pub-d78ee496bc1e4aec802a8692c1d9ed2d.r2.dev
Open in
urlscan Pro
104.18.2.35
Malicious Activity!
Public Scan
Effective URL: https://pub-d78ee496bc1e4aec802a8692c1d9ed2d.r2.dev/index.html
Submission: On July 13 via api from US — Scanned from DE
Summary
TLS certificate: Issued by E1 on June 3rd 2024. Valid for: 3 months.
This is the only time pub-d78ee496bc1e4aec802a8692c1d9ed2d.r2.dev was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Cloudflare (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 6 | 104.18.2.35 104.18.2.35 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 192.185.5.85 192.185.5.85 | 19871 (NETWORK-S...) (NETWORK-SOLUTIONS-HOSTING) | |
1 | () () | ||
16 | 188.114.96.9 188.114.96.9 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 104.17.24.14 104.17.24.14 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 152.199.19.160 152.199.19.160 | 15133 (EDGECAST) (EDGECAST) | |
28 | 7 |
ASN19871 (NETWORK-SOLUTIONS-HOSTING, US)
PTR: mail.egyprofme.net
professionaljewelryappraisals.org |
Apex Domain Subdomains |
Transfer | |
---|---|---|
16 |
pages.dev
private-files.pages.dev |
252 KB |
7 |
r2.dev
1 redirects
pub-d78ee496bc1e4aec802a8692c1d9ed2d.r2.dev |
38 KB |
2 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 240 |
11 KB |
2 |
professionaljewelryappraisals.org
professionaljewelryappraisals.org |
501 KB |
1 |
aspnetcdn.com
ajax.aspnetcdn.com — Cisco Umbrella Rank: 2522 |
30 KB |
0 |
truist.com
Failed
dias.bank.truist.com Failed |
|
28 | 6 |
Domain | Requested by | |
---|---|---|
16 | private-files.pages.dev |
pub-d78ee496bc1e4aec802a8692c1d9ed2d.r2.dev
|
7 | pub-d78ee496bc1e4aec802a8692c1d9ed2d.r2.dev |
1 redirects
pub-d78ee496bc1e4aec802a8692c1d9ed2d.r2.dev
professionaljewelryappraisals.org |
2 | cdnjs.cloudflare.com |
pub-d78ee496bc1e4aec802a8692c1d9ed2d.r2.dev
|
2 | professionaljewelryappraisals.org |
pub-d78ee496bc1e4aec802a8692c1d9ed2d.r2.dev
|
1 | ajax.aspnetcdn.com |
pub-d78ee496bc1e4aec802a8692c1d9ed2d.r2.dev
|
0 | dias.bank.truist.com Failed | |
28 | 6 |
This site contains links to these domains. Also see Links.
Domain |
---|
dias.bank.truist.com |
www.nmlsconsumeraccess.org |
www.finra.org |
www.sipc.org |
www.nyc.gov |
www.truist.com |
privacycenter.truist.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.r2.dev E1 |
2024-06-03 - 2024-09-01 |
3 months | crt.sh |
www.profjewelryappraisalsorg.blogfarms.net R3 |
2024-05-24 - 2024-08-22 |
3 months | crt.sh |
private-files.pages.dev WE1 |
2024-07-02 - 2024-09-30 |
3 months | crt.sh |
cdnjs.cloudflare.com E1 |
2024-06-02 - 2024-08-31 |
3 months | crt.sh |
*.vo.msecnd.net DigiCert SHA2 Secure Server CA |
2024-06-06 - 2025-06-06 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://pub-d78ee496bc1e4aec802a8692c1d9ed2d.r2.dev/index.html
Frame ID: D811A4D40F76157F73980B61E5C86D85
Requests: 31 HTTP requests in this frame
Screenshot
Page Title
Truist Online Banking Login | TruistPage URL History Show full URLs
-
http://pub-d78ee496bc1e4aec802a8692c1d9ed2d.r2.dev/index.html
HTTP 307
https://pub-d78ee496bc1e4aec802a8692c1d9ed2d.r2.dev/index.html Page URL
-
https://pub-d78ee496bc1e4aec802a8692c1d9ed2d.r2.dev/cdn-cgi/phish-bypass?atok=6U7zLQ87tuxJh8E9hLjT23IPkCLH7DeSgvtuBYLnfHY-172091...
HTTP 301
https://pub-d78ee496bc1e4aec802a8692c1d9ed2d.r2.dev/index.html Page URL
Detected technologies
WordPress (CMS) ExpandDetected patterns
- /wp-(?:content|includes)/
Font Awesome (Font Scripts) Expand
Detected patterns
- <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
10 Outgoing links
These are links going to different origins than the main page.
Title: Skip to main content
Search URL Search Domain Scan URL
Title: Search the NMLS Registry.
Search URL Search Domain Scan URL
Title: FINRA
Search URL Search Domain Scan URL
Title: SIPC
Search URL Search Domain Scan URL
Title: http://www.nyc.gov/dca
Search URL Search Domain Scan URL
Title: Privacy
Search URL Search Domain Scan URL
Title: Fraud & security
Search URL Search Domain Scan URL
Title: Terms and conditions
Search URL Search Domain Scan URL
Title: Accessibility
Search URL Search Domain Scan URL
Title: Limit use of my sensitive personal information
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://pub-d78ee496bc1e4aec802a8692c1d9ed2d.r2.dev/index.html
HTTP 307
https://pub-d78ee496bc1e4aec802a8692c1d9ed2d.r2.dev/index.html Page URL
-
https://pub-d78ee496bc1e4aec802a8692c1d9ed2d.r2.dev/cdn-cgi/phish-bypass?atok=6U7zLQ87tuxJh8E9hLjT23IPkCLH7DeSgvtuBYLnfHY-1720912997-0.0.1.1-%2Findex.html
HTTP 301
https://pub-d78ee496bc1e4aec802a8692c1d9ed2d.r2.dev/index.html Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://pub-d78ee496bc1e4aec802a8692c1d9ed2d.r2.dev/index.html HTTP 307
- https://pub-d78ee496bc1e4aec802a8692c1d9ed2d.r2.dev/index.html
28 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
index.html
pub-d78ee496bc1e4aec802a8692c1d9ed2d.r2.dev/ Redirect Chain
|
4 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
cf.errors.css
pub-d78ee496bc1e4aec802a8692c1d9ed2d.r2.dev/cdn-cgi/styles/ |
23 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
icon-exclamation.png
pub-d78ee496bc1e4aec802a8692c1d9ed2d.r2.dev/cdn-cgi/images/ |
452 B 889 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
favicon.ico
pub-d78ee496bc1e4aec802a8692c1d9ed2d.r2.dev/ |
27 KB 27 KB |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
index.html
pub-d78ee496bc1e4aec802a8692c1d9ed2d.r2.dev/ Redirect Chain
|
641 B 950 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.js
professionaljewelryappraisals.org/wp-includes/js/plupload/ase/ |
284 KB 108 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
basic.js
professionaljewelryappraisals.org/wp-includes/js/plupload/ase/ |
1015 KB 392 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET BLOB |
ec537a4a-238d-46ac-9833-56952784e1fc
https://pub-d78ee496bc1e4aec802a8692c1d9ed2d.r2.dev/ |
761 KB 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
styles.adbfad066c51a6c7.css
private-files.pages.dev/css/ |
73 KB 10 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
styles.css
private-files.pages.dev/css/ |
82 KB 10 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
styles_r.css
private-files.pages.dev/css/ |
129 KB 18 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
main.css
private-files.pages.dev/css/ |
92 KB 12 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
font-awesome.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/ |
30 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
AppMeasurement.min.js
private-files.pages.dev/css/ |
0 0 |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
AppMeasurement_Module_AudienceManagement.min.js
private-files.pages.dev/css/ |
0 0 |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
truist_common.js
private-files.pages.dev/css/ |
0 0 |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
css2.css
private-files.pages.dev/css/ |
372 KB 165 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
enjoy-cash-card-dias-login.png
private-files.pages.dev/css/ |
31 KB 32 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
trulogo_horz-trupurple.png
private-files.pages.dev/css/ |
4 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
qr_icon.svg
private-files.pages.dev/css/ |
2 KB 997 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
runtime.f12afbbe1a4afce3.js
private-files.pages.dev/css/ |
0 0 |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
polyfills.87d6b856162b755f.js
private-files.pages.dev/css/ |
0 0 |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
scripts.fcf8c3fbc6b0ae83.js
private-files.pages.dev/css/ |
0 0 |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
main.caa77d392702ccb5.js
private-files.pages.dev/css/ |
0 0 |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.3.1.min.js
ajax.aspnetcdn.com/ajax/jQuery/ |
85 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
jquery.mask.js
cdnjs.cloudflare.com/ajax/libs/jquery.mask/1.14.10/ |
20 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
styles.adbfad066c51a6c7.css
private-files.pages.dev/css/ |
73 KB 418 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
38 KB 0 |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
25 KB 25 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
26 KB 26 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
favicon.ico
dias.bank.truist.com/ui/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- dias.bank.truist.com
- URL
- https://dias.bank.truist.com/ui/favicon.ico
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Cloudflare (Online)2 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.pub-d78ee496bc1e4aec802a8692c1d9ed2d.r2.dev/ | Name: __cf_mw_byp Value: 6U7zLQ87tuxJh8E9hLjT23IPkCLH7DeSgvtuBYLnfHY-1720912997-0.0.1.1-/index.html |
8 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Frame-Options | SAMEORIGIN |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.aspnetcdn.com
cdnjs.cloudflare.com
dias.bank.truist.com
private-files.pages.dev
professionaljewelryappraisals.org
pub-d78ee496bc1e4aec802a8692c1d9ed2d.r2.dev
dias.bank.truist.com
104.17.24.14
104.18.2.35
152.199.19.160
188.114.96.9
192.185.5.85
03f09326e2b5bdd34a3a5b6bb0a8790cda3bfd8f3c5debc31d7dec89aae9b3a5
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
21e7ca53da5ff702c952bd2c87475aebc3565fdb747ebf75614c897b1e6a1aa9
24a362fd7a9fcd02be58853dbcbfed04ce7313a2f4adc3550c1c20d886ee13cd
292117c507b8edd48ff90aaf02b20fe0261e5b0af9aefe1bf5719a7effc8edcb
39232c655cad4bb1e600532f060c13e262aa6c0106d5a9f004699403f306fe65
49bc3f6b96f584ba4567cf4e882da603c4ab12a72e6370ea1a240f46e8dec2e4
5e3d5246b17e19e65385092db07554d8e1c5c4a226a6d7f97824b8e1e8571e34
78e78cb91ca4f330e027abf9a86a342f5e4fe581fea832eaab3d4f7261d83113
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
84e3c77025ace5af143972b4a40fc834dcdfd4e449d4b36a57e62326f16b3091
9eb52ee46c7ab5ea4ca0982415da99fded1b7d7354f75e50847bdae6cb44eb66
a72e3fb28a4327b30af65a0dd626432bdba64029ff71465c1d25adde2a289caa
ab3342c99251d9e6621995b739df56e5ba208934399a4d9a7f4722e0b16aefa2
b709c93c65d65ec11c869eb23ced8f7fb047cfed3d2ff180fe9e58725880e129
be2d555966f77b52878ef3c30e4d2fe8333f14c86b607209e16708280948ad43
be483938eb34538b970684f72e312f62652e84b42b7ad86953962d1ce2217c44
d2e2e20fc9729fb0389392bde5a8fd1b4cb390dd8689ce7a1c3fe83cc91b0d52
e6184bd0d4f6adf2dc1e02c63191fd624bc72c282f1e5d8ccf2fbc923e642b6b
f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016
f1ee49cf6e558df441898529fac9c3c4a7df434a00efef9e564356d7ed4f4570
f2a84bc4f4cb8ae04162f42f1f3ebed1e05725d9b5bf666b885356c7698a071f