mass.report
Scan Intelligence Report0/100
low Risk
anonflare.com
https://anonflare.com/en/sites
IP
104.21.54.234 · Cloudflare, Inc.
Location
Toronto, Canada
Domain Age
309 days
HTTP
200 · 18.1s
SSL
Valid· WE1, Google Trust Services, US
Status
COMPLETED
Domain Intelligence: anonflare.com
Scanned 4 times since Mar 17, 2026, 10:46 AM UTC
ℹ Low (5)
Linked Phishing Report
This scan is attached to a vendor submission report
Brand
Anonflare
Vendors
29/30
Status
partial
✓ sophos✓ microsoft✓ eset✓ avast✓ brightcloud✗ norton✓ bitdefender✓ kaspersky✓ spamhaus✓ avg✓ yandex✓ drweb✓ polyswarm✓ apple✓ openphish✓ cisa✓ urlquery✓ isitphish✓ urlscan✓ phishreport✓ apwg✓ emsisoft✓ netcraft✓ phishtank✓ virustotal✓ urlabuse✓ threatyeti✓ google✓ fortiguard✓ mcafee
KB/IOK Matches (0)—
No KB/IOK detections were recorded for this scan.
Anonflare
Unknowntechnology | other · 6/3/2026
Summary
The page presents branding for Anonflare with a dedicated sidebar and navigation, including a title 'Anonflare' and menu items under websites, proxy, and login. However, the content and imagery strongly focus on website proxying services, which is an abuse/service facilitating masking hosting/IP exposure. The domain anonflare.com is registered recently (created 2025-05-19) and uses Cloudflare, with a high number of external scripts. The page appears to be a legitimate Anonflare-like dashboard rather than a classic credential phishing page, but the presence of a proxying service raises potential abuse context. There is no direct evidence of credential harvesting on this page itself (no login form in static HTML), but dynamic SPA behavior could host credential collection. The risk signals and the visual branding strongly indicate impersonation risk only if the domain is used to deceive users about hosting/IP visibility; based on the evidence, treat as potential first-party service with notable abuse potential in proxy domain context.
Evidence Summary
▸Observed 3 capture stage(s); canonical stage is late_render_3s.
▸POST targets observed during capture: https://anonflare.com/cdn-cgi/rum?.
▸Distinctive asset clues: jquery-3.3.1.min.js, bootstrap.bundle.min.js, lite-purple.css, perfect-scrollbar.css, logo.png.
Capture
Stages: 3
Canonical: Late Render (+3s)
Changed: No
Credential Signals
Forms: 0
Password fields: 0
Late-stage login UI: No
Resource Signals
Resources: 52
Hosts: 4
Domains: 4
Observed Signals (1)
SPA rendering with credential capture potential (forms rendered via JavaScript despite no static HTML forms detected) as indicated by 0 static forms but 21 external scripts.
Observed Indicators (2)
▸Static HTML contains no login form; scripts likely render UI including credential fields (SPA behavior).
▸Screenshot shows a dashboard-like UI with navigation and 'Sign in', 'Sign up' links in the left menu, implying potential credential surfaces.
Risk AssessmentUsed in abuse reports
The site presents Anonflare-branded content and appears to be a legitimate service page for proxying websites, but the real abuse risk arises from the service category (proxy/VPN-like offerings) which can be used for wrongdoing such as obfuscating hosting or IPs. The scan shows SPA-style asset loading and a POST to a CDN-rum endpoint, plus a recent domain with Cloudflare protection; these factors together indicate potential for misuse in facilitating unauthorized website proxying. Given the evidence, classify as first-party service with notable abuse potential in the proxy domain, and monitor for credential collection UI if rendered dynamically. Do not claim credential harvesting without direct evidence of a login form in the runtime UI.
Recommended Action
Monitor
Cross-Reference9
URL Intelligence
Domain Intelligence
IP Intelligence
Public threat feed available — JSON API