www.confirmyourspage.cf Open in urlscan Pro
2400:cb00:2048:1::681b:b918 Public Scan

Go To Rescan
Add Verdict Report

URL:
http://www.confirmyourspage.cf/others2.html?recovery-udisabled-account
Submission: On August 12 via automatic, source openphish (August 12th 2017, 3:13:16 pm UTC)

Summary HTTP 10 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 10 HTTP transactions. The main IP is 2400:cb00:2048:1::681b:b918, located in United States and belongs to CLOUDFLARENET - CloudFlare, Inc., US. The main domain is www.confirmyourspage.cf.

This is the only time www.confirmyourspage.cf was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2	2400:cb00:204... 2400:cb00:2048:1::681b:b918	13335 (CLOUDFLAR...) (CLOUDFLARENET - CloudFlare)
6	162.125.66.6 162.125.66.6	19679 (DROPBOX) (DROPBOX - Dropbox)
2	209.126.122.22 209.126.122.22	30083 (SERVER4YOU) (SERVER4YOU - server4you Inc.)
10	3

2 2400:cb00:2048:1::681b:b918 (United States)

ASN13335 (CLOUDFLARENET - CloudFlare, Inc., US)

www.confirmyourspage.cf	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 162.125.66.6 (Frankfurt, Germany)

ASN19679 (DROPBOX - Dropbox, Inc., US)

dl.dropboxusercontent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 209.126.122.22 (Saint Louis, United States)

ASN30083 (SERVER4YOU - server4you Inc., US)
PTR: usloft4499.serverprofi24.de

cfs.u-ad.info	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	dropboxusercontent.com dl.dropboxusercontent.com	27 KB
2	u-ad.info cfs.u-ad.info	3 KB
2	confirmyourspage.cf www.confirmyourspage.cf	27 KB
10	3

	Domain	Requested by
6	dl.dropboxusercontent.com	www.confirmyourspage.cf
2	cfs.u-ad.info	www.confirmyourspage.cf
2	www.confirmyourspage.cf	www.confirmyourspage.cf
10	3

This site contains no links.

Subject Issuer	Validity	Valid
*.dl.dropboxusercontent.com DigiCert SHA2 High Assurance Server CA	`2017-03-06` - `2020-03-10`	3 years	crt.sh

This page contains 1 frames:

Primary Page: http://www.confirmyourspage.cf/others2.html?recovery-udisabled-account
Frame ID: 21417.1
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Statistics

10
Requests

60 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

56 kB
Transfer

120 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request others2.html Show response www.confirmyourspage.cf/	10 KB 4 KB	384ms 384ms	Document text/html	2400:cb00:2048:1::681b:b918 CloudFlare
General Check archive.org Show headers Download Go to Full URL http://www.confirmyourspage.cf/others2.html?recovery-udisabled-account Protocol HTTP/1.1 Server 2400:cb00:2048:1::681b:b918 , United States, ASN13335 (CLOUDFLARENET - CloudFlare, Inc., US), Reverse DNS Software cloudflare-nginx / Resource Hash `799764cd9554f87260a7a03d2ef22527e5e5cd3216237240b9febc7dd6199410` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.90 Safari/537.36 Response headers Date Sat, 12 Aug 2017 15:13:05 GMT Content-Encoding gzip Last-Modified Tue, 06 Jun 2017 13:07:10 GMT Server cloudflare-nginx Vary Accept-Encoding Content-Type text/html Transfer-Encoding chunked Connection keep-alive CF-RAY 38d4606774ab268a-FRA
GET S	200	5lgnwiqt.css dl.dropboxusercontent.com/s/bpe0hrswiv4spik/	24 KB 7 KB	459ms 444ms	Stylesheet text/css	162.125.66.6 Dropbox
General Check archive.org Show headers Download Go to Full URL https://dl.dropboxusercontent.com/s/bpe0hrswiv4spik/5lgnwiqt.css Requested by Host: www.confirmyourspage.cf URL: http://www.confirmyourspage.cf/others2.html?recovery-udisabled-account Protocol SPDY Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 162.125.66.6 Frankfurt, Germany, ASN19679 (DROPBOX - Dropbox, Inc., US), Reverse DNS Software nginx / Resource Hash `5025467eeeebd95fe1a434bc8c1cc18122723381b8e0d0004fcaed291e2503b1` Request headers Referer http://www.confirmyourspage.cf/others2.html?recovery-udisabled-account User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.90 Safari/537.36 Response headers pragma public date Sat, 12 Aug 2017 15:13:06 GMT content-encoding gzip server nginx x-server-response-time 347 vary Accept-Encoding content-type text/css; charset=utf-8 status 200 cache-control max-age=60 content-disposition inline; filename="5lgnwiqt.css"; filename=UTF-8''5lgnwiqt.css x-robots-tag* noindex, nofollow, noimageindex x-dropbox-request-id 4a6c5802e0ed603d9b77c61592429395
GET S	200	7p8bscst.css dl.dropboxusercontent.com/s/hxixbkb7geeh8ca/	3 KB 1 KB	350ms 335ms	Stylesheet text/css	162.125.66.6 Dropbox
General Check archive.org Show headers Download Go to Full URL https://dl.dropboxusercontent.com/s/hxixbkb7geeh8ca/7p8bscst.css Requested by Host: www.confirmyourspage.cf URL: http://www.confirmyourspage.cf/others2.html?recovery-udisabled-account Protocol SPDY Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 162.125.66.6 Frankfurt, Germany, ASN19679 (DROPBOX - Dropbox, Inc., US), Reverse DNS Software nginx / Resource Hash `0f153f0232400710c8d6f6a61566a4984d95cf00e3932075106d6d6b8848ebaf` Request headers Referer http://www.confirmyourspage.cf/others2.html?recovery-udisabled-account User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.90 Safari/537.36 Response headers pragma public date Sat, 12 Aug 2017 15:13:05 GMT content-encoding gzip server nginx x-server-response-time 239 vary Accept-Encoding content-type text/css; charset=utf-8 status 200 cache-control max-age=60 content-disposition inline; filename="7p8bscst.css"; filename=UTF-8''7p8bscst.css x-robots-tag* noindex, nofollow, noimageindex x-dropbox-request-id 23529dc921935b23d9c04283044f525c
GET S	200	7t09ffnu.css dl.dropboxusercontent.com/s/1yt09ua6p4zfq0s/	2 KB 961 B	335ms 321ms	Stylesheet text/css	162.125.66.6 Dropbox
General Check archive.org Show headers Download Go to Full URL https://dl.dropboxusercontent.com/s/1yt09ua6p4zfq0s/7t09ffnu.css Requested by Host: www.confirmyourspage.cf URL: http://www.confirmyourspage.cf/others2.html?recovery-udisabled-account Protocol SPDY Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 162.125.66.6 Frankfurt, Germany, ASN19679 (DROPBOX - Dropbox, Inc., US), Reverse DNS Software nginx / Resource Hash `69ea29dbe0dbe2879cc01f276198cc47a50f289b48bbbc16a74dc1409108d47a` Request headers Referer http://www.confirmyourspage.cf/others2.html?recovery-udisabled-account User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.90 Safari/537.36 Response headers pragma public date Sat, 12 Aug 2017 15:13:05 GMT content-encoding gzip server nginx x-server-response-time 225 vary Accept-Encoding content-type text/css; charset=utf-8 status 200 cache-control max-age=60 content-disposition inline; filename="7t09ffnu.css"; filename=UTF-8''7t09ffnu.css x-robots-tag* noindex, nofollow, noimageindex x-dropbox-request-id f0f4e3c0497f2b4c89ea3cd56d1baf86
GET S	200	2elnknfz.css dl.dropboxusercontent.com/s/uuyyvu301s4hr4a/	18 KB 5 KB	365ms 350ms	Stylesheet text/css	162.125.66.6 Dropbox
General Check archive.org Show headers Download Go to Full URL https://dl.dropboxusercontent.com/s/uuyyvu301s4hr4a/2elnknfz.css Requested by Host: www.confirmyourspage.cf URL: http://www.confirmyourspage.cf/others2.html?recovery-udisabled-account Protocol SPDY Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 162.125.66.6 Frankfurt, Germany, ASN19679 (DROPBOX - Dropbox, Inc., US), Reverse DNS Software nginx / Resource Hash `46c0acc9d15a1381e2809b06166ea2a060260e14b5c9692837d6dd0143931337` Request headers Referer http://www.confirmyourspage.cf/others2.html?recovery-udisabled-account User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.90 Safari/537.36 Response headers pragma public date Sat, 12 Aug 2017 15:13:05 GMT content-encoding gzip server nginx x-server-response-time 253 vary Accept-Encoding content-type text/css; charset=utf-8 status 200 cache-control max-age=60 content-disposition inline; filename="2elnknfz.css"; filename=UTF-8''2elnknfz.css x-robots-tag* noindex, nofollow, noimageindex x-dropbox-request-id cfbff462401addcf9b5f9ca6fc0a0d84
GET S	200	a27w6e83.js Show response dl.dropboxusercontent.com/s/bjljj8iiv1sp0yf/	32 KB 12 KB	633ms 618ms	Script application/javascript	162.125.66.6 Dropbox
General Check archive.org Show headers Download Go to Full URL https://dl.dropboxusercontent.com/s/bjljj8iiv1sp0yf/a27w6e83.js Requested by Host: www.confirmyourspage.cf URL: http://www.confirmyourspage.cf/others2.html?recovery-udisabled-account Protocol SPDY Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 162.125.66.6 Frankfurt, Germany, ASN19679 (DROPBOX - Dropbox, Inc., US), Reverse DNS Software nginx / Resource Hash `f4e9058504c9b8f90c19f23338360dba8194d4a35f2c9342cf2f68584ec7d4e9` Request headers Referer http://www.confirmyourspage.cf/others2.html?recovery-udisabled-account User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.90 Safari/537.36 Response headers pragma public date Sat, 12 Aug 2017 15:13:06 GMT content-encoding gzip server nginx x-server-response-time 254 vary Accept-Encoding content-type application/javascript status 200 cache-control max-age=60 content-disposition inline; filename="a27w6e83.js"; filename=UTF-8''a27w6e83.js x-robots-tag* noindex, nofollow, noimageindex x-dropbox-request-id 37edfdaaccf051caba3c40dc4d310c65
GET H/1.1	200 OK	12345.gif www.confirmyourspage.cf/others_files/	23 KB 23 KB	11ms 11ms	Image image/gif	2400:cb00:2048:1::681b:b918 CloudFlare
General Check archive.org Show headers Download Go to Show image Full URL http://www.confirmyourspage.cf/others_files/12345.gif Requested by Host: www.confirmyourspage.cf URL: http://www.confirmyourspage.cf/others2.html?recovery-udisabled-account Protocol HTTP/1.1 Server 2400:cb00:2048:1::681b:b918 , United States, ASN13335 (CLOUDFLARENET - CloudFlare, Inc., US), Reverse DNS Software cloudflare-nginx / Resource Hash `b163df33f1a70b14397d5086ded379a78ce2ceaf86d6fdfb9352ffb1b42d45c0` Request headers Referer http://www.confirmyourspage.cf/others2.html?recovery-udisabled-account User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.90 Safari/537.36 Response headers Date Sat, 12 Aug 2017 15:13:06 GMT CF-Cache-Status HIT Last-Modified Tue, 25 Aug 2015 01:08:40 GMT Server cloudflare-nginx ETag "5c65-51e185fde3600" Vary Accept-Encoding Content-Type image/gif Cache-Control public, max-age=14400 Connection keep-alive Accept-Ranges bytes CF-RAY 38d4606cc02e268a-FRA Content-Length 23653 Expires Sat, 12 Aug 2017 19:13:06 GMT
GET S	404	6svdixne.png dl.dropboxusercontent.com/rsrc.php/zB50F/hash/	1 KB 0	97ms 97ms	Image text/html	162.125.66.6 Dropbox
General Check archive.org Show headers Download Go to Show image Full URL https://dl.dropboxusercontent.com/rsrc.php/zB50F/hash/6svdixne.png Requested by Host: www.confirmyourspage.cf URL: http://www.confirmyourspage.cf/others2.html?recovery-udisabled-account Protocol SPDY Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 162.125.66.6 Frankfurt, Germany, ASN19679 (DROPBOX - Dropbox, Inc., US), Reverse DNS Software nginx / Resource Hash `9facaee86180f3da64ca42f57d693c64e8766b6a958dd223aa1c8f23f083635d` Request headers Referer https://dl.dropboxusercontent.com/s/bpe0hrswiv4spik/5lgnwiqt.css User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.90 Safari/537.36 Response headers date Sat, 12 Aug 2017 15:13:06 GMT content-encoding gzip server nginx vary Accept-Encoding content-type text/html status 404 x-dropbox-request-id 7a484e1e579d7d46cd7dcf51333ad883 x-robots-tag noindex, nofollow, noimageindex
GET H/1.1	200 OK	request Show response cfs.u-ad.info/cfspushadsv2/	3 KB 1 KB	326ms 197ms	Script application/javascript	209.126.122.22 server4you Inc.
General Check archive.org Show headers Download Go to Full URL http://cfs.u-ad.info/cfspushadsv2/request?id=1&enc=telkom2&params=4TtHaUQnUEiP6K%2fc5C582AaN6h071sG%2bp4Ppyvh%2bD%2bCsIXemBGE6pOnl%2fL4Pom%2fp2coJbftY5cm8rcKI%2bGLWDhrhyHIB3pTiZqACluYZzpFUz3nw2AMaPfewNBaMuZwsF41bHGJdQrIm%2bX92mjGrQkfkZ1wxSE8oHHUdqWjCS%2bk69lAJvw8edwEUQtWe7KrVEugPJQaLPNjUcQYU%2fECaPamTRPGNRqz3mjqll20emLgsV8TOdZuf2vQih7pEMyLY41y81APLj34va48d3coEhmzjRRorElb26xst52fcOx0ha0xmruNHQ6A9qpdzdanYvRpuRFkpZnyYssvL%2fpIt5gp%2bppv5vfq7FEvsjIn4iwdWffBiGUm%2f4Es937PC1dTY03pPOavpeK51xD8s0ztS4Qlr4W1LRpD%2bPZv7yqO3fg%2bz6gRb%2faZz2K63bitbEY1a%2b5l2YDpACjuxhr9DS5jN%2bMouTwHt1VrzFGGDhPnoG8j4qm%2fw2y1JNslbDpCkWmd8eO%2fmpn3WrzyH6k14rStEjV4L5CS%2fXsIVMzU9PY%2fqQum2d4%2fjYIiaY0ASjs5ppWaNCCQ5MnsLFi6FSiTjIlKC4jraHadQLavy&idc_r=73593386191&domain=www.confirmyourspage.cf&sw=1600&sh=1200 Requested by Host: www.confirmyourspage.cf URL: http://www.confirmyourspage.cf/others2.html?recovery-udisabled-account Protocol HTTP/1.1 Server 209.126.122.22 Saint Louis, United States, ASN30083 (SERVER4YOU - server4you Inc., US), Reverse DNS usloft4499.serverprofi24.de Software Apache/2.4.27 (Ubuntu) / Resource Hash `ba95d07a4cf518ca100bae99b4c45e6e8cac7ff91b04f1883f3ac489bdc943f6` Request headers Referer http://www.confirmyourspage.cf/others2.html?recovery-udisabled-account User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.90 Safari/537.36 Response headers Date Sat, 12 Aug 2017 15:13:06 GMT Content-Encoding gzip Server Apache/2.4.27 (Ubuntu) Connection close Content-Length 1347 Vary Accept-Encoding Content-Type application/javascript
GET H/1.1	200 OK	request Show response cfs.u-ad.info/cfspushadsv2/	3 KB 1 KB	326ms 197ms	Script application/javascript	209.126.122.22 server4you Inc.
General Check archive.org Show headers Download Go to Full URL http://cfs.u-ad.info/cfspushadsv2/request?id=1&enc=telkom2&params=4TtHaUQnUEiP6K%2fc5C582AaN6h071sG%2bOnp5fwFesD9lMdQJV6HC%2f8Lv7aZ5b9A2YIppMjO1RWrQrDBBjGlGB%2fnDiLAJWYHx9FliYVzx2GgN6pQVSGrVof9sc%2bHk5D0s8ODNfHvmY%2b7neu9e6rBJjizWt8cQdGdCYVylKh7uW6gSPoDCzfGY1vzFMDcMGIjYV6hrgfGrku6HiMvu9CEyQ9RQeFCN9Z%2bTn3rvbW8Ko30XHmHQdjBb1chgx4dwbimNUTn91yY4TcOyK%2fdY5msBlOGINAEeynUuUNu3mta0JWi%2ferdtCuX20ORbt0MDub2XiTJaJGhEbwmHUu5ByfIVs4pm81IMpEbKcOyphgNfEJbg2iqxSxcomgAYYeV77iD55aG7VFccbb1yyKLepJsjX9SQ4F0zG8Cz0z5HussD9V9t0svQUWtvlKVuF2pCD1HTYJG9PDupbPTKlbImS4iaerGtxgwKfaCWdRlRZHDvMgUIioi9NNxD9UQ3PBq2VEJbB6fOvqmL7Yd4RIyHokeA2d2KVXbxdGwtL85GNqwzCJTMGwH1x%2fhd6BemDbn3TC8ln7yF766632iA%2bNfc2hcfyetfFTprwWOyYsu2CpC2eIo%2f36ZoJt%2f8FPWacvuwfYvX0jLjpSc%2fRLNJg870MZqo5g408zbD0nJAbdI7KKQr8JY%3d&idc_r=63149862999&domain=www.confirmyourspage.cf&sw=1600&sh=1200 Requested by Host: www.confirmyourspage.cf URL: http://www.confirmyourspage.cf/others2.html?recovery-udisabled-account Protocol HTTP/1.1 Server 209.126.122.22 Saint Louis, United States, ASN30083 (SERVER4YOU - server4you Inc., US), Reverse DNS usloft4499.serverprofi24.de Software Apache/2.4.27 (Ubuntu) / Resource Hash `ba95d07a4cf518ca100bae99b4c45e6e8cac7ff91b04f1883f3ac489bdc943f6` Request headers Referer http://www.confirmyourspage.cf/others2.html?recovery-udisabled-account User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.90 Safari/537.36 Response headers Date Sat, 12 Aug 2017 15:13:06 GMT Content-Encoding gzip Server Apache/2.4.27 (Ubuntu) Connection close Content-Length 1347 Vary Accept-Encoding Content-Type application/javascript

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.confirmyourspage.cf/	2018-08-12 15:13:05	Name: __cfduid Value: d7e71d7ed09379cca22d8d45d251adcf71502550785

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cfs.u-ad.info
dl.dropboxusercontent.com
www.confirmyourspage.cf
162.125.66.6
209.126.122.22
2400:cb00:2048:1::681b:b918
0f153f0232400710c8d6f6a61566a4984d95cf00e3932075106d6d6b8848ebaf
46c0acc9d15a1381e2809b06166ea2a060260e14b5c9692837d6dd0143931337
5025467eeeebd95fe1a434bc8c1cc18122723381b8e0d0004fcaed291e2503b1
69ea29dbe0dbe2879cc01f276198cc47a50f289b48bbbc16a74dc1409108d47a
799764cd9554f87260a7a03d2ef22527e5e5cd3216237240b9febc7dd6199410
9facaee86180f3da64ca42f57d693c64e8766b6a958dd223aa1c8f23f083635d
b163df33f1a70b14397d5086ded379a78ce2ceaf86d6fdfb9352ffb1b42d45c0
ba95d07a4cf518ca100bae99b4c45e6e8cac7ff91b04f1883f3ac489bdc943f6
f4e9058504c9b8f90c19f23338360dba8194d4a35f2c9342cf2f68584ec7d4e9

www.confirmyourspage.cf Open in urlscan Pro 2400:cb00:2048:1::681b:b918 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Statistics

10 Requests

60 %HTTPS

33 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

56 kBTransfer

120 kBSize

1 Cookies

0 Outgoing links

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

1 Cookies

Indicators

www.confirmyourspage.cf Open in urlscan Pro
2400:cb00:2048:1::681b:b918 Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

60 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

56 kB
Transfer

120 kB
Size

1
Cookies

10 HTTP transactions
0 data transactions