www.icloud.com-es.tf Open in urlscan Pro
51.161.118.76 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.icloud.com-es.tf/sing/DjR
Submission: On March 28 via automatic, source openphish (March 28th 2020, 12:20:11 pm UTC)

Summary HTTP 22 Redirects Links 3 Behaviour Indicators

Summary

This website contacted 5 IPs in 2 countries across 4 domains to perform 22 HTTP transactions. The main IP is 51.161.118.76, located in Canada and belongs to OVH, FR. The main domain is www.icloud.com-es.tf.
TLS certificate: Issued by Let's Encrypt Authority X3 on March 14th 2020. Valid for: 3 months.

This is the only time www.icloud.com-es.tf was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Apple (Online)

Domain & IP information

	IP Address	AS Autonomous System
12	51.161.118.76 51.161.118.76	16276 (OVH) (OVH)
2	2001:4de0:ac1... 2001:4de0:ac19::1:b:3a	20446 (HIGHWINDS3) (HIGHWINDS3)
3	104.109.70.123 104.109.70.123	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
3	23.42.29.121 23.42.29.121	16625 (AKAMAI-AS) (AKAMAI-AS)
22	5

12 51.161.118.76 (Canada)

ASN16276 (OVH, FR)
PTR: sc2021.conectarhosting.com

www.icloud.com-es.tf	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:4de0:ac19::1:b:3a (Netherlands)

ASN20446 (HIGHWINDS3, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.109.70.123 (Netherlands)

ASN20940 (AKAMAI-ASN1, US)
PTR: a104-109-70-123.deploy.static.akamaitechnologies.com

www.icloud.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 23.42.29.121 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a23-42-29-121.deploy.static.akamaitechnologies.com

appleid.cdn-apple.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	com-es.tf www.icloud.com-es.tf	573 KB
3	cdn-apple.com appleid.cdn-apple.com	135 KB
3	icloud.com www.icloud.com	415 KB
2	jquery.com code.jquery.com	150 KB
22	4

	Domain	Requested by
12	www.icloud.com-es.tf	www.icloud.com-es.tf
3	appleid.cdn-apple.com	www.icloud.com-es.tf
3	www.icloud.com	www.icloud.com-es.tf
2	code.jquery.com	www.icloud.com-es.tf
22	4

This site contains links to these domains. Also see Links.

Domain
www.apple.com

Subject Issuer	Validity	Valid
icloud.com-es.tf Let's Encrypt Authority X3	`2020-03-14` - `2020-06-12`	3 months	crt.sh
jquery.org COMODO RSA Domain Validation Secure Server CA	`2018-10-17` - `2020-10-16`	2 years	crt.sh
www.icloud.com DigiCert SHA2 Extended Validation Server CA	`2019-07-17` - `2020-08-05`	a year	crt.sh
appleid.cdn-apple.com DigiCert SHA2 Extended Validation Server CA-3	`2020-02-10` - `2021-02-09`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://www.icloud.com-es.tf/sing/DjR
Frame ID: 8782ABBA3769CE2F04070B04FCDCF65F
Requests: 9 HTTP requests in this frame

Frame: https://www.icloud.com-es.tf/datos.php?tr=DjR&holder=ID%20de%20Apple&idname=26431&user=
Frame ID: 7B52F203ADF4759B709077F25D64C89E
Requests: 16 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery[.-]([\d.]*\d)[^/]*\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

22
Requests

91 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

5
IPs

2
Countries

1273 kB
Transfer

2243 kB
Size

1
Cookies

3 Outgoing links

These are links going to different origins than the main page.

URL: https://www.apple.com/es/support/systemstatus/
Title: Estado del sistema

Search URL Search Domain Scan URL

URL: https://www.apple.com/es/privacy/
Title: Política de privacidad

Search URL Search Domain Scan URL

URL: https://www.apple.com/legal/icloud/ww/
Title: Términos y condiciones

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

22 HTTP transactions
3 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request Cookie set DjR Show response
www.icloud.com-es.tf/sing/ 45 KB
45 KB 953ms
376ms Document
text/html 51.161.118.76
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://www.icloud.com-es.tf/sing/DjR
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 51.161.118.76 , Canada, ASN16276 (OVH, FR),
Reverse DNS: sc2021.conectarhosting.com
Software: Apache /
Resource Hash: 570d500782af4fa7c58e379ec8670ee48123c1222cb53a40808b66860d170deb

Request headers

Host: www.icloud.com-es.tf
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: document
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: document

Response headers

Date: Sat, 28 Mar 2020 12:19:53 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Set-Cookie: PHPSESSID=679fd7ccd21bc724c8a0108040a82b84; path=/
Keep-Alive: timeout=3, max=30
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK jquery-2.2.4.js Show response
code.jquery.com/ 252 KB
75 KB 156ms
6ms Script
application/javascript 2001:4de0:ac19::1:b:3a
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-2.2.4.js
Requested by: Host: www.icloud.com-es.tf
URL: https://www.icloud.com-es.tf/sing/DjR
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2001:4de0:ac19::1:b:3a , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: 893e90f6230962e42231635df650f20544ad22affc3ee396df768eaa6bc5a6a2

Request headers

Referer: https://www.icloud.com-es.tf/sing/DjR
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Sat, 28 Mar 2020 12:19:54 GMT
Content-Encoding: gzip
Last-Modified: Fri, 20 May 2016 17:24:41 GMT
Server: nginx
ETag: W/"573f4859-3ee0f"
Vary: Accept-Encoding
X-HW: 1585397994.dop156.fr8.t,1585397994.cds017.fr8.shn,1585397994.cds017.fr8.c
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=315360000, public
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 76245

GET
H/1.1 200
OK main.css
www.icloud.com//system/cloudos2/2004Project80/es-es/ 301 KB
28 KB 45ms
28ms Stylesheet
text/css 104.109.70.123
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.icloud.com//system/cloudos2/2004Project80/es-es/main.css

Requested by

Host: www.icloud.com-es.tf
URL: https://www.icloud.com-es.tf/sing/DjR

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.70.123 , Netherlands, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a104-109-70-123.deploy.static.akamaitechnologies.com

Software

AppleHttpServer/80d510f34941 /

Resource Hash

81543b52146ea55b66c2f56c4b1a8ff4dd279843b3c52101bb51e74eb8a819f6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.icloud.com-es.tf/sing/DjR
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: br
Server: AppleHttpServer/80d510f34941
ETag: "170d322f3406bed"
Vary: accept-encoding
Content-Language: en-us
X-Apple-Request-UUID: c6405e4a-5dad-487f-8f9b-6b3162cf2d7a
Access-Control-Expose-Headers: X-Apple-Request-UUID, Via
Cache-Control: public, max-age=31536000
Date: Sat, 28 Mar 2020 12:19:54 GMT
Content-Location: /system/cloudos2/2004Project80/es-es/main.css.brotli
Connection: keep-alive
Content-Type: text/css
Content-Length: 27629

GET
H/1.1 200
OK r$__116.png
www.icloud.com-es.tf/imagen/ 9 KB
9 KB 243ms
128ms Image
image/png 51.161.118.76
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.icloud.com-es.tf/imagen/r$__116.png
Requested by: Host: www.icloud.com-es.tf
URL: https://www.icloud.com-es.tf/sing/DjR
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 51.161.118.76 , Canada, ASN16276 (OVH, FR),
Reverse DNS: sc2021.conectarhosting.com
Software: Apache /
Resource Hash: 51d89294cbffbf328cb91fe7f0de4f7ac73ec33eb73feba0ac7d309d35d5ad9f

Request headers

Referer: https://www.icloud.com-es.tf/sing/DjR
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Sat, 28 Mar 2020 12:19:54 GMT
Last-Modified: Sat, 05 Oct 2019 21:25:48 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=3, max=29
Content-Length: 9431

GET
DATA 200
OK truncated
/ 5 KB
0 Stylesheet
text/css

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e69849b56d9384d0a7f9c5bf62bf73811a2e59aa5dea61fcd05cbf742ba8a25c

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: text/css

GET
H/1.1 404
Not Found close.png
www.icloud.com-es.tf/sing/imagen/ 315 B
315 B 299ms
124ms Image
text/html 51.161.118.76
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.icloud.com-es.tf/sing/imagen/close.png
Requested by: Host: www.icloud.com-es.tf
URL: https://www.icloud.com-es.tf/sing/DjR
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 51.161.118.76 , Canada, ASN16276 (OVH, FR),
Reverse DNS: sc2021.conectarhosting.com
Software: Apache /
Resource Hash: d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

Request headers

Referer: https://www.icloud.com-es.tf/sing/DjR
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Sat, 28 Mar 2020 12:19:54 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=3, max=30
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 200
OK SFUIText-Regular.woff
www.icloud.com/fonts/ 176 KB
176 KB 35ms
17ms Font
application/font-woff 104.109.70.123
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.icloud.com/fonts/SFUIText-Regular.woff

Requested by

Host: www.icloud.com-es.tf
URL: https://www.icloud.com-es.tf/sing/DjR

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.70.123 , Netherlands, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a104-109-70-123.deploy.static.akamaitechnologies.com

Software

AppleHttpServer/e70a1a237a4f /

Resource Hash

1dd142cb948458f8258fa4f7ba5e61bb3060e1b41dbc55eaefce115c3518759f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.icloud.com//system/cloudos2/2004Project80/es-es/main.css
Origin: https://www.icloud.com-es.tf
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Server: AppleHttpServer/e70a1a237a4f
ETag: "16e4a0229702bf9c"
Content-Language: en-us
Access-Control-Allow-Origin: *
X-Apple-Request-UUID: 4b77ed4d-2e5d-41bc-8d02-104676c1ae31
Access-Control-Expose-Headers: X-Apple-Request-UUID, Via
Cache-Control: public, max-age=31536000
Date: Sat, 28 Mar 2020 12:19:54 GMT
Connection: keep-alive
Content-Type: application/font-woff
Content-Length: 180124

GET
H/1.1 200
OK SFUIText-Light.woff
www.icloud.com/fonts/ 210 KB
211 KB 35ms
18ms Font
application/font-woff 104.109.70.123
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.icloud.com/fonts/SFUIText-Light.woff

Requested by

Host: www.icloud.com-es.tf
URL: https://www.icloud.com-es.tf/sing/DjR

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.70.123 , Netherlands, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

a104-109-70-123.deploy.static.akamaitechnologies.com

Software

AppleHttpServer/e70a1a237a4f /

Resource Hash

64ff0570e91055ef514596d780cd0d07533c5b49236b8a4f8cc05ed1fafcf828

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.icloud.com//system/cloudos2/2004Project80/es-es/main.css
Origin: https://www.icloud.com-es.tf
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Server: AppleHttpServer/e70a1a237a4f
ETag: "16edf58eba834924"
Content-Language: en-us
Access-Control-Allow-Origin: *
X-Apple-Request-UUID: 47fad53a-d399-4ee0-bc42-2ec1151251b6
Access-Control-Expose-Headers: X-Apple-Request-UUID, Via
Cache-Control: public, max-age=31536000
Date: Sat, 28 Mar 2020 12:19:54 GMT
Connection: keep-alive
Content-Type: application/font-woff
Content-Length: 215332

GET
H/1.1 200
OK spinner2.gif
www.icloud.com-es.tf/imagen/ 77 KB
77 KB 320ms
121ms Image
image/gif 51.161.118.76
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.icloud.com-es.tf/imagen/spinner2.gif
Requested by: Host: www.icloud.com-es.tf
URL: https://www.icloud.com-es.tf/sing/DjR
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 51.161.118.76 , Canada, ASN16276 (OVH, FR),
Reverse DNS: sc2021.conectarhosting.com
Software: Apache /
Resource Hash: 832dc1d13667c3d0d1213a90ee24a013e511912220913dc4f54988b8cea73c5d

Request headers

Referer: https://www.icloud.com-es.tf/sing/DjR
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Sat, 28 Mar 2020 12:19:54 GMT
Last-Modified: Sat, 05 Oct 2019 21:25:48 GMT
Server: Apache
Content-Type: image/gif
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=3, max=30
Content-Length: 78737

GET
H/1.1 200
OK datos.php Show response
www.icloud.com-es.tf/ Frame 7B52 47 KB
48 KB 490ms
364ms Document
text/html 51.161.118.76
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://www.icloud.com-es.tf/datos.php?tr=DjR&holder=ID%20de%20Apple&idname=26431&user=
Requested by: Host: www.icloud.com-es.tf
URL: https://www.icloud.com-es.tf/sing/DjR
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 51.161.118.76 , Canada, ASN16276 (OVH, FR),
Reverse DNS: sc2021.conectarhosting.com
Software: Apache /
Resource Hash: 271306dc1a9c34e831ce0566b5f145a4b92af187bbe20312e1470e91ddc5c05d

Request headers

Host: www.icloud.com-es.tf
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Referer: https://www.icloud.com-es.tf/sing/DjR
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: PHPSESSID=679fd7ccd21bc724c8a0108040a82b84
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://www.icloud.com-es.tf/sing/DjR

Response headers

Date: Sat, 28 Mar 2020 12:19:54 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Keep-Alive: timeout=3, max=28
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK fonts2.css
www.icloud.com-es.tf/css/ Frame 7B52 8 KB
8 KB 124ms
123ms Stylesheet
text/css 51.161.118.76
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://www.icloud.com-es.tf/css/fonts2.css
Requested by: Host: www.icloud.com-es.tf
URL: https://www.icloud.com-es.tf/datos.php?tr=DjR&holder=ID%20de%20Apple&idname=26431&user=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 51.161.118.76 , Canada, ASN16276 (OVH, FR),
Reverse DNS: sc2021.conectarhosting.com
Software: Apache /
Resource Hash: 20b14318d1ded4777435b1dd8540da7c29d620ee96d621db5ef645b2b5050600

Request headers

Referer: https://www.icloud.com-es.tf/datos.php?tr=DjR&holder=ID%20de%20Apple&idname=26431&user=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

Date: Sat, 28 Mar 2020 12:19:54 GMT
Last-Modified: Sat, 05 Oct 2019 21:25:48 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=3, max=29
Content-Length: 8371

GET
H/1.1 200
OK appe.css
www.icloud.com-es.tf/css/ Frame 7B52 126 KB
127 KB 124ms
122ms Stylesheet
text/css 51.161.118.76
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://www.icloud.com-es.tf/css/appe.css
Requested by: Host: www.icloud.com-es.tf
URL: https://www.icloud.com-es.tf/datos.php?tr=DjR&holder=ID%20de%20Apple&idname=26431&user=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 51.161.118.76 , Canada, ASN16276 (OVH, FR),
Reverse DNS: sc2021.conectarhosting.com
Software: Apache /
Resource Hash: f913bfc260acfd2f4c0fba9827c510e5ab096bd7fc0877b0aa2f439a5254ccca

Request headers

Referer: https://www.icloud.com-es.tf/datos.php?tr=DjR&holder=ID%20de%20Apple&idname=26431&user=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

Date: Sat, 28 Mar 2020 12:19:54 GMT
Last-Modified: Sat, 05 Oct 2019 21:25:48 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=3, max=30
Content-Length: 129378

GET
H/1.1 200
OK common-header.js Show response
appleid.cdn-apple.com/appleauth/static/jsj/N1241477586/ Frame 7B52 3 KB
2 KB 75ms
19ms Script
application/javascript 23.42.29.121
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://appleid.cdn-apple.com/appleauth/static/jsj/N1241477586/common-header.js
Requested by: Host: www.icloud.com-es.tf
URL: https://www.icloud.com-es.tf/datos.php?tr=DjR&holder=ID%20de%20Apple&idname=26431&user=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.42.29.121 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-42-29-121.deploy.static.akamaitechnologies.com
Software: Apple /
Resource Hash: 1d0215ad32e637ce0a549c1cc6440eac8d32ac8912ee445e64cb2fd51c7dcd41

Request headers

Referer: https://www.icloud.com-es.tf/datos.php?tr=DjR&holder=ID%20de%20Apple&idname=26431&user=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Sat, 28 Mar 2020 12:19:54 GMT
Content-Encoding: gzip
Last-Modified: Mon, 01 Oct 2018 06:47:21 GMT
Server: Apple
ETag: W/"3517-1538376441602"
Vary: Accept-Encoding
X-Cache: TCP_HIT from a95-101-230-231.deploy.akamaitechnologies.com (AkamaiGHost/9.9.4.1-29027442) (-)
Content-Type: application/javascript
Access-Control-Allow-Origin: https://idmsa.apple.com
Cache-Control: public, max-age=2592000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1438

GET
H/1.1 200
OK jquery-2.2.4.js Show response
code.jquery.com/ Frame 7B52 252 KB
75 KB 32ms
11ms Script
application/javascript 2001:4de0:ac19::1:b:3a
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-2.2.4.js
Requested by: Host: www.icloud.com-es.tf
URL: https://www.icloud.com-es.tf/datos.php?tr=DjR&holder=ID%20de%20Apple&idname=26431&user=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2001:4de0:ac19::1:b:3a , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: 893e90f6230962e42231635df650f20544ad22affc3ee396df768eaa6bc5a6a2

Request headers

Referer: https://www.icloud.com-es.tf/datos.php?tr=DjR&holder=ID%20de%20Apple&idname=26431&user=
Origin: https://www.icloud.com-es.tf
Sec-Fetch-Dest: script
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Sat, 28 Mar 2020 12:19:54 GMT
Content-Encoding: gzip
Last-Modified: Fri, 20 May 2016 17:24:41 GMT
Server: nginx
ETag: W/"573f4859-3ee0f"
Vary: Accept-Encoding
X-HW: 1585397994.dop158.fr8.t,1585397994.cds106.fr8.shn,1585397994.dop158.fr8.t,1585397994.cds017.fr8.c
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=315360000, public
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 76245

GET
H/1.1 200
OK function.js Show response
www.icloud.com-es.tf/jss/ Frame 7B52 3 KB
3 KB 125ms
124ms Script
application/javascript 51.161.118.76
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://www.icloud.com-es.tf/jss/function.js
Requested by: Host: www.icloud.com-es.tf
URL: https://www.icloud.com-es.tf/datos.php?tr=DjR&holder=ID%20de%20Apple&idname=26431&user=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 51.161.118.76 , Canada, ASN16276 (OVH, FR),
Reverse DNS: sc2021.conectarhosting.com
Software: Apache /
Resource Hash: 422dd27463cb6142ded7fa182ca1c220f463d6b38ec18c44fd1685c3b4f64984

Request headers

Referer: https://www.icloud.com-es.tf/datos.php?tr=DjR&holder=ID%20de%20Apple&idname=26431&user=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Sat, 28 Mar 2020 12:19:54 GMT
Last-Modified: Sat, 05 Oct 2019 21:25:48 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=3, max=30
Content-Length: 3108

GET
H/1.1 200
OK myscript_ind_fact.js Show response
www.icloud.com-es.tf/jss/ Frame 7B52 5 KB
5 KB 178ms
120ms Script
application/javascript 51.161.118.76
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://www.icloud.com-es.tf/jss/myscript_ind_fact.js
Requested by: Host: www.icloud.com-es.tf
URL: https://www.icloud.com-es.tf/datos.php?tr=DjR&holder=ID%20de%20Apple&idname=26431&user=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 51.161.118.76 , Canada, ASN16276 (OVH, FR),
Reverse DNS: sc2021.conectarhosting.com
Software: Apache /
Resource Hash: 9e610e7d964ecf46e469b88fe3e5551469146d4e0763cda183754d7ddc1bfeda

Request headers

Referer: https://www.icloud.com-es.tf/datos.php?tr=DjR&holder=ID%20de%20Apple&idname=26431&user=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Sat, 28 Mar 2020 12:19:54 GMT
Last-Modified: Sat, 05 Oct 2019 21:25:48 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=3, max=29
Content-Length: 5046

GET
H/1.1 200
OK spinner2.gif
www.icloud.com-es.tf/imagen/ Frame 7B52 77 KB
77 KB 129ms
128ms Image
image/gif 51.161.118.76
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.icloud.com-es.tf/imagen/spinner2.gif
Requested by: Host: www.icloud.com-es.tf
URL: https://www.icloud.com-es.tf/datos.php?tr=DjR&holder=ID%20de%20Apple&idname=26431&user=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 51.161.118.76 , Canada, ASN16276 (OVH, FR),
Reverse DNS: sc2021.conectarhosting.com
Software: Apache /
Resource Hash: 832dc1d13667c3d0d1213a90ee24a013e511912220913dc4f54988b8cea73c5d

Request headers

Referer: https://www.icloud.com-es.tf/datos.php?tr=DjR&holder=ID%20de%20Apple&idname=26431&user=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Sat, 28 Mar 2020 12:19:54 GMT
Last-Modified: Sat, 05 Oct 2019 21:25:48 GMT
Server: Apache
Content-Type: image/gif
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=3, max=27
Content-Length: 78737

GET
H/1.1 200
OK app.js Show response
appleid.cdn-apple.com/appleauth/static/jsj/1577869377/widget/auth/ Frame 7B52 448 KB
131 KB 48ms
47ms Script
application/javascript 23.42.29.121
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://appleid.cdn-apple.com/appleauth/static/jsj/1577869377/widget/auth/app.js
Requested by: Host: www.icloud.com-es.tf
URL: https://www.icloud.com-es.tf/datos.php?tr=DjR&holder=ID%20de%20Apple&idname=26431&user=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.42.29.121 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-42-29-121.deploy.static.akamaitechnologies.com
Software: Apple /
Resource Hash: 4105f266e2ddc97cd4638d92f227d99d29820aec513e574dfd2be54f9a30868d

Request headers

Referer: https://www.icloud.com-es.tf/datos.php?tr=DjR&holder=ID%20de%20Apple&idname=26431&user=
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Sat, 28 Mar 2020 12:19:54 GMT
Content-Encoding: gzip
Last-Modified: Tue, 20 Jun 2017 06:15:30 GMT
X-Cache-Remote: TCP_MISS from a84-53-140-109.deploy.akamaitechnologies.com (AkamaiGHost/9.9.4.1-29027442) (-)
ETag: W/"458846-1497939330509"
Vary: Accept-Encoding
X-Cache: TCP_MISS from a95-101-230-231.deploy.akamaitechnologies.com (AkamaiGHost/9.9.4.1-29027442) (-)
Content-Type: application/javascript
Access-Control-Allow-Origin: https://idmsa.apple.com
Cache-Control: public, max-age=2592000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 133120
Server: Apple

GET
DATA 200
OK truncated
/ Frame 7B52 24 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c382f99f49158456a7b367b9a1a96fe0702e996b2cb5daec67cad7e1b8f5b02c

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 7B52 443 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 61077157138fbe02d89f3fed67aa07979cd5ee701fab3b77ceff0dbc8891e5f6

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK myriad-set-pro_text.woff
www.icloud.com-es.tf/css/ Frame 7B52 105 KB
106 KB 123ms
122ms Font
font/woff 51.161.118.76
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://www.icloud.com-es.tf/css/myriad-set-pro_text.woff
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 51.161.118.76 , Canada, ASN16276 (OVH, FR),
Reverse DNS: sc2021.conectarhosting.com
Software: Apache /
Resource Hash: 2e7e87280e4a17892cbbd0ab2adc1341b83b8c026f8491daf64680d752e869a8

Request headers

Referer: https://www.icloud.com-es.tf/css/fonts2.css
Origin: https://www.icloud.com-es.tf
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Sat, 28 Mar 2020 12:19:55 GMT
Last-Modified: Sat, 05 Oct 2019 21:25:48 GMT
Server: Apache
Content-Type: font/woff
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=3, max=29
Content-Length: 107920

GET
H/1.1 200
OK HR_gradient_dark.png
appleid.cdn-apple.com/appleauth/static/bin/cb3299837348/dist/assets/images/ Frame 7B52 2 KB
2 KB 476ms
476ms Image
image/png 23.42.29.121
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://appleid.cdn-apple.com/appleauth/static/bin/cb3299837348/dist/assets/images/HR_gradient_dark.png
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.42.29.121 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-42-29-121.deploy.static.akamaitechnologies.com
Software: Apple /
Resource Hash: e349c0d498e66e8a95b0cee809066bcfc722c05315d0f318c47c340797caafd9

Request headers

Referer: https://www.icloud.com-es.tf/css/appe.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Sat, 28 Mar 2020 12:19:55 GMT
Content-Encoding: gzip
Last-Modified: Thu, 19 Mar 2020 17:09:01 GMT
X-Cache-Remote: TCP_MISS from a84-53-140-109.deploy.akamaitechnologies.com (AkamaiGHost/9.9.4.1-29027442) (-)
ETag: W/"1820-1584637741649"
Vary: Accept-Encoding
X-Cache: TCP_MISS from a95-101-230-231.deploy.akamaitechnologies.com (AkamaiGHost/9.9.4.1-29027442) (-)
Content-Type: image/png
Access-Control-Allow-Origin: https://idmsa.apple.com
Cache-Control: public, max-age=2592000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1843
Server: Apple

GET
H/1.1 200
OK myriad-set-pro_thin.woff
www.icloud.com-es.tf/css/ Frame 7B52 67 KB
68 KB 128ms
128ms Font
font/woff 51.161.118.76
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://www.icloud.com-es.tf/css/myriad-set-pro_thin.woff
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 51.161.118.76 , Canada, ASN16276 (OVH, FR),
Reverse DNS: sc2021.conectarhosting.com
Software: Apache /
Resource Hash: 2a49036e25ece04c427d544fb69b00a1dd7376999a98f34afd502e17dfb296c1

Request headers

Referer: https://www.icloud.com-es.tf/css/fonts2.css
Origin: https://www.icloud.com-es.tf
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Sat, 28 Mar 2020 12:19:55 GMT
Last-Modified: Sat, 05 Oct 2019 21:25:48 GMT
Server: Apache
Content-Type: font/woff
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=3, max=26
Content-Length: 69068

GET shared-icons.woff
appleid.cdn-apple.com/bin/cb259380101/dist/assets/generated-icons/ Frame 7B52 0
0

GET shared-icons.ttf
appleid.cdn-apple.com/bin/cb624250907/dist/assets/generated-icons/ Frame 7B52 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: appleid.cdn-apple.com
URL: https://appleid.cdn-apple.com/bin/cb259380101/dist/assets/generated-icons/shared-icons.woff

Domain: appleid.cdn-apple.com
URL: https://appleid.cdn-apple.com/bin/cb624250907/dist/assets/generated-icons/shared-icons.ttf

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Apple (Online)

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.icloud.com-es.tf/	1969-12-31 23:59:59	Name: PHPSESSID Value: 679fd7ccd21bc724c8a0108040a82b84

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

appleid.cdn-apple.com
code.jquery.com
www.icloud.com
www.icloud.com-es.tf
appleid.cdn-apple.com
104.109.70.123
2001:4de0:ac19::1:b:3a
23.42.29.121
51.161.118.76
1d0215ad32e637ce0a549c1cc6440eac8d32ac8912ee445e64cb2fd51c7dcd41
1dd142cb948458f8258fa4f7ba5e61bb3060e1b41dbc55eaefce115c3518759f
20b14318d1ded4777435b1dd8540da7c29d620ee96d621db5ef645b2b5050600
271306dc1a9c34e831ce0566b5f145a4b92af187bbe20312e1470e91ddc5c05d
2a49036e25ece04c427d544fb69b00a1dd7376999a98f34afd502e17dfb296c1
2e7e87280e4a17892cbbd0ab2adc1341b83b8c026f8491daf64680d752e869a8
4105f266e2ddc97cd4638d92f227d99d29820aec513e574dfd2be54f9a30868d
422dd27463cb6142ded7fa182ca1c220f463d6b38ec18c44fd1685c3b4f64984
51d89294cbffbf328cb91fe7f0de4f7ac73ec33eb73feba0ac7d309d35d5ad9f
570d500782af4fa7c58e379ec8670ee48123c1222cb53a40808b66860d170deb
61077157138fbe02d89f3fed67aa07979cd5ee701fab3b77ceff0dbc8891e5f6
64ff0570e91055ef514596d780cd0d07533c5b49236b8a4f8cc05ed1fafcf828
81543b52146ea55b66c2f56c4b1a8ff4dd279843b3c52101bb51e74eb8a819f6
832dc1d13667c3d0d1213a90ee24a013e511912220913dc4f54988b8cea73c5d
893e90f6230962e42231635df650f20544ad22affc3ee396df768eaa6bc5a6a2
9e610e7d964ecf46e469b88fe3e5551469146d4e0763cda183754d7ddc1bfeda
c382f99f49158456a7b367b9a1a96fe0702e996b2cb5daec67cad7e1b8f5b02c
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
e349c0d498e66e8a95b0cee809066bcfc722c05315d0f318c47c340797caafd9
e69849b56d9384d0a7f9c5bf62bf73811a2e59aa5dea61fcd05cbf742ba8a25c
f913bfc260acfd2f4c0fba9827c510e5ab096bd7fc0877b0aa2f439a5254ccca

www.icloud.com-es.tf Open in urlscan Pro 51.161.118.76 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

22 Requests

91 %HTTPS

25 %IPv6

4 Domains

4 Subdomains

5 IPs

2 Countries

1273 kBTransfer

2243 kBSize

1 Cookies

3 Outgoing links

Redirected requests

22 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 3 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

10 JavaScript Global Variables

1 Cookies

Indicators

www.icloud.com-es.tf Open in urlscan Pro
51.161.118.76 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

22
Requests

91 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

5
IPs

2
Countries

1273 kB
Transfer

2243 kB
Size

1
Cookies

22 HTTP transactions
3 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!