pub-987ffb585ccb40d8a3bf28b43d72382f.r2.dev Open in urlscan Pro
2606:4700::6812:223  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
4 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request cpanel.html Show response pub-987ffb585ccb40d8a3bf28b43d72382f.r2.dev/	265 B 574 B	132ms 94ms	Document text/html	2606:4700::6812:223 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://pub-987ffb585ccb40d8a3bf28b43d72382f.r2.dev/cpanel.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:223 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 59b9b90e841602da4607f991ca922a53a107a327e3d5b866ef2d32b4166a5fd0 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Accept-Ranges bytes CF-RAY 8637cc59fb6a377c-FRA Connection keep-alive Content-Length 265 Content-Type text/html Date Wed, 13 Mar 2024 00:09:58 GMT ETag "4bb00a464d5e9bf79ed247b8ff25cfb0" Last-Modified Thu, 01 Feb 2024 07:06:08 GMT Server cloudflare Vary Accept-Encoding
GET H2	200	/ Show response bafybeib6vx5dowe32lgfyglaxusvyp5di7gyefjkunbvrlmwplfxatf5mq.ipfs.w3s.link/	2 MB 272 KB	1067ms 1032ms	Script text/plain	2606:4700:4400::6812:29a9 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://bafybeib6vx5dowe32lgfyglaxusvyp5di7gyefjkunbvrlmwplfxatf5mq.ipfs.w3s.link/ Requested by Host: pub-987ffb585ccb40d8a3bf28b43d72382f.r2.dev URL: https://pub-987ffb585ccb40d8a3bf28b43d72382f.r2.dev/cpanel.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::6812:29a9 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 1a26cc80387362efb1c46ed7f64d947a79da95e997dae2a5474926d52ef45193 Security Headers Name Value Content-Security-Policy default-src 'self' 'unsafe-inline' 'unsafe-eval' blob: data: https://*.w3s.link https://*.nftstorage.link https://*.dweb.link https://ipfs.io/ipfs/ https://*.githubusercontent.com https://tableland.network https://*.tableland.network ; form-action 'self'; navigate-to 'self'; connect-src 'self' blob: data: https://*.w3s.link https://*.nftstorage.link https://*.dweb.link https://ipfs.io/ipfs/ https://*.githubusercontent.com https://tableland.network https://*.tableland.network ; report-to csp-endpoint ; report-uri https://csp-report-to.web3.storage Request headers accept-language de-DE,de;q=0.9 Referer https://pub-987ffb585ccb40d8a3bf28b43d72382f.r2.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36 Response headers date Wed, 13 Mar 2024 00:09:59 GMT content-security-policy default-src 'self' 'unsafe-inline' 'unsafe-eval' blob: data: https://*.w3s.link https://*.nftstorage.link https://*.dweb.link https://ipfs.io/ipfs/ https://*.githubusercontent.com https://tableland.network https://*.tableland.network ; form-action 'self'; navigate-to 'self'; connect-src 'self' blob: data: https://*.w3s.link https://*.nftstorage.link https://*.dweb.link https://ipfs.io/ipfs/ https://*.githubusercontent.com https://tableland.network https://*.tableland.network ; report-to csp-endpoint ; report-uri https://csp-report-to.web3.storage content-encoding gzip x-dotstorage-resolution-id https://freeway.dag.haus server-timing request;dur=1014 reporting-endpoints csp-endpoint="https://csp-report-to.web3.storage" server cloudflare etag W/"bafybeib6vx5dowe32lgfyglaxusvyp5di7gyefjkunbvrlmwplfxatf5mq" x-dotstorage-anchor 22acc47a11ad80c070281dba5fb5788b7c59cb1e242202fcd9b30d288a2a4012 vary Accept-Encoding access-control-allow-methods GET content-type text/plain; charset=ASCII access-control-allow-origin * x-freeway-version 2.15.0 access-control-expose-headers Link cache-control public, max-age=29030400, immutable x-dotstorage-resolution-layer dotstorage-race cf-ray 8637cc5acde79bdc-FRA
GET H2	200	/ Show response bafkreieutmqcb33imtlzyiq7az6dhgcko6euaut4c75mqdih2dqyw2kb6a.ipfs.w3s.link/	92 KB 35 KB	464ms 438ms	Script text/plain	2606:4700:4400::ac40:9257 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://bafkreieutmqcb33imtlzyiq7az6dhgcko6euaut4c75mqdih2dqyw2kb6a.ipfs.w3s.link/ Requested by Host: pub-987ffb585ccb40d8a3bf28b43d72382f.r2.dev URL: https://pub-987ffb585ccb40d8a3bf28b43d72382f.r2.dev/cpanel.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:4400::ac40:9257 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 949b2020ef6864d79c221f067c33984a778940527c17fac80d07d0e18b6941f0 Security Headers Name Value Content-Security-Policy default-src 'self' 'unsafe-inline' 'unsafe-eval' blob: data: https://*.w3s.link https://*.nftstorage.link https://*.dweb.link https://ipfs.io/ipfs/ https://*.githubusercontent.com https://tableland.network https://*.tableland.network ; form-action 'self'; navigate-to 'self'; connect-src 'self' blob: data: https://*.w3s.link https://*.nftstorage.link https://*.dweb.link https://ipfs.io/ipfs/ https://*.githubusercontent.com https://tableland.network https://*.tableland.network ; report-to csp-endpoint ; report-uri https://csp-report-to.web3.storage Request headers accept-language de-DE,de;q=0.9 Referer https://pub-987ffb585ccb40d8a3bf28b43d72382f.r2.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36 Response headers date Wed, 13 Mar 2024 00:09:58 GMT content-security-policy default-src 'self' 'unsafe-inline' 'unsafe-eval' blob: data: https://*.w3s.link https://*.nftstorage.link https://*.dweb.link https://ipfs.io/ipfs/ https://*.githubusercontent.com https://tableland.network https://*.tableland.network ; form-action 'self'; navigate-to 'self'; connect-src 'self' blob: data: https://*.w3s.link https://*.nftstorage.link https://*.dweb.link https://ipfs.io/ipfs/ https://*.githubusercontent.com https://tableland.network https://*.tableland.network ; report-to csp-endpoint ; report-uri https://csp-report-to.web3.storage content-encoding gzip x-dotstorage-resolution-id https://freeway.dag.haus server-timing request;dur=421 reporting-endpoints csp-endpoint="https://csp-report-to.web3.storage" server cloudflare etag W/"bafkreieutmqcb33imtlzyiq7az6dhgcko6euaut4c75mqdih2dqyw2kb6a" x-dotstorage-anchor 134b7a6d74b6d9502758d7439a53cbd8d74582bf05ecdee0ad4e1bcceedb0a96 vary Accept-Encoding access-control-allow-methods GET content-type text/plain; charset=ASCII access-control-allow-origin * x-freeway-version 2.15.0 access-control-expose-headers Link cache-control public, max-age=29030400, immutable x-dotstorage-resolution-layer dotstorage-race cf-ray 8637cc5abcf11db0-FRA
GET H2	200	css2 fonts.googleapis.com/	23 KB 2 KB	36ms 15ms	Stylesheet text/css	2a00:1450:4001:827::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css2?family=Open+Sans:wght@400;500;600;700&display=swap Requested by Host: bafybeib6vx5dowe32lgfyglaxusvyp5di7gyefjkunbvrlmwplfxatf5mq.ipfs.w3s.link URL: https://bafybeib6vx5dowe32lgfyglaxusvyp5di7gyefjkunbvrlmwplfxatf5mq.ipfs.w3s.link/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:827::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 2af467e5c74d9700a4f33f351d77f5d9a20abf58203d5dfdc5209095d8acf768 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://pub-987ffb585ccb40d8a3bf28b43d72382f.r2.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36 Response headers strict-transport-security max-age=31536000 date Wed, 13 Mar 2024 00:09:59 GMT content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 x-xss-protection 0 last-modified Tue, 12 Mar 2024 23:21:57 GMT server ESF cross-origin-opener-policy same-origin-allow-popups x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Wed, 13 Mar 2024 00:09:59 GMT
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/3.5.1/	87 KB 88 KB	34ms 9ms	Script text/javascript	2a00:1450:4001:82b::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js Requested by Host: bafybeib6vx5dowe32lgfyglaxusvyp5di7gyefjkunbvrlmwplfxatf5mq.ipfs.w3s.link URL: https://bafybeib6vx5dowe32lgfyglaxusvyp5di7gyefjkunbvrlmwplfxatf5mq.ipfs.w3s.link/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://pub-987ffb585ccb40d8a3bf28b43d72382f.r2.dev/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Tue, 12 Mar 2024 02:14:31 GMT x-content-type-options nosniff age 78928 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 89476 x-xss-protection 0 last-modified Fri, 08 May 2020 07:05:03 GMT server sffe cross-origin-opener-policy same-origin; report-to="hosted-libraries-pushers" vary Accept-Encoding report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Wed, 12 Mar 2025 02:14:31 GMT
GET DATA	200 OK	truncated /	37 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash e8f7e8e8672e4713a862483e86dd0eefbc326e2bc374e9fa21167cca50e07499 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	320 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 05ce0f813e6236158fa1d115faba62cd2041aab1878cac0960a0f45575cece1e Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36 Response headers Content-Type image/png
GET H2	200	memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2 fonts.gstatic.com/s/opensans/v40/	47 KB 48 KB	27ms 7ms	Font font/woff2	2a00:1450:4001:80b::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css2?family=Open+Sans:wght@400;500;600;700&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://pub-987ffb585ccb40d8a3bf28b43d72382f.r2.dev accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36 Response headers date Tue, 12 Mar 2024 00:50:53 GMT x-content-type-options nosniff age 83946 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 48236 x-xss-protection 0 last-modified Thu, 14 Dec 2023 02:08:40 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Wed, 12 Mar 2025 00:50:53 GMT
GET DATA	200 OK	truncated /	450 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash a02998df88a6efb0baa526796b2b682ce9fdd6471ceb19170b326320f22f7053 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	2 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 70667a94ef79118b93b13b1cb41fcb11b09e8fd3ce0c9c82680ed5f991ba9a32 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36 Response headers Content-Type image/svg+xml
GET H2	200	memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTUGmu1aB.woff2 fonts.gstatic.com/s/opensans/v40/	24 KB 25 KB	7ms 6ms	Font font/woff2	2a00:1450:4001:80b::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTUGmu1aB.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css2?family=Open+Sans:wght@400;500;600;700&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 7e510e61c497d334da21eccda06df5d3a428c9ea94d6903b6138e7c7255aba0f Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://pub-987ffb585ccb40d8a3bf28b43d72382f.r2.dev accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36 Response headers date Mon, 11 Mar 2024 19:17:02 GMT x-content-type-options nosniff age 103977 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 24984 x-xss-protection 0 last-modified Thu, 14 Dec 2023 02:04:54 GMT server sffe cross-origin-opener-policy same-origin; report-to="apps-themes" report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Tue, 11 Mar 2025 19:17:02 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Email (Online)

15 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| _0x5056 function| _0x1cde function| _0x3a61bd function| $ function| jQuery function| _0x179a97 function| _0x2e36 function| _0x39e283 function| _0x13873a function| _0x1b4fa9 function| _0x20c1 function| _0x1c5474 function| showEl function| hideEl function| _0x5f0267

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	URL: https://bafybeib6vx5dowe32lgfyglaxusvyp5di7gyefjkunbvrlmwplfxatf5mq.ipfs.w3s.link/ Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://bafybeib6vx5dowe32lgfyglaxusvyp5di7gyefjkunbvrlmwplfxatf5mq.ipfs.w3s.link/ Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
bafkreieutmqcb33imtlzyiq7az6dhgcko6euaut4c75mqdih2dqyw2kb6a.ipfs.w3s.link
bafybeib6vx5dowe32lgfyglaxusvyp5di7gyefjkunbvrlmwplfxatf5mq.ipfs.w3s.link
fonts.googleapis.com
fonts.gstatic.com
pub-987ffb585ccb40d8a3bf28b43d72382f.r2.dev
2606:4700:4400::6812:29a9
2606:4700:4400::ac40:9257
2606:4700::6812:223
2a00:1450:4001:80b::2003
2a00:1450:4001:827::200a
2a00:1450:4001:82b::200a
05ce0f813e6236158fa1d115faba62cd2041aab1878cac0960a0f45575cece1e
1a26cc80387362efb1c46ed7f64d947a79da95e997dae2a5474926d52ef45193
2af467e5c74d9700a4f33f351d77f5d9a20abf58203d5dfdc5209095d8acf768
3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa
59b9b90e841602da4607f991ca922a53a107a327e3d5b866ef2d32b4166a5fd0
70667a94ef79118b93b13b1cb41fcb11b09e8fd3ce0c9c82680ed5f991ba9a32
7e510e61c497d334da21eccda06df5d3a428c9ea94d6903b6138e7c7255aba0f
949b2020ef6864d79c221f067c33984a778940527c17fac80d07d0e18b6941f0
a02998df88a6efb0baa526796b2b682ce9fdd6471ceb19170b326320f22f7053
e8f7e8e8672e4713a862483e86dd0eefbc326e2bc374e9fa21167cca50e07499
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d