flocdates.safesecureentry.com Open in urlscan Pro
104.193.241.113 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://iml.kindred.graphics/
Effective URL:
http://flocdates.safesecureentry.com/?page=land2/501_uez4_ssf&x_source=vip53962.46064-1227000.&pgen=nn
Submission: On July 25 via api (July 25th 2019, 1:22:04 pm UTC) from CH

Summary HTTP 10 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 10 HTTP transactions. The main IP is 104.193.241.113, located in Toronto, Canada and belongs to AXXA-RACKCO - Rackco.com, US. The main domain is flocdates.safesecureentry.com.

This is the only time flocdates.safesecureentry.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	50.31.1.54 50.31.1.54	32748 (STEADFAST) (STEADFAST - Steadfast)
1 3	104.193.241.113 104.193.241.113	36529 (AXXA-RACKCO) (AXXA-RACKCO - Rackco.com)
1	192.229.221.188 192.229.221.188	15133 (EDGECAST) (EDGECAST - MCI Communications Services)
1	2606:4700::68... 2606:4700::6810:233f	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
10	4

1 50.31.1.54 (Chicago, United States) 1 redirects

ASN32748 (STEADFAST - Steadfast, US)
PTR: ip54.50-31-1.static.steadfastdns.net

iml.kindred.graphics	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.193.241.113 (Toronto, Canada) 1 redirects

ASN36529 (AXXA-RACKCO - Rackco.com, US)

flocdates.safesecureentry.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.229.221.188 (United States)

ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US)

media.minidtcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:233f (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

cdn.onesignal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	safesecureentry.com 1 redirects flocdates.safesecureentry.com	11 KB
1	onesignal.com cdn.onesignal.com	6 KB
1	minidtcdn.com media.minidtcdn.com	6 KB
1	kindred.graphics 1 redirects iml.kindred.graphics	351 B
10	4

	Domain	Requested by
3	flocdates.safesecureentry.com	1 redirects flocdates.safesecureentry.com
1	cdn.onesignal.com	flocdates.safesecureentry.com
1	media.minidtcdn.com	flocdates.safesecureentry.com
1	iml.kindred.graphics	1 redirects
10	4

This site contains no links.

Subject Issuer	Validity	Valid
	`1970-01-01` - `1970-01-01`	a few seconds	crt.sh
ssl473492.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2019-07-02` - `2020-01-08`	6 months	crt.sh

This page contains 1 frames:

Primary Page: http://flocdates.safesecureentry.com/?page=land2/501_uez4_ssf&x_source=vip53962.46064-1227000.&pgen=nn
Frame ID: EEBF0D13E08F98EB4CF83A5BB3A34E9F
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://iml.kindred.graphics/ HTTP 302
http://flocdates.safesecureentry.com/?in=frloda2a:35120&x_source=vip53962:&email= HTTP 302
http://flocdates.safesecureentry.com/?page=land2/501_uez4_ssf&x_source=vip53962.46064-1227000.&pgen=nn Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

headers server /php\/?([\d.]+)?/i

CentOS (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /CentOS/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i

Page Statistics

10
Requests

10 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

23 kB
Transfer

92 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://iml.kindred.graphics/ HTTP 302
http://flocdates.safesecureentry.com/?in=frloda2a:35120&x_source=vip53962:&email= HTTP 302
http://flocdates.safesecureentry.com/?page=land2/501_uez4_ssf&x_source=vip53962.46064-1227000.&pgen=nn Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request Cookie set / Show response flocdates.safesecureentry.com/ Redirect Chain http://iml.kindred.graphics/ http://flocdates.safesecureentry.com/?in=frloda2a:35120&x_source=vip53962:&email= http://flocdates.safesecureentry.com/?page=land2/501_uez4_ssf&x_source=vip53962.46064-1227000.&pgen=nn	44 KB 10 KB	4036ms 4036ms	Document text/html	104.193.241.113 Rackco.com
General Check archive.org Show headers Download Go to Full URL http://flocdates.safesecureentry.com/?page=land2/501_uez4_ssf&x_source=vip53962.46064-1227000.&pgen=nn Protocol HTTP/1.1 Server 104.193.241.113 Toronto, Canada, ASN36529 (AXXA-RACKCO - Rackco.com, US), Reverse DNS Software Apache/2.4.6 (CentOS) PHP/7.1.19 / PHP/7.1.19 Resource Hash `c1aa3334c0d4d637de9943dd7ee63be38121ffa217a44b173222c6e252554973` Request headers Host flocdates.safesecureentry.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3 Accept-Encoding gzip, deflate Cookie PHPSESSID=c1c62a744f9ab80dbe9c58ea407a6c72; src=vip53962%3A Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36 Response headers Date Thu, 25 Jul 2019 13:21:48 GMT Server Apache/2.4.6 (CentOS) PHP/7.1.19 X-Powered-By PHP/7.1.19 Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate Pragma no-cache Set-Cookie src=vip53962.46064-1227000.; expires=Thu, 08-Aug-2019 13:21:48 GMT; Max-Age=1209600 inf2128=1103__4.9722__52.3231__Amsterdam__528__NH Vary Accept-Encoding Content-Encoding gzip Content-Length 9895 Content-Type text/html; charset=UTF-8 Redirect headers Date Thu, 25 Jul 2019 13:21:44 GMT Server Apache/2.4.6 (CentOS) PHP/7.1.19 X-Powered-By PHP/7.1.19 Set-Cookie PHPSESSID=c1c62a744f9ab80dbe9c58ea407a6c72; path=/ src=vip53962%3A; expires=Thu, 08-Aug-2019 13:21:44 GMT; Max-Age=1209600 Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate Pragma no-cache Location ?page=land2/501_uez4_ssf&x_source=vip53962.46064-1227000.&pgen=nn Content-Length 0 Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	style3.css media.minidtcdn.com/land2/common/uez4_ssf/css/	31 KB 6 KB	2067ms 30ms	Stylesheet text/css	192.229.221.188 MCI Communication...
General Check archive.org Show headers Download Go to Full URL http://media.minidtcdn.com/land2/common/uez4_ssf/css/style3.css Requested by Host: flocdates.safesecureentry.com URL: http://flocdates.safesecureentry.com/?page=land2/501_uez4_ssf&x_source=vip53962.46064-1227000.&pgen=nn Protocol HTTP/1.1 Security , , Server 192.229.221.188 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US), Reverse DNS Software ECAcc (ama/8B0A) / Resource Hash `e37e06b348c250b75cfe01e3f267ef953662185407b8934242b5069f84f4834e` Request headers Referer http://flocdates.safesecureentry.com/?page=land2/501_uez4_ssf&x_source=vip53962.46064-1227000.&pgen=nn User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36 Response headers Date Thu, 25 Jul 2019 13:21:54 GMT Content-Encoding gzip Last-Modified Wed, 06 Feb 2019 03:57:15 GMT Server ECAcc (ama/8B0A) Vary Accept-Encoding X-Cache HIT Content-Type text/css Access-Control-Allow-Origin * Cache-Control max-age=604800 X-Cache-Info cached Accept-Ranges bytes Content-Length 5797 Expires Thu, 18 Jul 2019 20:37:27 GMT
GET		jquery-1.7.2.min.js media.minidtcdn.com/land2/js/	0 0

GET H/1.1	200 OK	skin.css flocdates.safesecureentry.com/land2/css/flocdates/501_uez4_ssf/	636 B 524 B	2035ms 2034ms	Stylesheet text/css	104.193.241.113 Rackco.com
General Check archive.org Show headers Download Go to Full URL http://flocdates.safesecureentry.com/land2/css/flocdates/501_uez4_ssf/skin.css Requested by Host: flocdates.safesecureentry.com URL: http://flocdates.safesecureentry.com/?page=land2/501_uez4_ssf&x_source=vip53962.46064-1227000.&pgen=nn Protocol HTTP/1.1 Security , , Server 104.193.241.113 Toronto, Canada, ASN36529 (AXXA-RACKCO - Rackco.com, US), Reverse DNS Software Apache/2.4.6 (CentOS) PHP/7.1.19 / Resource Hash `2eb66c3d04afc7f6e8215ac31395683324f2cdc7ddaeb511a7395002ea696502` Request headers Referer http://flocdates.safesecureentry.com/?page=land2/501_uez4_ssf&x_source=vip53962.46064-1227000.&pgen=nn User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36 Response headers Date Thu, 25 Jul 2019 13:21:52 GMT Content-Encoding gzip Last-Modified Fri, 26 Oct 2018 22:21:56 GMT Server Apache/2.4.6 (CentOS) PHP/7.1.19 Vary Accept-Encoding Content-Type text/css Accept-Ranges bytes Content-Length 266
GET H2	200	OneSignalSDK.js Show response cdn.onesignal.com/sdks/	17 KB 6 KB	51ms 35ms	Script application/javascript	2606:4700::6810:233f Cloudflare
General Check archive.org Show headers Download Go to Full URL https://cdn.onesignal.com/sdks/OneSignalSDK.js Requested by Host: flocdates.safesecureentry.com URL: http://flocdates.safesecureentry.com/?page=land2/501_uez4_ssf&x_source=vip53962.46064-1227000.&pgen=nn Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 2606:4700::6810:233f , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `0a2617768e184d5ddcc9a4e65b4780f0028502af41c54c438c18177bcaf581aa` Request headers Referer http://flocdates.safesecureentry.com/?page=land2/501_uez4_ssf&x_source=vip53962.46064-1227000.&pgen=nn User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36 Response headers date Thu, 25 Jul 2019 13:21:52 GMT content-encoding gzip cf-cache-status HIT server cloudflare age 2043 etag W/"73548930d8015a67a49758d8fe546f33" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/javascript status 200 cache-control public, max-age=43200 cf-ray 4fbe707f2bdc97cc-FRA expires Fri, 26 Jul 2019 01:21:52 GMT
GET		v1.jpg media.minidtcdn.com/land2/common/uez4_ssf/img/online/nn/	0 0

GET		v2.jpg media.minidtcdn.com/land2/common/uez4_ssf/img/online/nn/	0 0

GET		v3.jpg media.minidtcdn.com/land2/common/uez4_ssf/img/online/nn/	0 0

GET		v4.jpg media.minidtcdn.com/land2/common/uez4_ssf/img/online/nn/	0 0

GET		arrow.png media.minidtcdn.com/land2/common/uez4_ssf/img/	0 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: media.minidtcdn.com
URL: http://media.minidtcdn.com/land2/js/jquery-1.7.2.min.js

Domain: media.minidtcdn.com
URL: http://media.minidtcdn.com/land2/common/uez4_ssf/img/online/nn/v1.jpg

Domain: media.minidtcdn.com
URL: http://media.minidtcdn.com/land2/common/uez4_ssf/img/online/nn/v2.jpg

Domain: media.minidtcdn.com
URL: http://media.minidtcdn.com/land2/common/uez4_ssf/img/online/nn/v3.jpg

Domain: media.minidtcdn.com
URL: http://media.minidtcdn.com/land2/common/uez4_ssf/img/online/nn/v4.jpg

Domain: media.minidtcdn.com
URL: http://media.minidtcdn.com/land2/common/uez4_ssf/img/arrow.png

Verdicts & Comments Add Verdict or Comment

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.onesignal.com
flocdates.safesecureentry.com
iml.kindred.graphics
media.minidtcdn.com
media.minidtcdn.com
104.193.241.113
192.229.221.188
2606:4700::6810:233f
50.31.1.54
0a2617768e184d5ddcc9a4e65b4780f0028502af41c54c438c18177bcaf581aa
2eb66c3d04afc7f6e8215ac31395683324f2cdc7ddaeb511a7395002ea696502
c1aa3334c0d4d637de9943dd7ee63be38121ffa217a44b173222c6e252554973
e37e06b348c250b75cfe01e3f267ef953662185407b8934242b5069f84f4834e

flocdates.safesecureentry.com Open in urlscan Pro 104.193.241.113 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

10 Requests

10 %HTTPS

25 %IPv6

4 Domains

4 Subdomains

4 IPs

2 Countries

23 kBTransfer

92 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

3 JavaScript Global Variables

0 Cookies

Indicators

flocdates.safesecureentry.com Open in urlscan Pro
104.193.241.113 Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

10 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

23 kB
Transfer

92 kB
Size

0
Cookies

10 HTTP transactions
0 data transactions