pub-3cf0c63a6f4d40e89f096d50607c0759.r2.dev Open in urlscan Pro
162.159.140.237  Malicious Activity! Public Scan

Submitted URL: https://trimmer.to/xFzvO
Effective URL: https://pub-3cf0c63a6f4d40e89f096d50607c0759.r2.dev/includes.html
Submission: On December 16 via manual from US — Scanned from AT

Summary

This website contacted 5 IPs in 3 countries across 4 domains to perform 6 HTTP transactions. The main IP is 162.159.140.237, located in and belongs to CLOUDFLARENET, US. The main domain is pub-3cf0c63a6f4d40e89f096d50607c0759.r2.dev.
TLS certificate: Issued by E5 on November 27th 2024. Valid for: 3 months.
This is the only time pub-3cf0c63a6f4d40e89f096d50607c0759.r2.dev was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Community Verdicts: Malicious1 votes Show Verdicts

Domain & IP information

IP Address AS Autonomous System
1 1 172.67.199.75 13335 (CLOUDFLAR...)
1 185.185.85.130 58040 (hostlinco...)
1 162.159.140.237 13335 (CLOUDFLAR...)
1 151.101.2.137 54113 (FASTLY)
1 ()
6 5
Apex Domain
Subdomains
Transfer
2 r2.dev
pub-3cf0c63a6f4d40e89f096d50607c0759.r2.dev
90 KB
1 jquery.com
code.jquery.com — Cisco Umbrella Rank: 847
31 KB
1 jasonchewy.com
jasonchewy.com
206 B
1 trimmer.to
trimmer.to
838 B
6 4
Domain Requested by
2 pub-3cf0c63a6f4d40e89f096d50607c0759.r2.dev pub-3cf0c63a6f4d40e89f096d50607c0759.r2.dev
1 code.jquery.com pub-3cf0c63a6f4d40e89f096d50607c0759.r2.dev
1 jasonchewy.com
1 trimmer.to 1 redirects
6 4

This site contains no links.

Subject Issuer Validity Valid
*.burgundymanagement.com
R10
2024-11-13 -
2025-02-11
3 months crt.sh
*.r2.dev
E5
2024-11-27 -
2025-02-25
3 months crt.sh
*.jquery.com
Sectigo ECC Domain Validation Secure Server CA
2024-06-25 -
2025-06-25
a year crt.sh

This page contains 1 frames:

Primary Page: https://pub-3cf0c63a6f4d40e89f096d50607c0759.r2.dev/includes.html
Frame ID: 5C52FDC5097841F18E3A6C17C18D6AAD
Requests: 8 HTTP requests in this frame

Screenshot

Page Title

Sign In

Page URL History Show full URLs

  1. https://trimmer.to/xFzvO HTTP 301
    https://jasonchewy.com/include.htm Page URL
  2. https://pub-3cf0c63a6f4d40e89f096d50607c0759.r2.dev/includes.html Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

6
Requests

67 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

5
IPs

3
Countries

121 kB
Transfer

248 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://trimmer.to/xFzvO HTTP 301
    https://jasonchewy.com/include.htm Page URL
  2. https://pub-3cf0c63a6f4d40e89f096d50607c0759.r2.dev/includes.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://trimmer.to/xFzvO HTTP 301
  • https://jasonchewy.com/include.htm

6 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
include.htm
jasonchewy.com/
Redirect Chain
  • https://trimmer.to/xFzvO
  • https://jasonchewy.com/include.htm
109 B
206 B
Document
General
Full URL
https://jasonchewy.com/include.htm
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
185.185.85.130 , United Kingdom, ASN58040 (hostlincoln Host Lincoln Limited, GB),
Reverse DNS
ssdrsserver3.hostinginterface.eu
Software
Apache /
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

accept-ranges
bytes
content-length
109
content-type
text/html
date
Mon, 16 Dec 2024 18:54:47 GMT
last-modified
Tue, 10 Dec 2024 14:20:50 GMT
server
Apache

Redirect headers

alt-svc
h3=":443"; ma=86400
cache-control
no-store, no-cache, must-revalidate
cf-cache-status
DYNAMIC
cf-ray
8f30e24129575d5d-FRA
content-type
text/html; charset=UTF-8
date
Mon, 16 Dec 2024 18:54:46 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
location
https://jasonchewy.com/include.htm
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma
no-cache
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2Ffm9fuQmIvIGLl3IEiSLAPuSZ27Lq9N%2FaJAuNsGVI48AFaWjQXRBANYCKtN3Ym6oNAR6veA8vI3AQtKKFyRHNZiZFZUBL%2BJSSP4mkYHwBWzRMaDKrkSEXLD4mBzG"}],"group":"cf-nel","max_age":604800}
server
cloudflare
server-timing
cfL4;desc="?proto=TCP&rtt=21643&min_rtt=21222&rtt_var=5181&sent=8&recv=11&lost=0&retrans=0&sent_bytes=3892&recv_bytes=2291&delivery_rate=196623&cwnd=234&unsent_bytes=0&cid=811dc67179635acf&ts=483&x=0"
x-powered-by
PHP/8.1.31
x-robots-tag
noindex
x-turbo-charged-by
LiteSpeed
Primary Request includes.html
pub-3cf0c63a6f4d40e89f096d50607c0759.r2.dev/
90 KB
90 KB
Document
General
Full URL
https://pub-3cf0c63a6f4d40e89f096d50607c0759.r2.dev/includes.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
162.159.140.237 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
741bb8de64e940d52f39de1e991e561fdc43d0f1ebb240ff3e4d34ed2b7db72a

Request headers

Referer
https://jasonchewy.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

Accept-Ranges
bytes
CF-RAY
8f30e24c7ac19734-FRA
Connection
keep-alive
Content-Length
92238
Content-Type
text/html
Date
Mon, 16 Dec 2024 18:54:47 GMT
ETag
"2f07e67fb8d769d67611ac1e3e3e8cdb"
Last-Modified
Thu, 12 Dec 2024 16:08:16 GMT
Server
cloudflare
Vary
Accept-Encoding
favicon.ico
jasonchewy.com/
0
0

jquery-3.6.0.min.js
code.jquery.com/
87 KB
31 KB
Script
General
Full URL
https://code.jquery.com/jquery-3.6.0.min.js
Requested by
Host: pub-3cf0c63a6f4d40e89f096d50607c0759.r2.dev
URL: https://pub-3cf0c63a6f4d40e89f096d50607c0759.r2.dev/includes.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.2.137 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://pub-3cf0c63a6f4d40e89f096d50607c0759.r2.dev/

Response headers

content-encoding
gzip
etag
W/"28feccc0-15d9d"
age
2898578
x-cache
HIT, HIT
date
Mon, 16 Dec 2024 18:54:48 GMT
content-type
application/javascript; charset=utf-8
last-modified
Fri, 18 Oct 1991 12:00:00 GMT
x-cache-hits
17, 1171986
x-served-by
cache-lga21931-LGA, cache-vie6332-VIE
vary
Accept-Encoding
cache-control
public, max-age=31536000, stale-while-revalidate=604800
x-timer
S1734375288.024597,VS0,VE0
cross-origin-resource-policy
cross-origin
via
1.1 varnish, 1.1 varnish
accept-ranges
bytes
access-control-allow-origin
*
content-length
30875
server
nginx
1125d2b4-7604-4b56-b0e8-00eb365124db
https://pub-3cf0c63a6f4d40e89f096d50607c0759.r2.dev/
67 KB
0
Document
General
Full URL
blob:https://pub-3cf0c63a6f4d40e89f096d50607c0759.r2.dev/1125d2b4-7604-4b56-b0e8-00eb365124db
Requested by
Host: pub-3cf0c63a6f4d40e89f096d50607c0759.r2.dev
URL: https://pub-3cf0c63a6f4d40e89f096d50607c0759.r2.dev/includes.html
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
3515eb5cabc3b03bccd24c4d38595f572eebefd206abf0ed87e7ce35784430de

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

Content-Length
68531
Content-Type
text/html
favicon.ico
pub-3cf0c63a6f4d40e89f096d50607c0759.r2.dev/
0
0

truncated
/
1 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
0cb50e0480356ebb0158dfe5f8efa9707f556d704a54a4a3ebae3ed0fdb50e29

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/png
truncated
/
2 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b17a79ce3b9255e983b5cc79c0e6a8c2a3aac69c72c7401de1af65835adfbd35

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/png

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
jasonchewy.com
URL
https://jasonchewy.com/favicon.ico
Domain
pub-3cf0c63a6f4d40e89f096d50607c0759.r2.dev
URL
https://pub-3cf0c63a6f4d40e89f096d50607c0759.r2.dev/favicon.ico

Verdicts & Comments Add Verdict or Comment


Malicious page.url
Submitted on December 16th 2024, 6:55:52 pm UTC — From United States

Threats: Phishing
Brands: CapitalOne US
Comment: CapitalOne phishing link that redirects through google

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Domain/Path Name / Value
trimmer.to/ Name: PHPSESSID
Value: khk3smpnu2fhtm561l2kp10gsv
trimmer.to/ Name: short_5867
Value: 1