2fa.foo was registered on 19 Mar 2014 and is hosted on AS13335 CloudFlare Inc. in United States of America. Its SSL certificate from Sectigo Limited expired on 5 Feb 2026, and the site does not support HTTP/3.
What security vendors and the WOT community say about this domain.
What loads and tracks visitors when the homepage opens.
Running a full browser scan of the homepage… This takes about a minute.
399 similar domains registered in the last 90 days — possible typosquatting or phishing.
| Domain | Why it’s similar | Registered | Status | Report |
|---|---|---|---|---|
| 2f4.shop | Look-alike characters | 26 Aug 2026 | Checking… | Report → |
| f2a.pics | Typo | 27 Oct 2026 | Checking… | Report → |
| 2fa.guide | Other extension | 22 Oct 2026 | No website | Report → |
| 2fa.house | Other extension | 22 Oct 2026 | Checking… | Report → |
| f2a.click | Typo | 22 Oct 2026 | Checking… | Report → |
From CubDomain's daily newly registered domains. Similar doesn't mean malicious.
Is 2fa.foo’s name taken on other extensions?
Every IP address 2fa.foo resolves to, and where it's hosted.
| Host | IPv4 address | TTL |
|---|---|---|
| 2fa.foo | 104.21.75.136 | 300 |
| 2fa.foo | 172.67.177.77 | 300 |
| Host | IPv6 address | TTL |
|---|---|---|
| 2fa.foo | 2606:4700:3030::ac43:b14d | 300 |
| 2fa.foo | 2606:4700:3033::6815:4b88 | 300 |
| Host | Mail server | TTL |
|---|---|---|
| 2fa.foo | 0 2fa-foo.mail.protection.outlook.com | 3600 |
| Host | Name server | TTL |
|---|---|---|
| 2fa.foo | coco.ns.cloudflare.com | 21600 |
| 2fa.foo | paul.ns.cloudflare.com | 21600 |
| Host | Text | TTL |
|---|---|---|
| 2fa.foo | "MS=ms81202508" | 3600 |
| 2fa.foo | "v=spf1 include:spf.protection.outlook.com -all" | 3600 |
| Host | Start of authority | TTL |
|---|---|---|
| 2fa.foo | coco.ns.cloudflare.com dns.cloudflare.com 2371391330 10000 2400 604800 1800 | 1800 |
Other domains served from 172.67.177.77. Normal for shared hosting and CDNs.
No reviews yet. Used 2fa.foo? Be the first to say how it went.
Reviews are from CubDomain users and are separate from the security verdicts above.
Common questions, answered from this report's data.
2fa.foo has no community safety rating yet. Its SSL certificate expired on 5 Feb 2026. See Security →
2fa.foo was registered on 19 Mar 2014, making it 12 years old. See Overview →
2fa.foo is served from 2 IP addresses, mainly on AS13335 CloudFlare Inc. in United States of America. See Hosting →
Raw registry data for 2fa.foo. May be redacted by privacy services.
% IANA WHOIS server % for more information on IANA, visit http://www.iana.org % This query returned 1 object refer: domain: FOO organisation: Charleston Road Registry Inc. address: 1600 Amphitheatre Parkway address: Mountain View CA 94043 address: United States of America (the) contact: administrative name: TLD Admin organisation: Google Inc address: 111 8th Avenue address: New York NY 10011 address: United States of America (the) phone: +1 404 978 8419 fax-no: +1 650 492 5631 e-mail: [email protected] contact: technical name: TLD Engineering organisation: Google Inc address: 76 Ninth Avenue, 4th Floor address: New York NY 10011 address: United States of America (the) phone: +1 404 978 8419 fax-no: +1 650 492 5631 e-mail: [email protected] nserver: NS-TLD1.CHARLESTONROADREGISTRY.COM 2001:4860:4802:32:0:0:0:69 216.239.32.105 nserver: NS-TLD2.CHARLESTONROADREGISTRY.COM 2001:4860:4802:34:0:0:0:69 216.239.34.105 nserver: NS-TLD3.CHARLESTONROADREGISTRY.COM 2001:4860:4802:36:0:0:0:69 216.239.36.105 nserver: NS-TLD4.CHARLESTONROADREGISTRY.COM 2001:4860:4802:38:0:0:0:69 216.239.38.105 nserver: NS-TLD5.CHARLESTONROADREGISTRY.COM 2001:4860:4805:0:0:0:0:69 216.239.60.105 ds-rdata: 59840 8 2 cf97e293d4692c8085d5254b04c77780d1a217a692d5d0eeefc7a8e282614f1c whois: status: ACTIVE remarks: Registration information: https://www.registry.google created: 2014-03-20 changed: 2025-04-11 source: IANA
The first response from http://www.2fa.foo, before any redirect: caching, server and policy headers.
Four timed TCP connections to port 443 from CubDomain's servers.
CubDomain is not affiliated with 2fa.foo. Data is collected independently from public sources and some figures are estimates, provided for information only.
Spam and malware blocklists for the site's IP and mail servers.
Found in public certificate transparency logs.
Searching the certificate transparency logs… This can take up to a minute.
When the site first appeared, and what has changed since.
We record what changes from the next time this report is refreshed.