pub-a5a0b0fee89542dfb1ab2d8e5d94d1f8.r2.dev Open in urlscan Pro
2606:4700::6812:223  Malicious Activity! Public Scan

3 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
5 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request index9876543213456789876543212345678987654323456787654321234567898765432134567898765432134567898765432345678976543213456789765432345678.html Show response pub-a5a0b0fee89542dfb1ab2d8e5d94d1f8.r2.dev/	83 KB 26 KB	257ms 149ms	Document text/html	2606:4700::6812:223 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://pub-a5a0b0fee89542dfb1ab2d8e5d94d1f8.r2.dev/index9876543213456789876543212345678987654323456787654321234567898765432134567898765432134567898765432345678976543213456789765432345678.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:223 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 3f5410785cb94c98bdf72f8bbe453021702bc4603b6e1dcefd0684c5e305ea1b Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers CF-RAY 8069f8dde9579b8f-FRA Connection keep-alive Content-Encoding gzip Content-Type text/html Date Thu, 14 Sep 2023 16:23:02 GMT ETag W/"5bdc277d79239e022345d3cb18bdbbd7" Last-Modified Wed, 13 Sep 2023 09:35:18 GMT Server cloudflare Transfer-Encoding chunked Vary Accept-Encoding
GET H2	200	jquery-3.1.1.min.js Show response code.jquery.com/	85 KB 30 KB	130ms 43ms	Script application/javascript	2001:4de0:ac18::1:a:2b STACKPATH-CDN
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.1.1.min.js Requested by Host: pub-a5a0b0fee89542dfb1ab2d8e5d94d1f8.r2.dev URL: https://pub-a5a0b0fee89542dfb1ab2d8e5d94d1f8.r2.dev/index9876543213456789876543212345678987654323456787654321234567898765432134567898765432134567898765432345678976543213456789765432345678.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac18::1:a:2b , Netherlands, ASN20446 (STACKPATH-CDN, US), Reverse DNS Software nginx / Resource Hash 85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf Request headers accept-language de-DE,de;q=0.9 Referer https://pub-a5a0b0fee89542dfb1ab2d8e5d94d1f8.r2.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36 Response headers date Thu, 14 Sep 2023 16:23:02 GMT content-encoding gzip last-modified Fri, 18 Oct 1991 12:00:00 GMT server nginx etag W/"28feccc0-152b5" vary Accept-Encoding x-hw 1694708582.dop210.fr8.t,1694708582.cds325.fr8.hn,1694708582.cds164.fr8.c content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 30070
POST H2	200	dee8cd2.php Show response hkmloverki.com/hoo/	330 KB 87 KB	1990ms 1556ms	XHR text/html	72.167.135.212 GO-DADDY-COM-LLC
General Check archive.org Show headers Download Go to Full URL https://hkmloverki.com/hoo/dee8cd2.php Requested by Host: code.jquery.com URL: https://code.jquery.com/jquery-3.1.1.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 72.167.135.212 , United States, ASN398101 (GO-DADDY-COM-LLC, US), Reverse DNS 212.135.167.72.host.secureserver.net Software nginx / Resource Hash 5bf277ef9e1f542bc0968488acc538d13fc7dee1d18141fd1763f947b599146b Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Accept */* Referer https://pub-a5a0b0fee89542dfb1ab2d8e5d94d1f8.r2.dev/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36 Content-Type application/x-www-form-urlencoded; charset=UTF-8 Response headers pragma no-cache date Thu, 14 Sep 2023 16:23:04 GMT strict-transport-security max-age=31536000 content-encoding gzip server nginx vary Accept-Encoding access-control-allow-methods GET, PUT, POST, DELETE, OPTIONS content-type text/html; charset=UTF-8 access-control-allow-origin * cache-control no-store, no-cache, must-revalidate access-control-allow-credentials true expires Thu, 19 Nov 1981 08:52:00 GMT
GET H2	200	font-awesome.css cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/	37 KB 6 KB	184ms 92ms	Stylesheet text/css	2606:4700::6811:190e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.css Requested by Host: pub-a5a0b0fee89542dfb1ab2d8e5d94d1f8.r2.dev URL: https://pub-a5a0b0fee89542dfb1ab2d8e5d94d1f8.r2.dev/index9876543213456789876543212345678987654323456787654321234567898765432134567898765432134567898765432345678976543213456789765432345678.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 36e0a7e08bee65774168528938072c536437669c1b7458ac77976ec788e4439c Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Referer https://pub-a5a0b0fee89542dfb1ab2d8e5d94d1f8.r2.dev/ Origin https://pub-a5a0b0fee89542dfb1ab2d8e5d94d1f8.r2.dev accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36 Response headers date Thu, 14 Sep 2023 16:23:04 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} strict-transport-security max-age=15780000 age 7831795 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 5884 last-modified Mon, 04 May 2020 16:10:07 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "5eb03e5f-9226" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aZmQBmZOPH7WNw%2B053RdINFGv%2FmGLB7ajJ81Vlznc6evKWmRiAO%2BdMfp0%2FRqf%2BRwFwK%2FOwqoveWiNSqU826ELGQQqCWgsfmdQ1UNdrxHkNfE2WOP%2B%2BxIWYhsfVPctfu1psoDpDKNdD7zvwKc5ei7b2vO"}],"group":"cf-nel","max_age":604800} content-type text/css; charset=utf-8 access-control-allow-origin * cache-control public, max-age=30672000 accept-ranges bytes timing-allow-origin * cf-ray 8069f8ee682cbb7a-FRA expires Tue, 03 Sep 2024 16:23:04 GMT
GET H2	200	jquery-3.1.1.min.js Show response code.jquery.com/	85 KB 30 KB	42ms 42ms	Script application/javascript	2001:4de0:ac18::1:a:2b STACKPATH-CDN
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.1.1.min.js Requested by Host: pub-a5a0b0fee89542dfb1ab2d8e5d94d1f8.r2.dev URL: https://pub-a5a0b0fee89542dfb1ab2d8e5d94d1f8.r2.dev/index9876543213456789876543212345678987654323456787654321234567898765432134567898765432134567898765432345678976543213456789765432345678.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac18::1:a:2b , Netherlands, ASN20446 (STACKPATH-CDN, US), Reverse DNS Software nginx / Resource Hash 85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf Request headers Referer https://pub-a5a0b0fee89542dfb1ab2d8e5d94d1f8.r2.dev/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Thu, 14 Sep 2023 16:23:04 GMT content-encoding gzip last-modified Fri, 18 Oct 1991 12:00:00 GMT server nginx etag W/"28feccc0-152b5" vary Accept-Encoding x-hw 1694708584.dop210.fr8.t,1694708584.cds325.fr8.hn,1694708584.cds164.fr8.c content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 30070
GET H2	200	picker_verify_sms_27a6d18b56f46818420e60a773c36d4e.svg aadcdn.msauth.net/shared/1.0/content/images/	250 B 721 B	173ms 40ms	Image image/svg+xml	2620:1ec:bdf::67 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msauth.net/shared/1.0/content/images/picker_verify_sms_27a6d18b56f46818420e60a773c36d4e.svg Requested by Host: pub-a5a0b0fee89542dfb1ab2d8e5d94d1f8.r2.dev URL: https://pub-a5a0b0fee89542dfb1ab2d8e5d94d1f8.r2.dev/index9876543213456789876543212345678987654323456787654321234567898765432134567898765432134567898765432345678976543213456789765432345678.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:1ec:bdf::67 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 8ed8f3acb9b87f99e42c74463d4e2be96ee85b8a87cd6eb874295ace420a5904 Request headers accept-language de-DE,de;q=0.9 Referer https://pub-a5a0b0fee89542dfb1ab2d8e5d94d1f8.r2.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Thu, 14 Sep 2023 16:23:04 GMT content-encoding gzip x-cache TCP_HIT content-length 199 x-ms-lease-status unlocked last-modified Fri, 17 Jan 2020 19:28:39 GMT etag 0x8D79B8374CE7F93 x-azure-ref 20230914T162304Z-qpdue5whpt0m91ukm0bbce9vrc00000000k0000000031b55 content-type image/svg+xml access-control-allow-origin * x-ms-request-id 09f49a1e-c01e-001f-3ab4-e50e4e000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	picker_verify_call_fe87496cc7a44412f7893a72099c120a.svg aadcdn.msauth.net/shared/1.0/content/images/	3 KB 2 KB	174ms 41ms	Image image/svg+xml	2620:1ec:bdf::67 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msauth.net/shared/1.0/content/images/picker_verify_call_fe87496cc7a44412f7893a72099c120a.svg Requested by Host: pub-a5a0b0fee89542dfb1ab2d8e5d94d1f8.r2.dev URL: https://pub-a5a0b0fee89542dfb1ab2d8e5d94d1f8.r2.dev/index9876543213456789876543212345678987654323456787654321234567898765432134567898765432134567898765432345678976543213456789765432345678.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:1ec:bdf::67 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 55ce3b0ce5bc71339308107982cd7671f96014256ded0be36dc8062e64c847f1 Request headers accept-language de-DE,de;q=0.9 Referer https://pub-a5a0b0fee89542dfb1ab2d8e5d94d1f8.r2.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Thu, 14 Sep 2023 16:23:04 GMT content-encoding gzip x-cache TCP_HIT content-length 1173 x-ms-lease-status unlocked last-modified Fri, 17 Jan 2020 19:28:39 GMT etag 0x8D79B83749623C9 x-azure-ref 20230914T162304Z-qpdue5whpt0m91ukm0bbce9vrc00000000k0000000031b56 content-type image/svg+xml access-control-allow-origin * x-ms-request-id b489cc1c-401e-0017-5948-e5565f000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	picker_verify_fluent_authenticator_b59c16ca9bf156438a8a96d45e33db64.svg aadcdn.msauth.net/shared/1.0/content/images/	7 KB 3 KB	174ms 42ms	Image image/svg+xml	2620:1ec:bdf::67 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msauth.net/shared/1.0/content/images/picker_verify_fluent_authenticator_b59c16ca9bf156438a8a96d45e33db64.svg Requested by Host: pub-a5a0b0fee89542dfb1ab2d8e5d94d1f8.r2.dev URL: https://pub-a5a0b0fee89542dfb1ab2d8e5d94d1f8.r2.dev/index9876543213456789876543212345678987654323456787654321234567898765432134567898765432134567898765432345678976543213456789765432345678.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:1ec:bdf::67 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash a7ee799dd5b6f6dbb70b043b766362a6724e71458f9839306c995f06b218c2f8 Request headers accept-language de-DE,de;q=0.9 Referer https://pub-a5a0b0fee89542dfb1ab2d8e5d94d1f8.r2.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Thu, 14 Sep 2023 16:23:04 GMT content-encoding gzip x-cache TCP_HIT content-length 2407 x-ms-lease-status unlocked last-modified Fri, 11 Mar 2022 11:11:29 GMT etag 0x8DA034FE445C10D x-azure-ref 20230914T162304Z-qpdue5whpt0m91ukm0bbce9vrc00000000k0000000031b57 content-type image/svg+xml access-control-allow-origin * x-ms-request-id 57d771bb-501e-0022-52ec-e6f044000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET DATA	200 OK	truncated /	4 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	756 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 5d3357bd875b7335ace42e8ee3a64578e4253bed1a4e279109de403eedae3a69 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	899 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash b7fcd37eaafe3f08647ed072d5289eadfff6c660a26cdef31532b3fcfb4a0bb2 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	222 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 749f85621d92a5b31b2a377a8c385a36d48a83327dad9a8a8da93cd831b8c9a2 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	513 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.62 Safari/537.36 Response headers Content-Type image/svg+xml

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

14 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture function| _0x22c0a8 function| _0x4876b9 function| _0x527943 function| _0x44ac06 function| _0x34a683 object| scr string| stc function| _0x5804 function| _0x1057 function| $ function| jQuery string| em string| ur

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	(Line 1) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-3.1.1.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	(Line 1) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-3.1.1.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aadcdn.msauth.net
cdnjs.cloudflare.com
code.jquery.com
hkmloverki.com
pub-a5a0b0fee89542dfb1ab2d8e5d94d1f8.r2.dev
2001:4de0:ac18::1:a:2b
2606:4700::6811:190e
2606:4700::6812:223
2620:1ec:bdf::67
72.167.135.212
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58
36e0a7e08bee65774168528938072c536437669c1b7458ac77976ec788e4439c
3f5410785cb94c98bdf72f8bbe453021702bc4603b6e1dcefd0684c5e305ea1b
55ce3b0ce5bc71339308107982cd7671f96014256ded0be36dc8062e64c847f1
5bf277ef9e1f542bc0968488acc538d13fc7dee1d18141fd1763f947b599146b
5d3357bd875b7335ace42e8ee3a64578e4253bed1a4e279109de403eedae3a69
749f85621d92a5b31b2a377a8c385a36d48a83327dad9a8a8da93cd831b8c9a2
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
8ed8f3acb9b87f99e42c74463d4e2be96ee85b8a87cd6eb874295ace420a5904
a7ee799dd5b6f6dbb70b043b766362a6724e71458f9839306c995f06b218c2f8
b7fcd37eaafe3f08647ed072d5289eadfff6c660a26cdef31532b3fcfb4a0bb2