pub-db43ca51b636428e82c6dd52268b2699.r2.dev
Open in
urlscan Pro
2606:4700:7::eb
Malicious Activity!
Public Scan
Effective URL: https://pub-db43ca51b636428e82c6dd52268b2699.r2.dev/yesdeepmoresee.html
Submission: On September 19 via manual from DZ — Scanned from GB
Summary
TLS certificate: Issued by E6 on August 1st 2024. Valid for: 3 months.
This is the only time pub-db43ca51b636428e82c6dd52268b2699.r2.dev was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Email (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
3 | 38.21.198.131 38.21.198.131 | 40934 (FORTINET) (FORTINET) | |
1 | 34.117.33.233 34.117.33.233 | 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM) | |
1 | 2606:4700:7::eb 2606:4700:7::eb | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a00:1450:400... 2a00:1450:4001:828::200a | 15169 (GOOGLE) (GOOGLE) | |
2 | 2a04:4e42:400... 2a04:4e42:400::649 | 54113 (FASTLY) (FASTLY) | |
14 | 95.164.33.245 95.164.33.245 | 44477 (STARK-IND...) (STARK-INDUSTRIES) | |
22 | 7 |
ASN40934 (FORTINET, US)
PTR: relaydx39.fortimailcloud.com
cevital-com.fortimailcloud.com |
ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 233.33.117.34.bc.googleusercontent.com
hr-team-memenber-admin932.replit.app |
ASN13335 (CLOUDFLARENET, US)
pub-db43ca51b636428e82c6dd52268b2699.r2.dev |
ASN44477 (STARK-INDUSTRIES, GB)
PTR: vm2090149.stark-industries.solutions
zitromanx.top |
Apex Domain Subdomains |
Transfer | |
---|---|---|
14 |
zitromanx.top
zitromanx.top |
153 KB |
3 |
fortimailcloud.com
cevital-com.fortimailcloud.com |
4 KB |
2 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 808 |
108 KB |
1 |
googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 407 |
30 KB |
1 |
r2.dev
pub-db43ca51b636428e82c6dd52268b2699.r2.dev |
150 KB |
1 |
replit.app
hr-team-memenber-admin932.replit.app |
924 B |
22 | 6 |
Domain | Requested by | |
---|---|---|
14 | zitromanx.top |
pub-db43ca51b636428e82c6dd52268b2699.r2.dev
zitromanx.top |
3 | cevital-com.fortimailcloud.com |
cevital-com.fortimailcloud.com
|
2 | code.jquery.com |
pub-db43ca51b636428e82c6dd52268b2699.r2.dev
|
1 | ajax.googleapis.com |
pub-db43ca51b636428e82c6dd52268b2699.r2.dev
|
1 | pub-db43ca51b636428e82c6dd52268b2699.r2.dev |
hr-team-memenber-admin932.replit.app
|
1 | hr-team-memenber-admin932.replit.app |
cevital-com.fortimailcloud.com
|
22 | 6 |
This site contains links to these domains. Also see Links.
Domain |
---|
go.cpanel.net |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.fortimailcloud.com DigiCert Global G2 TLS RSA SHA256 2020 CA1 |
2024-08-22 - 2025-08-21 |
a year | crt.sh |
replit.app WR3 |
2024-08-15 - 2024-11-13 |
3 months | crt.sh |
*.r2.dev E6 |
2024-08-01 - 2024-10-30 |
3 months | crt.sh |
upload.video.google.com WR2 |
2024-08-26 - 2024-11-18 |
3 months | crt.sh |
*.jquery.com Sectigo ECC Domain Validation Secure Server CA |
2024-06-25 - 2025-06-25 |
a year | crt.sh |
*.zitromanx.top R10 |
2024-07-03 - 2024-10-01 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://pub-db43ca51b636428e82c6dd52268b2699.r2.dev/yesdeepmoresee.html
Frame ID: 3FB2A0CA93FC767F18D051C1C09BD42A
Requests: 23 HTTP requests in this frame
Screenshot
Page Title
Webmail LoginPage URL History Show full URLs
- https://cevital-com.fortimailcloud.com/fmlurlsvc/?fewReq=:B:JVA0Pzg+NCh4MzwgPihnajM+PzQ+Pyh9Z2lgb3p7fGszOW9razhtOT9... Page URL
- https://hr-team-memenber-admin932.replit.app/ Page URL
- https://pub-db43ca51b636428e82c6dd52268b2699.r2.dev/yesdeepmoresee.html Page URL
Detected technologies
Bootstrap (Web Frameworks) ExpandDetected patterns
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Moment.js (JavaScript Libraries) Expand
Detected patterns
- moment(?:\.min)?\.js
Select2 (JavaScript Libraries) Expand
Detected patterns
- select2(?:\.min|\.full)?\.js
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
2 Outgoing links
These are links going to different origins than the main page.
Title: cPanel Blog
Search URL Search Domain Scan URL
Title: Privacy Policy
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://cevital-com.fortimailcloud.com/fmlurlsvc/?fewReq=:B:JVA0Pzg+NCh4MzwgPihnajM+PzQ+Pyh9Z2lgb3p7fGszOW9razhtOT9oPztrbTg/ODdrbWw9NmpsOjo+a285OTZqNzY5P2s+bCh6Mz85PDg4NjY+PDwof2dqMzo2R0RcOGlAPTg6PjY9PiM6NkdEXDhpQT04Oj42PT4ofG1+ejNvbGprYGF7fCBsa2BtZm9vTm1reGd6b2IgbWFjKG0zOzwoZmpiMz4=&url=https%3a%2f%2fhr-team-memenber-admin932.replit.app%2f%23abdenour.benchaa%40cevital.com Page URL
- https://hr-team-memenber-admin932.replit.app/ Page URL
- https://pub-db43ca51b636428e82c6dd52268b2699.r2.dev/yesdeepmoresee.html Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
22 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
/
cevital-com.fortimailcloud.com/fmlurlsvc/ |
5 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
/
cevital-com.fortimailcloud.com//fmlurlsvc/ |
88 B 589 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
favicon.ico
cevital-com.fortimailcloud.com/ |
318 B 844 B |
Other
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
hr-team-memenber-admin932.replit.app/ |
766 B 924 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
yesdeepmoresee.html
pub-db43ca51b636428e82c6dd52268b2699.r2.dev/ |
150 KB 150 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/2.2.4/ |
84 KB 30 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.1.1.min.js
code.jquery.com/ |
85 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.3.1.js
code.jquery.com/ |
265 KB 79 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
styleme_v2_optimized.css
zitromanx.top/rcubby/ufiles/ |
141 KB 31 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
webmail-logo.svg
zitromanx.top/rcubby/ufiles/ |
5 KB 6 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-3.2.1.min.js
zitromanx.top/myjs/vendor/jquery/ |
85 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
animsition.min.js
zitromanx.top/myjs/vendor/animsition/js/ |
5 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
popper.js
zitromanx.top/myjs/vendor/bootstrap/js/ |
80 KB 21 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bootstrap.min.js
zitromanx.top/myjs/vendor/bootstrap/js/ |
50 KB 13 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
select2.min.js
zitromanx.top/myjs/vendor/select2/ |
65 KB 19 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
moment.min.js
zitromanx.top/myjs/vendor/daterangepicker/ |
46 KB 15 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
daterangepicker.js
zitromanx.top/myjs/vendor/daterangepicker/ |
68 KB 12 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
countdowntime.js
zitromanx.top/myjs/vendor/countdowntime/ |
1 KB 832 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
main.js
zitromanx.top/myjs/js/ |
2 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
notice-error.png
zitromanx.top/rcubby/ufiles/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icon-username.png
zitromanx.top/rcubby/ufiles/ |
320 B 605 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icon-password.png
zitromanx.top/rcubby/ufiles/ |
450 B 735 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Email (Online)28 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery function| Popper function| moment function| daterangepicker function| _0x1f1362 function| _0x9f4ae0 function| _0x28b013 function| _0x56ab function| _0x1b7c function| _0x39c7c9 function| _0x18e3d5 object| filter function| search string| dot function| _0x3d6af9 function| _0x2be6ee function| _0x4b9296 function| _0x2cd4c7 function| _0x522bae function| _0xf252f8 function| _0x503c function| _0x23ff65 function| _0x30003d function| _0x3a04d9 function| _0x2474 function| _0x3d3d82 function| _0x3576e40 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Content-Security-Policy | script-src 'self' 'unsafe-inline'; object-src 'none'; frame-ancestors 'self' https://*.fortimailcloud.com/ https://fortimail.forticloud.com/ |
Strict-Transport-Security | max-age=31536000; includeSubDomains |
X-Content-Type-Options | nosniff |
X-Frame-Options | SAMEORIGIN |
X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
cevital-com.fortimailcloud.com
code.jquery.com
hr-team-memenber-admin932.replit.app
pub-db43ca51b636428e82c6dd52268b2699.r2.dev
zitromanx.top
2606:4700:7::eb
2a00:1450:4001:828::200a
2a04:4e42:400::649
34.117.33.233
38.21.198.131
95.164.33.245
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
05ce0f813e6236158fa1d115faba62cd2041aab1878cac0960a0f45575cece1e
0e25895d7caaf355a53d19c37c69a06198f668e5422b211d27597ed93983b80b
2c3836208d9d0a3f9dab8ef05dda493c6e98c175155e7e7abba3575207ad0244
41c4e31f5d03a0f5bf67b80f6ddb4c6eb412e92a94745344bdab70a3520d4b87
4cff184248850f8767575963eb504ee95bbfabff946cdbfb4271474442b80ecd
4dc700204888299ca8c36beefa9e71b45b6784ab2648569c39d4956e9691c33b
4e411c99fe4a486db34e801a53392ae86f8659eccc438944b5a062c9aaba25be
6e0ed91e4f9d467675fcc84072fdda568e2b53757c71bc32428107752941e310
70667a94ef79118b93b13b1cb41fcb11b09e8fd3ce0c9c82680ed5f991ba9a32
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
998cd48cdc0414f694d0a3a299dd2beb1134769d5666c7e5567e7d20b4174ef8
a02998df88a6efb0baa526796b2b682ce9fdd6471ceb19170b326320f22f7053
a93f37c5c32d030a1d831b5023b6b29bc93290f5423debaf47c83b6444528059
b567c08098f2fe628374d2d4f5411b2b666b8645c00479a8e34c6c8cf84deb7a
bcaf01928e5c7246ab0bb7e83f609b485a67a5e442d3dd94539a883c11fb70cd
d18b3c9feb76c3c1cfdcc51c732f113327e3c33fb3f63b479951f7da6ed1216f
d418f1a383157e6d013cc08376bfad645f6b8a5a7e4310798ec0a5c8b389eccb
d8aa24ecc6cecb1a60515bc093f1c9da38a0392612d9ab8ae0f7f36e6eee1fad
f32da6bf81134c664b32582076b8260b3b614d508d5c651d0907b581df2a9323
fa659dfc6ebd4b8aad80fa304842c879502fefe16e2fcef55976a89605e7af04