urlscan.io logo urlscan.io
SecurityTrails logo

www.ledger-clearsigning.co Open in urlscan Pro
172.67.158.158  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://minahsatay.com/
Effective URL: https://www.ledger-clearsigning.co/activation/
Submission: On October 31 via manual from US — Scanned from SG
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 2 countries across 4 domains to perform 6 HTTP transactions. The main IP is 172.67.158.158, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.ledger-clearsigning.co.
TLS certificate: Issued by WE1 on October 22nd 2024. Valid for: 3 months.
This is the only time www.ledger-clearsigning.co was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Ledger (Crypto Exchange)

Domain & IP information

IP Address AS Autonomous System
1 1 51.79.230.147 16276 (OVH)
1 1 172.67.184.124 13335 (CLOUDFLAR...)
2 7 172.67.158.158 13335 (CLOUDFLAR...)
1 2 172.64.153.104 13335 (CLOUDFLAR...)
6 3
Apex Domain
Subdomains		 Transfer
7 ledger-clearsigning.co
www.ledger-clearsigning.co
899 KB
2 ledger.com
www.ledger.com — Cisco Umbrella Rank: 62127
ledger-wp-website-s3-prd.ledger.com
7 KB
1 come-back-mylove.com
come-back-mylove.com
679 B
1 minahsatay.com
minahsatay.com
986 B
6 4
Domain Requested by
7 www.ledger-clearsigning.co 2 redirects www.ledger-clearsigning.co
1 ledger-wp-website-s3-prd.ledger.com www.ledger-clearsigning.co
1 www.ledger.com 1 redirects
1 come-back-mylove.com 1 redirects
1 minahsatay.com 1 redirects
6 5

This site contains links to these domains. Also see Links.

Domain
developers.ledger.com
www.ledger.com
shop.ledger.com
Subject Issuer Validity Valid
ledger-clearsigning.co
WE1		 2024-10-22 -
2025-01-20		 3 months crt.sh

This page contains 2 frames:

Primary Page: https://www.ledger-clearsigning.co/activation/
Frame ID: FD91E122FA8EF32BE3FC4A690E9DDA98
Requests: 5 HTTP requests in this frame

Frame: https://www.ledger-clearsigning.co/cdn-cgi/challenge-platform/h/b/scripts/jsd/22755d9a86c9/main.js
Frame ID: 633F21EDD040F9EE0F9DD886415677FC
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://minahsatay.com/ HTTP 302
    https://come-back-mylove.com/ HTTP 302
    https://www.ledger-clearsigning.co/ HTTP 302
    https://www.ledger-clearsigning.co/activation/ Page URL

Page Statistics

6
Requests

67 %
HTTPS

0 %
IPv6

4
Domains

5
Subdomains

3
IPs

2
Countries

904 kB
Transfer

1179 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://minahsatay.com/ HTTP 302
    https://come-back-mylove.com/ HTTP 302
    https://www.ledger-clearsigning.co/ HTTP 302
    https://www.ledger-clearsigning.co/activation/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1
  • https://www.ledger.com/wp-content/uploads/2023/03/Recover-X-coincover.png HTTP 301
  • https://ledger-wp-website-s3-prd.ledger.com/uploads/2023/03/Recover-X-coincover.png
Request Chain 4
  • https://www.ledger-clearsigning.co/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
  • https://www.ledger-clearsigning.co/cdn-cgi/challenge-platform/h/b/scripts/jsd/22755d9a86c9/main.js

6 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
www.ledger-clearsigning.co/activation/
Redirect Chain
  • https://minahsatay.com/
  • https://come-back-mylove.com/
  • https://www.ledger-clearsigning.co/
  • https://www.ledger-clearsigning.co/activation/
21 KB
7 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.ledger-clearsigning.co/activation/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.158.158 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PleskLin
Resource Hash
6b04b9fa9e68bcb72ba209d9845dca8d3dbf84b1de5174201ffc969c3d50f9ab

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
8db084836c5340d2-SIN
content-encoding
br
content-type
text/html
date
Thu, 31 Oct 2024 03:21:54 GMT
last-modified
Mon, 14 Oct 2024 16:27:08 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
priority
u=0,i
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1e8TIsTYs8YL9u2fWIzmeC3uGEuuqnBYvnFiiiQ4rre4PffIs0XZYpxwkurbe7ZN8jLqN8WSphhLlDVBl8XLZbSGSQW8uT588Ft5dZVQTOsbKpl3HyI0%2BpZFnnQQT%2B30lo2SextQqJSzkmqggw%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
server-timing
cfL4;desc="?proto=QUIC&rtt=1909&sent=15&recv=13&lost=0&retrans=0&sent_bytes=5027&recv_bytes=6199&delivery_rate=111616&cwnd=12000&unsent_bytes=0&cid=9b126a8296313b18&ts=864&x=1" cfExtPri cfHdrFlush;dur=0
vary
accept-encoding
x-powered-by
PleskLin

Redirect headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
8db0847f781f40d2-SIN
content-type
text/html; charset=UTF-8
date
Thu, 31 Oct 2024 03:21:54 GMT
location
https://www.ledger-clearsigning.co/activation/
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
priority
u=0,i
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uFfHcLPBksF95D%2BG7OS8XfeH35mVEDOevoQT2tpClGFJ4iLgBkHPO82MqrcumEvWqX6NVe5l9sIQFwaxZ6V4J%2BclS0BR%2BRPoKKg8JyTljcmlGrIyL3Os2q5jBu41DhaV9etxWz%2FqMGGejhMI8w%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
server-timing
cfL4;desc="?proto=QUIC&rtt=1882&sent=13&recv=12&lost=0&retrans=0&sent_bytes=4259&recv_bytes=5794&delivery_rate=1036&cwnd=12000&unsent_bytes=0&cid=9b126a8296313b18&ts=640&x=1" cfExtPri cfHdrFlush;dur=0
x-powered-by
PHP/8.3.13 PleskLin
all.css
www.ledger-clearsigning.co/activation/assets/ 		515 KB
258 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.ledger-clearsigning.co/activation/assets/all.css
Requested by
Host: www.ledger-clearsigning.co
URL: https://www.ledger-clearsigning.co/activation/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.158.158 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PleskLin
Resource Hash
f85b1788c5491b8106eb14d98d71cde93d2583d3f04a709bdcb810d23f9d36c3

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://www.ledger-clearsigning.co/activation/

Response headers

content-encoding
br
cf-cache-status
HIT
etag
W/"65dc65fe-80c7a"
age
4279
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GB4VqN1gJEGmMkRrtuPoxSc20xtzXGXRTBykWf%2FdQfSpn%2FR7sWjElq6h5gtT%2F%2B7O4JVtznf%2BjTpWj065l7WmxMaK3%2BIxQNslcMsG8E1pDksElw%2BiFRmPEYatndgJfyf6S9suSmrGI425AsOL5w%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=1968&sent=23&recv=19&lost=0&retrans=0&sent_bytes=12443&recv_bytes=7051&delivery_rate=33773&cwnd=12000&unsent_bytes=0&cid=9b126a8296313b18&ts=928&x=1", cfExtPri, cfHdrFlush;dur=0
date
Thu, 31 Oct 2024 03:21:54 GMT
content-type
text/css
last-modified
Mon, 26 Feb 2024 10:20:46 GMT
vary
Accept-Encoding
priority
u=0,i=?0
cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
8db084850e0540d2-SIN
x-powered-by
PleskLin
server
cloudflare
Recover-X-coincover.png
ledger-wp-website-s3-prd.ledger.com/uploads/2023/03/
Redirect Chain
  • https://www.ledger.com/wp-content/uploads/2023/03/Recover-X-coincover.png
  • https://ledger-wp-website-s3-prd.ledger.com/uploads/2023/03/Recover-X-coincover.png
6 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ledger-wp-website-s3-prd.ledger.com/uploads/2023/03/Recover-X-coincover.png
Requested by
Host: www.ledger-clearsigning.co
URL: https://www.ledger-clearsigning.co/activation/
Protocol
H2
Server
172.64.153.104 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c3fa3bed7b6ad01f1e21e09e957b87a1b7b5558c5434aa7224e6800c8af14492

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

cf-bgj
imgq:100,h2pri
etag
"5eeea311b3bcfb87b05a632241a30e3e"
x-amz-version-id
_j_wEYUGgS49fUQ9Q9QMKfp4QaOV79If
cf-cache-status
HIT
age
10295
expires
Thu, 31 Oct 2024 07:21:54 GMT
cf-polished
origFmt=png, origSize=14352
date
Thu, 31 Oct 2024 03:21:54 GMT
content-type
image/webp
content-disposition
inline; filename="Recover-X-coincover.webp"
vary
Accept
last-modified
Mon, 04 Mar 2024 10:02:34 GMT
x-amz-id-2
Kaxa4647ne1DRW+fncrecWZH79b/XS2QIIqFMRZZz9WFCWopAMovoEEqhjoPimdmBq9yWCamJCY=
x-amz-replication-status
COMPLETED
cache-control
public, max-age=14400
x-amz-request-id
CXRS8Y2EG0ETQQ4P
cf-ray
8db084856c9a5ff2-SIN
accept-ranges
bytes
content-length
5778
server
cloudflare
x-amz-server-side-encryption
AES256

Redirect headers

access-control-max-age
1728000
cf-cache-status
HIT
age
10295
access-control-allow-methods
GET, PUT, POST, DELETE, PATCH, OPTIONS
expires
Thu, 31 Oct 2024 07:21:54 GMT
date
Thu, 31 Oct 2024 03:21:54 GMT
content-type
text/html
vary
Accept-Encoding
access-control-allow-headers
DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization
strict-transport-security
max-age=31536000; includeSubDomains
cache-control
public, max-age=14400
location
https://ledger-wp-website-s3-prd.ledger.com/uploads/2023/03/Recover-X-coincover.png
access-control-allow-credentials
true
cf-ray
8db084852c425ff2-SIN
access-control-allow-origin
*
server
cloudflare
rcv.png
www.ledger-clearsigning.co/activation/assets/ 		627 KB
628 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.ledger-clearsigning.co/activation/assets/rcv.png
Requested by
Host: www.ledger-clearsigning.co
URL: https://www.ledger-clearsigning.co/activation/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.158.158 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PleskLin
Resource Hash
3897ab7614a8854eec84bd75838fa6e257b4d59f8af84c911ab8cf174b39b19a

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

cf-cache-status
MISS
etag
"65dc6cbc-9caf1"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8YjqI6v3QeiXu0Z%2FGCvkeotB5dWc04f2%2FVZ4BiwBcd8H1sGroI6gfVNe0NAvRjLxyWsqYWK3pXvlkDSXBxGIJAht3Ktc%2Ffbf8yYFIaXZLqNxlPNRilLF2GgPA5%2BwKKsJt%2Bf4EPwAvm0%2BJ4p9SQ%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=2642&sent=263&recv=97&lost=0&retrans=0&sent_bytes=289098&recv_bytes=27419&delivery_rate=72719&cwnd=126000&unsent_bytes=0&cid=9b126a8296313b18&ts=2025&x=1", cfExtPri, cfHdrFlush;dur=0
date
Thu, 31 Oct 2024 03:21:55 GMT
content-type
image/png
last-modified
Mon, 26 Feb 2024 10:49:32 GMT
vary
Accept-Encoding
priority
u=2,i
cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
8db084850e0640d2-SIN
accept-ranges
bytes
content-length
641777
x-powered-by
PleskLin
server
cloudflare
truncated
/ 		2 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
24859811f0d8052e5979a146e00930a379b14745e480f40b20f1d9ccd79b99e0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/svg+xml
main.js
www.ledger-clearsigning.co/cdn-cgi/challenge-platform/h/b/scripts/jsd/22755d9a86c9/ Frame 633F
Redirect Chain
  • https://www.ledger-clearsigning.co/cdn-cgi/challenge-platform/scripts/jsd/main.js
  • https://www.ledger-clearsigning.co/cdn-cgi/challenge-platform/h/b/scripts/jsd/22755d9a86c9/main.js?
8 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.ledger-clearsigning.co/cdn-cgi/challenge-platform/h/b/scripts/jsd/22755d9a86c9/main.js?
Requested by
Host: www.ledger-clearsigning.co
URL: https://www.ledger-clearsigning.co/activation/
Protocol
H3
Server
172.67.158.158 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9f576ef93ec65d80a31057accf0a9a15daf929212af3bd3cb7473f3f2861ab5d
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

cache-control
max-age=14400, stale-if-error=10800, stale-while-revalidate=10800, public
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
br
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zTiDy1Pbp48w0C5KS14NbE0p6rGmwUK78X6pPzTgyUI0CAasJkqqJxgjiSJi4FA%2FB%2B8AnSA%2BU2HIkw3PkJVV8qqFUMk4kNH91orOE6yb5%2FvR2JGv4RACqgk2XEkI1VcBy8WWItD3wssTo8aLpg%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
cf-ray
8db08485df1840d2-SIN
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=2777&sent=253&recv=79&lost=0&retrans=0&sent_bytes=283267&recv_bytes=10175&delivery_rate=83756&cwnd=126000&unsent_bytes=0&cid=9b126a8296313b18&ts=1043&x=1", cfExtPri, cfHdrFlush;dur=0
date
Thu, 31 Oct 2024 03:21:54 GMT
content-type
application/javascript; charset=UTF-8
vary
Accept-Encoding
server
cloudflare
priority
u=3,i=?0

Redirect headers

cache-control
max-age=300, stale-if-error=10800, stale-while-revalidate=10800, public
location
/cdn-cgi/challenge-platform/h/b/scripts/jsd/22755d9a86c9/main.js?
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EOJ6UA27aS6RRlW9JjfvBeuHZdw3STR%2FneFPDPE9Y92pQL9HypJisMosNqB3OTIyyH26rSd4LiGbzCuRnTVzpXeY4HjQTJNsIiTg0B5KyBM8j5117Ubtk7k6duI07d6qvmHP1gby7PgBT0%2F5fw%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
8db08485cf0440d2-SIN
access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
content-length
0
server-timing
cfL4;desc="?proto=QUIC&rtt=2946&sent=251&recv=77&lost=0&retrans=0&sent_bytes=282524&recv_bytes=9840&delivery_rate=31889227&cwnd=126000&unsent_bytes=0&cid=9b126a8296313b18&ts=1030&x=1", cfExtPri, cfHdrFlush;dur=0
date
Thu, 31 Oct 2024 03:21:54 GMT
vary
Accept-Encoding
server
cloudflare
priority
u=3,i=?0
8db084836c5340d2
www.ledger-clearsigning.co/cdn-cgi/challenge-platform/h/b/jsd/r/ Frame 633F 		0
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.ledger-clearsigning.co/cdn-cgi/challenge-platform/h/b/jsd/r/8db084836c5340d2
Requested by
Host: www.ledger-clearsigning.co
URL: https://www.ledger-clearsigning.co/cdn-cgi/challenge-platform/scripts/jsd/main.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.158.158 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type
application/json
Referer

Response headers

nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EppgTxM3dIRA6Qbhj2Hh0VQIzxtQK48zyK6yyrOuMbnaucQMP9IKBAm6FlNgH%2FgFiByK6fO%2Fj6xqrHQo7W6rHfuvbQNZR5pHocePk%2BrtG7SJAPTWKMNAu3jYPmLnvnDtEwD%2BF%2BZpshb84ZvDCg%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
8db08486bfe040d2-SIN
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=2721&sent=261&recv=96&lost=0&retrans=0&sent_bytes=287872&recv_bytes=27374&delivery_rate=395051&cwnd=126000&unsent_bytes=0&cid=9b126a8296313b18&ts=1190&x=1", cfExtPri, cfHdrFlush;dur=0
content-length
0
date
Thu, 31 Oct 2024 03:21:55 GMT
content-type
text/plain; charset=UTF-8
server
cloudflare
priority
u=1,i

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Ledger (Crypto Exchange)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0

2 Cookies

Domain/Path Name / Value
.ledger.com/ Name: __cf_bm
Value: 52h5W6CTsZLgMQzvd7jKYTrKuSza8Ux.vKNyzimZYQc-1730344914-1.0.1.1-SicTxTHaZQWiAkVeyIhdS_cQ5rdw6yNmlV.uBGN6Pgeb7lRGhBTH1EgLRoGG61MPc02X0zbaTfw.m4y3ENV5uA
.ledger-clearsigning.co/ Name: cf_clearance
Value: bsJ8i_wBGfIiq6kblVIyhjTJqrdEOBaCCQm0pbqUXM4-1730344915-1.2.1.1-zVzgHwV_Tlc1KFAKe3lge_xoACkqiZ9d.Rf2NetKqvIWQS0bpI9XZCjmWJK6LGX5zHJeiLKdaOweUS15iEe_PhXvAOSWaHfWVH1N3GDLsq.F3n98U_D34Mr5MPyFZuXebmR_qJ3AOkeVpQ3baMLrC3DXS2nwz0_B.FuAlGUYdYnfE7RYrOYUfD.7wGyQBo2B4tU_3ZW9n6UnqYlY2NuTGrLRGkkvidxzNXlHxNozgsQeTD.i2s9HXNWHu8LhAuLmJwlEQRNqU06QaR2uGYXl9zOX7xN.7jN7Z1QFrEpt3GUv0NwEzJ0LOEVjkqcL0lHhw9U8UemNfSS2TqON0nDCucMoIQVuLTVno7UvOcVEisFZJwkPjYWNPBinMeXpc2LZ