bluebadgeforclaimsupport.cf Open in urlscan Pro
2606:4700:3035::ac43:cdfa  Malicious Activity! Public Scan

1 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response bluebadgeforclaimsupport.cf/	8 KB 4 KB	375ms 343ms	Document text/html	2606:4700:3035::ac43:cdfa CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://bluebadgeforclaimsupport.cf/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3035::ac43:cdfa , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 849941b29da4333f7c6b2a5f369b0b7a16c8d6c0d123f289d7e0b697439608f6 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers :method GET :authority bluebadgeforclaimsupport.cf :scheme https :path / pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sat, 21 Aug 2021 17:35:18 GMT content-type text/html; charset=UTF-8 x-xss-protection 1; mode=block x-content-type-options nosniff x-request-id b87a42106f153495cd53407677536447 cf-cache-status DYNAMIC expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MJcqRoZZFwqRjZ69UuGX%2BXfusPzS8ThnmFnlbPivlnFO7gleMougTIenLOWYBC3f%2BiMqefr%2FJ51smMDimAqfi%2Bw2ntzqhx1bnGer8Hk1WIb1iW5WXt6EWO%2BOZ0%2Fx%2FfGk094OHs9QR%2BLh9XuDrpqOhXCsm1dDGi8gy6M%3D"}],"group":"cf-nel","max_age":604800} nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare cf-ray 68259df958af2c4e-FRA content-encoding br alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
GET H2	200	insta_3.png linkpicture.com/q/	14 KB 14 KB	289ms 259ms	Image image/png	2606:4700:3038::6815:ebb1 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://linkpicture.com/q/insta_3.png Requested by Host: bluebadgeforclaimsupport.cf URL: https://bluebadgeforclaimsupport.cf/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3038::6815:ebb1 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PleskLin Resource Hash 34fd446145f18e9ee515a542605c8031c60aae2bb74fb686fa69235f290d1cb9 Request headers Referer https://bluebadgeforclaimsupport.cf/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sat, 21 Aug 2021 17:35:18 GMT vary Accept-Encoding cf-cache-status REVALIDATED last-modified Tue, 18 May 2021 19:24:37 GMT server cloudflare x-powered-by PleskLin etag "60a41475-377d" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ECAnhRfzAfGwC2G2ai%2FWBYQJiwh7MnBBxP3KREeuiIETQHEs6joQMyDJUyblBT%2F08XQEgEaKbtE5V5Cm73hJTblTz7kkQddCIOl0VF1oXgDhqlnWzUVjpMSO00RX%2B8ZXfQc%2FchJkZbECvYY0g9Y%3D"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control max-age=31536000 accept-ranges bytes cf-ray 68259dfbb82f4abd-FRA content-length 14205
GET H2	200	giphy.gif media1.giphy.com/media/3o7bu7wtT19WfBAt0Y/	619 KB 619 KB	151ms 47ms	Image image/gif	151.101.14.2 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://media1.giphy.com/media/3o7bu7wtT19WfBAt0Y/giphy.gif Requested by Host: bluebadgeforclaimsupport.cf URL: https://bluebadgeforclaimsupport.cf/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 632abf1f71aedf630847f14c5bb58651616ea38c4bb8a18f38a12e81938b6492 Security Headers Name Value Strict-Transport-Security max-age=15465600 Request headers Referer https://bluebadgeforclaimsupport.cf/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sat, 21 Aug 2021 17:35:18 GMT via 1.1 varnish, 1.1 varnish age 812082 x-cache HIT, HIT cross-origin-resource-policy cross-origin content-length 633406 x-served-by cache-bwi5148-BWI, cache-fra19131-FRA last-modified Thu, 14 Mar 2019 04:23:52 GMT x-timer S1629567318.458031,VS0,VE1 etag "ae106de830d353e782457e518990e94f" strict-transport-security max-age=15465600 content-type image/gif access-control-allow-origin * cache-control max-age=86400 accept-ranges bytes x-cache-hits 1, 1
GET H2	200	Varl%C4%B1k%201-273x274.png istalya.com/image/cache/catalog/resimler/	5 KB 5 KB	456ms 213ms	Image image/png	89.252.151.50 KAPTEYAN
General Check archive.org Show headers Download Go to Show image Full URL https://istalya.com/image/cache/catalog/resimler/Varl%C4%B1k%201-273x274.png Requested by Host: bluebadgeforclaimsupport.cf URL: https://bluebadgeforclaimsupport.cf/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 89.252.151.50 , Turkey, ASN207429 (KAPTEYAN, TR), Reverse DNS rdns50.kapteyan.com.tr Software nginx / PleskLin Resource Hash 1254d3402ce900c515d0a7f5b9b41536e7d474b8cd32bf801cbf9a565899436b Request headers Referer https://bluebadgeforclaimsupport.cf/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sat, 21 Aug 2021 17:35:18 GMT last-modified Fri, 17 Apr 2020 08:42:15 GMT server nginx x-powered-by PleskLin etag "5e996be7-1501" content-type image/png accept-ranges bytes content-length 5377
GET H2	200	facebook-logosu-degisti.gif img.paratic.com/dosya/2019/11/	444 KB 445 KB	589ms 452ms	Image image/gif	172.67.143.66 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://img.paratic.com/dosya/2019/11/facebook-logosu-degisti.gif Requested by Host: bluebadgeforclaimsupport.cf URL: https://bluebadgeforclaimsupport.cf/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.67.143.66 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6a3909d24870c59e1236681422876061a79ab429e5b270577d22f21ebdbbb2d9 Request headers Referer https://bluebadgeforclaimsupport.cf/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sat, 21 Aug 2021 17:35:18 GMT cf-cache-status MISS nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 content-length 455009 last-modified Tue, 05 Nov 2019 06:48:41 GMT server cloudflare etag "5dc11b49-6f161" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6IorQ5jkT0hWV3I9rBX%2Bc5YV3U4SyBL1bDEk%2BojErjeeK3zTWYsvdZasc7Y8RLvVD8A%2Bl6l7K0RM9ZLP%2BTk6IhCJIRdugXIap%2BldnaGZWiiuQQFH10WkYTI0G3rDhQFHZhU%3D"}],"group":"cf-nel","max_age":604800} content-type image/gif cache-control max-age=31536000 accept-ranges bytes cf-ray 68259dfc995e1f74-AMS expires Sun, 21 Aug 2022 17:35:18 GMT
GET H2	200	footer-powered-by-000webhost-white2.png cdn.000webhost.com/000webhost/logo/	2 KB 2 KB	57ms 20ms	Image image/webp	2606:4700::6813:b878 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.000webhost.com/000webhost/logo/footer-powered-by-000webhost-white2.png Requested by Host: bluebadgeforclaimsupport.cf URL: https://bluebadgeforclaimsupport.cf/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6813:b878 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 86f2673ec74a632865109a76b2232f4f5b3587daa219e07a17ef1d9c76a0fda5 Security Headers Name Value Strict-Transport-Security max-age=2592000 X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers Referer https://bluebadgeforclaimsupport.cf/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sat, 21 Aug 2021 17:35:18 GMT x-content-type-options nosniff cf-cache-status HIT age 4587 cf-polished origFmt=png, origSize=2046 content-disposition inline; filename="footer-powered-by-000webhost-white2.webp" cf-bgj imgq:100,h2pri x-hostinger-datacenter srv alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 content-length 1696 x-xss-protection 1; mode=block last-modified Thu, 19 Aug 2021 06:46:16 GMT server cloudflare x-frame-options sameorigin etag "611dfe38-7fe" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=2592000 content-type image/webp vary Accept cache-control public, max-age=14400 x-hostinger-node nl-srv-cdn1 accept-ranges bytes cf-ray 68259dfbcbec42e1-FRA expires Sat, 21 Aug 2021 21:35:18 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Instagram (Social Network)

30 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated function| getCookie undefined| wordpressAdminBody object| notification object| hostingerLogo undefined| mainContent undefined| googleFont undefined| css undefined| style undefined| sheet undefined| button undefined| link undefined| mainContentHolder undefined| h1Tag undefined| h2Tag undefined| paragraph undefined| list undefined| org_html undefined| new_html undefined| saleImage

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://bluebadgeforclaimsupport.cf/(Line 105) Message: Script Ahmet Guven Tarafindan Yapilmistir.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bluebadgeforclaimsupport.cf
cdn.000webhost.com
img.paratic.com
istalya.com
linkpicture.com
media1.giphy.com
151.101.14.2
172.67.143.66
2606:4700:3035::ac43:cdfa
2606:4700:3038::6815:ebb1
2606:4700::6813:b878
89.252.151.50
1254d3402ce900c515d0a7f5b9b41536e7d474b8cd32bf801cbf9a565899436b
34fd446145f18e9ee515a542605c8031c60aae2bb74fb686fa69235f290d1cb9
632abf1f71aedf630847f14c5bb58651616ea38c4bb8a18f38a12e81938b6492
6a3909d24870c59e1236681422876061a79ab429e5b270577d22f21ebdbbb2d9
849941b29da4333f7c6b2a5f369b0b7a16c8d6c0d123f289d7e0b697439608f6
86f2673ec74a632865109a76b2232f4f5b3587daa219e07a17ef1d9c76a0fda5