concentforintsa.cf Open in urlscan Pro
2a02:4780:dead:cb8f::1 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://concentforintsa.cf/
Submission: On March 26 via automatic, source openphish (March 26th 2022, 1:19:49 pm UTC) — Scanned from NL

Summary HTTP 8 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 8 HTTP transactions. The main IP is 2a02:4780:dead:cb8f::1, located in United States and belongs to AWEX, CY. The main domain is concentforintsa.cf.

This is the only time concentforintsa.cf was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Instagram (Social Network)

Domain & IP information

	IP Address	AS Autonomous System
6	2a02:4780:dea... 2a02:4780:dead:cb8f::1	204915 (AWEX) (AWEX)
1	176.9.17.111 176.9.17.111	24940 (HETZNER-AS) (HETZNER-AS)
8	3

6 2a02:4780:dead:cb8f::1 (United States)

ASN204915 (AWEX, CY)

concentforintsa.cf	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 176.9.17.111 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.111.17.9.176.clients.your-server.de

www.transparentpng.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	concentforintsa.cf concentforintsa.cf	209 KB
1	transparentpng.com www.transparentpng.com — Cisco Umbrella Rank: 333493	13 KB
0	newbigdata.science Failed newbigdata.science Failed
8	3

	Domain	Requested by
6	concentforintsa.cf	concentforintsa.cf
1	www.transparentpng.com	concentforintsa.cf
0	newbigdata.science Failed	concentforintsa.cf
8	3

This site contains links to these domains. Also see Links.

Domain
www.bbc.com

Subject Issuer	Validity	Valid

This page contains 3 frames:

Primary Page: http://concentforintsa.cf/
Frame ID: D0AE4F29F2ECA13C8D1B42AB47104106
Requests: 6 HTTP requests in this frame

Frame: http://concentforintsa.cf/asda_files/qMnGlIs-JNW.html
Frame ID: 3F46E001BB937E79C55D01860C572D6F
Requests: 4 HTTP requests in this frame

Frame: http://concentforintsa.cf/asda_files/ping.html
Frame ID: 11053ECE3984C3B6D8CFE22541ED5D5B
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Copyright | Instagram

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

8
Requests

0 %
HTTPS

50 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

222 kB
Transfer

618 kB
Size

0
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://www.bbc.com/news/live/world-europe-60517447
Title: HERE

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 2

http://www.transparentpng.com/thumb/instagram-logo-icon/FZW2tz-instagram-logo-free-png.png HTTP 307
https://www.transparentpng.com/thumb/instagram-logo-icon/FZW2tz-instagram-logo-free-png.png

8 HTTP transactions
5 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
concentforintsa.cf/ 171 KB
47 KB 258ms
117ms Document
text/html 2a02:4780:dead:cb8f::1
AWEX

General

Check archive.org

Show headers Download Go to

Full URL

http://concentforintsa.cf/

Protocol

HTTP/1.1

Server

2a02:4780:dead:cb8f::1 , United States, ASN204915 (AWEX, CY),

Reverse DNS

Software

awex /

Resource Hash

7eb1631bff9272b121e804882618e664799e4693182681621373a18c2fc87d27

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: nl-NL,nl;q=0.9

Response headers

Date: Sat, 26 Mar 2022 13:19:44 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Server: awex
X-Xss-Protection: 1; mode=block
X-Content-Type-Options: nosniff
X-Request-ID: 16df6a9e46098ed7576da2c8c75744ba
Content-Encoding: gzip

GET
H/1.1 200
OK jquery.min.js.indir Show response
concentforintsa.cf/asda_files/ 85 KB
34 KB 239ms
120ms Script
application/javascript 2a02:4780:dead:cb8f::1
AWEX

General

Check archive.org

Show headers Download Go to

Full URL

http://concentforintsa.cf/asda_files/jquery.min.js.indir

Requested by

Host: concentforintsa.cf
URL: http://concentforintsa.cf/

Protocol

HTTP/1.1

Server

2a02:4780:dead:cb8f::1 , United States, ASN204915 (AWEX, CY),

Reverse DNS

Software

awex /

Resource Hash

160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: nl-NL,nl;q=0.9
Referer: http://concentforintsa.cf/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Sat, 26 Mar 2022 13:19:44 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Fri, 25 Mar 2022 20:45:18 GMT
Server: awex
Transfer-Encoding: chunked
Content-Type: application/javascript
Connection: keep-alive
X-Xss-Protection: 1; mode=block
X-Request-ID: 93e0ed4c8589513d2cf27a2141c8e9f6

GET __cpa.cp.js
newbigdata.science/ 0
0

GET
H/1.1

200
OK

FZW2tz-instagram-logo-free-png.png
www.transparentpng.com/thumb/instagram-logo-icon/
Redirect Chain

http://www.transparentpng.com/thumb/instagram-logo-icon/FZW2tz-instagram-logo-free-png.png
https://www.transparentpng.com/thumb/instagram-logo-icon/FZW2tz-instagram-logo-free-png.png

13 KB
13 KB

125ms
44ms

Image
image/png

176.9.17.111
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.transparentpng.com/thumb/instagram-logo-icon/FZW2tz-instagram-logo-free-png.png
Requested by: Host: concentforintsa.cf
URL: http://concentforintsa.cf/
Protocol: HTTP/1.1
Server: 176.9.17.111 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.111.17.9.176.clients.your-server.de
Software: nginx /
Resource Hash: 6019a913bf6bc762f49ae1cc97f4bbffb215b45e9ef7939cf83681186e6468b6

Request headers

Accept-Language: nl-NL,nl;q=0.9
Referer: http://concentforintsa.cf/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Sat, 26 Mar 2022 13:19:45 GMT
Last-Modified: Wed, 30 Sep 2020 21:17:24 GMT
Server: nginx
ETag: "338e-5b08e6cfe4100"
Content-Type: image/png
Cache-Control: max-age=3600, no-cache, must-revalidate
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 13198
Expires: Sat, 26 Mar 2022 14:19:45 GMT

Redirect headers

Location: https://www.transparentpng.com/thumb/instagram-logo-icon/FZW2tz-instagram-logo-free-png.png
Non-Authoritative-Reason: HSTS
Cross-Origin-Resource-Policy: Cross-Origin

GET
H/1.1 200
OK index.jpg
concentforintsa.cf/asda_files/ 4 KB
4 KB 120ms
120ms Image
image/jpeg 2a02:4780:dead:cb8f::1
AWEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://concentforintsa.cf/asda_files/index.jpg

Requested by

Host: concentforintsa.cf
URL: http://concentforintsa.cf/

Protocol

HTTP/1.1

Server

2a02:4780:dead:cb8f::1 , United States, ASN204915 (AWEX, CY),

Reverse DNS

Software

awex /

Resource Hash

b98a5b8a78f04510e71900e3fa895406e61924c619021cc58f87bab29e0bfb02

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: nl-NL,nl;q=0.9
Referer: http://concentforintsa.cf/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Sat, 26 Mar 2022 13:19:45 GMT
X-Content-Type-Options: nosniff
Last-Modified: Fri, 25 Mar 2022 20:45:20 GMT
Server: awex
Content-Type: image/jpeg
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3669
X-Xss-Protection: 1; mode=block
X-Request-ID: 987b5a464aa99a29e099e52ed8e0f2bb

GET
H/1.1 404
Not Found 2115b50d229d.png
concentforintsa.cf/static/bundles/base/sprite_core.png/ 14 KB
14 KB 120ms
120ms Image
text/html 2a02:4780:dead:cb8f::1
AWEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://concentforintsa.cf/static/bundles/base/sprite_core.png/2115b50d229d.png

Requested by

Host: concentforintsa.cf
URL: http://concentforintsa.cf/

Protocol

HTTP/1.1

Server

2a02:4780:dead:cb8f::1 , United States, ASN204915 (AWEX, CY),

Reverse DNS

Software

awex /

Resource Hash

134ed6d615029fc4909d6ef1daf58e9d96254b7ec1739a739477a30181c127a7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: nl-NL,nl;q=0.9
Referer: http://concentforintsa.cf/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Sat, 26 Mar 2022 13:19:45 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: awex
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
X-Xss-Protection: 1; mode=block
X-Request-ID: 600b98e4221f34b66f8122339cba8c41

GET
H/1.1 200
OK qMnGlIs-JNW.html Show response
concentforintsa.cf/asda_files/ Frame 3F46 160 KB
55 KB 116ms
115ms Document
text/html 2a02:4780:dead:cb8f::1
AWEX

General

Check archive.org

Show headers Download Go to

Full URL

http://concentforintsa.cf/asda_files/qMnGlIs-JNW.html

Requested by

Host: concentforintsa.cf
URL: http://concentforintsa.cf/

Protocol

HTTP/1.1

Server

2a02:4780:dead:cb8f::1 , United States, ASN204915 (AWEX, CY),

Reverse DNS

Software

awex /

Resource Hash

8463bfe428d2f83efa6cc22bce567db6ad415f2a3a28e0b9155113a7aa12021c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: nl-NL,nl;q=0.9
Referer: http://concentforintsa.cf/

Response headers

Date: Sat, 26 Mar 2022 13:19:45 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Server: awex
X-Xss-Protection: 1; mode=block
X-Content-Type-Options: nosniff
X-Request-ID: d4fa2e4775a83465d1cdde55f97a84ab
Content-Encoding: gzip

GET
H/1.1 200
OK ping.html Show response
concentforintsa.cf/asda_files/ Frame 1105 161 KB
55 KB 227ms
120ms Document
text/html 2a02:4780:dead:cb8f::1
AWEX

General

Check archive.org

Show headers Download Go to

Full URL

http://concentforintsa.cf/asda_files/ping.html

Requested by

Host: concentforintsa.cf
URL: http://concentforintsa.cf/

Protocol

HTTP/1.1

Server

2a02:4780:dead:cb8f::1 , United States, ASN204915 (AWEX, CY),

Reverse DNS

Software

awex /

Resource Hash

502601faf3fc4ea5963331050226b8de55e8fae19f256b488c10f5279a3358da

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: nl-NL,nl;q=0.9
Referer: http://concentforintsa.cf/

Response headers

Date: Sat, 26 Mar 2022 13:19:45 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Server: awex
X-Xss-Protection: 1; mode=block
X-Content-Type-Options: nosniff
X-Request-ID: 4d487fc9db428fe14bc05cb346725bb1
Content-Encoding: gzip

GET
DATA 200
OK truncated
/ Frame 3F46 2 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 01c3692a6901b3e64b5a297e838cadc207368b096a1491de6373e43ed776c9a5

Request headers

Accept-Language: nl-NL,nl;q=0.9
Referer: http://concentforintsa.cf/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 3F46 3 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a86fb46f74eccd1cafc10601e1db03099e6ffc24f9ea61a0956f2f3a3eda3aca

Request headers

Accept-Language: nl-NL,nl;q=0.9
Referer: http://concentforintsa.cf/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 3F46 155 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7808605ddd1f0eaa454aa444293d2f0260943e51e53838fca46506e6a69fe521

Request headers

Accept-Language: nl-NL,nl;q=0.9
Referer: http://concentforintsa.cf/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 1105 2 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 01c3692a6901b3e64b5a297e838cadc207368b096a1491de6373e43ed776c9a5

Request headers

Accept-Language: nl-NL,nl;q=0.9
Referer: http://concentforintsa.cf/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 1105 3 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a86fb46f74eccd1cafc10601e1db03099e6ffc24f9ea61a0956f2f3a3eda3aca

Request headers

Accept-Language: nl-NL,nl;q=0.9
Referer: http://concentforintsa.cf/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Content-Type: image/png

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: newbigdata.science
URL: https://newbigdata.science/__cpa.cp.js?dummy=bb38f5627f85538afdae92980142c88c&__cpo=1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Instagram (Social Network)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://newbigdata.science/__cpa.cp.js?dummy=bb38f5627f85538afdae92980142c88c&__cpo=1 Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network	error	URL: http://concentforintsa.cf/static/bundles/base/sprite_core.png/2115b50d229d.png Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

concentforintsa.cf
newbigdata.science
www.transparentpng.com
newbigdata.science
176.9.17.111
2a02:4780:dead:cb8f::1
01c3692a6901b3e64b5a297e838cadc207368b096a1491de6373e43ed776c9a5
134ed6d615029fc4909d6ef1daf58e9d96254b7ec1739a739477a30181c127a7
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
502601faf3fc4ea5963331050226b8de55e8fae19f256b488c10f5279a3358da
6019a913bf6bc762f49ae1cc97f4bbffb215b45e9ef7939cf83681186e6468b6
7808605ddd1f0eaa454aa444293d2f0260943e51e53838fca46506e6a69fe521
7eb1631bff9272b121e804882618e664799e4693182681621373a18c2fc87d27
8463bfe428d2f83efa6cc22bce567db6ad415f2a3a28e0b9155113a7aa12021c
a86fb46f74eccd1cafc10601e1db03099e6ffc24f9ea61a0956f2f3a3eda3aca
b98a5b8a78f04510e71900e3fa895406e61924c619021cc58f87bab29e0bfb02

concentforintsa.cf Open in urlscan Pro 2a02:4780:dead:cb8f::1 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

8 Requests

0 %HTTPS

50 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

222 kBTransfer

618 kBSize

0 Cookies

1 Outgoing links

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 5 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

7 JavaScript Global Variables

0 Cookies

2 Console Messages

Security Headers

Indicators

concentforintsa.cf Open in urlscan Pro
2a02:4780:dead:cb8f::1 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

0 %
HTTPS

50 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

222 kB
Transfer

618 kB
Size

0
Cookies

8 HTTP transactions
5 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!