service-cloudflare.com Open in urlscan Pro
111.90.142.53  Malicious Activity! Public Scan

Submitted URL: http://service-cloudflare.com/
Effective URL: https://service-cloudflare.com/
Submission: On December 15 via manual from US

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 8 HTTP transactions. The main IP is 111.90.142.53, located in Malaysia and belongs to SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY. The main domain is service-cloudflare.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on December 14th 2019. Valid for: 3 months.
This is the only time service-cloudflare.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Cloudflare (Online)

Domain & IP information

IP Address AS Autonomous System
1 2 111.90.142.53 45839 (SHINJIRU-...)
6 143.204.214.46 16509 (AMAZON-02)
1 13.35.253.35 16509 (AMAZON-02)
8 3
Apex Domain
Subdomains
Transfer
6 oktacdn.com
ok7static.oktacdn.com
505 KB
2 service-cloudflare.com
service-cloudflare.com
3 KB
1 okta.com
login.okta.com
8 3
Domain Requested by
6 ok7static.oktacdn.com service-cloudflare.com
ok7static.oktacdn.com
2 service-cloudflare.com 1 redirects
1 login.okta.com service-cloudflare.com
8 3

This site contains links to these domains. Also see Links.

Domain
cloudflare.okta.com
www.okta.com
Subject Issuer Validity Valid
service-cloudflare.com
cPanel, Inc. Certification Authority
2019-12-14 -
2020-03-13
3 months crt.sh
*.oktacdn.com
DigiCert SHA2 High Assurance Server CA
2017-11-01 -
2021-01-06
3 years crt.sh
accounts.okta.com
DigiCert SHA2 High Assurance Server CA
2019-07-29 -
2021-07-29
2 years crt.sh

This page contains 2 frames:

Primary Page: https://service-cloudflare.com/
Frame ID: 858EE608BA8A287CDAE50DC82E519CF5
Requests: 7 HTTP requests in this frame

Frame: https://login.okta.com/discovery/iframe.html
Frame ID: D279CF94F035EE14FF0612B552B009AB
Requests: 1 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. http://service-cloudflare.com/ HTTP 301
    https://service-cloudflare.com/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /^LiteSpeed$/i

Page Statistics

8
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

508 kB
Transfer

1521 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://service-cloudflare.com/ HTTP 301
    https://service-cloudflare.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
service-cloudflare.com/
Redirect Chain
  • http://service-cloudflare.com/
  • https://service-cloudflare.com/
9 KB
3 KB
Document
General
Full URL
https://service-cloudflare.com/
Protocol
H2
Security
TLS 1.3, , CHACHA20_POLY1305
Server
111.90.142.53 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY),
Reverse DNS
Software
LiteSpeed /
Resource Hash
3f20ac2f5f7d3d4c5f79f7738abacc10d3e18c687c0d414dfd0f000cb2a1fc51

Request headers

:method
GET
:authority
service-cloudflare.com
:scheme
https
:path
/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
none
sec-fetch-mode
navigate
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
200
content-type
text/html
last-modified
Sat, 14 Dec 2019 00:30:37 GMT
accept-ranges
bytes
content-encoding
br
vary
Accept-Encoding
content-length
2569
date
Sun, 15 Dec 2019 02:09:41 GMT
server
LiteSpeed
alt-svc
quic=":443"; ma=2592000; v="39,43,46", h3-Q039=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-23=":443"; ma=2592000, h3-24=":443"; ma=2592000

Redirect headers

Connection
Keep-Alive
Content-Type
text/html
Content-Length
705
Date
Sun, 15 Dec 2019 02:09:41 GMT
Server
LiteSpeed
Location
https://service-cloudflare.com/
okta-login-page.min.3845dfba3786332238bffde2ff4ac213.css
ok7static.oktacdn.com/assets/loginpage/css/
181 KB
36 KB
Stylesheet
General
Full URL
https://ok7static.oktacdn.com/assets/loginpage/css/okta-login-page.min.3845dfba3786332238bffde2ff4ac213.css
Requested by
Host: service-cloudflare.com
URL: https://service-cloudflare.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.214.46 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-143-204-214-46.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
984de765ae3b8074989b0e886a0b834da9ac7a336a749bfef7819941f4926616
Security Headers
Name Value
Strict-Transport-Security max-age=315360000

Request headers

Referer
https://service-cloudflare.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Sun, 08 Dec 2019 15:35:12 GMT
content-encoding
gzip
age
454
x-cache
Hit from cloudfront
status
200
strict-transport-security
max-age=315360000
via
1.1 1764af62d635a1a6ee51aabc37405452.cloudfront.net (CloudFront)
last-modified
Wed, 04 Dec 2019 00:32:55 GMT
server
nginx
etag
W/"3845dfba3786332238bffde2ff4ac213"
vary
Accept-Encoding
public-key-pins-report-only
pin-sha256="r5EfzZxQVvQpKo3AgYRaT7X2bDO/kj3ACwmxfdT2zt8="; pin-sha256="MaqlcUgk2mvY/RFSGeSwBRkI+rZ6/dxe/DuQfBT/vnQ="; pin-sha256="72G5IEvDEWn+EThf3qjR7/bQSWaS2ZSLqolhnO6iyJI="; pin-sha256="rrV6CLCCvqnk89gWibYT0JO6fNQ8cCit7GGoiVTjCOg="; max-age=60; report-uri="https://okta.report-uri.io/r/default/hpkp/reportOnly"
access-control-allow-origin
*
cache-control
max-age=31536000, public,max-age=31536000,s-maxage=1814400
x-amz-cf-pop
FRA53-C1
content-type
text/css
x-amz-cf-id
TDSkXyqaZdWP_lBsSBmqfjOdZIt3sJjKCq0O7hevgrwBEYGp2DWsQQ==
expires
Mon, 07 Dec 2020 15:35:12 GMT
initLoginPage.pack.b856217968304fa5f91eec101ea11e19.js
ok7static.oktacdn.com/assets/js/mvc/loginpage/
1 MB
414 KB
Script
General
Full URL
https://ok7static.oktacdn.com/assets/js/mvc/loginpage/initLoginPage.pack.b856217968304fa5f91eec101ea11e19.js
Requested by
Host: service-cloudflare.com
URL: https://service-cloudflare.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.214.46 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-143-204-214-46.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
62bff5e8ec8344eecc16c95b5fc8750a20ac405dcb27c81de08437d26a8c162f
Security Headers
Name Value
Strict-Transport-Security max-age=315360000

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://service-cloudflare.com/
Origin
https://service-cloudflare.com

Response headers

date
Wed, 04 Dec 2019 00:55:20 GMT
content-encoding
gzip
age
954744
x-cache
Hit from cloudfront
status
200
strict-transport-security
max-age=315360000
via
1.1 12c16baed6578bf50fb0eaa233f2bc84.cloudfront.net (CloudFront)
last-modified
Wed, 04 Dec 2019 00:33:11 GMT
server
nginx
etag
W/"b856217968304fa5f91eec101ea11e19"
vary
Accept-Encoding
public-key-pins-report-only
pin-sha256="r5EfzZxQVvQpKo3AgYRaT7X2bDO/kj3ACwmxfdT2zt8="; pin-sha256="MaqlcUgk2mvY/RFSGeSwBRkI+rZ6/dxe/DuQfBT/vnQ="; pin-sha256="72G5IEvDEWn+EThf3qjR7/bQSWaS2ZSLqolhnO6iyJI="; pin-sha256="rrV6CLCCvqnk89gWibYT0JO6fNQ8cCit7GGoiVTjCOg="; max-age=60; report-uri="https://okta.report-uri.io/r/default/hpkp/reportOnly"
access-control-allow-origin
*
cache-control
max-age=31536000, public,max-age=31536000,s-maxage=1814400
x-amz-cf-pop
FRA53-C1
content-type
application/javascript
x-amz-cf-id
QyqesBv7eIBf-G8FVo3jt5ZH-c3ujqQjH5enesCWmQIA8PpO89EYzg==
expires
Thu, 03 Dec 2020 00:55:20 GMT
fs0buwmp52EAhUunt356
ok7static.oktacdn.com/fs/bco/1/
2 KB
3 KB
Image
General
Full URL
https://ok7static.oktacdn.com/fs/bco/1/fs0buwmp52EAhUunt356
Requested by
Host: service-cloudflare.com
URL: https://service-cloudflare.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.214.46 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-143-204-214-46.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
914b1ba1deda664e6eefb0a0dcbd4c138812222cf8f3fc2c0866010593539b71
Security Headers
Name Value
Strict-Transport-Security max-age=315360000

Request headers

Referer
https://service-cloudflare.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Sun, 24 Nov 2019 21:11:07 GMT
via
1.1 1764af62d635a1a6ee51aabc37405452.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA53-C1
x-cache
Hit from cloudfront
status
200
content-length
2340
last-modified
Wed, 03 Jul 2019 23:18:12 GMT
server
nginx
etag
"6287b18ddd086d53015cbdb69c725bd9"
strict-transport-security
max-age=315360000
public-key-pins-report-only
pin-sha256="r5EfzZxQVvQpKo3AgYRaT7X2bDO/kj3ACwmxfdT2zt8="; pin-sha256="MaqlcUgk2mvY/RFSGeSwBRkI+rZ6/dxe/DuQfBT/vnQ="; pin-sha256="72G5IEvDEWn+EThf3qjR7/bQSWaS2ZSLqolhnO6iyJI="; pin-sha256="rrV6CLCCvqnk89gWibYT0JO6fNQ8cCit7GGoiVTjCOg="; max-age=60; report-uri="https://okta.report-uri.io/r/default/hpkp/reportOnly"
access-control-allow-origin
*
cache-control
max-age=31536000, public,max-age=31536000,s-maxage=1814400
accept-ranges
bytes
content-type
image/png
x-amz-cf-id
Q3uTLRNPCSfPxO-rFYGvkxeaokdIbp9krmm5XzaTznRmygmMsaTutg==
expires
Mon, 23 Nov 2020 21:11:07 GMT
iframe.html
login.okta.com/discovery/ Frame D279
0
0
Document
General
Full URL
https://login.okta.com/discovery/iframe.html
Requested by
Host: service-cloudflare.com
URL: https://service-cloudflare.com/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.35.253.35 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-13-35-253-35.fra6.r.cloudfront.net
Software
AmazonS3 /
Resource Hash

Request headers

Host
login.okta.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
nested-navigate
Referer
https://service-cloudflare.com/
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://service-cloudflare.com/

Response headers

Content-Type
text/html
Content-Length
546
Connection
keep-alive
Last-Modified
Tue, 26 Nov 2019 19:10:38 GMT
Server
AmazonS3
Date
Sat, 14 Dec 2019 19:14:14 GMT
ETag
"ba966ef1e20f80a6bc3f7ca5b8a9e168"
X-Cache
Hit from cloudfront
Via
1.1 35c75b7f0ca8c787d67c8ebd22bc7fc3.cloudfront.net (CloudFront)
X-Amz-Cf-Pop
FRA6-C1
X-Amz-Cf-Id
zlAmgkrYvgZBFRAmd6R6dGCDpM9ho5BzdWZYiyS62iVyntr6tzY70g==
Age
24929
fs01ox0p30x3jWQFx357
ok7static.oktacdn.com/fs/bco/7/
45 KB
46 KB
Image
General
Full URL
https://ok7static.oktacdn.com/fs/bco/7/fs01ox0p30x3jWQFx357
Requested by
Host: ok7static.oktacdn.com
URL: https://ok7static.oktacdn.com/assets/js/mvc/loginpage/initLoginPage.pack.b856217968304fa5f91eec101ea11e19.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.214.46 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-143-204-214-46.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
a98e9cb560b60c684ea648345eeaa1d6dd49d8ed79b334388bd89edd9b4c8ab8
Security Headers
Name Value
Strict-Transport-Security max-age=315360000

Request headers

Referer
https://service-cloudflare.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=315360000
via
1.1 1764af62d635a1a6ee51aabc37405452.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA53-C1
x-cache
Hit from cloudfront
status
200
date
Tue, 10 Dec 2019 22:01:32 GMT
content-length
46018
last-modified
Tue, 29 Oct 2019 15:22:38 GMT
server
nginx
etag
"76a467d764ee289fec1fff898816c538"
public-key-pins-report-only
pin-sha256="r5EfzZxQVvQpKo3AgYRaT7X2bDO/kj3ACwmxfdT2zt8="; pin-sha256="MaqlcUgk2mvY/RFSGeSwBRkI+rZ6/dxe/DuQfBT/vnQ="; pin-sha256="72G5IEvDEWn+EThf3qjR7/bQSWaS2ZSLqolhnO6iyJI="; pin-sha256="rrV6CLCCvqnk89gWibYT0JO6fNQ8cCit7GGoiVTjCOg="; max-age=60; report-uri="https://okta.report-uri.io/r/default/hpkp/reportOnly"
access-control-allow-origin
*
cache-control
max-age=31536000, public,max-age=31536000,s-maxage=1814400
accept-ranges
bytes
content-type
image/jpeg
x-amz-cf-id
KbTXPcX_Xac_693qL6FDogGKoo7ofNLb6W80D7mwZNmfEitSC7ZQsg==
expires
Wed, 09 Dec 2020 22:01:32 GMT
default.04eeeba5b3538c4524d8e6828ba2c405.png
ok7static.oktacdn.com/assets/loginpage/img/security/
2 KB
2 KB
Image
General
Full URL
https://ok7static.oktacdn.com/assets/loginpage/img/security/default.04eeeba5b3538c4524d8e6828ba2c405.png
Requested by
Host: ok7static.oktacdn.com
URL: https://ok7static.oktacdn.com/assets/js/mvc/loginpage/initLoginPage.pack.b856217968304fa5f91eec101ea11e19.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.214.46 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-143-204-214-46.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
da75c3f3ce27c081541dfb59edd7e756fefe054a9e0e976356c4b0d3778bb434
Security Headers
Name Value
Strict-Transport-Security max-age=315360000

Request headers

Referer
https://ok7static.oktacdn.com/assets/loginpage/css/okta-login-page.min.3845dfba3786332238bffde2ff4ac213.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Fri, 29 Nov 2019 01:34:45 GMT
via
1.1 1764af62d635a1a6ee51aabc37405452.cloudfront.net (CloudFront)
age
1209950
x-cache
Hit from cloudfront
status
200
content-length
1800
last-modified
Tue, 18 Dec 2018 21:10:15 GMT
server
nginx
etag
"04eeeba5b3538c4524d8e6828ba2c405"
strict-transport-security
max-age=315360000
public-key-pins-report-only
pin-sha256="r5EfzZxQVvQpKo3AgYRaT7X2bDO/kj3ACwmxfdT2zt8="; pin-sha256="MaqlcUgk2mvY/RFSGeSwBRkI+rZ6/dxe/DuQfBT/vnQ="; pin-sha256="72G5IEvDEWn+EThf3qjR7/bQSWaS2ZSLqolhnO6iyJI="; pin-sha256="rrV6CLCCvqnk89gWibYT0JO6fNQ8cCit7GGoiVTjCOg="; max-age=60; report-uri="https://okta.report-uri.io/r/default/hpkp/reportOnly"
access-control-allow-origin
*
cache-control
max-age=31536000, public,max-age=31536000,s-maxage=1814400
x-amz-cf-pop
FRA53-C1
accept-ranges
bytes
content-type
image/png
x-amz-cf-id
VXrOlJ9pcTfcQCSB0FDIz5XnoPeXiK52IsrVgWGS1DKO2D6uPd88HQ==
expires
Sat, 28 Nov 2020 01:34:45 GMT
checkbox-sign-in-widget.7846b2f8c6d0a7ca69fdd3d3c294e92d.png
ok7static.oktacdn.com/assets/loginpage/img/ui/forms/
3 KB
4 KB
Image
General
Full URL
https://ok7static.oktacdn.com/assets/loginpage/img/ui/forms/checkbox-sign-in-widget.7846b2f8c6d0a7ca69fdd3d3c294e92d.png
Requested by
Host: ok7static.oktacdn.com
URL: https://ok7static.oktacdn.com/assets/js/mvc/loginpage/initLoginPage.pack.b856217968304fa5f91eec101ea11e19.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.214.46 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-143-204-214-46.fra53.r.cloudfront.net
Software
nginx /
Resource Hash
40810b0318131f9ba52c83a17e633a0ac476ade66ea8a914d6c4980571397665
Security Headers
Name Value
Strict-Transport-Security max-age=315360000

Request headers

Referer
https://ok7static.oktacdn.com/assets/loginpage/css/okta-login-page.min.3845dfba3786332238bffde2ff4ac213.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Sun, 22 Sep 2019 00:16:53 GMT
via
1.1 1764af62d635a1a6ee51aabc37405452.cloudfront.net (CloudFront)
age
22424
x-cache
Hit from cloudfront
status
200
content-length
3141
last-modified
Tue, 18 Dec 2018 21:10:16 GMT
server
nginx
etag
"7846b2f8c6d0a7ca69fdd3d3c294e92d"
strict-transport-security
max-age=315360000
public-key-pins-report-only
pin-sha256="r5EfzZxQVvQpKo3AgYRaT7X2bDO/kj3ACwmxfdT2zt8="; pin-sha256="MaqlcUgk2mvY/RFSGeSwBRkI+rZ6/dxe/DuQfBT/vnQ="; pin-sha256="72G5IEvDEWn+EThf3qjR7/bQSWaS2ZSLqolhnO6iyJI="; pin-sha256="rrV6CLCCvqnk89gWibYT0JO6fNQ8cCit7GGoiVTjCOg="; max-age=60; report-uri="https://okta.report-uri.io/r/default/hpkp/reportOnly"
access-control-allow-origin
*
cache-control
max-age=31536000, public,max-age=31536000,s-maxage=1814400
x-amz-cf-pop
FRA53-C1
accept-ranges
bytes
content-type
image/png
x-amz-cf-id
mNwWysRkrxDT3k73Eh0zhf8ec0A0KIQRAtEOoNMsUMDVO08bFYZfPg==
expires
Mon, 21 Sep 2020 00:16:53 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Cloudflare (Online)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate object| okta object| OktaLogin object| jQBrowser function| jQueryCourage object| Backbone

0 Cookies