app.cybsafe.com - urlscan.io

Summary

This website contacted 3 IPs in 2 countries across 4 domains to perform 6 HTTP transactions. The main IP is 52.211.29.121, located in Dublin, Ireland and belongs to AMAZON-02 - Amazon.com, Inc., US. The main domain is app.cybsafe.com.
TLS certificate: Issued by Amazon on August 26th 2018. Valid for: a year.

This is the only time app.cybsafe.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	167.89.115.54 167.89.115.54	11377 (SENDGRID) (SENDGRID - SendGrid)
3	52.211.29.121 52.211.29.121	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
2	2606:4700::68... 2606:4700::6813:c497	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1	52.218.16.132 52.218.16.132	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
6	3

1 167.89.115.54 (Denver, United States) 1 redirects

ASN11377 (SENDGRID - SendGrid, Inc., US)
PTR: o16789115x54.outbound-mail.sendgrid.net

u6197305.ct.sendgrid.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 52.211.29.121 (Dublin, Ireland)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-211-29-121.eu-west-1.compute.amazonaws.com

app.cybsafe.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6813:c497 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.218.16.132 (Dublin, Ireland)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)

s3-eu-west-1.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	cybsafe.com app.cybsafe.com	15 KB
2	cloudflare.com cdnjs.cloudflare.com	71 KB
1	amazonaws.com s3-eu-west-1.amazonaws.com	18 KB
1	sendgrid.net 1 redirects u6197305.ct.sendgrid.net	294 B
6	4

	Domain	Requested by
3	app.cybsafe.com	app.cybsafe.com
2	cdnjs.cloudflare.com	app.cybsafe.com
1	s3-eu-west-1.amazonaws.com	app.cybsafe.com
1	u6197305.ct.sendgrid.net	1 redirects
6	4

This site contains no links.

Subject Issuer	Validity	Valid
*.cybsafe.com Amazon	`2018-08-26` - `2019-09-26`	a year	crt.sh
ssl412106.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2018-09-22` - `2019-03-31`	6 months	crt.sh
*.s3-eu-west-1.amazonaws.com DigiCert Baltimore CA-2 G2	`2018-08-03` - `2019-11-06`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://app.cybsafe.com/faux/ZYq8pmGPJk7KgwPmEu1OXkU483TRDHDc1yYDGa4R9/12d1o1215d9d
Frame ID: 84632411A960451FB7636AFC73858461
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://u6197305.ct.sendgrid.net/wf/click?upn=Cp63b-2BM3M6TpZttlMG8yfWxhs1LxzoEc4yXHjQ4G24junGNtB10NdvzXpgnRx... HTTP 302
https://app.cybsafe.com/faux/ZYq8pmGPJk7KgwPmEu1OXkU483TRDHDc1yYDGa4R9/12d1o1215d9d Page URL

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+font-awesome(?:\.min)?\.css/i

Page Statistics

6
Requests

100 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

3
IPs

2
Countries

105 kB
Transfer

124 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://u6197305.ct.sendgrid.net/wf/click?upn=Cp63b-2BM3M6TpZttlMG8yfWxhs1LxzoEc4yXHjQ4G24junGNtB10NdvzXpgnRxpfTERXTNR2WepwnacVCnsA-2B2zbn1fuNEBmdg-2BgrEEpJb-2BGoxt8Uq91EKCEEVSulz7Mv_a0CozdHDIYk-2F-2FE-2BofPglZiPlLT35TOKzjjCjxvmLt9eRzqDH2gYeW7J0xPq8YS-2BM7139g7Mqvaim5bi-2BLZui35y7dUDw4XFUYiWzkOB8IHKW7V6XZd-2FzYtaK1urU-2BpMr2vHB4fH56UEPaSBptlyZyNWYT0X0-2BZOoo20bN0Jl7CIK-2F4RdEKFx-2FKcxSFxPMvRTi7-2BoYDpj50hrQ82-2FYUHezfyU9Pf4pO70eBIzwL6EF-2BdlZOsRdCmM0fmnwXHQdsIFt-2BQXaL-2BJz1Ck7oNUROFelvR00gsQ2MU-2B1RbiM7ivVMzB0uH9udzClALUv90Ars08 HTTP 302
https://app.cybsafe.com/faux/ZYq8pmGPJk7KgwPmEu1OXkU483TRDHDc1yYDGa4R9/12d1o1215d9d Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request 12d1o1215d9d Show response
app.cybsafe.com/faux/ZYq8pmGPJk7KgwPmEu1OXkU483TRDHDc1yYDGa4R9/
Redirect Chain

https://u6197305.ct.sendgrid.net/wf/click?upn=Cp63b-2BM3M6TpZttlMG8yfWxhs1LxzoEc4yXHjQ4G24junGNtB10NdvzXpgnRxpfTERXTNR2WepwnacVCnsA-2B2zbn1fuNEBmdg-2BgrEEpJb-2BGoxt8Uq91EKCEEVSulz7Mv_a0CozdHDIYk-2F...
https://app.cybsafe.com/faux/ZYq8pmGPJk7KgwPmEu1OXkU483TRDHDc1yYDGa4R9/12d1o1215d9d

6 KB
6 KB

1296ms
1220ms

Document
text/html

52.211.29.121
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://app.cybsafe.com/faux/ZYq8pmGPJk7KgwPmEu1OXkU483TRDHDc1yYDGa4R9/12d1o1215d9d

Protocol

H2

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.211.29.121 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-52-211-29-121.eu-west-1.compute.amazonaws.com

Software

nginx/1.12.1 / PHP/5.6.38

Resource Hash

0e979ff3c1f6dd073e9971e9d503f52acac903575604915f6f8f5e5807e13624

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: app.cybsafe.com
:scheme: https
:path: /faux/ZYq8pmGPJk7KgwPmEu1OXkU483TRDHDc1yYDGa4R9/12d1o1215d9d
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
accept-encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status: 200
date: Fri, 09 Nov 2018 15:57:37 GMT
content-type: text/html; charset=UTF-8
content-length: 5692
server: nginx/1.12.1
x-powered-by: PHP/5.6.38
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
expires: 0
set-cookie: cs_se=tvvnvrgtju8e1a23rftaff9q07; expires=Fri, 09-Nov-2018 19:57:36 GMT; Max-Age=14400; path=/; HttpOnly
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
p3p: policyref="https://cybsafe.com/p/privacy-policy", CP="CURa ADMa DEVa OUR IND DSP ALL COR"

Redirect headers

Server: nginx
Date: Fri, 09 Nov 2018 15:57:35 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Location: https://app.cybsafe.com/faux/ZYq8pmGPJk7KgwPmEu1OXkU483TRDHDc1yYDGa4R9/12d1o1215d9d
X-Robots-Tag: noindex, nofollow

GET
S 200 font-awesome.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.5.0/css/ 27 KB
6 KB 175ms
175ms Stylesheet
text/css 2606:4700::6813:c497
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.5.0/css/font-awesome.min.css

Requested by

Host: app.cybsafe.com
URL: https://app.cybsafe.com/faux/ZYq8pmGPJk7KgwPmEu1OXkU483TRDHDc1yYDGa4R9/12d1o1215d9d

Protocol

SPDY

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6813:c497 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

ddd92f10ad162c7449eff0acaf40598c05b1111739587edb75e5326b6697c5d5

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://app.cybsafe.com/faux/ZYq8pmGPJk7KgwPmEu1OXkU483TRDHDc1yYDGa4R9/12d1o1215d9d
Origin: https://app.cybsafe.com

Response headers

date: Fri, 09 Nov 2018 15:57:37 GMT
content-encoding: gzip
vary: Accept-Encoding
cf-cache-status: MISS
status: 200
served-in-seconds: 0.001
last-modified: Thu, 17 May 2018 09:19:53 GMT
server: cloudflare
etag: W/"5afd4939-6b4a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000; includeSubDomains
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=30672000
cf-ray: 477179e3fd4c977a-FRA
expires: Wed, 30 Oct 2019 15:57:37 GMT

GET
H2 200 styles-general.css
app.cybsafe.com/css/phishing/ 7 KB
7 KB 28ms
28ms Stylesheet
text/css 52.211.29.121
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://app.cybsafe.com/css/phishing/styles-general.css
Requested by: Host: app.cybsafe.com
URL: https://app.cybsafe.com/faux/ZYq8pmGPJk7KgwPmEu1OXkU483TRDHDc1yYDGa4R9/12d1o1215d9d
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.211.29.121 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-52-211-29-121.eu-west-1.compute.amazonaws.com
Software: nginx/1.12.1 /
Resource Hash: ceaaf53b034cc3fca96865f9aa6d6f26eab523f89583fc15df14c8a7b1b77cf7

Request headers

:path: /css/phishing/styles-general.css
pragma: no-cache
cookie: cs_se=tvvnvrgtju8e1a23rftaff9q07
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: text/css,*/*;q=0.1
cache-control: no-cache
:authority: app.cybsafe.com
referer: https://app.cybsafe.com/faux/ZYq8pmGPJk7KgwPmEu1OXkU483TRDHDc1yYDGa4R9/12d1o1215d9d
:scheme: https
:method: GET
Referer: https://app.cybsafe.com/faux/ZYq8pmGPJk7KgwPmEu1OXkU483TRDHDc1yYDGa4R9/12d1o1215d9d
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 09 Nov 2018 15:57:37 GMT
last-modified: Fri, 09 Nov 2018 03:16:11 GMT
server: nginx/1.12.1
etag: "5be4fbfb-1c11"
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 7185
expires: Sun, 09 Dec 2018 15:57:37 GMT

GET
H2 200 styles-photo-share.css
app.cybsafe.com/css/phishing/ 2 KB
2 KB 28ms
27ms Stylesheet
text/css 52.211.29.121
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://app.cybsafe.com/css/phishing/styles-photo-share.css?v=20180126
Requested by: Host: app.cybsafe.com
URL: https://app.cybsafe.com/faux/ZYq8pmGPJk7KgwPmEu1OXkU483TRDHDc1yYDGa4R9/12d1o1215d9d
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.211.29.121 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-52-211-29-121.eu-west-1.compute.amazonaws.com
Software: nginx/1.12.1 /
Resource Hash: f0c06f79af4c6cda0a230f3e4819cd25dbe6a009bda2558a7b802748429c9d9f

Request headers

:path: /css/phishing/styles-photo-share.css?v=20180126
pragma: no-cache
cookie: cs_se=tvvnvrgtju8e1a23rftaff9q07
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: text/css,*/*;q=0.1
cache-control: no-cache
:authority: app.cybsafe.com
referer: https://app.cybsafe.com/faux/ZYq8pmGPJk7KgwPmEu1OXkU483TRDHDc1yYDGa4R9/12d1o1215d9d
:scheme: https
:method: GET
Referer: https://app.cybsafe.com/faux/ZYq8pmGPJk7KgwPmEu1OXkU483TRDHDc1yYDGa4R9/12d1o1215d9d
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 09 Nov 2018 15:57:37 GMT
last-modified: Fri, 09 Nov 2018 03:16:11 GMT
server: nginx/1.12.1
etag: "5be4fbfb-73c"
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 1852
expires: Sun, 09 Dec 2018 15:57:37 GMT

GET
H/1.1 200
OK free_down_logo.png
s3-eu-west-1.amazonaws.com/phishing-templates/ 18 KB
18 KB 144ms
55ms Image
image/png 52.218.16.132
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3-eu-west-1.amazonaws.com/phishing-templates/free_down_logo.png
Requested by: Host: app.cybsafe.com
URL: https://app.cybsafe.com/faux/ZYq8pmGPJk7KgwPmEu1OXkU483TRDHDc1yYDGa4R9/12d1o1215d9d
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.218.16.132 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: d737360cbcae3e00b20e522599445f569536ad8f4afd32e27e11360d456e5433

Request headers

Referer: https://app.cybsafe.com/css/phishing/styles-photo-share.css?v=20180126
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Fri, 09 Nov 2018 15:57:38 GMT
Last-Modified: Fri, 01 Jun 2018 09:50:24 GMT
Server: AmazonS3
x-amz-request-id: 30E5EF8C915BB8F3
ETag: "e57699db72fcd29fe6004f96e6f7690e"
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 18190
x-amz-id-2: B8znQ/rJ9RZWvFAs21PyHgT2qgitprRQiYz2JESCgt4KczsjRa6O3a2eiYaGTG5QSSab2YrL5NE=

GET
S 200 fontawesome-webfont.woff2
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.5.0/fonts/ 65 KB
65 KB 177ms
177ms Font
application/octet-stream 2606:4700::6813:c497
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.5.0/fonts/fontawesome-webfont.woff2?v=4.5.0

Requested by

Host: app.cybsafe.com
URL: https://app.cybsafe.com/faux/ZYq8pmGPJk7KgwPmEu1OXkU483TRDHDc1yYDGa4R9/12d1o1215d9d

Protocol

SPDY

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6813:c497 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

ff82aeed6b9bb6701696c84d1b223d2e682eb78c89117a438ce6cfea8c498995

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.5.0/css/font-awesome.min.css
Origin: https://app.cybsafe.com

Response headers

date: Fri, 09 Nov 2018 15:57:37 GMT
vary: Accept-Encoding
cf-cache-status: MISS
status: 200
content-length: 66624
served-in-seconds: 0.001
last-modified: Thu, 17 May 2018 09:19:53 GMT
server: cloudflare
etag: "5afd4939-10440"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000; includeSubDomains
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 477179e51e10977a-FRA
expires: Wed, 30 Oct 2019 15:57:37 GMT

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

undefined| element

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			app.cybsafe.com/	1970-01-18 20:16:33	Name: cs_se Value: tvvnvrgtju8e1a23rftaff9q07

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

app.cybsafe.com
cdnjs.cloudflare.com
s3-eu-west-1.amazonaws.com
u6197305.ct.sendgrid.net
167.89.115.54
2606:4700::6813:c497
52.211.29.121
52.218.16.132
0e979ff3c1f6dd073e9971e9d503f52acac903575604915f6f8f5e5807e13624
ceaaf53b034cc3fca96865f9aa6d6f26eab523f89583fc15df14c8a7b1b77cf7
d737360cbcae3e00b20e522599445f569536ad8f4afd32e27e11360d456e5433
ddd92f10ad162c7449eff0acaf40598c05b1111739587edb75e5326b6697c5d5
f0c06f79af4c6cda0a230f3e4819cd25dbe6a009bda2558a7b802748429c9d9f
ff82aeed6b9bb6701696c84d1b223d2e682eb78c89117a438ce6cfea8c498995

app.cybsafe.com Open in urlscan Pro 52.211.29.121 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

6 Requests

100 %HTTPS

25 %IPv6

4 Domains

4 Subdomains

3 IPs

2 Countries

105 kBTransfer

124 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

1 Cookies

Security Headers

Indicators

app.cybsafe.com Open in urlscan Pro
52.211.29.121 Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

100 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

3
IPs

2
Countries

105 kB
Transfer

124 kB
Size

1
Cookies

6 HTTP transactions
0 data transactions