Report - cssz-id-portal.icu/cdn-cgi/phish-bypass?atok=qnOSOT.I6zMfsrDVGOECnt3fBq51JWediPOtq6tsZxE-1746130841.6021273-0.0.1.1-%2F&cf-turnstile-response=

Report Overview

Visited public
2025-05-02 11:23:37
Tags
URL
cssz-id-portal.icu/cdn-cgi/phish-bypass?atok=qnOSOT.I6zMfsrDVGOECnt3fBq51JWediPOtq6tsZxE-1746130841.6021273-0.0.1.1-%2F&cf-turnstile-response=
Finishing URL
cssz-id-portal.icu/cdn-cgi/phish-bypass?atok=qnOSOT.I6zMfsrDVGOECnt3fBq51JWediPOtq6tsZxE-1746130841.6021273-0.0.1.1-%2F&cf-turnstile-response=
IP / ASN
104.21.21.92
#13335 CLOUDFLARENET
Title
403 Forbidden

Detections

urlquery

0

Network Intrusion Detection

1

Threat Detection Systems

0

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
cssz-id-portal.icu	unknown	2025-04-30	2025-05-01	2025-05-01	1.1 kB	577 B	104.21.21.92

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2025-05-02 11:23:15	medium	Client IP	104.21.21.92	ET INFO Suspicious Domain (*.icu) in TLS SNI

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (0)

HTTP Transactions (2)

	URL	IP	Response	Size
	cssz-id-portal.icu/cdn-cgi/phish-bypass?atok=qnOSOT.I6zMfsrDVGOECnt3fBq51JWediPOtq6tsZxE-1746130841.6021273-0.0.1.1-%2F&cf-turnstile-response=	104.21.21.92	403 Forbidden	151 B
URL User Request GET cssz-id-portal.icu/cdn-cgi/phish-bypass?atok=qnOSOT.I6zMfsrDVGOECnt3fBq51JWediPOtq6tsZxE-1746130841.6021273-0.0.1.1-%2F&cf-turnstile-response= IP 104.21.21.92:80 ASN #13335 CLOUDFLARENET File type HTML document, ASCII text, with CRLF line terminators Size 151 B (151 bytes) Hash c371fa8374a06a3c0535fc341d454236 441671eacb9398792d435443beaddd3fc5fa1910 eed0b81a2fbdd1c5a9f80705885fc5bbf346ba428a79ff7a13ec8491c6a8e96c HTTP Headers `GET /cdn-cgi/phish-bypass?atok=qnOSOT.I6zMfsrDVGOECnt3fBq51JWediPOtq6tsZxE-1746130841.6021273-0.0.1.1-%2F&cf-turnstile-response= HTTP/1.1 Host: cssz-id-portal.icu User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate DNT: 1 Connection: keep-alive Upgrade-Insecure-Requests: 1 Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 403 Forbidden Date: Fri, 02 May 2025 11:23:15 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare CF-RAY: 93972540aeff5c28-TLL X-Frame-Options: DENY X-Content-Type-Options: nosniff Content-Encoding: gzip`

	cssz-id-portal.icu/cdn-cgi/phish-bypass?atok=qnOSOT.I6zMfsrDVGOECnt3fBq51JWediPOtq6tsZxE-1746130841.6021273-0.0.1.1-%2F&cf-turnstile-response=	104.21.21.92	400 Bad Request	23 B
URL User Request GET cssz-id-portal.icu/cdn-cgi/phish-bypass?atok=qnOSOT.I6zMfsrDVGOECnt3fBq51JWediPOtq6tsZxE-1746130841.6021273-0.0.1.1-%2F&cf-turnstile-response= IP 104.21.21.92:443 ASN #13335 CLOUDFLARENET Certificate IssuerGoogle Trust Services Subjectcssz-id-portal.icu Fingerprint40:70:78:05:F3:FE:79:67:A7:C9:25:67:4D:09:A5:73:39:79:60:4E ValidityWed, 30 Apr 2025 05:49:13 GMT - Tue, 29 Jul 2025 06:40:30 GMT File type ASCII text, with no line terminators Size 23 B (23 bytes) Hash 1862a245f1f02bd4477a17e9432e3a25 5e9e7ba669c7c6e7aa7aede335b0b22f0a08b88f e999e13afc2c76a9b3523daa037814a97f9ad5310ee32c4dfe3b5d006a0ed73b HTTP Headers GET /cdn-cgi/phish-bypass?atok=qnOSOT.I6zMfsrDVGOECnt3fBq51JWediPOtq6tsZxE-1746130841.6021273-0.0.1.1-%2F&cf-turnstile-response= HTTP/1.1 Host: cssz-id-portal.icu User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Upgrade-Insecure-Requests: 1 Connection: keep-alive Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache `HTTP/2 400 Bad Request date: Fri, 02 May 2025 11:23:15 GMT server: cloudflare cf-ray: 9397253fb9d05438-TLL X-Firefox-Spdy: h2`