ledger-hardware-clearsigning.com Open in urlscan Pro
172.67.211.112  Malicious Activity! Public Scan

Submitted URL: http://r.emailblue.hardbacon.ca/mk/cl/f/sh/7nVU1aA2nfsTSXf0TYXyV552FaMSd7Z/0NN501qh3scJ
Effective URL: https://ledger-hardware-clearsigning.com/
Submission: On November 19 via api from US — Scanned from CA

Summary

This website contacted 5 IPs in 2 countries across 5 domains to perform 8 HTTP transactions. The main IP is 172.67.211.112, located in United States and belongs to CLOUDFLARENET, US. The main domain is ledger-hardware-clearsigning.com.
TLS certificate: Issued by WE1 on November 19th 2024. Valid for: 3 months.
This is the only time ledger-hardware-clearsigning.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Ledger (Crypto Exchange)

Domain & IP information

IP Address AS Autonomous System
1 1.179.112.197 396982 (GOOGLE-CL...)
1 2606:4700:440... 13335 (CLOUDFLAR...)
1 1 209.182.192.109 22611 (INMOTION)
1 6 172.67.211.112 13335 (CLOUDFLAR...)
1 2 2606:4700::68... 13335 (CLOUDFLAR...)
8 5
Apex Domain
Subdomains
Transfer
6 ledger-hardware-clearsigning.com
ledger-hardware-clearsigning.com
904 KB
2 ledger.com
www.ledger.com — Cisco Umbrella Rank: 51810
ledger-wp-website-s3-prd.ledger.com — Cisco Umbrella Rank: 601869
7 KB
1 seguriciponline.com
seguriciponline.com
262 B
1 sibautomation.com
sibautomation.com — Cisco Umbrella Rank: 23280
1 hardbacon.ca
r.emailblue.hardbacon.ca
767 B
8 5
Domain Requested by
6 ledger-hardware-clearsigning.com 1 redirects r.emailblue.hardbacon.ca
ledger-hardware-clearsigning.com
1 ledger-wp-website-s3-prd.ledger.com ledger-hardware-clearsigning.com
1 www.ledger.com 1 redirects
1 seguriciponline.com 1 redirects
1 sibautomation.com r.emailblue.hardbacon.ca
1 r.emailblue.hardbacon.ca
8 6

This site contains links to these domains. Also see Links.

Domain
developers.ledger.com
www.ledger.com
shop.ledger.com
Subject Issuer Validity Valid
r.emailblue.hardbacon.ca
R11
2024-09-15 -
2024-12-14
3 months crt.sh
sibautomation.com
WE1
2024-10-03 -
2025-01-01
3 months crt.sh
ledger-hardware-clearsigning.com
WE1
2024-11-19 -
2025-02-17
3 months crt.sh

This page contains 3 frames:

Primary Page: https://ledger-hardware-clearsigning.com/
Frame ID: A2009178140F817DBB416B60E605CFB3
Requests: 6 HTTP requests in this frame

Frame: https://sibautomation.com/cm.html?id=1544184
Frame ID: 6D488723C666EB3D0021967D28B95E93
Requests: 1 HTTP requests in this frame

Frame: https://ledger-hardware-clearsigning.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/22755d9a86c9/main.js
Frame ID: 77415FE15D7BB0B9F6B0EAA0BB1C88C4
Requests: 2 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. http://r.emailblue.hardbacon.ca/mk/cl/f/sh/7nVU1aA2nfsTSXf0TYXyV552FaMSd7Z/0NN501qh3scJ HTTP 307
    https://r.emailblue.hardbacon.ca/mk/cl/f/sh/7nVU1aA2nfsTSXf0TYXyV552FaMSd7Z/0NN501qh3scJ Page URL
  2. http://seguriciponline.com/folder HTTP 307
    https://seguriciponline.com/folder HTTP 301
    https://ledger-hardware-clearsigning.com/ Page URL

Page Statistics

8
Requests

75 %
HTTPS

40 %
IPv6

5
Domains

6
Subdomains

5
IPs

2
Countries

911 kB
Transfer

1179 kB
Size

3
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://r.emailblue.hardbacon.ca/mk/cl/f/sh/7nVU1aA2nfsTSXf0TYXyV552FaMSd7Z/0NN501qh3scJ HTTP 307
    https://r.emailblue.hardbacon.ca/mk/cl/f/sh/7nVU1aA2nfsTSXf0TYXyV552FaMSd7Z/0NN501qh3scJ Page URL
  2. http://seguriciponline.com/folder HTTP 307
    https://seguriciponline.com/folder HTTP 301
    https://ledger-hardware-clearsigning.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • http://r.emailblue.hardbacon.ca/mk/cl/f/sh/7nVU1aA2nfsTSXf0TYXyV552FaMSd7Z/0NN501qh3scJ HTTP 307
  • https://r.emailblue.hardbacon.ca/mk/cl/f/sh/7nVU1aA2nfsTSXf0TYXyV552FaMSd7Z/0NN501qh3scJ
Request Chain 3
  • https://www.ledger.com/wp-content/uploads/2023/03/Recover-X-coincover.png HTTP 301
  • https://ledger-wp-website-s3-prd.ledger.com/uploads/2023/03/Recover-X-coincover.png
Request Chain 6
  • https://ledger-hardware-clearsigning.com/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
  • https://ledger-hardware-clearsigning.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/22755d9a86c9/main.js

8 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
0NN501qh3scJ
r.emailblue.hardbacon.ca/mk/cl/f/sh/7nVU1aA2nfsTSXf0TYXyV552FaMSd7Z/
Redirect Chain
  • http://r.emailblue.hardbacon.ca/mk/cl/f/sh/7nVU1aA2nfsTSXf0TYXyV552FaMSd7Z/0NN501qh3scJ
  • https://r.emailblue.hardbacon.ca/mk/cl/f/sh/7nVU1aA2nfsTSXf0TYXyV552FaMSd7Z/0NN501qh3scJ
619 B
767 B
Document
General
Full URL
https://r.emailblue.hardbacon.ca/mk/cl/f/sh/7nVU1aA2nfsTSXf0TYXyV552FaMSd7Z/0NN501qh3scJ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
1.179.112.197 , France, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
Software
/
Resource Hash
2602df61b0deeb1c61e8c86a465a9280ea963d51c6b6fe25edde8b854049fad3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

content-length
619
content-type
text/html; charset=utf-8
date
Tue, 19 Nov 2024 19:11:50 GMT
x-content-type-options
nosniff
x-sib-server
gke-public-cluster-v2-1-179-112-141
x-xss-protection
1

Redirect headers

Location
https://r.emailblue.hardbacon.ca/mk/cl/f/sh/7nVU1aA2nfsTSXf0TYXyV552FaMSd7Z/0NN501qh3scJ
Non-Authoritative-Reason
HttpsUpgrades
cm.html
sibautomation.com/ Frame 6D48
0
0
Document
General
Full URL
https://sibautomation.com/cm.html?id=1544184
Requested by
Host: r.emailblue.hardbacon.ca
URL: https://r.emailblue.hardbacon.ca/mk/cl/f/sh/7nVU1aA2nfsTSXf0TYXyV552FaMSd7Z/0NN501qh3scJ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::ac40:9473 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Sails <sailsjs.com>
Resource Hash

Request headers

Referer
https://r.emailblue.hardbacon.ca/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

access-control-allow-origin
*
age
28251
cache-control
public, max-age=7200
cf-cache-status
HIT
cf-ray
8e5282283ac7a2f2-YUL
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Tue, 19 Nov 2024 19:11:51 GMT
expires
Tue, 19 Nov 2024 21:11:51 GMT
server
cloudflare
vary
Accept-Encoding
x-powered-by
Sails <sailsjs.com>
Primary Request /
ledger-hardware-clearsigning.com/
Redirect Chain
  • http://seguriciponline.com/folder
  • https://seguriciponline.com/folder
  • https://ledger-hardware-clearsigning.com/
21 KB
8 KB
Document
General
Full URL
https://ledger-hardware-clearsigning.com/
Requested by
Host: r.emailblue.hardbacon.ca
URL: https://r.emailblue.hardbacon.ca/mk/cl/f/sh/7nVU1aA2nfsTSXf0TYXyV552FaMSd7Z/0NN501qh3scJ
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.211.112 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PHP/8.3.13 PleskLin
Resource Hash
9cae6540e1fc9c0fc7a25e511bfba8e3d855ae74d670c27ae0bf90532864c221

Request headers

Referer
https://r.emailblue.hardbacon.ca/mk/cl/f/sh/7nVU1aA2nfsTSXf0TYXyV552FaMSd7Z/0NN501qh3scJ
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
8e52822d1afa3a0b-YYZ
content-encoding
zstd
content-type
text/html; charset=UTF-8
date
Tue, 19 Nov 2024 19:11:52 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7S4YSiKcXDGcGt8b75NevJgucTPui%2Fz8ydLAY2kXvBzZSLMzM1rolEY60W36CJx%2FAWgOgbH6cw1PyPlA2WClA14vhdhUOpx5dU2fxEipOO7lvt9bv2kvHHpQbtfBZuIbMH9iq6SDhmAjOQlKboV8xxPudA%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
server-timing
cfL4;desc="?proto=QUIC&rtt=26212&sent=13&recv=11&lost=1&retrans=0&sent_bytes=4220&recv_bytes=5736&delivery_rate=1151&cwnd=12000&unsent_bytes=0&cid=d446034223c0b9b9&ts=429&x=1" cfHdrFlush;dur=0
vary
Accept-Encoding
x-powered-by
PHP/8.3.13 PleskLin

Redirect headers

Connection
Keep-Alive
Content-Length
249
Content-Type
text/html; charset=iso-8859-1
Date
Tue, 19 Nov 2024 19:11:51 GMT
Keep-Alive
timeout=5, max=100
Location
https://Ledger-hardware-clearsigning.com/
Server
Apache
all.css
ledger-hardware-clearsigning.com/assets/
515 KB
263 KB
Stylesheet
General
Full URL
https://ledger-hardware-clearsigning.com/assets/all.css
Requested by
Host: ledger-hardware-clearsigning.com
URL: https://ledger-hardware-clearsigning.com/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.211.112 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PleskLin
Resource Hash
943f4429d28c64823f9aaf0a98cdc43e5acdd798d0970dd7efec7aa98b4e4a99

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://ledger-hardware-clearsigning.com/

Response headers

content-encoding
zstd
cf-cache-status
HIT
etag
W/"65dc65fe-80c7a"
age
4978
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MarQuCK4N5guUMjmBvuZ%2BPK%2F9cihZ91OgTCai9wiRCP%2B4mgLqMODQDhVWKicF48oHPseyg7sW1YjD6uE7sVCv59e3Pgd4ACs7YuQsxQcX7Mk0uIJxaE3iAM7NII4Uv0F35oXVuNrjqBPCXdTuFJGXBKYPA%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=24904&sent=32&recv=18&lost=1&retrans=0&sent_bytes=24221&recv_bytes=6621&delivery_rate=22558&cwnd=12000&unsent_bytes=0&cid=d446034223c0b9b9&ts=572&x=1", cfHdrFlush;dur=19
date
Tue, 19 Nov 2024 19:11:52 GMT
content-type
text/css
last-modified
Mon, 26 Feb 2024 10:20:46 GMT
vary
Accept-Encoding
cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
8e5282303f003a0b-YYZ
x-powered-by
PleskLin
server
cloudflare
Recover-X-coincover.png
ledger-wp-website-s3-prd.ledger.com/uploads/2023/03/
Redirect Chain
  • https://www.ledger.com/wp-content/uploads/2023/03/Recover-X-coincover.png
  • https://ledger-wp-website-s3-prd.ledger.com/uploads/2023/03/Recover-X-coincover.png
6 KB
6 KB
Image
General
Full URL
https://ledger-wp-website-s3-prd.ledger.com/uploads/2023/03/Recover-X-coincover.png
Requested by
Host: ledger-hardware-clearsigning.com
URL: https://ledger-hardware-clearsigning.com/
Protocol
H2
Server
2606:4700::6812:14c4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c3fa3bed7b6ad01f1e21e09e957b87a1b7b5558c5434aa7224e6800c8af14492

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

cf-bgj
imgq:100,h2pri
etag
"5eeea311b3bcfb87b05a632241a30e3e"
x-amz-version-id
_j_wEYUGgS49fUQ9Q9QMKfp4QaOV79If
cf-cache-status
HIT
age
35124
expires
Tue, 19 Nov 2024 23:11:52 GMT
cf-polished
origFmt=png, origSize=14352
date
Tue, 19 Nov 2024 19:11:52 GMT
content-type
image/webp
content-disposition
inline; filename="Recover-X-coincover.webp"
vary
Accept
last-modified
Mon, 04 Mar 2024 10:02:34 GMT
x-amz-id-2
KUrKHqLyFsrb2E9K94RjGsepJC2VdMynbgfn3Y8/lpcXRAJOLZn555/UY0j5uojWfAdYVFuGrzk=
x-amz-replication-status
COMPLETED
cache-control
public, max-age=14400
x-amz-request-id
01GA6F1T24DA7Q6T
cf-ray
8e5282317b21a286-YUL
accept-ranges
bytes
content-length
5778
server
cloudflare
x-amz-server-side-encryption
AES256

Redirect headers

access-control-max-age
1728000
cf-cache-status
HIT
age
35124
access-control-allow-methods
GET, PUT, POST, DELETE, PATCH, OPTIONS
expires
Tue, 19 Nov 2024 23:11:52 GMT
date
Tue, 19 Nov 2024 19:11:52 GMT
content-type
text/html
vary
Accept-Encoding
access-control-allow-headers
DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization
strict-transport-security
max-age=31536000; includeSubDomains
cache-control
public, max-age=14400
location
https://ledger-wp-website-s3-prd.ledger.com/uploads/2023/03/Recover-X-coincover.png
access-control-allow-credentials
true
cf-ray
8e528230eaada286-YUL
access-control-allow-origin
*
server
cloudflare
rcv.png
ledger-hardware-clearsigning.com/assets/
627 KB
628 KB
Image
General
Full URL
https://ledger-hardware-clearsigning.com/assets/rcv.png
Requested by
Host: ledger-hardware-clearsigning.com
URL: https://ledger-hardware-clearsigning.com/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.211.112 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PleskLin
Resource Hash
3897ab7614a8854eec84bd75838fa6e257b4d59f8af84c911ab8cf174b39b19a

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

cf-cache-status
HIT
etag
"65dc6cbc-9caf1"
age
4978
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Oqhq%2B2IHJLcCmqODvbZU7CqiD1nKGIS1E2WNOfeI%2Fk3nIQl0MvNQuUG4l32P%2BzmTEl1wZCpZ5zMTwSCew57%2BGzNh0h5JIZ4ozviD%2BJafGjYk5Oa991GtG5RBT3V%2FXLUlADKhSdHQqbl4D6a2g%2Fti7i3PJQ%3D%3D"}],"group":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=24904&sent=22&recv=18&lost=1&retrans=0&sent_bytes=12221&recv_bytes=6621&delivery_rate=22558&cwnd=12000&unsent_bytes=0&cid=d446034223c0b9b9&ts=568&x=1", cfHdrFlush;dur=0
date
Tue, 19 Nov 2024 19:11:52 GMT
content-type
image/png
last-modified
Mon, 26 Feb 2024 10:49:32 GMT
vary
Accept-Encoding
cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
8e5282303f013a0b-YYZ
accept-ranges
bytes
content-length
641777
x-powered-by
PleskLin
server
cloudflare
truncated
/
2 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
24859811f0d8052e5979a146e00930a379b14745e480f40b20f1d9ccd79b99e0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/svg+xml
main.js
ledger-hardware-clearsigning.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/22755d9a86c9/ Frame 7741
Redirect Chain
  • https://ledger-hardware-clearsigning.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
  • https://ledger-hardware-clearsigning.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/22755d9a86c9/main.js?
8 KB
4 KB
Script
General
Full URL
https://ledger-hardware-clearsigning.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/22755d9a86c9/main.js?
Protocol
H3
Server
172.67.211.112 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
da5ef9d3dbe304b9d650f2a2a9919294cd1cc9811fa5db54c43b788b4fd1d9e3
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

cache-control
max-age=14400, stale-if-error=10800, stale-while-revalidate=10800, public
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
zstd
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pxSL%2F%2BtgqZgdBr%2BaJlvrMQqLe8LAJ2yXA85xgzDfjyBCAoGiPVvmb6wgkHnfnRdSopNYY3hASCqC3txfe0F%2FU1NJH04gZ2M5%2FC%2BKOt40oHYpZ9UQ0Lf%2B6iiZGOU%2FXhcxh2ID936%2Bwm%2FtQIIvFhiEqy%2BHeg%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
cf-ray
8e528231f95b3a0b-YYZ
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=24397&sent=808&recv=243&lost=2&retrans=1&sent_bytes=946441&recv_bytes=17403&delivery_rate=18285&cwnd=210360&unsent_bytes=0&cid=d446034223c0b9b9&ts=841&x=1", cfHdrFlush;dur=0
date
Tue, 19 Nov 2024 19:11:52 GMT
content-type
application/javascript; charset=UTF-8
vary
Accept-Encoding
server
cloudflare

Redirect headers

cache-control
max-age=300, stale-if-error=10800, stale-while-revalidate=10800, public
location
/cdn-cgi/challenge-platform/h/b/scripts/jsd/22755d9a86c9/main.js?
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bnRuFPd7rFNDV5DDqN9xR9m24PAVu%2B%2B5kWOUVYOs7wqi4%2B89WiQPLd9VAj92CriTRZNJrods0eySxhz3nZtQdHha8fpTuXBE%2FZE1g%2BFjbR%2BeiDxgUInzr2smo4n2tbwq%2F6%2Fkgek5CBOCBUnDchAasS4FCw%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
8e52823188e13a0b-YYZ
access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
content-length
0
server-timing
cfL4;desc="?proto=QUIC&rtt=24416&sent=806&recv=241&lost=2&retrans=1&sent_bytes=945716&recv_bytes=17064&delivery_rate=6956371&cwnd=210360&unsent_bytes=0&cid=d446034223c0b9b9&ts=776&x=1", cfHdrFlush;dur=0
date
Tue, 19 Nov 2024 19:11:52 GMT
vary
Accept-Encoding
server
cloudflare
8e52822d1afa3a0b
ledger-hardware-clearsigning.com/cdn-cgi/challenge-platform/h/b/jsd/r/ Frame 7741
0
1 KB
XHR
General
Full URL
https://ledger-hardware-clearsigning.com/cdn-cgi/challenge-platform/h/b/jsd/r/8e52822d1afa3a0b
Requested by
Host: ledger-hardware-clearsigning.com
URL: https://ledger-hardware-clearsigning.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.211.112 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Content-Type
application/json
Referer

Response headers

nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4d1NFTrAEyhXybT4tPvuHoBg7pGt%2FBRWKW98uwr0vTTWuVhV7L1vCi4mN%2F5BJdLUAtWiHPL%2FT3IRPMb5BbLLKoFCmH6c6IeCU5S4pZ43F5FXAvzIGbO96bd%2FKdmqYdBrOdi045XQ4p%2FS2CnJUr6ExorMvQ%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
8e528233dbd33a0b-YYZ
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=26943&sent=817&recv=262&lost=2&retrans=1&sent_bytes=951248&recv_bytes=34713&delivery_rate=112280&cwnd=210360&unsent_bytes=0&cid=d446034223c0b9b9&ts=1155&x=1", cfHdrFlush;dur=0
content-length
0
date
Tue, 19 Nov 2024 19:11:52 GMT
content-type
text/plain; charset=UTF-8
server
cloudflare

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Ledger (Crypto Exchange)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0

3 Cookies

Domain/Path Name / Value
sibautomation.com/ Name: uuid
Value: 1bdc970b-f0b5-45db-9a56-ba6bd2721a0b
.ledger.com/ Name: __cf_bm
Value: K3Uu.cQtYxx9qJzOFdsMCNmovmOo0UF6znphD_jqboQ-1732043512-1.0.1.1-t8sIF4YeV1M0iyHzpukRPnJZiXBSgd_Uoum9VUgC5a1wRpzrhjSqmMpCpIB7InifoSSGBGflcYpIk2myD6EV6g
.ledger-hardware-clearsigning.com/ Name: cf_clearance
Value: _V3dUcrkNMcffMh9vaS2snY93sa1GAbGKe4iagiPUk8-1732043512-1.2.1.1-1_SIhdcbyDtCpQcaxbmgNZ9lZ1lZ4itbILzYXjfgmvedzZ7zoZOOw4I2n_ghmICqxp0pNIodDZccU6riaQewECRLHTyU1Ta0gq4ugSuESeWLJ55twtDcB7C0hsFjO.XOlvIGTgWUtj8xX8gIUK3FlRStiqE9.KCPAHHX.S81HqOjCsdMvTJIOrQaK.3omXLYxo3M29RBqeMhjyFEh5ehIWsvtqKsZvV6iqeXUGU66XrGSvE7A9Fynk73Jj0k1ydJDkbAKLaE8zGEaLCmiEBiomjlktprO2qXlLziv2NHe5RXZpblBonu1AclLRLwLdX9vRifMQVrNrFaX8Y8.jfu0H06K._WnqgYY2dolmJgJOlYniRoKAOFtkaKOu.8vMjE

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff
X-Xss-Protection 1