threatfox.abuse.ch
199.232.174.49AS54113 · US- Content Inspectionclean
- Threat Intelligenceclean
- Network & Hostingclean
- Browser Analysisclean
- Related Infrastructureclean
- TLS Fingerprintunknown
- Domain Intelligenceunknown
Looks safe
AutomatedOur automated checks did not find known threat signals on this site at the time of the scan.
What to do
No action needed. Stay alert as usual — a clean result reflects this scan only, and sites can change after they are checked.
A clean result means no known threat signals were found in this scan — it is not an absolute guarantee, and a site can change after it is checked.
Findings
Strongest firstThe page reproduces a CDN challenge interstitial (e.g. Cloudflare's 'Just a moment…') inside a hosted file, rather than being served by that CDN's edge. It is a lure skin used to make a redirect look like a routine security check.
Analyst noteA genuine Cloudflare/DDoS-Guard challenge is served by the CDN, not uploaded to object storage. Treat the faked chrome as a delivery signal, especially alongside a gated cross-origin redirect.
Infrastructure
- IP
- 199.232.174.49FASTLY - Fastly, Inc., US · AS54113US
- TLS
- CN=GlobalSign Atlas R3 DV TLS CA 2025 Q4, O=GlobalSign nv-sa, C=BE · expires Jan 10, 2027
- Redirects
- 1 hop · /ioc/1940997/ → /verify-ua/
Hashes & fingerprints
Page capture
LiveTitle “ThreatFox | Checking your browser”
Engines
7 · time to verdictPage
- HTTP
- 200 · Completed
- Title
- ThreatFox | Checking your browser
- Load
- 3.71 s · 18 requests