ledger-clearsigning-activation.com Open in urlscan Pro
188.114.96.3  Malicious Activity! Public Scan

Submitted URL: https://bejo88.backgroundeventos.cl/
Effective URL: https://ledger-clearsigning-activation.com/
Submission: On October 31 via api from US — Scanned from DE

Summary

This website contacted 3 IPs in 3 countries across 4 domains to perform 6 HTTP transactions. The main IP is 188.114.96.3, located in Amsterdam, Netherlands and belongs to CLOUDFLARENET, US. The main domain is ledger-clearsigning-activation.com.
TLS certificate: Issued by WE1 on October 29th 2024. Valid for: 3 months.
This is the only time ledger-clearsigning-activation.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Ledger (Crypto Exchange)

Domain & IP information

IP Address AS Autonomous System
1 1 190.113.0.69 22860 (SERVICIOS...)
1 1 188.114.97.3 13335 (CLOUDFLAR...)
1 6 188.114.96.3 13335 (CLOUDFLAR...)
1 2 2606:4700:440... 13335 (CLOUDFLAR...)
6 3
Apex Domain
Subdomains
Transfer
6 ledger-clearsigning-activation.com
ledger-clearsigning-activation.com
899 KB
2 ledger.com
www.ledger.com — Cisco Umbrella Rank: 62127
ledger-wp-website-s3-prd.ledger.com
7 KB
1 back-door-always.com
back-door-always.com
706 B
1 backgroundeventos.cl
bejo88.backgroundeventos.cl
250 B
6 4
Domain Requested by
6 ledger-clearsigning-activation.com 1 redirects ledger-clearsigning-activation.com
1 ledger-wp-website-s3-prd.ledger.com ledger-clearsigning-activation.com
1 www.ledger.com 1 redirects
1 back-door-always.com 1 redirects
1 bejo88.backgroundeventos.cl 1 redirects
6 5

This site contains links to these domains. Also see Links.

Domain
developers.ledger.com
www.ledger.com
shop.ledger.com
Subject Issuer Validity Valid
ledger-clearsigning-activation.com
WE1
2024-10-29 -
2025-01-27
3 months crt.sh

This page contains 2 frames:

Primary Page: https://ledger-clearsigning-activation.com/
Frame ID: BBF21F8DA5B850CAB8849C8AF16A0AC4
Requests: 5 HTTP requests in this frame

Frame: https://ledger-clearsigning-activation.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/22755d9a86c9/main.js
Frame ID: 163FB6979F1049DEABCE898C06FEA3DE
Requests: 2 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. https://bejo88.backgroundeventos.cl/ HTTP 301
    https://back-door-always.com/ HTTP 302
    https://ledger-clearsigning-activation.com/ Page URL

Page Statistics

6
Requests

67 %
HTTPS

25 %
IPv6

4
Domains

5
Subdomains

3
IPs

3
Countries

904 kB
Transfer

1179 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://bejo88.backgroundeventos.cl/ HTTP 301
    https://back-door-always.com/ HTTP 302
    https://ledger-clearsigning-activation.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1
  • https://www.ledger.com/wp-content/uploads/2023/03/Recover-X-coincover.png HTTP 301
  • https://ledger-wp-website-s3-prd.ledger.com/uploads/2023/03/Recover-X-coincover.png
Request Chain 4
  • https://ledger-clearsigning-activation.com/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
  • https://ledger-clearsigning-activation.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/22755d9a86c9/main.js

6 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
ledger-clearsigning-activation.com/
Redirect Chain
  • https://bejo88.backgroundeventos.cl/
  • https://back-door-always.com/
  • https://ledger-clearsigning-activation.com/
21 KB
7 KB
Document
General
Full URL
https://ledger-clearsigning-activation.com/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PleskLin
Resource Hash
1cc32eae1695e01a3c0c8f9f2c7620fdd4c171ab8bda49faabf480b63a0dba6a

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
8db131595a6bd206-FRA
content-encoding
br
content-type
text/html
date
Thu, 31 Oct 2024 05:19:53 GMT
last-modified
Mon, 14 Oct 2024 16:27:08 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
priority
u=0,i
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=j1HYTpFiVoHKp0MPJcSpDgKy664YLwQvhvq7vuH4k%2BYgtIPU8MiaVowF3BIcMBRUTQRbsl3xVqECD0dAaqjmwTabh1AIlXHh2FW%2BuBwiSZQ3phpfIcV%2FG5hZoCttSNQ3l%2F8aT%2FKcsRcI5E44ATak6cnBuRG9"}],"group":"cf-nel","max_age":604800}
server
cloudflare
server-timing
cfL4;desc="?proto=QUIC&rtt=6845&sent=12&recv=10&lost=0&retrans=0&sent_bytes=4180&recv_bytes=4498&delivery_rate=881&cwnd=12000&unsent_bytes=0&cid=57fb533d5cfb6007&ts=96&x=1" cfExtPri cfHdrFlush;dur=0
vary
accept-encoding
x-powered-by
PleskLin

Redirect headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
8db13158ccce1e31-FRA
content-type
text/html; charset=UTF-8
date
Thu, 31 Oct 2024 05:19:53 GMT
location
https://ledger-clearsigning-activation.com/
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
priority
u=0,i
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hIPWJdRpDNTnrgyYot54pxr2F5p2YlnxlDLpWeXvAWIWGiraVpmZKe2q3%2BYNKGR56XHbCc6TzvGxBWMR1bEviMtQnbsBFuca%2BSnholin2waxnU2pK6kttDvK4hDixW29P0AG6q1ShA%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
server-timing
cfL4;desc="?proto=QUIC&rtt=6993&sent=11&recv=9&lost=0&retrans=0&sent_bytes=4146&recv_bytes=4440&delivery_rate=83008&cwnd=12000&unsent_bytes=0&cid=c2d2a16c7c20c56f&ts=54&x=1" cfExtPri cfHdrFlush;dur=0
x-powered-by
PHP/8.3.13 PleskLin
all.css
ledger-clearsigning-activation.com/assets/
515 KB
258 KB
Stylesheet
General
Full URL
https://ledger-clearsigning-activation.com/assets/all.css
Requested by
Host: ledger-clearsigning-activation.com
URL: https://ledger-clearsigning-activation.com/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PleskLin
Resource Hash
f85b1788c5491b8106eb14d98d71cde93d2583d3f04a709bdcb810d23f9d36c3

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://ledger-clearsigning-activation.com/

Response headers

content-encoding
br
cf-cache-status
REVALIDATED
etag
W/"65dc65fe-80c7a"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2B10DFzIkGSa9gCfUXe0rQ66k2jUgL%2B1nwaV2p%2BPzsrpJNq4sC6qKw1j%2BC%2FFA6dgsfYBhNkJwfmscD%2BiW7p4dg2c4QF8LP2AiUHd5wHquBo6Wsxkdu4oMuHM1ITkW3kT2XgcjzsNkut6Zg%2FRZ7x9ZOSli3FHv"}],"group":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=7105&sent=84&recv=30&lost=0&retrans=0&sent_bytes=88437&recv_bytes=5948&delivery_rate=515142&cwnd=40800&unsent_bytes=0&cid=57fb533d5cfb6007&ts=178&x=1", cfExtPri, cfHdrFlush;dur=3
date
Thu, 31 Oct 2024 05:19:53 GMT
content-type
text/css
last-modified
Mon, 26 Feb 2024 10:20:46 GMT
vary
Accept-Encoding
priority
u=0,i=?0
cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
8db13159fabdd206-FRA
x-powered-by
PleskLin
server
cloudflare
Recover-X-coincover.png
ledger-wp-website-s3-prd.ledger.com/uploads/2023/03/
Redirect Chain
  • https://www.ledger.com/wp-content/uploads/2023/03/Recover-X-coincover.png
  • https://ledger-wp-website-s3-prd.ledger.com/uploads/2023/03/Recover-X-coincover.png
6 KB
6 KB
Image
General
Full URL
https://ledger-wp-website-s3-prd.ledger.com/uploads/2023/03/Recover-X-coincover.png
Requested by
Host: ledger-clearsigning-activation.com
URL: https://ledger-clearsigning-activation.com/
Protocol
H2
Server
2606:4700:4400::ac40:9968 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c3fa3bed7b6ad01f1e21e09e957b87a1b7b5558c5434aa7224e6800c8af14492

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

cf-bgj
imgq:100,h2pri
etag
"5eeea311b3bcfb87b05a632241a30e3e"
x-amz-version-id
_j_wEYUGgS49fUQ9Q9QMKfp4QaOV79If
cf-cache-status
HIT
expires
Thu, 31 Oct 2024 09:19:54 GMT
cf-polished
origFmt=png, origSize=14352
date
Thu, 31 Oct 2024 05:19:54 GMT
content-type
image/webp
content-disposition
inline; filename="Recover-X-coincover.webp"
vary
Accept
last-modified
Mon, 04 Mar 2024 10:02:34 GMT
x-amz-id-2
Kaxa4647ne1DRW+fncrecWZH79b/XS2QIIqFMRZZz9WFCWopAMovoEEqhjoPimdmBq9yWCamJCY=
x-amz-replication-status
COMPLETED
cache-control
public, max-age=14400
x-amz-request-id
CXRS8Y2EG0ETQQ4P
cf-ray
8db1315a5b1f9766-FRA
accept-ranges
bytes
content-length
5778
server
cloudflare
x-amz-server-side-encryption
AES256

Redirect headers

access-control-max-age
1728000
cf-cache-status
HIT
age
11344
access-control-allow-methods
GET, PUT, POST, DELETE, PATCH, OPTIONS
expires
Thu, 31 Oct 2024 09:19:53 GMT
date
Thu, 31 Oct 2024 05:19:53 GMT
content-type
text/html
vary
Accept-Encoding
access-control-allow-headers
DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization
strict-transport-security
max-age=31536000; includeSubDomains
cache-control
public, max-age=14400
location
https://ledger-wp-website-s3-prd.ledger.com/uploads/2023/03/Recover-X-coincover.png
access-control-allow-credentials
true
cf-ray
8db1315a2b079766-FRA
access-control-allow-origin
*
server
cloudflare
rcv.png
ledger-clearsigning-activation.com/assets/
627 KB
628 KB
Image
General
Full URL
https://ledger-clearsigning-activation.com/assets/rcv.png
Requested by
Host: ledger-clearsigning-activation.com
URL: https://ledger-clearsigning-activation.com/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PleskLin
Resource Hash
3897ab7614a8854eec84bd75838fa6e257b4d59f8af84c911ab8cf174b39b19a

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

cf-cache-status
REVALIDATED
etag
"65dc6cbc-9caf1"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=91CZbAsApc%2FoIwKDEloDyyjSLFdy0%2FI9InfAl%2FJysiTEnChzNqwHuejJt3YgTObhTIhXqBPbv9OF%2BaU9EEzJOw8TQ3VtT21iDv6YIKGUX4oUG%2FaZFyphGqgMxYRCsWbbS8qB%2F4rAPnR8OMukZmFtG7wtbk35"}],"group":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=7228&sent=20&recv=15&lost=0&retrans=0&sent_bytes=11637&recv_bytes=5303&delivery_rate=1102212&cwnd=12000&unsent_bytes=0&cid=57fb533d5cfb6007&ts=160&x=1", cfExtPri, cfHdrFlush;dur=0
date
Thu, 31 Oct 2024 05:19:53 GMT
content-type
image/png
last-modified
Mon, 26 Feb 2024 10:49:32 GMT
vary
Accept-Encoding
priority
u=2,i
cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
8db13159fabfd206-FRA
accept-ranges
bytes
content-length
641777
x-powered-by
PleskLin
server
cloudflare
truncated
/
2 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
24859811f0d8052e5979a146e00930a379b14745e480f40b20f1d9ccd79b99e0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/svg+xml
main.js
ledger-clearsigning-activation.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/22755d9a86c9/ Frame 163F
Redirect Chain
  • https://ledger-clearsigning-activation.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
  • https://ledger-clearsigning-activation.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/22755d9a86c9/main.js?
8 KB
4 KB
Script
General
Full URL
https://ledger-clearsigning-activation.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/22755d9a86c9/main.js?
Protocol
H3
Server
188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6a7571e2b4f38a37ecbe53726943c15d6c46984d2c2d2a6f6cf1b1265586bd59
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

cache-control
max-age=14400, stale-if-error=10800, stale-while-revalidate=10800, public
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
br
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4NNA395DA1DeuFg0yXfDrfFZKfwljFRTodM6hsYVbe1EGW7NP0sqyeIJaYPtgk2pB9ADWL1h%2F%2F%2F7uhKnYu1wCp6LsFxAWa%2Fh3fVCWlyayatguhpoUsu9PRlEtLSum12e3mUOS9OUm%2BJ6Kq4qjJzDkVXlOl6Y"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
cf-ray
8db1315b1b65d206-FRA
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=9939&sent=798&recv=131&lost=0&retrans=0&sent_bytes=939589&recv_bytes=10977&delivery_rate=37859&cwnd=411600&unsent_bytes=0&cid=57fb533d5cfb6007&ts=303&x=1", cfExtPri, cfHdrFlush;dur=0
date
Thu, 31 Oct 2024 05:19:54 GMT
content-type
application/javascript; charset=UTF-8
vary
Accept-Encoding
server
cloudflare
priority
u=3,i=?0

Redirect headers

cache-control
max-age=300, stale-if-error=10800, stale-while-revalidate=10800, public
location
/cdn-cgi/challenge-platform/h/b/scripts/jsd/22755d9a86c9/main.js?
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Hw60Zn8YKbLjW56JJBlG8mn8bK6XCs45meqWWMAXSezpylGzqkYwD0uQyI3%2FAixT0FLDY7GT9NyjRlqQw5pev5v1xRrAoLSR5eXw0f%2FqSN8O%2BcDZ6oe7L6hDDCVIKHi22JJEHmvpw4rhxcNrrzFaxELG1%2Fvu"}],"group":"cf-nel","max_age":604800}
cf-ray
8db1315afb54d206-FRA
access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
content-length
0
server-timing
cfL4;desc="?proto=QUIC&rtt=10332&sent=796&recv=129&lost=0&retrans=0&sent_bytes=938836&recv_bytes=10637&delivery_rate=29416710&cwnd=411600&unsent_bytes=0&cid=57fb533d5cfb6007&ts=286&x=1", cfExtPri, cfHdrFlush;dur=0
date
Thu, 31 Oct 2024 05:19:54 GMT
vary
Accept-Encoding
server
cloudflare
priority
u=3,i=?0
8db131595a6bd206
ledger-clearsigning-activation.com/cdn-cgi/challenge-platform/h/b/jsd/r/ Frame 163F
0
1 KB
XHR
General
Full URL
https://ledger-clearsigning-activation.com/cdn-cgi/challenge-platform/h/b/jsd/r/8db131595a6bd206
Requested by
Host: ledger-clearsigning-activation.com
URL: https://ledger-clearsigning-activation.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type
application/json
Referer

Response headers

nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4vUKva3FBWcTgL8xSR31KO2TSq%2FHsB0wUktp7ZbCgHjQWlANnrM9lvKMvoGEVpl6ApUSyUyfx8ZgR4aqJH%2BbBaJ3UMgjqy5tqNMdRxcot32DkiBxFo1zaEb%2BIzR4mxguaH61hrKVGwsu69fVc8cVbCxOLC6%2B"}],"group":"cf-nel","max_age":604800}
cf-ray
8db1315b8ba1d206-FRA
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=9523&sent=810&recv=147&lost=0&retrans=0&sent_bytes=944312&recv_bytes=28220&delivery_rate=293059&cwnd=411600&unsent_bytes=0&cid=57fb533d5cfb6007&ts=386&x=1", cfExtPri, cfHdrFlush;dur=0
content-length
0
date
Thu, 31 Oct 2024 05:19:54 GMT
content-type
text/plain; charset=UTF-8
server
cloudflare
priority
u=1,i

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Ledger (Crypto Exchange)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0

2 Cookies

Domain/Path Name / Value
.ledger.com/ Name: __cf_bm
Value: 5RMi4BqEwi71HPysvT0AEvHQrU9K3nB.joTPp07xwIM-1730351993-1.0.1.1-UyvTCke6i_0spBwKI8Q0MBCqI5xNS.x3bvknFOajHav1BGDscjRxLFLlLtUZ4x87HEWvFVuLH_kVvsiMKcXqig
.ledger-clearsigning-activation.com/ Name: cf_clearance
Value: lGm1Bbl9iTjoPQiUr_VTxHgsqe0bSeGL4s3n.2vrmSg-1730351994-1.2.1.1-zwch7VEvfwK4UGIcAliHp1Kot14O4XW9aTgJ5cxaUX_o_.E2zffzmv1T.OBNB90MODYRyaxGtXiI0xK8JxH6lLURg.QsItwy2xUHW908MiQgLckYH1GngPBa6BVujtAxaLnyAwlpmG686b4eC3D9DKuNU2C.guf_batM3qNP2Jabd2CWt9soqTQi05WhCiGmv3abgzjDDhbnFn_kNXA8r9nkpunNVoAqQPadPh6hsEGCEBZ.Wbw1QZ3twFRqMV9UWGNWbxVrj.qDpviD31Bo3qqoZtj..KHopZaHcVfJTvTNyKi.xUuENObaT_ly6OitXo5k6juRCIIkpAiCxzwiRLwUl6UwDI6cAr2zrxKeIkaQd0rM5etbvz5WFOss.ciu