pages-your-reconfirm.ga Open in urlscan Pro
104.24.122.135  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request Cookie set update-payment.html Show response pages-your-reconfirm.ga/	17 KB 17 KB	386ms 380ms	Document text/html	104.24.122.135 Cloudflare
General Check archive.org Show headers Download Go to Full URL http://pages-your-reconfirm.ga/update-payment.html Protocol HTTP/1.1 Server 104.24.122.135 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 8812a9837b76526ab0c4f7cad67cc65c53a3c82d72396018b03565ac39044913 Request headers Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8 Connection keep-alive Accept-Encoding gzip, deflate Host pages-your-reconfirm.ga Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Sun, 21 Jan 2018 06:42:29 GMT Content-Encoding gzip Last-Modified Fri, 19 Jan 2018 18:54:51 GMT Server cloudflare Transfer-Encoding chunked Content-Type text/html Set-Cookie __cfduid=d756a4723f745246b9399c5bf677ffbe21516516949; expires=Mon, 21-Jan-19 06:42:29 GMT; path=/; domain=.pages-your-reconfirm.ga; HttpOnly Connection keep-alive CF-RAY 3e084b3462d0979e-FRA
GET S	200	xcd4Cels.css dl.dropboxusercontent.com/s/x9b47qezx1y1id0/	58 KB 25 KB	552ms 537ms	Stylesheet text/css	162.125.66.6 Dropbox
General Check archive.org Show headers Download Go to Full URL https://dl.dropboxusercontent.com/s/x9b47qezx1y1id0/xcd4Cels.css Requested by Host: pages-your-reconfirm.ga URL: http://pages-your-reconfirm.ga/update-payment.html Protocol SPDY Server 162.125.66.6 Frankfurt, Germany, ASN19679 (DROPBOX - Dropbox, Inc., US), Reverse DNS Software nginx / Resource Hash 60c4e43e7df89e683fec1c91a6d4586b964aa3806d29deadef19da61ea1bf534 Security Headers Name Value Strict-Transport-Security max-age=15552000; includeSubDomains Request headers Referer http://pages-your-reconfirm.ga/update-payment.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers pragma public date Sun, 21 Jan 2018 06:42:30 GMT content-encoding gzip server nginx x-server-response-time 279 vary Accept-Encoding content-type text/css; charset=utf-8 status 200 cache-control max-age=60 content-disposition inline; filename="xcd4Cels.css"; filename*=UTF-8''xcd4Cels.css strict-transport-security max-age=15552000; includeSubDomains x-robots-tag noindex, nofollow, noimageindex x-dropbox-request-id e739c2adef52350753946182c2aefdfe
GET S	200	fXKuyC3I.css dl.dropboxusercontent.com/s/l3g2pvtepeb6zuj/	362 KB 76 KB	471ms 456ms	Stylesheet text/css	162.125.66.6 Dropbox
General Check archive.org Show headers Download Go to Full URL https://dl.dropboxusercontent.com/s/l3g2pvtepeb6zuj/fXKuyC3I.css Requested by Host: pages-your-reconfirm.ga URL: http://pages-your-reconfirm.ga/update-payment.html Protocol SPDY Server 162.125.66.6 Frankfurt, Germany, ASN19679 (DROPBOX - Dropbox, Inc., US), Reverse DNS Software nginx / Resource Hash c1d2071edc96d8cceb4f7eee1aaa45769582025d08752cb710f0b5471dee65db Security Headers Name Value Strict-Transport-Security max-age=15552000; includeSubDomains Request headers Referer http://pages-your-reconfirm.ga/update-payment.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers pragma public date Sun, 21 Jan 2018 06:42:30 GMT content-encoding gzip server nginx x-server-response-time 307 vary Accept-Encoding content-type text/css; charset=utf-8 status 200 cache-control max-age=60 content-disposition inline; filename="fXKuyC3I.css"; filename*=UTF-8''fXKuyC3I.css strict-transport-security max-age=15552000; includeSubDomains x-robots-tag noindex, nofollow, noimageindex x-dropbox-request-id 2a8762be0bf447c5f38ad3ba8b38497c
GET S	200	2.js Show response dl.dropboxusercontent.com/s/c5qm0y9js3lyjnv/	4 KB 1 KB	398ms 383ms	Script application/javascript	162.125.66.6 Dropbox
General Check archive.org Show headers Download Go to Full URL https://dl.dropboxusercontent.com/s/c5qm0y9js3lyjnv/2.js Requested by Host: pages-your-reconfirm.ga URL: http://pages-your-reconfirm.ga/update-payment.html Protocol SPDY Server 162.125.66.6 Frankfurt, Germany, ASN19679 (DROPBOX - Dropbox, Inc., US), Reverse DNS Software nginx / Resource Hash 4c677c6a5d6e7c3310b8fa38d073fd08b09df076df99d012c113e189b8a06dae Security Headers Name Value Strict-Transport-Security max-age=15552000; includeSubDomains Request headers Referer http://pages-your-reconfirm.ga/update-payment.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers pragma public date Sun, 21 Jan 2018 06:42:29 GMT content-encoding gzip server nginx x-server-response-time 254 vary Accept-Encoding content-type application/javascript status 200 cache-control max-age=60 content-disposition inline; filename="2.js"; filename*=UTF-8''2.js strict-transport-security max-age=15552000; includeSubDomains x-robots-tag noindex, nofollow, noimageindex x-dropbox-request-id b190ea250313e7c9ee712dd7e1a4351b
GET H/1.1	200 OK	Upgradepayment.jpg pages-your-reconfirm.ga/update-payment_files/	13 KB 14 KB	396ms 396ms	Image image/jpeg	104.24.122.135 Cloudflare
General Check archive.org Show headers Download Go to Show image Full URL http://pages-your-reconfirm.ga/update-payment_files/Upgradepayment.jpg Requested by Host: pages-your-reconfirm.ga URL: http://pages-your-reconfirm.ga/update-payment.html Protocol HTTP/1.1 Server 104.24.122.135 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 915349098484d339675b119e657628af43749095907942f349cbd47e13118aba Request headers Pragma no-cache Accept-Encoding gzip, deflate Host pages-your-reconfirm.ga User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept image/webp,image/apng,image/*,*/*;q=0.8 Referer http://pages-your-reconfirm.ga/update-payment.html Cookie __cfduid=d756a4723f745246b9399c5bf677ffbe21516516949 Connection keep-alive Cache-Control no-cache Referer http://pages-your-reconfirm.ga/update-payment.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Sun, 21 Jan 2018 06:42:30 GMT CF-Cache-Status MISS Last-Modified Fri, 19 Jan 2018 18:54:51 GMT Server cloudflare Vary Accept-Encoding Content-Type image/jpeg Cache-Control public, max-age=14400 Connection keep-alive Accept-Ranges bytes CF-RAY 3e084b39d47e979e-FRA Content-Length 13713 Expires Sun, 21 Jan 2018 10:42:30 GMT
GET H/1.1	200 OK	kT2ocXFCst4.gif pages-your-reconfirm.ga/update-payment_files/	6 KB 6 KB	381ms 375ms	Image image/gif	104.24.123.135 Cloudflare
General Check archive.org Show headers Download Go to Show image Full URL http://pages-your-reconfirm.ga/update-payment_files/kT2ocXFCst4.gif Requested by Host: pages-your-reconfirm.ga URL: http://pages-your-reconfirm.ga/update-payment.html Protocol HTTP/1.1 Server 104.24.123.135 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 30f733ec1189c141a979904a2c134f51be5244a2490d50c8956c2e09beb36887 Request headers Pragma no-cache Accept-Encoding gzip, deflate Host pages-your-reconfirm.ga User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Accept image/webp,image/apng,image/*,*/*;q=0.8 Referer http://pages-your-reconfirm.ga/update-payment.html Cookie __cfduid=d756a4723f745246b9399c5bf677ffbe21516516949 Connection keep-alive Cache-Control no-cache Referer http://pages-your-reconfirm.ga/update-payment.html User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 Response headers Date Sun, 21 Jan 2018 06:42:30 GMT CF-Cache-Status MISS Last-Modified Fri, 19 Jan 2018 18:54:51 GMT Server cloudflare Vary Accept-Encoding Content-Type image/gif Cache-Control public, max-age=14400 Connection keep-alive Accept-Ranges bytes CF-RAY 3e084b3a433c9786-FRA Content-Length 5658 Expires Sun, 21 Jan 2018 10:42:30 GMT
GET DATA	200 OK	truncated /	182 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 42d36996c02517532ff0caa33f6f803ee71914cb480d21629484430600c88e75 Request headers Response headers Access-Control-Allow-Origin * Content-Type image/png
GET		Cou7n-nqK52.gif fbstatic-a.akamaihd.net/rsrc.php/v2/yd/r/	0 0
GET		7rpZ7CHyvX7.gif fbstatic-a.akamaihd.net/rsrc.php/v2/yt/r/	0 0
GET		wLT6Ip0h51L.png fbstatic-a.akamaihd.net/rsrc.php/v2/yZ/r/	0 0
GET		cDUSqVVxJZv.png fbstatic-a.akamaihd.net/rsrc.php/v2/yf/r/	0 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

fbstatic-a.akamaihd.net

URL

https://fbstatic-a.akamaihd.net/rsrc.php/v2/yd/r/Cou7n-nqK52.gif

Domain

fbstatic-a.akamaihd.net

URL

https://fbstatic-a.akamaihd.net/rsrc.php/v2/yt/r/7rpZ7CHyvX7.gif

Domain

fbstatic-a.akamaihd.net

URL

https://fbstatic-a.akamaihd.net/rsrc.php/v2/yZ/r/wLT6Ip0h51L.png

Domain

fbstatic-a.akamaihd.net

URL

https://fbstatic-a.akamaihd.net/rsrc.php/v2/yf/r/cDUSqVVxJZv.png

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onafterprint object| onbeforeprint function| mod10 function| expired function| validateCard

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.pages-your-reconfirm.ga/	1970-01-18 22:00:52	Name: __cfduid Value: d756a4723f745246b9399c5bf677ffbe21516516949

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

dl.dropboxusercontent.com
fbstatic-a.akamaihd.net
pages-your-reconfirm.ga
fbstatic-a.akamaihd.net
104.24.122.135
104.24.123.135
162.125.66.6
30f733ec1189c141a979904a2c134f51be5244a2490d50c8956c2e09beb36887
42d36996c02517532ff0caa33f6f803ee71914cb480d21629484430600c88e75
4c677c6a5d6e7c3310b8fa38d073fd08b09df076df99d012c113e189b8a06dae
60c4e43e7df89e683fec1c91a6d4586b964aa3806d29deadef19da61ea1bf534
8812a9837b76526ab0c4f7cad67cc65c53a3c82d72396018b03565ac39044913
915349098484d339675b119e657628af43749095907942f349cbd47e13118aba
c1d2071edc96d8cceb4f7eee1aaa45769582025d08752cb710f0b5471dee65db