pub-50f95bc85aff43489e93e804618a35f0.r2.dev Open in urlscan Pro
172.66.0.235  Malicious Activity! Public Scan

Submitted URL: https://oldcardboard.com/pins/pd3/pd3.asp?url=https://pioneerhbrau.convosco.de/en
Effective URL: https://pub-50f95bc85aff43489e93e804618a35f0.r2.dev/index.html
Submission: On December 17 via manual from US — Scanned from IL

Summary

This website contacted 6 IPs in 3 countries across 7 domains to perform 8 HTTP transactions. The main IP is 172.66.0.235, located in United States and belongs to CLOUDFLARENET, US. The main domain is pub-50f95bc85aff43489e93e804618a35f0.r2.dev.
TLS certificate: Issued by E5 on November 27th 2024. Valid for: 3 months.
This is the only time pub-50f95bc85aff43489e93e804618a35f0.r2.dev was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Email (Online)

Domain & IP information

IP Address AS Autonomous System
1 1 192.124.249.20 30148 (SUCURI-SEC)
1 3 89.163.142.48 24961 (MYLOC-AS ...)
1 172.66.0.235 13335 (CLOUDFLAR...)
1 172.217.23.106 15169 (GOOGLE)
2 151.101.130.137 54113 (FASTLY)
1 34.117.59.81 396982 (GOOGLE-CL...)
1 2 104.17.11.85 13335 (CLOUDFLAR...)
8 6
Apex Domain
Subdomains
Transfer
3 convosco.de
pioneerhbrau.convosco.de
5 KB
2 blockchain.com
login.blockchain.com — Cisco Umbrella Rank: 657854
4 KB
2 jquery.com
code.jquery.com — Cisco Umbrella Rank: 847
108 KB
1 ipinfo.io
ipinfo.io — Cisco Umbrella Rank: 7599
358 B
1 googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 415
30 KB
1 r2.dev
pub-50f95bc85aff43489e93e804618a35f0.r2.dev
132 KB
1 oldcardboard.com
oldcardboard.com
506 B
8 7
Domain Requested by
3 pioneerhbrau.convosco.de 1 redirects
2 login.blockchain.com 1 redirects
2 code.jquery.com pub-50f95bc85aff43489e93e804618a35f0.r2.dev
1 ipinfo.io pub-50f95bc85aff43489e93e804618a35f0.r2.dev
1 ajax.googleapis.com pub-50f95bc85aff43489e93e804618a35f0.r2.dev
1 pub-50f95bc85aff43489e93e804618a35f0.r2.dev pioneerhbrau.convosco.de
1 oldcardboard.com 1 redirects
8 7

This site contains no links.

Subject Issuer Validity Valid
pioneerhbrau.convosco.de
R10
2024-11-17 -
2025-02-15
3 months crt.sh
*.r2.dev
E5
2024-11-27 -
2025-02-25
3 months crt.sh
upload.video.google.com
WR2
2024-11-04 -
2025-01-27
3 months crt.sh
*.jquery.com
Sectigo ECC Domain Validation Secure Server CA
2024-06-25 -
2025-06-25
a year crt.sh
ipinfo.io
R11
2024-11-15 -
2025-02-13
3 months crt.sh

This page contains 1 frames:

Primary Page: https://pub-50f95bc85aff43489e93e804618a35f0.r2.dev/index.html
Frame ID: F71B12E2BD2944A637069F3BB1599E9C
Requests: 8 HTTP requests in this frame

Screenshot

Page Title

Wallet | Recovery

Page URL History Show full URLs

  1. https://oldcardboard.com/pins/pd3/pd3.asp?url=https://pioneerhbrau.convosco.de/en HTTP 302
    https://pioneerhbrau.convosco.de/en HTTP 301
    https://pioneerhbrau.convosco.de/en/ Page URL
  2. https://pub-50f95bc85aff43489e93e804618a35f0.r2.dev/index.html Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

8
Requests

88 %
HTTPS

0 %
IPv6

7
Domains

7
Subdomains

6
IPs

3
Countries

279 kB
Transfer

592 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://oldcardboard.com/pins/pd3/pd3.asp?url=https://pioneerhbrau.convosco.de/en HTTP 302
    https://pioneerhbrau.convosco.de/en HTTP 301
    https://pioneerhbrau.convosco.de/en/ Page URL
  2. https://pub-50f95bc85aff43489e93e804618a35f0.r2.dev/index.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://oldcardboard.com/pins/pd3/pd3.asp?url=https://pioneerhbrau.convosco.de/en HTTP 302
  • https://pioneerhbrau.convosco.de/en HTTP 301
  • https://pioneerhbrau.convosco.de/en/
Request Chain 6
  • https://login.blockchain.com//beta/favicon.ico HTTP 308
  • https://login.blockchain.com/beta/favicon.ico

8 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
/
pioneerhbrau.convosco.de/en/
Redirect Chain
  • https://oldcardboard.com/pins/pd3/pd3.asp?url=https://pioneerhbrau.convosco.de/en
  • https://pioneerhbrau.convosco.de/en
  • https://pioneerhbrau.convosco.de/en/
362 B
488 B
Document
General
Full URL
https://pioneerhbrau.convosco.de/en/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
89.163.142.48 , Germany, ASN24961 (MYLOC-AS WIIT AG, DE),
Reverse DNS
plesk.convosco.de
Software
nginx / PleskLin
Resource Hash
1a80f19ab7eddf373ea4f915ff297091f1a739f245f26cc6b1f19115ab55d158

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

accept-ranges
bytes
content-encoding
gzip
content-length
280
content-type
text/html
date
Tue, 17 Dec 2024 00:15:28 GMT
etag
"16a-62928d6b6d180-gzip"
last-modified
Fri, 13 Dec 2024 15:53:58 GMT
server
nginx
vary
Accept-Encoding
x-accel-version
0.01
x-powered-by
PleskLin

Redirect headers

content-length
319
content-type
text/html; charset=iso-8859-1
date
Tue, 17 Dec 2024 00:15:28 GMT
location
https://pioneerhbrau.convosco.de/en/
server
nginx
x-powered-by
PleskLin
favicon.ico
pioneerhbrau.convosco.de/
11 KB
4 KB
Other
General
Full URL
https://pioneerhbrau.convosco.de/favicon.ico
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
89.163.142.48 , Germany, ASN24961 (MYLOC-AS WIIT AG, DE),
Reverse DNS
plesk.convosco.de
Software
nginx / PleskLin
Resource Hash
4ef9bf2647c6d37a878dcee3f9780056e06cf0fe458fdfa67bb752316cc6523d

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://pioneerhbrau.convosco.de/en/

Response headers

x-powered-by
PleskLin
content-encoding
gzip
etag
"2cb0-0-gzip"
accept-ranges
bytes
content-length
3890
date
Tue, 17 Dec 2024 00:15:29 GMT
content-type
text/html
last-modified
Thu, 01 Jan 1970 00:00:00 GMT
server
nginx
vary
Accept-Encoding
Primary Request index.html
pub-50f95bc85aff43489e93e804618a35f0.r2.dev/
132 KB
132 KB
Document
General
Full URL
https://pub-50f95bc85aff43489e93e804618a35f0.r2.dev/index.html
Requested by
Host: pioneerhbrau.convosco.de
URL: https://pioneerhbrau.convosco.de/en/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
172.66.0.235 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
62a1c4166a35a5252d3d03c0155e5bd90f1642c2c819e83b2e0ea2890f05a516

Request headers

Referer
https://pioneerhbrau.convosco.de/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

Accept-Ranges
bytes
CF-RAY
8f32b8152a927da1-TLV
Connection
keep-alive
Content-Length
135219
Content-Type
text/html
Date
Tue, 17 Dec 2024 00:15:30 GMT
ETag
"eaeea0cef11445a222f1b4c04bda52fc"
Last-Modified
Mon, 16 Dec 2024 15:32:56 GMT
Server
cloudflare
Vary
Accept-Encoding
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/2.2.4/
84 KB
30 KB
Script
General
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js
Requested by
Host: pub-50f95bc85aff43489e93e804618a35f0.r2.dev
URL: https://pub-50f95bc85aff43489e93e804618a35f0.r2.dev/index.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.23.106 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
mil04s23-in-f106.1e100.net
Software
sffe /
Resource Hash
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"
Referer
https://pub-50f95bc85aff43489e93e804618a35f0.r2.dev/

Response headers

content-encoding
gzip
age
572799
report-to
{"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
x-content-type-options
nosniff
expires
Wed, 10 Dec 2025 09:08:52 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Tue, 10 Dec 2024 09:08:52 GMT
last-modified
Tue, 03 Mar 2020 19:15:00 GMT
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="hosted-libraries-pushers"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
accept-ranges
bytes
access-control-allow-origin
*
content-length
30028
x-xss-protection
0
server
sffe
jquery-3.1.1.min.js
code.jquery.com/
85 KB
30 KB
Script
General
Full URL
https://code.jquery.com/jquery-3.1.1.min.js
Requested by
Host: pub-50f95bc85aff43489e93e804618a35f0.r2.dev
URL: https://pub-50f95bc85aff43489e93e804618a35f0.r2.dev/index.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.130.137 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"
Referer
https://pub-50f95bc85aff43489e93e804618a35f0.r2.dev/

Response headers

content-encoding
gzip
etag
W/"28feccc0-152b5"
age
2914383
x-cache
HIT, HIT
date
Tue, 17 Dec 2024 00:15:31 GMT
content-type
application/javascript; charset=utf-8
vary
Accept-Encoding
x-cache-hits
93, 13504
last-modified
Fri, 18 Oct 1991 12:00:00 GMT
x-served-by
cache-lga21947-LGA, cache-fra-eddf8230164-FRA
cache-control
public, max-age=31536000, stale-while-revalidate=604800
x-timer
S1734394531.284768,VS0,VE0
via
1.1 varnish, 1.1 varnish
accept-ranges
bytes
access-control-allow-origin
*
content-length
30070
server
nginx
jquery-3.3.1.js
code.jquery.com/
265 KB
79 KB
Script
General
Full URL
https://code.jquery.com/jquery-3.3.1.js
Requested by
Host: pub-50f95bc85aff43489e93e804618a35f0.r2.dev
URL: https://pub-50f95bc85aff43489e93e804618a35f0.r2.dev/index.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.130.137 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
d8aa24ecc6cecb1a60515bc093f1c9da38a0392612d9ab8ae0f7f36e6eee1fad

Request headers

Origin
https://pub-50f95bc85aff43489e93e804618a35f0.r2.dev
Referer
https://pub-50f95bc85aff43489e93e804618a35f0.r2.dev/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

content-encoding
gzip
etag
W/"28feccc0-42587"
age
4730492
x-cache
HIT, HIT
date
Tue, 17 Dec 2024 00:15:31 GMT
content-type
application/javascript; charset=utf-8
vary
Accept-Encoding
x-cache-hits
10089, 4619
last-modified
Fri, 18 Oct 1991 12:00:00 GMT
x-served-by
cache-lga21980-LGA, cache-fra-eddf8230091-FRA
cache-control
public, max-age=31536000, stale-while-revalidate=604800
x-timer
S1734394531.284721,VS0,VE0
via
1.1 varnish, 1.1 varnish
accept-ranges
bytes
access-control-allow-origin
*
content-length
80268
server
nginx
json
ipinfo.io/
233 B
358 B
Fetch
General
Full URL
https://ipinfo.io/json
Requested by
Host: pub-50f95bc85aff43489e93e804618a35f0.r2.dev
URL: https://pub-50f95bc85aff43489e93e804618a35f0.r2.dev/index.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.117.59.81 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
81.59.117.34.bc.googleusercontent.com
Software
/
Resource Hash
51674ddd53701581ffc1c5ca0322f2217e2c54b5c5897a8a557ca7fc06f7f68a
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://pub-50f95bc85aff43489e93e804618a35f0.r2.dev/

Response headers

strict-transport-security
max-age=2592000; includeSubDomains
content-encoding
br
x-content-type-options
nosniff
via
1.1 google
access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
158
date
Tue, 17 Dec 2024 00:15:31 GMT
content-type
application/json; charset=utf-8
vary
Accept-Encoding
favicon.ico
login.blockchain.com/beta/
Redirect Chain
  • https://login.blockchain.com//beta/favicon.ico
  • https://login.blockchain.com/beta/favicon.ico
15 KB
3 KB
Other
General
Full URL
https://login.blockchain.com/beta/favicon.ico
Protocol
H2
Server
104.17.11.85 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6e9e4aefec755103010def1151655624c2d184861243090df4c426e8b7e69158
Security Headers
Name Value
Content-Security-Policy default-src 'none'; manifest-src 'self'; script-src 'self' 'nonce-kewfCa7N+nMiEAcOJNY+2g==' https://www.google.com https://www.gstatic.com https://pay.google.com https://api.sardine.ai 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: *; connect-src 'self' https://api.blockchain.info https://blockchain.info https://*.googleapis.com https://www.google.com https://google.com https://pay.google.com https://blockchain.info https://api.blockchain.com wss://ws.blockchain.info/coins wss://ws.blockchain.info/wallet-pubkey https://rum.browser-intake-datadoghq.eu ws://localhost:8080; font-src 'self'; frame-src 'self' https://www.google.com https://pay.google.com https://wallet-helper.blockchain.com https://magic.veriff.me; frame-ancestors 'none'; object-src 'none'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://pub-50f95bc85aff43489e93e804618a35f0.r2.dev/

Response headers

x-request-id
6a0899656f2f5d55f6115503e73706ff
content-encoding
br
cf-cache-status
MISS
x-blockchain-cp-f
3rll 0.009 - 6a0899656f2f5d55f6115503e73706ff
x-content-type-options
nosniff
x-blockchain-language-id
0:0:0 (en:en:en)
x-blockchain-cp-b
wallet-frontend-v5
date
Tue, 17 Dec 2024 00:15:32 GMT
content-type
image/x-icon
vary
Cookie, Accept-Encoding
last-modified
Tue, 17 Dec 2024 00:15:32 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-security-policy
default-src 'none'; manifest-src 'self'; script-src 'self' 'nonce-kewfCa7N+nMiEAcOJNY+2g==' https://www.google.com https://www.gstatic.com https://pay.google.com https://api.sardine.ai 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: *; connect-src 'self' https://api.blockchain.info https://blockchain.info https://*.googleapis.com https://www.google.com https://google.com https://pay.google.com https://blockchain.info https://api.blockchain.com wss://ws.blockchain.info/coins wss://ws.blockchain.info/wallet-pubkey https://rum.browser-intake-datadoghq.eu ws://localhost:8080; font-src 'self'; frame-src 'self' https://www.google.com https://pay.google.com https://wallet-helper.blockchain.com https://magic.veriff.me; frame-ancestors 'none'; object-src 'none'
cache-control
public, max-age=300, must-revalidate
x-original-host
login.blockchain.com
x-blockchain-language
en
cf-ray
8f32b821cb3ac227-TLV
x-blockchain-server
BlockchainFE/1.0
x-xss-protection
1; mode=block
server
cloudflare

Redirect headers

x-request-id
b08d21e1b79f0150dd7068be7be56eb8
cf-cache-status
EXPIRED
x-blockchain-cp-f
3rll 0.005 - b08d21e1b79f0150dd7068be7be56eb8
x-content-type-options
nosniff
x-blockchain-language-id
0:0:0 (en:en:en)
x-blockchain-cp-b
wallet-frontend-v5
date
Tue, 17 Dec 2024 00:15:32 GMT
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
location
/beta/favicon.ico
x-original-host
login.blockchain.com
x-blockchain-language
en
cf-ray
8f32b8208a77c227-TLV
refresh
0;url=/beta/favicon.ico
x-blockchain-server
BlockchainFE/1.0
x-xss-protection
1; mode=block
server
cloudflare

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Email (Online)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| _0x1af9 function| _0x431a function| _0x3e4648 function| $ function| jQuery object| phrase_value

2 Cookies

Domain/Path Name / Value
oldcardboard.com/ Name: ASPSESSIONIDAWQDTTCC
Value: HKIEDLDAEPKKHKMGAPDFMKIE
.blockchain.com/ Name: _cfuvid
Value: b1i4mxqX_XvUpY_dX9ZdYWWDhEFmJxt8_OTWfBawkkk-1734394532045-0.0.1.1-604800000

4 Console Messages

Source Level URL
Text
javascript warning URL: https://pub-50f95bc85aff43489e93e804618a35f0.r2.dev/index.html(Line 1)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://pub-50f95bc85aff43489e93e804618a35f0.r2.dev/index.html(Line 1)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://pub-50f95bc85aff43489e93e804618a35f0.r2.dev/index.html(Line 1)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-3.1.1.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://pub-50f95bc85aff43489e93e804618a35f0.r2.dev/index.html(Line 1)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-3.3.1.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.