bluebadgeforclaimsupport.cf Open in urlscan Pro
2606:4700:3035::ac43:cdfa  Malicious Activity! Public Scan

1 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response bluebadgeforclaimsupport.cf/	8 KB 3 KB	430ms 400ms	Document text/html	2606:4700:3035::ac43:cdfa
General Check archive.org Show headers Download Go to Full URL https://bluebadgeforclaimsupport.cf/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3035::ac43:cdfa , United States, ASN (), Reverse DNS Software cloudflare / Resource Hash 849941b29da4333f7c6b2a5f369b0b7a16c8d6c0d123f289d7e0b697439608f6 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers :method GET :authority bluebadgeforclaimsupport.cf :scheme https :path / pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Wed, 23 Jun 2021 18:19:25 GMT content-type text/html; charset=UTF-8 x-xss-protection 1; mode=block x-content-type-options nosniff x-request-id 6b37bc86ab0fec270fc81681f457fe17 cf-cache-status DYNAMIC cf-request-id 0adbb24105000023971c311000000001 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=ePZHomrc0ZFQcAOkXYJo8RTu6GnXHvB5rFQ7GP6IDCWko4dI5ohm2Hc5U3uoY%2F1efEHrWho3KwqShbLO%2FVYdnklwwrHzfAUNpICC7WmaPMLc6XF%2Bpx9I9lDqzddA0lZYK0fCUQfe%2F6CQOb80nmYcRH4%2FNJl%2F"}],"group":"cf-nel","max_age":604800} nel {"report_to":"cf-nel","max_age":604800} server cloudflare cf-ray 663fb97b3ed72397-ZRH content-encoding br alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
GET H2	200	insta_3.png linkpicture.com/q/	14 KB 14 KB	282ms 247ms	Image image/png	2606:4700:3031::6815:5547
General Check archive.org Show headers Download Go to Show image Full URL https://linkpicture.com/q/insta_3.png Requested by Host: bluebadgeforclaimsupport.cf URL: https://bluebadgeforclaimsupport.cf/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3031::6815:5547 , United States, ASN (), Reverse DNS Software cloudflare / PleskLin Resource Hash 34fd446145f18e9ee515a542605c8031c60aae2bb74fb686fa69235f290d1cb9 Request headers Referer https://bluebadgeforclaimsupport.cf/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Wed, 23 Jun 2021 18:19:26 GMT cf-cache-status REVALIDATED nel {"report_to":"cf-nel","max_age":604800} x-powered-by PleskLin content-length 14205 cf-request-id 0adbb242c00000d70d62a51000000001 last-modified Tue, 18 May 2021 19:24:37 GMT server cloudflare etag "60a41475-377d" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=8oP%2BoAAZc1oxFIiaavQt%2Br4MAnhBG4ietvPMxFefpbrokws1pGSjwqOIy%2Bm1O86nuEWve3%2BToba9dzIWUEfQg2KKsUAxItMfpKrT9eSoYHeW8xewfoaNNbiUKioaFdNMOL45J%2Bo6rzPn"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control max-age=31536000 accept-ranges bytes cf-ray 663fb97e0f33d70d-FRA
GET H2	200	giphy.gif media1.giphy.com/media/3o7bu7wtT19WfBAt0Y/	619 KB 619 KB	197ms 63ms	Image image/gif	199.232.82.2
General Check archive.org Show headers Download Go to Show image Full URL https://media1.giphy.com/media/3o7bu7wtT19WfBAt0Y/giphy.gif Requested by Host: bluebadgeforclaimsupport.cf URL: https://bluebadgeforclaimsupport.cf/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 199.232.82.2 Marseille, France, ASN (), Reverse DNS Software / Resource Hash 632abf1f71aedf630847f14c5bb58651616ea38c4bb8a18f38a12e81938b6492 Security Headers Name Value Strict-Transport-Security max-age=86400 Request headers Referer https://bluebadgeforclaimsupport.cf/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Wed, 23 Jun 2021 18:19:25 GMT via 1.1 varnish, 1.1 varnish age 1163161 x-cache HIT, HIT cross-origin-resource-policy cross-origin content-length 633406 x-served-by cache-bwi5151-BWI, cache-mrs10572-MRS last-modified Thu, 14 Mar 2019 04:23:52 GMT x-timer S1624472366.893794,VS0,VE0 etag "ae106de830d353e782457e518990e94f" strict-transport-security max-age=86400 content-type image/gif access-control-allow-origin * cache-control max-age=86400 accept-ranges bytes x-cache-hits 1, 1
GET H2	200	Varl%C4%B1k%201-273x274.png istalya.com/image/cache/catalog/resimler/	5 KB 5 KB	417ms 122ms	Image image/png	89.252.151.50
General Check archive.org Show headers Download Go to Show image Full URL https://istalya.com/image/cache/catalog/resimler/Varl%C4%B1k%201-273x274.png Requested by Host: bluebadgeforclaimsupport.cf URL: https://bluebadgeforclaimsupport.cf/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 89.252.151.50 , Turkey, ASN (), Reverse DNS Software nginx / PleskLin Resource Hash 1254d3402ce900c515d0a7f5b9b41536e7d474b8cd32bf801cbf9a565899436b Request headers Referer https://bluebadgeforclaimsupport.cf/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Wed, 23 Jun 2021 18:19:26 GMT last-modified Fri, 17 Apr 2020 08:42:15 GMT server nginx x-powered-by PleskLin etag "5e996be7-1501" content-type image/png accept-ranges bytes content-length 5377
GET H2	200	facebook-logosu-degisti.gif img.paratic.com/dosya/2019/11/	444 KB 445 KB	588ms 508ms	Image image/gif	104.26.9.235
General Check archive.org Show headers Download Go to Show image Full URL https://img.paratic.com/dosya/2019/11/facebook-logosu-degisti.gif Requested by Host: bluebadgeforclaimsupport.cf URL: https://bluebadgeforclaimsupport.cf/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.9.235 , United States, ASN (), Reverse DNS Software cloudflare / Resource Hash 6a3909d24870c59e1236681422876061a79ab429e5b270577d22f21ebdbbb2d9 Request headers Referer https://bluebadgeforclaimsupport.cf/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Wed, 23 Jun 2021 18:19:26 GMT cf-cache-status MISS nel {"report_to":"cf-nel","max_age":604800} content-length 455009 cf-request-id 0adbb242fb0000f15a6616f000000001 last-modified Tue, 05 Nov 2019 06:48:41 GMT server cloudflare etag "5dc11b49-6f161" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=Fv5Ecj3TBmZ%2BByDj5cV9QYbHxfn9Qlctbigs3ODBRVwrO8nxTanE9KdkFEIASZUs0zrWJjhAE6DIeWTNeGQui4gUO0%2F%2BKO7d1uj86NmoLhoj7SwQvUUHz1ixMuY%3D"}],"group":"cf-nel","max_age":604800} content-type image/gif cache-control max-age=31536000 accept-ranges bytes cf-ray 663fb97e5ae9f15a-ARN expires Thu, 23 Jun 2022 18:19:23 GMT
GET H2	200	footer-powered-by-000webhost-white2.png cdn.000webhost.com/000webhost/logo/	2 KB 2 KB	71ms 44ms	Image image/webp	2606:4700::6812:6b08
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.000webhost.com/000webhost/logo/footer-powered-by-000webhost-white2.png Requested by Host: bluebadgeforclaimsupport.cf URL: https://bluebadgeforclaimsupport.cf/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:6b08 , United States, ASN (), Reverse DNS Software cloudflare / Resource Hash 86f2673ec74a632865109a76b2232f4f5b3587daa219e07a17ef1d9c76a0fda5 Security Headers Name Value Strict-Transport-Security max-age=2592000 X-Content-Type-Options nosniff X-Frame-Options sameorigin X-Xss-Protection 1; mode=block Request headers Referer https://bluebadgeforclaimsupport.cf/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Wed, 23 Jun 2021 18:19:25 GMT x-content-type-options nosniff cf-cache-status HIT age 6606 cf-polished origFmt=png, origSize=2046 content-disposition inline; filename="footer-powered-by-000webhost-white2.webp" cf-bgj imgq:100,h2pri x-hostinger-datacenter srv alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 content-length 1696 x-xss-protection 1; mode=block last-modified Thu, 10 Jun 2021 14:55:20 GMT server cloudflare x-frame-options sameorigin etag "60c227d8-7fe" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=2592000 content-type image/webp vary Accept cache-control public, max-age=14400 x-hostinger-node nl-srv-cdn2 cf-request-id 0adbb242bb0000973c220d5000000001 accept-ranges bytes cf-ray 663fb97dfb8c973c-FRA expires Wed, 23 Jun 2021 22:19:25 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Instagram (Social Network)

30 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated function| getCookie undefined| wordpressAdminBody object| notification object| hostingerLogo undefined| mainContent undefined| googleFont undefined| css undefined| style undefined| sheet undefined| button undefined| link undefined| mainContentHolder undefined| h1Tag undefined| h2Tag undefined| paragraph undefined| list undefined| org_html undefined| new_html undefined| saleImage

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://bluebadgeforclaimsupport.cf/(Line 105) Message: Script Ahmet Guven Tarafindan Yapilmistir.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bluebadgeforclaimsupport.cf
cdn.000webhost.com
img.paratic.com
istalya.com
linkpicture.com
media1.giphy.com
104.26.9.235
199.232.82.2
2606:4700:3031::6815:5547
2606:4700:3035::ac43:cdfa
2606:4700::6812:6b08
89.252.151.50
1254d3402ce900c515d0a7f5b9b41536e7d474b8cd32bf801cbf9a565899436b
34fd446145f18e9ee515a542605c8031c60aae2bb74fb686fa69235f290d1cb9
632abf1f71aedf630847f14c5bb58651616ea38c4bb8a18f38a12e81938b6492
6a3909d24870c59e1236681422876061a79ab429e5b270577d22f21ebdbbb2d9
849941b29da4333f7c6b2a5f369b0b7a16c8d6c0d123f289d7e0b697439608f6
86f2673ec74a632865109a76b2232f4f5b3587daa219e07a17ef1d9c76a0fda5