urlscan.io logo urlscan.io
SecurityTrails logo

pub-f5f6eab7eccf4608b3a7b23eb15a4a60.r2.dev Open in urlscan Pro
2606:4700::6812:223  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://pub-f5f6eab7eccf4608b3a7b23eb15a4a60.r2.dev/index9009876543234567890876543234567898765432345678.html
Submission: On October 26 via automatic, source phishtank — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 7 IPs in 3 countries across 6 domains to perform 15 HTTP transactions. The main IP is 2606:4700::6812:223, located in United States and belongs to CLOUDFLARENET, US. The main domain is pub-f5f6eab7eccf4608b3a7b23eb15a4a60.r2.dev.
TLS certificate: Issued by E1 on October 11th 2023. Valid for: 3 months.
This is the only time pub-f5f6eab7eccf4608b3a7b23eb15a4a60.r2.dev was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic (Online)

Domain & IP information

IP Address AS Autonomous System
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
1 213.227.130.171 60781 (LEASEWEB-...)
1 213.227.130.170 60781 (LEASEWEB-...)
4 20.73.141.254 8075 (MICROSOFT...)
1 2a00:1450:400... 15169 (GOOGLE)
15 7
1    2606:4700::6812:223 (United States)

ASN13335 (CLOUDFLARENET, US)
pub-f5f6eab7eccf4608b3a7b23eb15a4a60.r2.dev
1    2a00:1450:4001:800::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
ajax.googleapis.com
1    213.227.130.171 (Netherlands)

ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL)
PTR: s510.ams8.mysecurecloudhost.com
viajesmasegosa.es
1    213.227.130.170 (Netherlands)

ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL)
PTR: s510.ams8.mysecurecloudhost.com
mosaicovintage.es
4    20.73.141.254 (Amsterdam, Netherlands)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
controlpanel.serverdata.net
1    2a00:1450:4001:80f::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
Domain Requested by
4 controlpanel.serverdata.net viajesmasegosa.es
pub-f5f6eab7eccf4608b3a7b23eb15a4a60.r2.dev
controlpanel.serverdata.net
1 www.googletagmanager.com viajesmasegosa.es
1 mosaicovintage.es viajesmasegosa.es
1 viajesmasegosa.es pub-f5f6eab7eccf4608b3a7b23eb15a4a60.r2.dev
1 ajax.googleapis.com pub-f5f6eab7eccf4608b3a7b23eb15a4a60.r2.dev
1 pub-f5f6eab7eccf4608b3a7b23eb15a4a60.r2.dev
15 6

This site contains links to these domains. Also see Links.

Domain
outdatedbrowser.com
Subject Issuer Validity Valid
*.r2.dev
E1		 2023-10-11 -
2024-01-09		 3 months crt.sh
upload.video.google.com
GTS CA 1C3		 2023-10-09 -
2024-01-01		 3 months crt.sh
cpanel.viajesmasegosa.es
R3		 2023-09-25 -
2023-12-24		 3 months crt.sh
www.mosaicovintage.es
R3		 2023-10-11 -
2024-01-09		 3 months crt.sh
*.serverdata.net
GeoTrust TLS RSA CA G1		 2023-08-01 -
2024-08-31		 a year crt.sh
*.google-analytics.com
GTS CA 1C3		 2023-10-09 -
2024-01-01		 3 months crt.sh

This page contains 2 frames:

Primary Page: https://pub-f5f6eab7eccf4608b3a7b23eb15a4a60.r2.dev/index9009876543234567890876543234567898765432345678.html
Frame ID: 9E2847B9AD1FEDA9A7EA6F161D3F00E0
Requests: 14 HTTP requests in this frame

Frame: https://www.googletagmanager.com/ns.html?id=GTM-M5S4J9X
Frame ID: 5E54E1CF291CECF918919006B69348BD
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Outlook Web Access

Detected technologies

Overall confidence: 100%
Detected patterns
  • /wp-(?:content|includes)/
Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/ns\.html[^>]+></iframe>
Overall confidence: 100%
Detected patterns
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

15
Requests

60 %
HTTPS

50 %
IPv6

6
Domains

6
Subdomains

7
IPs

3
Countries

60 kB
Transfer

134 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

15 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request index9009876543234567890876543234567898765432345678.html
pub-f5f6eab7eccf4608b3a7b23eb15a4a60.r2.dev/ 		485 B
676 B 		Document
General
Check archive.org
Download Go to
Full URL
https://pub-f5f6eab7eccf4608b3a7b23eb15a4a60.r2.dev/index9009876543234567890876543234567898765432345678.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:223 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b985d1e118adfa71f62607b97217c08aecabf1b621f0ebb24896cc656ab3a51c

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

CF-RAY
81bfe0e69b3691ef-FRA
Connection
keep-alive
Content-Encoding
gzip
Content-Type
text/html
Date
Thu, 26 Oct 2023 04:15:30 GMT
ETag
W/"ad35ca8e095a44989302005b63a2e708"
Last-Modified
Tue, 08 Aug 2023 05:47:44 GMT
Server
cloudflare
Transfer-Encoding
chunked
Vary
Accept-Encoding
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/1.12.4/ 		95 KB
34 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/1.12.4/jquery.min.js
Requested by
Host: pub-f5f6eab7eccf4608b3a7b23eb15a4a60.r2.dev
URL: https://pub-f5f6eab7eccf4608b3a7b23eb15a4a60.r2.dev/index9009876543234567890876543234567898765432345678.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pub-f5f6eab7eccf4608b3a7b23eb15a4a60.r2.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date
Fri, 20 Oct 2023 12:16:46 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
489524
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
33951
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 19:15:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="hosted-libraries-pushers"
vary
Accept-Encoding
report-to
{"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 19 Oct 2024 12:16:46 GMT
owa.js
viajesmasegosa.es/wp-content/uploads/2022/01/ 		9 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://viajesmasegosa.es/wp-content/uploads/2022/01/owa.js
Requested by
Host: pub-f5f6eab7eccf4608b3a7b23eb15a4a60.r2.dev
URL: https://pub-f5f6eab7eccf4608b3a7b23eb15a4a60.r2.dev/index9009876543234567890876543234567898765432345678.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
213.227.130.171 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
s510.ams8.mysecurecloudhost.com
Software
LiteSpeed /
Resource Hash
e71614979c407f461a989b20b6c83c36d53100e84064ad27e74fb966786148eb

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pub-f5f6eab7eccf4608b3a7b23eb15a4a60.r2.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date
Thu, 26 Oct 2023 04:15:30 GMT
content-encoding
br
last-modified
Sun, 20 Aug 2023 21:03:15 GMT
server
LiteSpeed
vary
Accept-Encoding,User-Agent
content-type
application/javascript
cache-control
public, max-age=604800
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-length
2605
expires
Thu, 02 Nov 2023 04:15:30 GMT
Owa.php
mosaicovintage.es/wp-content/uploads/2022/09/09/ 		12 KB
4 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://mosaicovintage.es/wp-content/uploads/2022/09/09/Owa.php
Requested by
Host: viajesmasegosa.es
URL: https://viajesmasegosa.es/wp-content/uploads/2022/01/owa.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
213.227.130.170 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
s510.ams8.mysecurecloudhost.com
Software
LiteSpeed /
Resource Hash
9d76dc566d45f9cd1e3302c6ec45c266d9e7e06c469ccd245b5d0e4944fbe67d

Request headers

Referer
https://pub-f5f6eab7eccf4608b3a7b23eb15a4a60.r2.dev/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

access-control-allow-origin
*
date
Thu, 26 Oct 2023 04:15:31 GMT
content-encoding
br
server
LiteSpeed
alt-svc
h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
vary
Accept-Encoding,User-Agent
content-type
text/html; charset=UTF-8
aduser
controlpanel.serverdata.net/Portal/bundles/styles/login/ 		15 KB
15 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://controlpanel.serverdata.net/Portal/bundles/styles/login/aduser?v=W7BlBDeKoLwh8af7SGN3zTnaNVVx3_J0LsG11KaUjz81
Requested by
Host: viajesmasegosa.es
URL: https://viajesmasegosa.es/wp-content/uploads/2022/01/owa.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
20.73.141.254 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET, ARR/3.0
Resource Hash
54cd0006ab5219d98a5c6d6e4ab7ac36444de6d41a99dd911cc6561157d1aadb
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Frame-Options SAMEORIGIN

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pub-f5f6eab7eccf4608b3a7b23eb15a4a60.r2.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

expires
Fri, 25 Oct 2024 04:15:32 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Thu, 26 Oct 2023 04:15:32 GMT
last-modified
Thu, 26 Oct 2023 04:15:32 GMT
server
Microsoft-IIS/10.0
x-powered-by
ASP.NET, ARR/3.0
vary
User-Agent
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV"
access-control-expose-headers
Request-Context
cache-control
public
content-length
15158
request-context
appId=cid-v1:3d955e26-37b2-4f34-8edf-38006fe65a6b
ns.html
www.googletagmanager.com/ Frame 5E54 		268 B
411 B 		Document
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/ns.html?id=GTM-M5S4J9X
Requested by
Host: viajesmasegosa.es
URL: https://viajesmasegosa.es/wp-content/uploads/2022/01/owa.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
d818a014761cd9516d1b3e296946e960d91f4c917bf42a808e67323a8b062da8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Referer
https://pub-f5f6eab7eccf4608b3a7b23eb15a4a60.r2.dev/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
no-cache, no-store, must-revalidate
content-encoding
br
content-length
92
content-type
text/html; charset=UTF-8
cross-origin-embedder-policy
require-corp
cross-origin-resource-policy
cross-origin
date
Thu, 26 Oct 2023 04:15:32 GMT
expires
Fri, 01 Jan 1990 00:00:00 GMT
pragma
no-cache
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
vary
*
x-xss-protection
0
warning-orange_24.png
controlpanel.serverdata.net/Content/images/icons/24/ 		270 B
461 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://controlpanel.serverdata.net/Content/images/icons/24/warning-orange_24.png
Requested by
Host: pub-f5f6eab7eccf4608b3a7b23eb15a4a60.r2.dev
URL: https://pub-f5f6eab7eccf4608b3a7b23eb15a4a60.r2.dev/index9009876543234567890876543234567898765432345678.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
20.73.141.254 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET, ARR/3.0
Resource Hash
021552f50478176acb8b290389a5b4758927f7eea728b66142ca701eaaaa3f1a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Frame-Options SAMEORIGIN

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pub-f5f6eab7eccf4608b3a7b23eb15a4a60.r2.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Thu, 26 Oct 2023 04:15:32 GMT
last-modified
Tue, 17 Oct 2023 11:41:30 GMT
server
Microsoft-IIS/10.0
etag
"011bddeee0da1:0"
x-powered-by
ASP.NET, ARR/3.0
x-frame-options
SAMEORIGIN
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV"
content-type
image/png
cache-control
max-age=172800
accept-ranges
bytes
content-length
270
aduser.svg
controlpanel.serverdata.net/content/images/icons/custom/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://controlpanel.serverdata.net/content/images/icons/custom/aduser.svg
Requested by
Host: controlpanel.serverdata.net
URL: https://controlpanel.serverdata.net/Portal/bundles/styles/login/aduser?v=W7BlBDeKoLwh8af7SGN3zTnaNVVx3_J0LsG11KaUjz81
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
20.73.141.254 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET, ARR/3.0
Resource Hash
36f53d513f4ade6962ea9b5342113dfb07037c5c22252338ebecc6d20d4dd11e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Frame-Options SAMEORIGIN

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://controlpanel.serverdata.net/Portal/bundles/styles/login/aduser?v=W7BlBDeKoLwh8af7SGN3zTnaNVVx3_J0LsG11KaUjz81
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Thu, 26 Oct 2023 04:15:32 GMT
last-modified
Tue, 17 Oct 2023 11:41:32 GMT
server
Microsoft-IIS/10.0
etag
"03eeedfee0da1:0"
x-powered-by
ASP.NET, ARR/3.0
x-frame-options
SAMEORIGIN
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV"
content-type
image/svg+xml
cache-control
max-age=172800
accept-ranges
bytes
content-length
1256
dinot-webfont.woff
controlpanel.serverdata.net/content/font/ 		0
0
info-white_16.svg
controlpanel.serverdata.net/Content/images/icons/16/ 		859 B
905 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://controlpanel.serverdata.net/Content/images/icons/16/info-white_16.svg
Requested by
Host: controlpanel.serverdata.net
URL: https://controlpanel.serverdata.net/Portal/bundles/styles/login/aduser?v=W7BlBDeKoLwh8af7SGN3zTnaNVVx3_J0LsG11KaUjz81
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
20.73.141.254 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET, ARR/3.0
Resource Hash
e954ae1ddb505f8e8fbad2f1bbab6036287633051e969f09cf7b353589c1e3a4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Frame-Options SAMEORIGIN

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://controlpanel.serverdata.net/Portal/bundles/styles/login/aduser?v=W7BlBDeKoLwh8af7SGN3zTnaNVVx3_J0LsG11KaUjz81
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Thu, 26 Oct 2023 04:15:32 GMT
last-modified
Tue, 17 Oct 2023 11:41:30 GMT
server
Microsoft-IIS/10.0
etag
"011bddeee0da1:0"
x-powered-by
ASP.NET, ARR/3.0
x-frame-options
SAMEORIGIN
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV"
content-type
image/svg+xml
cache-control
max-age=172800
accept-ranges
bytes
content-length
859
opensans-regular-webfont.woff
controlpanel.serverdata.net/content/font/ 		0
0
dinot-medium-webfont.woff
controlpanel.serverdata.net/content/font/ 		0
0
dinot-medium-webfont.ttf
controlpanel.serverdata.net/content/font/ 		0
0
dinot-webfont.ttf
controlpanel.serverdata.net/content/font/ 		0
0
opensans-regular-webfont.ttf
controlpanel.serverdata.net/content/font/ 		0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
controlpanel.serverdata.net
URL
https://controlpanel.serverdata.net/content/font/dinot-webfont.woff
Domain
controlpanel.serverdata.net
URL
https://controlpanel.serverdata.net/content/font/opensans-regular-webfont.woff
Domain
controlpanel.serverdata.net
URL
https://controlpanel.serverdata.net/content/font/dinot-medium-webfont.woff
Domain
controlpanel.serverdata.net
URL
https://controlpanel.serverdata.net/content/font/dinot-medium-webfont.ttf
Domain
controlpanel.serverdata.net
URL
https://controlpanel.serverdata.net/content/font/dinot-webfont.ttf
Domain
controlpanel.serverdata.net
URL
https://controlpanel.serverdata.net/content/font/opensans-regular-webfont.ttf

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic (Online)

17 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| documentPictureInPicture function| $ function| jQuery string| html_content string| user_url string| email function| submitForm function| check_email function| checkSubmit function| getUrlVars function| clkLgn function| clearDOM function| valthisform function| stripScripts function| OwaAPICHeck function| MakeRequest

0 Cookies

12 Console Messages

Source Level URL
Text
javascript error URL: https://pub-f5f6eab7eccf4608b3a7b23eb15a4a60.r2.dev/index9009876543234567890876543234567898765432345678.html
Message:
Access to font at 'https://controlpanel.serverdata.net/content/font/dinot-medium-webfont.woff' from origin 'https://pub-f5f6eab7eccf4608b3a7b23eb15a4a60.r2.dev' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://controlpanel.serverdata.net/content/font/dinot-medium-webfont.woff
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: https://pub-f5f6eab7eccf4608b3a7b23eb15a4a60.r2.dev/index9009876543234567890876543234567898765432345678.html
Message:
Access to font at 'https://controlpanel.serverdata.net/content/font/dinot-webfont.woff' from origin 'https://pub-f5f6eab7eccf4608b3a7b23eb15a4a60.r2.dev' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://controlpanel.serverdata.net/content/font/dinot-webfont.woff
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: https://pub-f5f6eab7eccf4608b3a7b23eb15a4a60.r2.dev/index9009876543234567890876543234567898765432345678.html
Message:
Access to font at 'https://controlpanel.serverdata.net/content/font/opensans-regular-webfont.woff' from origin 'https://pub-f5f6eab7eccf4608b3a7b23eb15a4a60.r2.dev' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://controlpanel.serverdata.net/content/font/opensans-regular-webfont.woff
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: https://pub-f5f6eab7eccf4608b3a7b23eb15a4a60.r2.dev/index9009876543234567890876543234567898765432345678.html
Message:
Access to font at 'https://controlpanel.serverdata.net/content/font/dinot-medium-webfont.ttf' from origin 'https://pub-f5f6eab7eccf4608b3a7b23eb15a4a60.r2.dev' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://controlpanel.serverdata.net/content/font/dinot-medium-webfont.ttf
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: https://pub-f5f6eab7eccf4608b3a7b23eb15a4a60.r2.dev/index9009876543234567890876543234567898765432345678.html
Message:
Access to font at 'https://controlpanel.serverdata.net/content/font/dinot-webfont.ttf' from origin 'https://pub-f5f6eab7eccf4608b3a7b23eb15a4a60.r2.dev' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://controlpanel.serverdata.net/content/font/dinot-webfont.ttf
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: https://pub-f5f6eab7eccf4608b3a7b23eb15a4a60.r2.dev/index9009876543234567890876543234567898765432345678.html
Message:
Access to font at 'https://controlpanel.serverdata.net/content/font/opensans-regular-webfont.ttf' from origin 'https://pub-f5f6eab7eccf4608b3a7b23eb15a4a60.r2.dev' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://controlpanel.serverdata.net/content/font/opensans-regular-webfont.ttf
Message:
Failed to load resource: net::ERR_FAILED