recovery-support2022.cf
199.102.48.14  Malicious Activity! Public Scan Open in urlscan Pro

Internal
urlscan.io (IP) urlscan.io (Domain)
Effective Hostname
VirusTotal SecurityTrails crt.sh
Submitted URL
Google Safe Browsing Archive.org
Effective IP
VirusTotal SecurityTrails Domaintools Censys
Go To Rescan
Add Verdict Report
URL:
http://recovery-support2022.cf/ 4yr old
Submission: On November 11 via api (November 11th 2022, 2:03:07 am UTC) from JP — Scanned from JP Go Pro

Only in urlscan Pro

  • Select different country locations for Private Scans.
  • Use a global network of additional scanning locations and residential IPs for scanning.
  • Interact with pages while you are scanning them.
  • Download files from remote websites.
  • Scan websites on the Tor Network.
Click for more information
Free trials of urlscan Pro are available.
Summary HTTP 5 Redirects  Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 1 countries across 3 domains to perform 5 HTTP transactions. The main IP is 199.102.48.14, located in United States and belongs to DATABANK-MARQUISNET, US. The main domain is recovery-support2022.cf. 4yr old
This is the only time recovery-support2022.cf was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

IP Address AS Autonomous System
1 199.102.48.14 199.102.48.14 35937 (DATABANK-...) (DATABANK-MARQUISNET)
2 2606:4700::68... 2606:4700::6810:5614 13335 (CLOUDFLAR...) (CLOUDFLARENET)
2 172.96.161.50 172.96.161.50 23470 (RELIABLESITE) (RELIABLESITE)
5 3
Apex Domain
Subdomains		 Transfer
2 ibb.co
i.ibb.co — Cisco Umbrella Rank: 13047 8yr old
42 KB
2 jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 374 14yr old
53 KB
1 recovery-support2022.cf
recovery-support2022.cf 4yr old
2 KB
5 3
Domain Requested by
2 i.ibb.co recovery-support2022.cf
2 cdn.jsdelivr.net recovery-support2022.cf
1 recovery-support2022.cf
5 3

This site contains no links.

Subject Issuer Validity Valid
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2022-06-02 -
2023-06-01		 1yr crt.sh
ibb.co
R3		 2022-10-09 -
2023-01-07		 3mo crt.sh

This page contains 1 frames:

Primary Page: http://recovery-support2022.cf/
Frame ID: 3F4FDAD25959BF998957581D0DB2D3CB
Requests: 5 HTTP requests in this frame

Screenshot Go Pro

Only in urlscan Pro

Use the Visual Search feature to find pages with visually similar screenshots.
Click for more information
Free trials of urlscan Pro are available.
Full Image

Page Title

Page Help Support Team

Detected technologies

(UI frameworks)
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
(CDN)
Overall confidence: 100%
Detected patterns
  • <link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
  • //cdn\.jsdelivr\.net/

Page Statistics

5
Requests

80 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

1
Countries

96 kB
Transfer

312 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions Go Pro

Only in urlscan Pro

Inspect WebSocket connections, examine POST data effortlessly, and track overlap counts in real time. Features live search and filtering across all HTTP output, complete with full response metadata for deep analysis.
Click for more information
Free trials of urlscan Pro are available.
0 data transactions

Method
Protocol		 Status Resource
Path		 Size
x-fer		 Time
Latency		 Type
MIME-Type		 IP
Location
GET
H/1.1 		200
OK 		Primary Request / Show response
recovery-support2022.cf/ 		4 KB
2 KB 		1103ms
122ms 		Document
text/html		 199.102.48.14
DATABANK-MARQUISNET
General
Check archive.org
Download Go to
Full URL
http://recovery-support2022.cf/
Protocol
HTTP/1.1
Server
199.102.48.14 , United States, ASN35937 (DATABANK-MARQUISNET, US),
Reverse DNS
14-48-102-199.zayo.com
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
ce0e97f121901e873a78a7f4e25ed59820f58768c12c4af7e8a836a42669ccd9

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36
accept-language
jp-JP,jp;q=0.9

Response headers

Accept-Ranges
bytes
Cache-Control
max-age=31536000
Content-Encoding
gzip
Content-Length
1603
Content-Type
text/html
Date
Fri, 11 Nov 2022 02:03:08 GMT
ETag
"8435cc774bf5d81:0"
Last-Modified
Thu, 10 Nov 2022 21:29:08 GMT
Server
Microsoft-IIS/10.0
Vary
Accept-Encoding
X-Powered-By
ASP.NET
GET
H2 		200
 bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@5.2.0-beta1/dist/css/ 		189 KB
29 KB 		18ms
12ms 		Stylesheet
text/css		 2606:4700::6810:5614
CLOUDFLARENET
General
Check archive.org
Download Go to
Full URL
https://cdn.jsdelivr.net/npm/bootstrap@5.2.0-beta1/dist/css/bootstrap.min.css
Requested by
Host: recovery-support2022.cf
URL: http://recovery-support2022.cf/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5614 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fb1763b59f9f5764294b5af9fa5250835ae608282fe6f2f2213a5952aacf1fbf
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
http://recovery-support2022.cf/
Origin
http://recovery-support2022.cf
accept-language
jp-JP,jp;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date
Fri, 11 Nov 2022 02:03:08 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
4378269
x-jsd-version
5.2.0-beta1
content-encoding
br
x-cache
HIT, MISS
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by
cache-fra19156-FRA, cache-itm18842-ITM
x-jsd-version-type
version
server
cloudflare
etag
W/"2f3f9-YnOsGiPXmhIvAi9qh8W3XCz6/Do"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LfqfGmpIQbKOed0mSsNm6BW4j69H67o2ZqrBEo7zIXI%2FVM0cA1O%2F792eLYcwlIdaUG4QlpvGLGl6h9%2FlKxafZNOcpTAqIT%2FADmoe8dEaHlP0tR2C65krdZ6rxQwYAwUOJrGvgFKM%2FIFGM2iDLMU%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin
*
cf-ray
76837324fdb38a66-NRT
GET
H2 		200
 limbo-dark.png
i.ibb.co/ZWJD6Df/ 		8 KB
9 KB 		310ms
107ms 		Image
image/png		 172.96.161.50
RELIABLESITE
General
Check archive.org
Download Go to Show image
Full URL
https://i.ibb.co/ZWJD6Df/limbo-dark.png
Requested by
Host: recovery-support2022.cf
URL: http://recovery-support2022.cf/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.96.161.50 Los Angeles, United States, ASN23470 (RELIABLESITE, US),
Reverse DNS
Software
nginx /
Resource Hash
9352f87aaa33a6c29a91ea597aada750d10c10c1b708ce358138d5a3f1fd4fb1

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
http://recovery-support2022.cf/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date
Fri, 11 Nov 2022 02:03:09 GMT
last-modified
Mon, 18 Jul 2022 14:47:03 GMT
server
nginx
access-control-allow-methods
GET, OPTIONS
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
content-length
8455
expires
Thu, 31 Dec 2037 23:55:55 GMT
GET
H2 		200
 5yj6qxk6guu51.jpg
i.ibb.co/dBBThCZ/ 		33 KB
33 KB 		296ms
107ms 		Image
image/jpeg		 172.96.161.50
RELIABLESITE
General
Check archive.org
Download Go to Show image
Full URL
https://i.ibb.co/dBBThCZ/5yj6qxk6guu51.jpg
Requested by
Host: recovery-support2022.cf
URL: http://recovery-support2022.cf/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.96.161.50 Los Angeles, United States, ASN23470 (RELIABLESITE, US),
Reverse DNS
Software
nginx /
Resource Hash
50b17bc8189d5f180db288beabf2caab26ee42225b2126559c4b3fc7e3786c13

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
http://recovery-support2022.cf/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date
Fri, 11 Nov 2022 02:03:09 GMT
last-modified
Thu, 14 Jul 2022 10:48:41 GMT
server
nginx
access-control-allow-methods
GET, OPTIONS
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
content-length
33573
expires
Thu, 31 Dec 2037 23:55:55 GMT
GET
H2 		200
 bootstrap.bundle.min.js Show response
cdn.jsdelivr.net/npm/bootstrap@5.2.0-beta1/dist/js/ 		78 KB
24 KB 		15ms
9ms 		Script
application/javascript		 2606:4700::6810:5614
CLOUDFLARENET
General
Check archive.org
Download Go to
Full URL
https://cdn.jsdelivr.net/npm/bootstrap@5.2.0-beta1/dist/js/bootstrap.bundle.min.js
Requested by
Host: recovery-support2022.cf
URL: http://recovery-support2022.cf/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5614 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2515e37eee31f5ef3d659b21dcc84dc6ea732b06872da51078b5b526de34c0c1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
http://recovery-support2022.cf/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date
Fri, 11 Nov 2022 02:03:08 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
6137286
x-jsd-version
5.2.0-beta1
content-encoding
br
x-cache
HIT, MISS
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by
cache-fra19132-FRA, cache-iad-kiad7000098-IAD
x-jsd-version-type
version
server
cloudflare
etag
W/"1377e-a0uYWpCr16scLjX/O4dNB8+EEO4"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4dL9cXpMf4mVph0Qkn3yhl2wvbCQ7qczNyFEerr5w6nv0b05uRZ%2FycxPwotbn5osPfy1vjrukwd44tkTqQpUHU4BsC%2Fk2kMhiqDIPe%2Bcf2CbkJdZeZq1jOZblz6%2FI%2BQe3W9RDJdVb2Teq9ZfxoE%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin
*
cf-ray
768373250d7faf81-NRT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network) Go Pro

Only in urlscan Pro

Use our Phishing URL feed to retrieve phishing pages targeting 3000+ brands in real-time. Set up monitoring and alerts. Use maliciousness scores and AI-powered brand name recognition to hunt for brand impersonation.
Click for more information
Free trials of urlscan Pro are available.

2 JavaScript Window variables Go Pro

Only in urlscan Pro

Inspect and pivot on JavaScript variables, identifiers, and other key site metadata data with urlscan Pro. Reveal and search on client-side frameworks, runtime variables, and custom values.
Click for more information
Free trials of urlscan Pro are available.

These are the non-standard variables defined on the window object. These include var declarations and global functions and can be helpful in identifying possible client-side frameworks and code.

number| uidEvent object| bootstrap

0 Cookies Go Pro

Only in urlscan Pro

Review, search, and pivot on browser cookies and persistence site data to see how a site tracks users and keeps sessions alive across visits.
Click for more information
Free trials of urlscan Pro are available.

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.