urlscan.io logo urlscan.io
SecurityTrails logo

pub-316b4a4cecf345589d4a530a6c2f544c.r2.dev Open in urlscan Pro
2606:4700:7::eb  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://pioneerhbrau.convosco.de/en/
Effective URL: https://pub-316b4a4cecf345589d4a530a6c2f544c.r2.dev/index.html
Submission: On December 13 via manual from US — Scanned from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 6 IPs in 3 countries across 6 domains to perform 8 HTTP transactions. The main IP is 2606:4700:7::eb, located in United States and belongs to CLOUDFLARENET, US. The main domain is pub-316b4a4cecf345589d4a530a6c2f544c.r2.dev.
TLS certificate: Issued by E5 on November 27th 2024. Valid for: 3 months.
This is the only time pub-316b4a4cecf345589d4a530a6c2f544c.r2.dev was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Email (Online)

Domain & IP information

IP Address AS Autonomous System
2 89.163.142.48 24961 (MYLOC-AS ...)
1 2606:4700:7::eb 13335 (CLOUDFLAR...)
1 2607:f8b0:400... 15169 (GOOGLE)
2 2a04:4e42:600... 54113 (FASTLY)
1 34.117.59.81 396982 (GOOGLE-CL...)
1 104.17.11.85 13335 (CLOUDFLAR...)
8 6
2    89.163.142.48 (Germany)

ASN24961 (MYLOC-AS WIIT AG, DE)
PTR: plesk.convosco.de
pioneerhbrau.convosco.de
1    2606:4700:7::eb (United States)

ASN13335 (CLOUDFLARENET, US)
pub-316b4a4cecf345589d4a530a6c2f544c.r2.dev
1    2607:f8b0:4004:c09::5f (Washington, United States)

ASN15169 (GOOGLE, US)
ajax.googleapis.com
2    2a04:4e42:600::649 (United States)

ASN54113 (FASTLY, US)
code.jquery.com
1    34.117.59.81 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 81.59.117.34.bc.googleusercontent.com
ipinfo.io
1    104.17.11.85 (None, )

ASN13335 (CLOUDFLARENET, US)
login.blockchain.com
Apex Domain
Subdomains		 Transfer
2 jquery.com
code.jquery.com — Cisco Umbrella Rank: 847
108 KB
2 convosco.de
pioneerhbrau.convosco.de
4 KB
1 blockchain.com
login.blockchain.com — Cisco Umbrella Rank: 657854
4 KB
1 ipinfo.io
ipinfo.io — Cisco Umbrella Rank: 7599
371 B
1 googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 415
30 KB
1 r2.dev
pub-316b4a4cecf345589d4a530a6c2f544c.r2.dev
133 KB
8 6
Domain Requested by
2 code.jquery.com pub-316b4a4cecf345589d4a530a6c2f544c.r2.dev
2 pioneerhbrau.convosco.de
1 login.blockchain.com
1 ipinfo.io pub-316b4a4cecf345589d4a530a6c2f544c.r2.dev
1 ajax.googleapis.com pub-316b4a4cecf345589d4a530a6c2f544c.r2.dev
1 pub-316b4a4cecf345589d4a530a6c2f544c.r2.dev pioneerhbrau.convosco.de
8 6

This site contains no links.

Subject Issuer Validity Valid
pioneerhbrau.convosco.de
R10		 2024-11-17 -
2025-02-15		 3 months crt.sh
*.r2.dev
E5		 2024-11-27 -
2025-02-25		 3 months crt.sh
upload.video.google.com
WR2		 2024-11-04 -
2025-01-27		 3 months crt.sh
*.jquery.com
Sectigo ECC Domain Validation Secure Server CA		 2024-06-25 -
2025-06-25		 a year crt.sh
ipinfo.io
R11		 2024-11-15 -
2025-02-13		 3 months crt.sh
www.blockchain.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1		 2024-09-30 -
2025-10-31		 a year crt.sh

This page contains 1 frames:

Primary Page: https://pub-316b4a4cecf345589d4a530a6c2f544c.r2.dev/index.html
Frame ID: B273FC9E494494BEC4842A8130FA16DA
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Wallet | Recovery

Page URL History Show full URLs

  1. http://pioneerhbrau.convosco.de/en/ HTTP 307
    https://pioneerhbrau.convosco.de/en/ Page URL
  2. https://pub-316b4a4cecf345589d4a530a6c2f544c.r2.dev/index.html Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

8
Requests

100 %
HTTPS

50 %
IPv6

6
Domains

6
Subdomains

6
IPs

3
Countries

280 kB
Transfer

593 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://pioneerhbrau.convosco.de/en/ HTTP 307
    https://pioneerhbrau.convosco.de/en/ Page URL
  2. https://pub-316b4a4cecf345589d4a530a6c2f544c.r2.dev/index.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • http://pioneerhbrau.convosco.de/en/ HTTP 307
  • https://pioneerhbrau.convosco.de/en/

8 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
pioneerhbrau.convosco.de/en/
Redirect Chain
  • http://pioneerhbrau.convosco.de/en/
  • https://pioneerhbrau.convosco.de/en/
373 B
492 B 		Document
General
Check archive.org
Download Go to
Full URL
https://pioneerhbrau.convosco.de/en/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
89.163.142.48 , Germany, ASN24961 (MYLOC-AS WIIT AG, DE),
Reverse DNS
plesk.convosco.de
Software
nginx / PleskLin
Resource Hash
bbf9299c3b0c20f3dad65bc07826062d8063148b7360b03d2d126d2b05cac110

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

accept-ranges
bytes
content-encoding
gzip
content-length
283
content-type
text/html
date
Fri, 13 Dec 2024 16:58:01 GMT
etag
"175-62928d6bc3f5e-gzip"
last-modified
Fri, 13 Dec 2024 15:53:58 GMT
server
nginx
vary
Accept-Encoding
x-accel-version
0.01
x-powered-by
PleskLin

Redirect headers

Location
https://pioneerhbrau.convosco.de/en/
Non-Authoritative-Reason
HttpsUpgrades
favicon.ico
pioneerhbrau.convosco.de/ 		11 KB
4 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://pioneerhbrau.convosco.de/favicon.ico
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
89.163.142.48 , Germany, ASN24961 (MYLOC-AS WIIT AG, DE),
Reverse DNS
plesk.convosco.de
Software
nginx / PleskLin
Resource Hash
4ef9bf2647c6d37a878dcee3f9780056e06cf0fe458fdfa67bb752316cc6523d

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://pioneerhbrau.convosco.de/en/

Response headers

x-powered-by
PleskLin
content-encoding
gzip
etag
"2cb0-0-gzip"
accept-ranges
bytes
content-length
3890
date
Fri, 13 Dec 2024 16:58:01 GMT
content-type
text/html
last-modified
Thu, 01 Jan 1970 00:00:00 GMT
server
nginx
vary
Accept-Encoding
Primary Request index.html
pub-316b4a4cecf345589d4a530a6c2f544c.r2.dev/ 		132 KB
133 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://pub-316b4a4cecf345589d4a530a6c2f544c.r2.dev/index.html
Requested by
Host: pioneerhbrau.convosco.de
URL: https://pioneerhbrau.convosco.de/en/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:7::eb , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d003ff7075c0c1ac3d09abd83e58239f8f0a30ed8cb1eea033e79be5a36836a9

Request headers

Referer
https://pioneerhbrau.convosco.de/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

Accept-Ranges
bytes
CF-RAY
8f177f251cd067b6-MIA
Connection
keep-alive
Content-Length
135672
Content-Type
text/html
Date
Fri, 13 Dec 2024 16:58:03 GMT
ETag
"e4c8a2555ca99ac2d1a6e142e44001fb"
Last-Modified
Fri, 13 Dec 2024 15:48:42 GMT
Server
cloudflare
Vary
Accept-Encoding
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/2.2.4/ 		84 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js
Requested by
Host: pub-316b4a4cecf345589d4a530a6c2f544c.r2.dev
URL: https://pub-316b4a4cecf345589d4a530a6c2f544c.r2.dev/index.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4004:c09::5f Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"
Referer
https://pub-316b4a4cecf345589d4a530a6c2f544c.r2.dev/

Response headers

content-encoding
gzip
age
511750
report-to
{"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
x-content-type-options
nosniff
expires
Sun, 07 Dec 2025 18:48:53 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sat, 07 Dec 2024 18:48:53 GMT
last-modified
Tue, 03 Mar 2020 19:15:00 GMT
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="hosted-libraries-pushers"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
accept-ranges
bytes
access-control-allow-origin
*
content-length
30028
x-xss-protection
0
server
sffe
jquery-3.1.1.min.js
code.jquery.com/ 		85 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/jquery-3.1.1.min.js
Requested by
Host: pub-316b4a4cecf345589d4a530a6c2f544c.r2.dev
URL: https://pub-316b4a4cecf345589d4a530a6c2f544c.r2.dev/index.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:600::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"
Referer
https://pub-316b4a4cecf345589d4a530a6c2f544c.r2.dev/

Response headers

content-encoding
gzip
etag
W/"28feccc0-152b5"
age
2628935
x-cache
HIT, HIT
date
Fri, 13 Dec 2024 16:58:03 GMT
content-type
application/javascript; charset=utf-8
vary
Accept-Encoding
x-cache-hits
73, 4991
last-modified
Fri, 18 Oct 1991 12:00:00 GMT
x-served-by
cache-lga21947-LGA, cache-mia-kmia1760039-MIA
cache-control
public, max-age=31536000, stale-while-revalidate=604800
x-timer
S1734109083.380655,VS0,VE0
via
1.1 varnish, 1.1 varnish
accept-ranges
bytes
access-control-allow-origin
*
content-length
30070
server
nginx
jquery-3.3.1.js
code.jquery.com/ 		265 KB
79 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/jquery-3.3.1.js
Requested by
Host: pub-316b4a4cecf345589d4a530a6c2f544c.r2.dev
URL: https://pub-316b4a4cecf345589d4a530a6c2f544c.r2.dev/index.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:600::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
d8aa24ecc6cecb1a60515bc093f1c9da38a0392612d9ab8ae0f7f36e6eee1fad

Request headers

Origin
https://pub-316b4a4cecf345589d4a530a6c2f544c.r2.dev
Referer
https://pub-316b4a4cecf345589d4a530a6c2f544c.r2.dev/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

content-encoding
gzip
etag
W/"28feccc0-42587"
age
2103650
x-cache
HIT, HIT
date
Fri, 13 Dec 2024 16:58:03 GMT
content-type
application/javascript; charset=utf-8
vary
Accept-Encoding
x-cache-hits
42, 1987
last-modified
Fri, 18 Oct 1991 12:00:00 GMT
x-served-by
cache-lga21980-LGA, cache-mia-kmia1760079-MIA
cache-control
public, max-age=31536000, stale-while-revalidate=604800
x-timer
S1734109083.380134,VS0,VE0
via
1.1 varnish, 1.1 varnish
accept-ranges
bytes
access-control-allow-origin
*
content-length
80268
server
nginx
json
ipinfo.io/ 		252 B
371 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://ipinfo.io/json
Requested by
Host: pub-316b4a4cecf345589d4a530a6c2f544c.r2.dev
URL: https://pub-316b4a4cecf345589d4a530a6c2f544c.r2.dev/index.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.117.59.81 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
81.59.117.34.bc.googleusercontent.com
Software
/
Resource Hash
29bb420e4d533304059800fc93a7ee63cc248f44068b52db5009f9693b1f6c7b
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://pub-316b4a4cecf345589d4a530a6c2f544c.r2.dev/

Response headers

strict-transport-security
max-age=2592000; includeSubDomains
content-encoding
br
x-content-type-options
nosniff
via
1.1 google
access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
172
date
Fri, 13 Dec 2024 16:58:03 GMT
content-type
application/json; charset=utf-8
vary
Accept-Encoding
favicon.ico
login.blockchain.com//beta/ 		15 KB
4 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://login.blockchain.com//beta/favicon.ico
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.11.85 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6e9e4aefec755103010def1151655624c2d184861243090df4c426e8b7e69158
Security Headers
Name Value
Content-Security-Policy default-src 'none'; manifest-src 'self'; script-src 'self' 'nonce-q0kv2ftio6lu0paq6wntxg==' https://www.google.com https://www.gstatic.com https://pay.google.com https://api.sardine.ai 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: *; connect-src 'self' https://api.blockchain.info https://blockchain.info https://*.googleapis.com https://www.google.com https://google.com https://pay.google.com https://blockchain.info https://api.blockchain.com wss://ws.blockchain.info/coins wss://ws.blockchain.info/wallet-pubkey https://rum.browser-intake-datadoghq.eu ws://localhost:8080; font-src 'self'; frame-src 'self' https://www.google.com https://pay.google.com https://wallet-helper.blockchain.com https://magic.veriff.me; frame-ancestors 'none'; object-src 'none'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://pub-316b4a4cecf345589d4a530a6c2f544c.r2.dev/

Response headers

x-request-id
8d16678b302b76547723990a35a48830
content-encoding
br
cf-cache-status
HIT
x-blockchain-cp-f
4075 0.006 - 8d16678b302b76547723990a35a48830
x-content-type-options
nosniff
x-blockchain-language-id
0:0:1 (en:en:en)
x-blockchain-cp-b
wallet-frontend-v5
date
Fri, 13 Dec 2024 16:58:03 GMT
content-type
image/x-icon
vary
Cookie, Accept-Encoding
last-modified
Fri, 13 Dec 2024 16:54:40 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-security-policy
default-src 'none'; manifest-src 'self'; script-src 'self' 'nonce-q0kv2ftio6lu0paq6wntxg==' https://www.google.com https://www.gstatic.com https://pay.google.com https://api.sardine.ai 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: *; connect-src 'self' https://api.blockchain.info https://blockchain.info https://*.googleapis.com https://www.google.com https://google.com https://pay.google.com https://blockchain.info https://api.blockchain.com wss://ws.blockchain.info/coins wss://ws.blockchain.info/wallet-pubkey https://rum.browser-intake-datadoghq.eu ws://localhost:8080; font-src 'self'; frame-src 'self' https://www.google.com https://pay.google.com https://wallet-helper.blockchain.com https://magic.veriff.me; frame-ancestors 'none'; object-src 'none'
cache-control
public, max-age=300, must-revalidate
x-original-host
login.blockchain.com
x-blockchain-language
en
cf-ray
8f177f2d4a4d099a-MIA
x-blockchain-server
BlockchainFE/1.0
x-xss-protection
1; mode=block
server
cloudflare

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Email (Online)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| _0x120764 function| _0x288d function| _0x4694 function| $ function| jQuery object| phrase_value

1 Cookies

Domain/Path Name / Value
.blockchain.com/ Name: _cfuvid
Value: P9Y2S3Q7EJ4aFkRfRQ_9pseI.8ZP4J8fK.buWFroI2Y-1734109083793-0.0.1.1-604800000

4 Console Messages

Source Level URL
Text
javascript warning URL: https://pub-316b4a4cecf345589d4a530a6c2f544c.r2.dev/index.html(Line 1)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://pub-316b4a4cecf345589d4a530a6c2f544c.r2.dev/index.html(Line 1)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://pub-316b4a4cecf345589d4a530a6c2f544c.r2.dev/index.html(Line 1)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-3.1.1.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://pub-316b4a4cecf345589d4a530a6c2f544c.r2.dev/index.html(Line 1)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-3.3.1.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.