3generationtreeservice.com

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 4 HTTP transactions. The main IP is 160.153.16.63, located in Scottsdale, United States and belongs to AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US. The main domain is 3generationtreeservice.com.

This is the only time 3generationtreeservice.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
2	160.153.16.63 160.153.16.63	26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com)
2	95.101.245.11 95.101.245.11	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
4	2

2 160.153.16.63 (Scottsdale, United States)

ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US)
PTR: ip-160-153-16-63.ip.secureserver.net

3generationtreeservice.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 95.101.245.11 (European Union)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a95-101-245-11.deploy.akamaitechnologies.com

auth.gfx.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	gfx.ms auth.gfx.ms	5 KB
2	3generationtreeservice.com 3generationtreeservice.com	16 KB
4	2

	Domain	Requested by
2	auth.gfx.ms	3generationtreeservice.com
2	3generationtreeservice.com	3generationtreeservice.com
4	2

This site contains no links.

Subject Issuer	Validity	Valid
msagfx.live.com Symantec Class 3 Secure Server CA - G4	`2016-12-14` - `2018-12-15`	2 years	crt.sh

This page contains 1 frames:

Primary Page: http://3generationtreeservice.com/gadat/newzone/hox.html
Frame ID: 30037.1
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Statistics

4
Requests

50 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

21 kB
Transfer

89 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request hox.html Show response 3generationtreeservice.com/gadat/newzone/	5 KB 2 KB	87ms 13ms	Document text/html	160.153.16.63 GoDaddy.com
General Check archive.org Show headers Download Go to Full URL http://3generationtreeservice.com/gadat/newzone/hox.html Protocol HTTP/1.1 Server 160.153.16.63 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US), Reverse DNS ip-160-153-16-63.ip.secureserver.net Software Apache/2.4.25 / Resource Hash `bc56f12b34c1161cdd5f0252d5139aaee87b41da3e10cf5d3222c7a688446ffb` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host 3generationtreeservice.com Accept-Language en-US,en;q=0.8 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8 Cache-Control no-cache Connection keep-alive Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Response headers Date Mon, 05 Jun 2017 19:34:36 GMT Content-Encoding gzip Last-Modified Wed, 13 Jul 2016 04:46:42 GMT Server Apache/2.4.25 ETag "48604cc-132d-5377d125bd080-gzip" Vary Accept-Encoding,User-Agent Content-Type text/html Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5 Content-Length 2279
GET H/1.1	200 OK	Default1033.css 3generationtreeservice.com/gadat/newzone/hox_files/	72 KB 14 KB	16ms 16ms	Stylesheet text/css	160.153.16.63 GoDaddy.com
General Check archive.org Show headers Download Go to Full URL http://3generationtreeservice.com/gadat/newzone/hox_files/Default1033.css Requested by Host: 3generationtreeservice.com URL: http://3generationtreeservice.com/gadat/newzone/hox.html Protocol HTTP/1.1 Server 160.153.16.63 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US), Reverse DNS ip-160-153-16-63.ip.secureserver.net Software Apache/2.4.25 / Resource Hash `1a3260d3f45c88e326e046374ab737a0631de1c5a866913eb2c8acacf370d7ec` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch Host 3generationtreeservice.com Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Accept text/css,/;q=0.1 Referer http://3generationtreeservice.com/gadat/newzone/hox.html Connection keep-alive Cache-Control no-cache Referer http://3generationtreeservice.com/gadat/newzone/hox.html User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Response headers Date Mon, 05 Jun 2017 19:34:36 GMT Content-Encoding gzip Last-Modified Wed, 11 May 2016 10:53:42 GMT Server Apache/2.4.25 ETag "48604d3-11fff-5328edad9b980-gzip" Vary Accept-Encoding,User-Agent Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5 Content-Length 14376
GET H/1.1	200 OK	AppCentipede_Microsoft.svg auth.gfx.ms/16.000.26281.00/AppCentipede/	7 KB 3 KB	36ms 8ms	Image image/svg+xml	95.101.245.11 Akamai Technologies
General Check archive.org Show headers Download Go to Show image Full URL https://auth.gfx.ms/16.000.26281.00/AppCentipede/AppCentipede_Microsoft.svg Requested by Host: 3generationtreeservice.com URL: http://3generationtreeservice.com/gadat/newzone/hox.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 95.101.245.11 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a95-101-245-11.deploy.akamaitechnologies.com Software Microsoft-IIS/8.5 / Resource Hash `bde5e27f76f371121f1955806f1b662f323f3793b079455f5bfe83365a393625` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch, br Host auth.gfx.ms Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* http://3generationtreeservice.com/gadat/newzone/hox.html Connection keep-alive Cache-Control no-cache Referer http://3generationtreeservice.com/gadat/newzone/hox.html User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Response headers Date Mon, 05 Jun 2017 19:34:36 GMT Content-Encoding gzip Last-Modified Tue, 10 Nov 2015 05:54:06 GMT PPServer PPV: 30 H: BL2IDSPRTS1A002 V: 0 ETag "0939f357c1bd11:0" Vary Accept-Encoding Content-Type image/svg+xml Access-Control-Allow-Origin * Cache-Control max-age=604608 Connection keep-alive Accept-Ranges bytes Content-Length 2946 Server Microsoft-IIS/8.5
GET H/1.1	200 OK	Microsoft_Logotype_Gray.svg auth.gfx.ms/16.000.26281.00/	5 KB 2 KB	16ms 7ms	Image image/svg+xml	95.101.245.11 Akamai Technologies
General Check archive.org Show headers Download Go to Show image Full URL https://auth.gfx.ms/16.000.26281.00/Microsoft_Logotype_Gray.svg Requested by Host: 3generationtreeservice.com URL: http://3generationtreeservice.com/gadat/newzone/hox.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 95.101.245.11 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a95-101-245-11.deploy.akamaitechnologies.com Software Microsoft-IIS/8.5 / Resource Hash `356f7d1241f92c9de9c9cfd0bebb6c10d1b38508a3f37cebc26329c656bad19f` Request headers Pragma no-cache Accept-Encoding gzip, deflate, sdch, br Host auth.gfx.ms Accept-Language en-US,en;q=0.8 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Accept image/webp,image/,/;q=0.8 Referer* http://3generationtreeservice.com/gadat/newzone/hox.html Connection keep-alive Cache-Control no-cache Referer http://3generationtreeservice.com/gadat/newzone/hox.html User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Response headers Date Mon, 05 Jun 2017 19:34:36 GMT Content-Encoding gzip Last-Modified Tue, 10 Nov 2015 05:54:06 GMT PPServer PPV: 30 H: BL2IDSPRTS1C004 V: 0 ETag "0939f357c1bd11:0" Vary Accept-Encoding Content-Type image/svg+xml Access-Control-Allow-Origin * Cache-Control max-age=604608 Connection keep-alive Accept-Ranges bytes Content-Length 2160 Server Microsoft-IIS/8.5

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

3generationtreeservice.com
auth.gfx.ms
160.153.16.63
95.101.245.11
1a3260d3f45c88e326e046374ab737a0631de1c5a866913eb2c8acacf370d7ec
356f7d1241f92c9de9c9cfd0bebb6c10d1b38508a3f37cebc26329c656bad19f
bc56f12b34c1161cdd5f0252d5139aaee87b41da3e10cf5d3222c7a688446ffb
bde5e27f76f371121f1955806f1b662f323f3793b079455f5bfe83365a393625

3generationtreeservice.com Open in urlscan Pro 160.153.16.63 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Statistics

4 Requests

50 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

21 kBTransfer

89 kBSize

0 Cookies

0 Outgoing links

Redirected requests

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

Indicators

3generationtreeservice.com Open in urlscan Pro
160.153.16.63 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

4
Requests

50 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

21 kB
Transfer

89 kB
Size

0
Cookies

4 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!