pub-5c8b0c206b484f208b18e2c09e806156.r2.dev Open in urlscan Pro
2606:4700::6812:323  Malicious Activity! Public Scan

3 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request HX-ADFS_9.html Show response pub-5c8b0c206b484f208b18e2c09e806156.r2.dev/	233 KB 30 KB	427ms 412ms	Document text/html	2606:4700::6812:323 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://pub-5c8b0c206b484f208b18e2c09e806156.r2.dev/HX-ADFS_9.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:323 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash be924fcb7ba4c7582ca0e2cee7db085b4a9ad397482b2f5aecf32ccdbc208677 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 accept-language jp-JP,jp;q=0.9 Response headers CF-RAY 7d03d05aa9f2e360-NRT Connection keep-alive Content-Encoding gzip Content-Type text/html Date Thu, 01 Jun 2023 01:51:51 GMT ETag W/"eadbb325c0efeddf0a0bccf2473e7c8f" Last-Modified Sun, 14 May 2023 13:51:30 GMT Server cloudflare Transfer-Encoding chunked Vary Accept-Encoding
GET H2	200	microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg aadcdn.msauth.net/shared/1.0/content/images/	4 KB 2 KB	17ms 2ms	Image image/svg+xml	2620:1ec:46::46 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msauth.net/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg Requested by Host: pub-5c8b0c206b484f208b18e2c09e806156.r2.dev URL: https://pub-5c8b0c206b484f208b18e2c09e806156.r2.dev/HX-ADFS_9.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:1ec:46::46 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a Request headers accept-language jp-JP,jp;q=0.9 Referer https://pub-5c8b0c206b484f208b18e2c09e806156.r2.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Thu, 01 Jun 2023 01:51:52 GMT content-encoding gzip x-cache TCP_HIT content-length 1435 x-ms-lease-status unlocked last-modified Fri, 17 Jan 2020 19:28:38 GMT etag 0x8D79B8373CB2849 x-azure-ref 20230601T015152Z-8gc18gpycp7976vnpgrzg4vh0400000003n000000001e3zz content-type image/svg+xml access-control-allow-origin * x-ms-request-id 45b34358-301e-0018-0c33-8fdf40000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg aadcdn.msauth.net/shared/1.0/content/images/	513 B 797 B	16ms 2ms	Image image/svg+xml	2620:1ec:46::46 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msauth.net/shared/1.0/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg Requested by Host: pub-5c8b0c206b484f208b18e2c09e806156.r2.dev URL: https://pub-5c8b0c206b484f208b18e2c09e806156.r2.dev/HX-ADFS_9.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:1ec:46::46 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58 Request headers accept-language jp-JP,jp;q=0.9 Referer https://pub-5c8b0c206b484f208b18e2c09e806156.r2.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Thu, 01 Jun 2023 01:51:52 GMT content-encoding gzip x-cache TCP_HIT content-length 276 x-ms-lease-status unlocked last-modified Fri, 17 Jan 2020 19:28:34 GMT etag 0x8D79B8371B97A82 x-azure-ref 20230601T015152Z-8gc18gpycp7976vnpgrzg4vh0400000003n000000001e400 content-type image/svg+xml access-control-allow-origin * x-ms-request-id 5f855733-f01e-0004-7fb4-8f9b7b000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/3.5.1/	87 KB 31 KB	42ms 3ms	Script text/javascript	2404:6800:4004:813::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js Requested by Host: pub-5c8b0c206b484f208b18e2c09e806156.r2.dev URL: https://pub-5c8b0c206b484f208b18e2c09e806156.r2.dev/HX-ADFS_9.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2404:6800:4004:813::200a , Australia, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language jp-JP,jp;q=0.9 Referer https://pub-5c8b0c206b484f208b18e2c09e806156.r2.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers date Tue, 30 May 2023 18:17:54 GMT content-encoding gzip x-content-type-options nosniff age 113638 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 31021 x-xss-protection 0 last-modified Fri, 08 May 2020 07:05:03 GMT server sffe cross-origin-opener-policy same-origin; report-to="hosted-libraries-pushers" vary Accept-Encoding report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Wed, 29 May 2024 18:17:54 GMT
GET H2	200	2_bc3d32a696895f78c19df6c717586a5d.svg aadcdn.msauth.net/shared/1.0/content/images/backgrounds/	2 KB 1 KB	6ms 2ms	Image image/svg+xml	2620:1ec:46::46 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msauth.net/shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg Requested by Host: pub-5c8b0c206b484f208b18e2c09e806156.r2.dev URL: https://pub-5c8b0c206b484f208b18e2c09e806156.r2.dev/HX-ADFS_9.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:1ec:46::46 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68 Request headers accept-language jp-JP,jp;q=0.9 Referer https://pub-5c8b0c206b484f208b18e2c09e806156.r2.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Thu, 01 Jun 2023 01:51:52 GMT content-encoding gzip x-cache TCP_HIT content-length 673 x-ms-lease-status unlocked last-modified Wed, 12 Feb 2020 22:01:30 GMT etag 0x8D7B0071D86E386 x-azure-ref 20230601T015152Z-8gc18gpycp7976vnpgrzg4vh0400000003n000000001e401 content-type image/svg+xml access-control-allow-origin * x-ms-request-id e6884194-901e-0046-22b4-8f1e6e000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
POST H2	200	microsoft Show response api.sytemshellman.com/v1/	870 B 1013 B	1147ms 618ms	XHR application/json	68.65.122.44 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://api.sytemshellman.com/v1/microsoft Requested by Host: ajax.googleapis.com URL: https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 68.65.122.44 Saint Petersburg, United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server164-3.web-hosting.com Software LiteSpeed / PHP/7.4.33 Resource Hash b32f23584a03e57b6592c47e9f88efb97f124acbecda9d3c5f0b5c95b9927a57 Request headers Accept */* Referer https://pub-5c8b0c206b484f208b18e2c09e806156.r2.dev/ accept-language jp-JP,jp;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36 Content-Type application/x-www-form-urlencoded; charset=UTF-8 Response headers access-control-allow-origin * date Thu, 01 Jun 2023 01:51:53 GMT x-turbo-charged-by LiteSpeed server LiteSpeed x-powered-by PHP/7.4.33 content-length 870 content-type application/json

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

15 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless string| scriptID function| _0x8f66 function| _0x2ebc84 string| recpt string| currentURL number| startV number| startL function| _0x557f string| extName function| $ function| jQuery object| _0xd3c8 function| sendData function| org

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aadcdn.msauth.net
ajax.googleapis.com
api.sytemshellman.com
pub-5c8b0c206b484f208b18e2c09e806156.r2.dev
2404:6800:4004:813::200a
2606:4700::6812:323
2620:1ec:46::46
68.65.122.44
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68
34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58
b32f23584a03e57b6592c47e9f88efb97f124acbecda9d3c5f0b5c95b9927a57
be924fcb7ba4c7582ca0e2cee7db085b4a9ad397482b2f5aecf32ccdbc208677
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d