 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2606:4700:440... 2606:4700:4400::ac40:93bc | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 192.229.133.221 192.229.133.221 | 15133 (EDGECAST) (EDGECAST) | |
1 | 192.0.78.220 192.0.78.220 | 2635 (AUTOMATTIC) (AUTOMATTIC) | |
3 | 2a02:26f0:350... 2a02:26f0:3500:89a::523 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
1 | 2a00:1450:400... 2a00:1450:4001:82f::200a | 15169 (GOOGLE) (GOOGLE) | |
4 | 172.67.139.119 172.67.139.119 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
13 | 8 |
ASN13335 (CLOUDFLARENET, US)
pub-7b45cf3835c940eebae7c0a13a7ccb2a.r2.dev |
ASN20940 (AKAMAI-ASN1, NL)
res.cloudinary.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
5 |
fontawesome.com
kit.fontawesome.com — Cisco Umbrella Rank: 2060 ka-f.fontawesome.com — Cisco Umbrella Rank: 5357 |
34 KB |
3 |
cloudinary.com
res.cloudinary.com — Cisco Umbrella Rank: 3546 |
323 KB |
1 |
googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 469 |
30 KB |
1 |
icones.pro
icones.pro |
7 KB |
1 |
w3schools.com
www.w3schools.com — Cisco Umbrella Rank: 22461 |
5 KB |
1 |
r2.dev
pub-7b45cf3835c940eebae7c0a13a7ccb2a.r2.dev |
36 KB |
0 |
drv.tw
Failed
ip9uk39kv26rml8wjjruzg.on.drv.tw Failed |
|
13 | 7 |
Domain | Requested by | |
---|---|---|
4 | ka-f.fontawesome.com |
kit.fontawesome.com
|
3 | res.cloudinary.com |
pub-7b45cf3835c940eebae7c0a13a7ccb2a.r2.dev
|
1 | ajax.googleapis.com |
pub-7b45cf3835c940eebae7c0a13a7ccb2a.r2.dev
|
1 | icones.pro |
pub-7b45cf3835c940eebae7c0a13a7ccb2a.r2.dev
|
1 | www.w3schools.com |
pub-7b45cf3835c940eebae7c0a13a7ccb2a.r2.dev
|
1 | kit.fontawesome.com |
pub-7b45cf3835c940eebae7c0a13a7ccb2a.r2.dev
|
1 | pub-7b45cf3835c940eebae7c0a13a7ccb2a.r2.dev | |
0 | ip9uk39kv26rml8wjjruzg.on.drv.tw Failed |
pub-7b45cf3835c940eebae7c0a13a7ccb2a.r2.dev
|
13 | 8 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.r2.dev E1 |
2024-06-03 - 2024-09-01 |
3 months | crt.sh |
*.fontawesome.com DigiCert Global G2 TLS RSA SHA256 2020 CA1 |
2023-12-04 - 2025-01-03 |
a year | crt.sh |
*.w3schools.com DigiCert Global G2 TLS RSA SHA256 2020 CA1 |
2024-04-03 - 2025-05-04 |
a year | crt.sh |
tls.automattic.com R3 |
2024-06-01 - 2024-08-30 |
3 months | crt.sh |
*.cloudinary.com Go Daddy Secure Certificate Authority - G2 |
2023-12-18 - 2025-01-13 |
a year | crt.sh |
upload.video.google.com WR2 |
2024-06-13 - 2024-09-05 |
3 months | crt.sh |
ka-f.fontawesome.com WE1 |
2024-07-01 - 2024-09-29 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://pub-7b45cf3835c940eebae7c0a13a7ccb2a.r2.dev/sharepoint-e5cc43015815732a4d38f73eec6434e3e5cc43015815732a4d38f73eec6434e3e5cc43015815732a4d38f73eec6434e3e5cc43015815732a4d38f73eec6434e3e5cc43015815732a4d38f73eec6434e3.html
Frame ID: 8FCB307243BFA2214A8631B241738D60
Requests: 13 HTTP requests in this frame
Screenshot
Page Title
Secured DocumentDetected technologies
WordPress (CMS) ExpandDetected patterns
- /wp-(?:content|includes)/
Font Awesome (Font Scripts) Expand
Detected patterns
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- kit\.fontawesome\.com/([0-9a-z]+).js
jQuery (JavaScript Libraries) Expand
Detected patterns
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 4- https://ip9uk39kv26rml8wjjruzg-on.drv.tw/jsbot.js HTTP 301
- https://ip9uk39kv26rml8wjjruzg.on.drv.tw/jsbot.js
13 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
sharepoint-e5cc43015815732a4d38f73eec6434e3e5cc43015815732a4d38f73eec6434e3e5cc43015815732a4d38f73eec6434e3e5cc43015815732a4d38f73eec6434e3e5cc43015815732a4d38f73eec6434e3.html
pub-7b45cf3835c940eebae7c0a13a7ccb2a.r2.dev/ |
36 KB 36 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
c2d4bde48d.js
kit.fontawesome.com/ |
12 KB 5 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
w3.css
www.w3schools.com/w3css/4/ |
23 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icone-pdf-symbole-png-rouge.png
icones.pro/wp-content/uploads/2021/03/ |
7 KB 7 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
symatec_uzpocb.png
res.cloudinary.com/dbw0dmugc/image/upload/v1699346632/ |
12 KB 12 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
jsbot.js
ip9uk39kv26rml8wjjruzg.on.drv.tw/ Redirect Chain
|
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/2.1.1/ |
82 KB 30 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
download_jt6c2l.gif
res.cloudinary.com/dbw0dmugc/image/upload/v1699347849/ |
88 KB 88 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
download_1_so80mv.gif
res.cloudinary.com/dbw0dmugc/image/upload/v1699348070/ |
222 KB 222 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
free.min.css
ka-f.fontawesome.com/releases/v6.5.2/css/ |
101 KB 23 KB |
Fetch
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
free-v4-shims.min.css
ka-f.fontawesome.com/releases/v6.5.2/css/ |
27 KB 5 KB |
Fetch
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
free-v5-font-face.min.css
ka-f.fontawesome.com/releases/v6.5.2/css/ |
823 B 1017 B |
Fetch
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
free-v4-font-face.min.css
ka-f.fontawesome.com/releases/v6.5.2/css/ |
2 KB 1 KB |
Fetch
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- ip9uk39kv26rml8wjjruzg.on.drv.tw
- URL
- https://ip9uk39kv26rml8wjjruzg.on.drv.tw/jsbot.js
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: DocuSign (Online)4 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
undefined| event object| fence object| sharedStorage object| FontAwesomeKitConfig0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
icones.pro
ip9uk39kv26rml8wjjruzg.on.drv.tw
ka-f.fontawesome.com
kit.fontawesome.com
pub-7b45cf3835c940eebae7c0a13a7ccb2a.r2.dev
res.cloudinary.com
www.w3schools.com
ip9uk39kv26rml8wjjruzg.on.drv.tw
172.67.139.119
192.0.78.220
192.229.133.221
2606:4700:4400::ac40:93bc
2606:4700::6812:323
2a00:1450:4001:82f::200a
2a02:26f0:3500:89a::523
1fa82d030aca102b39e357291206b8b133d9f920c781c7d270d2c73f6ee7b61b
3e9c73fa687cd4110688668977a7caa87f5a1dee0d11f03687bd4871deedf1c1
4f422dc1efc7ca439c68506c34c4604a3b05c7d51f038b2d2e6d6a1fa7ae28f7
874706b2b1311a0719b5267f7d1cf803057e367e94ae1ff7bf78c5450d30f5d4
9699b18200a9d40ed7859411c33cfa2194174a4746d466123107f888d93dc878
aa3b5749e0a19ad393b0d8a80a8f78edbf317bf5b067f95bad0503300fcab860
b4b91d1b8888b77fdbf5d54b3ed71f03b1473cd97bb13fadb4fe5efe0e7eaf20
c4f2aba13970ecf8303fb9329f97c8824861569273b0aa27acce48abc61d04f5
c7fa2e35f8bc44076f4aa989a02eab432ac3d1c27764583f78929ac69c42f907
e1dc27b700a62c005e4521b670cac08fb0b4b3e02a73c1ac44e7f9a9784bd672
ef9a6e55bab3d4c3a767dccdd5ae43971f99177332c1181a5515b55f3167c5d2
f4e953827930889e844103c3a6771bd2e9de17d091b36378c40362271858e075