![](/screenshots/139c63e1-c339-4b82-8e69-7f4754155a2a.png)
protect.restorecord-backup.xyz
Open in
urlscan Pro
172.67.140.223
Public Scan
Submission Tags: @phish_report
Submission: On May 05 via api from FI — Scanned from FI
Summary
TLS certificate: Issued by E1 on May 5th 2024. Valid for: 3 months.
This is the only time protect.restorecord-backup.xyz was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 | 172.67.140.223 172.67.140.223 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 104.26.7.187 104.26.7.187 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 172.67.70.229 172.67.70.229 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 142.250.186.163 142.250.186.163 | 15169 (GOOGLE) (GOOGLE) | |
6 | 4 |
ASN15169 (GOOGLE, US)
PTR: fra24s08-in-f3.1e100.net
fonts.gstatic.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
2 |
gstatic.com
fonts.gstatic.com |
75 KB |
2 |
restorecord.com
restorecord.com cdn.restorecord.com |
13 KB |
2 |
restorecord-backup.xyz
protect.restorecord-backup.xyz |
5 KB |
6 | 3 |
Domain | Requested by | |
---|---|---|
2 | fonts.gstatic.com |
protect.restorecord-backup.xyz
|
2 | protect.restorecord-backup.xyz | |
1 | cdn.restorecord.com |
protect.restorecord-backup.xyz
|
1 | restorecord.com |
protect.restorecord-backup.xyz
|
6 | 4 |
This site contains links to these domains. Also see Links.
Domain |
---|
login.restorecord-backup.xyz |
Subject Issuer | Validity | Valid | |
---|---|---|---|
restorecord-backup.xyz E1 |
2024-05-05 - 2024-08-03 |
3 months | crt.sh |
restorecord.com GTS CA 1P5 |
2024-04-23 - 2024-07-22 |
3 months | crt.sh |
cdn.restorecord.com E1 |
2024-04-23 - 2024-07-22 |
3 months | crt.sh |
*.gstatic.com GTS CA 1C3 |
2024-04-16 - 2024-07-09 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://protect.restorecord-backup.xyz/verify?data=eyJndWlsZElkIjogNTE4NDA2NzY1NzE3NDg3NjI1LCAiY2xpZW50SWQiOiAxMjM2NTkwODI5MDE2MDU1ODg4LCAibmFtZSI6ICJOdWRlcyAmIE5zZncgXHVkODNkXHVkZDFlXHVkODNjXHVkZjM1IiwgImV4cGlyZXMiOiAiMTcxNDkzODA0NiIsICJkb21haW4iOiAibG9naW4ucmVzdG9yZWNvcmQtYmFja3VwLnh5eiJ9
Frame ID: D3240414DF5900D4ECA7909D11645AF5
Requests: 6 HTTP requests in this frame
1 Outgoing links
These are links going to different origins than the main page.
Title: Verify
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
6 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
verify
protect.restorecord-backup.xyz/ |
48 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
907a4567ba2948de.css
restorecord.com/_next/static/css/ |
27 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo512.png
cdn.restorecord.com/ |
9 KB 10 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa1ZL7W0Q5nw.woff2
fonts.gstatic.com/s/inter/v13/ |
45 KB 46 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
UcCO3FwrK3iLTeHuS_fvQtMwCp50KnMw2boKoduKmMEVuFuYAZ9hjg.woff
fonts.gstatic.com/s/inter/v13/ |
29 KB 29 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
favicon.ico
protect.restorecord-backup.xyz/ |
0 343 B |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
8 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| _0x4074c1 function| getParameterByName string| dataParam function| _0x29a9 function| _0x1586 string| decodedData object| jsonData object| verificationButton0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn.restorecord.com
fonts.gstatic.com
protect.restorecord-backup.xyz
restorecord.com
104.26.7.187
142.250.186.163
172.67.140.223
172.67.70.229
3bcf04ca301e44f13f404c8a04aa4ae707f67a950e12ef30c238f96e784266a1
8c376c5f1480b3f80fad49fcf7a96314d9b71aa91eb6f193d636d1ac57d47e3d
9c02afb0fbba97b7a315201407cbb9bec9b14c93f26a64b939671c4b0d10caeb
adc6e86d7fff513934f5eef8d9a49c6b83ccfe4b9dc571b6076106ab9f688df1
d1a0a32e8d49017912d40af0d18cc4cd423b9da133d9dc6d78ace46f5aaa1c82
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855