ifreecards.com Open in urlscan Pro
2606:4700:30::681b:865b Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://www.amazon.axteam.pw/
Effective URL:
https://ifreecards.com/8920943
Submission: On September 20 via automatic, source certstream-suspicious (September 20th 2019, 4:30:10 am UTC)

Summary HTTP 18 Redirects Behaviour Indicators

Summary

This website contacted 7 IPs in 2 countries across 6 domains to perform 18 HTTP transactions. The main IP is 2606:4700:30::681b:865b, located in United States and belongs to CLOUDFLARENET - Cloudflare, Inc., US. The main domain is ifreecards.com.
TLS certificate: Issued by CloudFlare Inc ECC CA-2 on February 1st 2019. Valid for: a year.

This is the only time ifreecards.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Scam (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 1	69.16.212.201 69.16.212.201	32244 (LIQUIDWEB) (LIQUIDWEB - Liquid Web)
6	2606:4700:30:... 2606:4700:30::681b:865b	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1	2a00:1450:400... 2a00:1450:4001:81f::200a	15169 (GOOGLE) (GOOGLE - Google LLC)
7	2a00:1450:400... 2a00:1450:4001:806::2010	15169 (GOOGLE) (GOOGLE - Google LLC)
1	2a00:1450:400... 2a00:1450:4001:825::200e	15169 (GOOGLE) (GOOGLE - Google LLC)
1	2a00:1450:400... 2a00:1450:4001:821::200a	15169 (GOOGLE) (GOOGLE - Google LLC)
1	2a00:1450:400... 2a00:1450:4001:825::2003	15169 (GOOGLE) (GOOGLE - Google LLC)
1	35.186.205.120 35.186.205.120	15169 (GOOGLE) (GOOGLE - Google LLC)
18	7

1 69.16.212.201 (Lansing, United States) 1 redirects

ASN32244 (LIQUIDWEB - Liquid Web, L.L.C, US)
PTR: ben.securewebhosting.net

www.amazon.axteam.pw	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2606:4700:30::681b:865b (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

ifreecards.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
app.ifreecards.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81f::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:806::2010 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

storage.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:825::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:821::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:825::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.186.205.120 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: 120.205.186.35.bc.googleusercontent.com

anthill.instapage.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	googleapis.com fonts.googleapis.com storage.googleapis.com ajax.googleapis.com	393 KB
6	ifreecards.com ifreecards.com app.ifreecards.com	21 KB
1	instapage.com anthill.instapage.com	192 B
1	gstatic.com fonts.gstatic.com	9 KB
1	google-analytics.com www.google-analytics.com	17 KB
1	axteam.pw 1 redirects www.amazon.axteam.pw	142 B
18	6

	Domain	Requested by
7	storage.googleapis.com	ifreecards.com
5	app.ifreecards.com	ifreecards.com app.ifreecards.com
1	anthill.instapage.com	ifreecards.com
1	fonts.gstatic.com	ifreecards.com
1	ajax.googleapis.com	ifreecards.com
1	www.google-analytics.com	ifreecards.com
1	fonts.googleapis.com	ifreecards.com
1	ifreecards.com
1	www.amazon.axteam.pw	1 redirects
18	9

This site contains no links.

Subject Issuer	Validity	Valid
sni.cloudflaressl.com CloudFlare Inc ECC CA-2	`2019-02-01` - `2020-02-01`	a year	crt.sh
*.googleapis.com GTS CA 1O1	`2019-09-05` - `2019-11-28`	3 months	crt.sh
*.storage.googleapis.com GTS CA 1O1	`2019-09-05` - `2019-11-28`	3 months	crt.sh
*.google-analytics.com GTS CA 1O1	`2019-09-05` - `2019-11-28`	3 months	crt.sh
*.google.com GTS CA 1O1	`2019-09-05` - `2019-11-28`	3 months	crt.sh
*.instapage.com DigiCert SHA2 Secure Server CA	`2018-10-01` - `2019-11-27`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://ifreecards.com/8920943
Frame ID: 46228C0F11423E9F578CB122A358A3C9
Requests: 18 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://www.amazon.axteam.pw/ HTTP 301
https://ifreecards.com/8920943 Page URL

Detected technologies

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i

Page Statistics

18
Requests

100 %
HTTPS

75 %
IPv6

6
Domains

9
Subdomains

7
IPs

2
Countries

441 kB
Transfer

927 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://www.amazon.axteam.pw/ HTTP 301
https://ifreecards.com/8920943 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

18 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request 8920943 Show response
ifreecards.com/
Redirect Chain

https://www.amazon.axteam.pw/
https://ifreecards.com/8920943

34 KB
8 KB

141ms
82ms

Document
text/html

2606:4700:30::681b:865b
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://ifreecards.com/8920943
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::681b:865b , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare / PHP/5.4.16
Resource Hash: 3e3fc699ce68c8f8feb049e0f9890aa963f64f4c552aa4cfa41eb942814bbf92

Request headers

:method: GET
:authority: ifreecards.com
:scheme: https
:path: /8920943
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode: navigate
sec-fetch-user: ?1
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: none
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1

Response headers

status: 200
date: Fri, 20 Sep 2019 04:29:52 GMT
content-type: text/html; charset=UTF-8
set-cookie: __cfduid=dc987b840d22454ef59cb1897769108241568953792; expires=Sat, 19-Sep-20 04:29:52 GMT; path=/; domain=.ifreecards.com; HttpOnly
vary: CF-Visitor
x-powered-by: PHP/5.4.16
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store, must-revalidate
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 51910f952c028c74-VIE
content-encoding: br

Redirect headers

status: 301
content-type: text/html
content-length: 705
date: Fri, 20 Sep 2019 04:29:53 GMT
server: LiteSpeed
location: https://ifreecards.com/8920943
alt-svc: quic=":443"; ma=2592000; v="39,43,46", h3-22=":443"; ma=2592000

GET
H2 200 css
fonts.googleapis.com/ 24 KB
1 KB 17ms
17ms Stylesheet
text/css 2a00:1450:4001:81f::200a
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans:300italic,400italic,600italic,700italic,800italic,400,300,600,700,800

Requested by

Host: ifreecards.com
URL: https://ifreecards.com/8920943

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

0a733c9a259685cf9a9816145434c0087227f35400e16208e7e63e58ccd44538

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Fri, 20 Sep 2019 04:29:52 GMT
server: ESF
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
status: 200
date: Fri, 20 Sep 2019 04:29:52 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
x-xss-protection: 0
expires: Fri, 20 Sep 2019 04:29:52 GMT

GET
H2 200 031a761e2b05d2bed213fd1f07412755.css
storage.googleapis.com/instapage-app-assets/433/ 215 KB
34 KB 378ms
365ms Stylesheet
text/css 2a00:1450:4001:806::2010
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://storage.googleapis.com/instapage-app-assets/433/031a761e2b05d2bed213fd1f07412755.css
Requested by: Host: ifreecards.com
URL: https://ifreecards.com/8920943
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:806::2010 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software: UploadServer /
Resource Hash: df98f0e1b31496371a07477e82507a48902a54ff40b0bc60bb11f6810ba59b75

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 20 Sep 2019 04:29:53 GMT
content-encoding: gzip
x-goog-stored-content-length: 34362
status: 200
x-guploader-uploadid: AEnB2Up3teZvbPfWgAkvgxzpUNoENM-SOLMgLy_QTSnHwSaBvAVYo1Za30NnI_Ni6AuCGd4e_UXrzPKIDuslD7jbr029n3AQZw
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
x-goog-meta-expires: Sun, 15 Apr 2018 07:53:04 GMT
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 34362
last-modified: Wed, 22 Feb 2017 15:53:04 GMT
server: UploadServer
etag: "16132f83a09982ab6a69fa822ca385a9"
vary: Accept-Encoding
x-goog-hash: crc32c=hrMKog==, md5=FhMvg6CZgqtqafqCLKOFqQ==
x-goog-generation: 1487778784229510
access-control-allow-origin: *
access-control-expose-headers: Content-Type
cache-control: max-age=315360000, public
x-goog-meta-content-length: 34362
accept-ranges: bytes
content-type: text/css
expires: Sat, 19 Sep 2020 04:29:53 GMT

GET
H2 200 a5cb880a745154a6a1a45f3465215dfd.js Show response
storage.googleapis.com/instapage-app-assets/433/ 201 KB
66 KB 307ms
294ms Script
text/javascript 2a00:1450:4001:806::2010
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://storage.googleapis.com/instapage-app-assets/433/a5cb880a745154a6a1a45f3465215dfd.js
Requested by: Host: ifreecards.com
URL: https://ifreecards.com/8920943
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:806::2010 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software: UploadServer /
Resource Hash: 15b3fcc73003a15db7d41d2c0f6e03a432fe190c0da5603cbd71b5cc5111b6b8

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 20 Sep 2019 04:29:53 GMT
content-encoding: gzip
x-goog-stored-content-length: 67426
status: 200
x-guploader-uploadid: AEnB2UqlzHg5GQIGOfAr1ArBPUxNkv0ldtcTzZqIYHm0Vvyg_EIQ8takmRdM0W7nFF9hHk6BtlC4xnuln5kXq5DqmKkowdfrdA
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
x-goog-meta-expires: Sun, 15 Apr 2018 07:53:03 GMT
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 67426
last-modified: Wed, 22 Feb 2017 15:53:03 GMT
server: UploadServer
etag: "950df85e291c10eeaa94f3fe572e1d38"
vary: Accept-Encoding
x-goog-hash: crc32c=vxmlYw==, md5=lQ34XikcEO6qlPP+Vy4dOA==
x-goog-generation: 1487778783831000
access-control-allow-origin: *
access-control-expose-headers: Content-Type
cache-control: max-age=315360000, public
x-goog-meta-content-length: 67426
accept-ranges: bytes
content-type: text/javascript
expires: Sat, 19 Sep 2020 04:29:53 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 43 KB
17 KB 5ms
5ms Script
text/javascript 2a00:1450:4001:825::200e
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: ifreecards.com
URL: https://ifreecards.com/8920943

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 19 Aug 2019 17:22:41 GMT
server: Golfe2
age: 6379
date: Fri, 20 Sep 2019 02:43:33 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 17803
expires: Fri, 20 Sep 2019 04:43:33 GMT

GET
H2 200 13420723-0-gift-512.png
storage.googleapis.com/instapage-user-media/b2744156/ 15 KB
15 KB 353ms
353ms Image
image/png 2a00:1450:4001:806::2010
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://storage.googleapis.com/instapage-user-media/b2744156/13420723-0-gift-512.png
Requested by: Host: ifreecards.com
URL: https://ifreecards.com/8920943
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:806::2010 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software: UploadServer /
Resource Hash: 0ac4b4d72af766c982f24f4f94593f8ef8e0cb811f52ddf022ef387567ba34e2

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 20 Sep 2019 04:29:53 GMT
x-goog-stored-content-length: 14984
x-guploader-uploadid: AEnB2UqEOb9Ef7XQxX21MdJh_2bju2itcq5TbXNHxTViqBtTqr8naYK628ag5XkviEETKMRBper-qBkHij0MWqw0cPj3V6xj0Q
x-goog-storage-class: STANDARD
status: 200
x-goog-metageneration: 3
x-goog-stored-content-encoding: identity
x-goog-meta-expires: Sun, 15 Apr 2018 12:12:09 GMT
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 14984
last-modified: Wed, 22 Feb 2017 20:12:09 GMT
server: UploadServer
etag: "2d123796dc004230907b915f97318ac1"
x-goog-hash: crc32c=6T43sg==, md5=LRI3ltwAQjCQe5FflzGKwQ==
x-goog-generation: 1487794329321000
cache-control: max-age=315360000, public
x-goog-meta-content-length: 0
accept-ranges: bytes
content-type: image/png
expires: Sat, 19 Sep 2020 04:29:53 GMT

GET
H2 200 13421163-0-GC-logo-cllb.jpg
storage.googleapis.com/instapage-user-media/b2744156/ 111 KB
112 KB 330ms
329ms Image
image/jpeg 2a00:1450:4001:806::2010
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://storage.googleapis.com/instapage-user-media/b2744156/13421163-0-GC-logo-cllb.jpg
Requested by: Host: ifreecards.com
URL: https://ifreecards.com/8920943
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:806::2010 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software: UploadServer /
Resource Hash: c0075f6b6e95c31341304489c22fafb990ff877932a7b065beea264991036907

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 20 Sep 2019 04:29:53 GMT
x-goog-stored-content-length: 113832
x-guploader-uploadid: AEnB2UqyWp9gHGDXQjAfwBNP9b8cBgHoAbrFSJBgNzRVcgq_86vzxjdPULU_Sq61Pkxl_mrTzmfvchPx5wyQI7dk1n6ppsBukA
x-goog-storage-class: STANDARD
status: 200
x-goog-metageneration: 3
x-goog-stored-content-encoding: identity
x-goog-meta-expires: Sun, 15 Apr 2018 12:25:07 GMT
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 113832
last-modified: Wed, 22 Feb 2017 20:25:07 GMT
server: UploadServer
etag: "c4ac84a487778525ef94fe04e9c81c0e"
x-goog-hash: crc32c=DnDDVg==, md5=xKyEpId3hSXvlP4E6cgcDg==
x-goog-generation: 1487795107918000
cache-control: max-age=315360000, public
x-goog-meta-content-length: 0
accept-ranges: bytes
content-type: image/jpeg
expires: Sat, 19 Sep 2020 04:29:53 GMT

GET
H2 200 13421213-0-rsz-amazon.png
storage.googleapis.com/instapage-user-media/b2744156/ 52 KB
52 KB 443ms
443ms Image
image/png 2a00:1450:4001:806::2010
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://storage.googleapis.com/instapage-user-media/b2744156/13421213-0-rsz-amazon.png
Requested by: Host: ifreecards.com
URL: https://ifreecards.com/8920943
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:806::2010 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software: UploadServer /
Resource Hash: 3f375e016ac4a5ca03f8dd180088dda37b0a80b21849d81724f9636d469bd724

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 20 Sep 2019 04:29:53 GMT
x-goog-stored-content-length: 52984
x-guploader-uploadid: AEnB2UqzvsJWAvr90rf49VWlJPzX708DxR38KUgyYFBc6q7RRazy6BTVQMbzE2CE3mfeIX5Q0h9F0ohH48VL4aNc_iL3p4Rz4w
x-goog-storage-class: STANDARD
status: 200
x-goog-metageneration: 3
x-goog-stored-content-encoding: identity
x-goog-meta-expires: Sun, 15 Apr 2018 12:26:27 GMT
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 52984
last-modified: Wed, 22 Feb 2017 20:26:27 GMT
server: UploadServer
etag: "7fc58430d5061f705f0a969b3bc335c7"
x-goog-hash: crc32c=0v4A2Q==, md5=f8WEMNUGH3BfCpabO8M1xw==
x-goog-generation: 1487795187316000
cache-control: max-age=315360000, public
x-goog-meta-content-length: 0
accept-ranges: bytes
content-type: image/png
expires: Sat, 19 Sep 2020 04:29:53 GMT

GET
H2 200 13421408-0-rsz-1rsz-title.png
storage.googleapis.com/instapage-user-media/b2744156/ 83 KB
83 KB 319ms
318ms Image
image/png 2a00:1450:4001:806::2010
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://storage.googleapis.com/instapage-user-media/b2744156/13421408-0-rsz-1rsz-title.png
Requested by: Host: ifreecards.com
URL: https://ifreecards.com/8920943
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:806::2010 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software: UploadServer /
Resource Hash: dcc17d750bc000fae72a53b1a389cdc001a8ed2e956663dce9a80ccc6eec4de2

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 20 Sep 2019 04:29:53 GMT
x-goog-stored-content-length: 84508
x-guploader-uploadid: AEnB2UpmMiQVga28J2TtYfSPdrX2f7m8prSFcLWPXWaYs6ECnKNCbzyHPumBdU96bZk0qYrVNUgXXXUbCAHHR5VnYWWwkzIptg
x-goog-storage-class: STANDARD
status: 200
x-goog-metageneration: 3
x-goog-stored-content-encoding: identity
x-goog-meta-expires: Sun, 15 Apr 2018 12:32:52 GMT
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 84508
last-modified: Wed, 22 Feb 2017 20:32:52 GMT
server: UploadServer
etag: "816c7a53675fb2f34c71f72b5ff6f37c"
x-goog-hash: crc32c=BEdaJQ==, md5=gWx6U2dfsvNMcfcrX/bzfA==
x-goog-generation: 1487795572266000
cache-control: max-age=315360000, public
x-goog-meta-content-length: 0
accept-ranges: bytes
content-type: image/png
expires: Sat, 19 Sep 2020 04:29:53 GMT

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/2.2.4/ 84 KB
29 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:821::200a
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js

Requested by

Host: ifreecards.com
URL: https://ifreecards.com/8920943

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:821::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 03 Sep 2019 19:12:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1415839
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 30028
x-xss-protection: 0
last-modified: Tue, 20 Dec 2016 18:17:03 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 02 Sep 2020 19:12:33 GMT

GET
H2 200 locker.js Show response
app.ifreecards.com/public/external/ 22 KB
6 KB 595ms
582ms Script
text/javascript 2606:4700:30::681b:865b
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://app.ifreecards.com/public/external/locker.js
Requested by: Host: ifreecards.com
URL: https://ifreecards.com/8920943
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::681b:865b , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4d9e5c69afebfe736f5c72f115e98dd41705e81e5e2562b38a3cec33929c8aaf

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 20 Sep 2019 04:29:53 GMT
content-encoding: br
cf-cache-status: REVALIDATED
last-modified: Tue, 29 Jan 2019 21:26:39 GMT
server: cloudflare
etag: W/"5749-5809f72e3e708"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=14400
cf-ray: 51910f95ec568c74-VIE
expires: Fri, 20 Sep 2019 08:29:53 GMT

GET
H2 200 mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
fonts.gstatic.com/s/opensans/v17/ 9 KB
9 KB 6ms
5ms Font
font/woff2 2a00:1450:4001:825::2003
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v17/mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2

Requested by

Host: ifreecards.com
URL: https://ifreecards.com/8920943

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://fonts.googleapis.com/css?family=Open+Sans:300italic,400italic,600italic,700italic,800italic,400,300,600,700,800
Origin: https://ifreecards.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 03 Sep 2019 21:41:24 GMT
x-content-type-options: nosniff
last-modified: Tue, 23 Jul 2019 19:30:49 GMT
server: sffe
age: 1406909
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 9132
x-xss-protection: 0
expires: Wed, 02 Sep 2020 21:41:24 GMT

GET
H2 200 html.604446.b9c35.0.js Show response
app.ifreecards.com/public/external/v2/ 26 KB
6 KB 534ms
534ms Script
application/javascript 2606:4700:30::681b:865b
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://app.ifreecards.com/public/external/v2/html.604446.b9c35.0.js
Requested by: Host: app.ifreecards.com
URL: https://app.ifreecards.com/public/external/locker.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::681b:865b , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare / PHP/5.6.32
Resource Hash: 90efab0671e499153150ba03069c13f6dd071fb3c31de70e71f22175308a5a92

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 20 Sep 2019 04:29:54 GMT
content-encoding: br
cf-cache-status: MISS
server: cloudflare
x-powered-by: PHP/5.6.32
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=14400
cf-ray: 51910f999d7e8c74-VIE
expires: Fri, 20 Sep 2019 08:29:53 GMT

GET
H2 200 css_front.css
app.ifreecards.com/public/external/ 6 KB
1 KB 364ms
363ms Stylesheet
text/css 2606:4700:30::681b:865b
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://app.ifreecards.com/public/external/css_front.css
Requested by: Host: app.ifreecards.com
URL: https://app.ifreecards.com/public/external/locker.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::681b:865b , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: a7bd79b6fba60944ee3a9c153108ff0819d2db57850116ac7065a86db08af4ec

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 20 Sep 2019 04:29:53 GMT
content-encoding: br
cf-cache-status: EXPIRED
last-modified: Tue, 04 Dec 2018 23:08:50 GMT
server: cloudflare
etag: W/"19c4-57c3a5934f53b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: public, max-age=14400
cf-ray: 51910f999d7f8c74-VIE
expires: Fri, 20 Sep 2019 08:29:53 GMT

GET
H2 200 visit
anthill.instapage.com/projects/56c2f3d796773d0a7e96a536/events/ 35 B
192 B 153ms
113ms Image
application/octet-stream 35.186.205.120
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://anthill.instapage.com/projects/56c2f3d796773d0a7e96a536/events/visit?api_key=f1058d5b927a12ddc563dd85bc2a63729bf00fdc344b3786d76f13375d89b5c7251079a9f51b614d5f4c59ba2c388005fbc03c83415082e6e7bce9747a6322437ecffc9b6a102bb823bcb980e250dfefed6e63eff4528b66d83b09e45111f358007612bcc1114576c1668c8e06dc7b892070bb236ac60c50aa0f10ac61596889e3463e4bfa6f09c166373762d3f4c727&data=eyJ1c2VyX2lkIjoxMjc4NDE5LCJwYWdlX2lkIjo0OTA4NDk4LCJwdWJsaXNoZWRfdmVyc2lvbiI6OCwicXVhbnRpdHkiOjEsInN0YXRpY19wYWdlIjpmYWxzZSwidmFyaWF0aW9uX25hbWUiOiJBIiwidmFyaWF0aW9uX2lkIjoxLCJsaW5rZWRfdmFyaWF0aW9uX2lkIjoyLCJpbml0aWFsX3Jlc3BvbnNpdmVfbW9kZSI6bnVsbCwidmlzaXRvcl9pcCI6IjEwNC4xNTUuMTU5LjcxIiwidXNlcmFnZW50IjoiIiwiamF2YXNjcmlwdCI6dHJ1ZSwidmFyaWF0aW9uIjoiQSIsImdlbmVyYXRpb25fdGltZSI6IjExNSIsInJlc3BvbnNpdmVfbW9kZSI6bnVsbCwidmlzaXRlZCI6MH0=
Requested by: Host: ifreecards.com
URL: https://ifreecards.com/8920943
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.186.205.120 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 120.205.186.35.bc.googleusercontent.com
Software: / Express
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 20 Sep 2019 04:29:53 GMT
via: 1.1 google
etag: W/"23-X71HIiL+uKIs9biqXcW44Tr4jis"
x-powered-by: Express
vary: Origin
content-type: application/octet-stream
status: 200
alt-svc: clear
content-length: 35

GET
H2 200 css.css
app.ifreecards.com/public/clockers/PrimeApps/ 1010 B
412 B 358ms
358ms Stylesheet
text/css 2606:4700:30::681b:865b
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://app.ifreecards.com/public/clockers/PrimeApps/css.css
Requested by: Host: app.ifreecards.com
URL: https://app.ifreecards.com/public/external/locker.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::681b:865b , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: a7081a117335212b9e7f2e348f7369a64423d51db1666310b3451e7375f0b7de

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 20 Sep 2019 04:29:54 GMT
content-encoding: br
cf-cache-status: EXPIRED
last-modified: Tue, 04 Dec 2018 23:26:58 GMT
server: cloudflare
etag: W/"3f2-57c3a9a17efb1"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: public, max-age=14400
cf-ray: 51910f9cef148c74-VIE
expires: Fri, 20 Sep 2019 08:29:54 GMT

GET
H2 200 loading_circle.svg
storage.googleapis.com/instapage-app-assets/img/ 694 B
1010 B 163ms
163ms Image
image/svg+xml 2a00:1450:4001:806::2010
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://storage.googleapis.com/instapage-app-assets/img/loading_circle.svg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:806::2010 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software: UploadServer /
Resource Hash: eec2c40d8b1bb98306990239204d8b90ca030f0def0e00dfe3117ae42991e126

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 20 Sep 2019 04:29:54 GMT
x-guploader-uploadid: AEnB2UqeS_MNEMEgOsxrJbW4y9RffKDJwgmaXs4iDu4WSIFKUF4GTk0LLuBKln763lkPNXvWLOkROgNX9ja-3ZqN1n_HYrhlEQ
x-goog-storage-class: STANDARD
status: 200
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
content-length: 694
last-modified: Mon, 04 Jul 2016 13:37:12 GMT
server: UploadServer
etag: "be00fc4a29d03016e78b28c9943e3f51"
x-goog-hash: crc32c=Y/o9cg==, md5=vgD8SinQMBbniyjJlD4/UQ==
x-goog-generation: 1467639432842000
access-control-allow-origin: *
access-control-expose-headers: Content-Type
cache-control: public, max-age=3600
x-goog-stored-content-length: 694
accept-ranges: bytes
content-type: image/svg+xml
expires: Fri, 20 Sep 2019 05:29:54 GMT

GET
H2 200 check.php Show response
app.ifreecards.com/public/external/ 0
59 B 356ms
356ms Script
application/javascript 2606:4700:30::681b:865b
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://app.ifreecards.com/public/external/check.php?time=1568953796062&it=604446
Requested by: Host: app.ifreecards.com
URL: https://app.ifreecards.com/public/external/locker.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::681b:865b , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare / PHP/5.6.32
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode: no-cors
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 20 Sep 2019 04:29:56 GMT
server: cloudflare
x-powered-by: PHP/5.6.32
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type: application/javascript
status: 200
cf-ray: 51910fa96c688c74-VIE
content-length: 0

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Scam (Online)

58 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			ifreecards.com/	1970-01-19 12:34:49	Name: instapage-visit-4908498 Value: %7B%22A%22%3A%7B%22b%22%3A1%2C%22d%22%3A1568953793%7D%7D
			.ifreecards.com/	1970-01-19 12:34:49	Name: __cfduid Value: dc987b840d22454ef59cb1897769108241568953792

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
anthill.instapage.com
app.ifreecards.com
fonts.googleapis.com
fonts.gstatic.com
ifreecards.com
storage.googleapis.com
www.amazon.axteam.pw
www.google-analytics.com
2606:4700:30::681b:865b
2a00:1450:4001:806::2010
2a00:1450:4001:81f::200a
2a00:1450:4001:821::200a
2a00:1450:4001:825::2003
2a00:1450:4001:825::200e
35.186.205.120
69.16.212.201
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
0a733c9a259685cf9a9816145434c0087227f35400e16208e7e63e58ccd44538
0ac4b4d72af766c982f24f4f94593f8ef8e0cb811f52ddf022ef387567ba34e2
15b3fcc73003a15db7d41d2c0f6e03a432fe190c0da5603cbd71b5cc5111b6b8
3e3fc699ce68c8f8feb049e0f9890aa963f64f4c552aa4cfa41eb942814bbf92
3f375e016ac4a5ca03f8dd180088dda37b0a80b21849d81724f9636d469bd724
4d9e5c69afebfe736f5c72f115e98dd41705e81e5e2562b38a3cec33929c8aaf
54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
90efab0671e499153150ba03069c13f6dd071fb3c31de70e71f22175308a5a92
a7081a117335212b9e7f2e348f7369a64423d51db1666310b3451e7375f0b7de
a7bd79b6fba60944ee3a9c153108ff0819d2db57850116ac7065a86db08af4ec
c0075f6b6e95c31341304489c22fafb990ff877932a7b065beea264991036907
dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a
dcc17d750bc000fae72a53b1a389cdc001a8ed2e956663dce9a80ccc6eec4de2
df98f0e1b31496371a07477e82507a48902a54ff40b0bc60bb11f6810ba59b75
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
eec2c40d8b1bb98306990239204d8b90ca030f0def0e00dfe3117ae42991e126

ifreecards.com Open in urlscan Pro 2606:4700:30::681b:865b Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

18 Requests

100 %HTTPS

75 %IPv6

6 Domains

9 Subdomains

7 IPs

2 Countries

441 kBTransfer

927 kBSize

2 Cookies

0 Outgoing links

Page URL History

Redirected requests

18 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

58 JavaScript Global Variables

2 Cookies

Indicators

ifreecards.com Open in urlscan Pro
2606:4700:30::681b:865b Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

18
Requests

100 %
HTTPS

75 %
IPv6

6
Domains

9
Subdomains

7
IPs

2
Countries

441 kB
Transfer

927 kB
Size

2
Cookies

18 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!