pub-262f714d04e74664b859b1717330a4de.r2.dev Open in urlscan Pro
104.18.2.35 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://er.lgyb1.shop/
Effective URL:
https://pub-262f714d04e74664b859b1717330a4de.r2.dev/vendorupdate.html
Submission: On August 15 via api (August 15th 2024, 10:57:22 pm UTC) from US — Scanned from IT

Summary HTTP 20 Redirects Behaviour Indicators

Summary

This website contacted 8 IPs in 5 countries across 10 domains to perform 20 HTTP transactions. The main IP is 104.18.2.35, located in and belongs to CLOUDFLARENET, US. The main domain is pub-262f714d04e74664b859b1717330a4de.r2.dev.
TLS certificate: Issued by E6 on August 1st 2024. Valid for: 3 months.

This is the only time pub-262f714d04e74664b859b1717330a4de.r2.dev was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Email (Online) Adobe (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
1 1	77.237.235.224 77.237.235.224	51167 (CONTABO) (CONTABO)
4	104.18.2.35 104.18.2.35	13335 (CLOUDFLAR...) (CLOUDFLARENET)
7	104.18.24.163 104.18.24.163	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	185.15.59.240 185.15.59.240	14907 (WIKIMEDIA) (WIKIMEDIA)
1	151.101.2.137 151.101.2.137	54113 (FASTLY) (FASTLY)
1	104.17.24.14 104.17.24.14	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	104.18.10.207 104.18.10.207	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	142.250.185.234 142.250.185.234	15169 (GOOGLE) (GOOGLE)
20	8

1 77.237.235.224 (Germany) 1 redirects

ASN51167 (CONTABO, DE)
PTR: vmi2077148.contaboserver.net

er.lgyb1.shop	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 104.18.2.35 (None, )

ASN13335 (CLOUDFLARENET, US)

pub-262f714d04e74664b859b1717330a4de.r2.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 104.18.24.163 (None, )

ASN13335 (CLOUDFLARENET, US)

i.gyazo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.15.59.240 (United States)

ASN14907 (WIKIMEDIA, US)
PTR: upload-lb.esams.wikimedia.org

upload.wikimedia.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.2.137 (San Francisco, United States)

ASN54113 (FASTLY, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.17.24.14 (None, )

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.18.10.207 (None, )

ASN13335 (CLOUDFLARENET, US)

maxcdn.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
stackpath.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.234 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s53-in-f10.1e100.net

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	gyazo.com i.gyazo.com — Cisco Umbrella Rank: 71931	431 KB
4	r2.dev pub-262f714d04e74664b859b1717330a4de.r2.dev	37 KB
2	bootstrapcdn.com maxcdn.bootstrapcdn.com — Cisco Umbrella Rank: 1832 stackpath.bootstrapcdn.com — Cisco Umbrella Rank: 4508	31 KB
1	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 641	30 KB
1	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 336	7 KB
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 1211	24 KB
1	wikimedia.org upload.wikimedia.org — Cisco Umbrella Rank: 4162	6 KB
1	lgyb1.shop 1 redirects er.lgyb1.shop	290 B
0	microsoft.com Failed learn.microsoft.com — Cisco Umbrella Rank: 20571 Failed
0	keycdn.com Failed opensource.keycdn.com Failed
20	10

	Domain	Requested by
7	i.gyazo.com	pub-262f714d04e74664b859b1717330a4de.r2.dev
4	pub-262f714d04e74664b859b1717330a4de.r2.dev	pub-262f714d04e74664b859b1717330a4de.r2.dev
1	stackpath.bootstrapcdn.com	pub-262f714d04e74664b859b1717330a4de.r2.dev
1	ajax.googleapis.com	pub-262f714d04e74664b859b1717330a4de.r2.dev
1	maxcdn.bootstrapcdn.com	pub-262f714d04e74664b859b1717330a4de.r2.dev
1	cdnjs.cloudflare.com	pub-262f714d04e74664b859b1717330a4de.r2.dev
1	code.jquery.com	pub-262f714d04e74664b859b1717330a4de.r2.dev
1	upload.wikimedia.org	pub-262f714d04e74664b859b1717330a4de.r2.dev
1	er.lgyb1.shop	1 redirects
0	learn.microsoft.com Failed
0	opensource.keycdn.com Failed	pub-262f714d04e74664b859b1717330a4de.r2.dev
20	11

This site contains no links.

Subject Issuer	Validity	Valid
*.r2.dev E6	`2024-08-01` - `2024-10-30`	3 months	crt.sh
gyazo.com WE1	`2024-07-30` - `2024-10-28`	3 months	crt.sh
*.wikipedia.org DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2023-10-18` - `2024-10-16`	a year	crt.sh
*.jquery.com Sectigo ECC Domain Validation Secure Server CA	`2024-06-25` - `2025-06-25`	a year	crt.sh
cdnjs.cloudflare.com WE1	`2024-07-31` - `2024-10-29`	3 months	crt.sh
bootstrapcdn.com WE1	`2024-07-23` - `2024-10-21`	3 months	crt.sh
upload.video.google.com WR2	`2024-07-30` - `2024-10-22`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://pub-262f714d04e74664b859b1717330a4de.r2.dev/vendorupdate.html
Frame ID: 068A1FF378F305744F597399E291E38B
Requests: 20 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Adobe

Page URL History Show full URLs

https://er.lgyb1.shop/ HTTP 301
https://pub-262f714d04e74664b859b1717330a4de.r2.dev/vendorupdate.html Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Popper (Miscellaneous) Expand

Overall confidence: 100%
Detected patterns

/popper\.js/([0-9.]+)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

20
Requests

85 %
HTTPS

0 %
IPv6

10
Domains

11
Subdomains

8
IPs

5
Countries

565 kB
Transfer

739 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://er.lgyb1.shop/ HTTP 301
https://pub-262f714d04e74664b859b1717330a4de.r2.dev/vendorupdate.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 17

https://docs.com/1673155405_Images/favicon.ico HTTP 301
https://www.docs.com/1673155405_Images/favicon.ico HTTP 301
https://learn.microsoft.com/ HTTP 302
https://learn.microsoft.com/it-it/

Request Chain 18

https://docs.com/1673155405_Images/favicon.ico HTTP 301
https://www.docs.com/1673155405_Images/favicon.ico HTTP 301
https://learn.microsoft.com/

20 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request vendorupdate.html Show response
pub-262f714d04e74664b859b1717330a4de.r2.dev/
Redirect Chain

https://er.lgyb1.shop/
https://pub-262f714d04e74664b859b1717330a4de.r2.dev/vendorupdate.html

27 KB
27 KB

803ms
114ms

Document
text/html

104.18.2.35
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://pub-262f714d04e74664b859b1717330a4de.r2.dev/vendorupdate.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.2.35 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b4e69a741ce321048d31f860201d1312b9fe88db6fe027f0534a5e72bc4ea7a4

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Accept-Ranges: bytes
CF-RAY: 8b3cc85f59ef59dd-MXP
Connection: keep-alive
Content-Length: 27835
Content-Type: text/html
Date: Thu, 15 Aug 2024 22:57:16 GMT
ETag: "3e4da3a0460b9c16c656e3d08c27e149"
Last-Modified: Thu, 15 Aug 2024 14:21:32 GMT
Server: cloudflare
Vary: Accept-Encoding

Redirect headers

Connection: Keep-Alive
Content-Length: 277
Content-Type: text/html; charset=iso-8859-1
Date: Thu, 15 Aug 2024 22:57:15 GMT
Keep-Alive: timeout=5, max=100
Location: https://pub-262f714d04e74664b859b1717330a4de.r2.dev/vendorupdate.html
Server: Apache

GET font-awesome.min.css
opensource.keycdn.com/fontawesome/4.6.3/ 0
0

GET
H2 200 2e6a7c17a90b17b5ff2019543193b4e9.jpg
i.gyazo.com/ 5 KB
5 KB 551ms
119ms Image
image/jpeg 104.18.24.163
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.gyazo.com/2e6a7c17a90b17b5ff2019543193b4e9.jpg
Requested by: Host: pub-262f714d04e74664b859b1717330a4de.r2.dev
URL: https://pub-262f714d04e74664b859b1717330a4de.r2.dev/vendorupdate.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.24.163 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2f71bea7601b970d07eea91af38bcee8b1c9fc197b5f85cbe9bae3b9f2b705c5

Request headers

Referer: https://pub-262f714d04e74664b859b1717330a4de.r2.dev/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 15 Aug 2024 22:57:17 GMT
via: 1.1 google
cf-cache-status: HIT
age: 26729
content-length: 4687
cf-bgj: h2pri
server: cloudflare
etag: "2e6a"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: https://gyazo.com
cache-control: public, max-age=31536000
access-control-allow-credentials: true
x-cache-level: ZS
accept-ranges: bytes
cf-ray: 8b3cc8632dcc0e4d-MXP
expires: Fri, 15 Aug 2025 22:57:17 GMT

GET
H2 200 200px-AOL_Eraser.svg.png
upload.wikimedia.org/wikipedia/commons/thumb/a/a2/AOL_Eraser.svg/ 5 KB
6 KB 575ms
77ms Image
image/png 185.15.59.240
WIKIMEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://upload.wikimedia.org/wikipedia/commons/thumb/a/a2/AOL_Eraser.svg/200px-AOL_Eraser.svg.png

Requested by

Host: pub-262f714d04e74664b859b1717330a4de.r2.dev
URL: https://pub-262f714d04e74664b859b1717330a4de.r2.dev/vendorupdate.html

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

185.15.59.240 , United States, ASN14907 (WIKIMEDIA, US),

Reverse DNS

upload-lb.esams.wikimedia.org

Software

envoy /

Resource Hash

1137cadbe746090853f7d2fb7ac45fb577193ea2560d6cdf29af273d6515c3b3

Security Headers

Name	Value
Strict-Transport-Security	max-age=106384710; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://pub-262f714d04e74664b859b1717330a4de.r2.dev/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 15 Aug 2024 07:25:06 GMT
strict-transport-security: max-age=106384710; includeSubDomains; preload
x-content-type-options: nosniff
nel: { "report_to": "wm_nel", "max_age": 604800, "failure_fraction": 0.05, "success_fraction": 0.0}
age: 55932
x-cache-status: hit-local
x-cache: cp3074 hit, cp3074 miss
content-disposition: inline;filename*=UTF-8''AOL_Eraser.svg.png
server-timing: cache;desc="hit-local", host;desc="cp3074"
content-length: 5124
x-client-ip: 185.198.62.147
last-modified: Sat, 20 Jul 2024 18:46:36 GMT
server: envoy
etag: 1bd8b473b9b7e52a9c7c990896b001b3
report-to: { "group": "wm_nel", "max_age": 604800, "endpoints": [{ "url": "https://intake-logging.wikimedia.org/v1/events?stream=w3c.reportingapi.network_error&schema_uri=/w3c/reportingapi/network_error/1.0.0" }] }
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Age, Date, Content-Length, Content-Range, X-Content-Duration, X-Cache
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 060e9d726f9bb555eb94f15474b6fd65.png
i.gyazo.com/ 2 KB
2 KB 753ms
321ms Image
image/png 104.18.24.163
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.gyazo.com/060e9d726f9bb555eb94f15474b6fd65.png
Requested by: Host: pub-262f714d04e74664b859b1717330a4de.r2.dev
URL: https://pub-262f714d04e74664b859b1717330a4de.r2.dev/vendorupdate.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.24.163 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 150635dc2c0d83b291bca970628370ff2a04c760c3bb7c1ff52aee296b6287d5

Request headers

Referer: https://pub-262f714d04e74664b859b1717330a4de.r2.dev/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 15 Aug 2024 22:57:17 GMT
via: 1.1 google
cf-cache-status: HIT
server: cloudflare
etag: "060e"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: https://gyazo.com
cache-control: public, max-age=31536000
access-control-allow-credentials: true
x-cache-level: ZS
accept-ranges: bytes
cf-ray: 8b3cc8632dce0e4d-MXP
content-length: 2079
expires: Fri, 15 Aug 2025 22:57:17 GMT

GET
H2 200 8b09deab09d58e1261bbb6cbc5e89559.jpg
i.gyazo.com/ 14 KB
14 KB 538ms
106ms Image
image/jpeg 104.18.24.163
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.gyazo.com/8b09deab09d58e1261bbb6cbc5e89559.jpg
Requested by: Host: pub-262f714d04e74664b859b1717330a4de.r2.dev
URL: https://pub-262f714d04e74664b859b1717330a4de.r2.dev/vendorupdate.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.24.163 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0cf605381ef8acee469f427fb203acf2e5fedf6056208215be170bf7421e3433

Request headers

Referer: https://pub-262f714d04e74664b859b1717330a4de.r2.dev/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 15 Aug 2024 22:57:17 GMT
via: 1.1 google
cf-cache-status: HIT
age: 26729
content-length: 14024
cf-bgj: h2pri
server: cloudflare
etag: "8b09"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: https://gyazo.com
cache-control: public, max-age=31536000
access-control-allow-credentials: true
x-cache-level: ZS
accept-ranges: bytes
cf-ray: 8b3cc8632dca0e4d-MXP
expires: Fri, 15 Aug 2025 22:57:17 GMT

GET
H2 200 1cd4efa81de96d9776b7cdb887745acf.gif
i.gyazo.com/ 6 KB
6 KB 580ms
148ms Image
image/gif 104.18.24.163
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.gyazo.com/1cd4efa81de96d9776b7cdb887745acf.gif
Requested by: Host: pub-262f714d04e74664b859b1717330a4de.r2.dev
URL: https://pub-262f714d04e74664b859b1717330a4de.r2.dev/vendorupdate.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.24.163 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b7ead6c56b3245b1bc31fff1b4c97e4e0190dae25116d9f04dcaca0ae8b30f4a

Request headers

Referer: https://pub-262f714d04e74664b859b1717330a4de.r2.dev/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 15 Aug 2024 22:57:17 GMT
via: 1.1 google
cf-cache-status: HIT
server: cloudflare
age: 26729
etag: "1cd4"
vary: Accept-Encoding
content-type: image/gif
access-control-allow-origin: https://gyazo.com
cache-control: public, max-age=31536000
access-control-allow-credentials: true
accept-ranges: bytes
cf-ray: 8b3cc8632dc90e4d-MXP
content-length: 6210
expires: Fri, 15 Aug 2025 22:57:17 GMT

GET
H2 200 c2bddd4e69aba81bcf138fa9028df5fb.png
i.gyazo.com/ 12 KB
13 KB 502ms
72ms Image
image/png 104.18.24.163
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.gyazo.com/c2bddd4e69aba81bcf138fa9028df5fb.png
Requested by: Host: pub-262f714d04e74664b859b1717330a4de.r2.dev
URL: https://pub-262f714d04e74664b859b1717330a4de.r2.dev/vendorupdate.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.24.163 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 91a90597b2e95f89fdcef1fb71c3eef1dd6a9e849ccd4a68dae3a94ceb8a7c8b

Request headers

Referer: https://pub-262f714d04e74664b859b1717330a4de.r2.dev/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 15 Aug 2024 22:57:17 GMT
via: 1.1 google
cf-cache-status: HIT
age: 26729
content-length: 12787
server: cloudflare
etag: "c2bd"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: https://gyazo.com
cache-control: public, max-age=31536000
access-control-allow-credentials: true
x-cache-level: ZS
accept-ranges: bytes
cf-ray: 8b3cc8632dc80e4d-MXP
expires: Fri, 15 Aug 2025 22:57:17 GMT

GET
H2 200 8922f8c4f3b73b259c84ee57c2dec1ee.png
i.gyazo.com/ 16 KB
16 KB 522ms
92ms Image
image/png 104.18.24.163
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.gyazo.com/8922f8c4f3b73b259c84ee57c2dec1ee.png
Requested by: Host: pub-262f714d04e74664b859b1717330a4de.r2.dev
URL: https://pub-262f714d04e74664b859b1717330a4de.r2.dev/vendorupdate.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.24.163 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3f028b5949911c652f1ac727f5c2c8e30d7ae79a7de47a6e392a15073fa18f56

Request headers

Referer: https://pub-262f714d04e74664b859b1717330a4de.r2.dev/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 15 Aug 2024 22:57:17 GMT
via: 1.1 google
cf-cache-status: HIT
age: 26729
content-length: 16053
server: cloudflare
etag: "8922"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: https://gyazo.com
cache-control: public, max-age=31536000
access-control-allow-credentials: true
x-cache-level: ZS
accept-ranges: bytes
cf-ray: 8b3cc8632dcb0e4d-MXP
expires: Fri, 15 Aug 2025 22:57:17 GMT

GET
H2 200 jquery-3.2.1.slim.min.js Show response
code.jquery.com/ 68 KB
24 KB 563ms
69ms Script
application/javascript 151.101.2.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.2.1.slim.min.js
Requested by: Host: pub-262f714d04e74664b859b1717330a4de.r2.dev
URL: https://pub-262f714d04e74664b859b1717330a4de.r2.dev/vendorupdate.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.2.137 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: 9365920887b11b33a3dc4ba28a0f93951f200341263e3b9cefd384798e4be398

Request headers

Referer: https://pub-262f714d04e74664b859b1717330a4de.r2.dev/
Origin: https://pub-262f714d04e74664b859b1717330a4de.r2.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 15 Aug 2024 22:57:17 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
age: 1524228
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
content-length: 23856
x-served-by: cache-lga21963-LGA, cache-mxp6982-MXP
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
server: nginx
x-timer: S1723762637.388067,VS0,VE0
etag: W/"28feccc0-10fdd"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=604800
accept-ranges: bytes
x-cache-hits: 15217, 16654

GET
H2 200 popper.min.js Show response
cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/ 19 KB
7 KB 571ms
77ms Script
application/javascript 104.17.24.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js

Requested by

Host: pub-262f714d04e74664b859b1717330a4de.r2.dev
URL: https://pub-262f714d04e74664b859b1717330a4de.r2.dev/vendorupdate.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://pub-262f714d04e74664b859b1717330a4de.r2.dev/
Origin: https://pub-262f714d04e74664b859b1717330a4de.r2.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 15 Aug 2024 22:57:17 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 11599
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 6157
last-modified: Mon, 04 May 2020 16:15:37 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03fa9-4af4"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bK4FYIfVnHs2IMx82%2FTq7XFk78ucMOIKeg03pLZCiLp%2BPUeKiLvId9FePqz4dI3S1E%2FI7thnV5coipkXfLpR9P6qkDb6%2F90fMD9P3t8j6%2BlFKVzouC07it2pHyF2G39LMi06Nztk"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 8b3cc863ac3c83ac-MXP
expires: Tue, 05 Aug 2025 22:57:17 GMT

GET
H2 200 bootstrap.min.js Show response
maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/ 48 KB
15 KB 520ms
73ms Script
application/javascript 104.18.10.207
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js

Requested by

Host: pub-262f714d04e74664b859b1717330a4de.r2.dev
URL: https://pub-262f714d04e74664b859b1717330a4de.r2.dev/vendorupdate.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.10.207 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://pub-262f714d04e74664b859b1717330a4de.r2.dev/
Origin: https://pub-262f714d04e74664b859b1717330a4de.r2.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 15 Aug 2024 22:57:17 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: MISS
cdn-edgestorageid: 1048
strict-transport-security: max-age=31536000; includeSubDomains; preload
cdn-cachedat: 03/18/2024 12:46:36
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
last-modified: Mon, 25 Jan 2021 22:04:04 GMT
cdn-proxyver: 1.04
cdn-requestpullcode: 200
server: cloudflare
etag: W/"14d449eb8876fa55e1ef3c2cc52b0c17"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cache-control: public, max-age=31919000
cdn-requestid: 7fd297ecc1f624ea9e004a58f10e8690
timing-allow-origin: *
cdn-requestcountrycode: DE
cdn-status: 200
cf-ray: 8b3cc8633d925a13-MXP
cdn-requestpullsuccess: True

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/2.2.4/ 84 KB
30 KB 454ms
33ms Script
text/javascript 142.250.185.234
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js

Requested by

Host: pub-262f714d04e74664b859b1717330a4de.r2.dev
URL: https://pub-262f714d04e74664b859b1717330a4de.r2.dev/vendorupdate.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.234 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f10.1e100.net

Software

sffe /

Resource Hash

05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://pub-262f714d04e74664b859b1717330a4de.r2.dev/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 13 Aug 2024 14:07:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 204603
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 30028
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 13 Aug 2025 14:07:14 GMT

GET
H2 200 bootstrap.min.js Show response
stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/ 50 KB
16 KB 487ms
64ms Script
application/javascript 104.18.10.207
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js

Requested by

Host: pub-262f714d04e74664b859b1717330a4de.r2.dev
URL: https://pub-262f714d04e74664b859b1717330a4de.r2.dev/vendorupdate.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.10.207 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://pub-262f714d04e74664b859b1717330a4de.r2.dev/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 15 Aug 2024 22:57:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
cdn-edgestorageid: 723
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 5033091
cdn-cachedat: 11/15/2021 23:30:00
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
last-modified: Mon, 25 Jan 2021 22:04:06 GMT
cdn-proxyver: 1.0
cdn-requestpullcode: 200
server: cloudflare
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cdn-cache: HIT
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cache-control: public, max-age=31919000
cdn-requestid: a35b0179a28ed953258d0fb41376a09c
timing-allow-origin: *
cdn-requestcountrycode: DE
cdn-status: 200
cf-ray: 8b3cc863498a0e05-MXP
cdn-requestpullsuccess: True

GET
H/1.1 404
Not Found bg.jpg
pub-262f714d04e74664b859b1717330a4de.r2.dev/images/ 9 KB
9 KB 87ms
86ms Image
text/html 104.18.2.35
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pub-262f714d04e74664b859b1717330a4de.r2.dev/images/bg.jpg
Requested by: Host: pub-262f714d04e74664b859b1717330a4de.r2.dev
URL: https://pub-262f714d04e74664b859b1717330a4de.r2.dev/vendorupdate.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.2.35 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: eb62bef03b5f56fbc3892ff71d95c1cad9c8bc8b25976493251f55294da6211d

Request headers

Referer: https://pub-262f714d04e74664b859b1717330a4de.r2.dev/vendorupdate.html
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date: Thu, 15 Aug 2024 22:57:16 GMT
Server: cloudflare
Connection: keep-alive
CF-RAY: 8b3cc8608b4559dd-MXP
Content-Length: 27150
Vary: Accept-Encoding
Content-Type: text/html

GET
H2 200 d2a6d4a5caf16f926e6b820798a6fc00.png
i.gyazo.com/ 375 KB
376 KB 538ms
130ms Image
image/png 104.18.24.163
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.gyazo.com/d2a6d4a5caf16f926e6b820798a6fc00.png
Requested by: Host: pub-262f714d04e74664b859b1717330a4de.r2.dev
URL: https://pub-262f714d04e74664b859b1717330a4de.r2.dev/vendorupdate.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.24.163 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 844abe80bf4590a25984c4bf885fc27d386819df20022aacd7ed8c96a159c831

Request headers

Referer: https://pub-262f714d04e74664b859b1717330a4de.r2.dev/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Thu, 15 Aug 2024 22:57:17 GMT
via: 1.1 google
cf-cache-status: HIT
age: 26729
content-length: 384386
server: cloudflare
etag: "d2a6"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: https://gyazo.com
cache-control: public, max-age=31536000
access-control-allow-credentials: true
x-cache-level: ZS
accept-ranges: bytes
cf-ray: 8b3cc8632dc60e4d-MXP
expires: Fri, 15 Aug 2025 22:57:17 GMT

GET
H/1.1 404
Not Found et-line.woff
pub-262f714d04e74664b859b1717330a4de.r2.dev/fonts/ 0
0 568ms
121ms Font
text/html 104.18.2.35
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://pub-262f714d04e74664b859b1717330a4de.r2.dev/fonts/et-line.woff
Requested by: Host: pub-262f714d04e74664b859b1717330a4de.r2.dev
URL: https://pub-262f714d04e74664b859b1717330a4de.r2.dev/vendorupdate.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.2.35 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Referer: https://pub-262f714d04e74664b859b1717330a4de.r2.dev/vendorupdate.html
Origin: https://pub-262f714d04e74664b859b1717330a4de.r2.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date: Thu, 15 Aug 2024 22:57:17 GMT
Server: cloudflare
Connection: keep-alive
CF-RAY: 8b3cc8636e94babe-MXP
Content-Length: 27150
Vary: Accept-Encoding
Content-Type: text/html

GET
H/1.1 404
Not Found et-line.ttf
pub-262f714d04e74664b859b1717330a4de.r2.dev/fonts/ 0
0 107ms
102ms Font
text/html 104.18.2.35
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://pub-262f714d04e74664b859b1717330a4de.r2.dev/fonts/et-line.ttf
Requested by: Host: pub-262f714d04e74664b859b1717330a4de.r2.dev
URL: https://pub-262f714d04e74664b859b1717330a4de.r2.dev/vendorupdate.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.2.35 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Referer: https://pub-262f714d04e74664b859b1717330a4de.r2.dev/vendorupdate.html
Origin: https://pub-262f714d04e74664b859b1717330a4de.r2.dev
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Date: Thu, 15 Aug 2024 22:57:17 GMT
Server: cloudflare
Connection: keep-alive
CF-RAY: 8b3cc8642965839d-MXP
Content-Length: 27150
Vary: Accept-Encoding
Content-Type: text/html

GET

/
learn.microsoft.com/it-it/
Redirect Chain

https://docs.com/1673155405_Images/favicon.ico
https://www.docs.com/1673155405_Images/favicon.ico
https://learn.microsoft.com/
https://learn.microsoft.com/it-it/

0
0

GET

/
learn.microsoft.com/
Redirect Chain

https://docs.com/1673155405_Images/favicon.ico
https://www.docs.com/1673155405_Images/favicon.ico
https://learn.microsoft.com/

0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: opensource.keycdn.com
URL: https://opensource.keycdn.com/fontawesome/4.6.3/font-awesome.min.css

Domain: learn.microsoft.com
URL: https://learn.microsoft.com/it-it/

Domain: learn.microsoft.com
URL: https://learn.microsoft.com/

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Email (Online) Adobe (Consumer)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			i.gyazo.com/	1970-01-21 08:25:22	Name: Gyazo_cfwoker Value: i

5 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://opensource.keycdn.com/fontawesome/4.6.3/font-awesome.min.css Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network	error	URL: https://pub-262f714d04e74664b859b1717330a4de.r2.dev/images/bg.jpg Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://pub-262f714d04e74664b859b1717330a4de.r2.dev/fonts/et-line.woff Message: Failed to load resource: the server responded with a status of 404 (Not Found)
recommendation	verbose	URL: https://pub-262f714d04e74664b859b1717330a4de.r2.dev/vendorupdate.html Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o
network	error	URL: https://pub-262f714d04e74664b859b1717330a4de.r2.dev/fonts/et-line.ttf Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
cdnjs.cloudflare.com
code.jquery.com
er.lgyb1.shop
i.gyazo.com
learn.microsoft.com
maxcdn.bootstrapcdn.com
opensource.keycdn.com
pub-262f714d04e74664b859b1717330a4de.r2.dev
stackpath.bootstrapcdn.com
upload.wikimedia.org
learn.microsoft.com
opensource.keycdn.com
104.17.24.14
104.18.10.207
104.18.2.35
104.18.24.163
142.250.185.234
151.101.2.137
185.15.59.240
77.237.235.224
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
0cf605381ef8acee469f427fb203acf2e5fedf6056208215be170bf7421e3433
1137cadbe746090853f7d2fb7ac45fb577193ea2560d6cdf29af273d6515c3b3
150635dc2c0d83b291bca970628370ff2a04c760c3bb7c1ff52aee296b6287d5
2f71bea7601b970d07eea91af38bcee8b1c9fc197b5f85cbe9bae3b9f2b705c5
3f028b5949911c652f1ac727f5c2c8e30d7ae79a7de47a6e392a15073fa18f56
56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4
844abe80bf4590a25984c4bf885fc27d386819df20022aacd7ed8c96a159c831
91a90597b2e95f89fdcef1fb71c3eef1dd6a9e849ccd4a68dae3a94ceb8a7c8b
9365920887b11b33a3dc4ba28a0f93951f200341263e3b9cefd384798e4be398
a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66
b4e69a741ce321048d31f860201d1312b9fe88db6fe027f0534a5e72bc4ea7a4
b7ead6c56b3245b1bc31fff1b4c97e4e0190dae25116d9f04dcaca0ae8b30f4a
e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b
eb62bef03b5f56fbc3892ff71d95c1cad9c8bc8b25976493251f55294da6211d

pub-262f714d04e74664b859b1717330a4de.r2.dev Open in urlscan Pro 104.18.2.35 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

20 Requests

85 %HTTPS

0 %IPv6

10 Domains

11 Subdomains

8 IPs

5 Countries

565 kBTransfer

739 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

20 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

9 JavaScript Global Variables

1 Cookies

5 Console Messages

Indicators

pub-262f714d04e74664b859b1717330a4de.r2.dev Open in urlscan Pro
104.18.2.35 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

20
Requests

85 %
HTTPS

0 %
IPv6

10
Domains

11
Subdomains

8
IPs

5
Countries

565 kB
Transfer

739 kB
Size

1
Cookies

20 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!