9cst47.tk Open in urlscan Pro
2606:4700:30::6812:27e0 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://9cst47.tk/index.php
Submission: On April 13 via manual (April 13th 2019, 9:41:11 am UTC) from JP

Summary HTTP 16 Redirects Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 5 IPs in 2 countries across 4 domains to perform 16 HTTP transactions. The main IP is 2606:4700:30::6812:27e0, located in United States and belongs to CLOUDFLARENET - Cloudflare, Inc., US. The main domain is 9cst47.tk.
TLS certificate: Issued by CloudFlare Inc ECC CA-2 on April 13th 2019. Valid for: a year.

This is the only time 9cst47.tk was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic (Online) Tech Support Scam (Consumer)

Domain & IP information

	IP Address		AS Autonomous System
12	2606:4700:30:... 2606:4700:30::6812:27e0		13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1	2606:4700::68... 2606:4700::6813:c397		13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1	2a00:1450:400... 2a00:1450:4001:816::2008		15169 (GOOGLE) (GOOGLE - Google LLC)
2	2a00:1450:400... 2a00:1450:4001:818::200e		15169 (GOOGLE) (GOOGLE - Google LLC)
16	5

12 2606:4700:30::6812:27e0 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

9cst47.tk	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6813:c397 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:816::2008 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:818::200e (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	9cst47.tk 9cst47.tk	95 KB
2	google-analytics.com www.google-analytics.com	18 KB
1	googletagmanager.com www.googletagmanager.com	24 KB
1	cloudflare.com cdnjs.cloudflare.com	29 KB
16	4

	Domain	Requested by
12	9cst47.tk	9cst47.tk
2	www.google-analytics.com	www.googletagmanager.com 9cst47.tk
1	www.googletagmanager.com	9cst47.tk
1	cdnjs.cloudflare.com	9cst47.tk
16	4

This site contains no links.

Subject Issuer	Validity	Valid
sni.cloudflaressl.com CloudFlare Inc ECC CA-2	`2019-04-13` - `2020-04-13`	a year	crt.sh
ssl412106.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2019-03-02` - `2019-09-08`	6 months	crt.sh
*.google-analytics.com Google Internet Authority G3	`2019-03-01` - `2019-05-24`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://9cst47.tk/index.php
Frame ID: 21AC8D8D966523C24F59607A9BE8ED59
Requests: 17 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /cloudflare/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|(analytics))\.js/i
env /^gaGlobal$/i

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

env /^google_tag_manager$/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
script /jquery.*\.js/i
env /^jQuery$/i

Page Statistics

16
Requests

100 %
HTTPS

100 %
IPv6

4
Domains

4
Subdomains

5
IPs

2
Countries

167 kB
Transfer

464 kB
Size

4
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

16 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request index.php Show response
9cst47.tk/ 92 KB
44 KB 575ms
543ms Document
text/html 2606:4700:30::6812:27e0
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://9cst47.tk/index.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::6812:27e0 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare / PHP/5.6.36
Resource Hash: 47809af26425c985d23cb4c4b7904ce4cb6727ab3ebb49381fca9ba7e9c3b2d1

Request headers

:method: GET
:authority: 9cst47.tk
:scheme: https
:path: /index.php
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status: 200
date: Sat, 13 Apr 2019 09:40:54 GMT
content-type: text/html; charset=UTF-8
set-cookie: __cfduid=d7d1be507d8da94e42cb7bc80d2d6f33e1555148454; expires=Sun, 12-Apr-20 09:40:54 GMT; path=/; domain=.9cst47.tk; HttpOnly
vary: Accept-Encoding
x-powered-by: PHP/5.6.36
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 4c6c7b303e0abed0-FRA
content-encoding: br

GET
H2 200 jquery.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery/3.3.1/ 85 KB
29 KB 62ms
14ms Script
application/javascript 2606:4700::6813:c397
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery/3.3.1/jquery.min.js

Requested by

Host: 9cst47.tk
URL: https://9cst47.tk/index.php

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:c397 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000; includeSubDomains

Request headers

Referer: https://9cst47.tk/index.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Sat, 13 Apr 2019 09:40:55 GMT
content-encoding: br
cf-cache-status: HIT
status: 200
strict-transport-security: max-age=15780000; includeSubDomains
last-modified: Thu, 17 May 2018 09:21:00 GMT
server: cloudflare
etag: W/"5afd497c-1538f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
expires: Thu, 02 Apr 2020 09:40:55 GMT
cache-control: public, max-age=30672000
cf-ray: 4c6c7b33fe59c2e7-FRA
served-in-seconds: 0.003

GET
H2 200 analytics.js Show response
9cst47.tk/ 43 KB
17 KB 13ms
12ms Script
application/javascript 2606:4700:30::6812:27e0
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://9cst47.tk/analytics.js
Requested by: Host: 9cst47.tk
URL: https://9cst47.tk/index.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::6812:27e0 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: b688a3bcd1297cc0fe08e6e52fea14ba9108ee4b9a2052c03e7bac6e19347255

Request headers

:path: /analytics.js
pragma: no-cache
cookie: __cfduid=d7d1be507d8da94e42cb7bc80d2d6f33e1555148454
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: */*
cache-control: no-cache
:authority: 9cst47.tk
referer: https://9cst47.tk/index.php
:scheme: https
:method: GET
Referer: https://9cst47.tk/index.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Sat, 13 Apr 2019 09:40:54 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 20 Feb 2019 08:25:20 GMT
server: cloudflare
etag: W/"5c6d0ef0-aabe"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=43200
cf-ray: 4c6c7b33aaf8bed0-FRA
expires: Sat, 13 Apr 2019 21:40:54 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 63 KB
24 KB 40ms
19ms Script
application/javascript 2a00:1450:4001:816::2008
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-8664486-1

Requested by

Host: 9cst47.tk
URL: https://9cst47.tk/index.php

Protocol

H2

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:816::2008 , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Google Tag Manager (scaffolding) /

Resource Hash

c8dc8c2b0fdb55c77e3511c85941f051a07c12d88222d6ee0f84503c21edbb27

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://9cst47.tk/index.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Sat, 13 Apr 2019 09:40:55 GMT
content-encoding: br
last-modified: Thu, 11 Apr 2019 22:27:45 GMT
server: Google Tag Manager (scaffolding)
access-control-allow-origin: http://www.googletagmanager.com
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,44,43,39"
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-length: 24712
x-xss-protection: 0
expires: Sat, 13 Apr 2019 09:40:55 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 43 KB
17 KB 26ms
5ms Script
text/javascript 2a00:1450:4001:818::200e
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-8664486-1

Protocol

H2

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:818::200e , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

3e552578c7d450b023f2cd9d28f830be4335c3acc6c4ab6dadda0769f09e5f22

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://9cst47.tk/index.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 16 Jan 2019 20:01:45 GMT
server: Golfe2
age: 6839
date: Sat, 13 Apr 2019 07:46:56 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,44,43,39"
content-length: 17543
expires: Sat, 13 Apr 2019 09:46:56 GMT

GET
H2 200 collect
www.google-analytics.com/r/ 35 B
199 B 34ms
13ms Image
image/gif 2a00:1450:4001:818::200e
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/r/collect?v=1&_v=j72&a=458584871&t=pageview&_s=1&dl=https%3A%2F%2F9cst47.tk%2Findex.php&ul=en-us&de=UTF-8&dt=**%20%E3%81%82%E3%81%AA%E3%81%9F%E3%81%AE%E3%82%B3%E3%83%B3%E3%83%94%E3%83%A5%E3%83%BC%E3%82%BF%E3%81%AF%E3%83%96%E3%83%AD%E3%83%83%E3%82%AF%E3%81%95%E3%82%8C%E3%81%A6%E3%81%84%E3%81%BE%E3%81%99%20**&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=KEBAAUABE~&jid=2139977588&gjid=51562960&cid=1555110378.1555148455&tid=UA-8664486-1&_gid=1418743538.1555148455&_r=1&gtm=2ou430&z=1549866119

Requested by

Host: 9cst47.tk
URL: https://9cst47.tk/index.php

Protocol

H2

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:818::200e , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://9cst47.tk/index.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 13 Apr 2019 09:40:55 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
access-control-allow-origin: *
content-type: image/gif
status: 200
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,44,43,39"
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ 239 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bd08b9849632e73574f62ca80572a17f9bbd9bb1010fe8c6380e641460abd96c

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 xe-microsoft.svg
9cst47.tk/ 910 B
677 B 16ms
14ms Image
image/svg+xml 2606:4700:30::6812:27e0
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://9cst47.tk/xe-microsoft.svg
Requested by: Host: 9cst47.tk
URL: https://9cst47.tk/index.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::6812:27e0 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3e2a093c02f30c7844ad6cd04b64ff1af1ea0e94428ed8a00436983f2ce6efa9

Request headers

:path: /xe-microsoft.svg
pragma: no-cache
cookie: __cfduid=d7d1be507d8da94e42cb7bc80d2d6f33e1555148454; _ga=GA1.2.1555110378.1555148455; _gid=GA1.2.1418743538.1555148455; _gat_gtag_UA_8664486_1=1
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: 9cst47.tk
referer: https://9cst47.tk/index.php
:scheme: https
:method: GET
Referer: https://9cst47.tk/index.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Sat, 13 Apr 2019 09:40:55 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 20 Feb 2019 08:25:48 GMT
server: cloudflare
etag: W/"5c6d0f0c-38e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
status: 200
cache-control: public, max-age=14400
cf-ray: 4c6c7b36ef3abed0-FRA
expires: Sat, 13 Apr 2019 13:40:55 GMT

GET
H2 200 xe-search.png
9cst47.tk/ 392 B
543 B 16ms
15ms Image
image/png 2606:4700:30::6812:27e0
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://9cst47.tk/xe-search.png
Requested by: Host: 9cst47.tk
URL: https://9cst47.tk/index.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::6812:27e0 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 93e9e91bedd600e5222c7f996eea83465c764b01b68952852eb26792371bbce9

Request headers

:path: /xe-search.png
pragma: no-cache
cookie: __cfduid=d7d1be507d8da94e42cb7bc80d2d6f33e1555148454; _ga=GA1.2.1555110378.1555148455; _gid=GA1.2.1418743538.1555148455; _gat_gtag_UA_8664486_1=1
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: 9cst47.tk
referer: https://9cst47.tk/index.php
:scheme: https
:method: GET
Referer: https://9cst47.tk/index.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Sat, 13 Apr 2019 09:40:55 GMT
cf-cache-status: HIT
last-modified: Wed, 20 Feb 2019 08:25:50 GMT
server: cloudflare
etag: "5c6d0f0e-188"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 4c6c7b36ef3bbed0-FRA
content-length: 392
expires: Mon, 13 May 2019 09:40:55 GMT

GET
H2 200 xe-windows1.svg
9cst47.tk/ 2 KB
622 B 16ms
14ms Image
image/svg+xml 2606:4700:30::6812:27e0
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://9cst47.tk/xe-windows1.svg
Requested by: Host: 9cst47.tk
URL: https://9cst47.tk/index.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::6812:27e0 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0df2763118a790480bf1bf5f6af4482469ada488b34277763a9713415446555f

Request headers

:path: /xe-windows1.svg
pragma: no-cache
cookie: __cfduid=d7d1be507d8da94e42cb7bc80d2d6f33e1555148454; _ga=GA1.2.1555110378.1555148455; _gid=GA1.2.1418743538.1555148455; _gat_gtag_UA_8664486_1=1
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: 9cst47.tk
referer: https://9cst47.tk/index.php
:scheme: https
:method: GET
Referer: https://9cst47.tk/index.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Sat, 13 Apr 2019 09:40:55 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 20 Feb 2019 08:25:54 GMT
server: cloudflare
etag: W/"5c6d0f12-67d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
status: 200
cache-control: public, max-age=14400
cf-ray: 4c6c7b36ef3cbed0-FRA
expires: Sat, 13 Apr 2019 13:40:55 GMT

GET
H2 200 xe-window.svg
9cst47.tk/ 786 B
483 B 17ms
15ms Image
image/svg+xml 2606:4700:30::6812:27e0
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://9cst47.tk/xe-window.svg
Requested by: Host: 9cst47.tk
URL: https://9cst47.tk/index.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::6812:27e0 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1dff6a9b2b8680ef77287060ce58246ca2a80d613e69fa5d5059680eae8f5e07

Request headers

:path: /xe-window.svg
pragma: no-cache
cookie: __cfduid=d7d1be507d8da94e42cb7bc80d2d6f33e1555148454; _ga=GA1.2.1555110378.1555148455; _gid=GA1.2.1418743538.1555148455; _gat_gtag_UA_8664486_1=1
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: 9cst47.tk
referer: https://9cst47.tk/index.php
:scheme: https
:method: GET
Referer: https://9cst47.tk/index.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Sat, 13 Apr 2019 09:40:55 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 20 Feb 2019 08:26:10 GMT
server: cloudflare
etag: W/"5c6d0f22-312"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
status: 200
cache-control: public, max-age=14400
cf-ray: 4c6c7b36ef3dbed0-FRA
expires: Sat, 13 Apr 2019 13:40:55 GMT

GET
H2 200 xe-light.svg
9cst47.tk/ 2 KB
1 KB 17ms
16ms Image
image/svg+xml 2606:4700:30::6812:27e0
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://9cst47.tk/xe-light.svg
Requested by: Host: 9cst47.tk
URL: https://9cst47.tk/index.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::6812:27e0 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: ccd54be5ab15468c429770a4f4b7e6347802feef19d949a02c46198f745cd4c7

Request headers

:path: /xe-light.svg
pragma: no-cache
cookie: __cfduid=d7d1be507d8da94e42cb7bc80d2d6f33e1555148454; _ga=GA1.2.1555110378.1555148455; _gid=GA1.2.1418743538.1555148455; _gat_gtag_UA_8664486_1=1
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: 9cst47.tk
referer: https://9cst47.tk/index.php
:scheme: https
:method: GET
Referer: https://9cst47.tk/index.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Sat, 13 Apr 2019 09:40:55 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 20 Feb 2019 08:26:12 GMT
server: cloudflare
etag: W/"5c6d0f24-9a6"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
status: 200
cache-control: public, max-age=14400
cf-ray: 4c6c7b36ef3ebed0-FRA
expires: Sat, 13 Apr 2019 13:40:55 GMT

GET
H2 200 xe-store.svg
9cst47.tk/ 1 KB
781 B 18ms
16ms Image
image/svg+xml 2606:4700:30::6812:27e0
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://9cst47.tk/xe-store.svg
Requested by: Host: 9cst47.tk
URL: https://9cst47.tk/index.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::6812:27e0 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0e9c177bc5fd50780e7b9bc6f42b7a76ad8b371d888dc4e30ecb1cfccd894f01

Request headers

:path: /xe-store.svg
pragma: no-cache
cookie: __cfduid=d7d1be507d8da94e42cb7bc80d2d6f33e1555148454; _ga=GA1.2.1555110378.1555148455; _gid=GA1.2.1418743538.1555148455; _gat_gtag_UA_8664486_1=1
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: 9cst47.tk
referer: https://9cst47.tk/index.php
:scheme: https
:method: GET
Referer: https://9cst47.tk/index.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Sat, 13 Apr 2019 09:40:55 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 20 Feb 2019 08:26:16 GMT
server: cloudflare
etag: W/"5c6d0f28-4d8"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
status: 200
cache-control: public, max-age=14400
cf-ray: 4c6c7b36ef3fbed0-FRA
expires: Sat, 13 Apr 2019 13:40:55 GMT

GET
H2 200 xe-ie.svg
9cst47.tk/ 2 KB
1014 B 17ms
16ms Image
image/svg+xml 2606:4700:30::6812:27e0
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://9cst47.tk/xe-ie.svg
Requested by: Host: 9cst47.tk
URL: https://9cst47.tk/index.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::6812:27e0 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6b7bf3ec9a7e3ee1fc4bea81cc84f248451f3038b0c20668699c62c3c90413a7

Request headers

:path: /xe-ie.svg
pragma: no-cache
cookie: __cfduid=d7d1be507d8da94e42cb7bc80d2d6f33e1555148454; _ga=GA1.2.1555110378.1555148455; _gid=GA1.2.1418743538.1555148455; _gat_gtag_UA_8664486_1=1
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: 9cst47.tk
referer: https://9cst47.tk/index.php
:scheme: https
:method: GET
Referer: https://9cst47.tk/index.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Sat, 13 Apr 2019 09:40:55 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 20 Feb 2019 08:26:18 GMT
server: cloudflare
etag: W/"5c6d0f2a-6c4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
status: 200
cache-control: public, max-age=14400
cf-ray: 4c6c7b36ef40bed0-FRA
expires: Sat, 13 Apr 2019 13:40:55 GMT

GET
H2 404 xe-globe.png
9cst47.tk/assests/ 564 B
564 B 19ms
19ms Image
text/html 2606:4700:30::6812:27e0
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://9cst47.tk/assests/xe-globe.png
Requested by: Host: 9cst47.tk
URL: https://9cst47.tk/index.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::6812:27e0 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0b52c5338af355699530a47683420e48c7344e779d3e815ff9943cbfdc153cf2

Request headers

:path: /assests/xe-globe.png
pragma: no-cache
cookie: __cfduid=d7d1be507d8da94e42cb7bc80d2d6f33e1555148454; _ga=GA1.2.1555110378.1555148455; _gid=GA1.2.1418743538.1555148455; _gat_gtag_UA_8664486_1=1
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: 9cst47.tk
referer: https://9cst47.tk/index.php
:scheme: https
:method: GET
Referer: https://9cst47.tk/index.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Sat, 13 Apr 2019 09:40:55 GMT
content-encoding: br
cf-cache-status: HIT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/html
status: 404
cache-control: public, max-age=14400
cf-ray: 4c6c7b36ef41bed0-FRA
expires: Sat, 13 Apr 2019 13:40:55 GMT

GET
H2 200 index.php
9cst47.tk/ 29 KB
29 KB 547ms
546ms Image
text/html 2606:4700:30::6812:27e0
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://9cst47.tk/index.php
Requested by: Host: 9cst47.tk
URL: https://9cst47.tk/index.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::6812:27e0 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare / PHP/5.6.36
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /index.php
pragma: no-cache
cookie: __cfduid=d7d1be507d8da94e42cb7bc80d2d6f33e1555148454; _ga=GA1.2.1555110378.1555148455; _gid=GA1.2.1418743538.1555148455; _gat_gtag_UA_8664486_1=1
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: 9cst47.tk
referer: https://9cst47.tk/index.php
:scheme: https
:method: GET
Referer: https://9cst47.tk/index.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Sat, 13 Apr 2019 09:40:56 GMT
content-encoding: br
server: cloudflare
x-powered-by: PHP/5.6.36
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/html; charset=UTF-8
status: 200
cf-ray: 4c6c7b36ef42bed0-FRA

GET
H2 206 japan.mp3
9cst47.tk/ 100 KB
0 548ms
548ms Media
audio/mpeg 2606:4700:30::6812:27e0
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://9cst47.tk/japan.mp3
Requested by: Host: 9cst47.tk
URL: https://9cst47.tk/index.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::6812:27e0 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

:path: /japan.mp3
pragma: no-cache
cookie: __cfduid=d7d1be507d8da94e42cb7bc80d2d6f33e1555148454; _ga=GA1.2.1555110378.1555148455; _gid=GA1.2.1418743538.1555148455; _gat_gtag_UA_8664486_1=1
accept-encoding: identity;q=1, *;q=0
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
chrome-proxy: frfr
accept: */*
cache-control: no-cache
:authority: 9cst47.tk
referer: https://9cst47.tk/index.php
:scheme: https
range: bytes=0-
:method: GET
Referer: https://9cst47.tk/index.php
Accept-Encoding: identity;q=1, *;q=0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Range: bytes=0-
chrome-proxy: frfr

Response headers

date: Sat, 13 Apr 2019 09:40:56 GMT
last-modified: Wed, 20 Feb 2019 08:25:44 GMT
server: cloudflare
etag: "5c6d0f08-34ea2"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
status: 206
content-type: audio/mpeg
Content-Range: bytes 0-216737/216738
cf-ray: 4c6c7b373fbebed0-FRA
Content-Length: 216738

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic (Online) Tech Support Scam (Consumer)

36 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask function| $ function| jQuery function| gtag object| dataLayer object| google_tag_data function| ga object| gaplugins object| google_tag_manager string| GoogleAnalyticsObject object| gaGlobal object| gaData string| stroka function| toggleFullScreen function| getVariableFromURl string| phone object| x string| subid string| clickid string| postback boolean| cl boolean| isFullScreen function| fullScreen function| kzogExQSrDChY4Iq function| setCookie function| hTRnKeAy1lgYB4La function| gpAkSJDl9ENT5gLQ function| eKxJS2GzrfWPEjgm function| hCPNapvlhFicLoDm function| hxvw7JrbMUZBqVhN function| f5WOxk2dF74GMRLf function| dsfsf function| addEvent function| removeEvent

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.9cst47.tk/	1970-01-18 23:59:08	Name: _gat_gtag_UA_8664486_1 Value: 1
			.9cst47.tk/	1970-01-19 17:30:20	Name: _ga Value: GA1.2.1555110378.1555148455
			.9cst47.tk/	1970-01-19 00:00:34	Name: _gid Value: GA1.2.1418743538.1555148455
			.9cst47.tk/	1970-01-19 08:44:44	Name: __cfduid Value: d7d1be507d8da94e42cb7bc80d2d6f33e1555148454

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

9cst47.tk
cdnjs.cloudflare.com
www.google-analytics.com
www.googletagmanager.com
2606:4700:30::6812:27e0
2606:4700::6813:c397
2a00:1450:4001:816::2008
2a00:1450:4001:818::200e
0b52c5338af355699530a47683420e48c7344e779d3e815ff9943cbfdc153cf2
0df2763118a790480bf1bf5f6af4482469ada488b34277763a9713415446555f
0e9c177bc5fd50780e7b9bc6f42b7a76ad8b371d888dc4e30ecb1cfccd894f01
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
1dff6a9b2b8680ef77287060ce58246ca2a80d613e69fa5d5059680eae8f5e07
3e2a093c02f30c7844ad6cd04b64ff1af1ea0e94428ed8a00436983f2ce6efa9
3e552578c7d450b023f2cd9d28f830be4335c3acc6c4ab6dadda0769f09e5f22
47809af26425c985d23cb4c4b7904ce4cb6727ab3ebb49381fca9ba7e9c3b2d1
6b7bf3ec9a7e3ee1fc4bea81cc84f248451f3038b0c20668699c62c3c90413a7
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
93e9e91bedd600e5222c7f996eea83465c764b01b68952852eb26792371bbce9
b688a3bcd1297cc0fe08e6e52fea14ba9108ee4b9a2052c03e7bac6e19347255
bd08b9849632e73574f62ca80572a17f9bbd9bb1010fe8c6380e641460abd96c
c8dc8c2b0fdb55c77e3511c85941f051a07c12d88222d6ee0f84503c21edbb27
ccd54be5ab15468c429770a4f4b7e6347802feef19d949a02c46198f745cd4c7
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855