pub-0c7b35c4da3644298510aa02c0534131.r2.dev
Open in
urlscan Pro
2606:4700::6812:323
Malicious Activity!
Public Scan
Effective URL: https://pub-0c7b35c4da3644298510aa02c0534131.r2.dev/index.html
Submission: On August 21 via api — Scanned from DE
Summary
TLS certificate: Issued by E6 on August 1st 2024. Valid for: 3 months.
This is the only time pub-0c7b35c4da3644298510aa02c0534131.r2.dev was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 99.83.237.166 99.83.237.166 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 93.184.221.165 93.184.221.165 | 15133 (EDGECAST) (EDGECAST) | |
1 | 2606:4700::68... 2606:4700::6812:323 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 50.116.87.173 50.116.87.173 | 19871 (NETWORK-S...) (NETWORK-SOLUTIONS-HOSTING) | |
1 | () () | ||
1 | 2a04:4e42:400... 2a04:4e42:400::485 | 54113 (FASTLY) (FASTLY) | |
1 | 2a00:1450:400... 2a00:1450:4001:80f::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a04:4e42:400... 2a04:4e42:400::649 | 54113 (FASTLY) (FASTLY) | |
1 | 2a02:ec80:300... 2a02:ec80:300:ed1a::2:b | 14907 (WIKIMEDIA) (WIKIMEDIA) | |
1 | 2620:1ec:bdf::60 2620:1ec:bdf::60 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
1 | 2a02:26f0:710... 2a02:26f0:7100::687e:2531 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
12 | 11 |
ASN16509 (AMAZON-02, US)
PTR: a242879cca9aebe57.awsglobalaccelerator.com
naturalmedicines.therapeuticresearch.com |
ASN13335 (CLOUDFLARENET, US)
pub-0c7b35c4da3644298510aa02c0534131.r2.dev |
ASN19871 (NETWORK-SOLUTIONS-HOSTING, US)
PTR: 50-116-87-173.unifiedlayer.com
test.dimasneto.com |
ASN20940 (AKAMAI-ASN1, NL)
res.cdn.office.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
2 |
dimasneto.com
test.dimasneto.com |
122 KB |
2 |
r2.dev
pub-0c7b35c4da3644298510aa02c0534131.r2.dev |
864 B |
1 |
office.net
res.cdn.office.net — Cisco Umbrella Rank: 405 |
16 KB |
1 |
msauth.net
aadcdn.msauth.net — Cisco Umbrella Rank: 2218 |
1 KB |
1 |
wikimedia.org
upload.wikimedia.org — Cisco Umbrella Rank: 4162 |
9 KB |
1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 1211 |
31 KB |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 110 |
1 KB |
1 |
jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 410 |
35 KB |
1 |
t.co
t.co — Cisco Umbrella Rank: 979 |
578 B |
1 |
therapeuticresearch.com
1 redirects
naturalmedicines.therapeuticresearch.com — Cisco Umbrella Rank: 841096 |
1 KB |
12 | 10 |
Domain | Requested by | |
---|---|---|
2 | test.dimasneto.com |
pub-0c7b35c4da3644298510aa02c0534131.r2.dev
|
2 | pub-0c7b35c4da3644298510aa02c0534131.r2.dev |
t.co
test.dimasneto.com |
1 | res.cdn.office.net | |
1 | aadcdn.msauth.net |
pub-0c7b35c4da3644298510aa02c0534131.r2.dev
|
1 | upload.wikimedia.org |
pub-0c7b35c4da3644298510aa02c0534131.r2.dev
|
1 | code.jquery.com |
pub-0c7b35c4da3644298510aa02c0534131.r2.dev
|
1 | fonts.googleapis.com |
pub-0c7b35c4da3644298510aa02c0534131.r2.dev
|
1 | cdn.jsdelivr.net |
pub-0c7b35c4da3644298510aa02c0534131.r2.dev
|
1 | t.co | |
1 | naturalmedicines.therapeuticresearch.com | 1 redirects |
12 | 10 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
t.co DigiCert Global G2 TLS RSA SHA256 2020 CA1 |
2024-05-08 - 2025-05-07 |
a year | crt.sh |
*.r2.dev E6 |
2024-08-01 - 2024-10-30 |
3 months | crt.sh |
www.test.dimasneto.com R10 |
2024-08-13 - 2024-11-11 |
3 months | crt.sh |
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2024 Q3 |
2024-07-30 - 2025-08-31 |
a year | crt.sh |
upload.video.google.com WR2 |
2024-07-30 - 2024-10-22 |
3 months | crt.sh |
*.jquery.com Sectigo ECC Domain Validation Secure Server CA |
2024-06-25 - 2025-06-25 |
a year | crt.sh |
*.wikipedia.org DigiCert TLS Hybrid ECC SHA384 2020 CA1 |
2023-10-18 - 2024-10-16 |
a year | crt.sh |
aadcdn.msauth.net DigiCert SHA2 Secure Server CA |
2024-07-30 - 2025-07-30 |
a year | crt.sh |
*.res.outlook.com DigiCert SHA2 Secure Server CA |
2024-02-20 - 2025-02-20 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://pub-0c7b35c4da3644298510aa02c0534131.r2.dev/index.html
Frame ID: 2321F31ED8789FE5AA4761D3C87DB013
Requests: 12 HTTP requests in this frame
Screenshot
Page Title
Please wait - Loading your e-Sign Document....Page URL History Show full URLs
-
https://naturalmedicines.therapeuticresearch.com/api/AccountApiCallback/620383?redirectUrl=https://t.co/ZVecVUIivP
HTTP 302
https://t.co/ZVecVUIivP Page URL
- https://pub-0c7b35c4da3644298510aa02c0534131.r2.dev/index.html Page URL
Detected technologies
Bootstrap (Web Frameworks) ExpandDetected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Google Font API (Font Scripts) Expand
Detected patterns
- <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
jsDelivr (CDN) Expand
Detected patterns
- <link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
- //cdn\.jsdelivr\.net/
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://naturalmedicines.therapeuticresearch.com/api/AccountApiCallback/620383?redirectUrl=https://t.co/ZVecVUIivP
HTTP 302
https://t.co/ZVecVUIivP Page URL
- https://pub-0c7b35c4da3644298510aa02c0534131.r2.dev/index.html Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://naturalmedicines.therapeuticresearch.com/api/AccountApiCallback/620383?redirectUrl=https://t.co/ZVecVUIivP HTTP 302
- https://t.co/ZVecVUIivP
12 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
ZVecVUIivP
t.co/ Redirect Chain
|
341 B 578 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
index.html
pub-0c7b35c4da3644298510aa02c0534131.r2.dev/ |
555 B 864 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.js
test.dimasneto.com/ |
284 KB 108 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
basic.js
test.dimasneto.com/ |
33 KB 13 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET BLOB |
58c4434d-36ee-47c6-a5d3-a4a88ecef778
https://pub-0c7b35c4da3644298510aa02c0534131.r2.dev/ |
24 KB 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
favicon.ico
pub-0c7b35c4da3644298510aa02c0534131.r2.dev/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@5.3.0/dist/css/ |
227 KB 35 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css2
fonts.googleapis.com/ |
4 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.6.4.min.js
code.jquery.com/ |
88 KB 31 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1280px-Microsoft_logo_%282012%29.svg.png
upload.wikimedia.org/wikipedia/commons/thumb/9/96/Microsoft_logo_%282012%29.svg/ |
8 KB 9 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
49-small_e58aafc980614a9cd7796bea7b5ea8f0.jpg
aadcdn.msauth.net/shared/1.0/content/images/appbackgrounds/ |
987 B 1 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
favicon_m365-31d62b976c.ico
res.cdn.office.net/officehub/images/content/images/ |
15 KB 16 KB |
Other
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- pub-0c7b35c4da3644298510aa02c0534131.r2.dev
- URL
- https://pub-0c7b35c4da3644298510aa02c0534131.r2.dev/favicon.ico
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)9 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery function| validateAndProceed function| generateRandomString function| sha1 function| md5 function| changeText function| waitForRedirect function| performChecksAndRedirect9 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
naturalmedicines.therapeuticresearch.com/ | Name: AWSALB Value: CycDxWGJr9vi+ZNDJihOshyUNCkmX4MWWdBEigjo/nZ0WQ0aB2kOuowG/n6dgMC1pd+9sMuo0Daduyxqm+qTIeWQTWBGGPGttYER5/mLHL+Alt0HNfFX9+HL9x47 |
|
naturalmedicines.therapeuticresearch.com/ | Name: AWSALBCORS Value: CycDxWGJr9vi+ZNDJihOshyUNCkmX4MWWdBEigjo/nZ0WQ0aB2kOuowG/n6dgMC1pd+9sMuo0Daduyxqm+qTIeWQTWBGGPGttYER5/mLHL+Alt0HNfFX9+HL9x47 |
|
naturalmedicines.therapeuticresearch.com/ | Name: NS_ASP.NET_SessionId Value: jw3rhmijlqjzs4snchzls5zt |
|
.therapeuticresearch.com/ | Name: NsBaseUrl Value: https://naturalmedicines.therapeuticresearch.com |
|
.therapeuticresearch.com/ | Name: NmIntegration-NS_ASP.NET_SessionId Value: jw3rhmijlqjzs4snchzls5zt |
|
naturalmedicines.therapeuticresearch.com/ | Name: NsAuth Value: 46D45BB0D01E0E0FFFACB11F4D882B6F436AD8C8DD7997CD9CDD36FC877FF18358941F37924E68DA4A8F0BC3F2167B2A5187DF423C02DA1477625311058492A77CAF1CB23440F24A66FBAE58C94F9DA12C142FC700A50F3DC0A4B18FC469E7A256E4A828D699A81224828949F705EEC3AB92CCC8 |
|
.therapeuticresearch.com/ | Name: NmIntegration-NsAuth Value: 46D45BB0D01E0E0FFFACB11F4D882B6F436AD8C8DD7997CD9CDD36FC877FF18358941F37924E68DA4A8F0BC3F2167B2A5187DF423C02DA1477625311058492A77CAF1CB23440F24A66FBAE58C94F9DA12C142FC700A50F3DC0A4B18FC469E7A256E4A828D699A81224828949F705EEC3AB92CCC8 |
|
.therapeuticresearch.com/ | Name: ns3-context-data Value: lm=7&uf=1&ceid= |
|
.t.co/ | Name: muc Value: 4d56c207-3c9f-4055-97bd-720d259bf99b |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=0 |
X-Xss-Protection | 0 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
aadcdn.msauth.net
cdn.jsdelivr.net
code.jquery.com
fonts.googleapis.com
naturalmedicines.therapeuticresearch.com
pub-0c7b35c4da3644298510aa02c0534131.r2.dev
res.cdn.office.net
t.co
test.dimasneto.com
upload.wikimedia.org
pub-0c7b35c4da3644298510aa02c0534131.r2.dev
2606:4700::6812:323
2620:1ec:bdf::60
2a00:1450:4001:80f::200a
2a02:26f0:7100::687e:2531
2a02:ec80:300:ed1a::2:b
2a04:4e42:400::485
2a04:4e42:400::649
50.116.87.173
93.184.221.165
99.83.237.166
04663fb0b01fc27b402519f0b000db2b98ef3754c8c99c21e304262d2353ab62
3ee5ad440d69d7497bb934432424c9714c28a4275444243844f84fbd9666c063
6abc09c2aa03d70e026332d899222534a69c17eea9988d30e20e72053efd14d8
7e7dce64bd4f41c9d1f149cc053e506b7a83be3ac10810d0deaacaae640b9415
7f1d37f0d90b6385354c2ac10e2bb91563c46bd7a266ed351222ebcac8496c2a
8b34a475187302935336bf43a2bf2a4e0adb9a1e87953ea51f6fcf0ef52a4a1d
a0fe8723dcf55da64d06b25446d0a8513e52527c45afcb37073465f9c6f352af
b3d31a4d39808d01825e8686e85eaafff954ebfef3a89fd05f720cfc0a09ab69
b9ef5e22dc469a4f882deb9e08c610f26591c1f4851afb34cb495ee2026f5ee6
f2a84bc4f4cb8ae04162f42f1f3ebed1e05725d9b5bf666b885356c7698a071f