pub-ab17cf5b1a654ae591b54a1cec02cd4f.r2.dev

Summary

This website contacted 5 IPs in 1 countries across 5 domains to perform 7 HTTP transactions. The main IP is 2606:4700::6812:323, located in United States and belongs to CLOUDFLARENET, US. The main domain is pub-ab17cf5b1a654ae591b54a1cec02cd4f.r2.dev.
TLS certificate: Issued by E1 on October 11th 2023. Valid for: 3 months.

This is the only time pub-ab17cf5b1a654ae591b54a1cec02cd4f.r2.dev was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
1	2606:4700::68... 2606:4700::6812:323	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a04:4e42:600... 2a04:4e42:600::649	54113 (FASTLY) (FASTLY)
2	2606:2800:247... 2606:2800:247:8f3c:39fe:2753:7a35:e3da	15133 (EDGECAST) (EDGECAST)
2	2620:1ec:46::46 2620:1ec:46::46	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
7	5

1 2606:4700::6812:323 (United States)

ASN13335 (CLOUDFLARENET, US)

pub-ab17cf5b1a654ae591b54a1cec02cd4f.r2.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:600::649 (United States)

ASN54113 (FASTLY, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:2800:247:8f3c:39fe:2753:7a35:e3da (United States)

ASN15133 (EDGECAST, US)

aadcdn.msftauth.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:1ec:46::46 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

aadcdn.msauth.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	msauth.net aadcdn.msauth.net — Cisco Umbrella Rank: 982	2 KB
2	msftauth.net aadcdn.msftauth.net — Cisco Umbrella Rank: 1018	3 KB
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 762	30 KB
1	r2.dev pub-ab17cf5b1a654ae591b54a1cec02cd4f.r2.dev	22 KB
0	ru.com Failed 9bacaladilla.ru.com Failed
7	5

	Domain	Requested by
2	aadcdn.msauth.net	pub-ab17cf5b1a654ae591b54a1cec02cd4f.r2.dev
2	aadcdn.msftauth.net	pub-ab17cf5b1a654ae591b54a1cec02cd4f.r2.dev
1	code.jquery.com	pub-ab17cf5b1a654ae591b54a1cec02cd4f.r2.dev
1	pub-ab17cf5b1a654ae591b54a1cec02cd4f.r2.dev
0	9bacaladilla.ru.com Failed	pub-ab17cf5b1a654ae591b54a1cec02cd4f.r2.dev
7	5

This site contains links to these domains. Also see Links.

Domain
passwordreset.microsoftonline.com
www.microsoft.com
privacy.microsoft.com

Subject Issuer	Validity	Valid
*.r2.dev E1	`2023-10-11` - `2024-01-09`	3 months	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2023-07-11` - `2024-07-14`	a year	crt.sh
aadcdn.msftauth.net DigiCert SHA2 Secure Server CA	`2023-01-31` - `2024-01-31`	a year	crt.sh
aadcdn.msauth.net DigiCert SHA2 Secure Server CA	`2023-10-29` - `2024-10-29`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://pub-ab17cf5b1a654ae591b54a1cec02cd4f.r2.dev/updateaccount.html
Frame ID: F1B43BEC47860B2BB9D45615EF9D3D23
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Sign in to your account

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

7
Requests

86 %
HTTPS

100 %
IPv6

5
Domains

5
Subdomains

5
IPs

1
Countries

56 kB
Transfer

204 kB
Size

0
Cookies

3 Outgoing links

These are links going to different origins than the main page.

URL: https://passwordreset.microsoftonline.com/?ru=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2freprocess%3fctx%3drQIIAYWSu4vTAADGm_au1zvQO0VEEeQGBxXS5tU8Kg49m0uba5LWJO0lgyVt0jyaV9u0aTIdTo43OdwkIg4nLk4iiDffdIuLoyCIgxxOiou9v8Dlgw9-fMv321jDi2QRKkL3c3ARrtzBUKysEX0KpDQcBTEKhkANQ3AQLaM4ikCwXobQydWNrQP6258nN7_Sr3efvnn1-fzvMXDbiqJwWimV4jguBsOhPTCKg8AruZqv2775HgDOAOA7ABxlVw0flMXj7BRHCRzFSJzCcQzBYAinigrCJbzE2mqXjlSmjSgJBPEevWhKZswz7YhH5ITzOJj3VFeoWY66ZHlGhjlmyTs0xj1a8qluNbuspUijiPd4m5eqsSApy53O6Et2U6jOIgu5iGBip8av7PowmHi9MJhGR7nn2YlpRA1nFOm2WWtFCian7LSh2qbLNxGQjOtE0yL0RJtbLT1g91TIjljHpgYttGeIC7_pDQfueMF1zJDSGMVE6WqDEXFWwtvKUBLS_VQQSXjIk464GzHJqDkLU6xOmi5EJCEqzOmpk87mCYmEYrutN4ZUn9ujPTcZDagIdvpwYKhpDZwlrTFIWb3I1H1kZIug2yCEMcu0SEXq-QuC1z153JrLUoDAEYjUFTFs99vYXOt03J2eXN-btYxJzbGZVNUbEJ4ws2RB7ldHeNmtph6PonKP6gwm83A6ZQPJEbvxu1x-eaYX-Ke5y0Fo-La-HU6Coe0aZyvAj5XrhfxW4UZmO3P3GpSrFAobW5mL9nsFeLm6tEU-qDz4ufmRfvvi3q2TT4eZ09VSXVW7jiA1-qQSsIsBYcCxxPnCTuQmlkSNISTAm_N-jdEI7CFcgQ_zwGE-f5q_0qj1eFoSpSpfqz6uIT3oPA88W8t8WP-PfyeXMv8A0&mkt=en-US&hosted=0&device_platform=Windows+10
Title: Forgot my password

Search URL Search Domain Scan URL

URL: https://www.microsoft.com/en-US/servicesagreement/
Title: Terms of use

Search URL Search Domain Scan URL

URL: https://privacy.microsoft.com/en-US/privacystatement
Title: Privacy & cookies

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request updateaccount.html Show response pub-ab17cf5b1a654ae591b54a1cec02cd4f.r2.dev/	112 KB 22 KB	2387ms 2362ms	Document text/html	2606:4700::6812:323 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://pub-ab17cf5b1a654ae591b54a1cec02cd4f.r2.dev/updateaccount.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:323 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `64ab28c5acf364314acad47957e3d79be9c0a072240b734c4ce3e26839e073f7` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36 accept-language jp-JP,jp;q=0.9 Response headers CF-RAY 81e4d4055b426871-NRT Connection keep-alive Content-Encoding gzip Content-Type text/html Date Mon, 30 Oct 2023 15:52:58 GMT ETag W/"1528ec38a8ae199931f42d1a8213ccb6" Last-Modified Wed, 25 Oct 2023 12:11:40 GMT Server cloudflare Transfer-Encoding chunked Vary Accept-Encoding
GET H2	200	jquery-3.1.1.min.js Show response code.jquery.com/	85 KB 30 KB	24ms 7ms	Script application/javascript	2a04:4e42:600::649 FASTLY
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.1.1.min.js Requested by Host: pub-ab17cf5b1a654ae591b54a1cec02cd4f.r2.dev URL: https://pub-ab17cf5b1a654ae591b54a1cec02cd4f.r2.dev/updateaccount.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a04:4e42:600::649 , United States, ASN54113 (FASTLY, US), Reverse DNS Software nginx / Resource Hash `85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf` Request headers accept-language jp-JP,jp;q=0.9 Referer https://pub-ab17cf5b1a654ae591b54a1cec02cd4f.r2.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36 Response headers date Mon, 30 Oct 2023 15:52:58 GMT content-encoding gzip via 1.1 varnish, 1.1 varnish age 3880577 x-cache HIT, HIT content-length 30070 x-served-by cache-lga21947-LGA, cache-nrt-rjtf7700032-NRT last-modified Fri, 18 Oct 1991 12:00:00 GMT server nginx x-timer S1698681179.561660,VS0,VE0 etag W/"28feccc0-152b5" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=604800 accept-ranges bytes x-cache-hits 87, 49425
GET H2	200	microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg aadcdn.msftauth.net/shared/1.0/content/images/	4 KB 2 KB	40ms 10ms	Image image/svg+xml	2606:2800:247:8f3c:39fe:2753:7a35:e3da EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msftauth.net/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg Requested by Host: pub-ab17cf5b1a654ae591b54a1cec02cd4f.r2.dev URL: https://pub-ab17cf5b1a654ae591b54a1cec02cd4f.r2.dev/updateaccount.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2606:2800:247:8f3c:39fe:2753:7a35:e3da , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (osa/2B56) / Resource Hash `04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a` Request headers accept-language jp-JP,jp;q=0.9 Referer https://pub-ab17cf5b1a654ae591b54a1cec02cd4f.r2.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Mon, 30 Oct 2023 15:52:58 GMT content-encoding gzip content-md5 nzaLxFgP7ZB3dfMcaybWzw== age 24936444 x-cache HIT content-length 1435 x-ms-lease-status unlocked last-modified Thu, 16 Jan 2020 00:32:52 GMT server ECAcc (osa/2B56) etag 0x8D79A1B9F5E121A vary Accept-Encoding content-type image/svg+xml access-control-allow-origin * x-ms-request-id 2ced53f5-901e-0025-237d-28b575000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg aadcdn.msauth.net/shared/1.0/content/images/	513 B 798 B	23ms 4ms	Image image/svg+xml	2620:1ec:46::46 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msauth.net/shared/1.0/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg Requested by Host: pub-ab17cf5b1a654ae591b54a1cec02cd4f.r2.dev URL: https://pub-ab17cf5b1a654ae591b54a1cec02cd4f.r2.dev/updateaccount.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:1ec:46::46 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash `34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58` Request headers accept-language jp-JP,jp;q=0.9 Referer https://pub-ab17cf5b1a654ae591b54a1cec02cd4f.r2.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Mon, 30 Oct 2023 15:52:58 GMT content-encoding gzip x-cache TCP_HIT content-length 276 x-ms-lease-status unlocked last-modified Fri, 17 Jan 2020 19:28:34 GMT etag 0x8D79B8371B97A82 x-azure-ref 20231030T155258Z-9v1hrr4q693hxd8c7zrtqm9gss00000001hg00000000xupw content-type image/svg+xml access-control-allow-origin * x-ms-request-id 6eb70b7f-001e-003f-7e80-0a9f7d000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	signin-options_4e48046ce74f4b89d45037c90576bfac.svg aadcdn.msauth.net/shared/1.0/content/images/	2 KB 1 KB	4ms 3ms	Image image/svg+xml	2620:1ec:46::46 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msauth.net/shared/1.0/content/images/signin-options_4e48046ce74f4b89d45037c90576bfac.svg Requested by Host: pub-ab17cf5b1a654ae591b54a1cec02cd4f.r2.dev URL: https://pub-ab17cf5b1a654ae591b54a1cec02cd4f.r2.dev/updateaccount.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:1ec:46::46 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash `8e6db1634f1812d42516778fc890010aa57f3e39914fb4803df2c38abbf56d93` Request headers accept-language jp-JP,jp;q=0.9 Referer https://pub-ab17cf5b1a654ae591b54a1cec02cd4f.r2.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Mon, 30 Oct 2023 15:52:58 GMT content-encoding gzip x-cache TCP_HIT content-length 621 x-ms-lease-status unlocked last-modified Tue, 10 Nov 2020 03:41:24 GMT etag 0x8D8852A7FA6B761 x-azure-ref 20231030T155258Z-9v1hrr4q693hxd8c7zrtqm9gss00000001hg00000000xupy content-type image/svg+xml access-control-allow-origin * x-ms-request-id aa816a77-501e-004a-0a03-0aea77000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	2_bc3d32a696895f78c19df6c717586a5d.svg aadcdn.msftauth.net/shared/1.0/content/images/backgrounds/	2 KB 824 B	10ms 10ms	Image image/svg+xml	2606:2800:247:8f3c:39fe:2753:7a35:e3da EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msftauth.net/shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg Requested by Host: pub-ab17cf5b1a654ae591b54a1cec02cd4f.r2.dev URL: https://pub-ab17cf5b1a654ae591b54a1cec02cd4f.r2.dev/updateaccount.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2606:2800:247:8f3c:39fe:2753:7a35:e3da , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (osa/2B5B) / Resource Hash `0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68` Request headers accept-language jp-JP,jp;q=0.9 Referer https://pub-ab17cf5b1a654ae591b54a1cec02cd4f.r2.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Mon, 30 Oct 2023 15:52:58 GMT content-encoding gzip content-md5 DhdidjYrlCeaRJJRG/y9mA== age 22083416 x-cache HIT content-length 673 x-ms-lease-status unlocked last-modified Wed, 12 Feb 2020 22:01:50 GMT server ECAcc (osa/2B5B) etag 0x8D7B007297AE131 vary Accept-Encoding content-type image/svg+xml access-control-allow-origin * x-ms-request-id b9f9e611-301e-0077-6070-42fb92000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET		prv.php 9bacaladilla.ru.com/biller/	0 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: 9bacaladilla.ru.com
URL: https://9bacaladilla.ru.com/biller/prv.php?id=

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture function| $ function| jQuery object| inputpw

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	error	URL: https://pub-ab17cf5b1a654ae591b54a1cec02cd4f.r2.dev/updateaccount.html Message: Access to XMLHttpRequest at 'https://9bacaladilla.ru.com/biller/prv.php?id=' from origin 'https://pub-ab17cf5b1a654ae591b54a1cec02cd4f.r2.dev' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://9bacaladilla.ru.com/biller/prv.php?id= Message: Failed to load resource: net::ERR_FAILED

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

9bacaladilla.ru.com
aadcdn.msauth.net
aadcdn.msftauth.net
code.jquery.com
pub-ab17cf5b1a654ae591b54a1cec02cd4f.r2.dev
9bacaladilla.ru.com
2606:2800:247:8f3c:39fe:2753:7a35:e3da
2606:4700::6812:323
2620:1ec:46::46
2a04:4e42:600::649
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68
34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58
64ab28c5acf364314acad47957e3d79be9c0a072240b734c4ce3e26839e073f7
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
8e6db1634f1812d42516778fc890010aa57f3e39914fb4803df2c38abbf56d93

pub-ab17cf5b1a654ae591b54a1cec02cd4f.r2.dev Open in urlscan Pro 2606:4700::6812:323 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

7 Requests

86 %HTTPS

100 %IPv6

5 Domains

5 Subdomains

5 IPs

1 Countries

56 kBTransfer

204 kBSize

0 Cookies

3 Outgoing links

Redirected requests

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

0 Cookies

2 Console Messages

Indicators

pub-ab17cf5b1a654ae591b54a1cec02cd4f.r2.dev Open in urlscan Pro
2606:4700::6812:323 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

7
Requests

86 %
HTTPS

100 %
IPv6

5
Domains

5
Subdomains

5
IPs

1
Countries

56 kB
Transfer

204 kB
Size

0
Cookies

7 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!