ledger-clearsign-updates.com Open in urlscan Pro
188.114.97.3  Malicious Activity! Public Scan

URL: https://ledger-clearsign-updates.com/
Submission Tags: falconsandbox
Submission: On December 19 via api from US — Scanned from NL

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 8 HTTP transactions. The main IP is 188.114.97.3, located in Amsterdam, Netherlands and belongs to CLOUDFLARENET, US. The main domain is ledger-clearsign-updates.com.
TLS certificate: Issued by WE1 on December 19th 2024. Valid for: 3 months.
This is the only time ledger-clearsign-updates.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Ledger (Crypto Exchange)

Domain & IP information

IP Address AS Autonomous System
2 9 188.114.97.3 13335 (CLOUDFLAR...)
8 2
Apex Domain
Subdomains
Transfer
9 ledger-clearsign-updates.com
ledger-clearsign-updates.com
912 KB
0 clearsigning-ledger.com Failed
clearsigning-ledger.com Failed
8 2
Domain Requested by
9 ledger-clearsign-updates.com 2 redirects ledger-clearsign-updates.com
0 clearsigning-ledger.com Failed ledger-clearsign-updates.com
8 2

This site contains links to these domains. Also see Links.

Domain
developers.ledger.com
www.ledger.com
shop.ledger.com
Subject Issuer Validity Valid
ledger-clearsign-updates.com
WE1
2024-12-19 -
2025-03-19
3 months crt.sh

This page contains 3 frames:

Primary Page: https://ledger-clearsign-updates.com/
Frame ID: 9593BDA0E867E4F00D306929B20F1786
Requests: 5 HTTP requests in this frame

Frame: https://ledger-clearsign-updates.com/clearsigning-ledger.com_files/saved_resource.html
Frame ID: D52231ABFDADA5791B70646C129CC70A
Requests: 3 HTTP requests in this frame

Frame: https://ledger-clearsign-updates.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/787bc399e22f/main.js
Frame ID: CF118D85D0F21BF77CC15B450E864E48
Requests: 1 HTTP requests in this frame

Screenshot


Page Statistics

8
Requests

63 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

911 kB
Transfer

1188 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 5
  • https://ledger-clearsign-updates.com/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
  • https://ledger-clearsign-updates.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/787bc399e22f/main.js
Request Chain 7
  • https://ledger-clearsign-updates.com/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
  • https://ledger-clearsign-updates.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/787bc399e22f/main.js

8 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
ledger-clearsign-updates.com/
20 KB
8 KB
Document
General
Full URL
https://ledger-clearsign-updates.com/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PleskLin
Resource Hash
b95e051046c1ab21917645321fcb89298a5240a158ac67f3e52c3df8ab988887

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
8f4a49e06ea3b93f-AMS
content-encoding
zstd
content-type
text/html
date
Thu, 19 Dec 2024 20:54:34 GMT
last-modified
Sat, 19 Oct 2024 13:36:14 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
priority
u=0,i
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BIbg9xILmrDTujUe86tBSybOe8gDL9zElrRJqVp77EmJKwFL00VwXieOlrdUH2bZC%2F3HQ%2FKvwB5g1xQ%2FldA1wtGIL2RahS5pmMggxjxRNbBX6Lb5ofDoLIVpRcclcyO%2BHB%2FWqhEuE2Vhrf%2BHVjpm"}],"group":"cf-nel","max_age":604800}
server
cloudflare
server-timing
cfL4;desc="?proto=QUIC&rtt=15584&min_rtt=15452&rtt_var=3485&sent=13&recv=9&lost=0&retrans=0&sent_bytes=4207&recv_bytes=4446&delivery_rate=36112&cwnd=12000&unsent_bytes=0&cid=f597bb8ab3725507&ts=78&x=1" cfExtPri cfHdrFlush;dur=0
vary
accept-encoding
x-powered-by
PleskLin
all.css
ledger-clearsign-updates.com/clearsigning-ledger.com_files/
515 KB
263 KB
Stylesheet
General
Full URL
https://ledger-clearsign-updates.com/clearsigning-ledger.com_files/all.css
Requested by
Host: ledger-clearsign-updates.com
URL: https://ledger-clearsign-updates.com/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PleskLin
Resource Hash
a8cf7bc0a4641b5f83e90603ed32ea9c856c97eb331285cdc8c93d7997e263b6

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://ledger-clearsign-updates.com/

Response headers

content-encoding
zstd
cf-cache-status
HIT
etag
W/"6713b5e0-80cbe"
age
60
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VKNNxcNVGjyPLnCFip0nCGMepkh6PmeC0kOupAq3r7bXtEZgDnKxSe8SxHev%2FuHZ4dq9ILUIVlTt8tLjmlqUrsA41V5TPoEsPhJVmmvdSS4EZcWHR4wZoeDczzNV4S5p2RBSGh544VhNsjXAtKYX"}],"group":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=15298&min_rtt=14767&rtt_var=1277&sent=32&recv=16&lost=0&retrans=0&sent_bytes=24285&recv_bytes=5682&delivery_rate=197361&cwnd=12000&unsent_bytes=0&cid=f597bb8ab3725507&ts=110&x=1", cfExtPri, cfHdrFlush;dur=14
date
Thu, 19 Dec 2024 20:54:34 GMT
content-type
text/css
last-modified
Sat, 19 Oct 2024 13:36:32 GMT
vary
Accept-Encoding
priority
u=0,i=?0
cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
8f4a49e0eefcb93f-AMS
x-powered-by
PleskLin
server
cloudflare
Recover-X-coincover.png
ledger-clearsign-updates.com/clearsigning-ledger.com_files/
6 KB
7 KB
Image
General
Full URL
https://ledger-clearsign-updates.com/clearsigning-ledger.com_files/Recover-X-coincover.png
Requested by
Host: ledger-clearsign-updates.com
URL: https://ledger-clearsign-updates.com/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PleskLin
Resource Hash
44091e09c3c31ad5fe888494acdf8d6473ff5dd267eddb2bef7f0bc07d6e41bc

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

cf-cache-status
HIT
etag
"6713b5e2-19d8"
age
60
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qtfkPVJOWgYxxA%2F77zKxzU6E87ZiTntyIvbujU5p7EK3BVL3YFEkLioLysUmkdxa1ASDE7QH7p6f9iAFAdkn0ieS6ac8y8dev9mpKM2gKEN0AoDzk0yBHvV%2FXVPhsskNhRNTJClcoJGwx2LVPb0e"}],"group":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=15298&min_rtt=14767&rtt_var=1277&sent=21&recv=16&lost=0&retrans=0&sent_bytes=12285&recv_bytes=5682&delivery_rate=197361&cwnd=12000&unsent_bytes=0&cid=f597bb8ab3725507&ts=109&x=1", cfExtPri, cfHdrFlush;dur=0
date
Thu, 19 Dec 2024 20:54:34 GMT
content-type
image/png
last-modified
Sat, 19 Oct 2024 13:36:34 GMT
vary
Accept-Encoding
priority
u=2,i
cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
8f4a49e0eefeb93f-AMS
accept-ranges
bytes
content-length
6616
x-powered-by
PleskLin
server
cloudflare
rcv.png
ledger-clearsign-updates.com/clearsigning-ledger.com_files/
627 KB
628 KB
Image
General
Full URL
https://ledger-clearsign-updates.com/clearsigning-ledger.com_files/rcv.png
Requested by
Host: ledger-clearsign-updates.com
URL: https://ledger-clearsign-updates.com/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PleskLin
Resource Hash
3897ab7614a8854eec84bd75838fa6e257b4d59f8af84c911ab8cf174b39b19a

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

cf-cache-status
HIT
etag
"6713b5e2-9caf1"
age
60
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4qEWlbQcSRXYgeyG9Fa0PE5Hsl5i0Uwdxg69rn7krFaPwHaCoTzOuQs%2FT0syXLoTzNJzaTBlmKeoCljbJgTNPY6KCA0pkAEUabTsW0XLu0uumvSy285J2hN7qIHbXYTZT3NbW7bAwQeotG4zheTK"}],"group":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=15298&min_rtt=14767&rtt_var=1277&sent=28&recv=16&lost=0&retrans=0&sent_bytes=19768&recv_bytes=5682&delivery_rate=197361&cwnd=12000&unsent_bytes=0&cid=f597bb8ab3725507&ts=110&x=1", cfExtPri, cfHdrFlush;dur=0
date
Thu, 19 Dec 2024 20:54:34 GMT
content-type
image/png
last-modified
Sat, 19 Oct 2024 13:36:34 GMT
vary
Accept-Encoding
priority
u=2,i
cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
8f4a49e0ef00b93f-AMS
accept-ranges
bytes
content-length
641777
x-powered-by
PleskLin
server
cloudflare
truncated
/
2 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
24859811f0d8052e5979a146e00930a379b14745e480f40b20f1d9ccd79b99e0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/svg+xml
saved_resource.html
ledger-clearsign-updates.com/clearsigning-ledger.com_files/ Frame D522
506 B
1 KB
Document
General
Full URL
https://ledger-clearsign-updates.com/clearsigning-ledger.com_files/saved_resource.html
Requested by
Host: ledger-clearsign-updates.com
URL: https://ledger-clearsign-updates.com/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PleskLin
Resource Hash
47884d2867f1b2ac0033b8aa2ad10fc40155e6d5267098570c66ed250c90c874

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
8f4a49e1cfbfb93f-AMS
content-encoding
zstd
content-type
text/html
date
Thu, 19 Dec 2024 20:54:34 GMT
last-modified
Sat, 19 Oct 2024 13:36:26 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
priority
u=0,i
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=192cxWW2QaICkTA2PVSBs4HDy8zASKDhyL9IiK6pHRyk%2FbkoUH0QvXGz%2BZKnoubdHagnSDcNNFgAV77VOFbzHJ888GlLVxF7oT%2FhZ%2BoFhJ1U0YTl2d%2FnvGKAB17aJR2kgNW1VMurIN5nfbh4pIm0"}],"group":"cf-nel","max_age":604800}
server
cloudflare
server-timing
cfL4;desc="?proto=QUIC&rtt=16435&min_rtt=14767&rtt_var=289&sent=815&recv=132&lost=0&retrans=0&sent_bytes=953177&recv_bytes=11473&delivery_rate=19732863&cwnd=429600&unsent_bytes=0&cid=f597bb8ab3725507&ts=267&x=1" cfExtPri cfHdrFlush;dur=0
vary
Accept-Encoding
x-accel-version
0.01
x-powered-by
PleskLin
main.js
ledger-clearsign-updates.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/787bc399e22f/ Frame CF11
Redirect Chain
  • https://ledger-clearsign-updates.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
  • https://ledger-clearsign-updates.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/787bc399e22f/main.js?
9 KB
5 KB
Script
General
Full URL
https://ledger-clearsign-updates.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/787bc399e22f/main.js?
Requested by
Host: ledger-clearsign-updates.com
URL: https://ledger-clearsign-updates.com/
Protocol
H3
Server
188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f9199209261552dd5bb07ce356ec5c1bb70c8572f43153229af5d99e1a5b7140
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

cache-control
max-age=14400, stale-if-error=10800, stale-while-revalidate=10800, public
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
zstd
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mtnppZEOPc84qsCifXglm3BulqMCtIDIvoMt8mYxrRMLIKeG6sst%2Ff2ERjE24kcgK6JT8%2B2oPG17mWjFtfqjdQM5v%2F%2BpKIRIhYAIgR89fHukfkrXGbTRssuI0At0vF17%2BsT8gDPrIcCA9j2aBSiF"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
cf-ray
8f4a49e20ffeb93f-AMS
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=16108&min_rtt=14767&rtt_var=726&sent=818&recv=135&lost=0&retrans=0&sent_bytes=954322&recv_bytes=11855&delivery_rate=47211&cwnd=429600&unsent_bytes=0&cid=f597bb8ab3725507&ts=287&x=1", cfExtPri, cfHdrFlush;dur=0
date
Thu, 19 Dec 2024 20:54:34 GMT
content-type
application/javascript; charset=UTF-8
vary
Accept-Encoding
server
cloudflare
priority
u=3,i=?0

Redirect headers

cache-control
max-age=300, stale-if-error=10800, stale-while-revalidate=10800, public
location
/cdn-cgi/challenge-platform/h/b/scripts/jsd/787bc399e22f/main.js?
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RoGoDt0nVUmSAnK2J%2ByowjkQLprlcP72%2FbgK1Q5S1kGcyFaSwd32ARhNtKAMFBHeYeNi7BiCnx6aWPPHMoAO7%2FmNYG8S8vJbxWOQ0rnYoYVmaSuyzQAj24fYhn9jz%2BuUQPW54ut9enSrrDB02PCK"}],"group":"cf-nel","max_age":604800}
cf-ray
8f4a49e1dfd8b93f-AMS
access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
content-length
0
server-timing
cfL4;desc="?proto=QUIC&rtt=16435&min_rtt=14767&rtt_var=289&sent=814&recv=132&lost=0&retrans=0&sent_bytes=952439&recv_bytes=11473&delivery_rate=19732863&cwnd=429600&unsent_bytes=0&cid=f597bb8ab3725507&ts=259&x=1", cfExtPri, cfHdrFlush;dur=0
date
Thu, 19 Dec 2024 20:54:34 GMT
vary
Accept-Encoding
server
cloudflare
priority
u=3,i=?0
main.js
clearsigning-ledger.com/cdn-cgi/challenge-platform/scripts/jsd/ Frame D522
0
0

main.js
ledger-clearsign-updates.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/787bc399e22f/ Frame D522
Redirect Chain
  • https://ledger-clearsign-updates.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
  • https://ledger-clearsign-updates.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/787bc399e22f/main.js?
9 KB
0
Script
General
Full URL
https://ledger-clearsign-updates.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/787bc399e22f/main.js?
Requested by
Host: ledger-clearsign-updates.com
URL: https://ledger-clearsign-updates.com/clearsigning-ledger.com_files/saved_resource.html
Protocol
H3
Server
188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f9199209261552dd5bb07ce356ec5c1bb70c8572f43153229af5d99e1a5b7140
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://ledger-clearsign-updates.com/clearsigning-ledger.com_files/saved_resource.html

Response headers

cache-control
max-age=14400, stale-if-error=10800, stale-while-revalidate=10800, public
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
zstd
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mtnppZEOPc84qsCifXglm3BulqMCtIDIvoMt8mYxrRMLIKeG6sst%2Ff2ERjE24kcgK6JT8%2B2oPG17mWjFtfqjdQM5v%2F%2BpKIRIhYAIgR89fHukfkrXGbTRssuI0At0vF17%2BsT8gDPrIcCA9j2aBSiF"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
cf-ray
8f4a49e20ffeb93f-AMS
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=16108&min_rtt=14767&rtt_var=726&sent=818&recv=135&lost=0&retrans=0&sent_bytes=954322&recv_bytes=11855&delivery_rate=47211&cwnd=429600&unsent_bytes=0&cid=f597bb8ab3725507&ts=287&x=1", cfExtPri, cfHdrFlush;dur=0
date
Thu, 19 Dec 2024 20:54:34 GMT
content-type
application/javascript; charset=UTF-8
vary
Accept-Encoding
server
cloudflare
priority
u=3,i=?0

Redirect headers

cache-control
max-age=300, stale-if-error=10800, stale-while-revalidate=10800, public
location
/cdn-cgi/challenge-platform/h/b/scripts/jsd/787bc399e22f/main.js?
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RoGoDt0nVUmSAnK2J%2ByowjkQLprlcP72%2FbgK1Q5S1kGcyFaSwd32ARhNtKAMFBHeYeNi7BiCnx6aWPPHMoAO7%2FmNYG8S8vJbxWOQ0rnYoYVmaSuyzQAj24fYhn9jz%2BuUQPW54ut9enSrrDB02PCK"}],"group":"cf-nel","max_age":604800}
cf-ray
8f4a49e1dfd8b93f-AMS
access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
content-length
0
server-timing
cfL4;desc="?proto=QUIC&rtt=16435&min_rtt=14767&rtt_var=289&sent=814&recv=132&lost=0&retrans=0&sent_bytes=952439&recv_bytes=11473&delivery_rate=19732863&cwnd=429600&unsent_bytes=0&cid=f597bb8ab3725507&ts=259&x=1", cfExtPri, cfHdrFlush;dur=0
date
Thu, 19 Dec 2024 20:54:34 GMT
vary
Accept-Encoding
server
cloudflare
priority
u=3,i=?0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
clearsigning-ledger.com
URL
https://clearsigning-ledger.com/cdn-cgi/challenge-platform/scripts/jsd/main.js

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Ledger (Crypto Exchange)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1

0 Cookies