urlscan.io logo urlscan.io
SecurityTrails logo

pc-firewall-alert.ga Open in urlscan Pro
2606:4700:3035::681b:ac16  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://pc-firewall-alert.ga/
Effective URL: https://pc-firewall-alert.ga/LaBlanca-X-78558/
Submission Tags: @jcybersec_
Submission: On July 08 via api from GB
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 10 IPs in 4 countries across 7 domains to perform 21 HTTP transactions. The main IP is 2606:4700:3035::681b:ac16, located in United States and belongs to CLOUDFLARENET, US. The main domain is pc-firewall-alert.ga.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on July 8th 2020. Valid for: a year.
This is the only time pc-firewall-alert.ga was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Apple Software Update (Online) Tech Support Scam (Consumer)

Domain & IP information

IP Address AS Autonomous System
9 2606:4700:303... 13335 (CLOUDFLAR...)
2 104.22.53.65 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
2 46.105.202.39 16276 (OVH)
1 93.184.220.20 15133 (EDGECAST)
1 35.186.235.23 15169 (GOOGLE)
2 46.4.89.108 24940 (HETZNER-AS)
1 130.211.34.183 15169 (GOOGLE)
1 149.202.74.47 16276 (OVH)
1 198.145.13.11 2044 (IINET-2044)
21 10
9    2606:4700:3035::681b:ac16 (United States)

ASN13335 (CLOUDFLARENET, US)
pc-firewall-alert.ga
2    104.22.53.65 (United States)

ASN13335 (CLOUDFLARENET, US)
www.statcounter.com
c.statcounter.com
1    2606:4700::6810:dd1d (United States)

ASN13335 (CLOUDFLARENET, US)
static.getclicky.com
2    46.105.202.39 (France)

ASN16276 (OVH, FR)
u.heatmap.it
1    93.184.220.20 (London, United Kingdom)

ASN15133 (EDGECAST, US)
static.woopra.com
1    35.186.235.23 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: 23.235.186.35.bc.googleusercontent.com
cdn4.mxpnl.com
2    46.4.89.108 (Germany)

ASN24940 (HETZNER-AS, DE)
www.woopra.com
1    130.211.34.183 (Mountain View, United States)

ASN15169 (GOOGLE, US)
api-js.mixpanel.com
1    149.202.74.47 (France)

ASN16276 (OVH, FR)
eu6.heatmap.it
1    198.145.13.11 (United States)

ASN2044 (IINET-2044, US)
in.getclicky.com
Domain Requested by
9 pc-firewall-alert.ga pc-firewall-alert.ga
2 www.woopra.com static.woopra.com
2 u.heatmap.it pc-firewall-alert.ga
u.heatmap.it
1 in.getclicky.com static.getclicky.com
1 eu6.heatmap.it pc-firewall-alert.ga
1 api-js.mixpanel.com cdn4.mxpnl.com
1 c.statcounter.com www.statcounter.com
1 cdn4.mxpnl.com pc-firewall-alert.ga
1 static.woopra.com pc-firewall-alert.ga
1 static.getclicky.com pc-firewall-alert.ga
1 www.statcounter.com pc-firewall-alert.ga
21 11

This site contains no links.

Subject Issuer Validity Valid
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2020-07-08 -
2021-07-08		 a year crt.sh
us-dallas.statcounter.com
Sectigo RSA Domain Validation Secure Server CA		 2019-11-22 -
2020-10-29		 a year crt.sh
*.heatmap.it
Sectigo RSA Domain Validation Secure Server CA		 2020-06-13 -
2022-06-26		 2 years crt.sh
gp1.wac.edgecastcdn.net
DigiCert SHA2 Secure Server CA		 2019-01-29 -
2021-03-19		 2 years crt.sh
*.mxpnl.com
RapidSSL RSA CA 2018		 2019-07-29 -
2021-07-28		 2 years crt.sh
woopra.com
Let's Encrypt Authority X3		 2020-05-06 -
2020-08-04		 3 months crt.sh
*.mixpanel.com
GeoTrust RSA CA 2018		 2020-04-20 -
2022-04-21		 2 years crt.sh
*.getclicky.com
COMODO RSA Domain Validation Secure Server CA		 2018-10-29 -
2020-10-15		 2 years crt.sh

This page contains 1 frames:

Primary Page: https://pc-firewall-alert.ga/LaBlanca-X-78558/
Frame ID: 3E7DE78961AD5E0CE4168ED85522980F
Requests: 21 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://pc-firewall-alert.ga/ Page URL
  2. https://pc-firewall-alert.ga/LaBlanca-X-78558/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /^cloudflare$/i
Overall confidence: 100%
Detected patterns
  • script /static\.woopra\.com/i

Page Statistics

21
Requests

100 %
HTTPS

20 %
IPv6

7
Domains

11
Subdomains

10
IPs

4
Countries

181 kB
Transfer

401 kB
Size

6
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://pc-firewall-alert.ga/ Page URL
  2. https://pc-firewall-alert.ga/LaBlanca-X-78558/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

21 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
pc-firewall-alert.ga/ 		1 KB
813 B 		Document
General
Check archive.org
Download Go to
Full URL
https://pc-firewall-alert.ga/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3035::681b:ac16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PHP/7.0.33
Resource Hash

Request headers

:method
GET
:authority
pc-firewall-alert.ga
:scheme
https
:path
/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
200
date
Wed, 08 Jul 2020 15:56:16 GMT
content-type
text/html; charset=UTF-8
set-cookie
__cfduid=dad674aacc1ccc4655a1723afa085d3141594223775; expires=Fri, 07-Aug-20 15:56:15 GMT; path=/; domain=.pc-firewall-alert.ga; HttpOnly; SameSite=Lax; Secure
x-powered-by
PHP/7.0.33
vary
Accept-Encoding,User-Agent
cf-cache-status
DYNAMIC
cf-request-id
03d0bd6855000097166a812200000001
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
5afafe86e9089716-FRA
content-encoding
br
Primary Request /
pc-firewall-alert.ga/LaBlanca-X-78558/ 		102 KB
47 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://pc-firewall-alert.ga/LaBlanca-X-78558/
Requested by
Host: pc-firewall-alert.ga
URL: https://pc-firewall-alert.ga/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3035::681b:ac16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d3955cb7e0a908bbcf029cfcc3083d0df02bd70084c41442736e1b3d03fada8b

Request headers

:method
GET
:authority
pc-firewall-alert.ga
:scheme
https
:path
/LaBlanca-X-78558/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
same-origin
sec-fetch-mode
navigate
sec-fetch-dest
document
referer
https://pc-firewall-alert.ga/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
__cfduid=dad674aacc1ccc4655a1723afa085d3141594223775
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://pc-firewall-alert.ga/

Response headers

status
200
date
Wed, 08 Jul 2020 15:56:16 GMT
content-type
text/html
last-modified
Wed, 08 Jul 2020 15:44:06 GMT
vary
Accept-Encoding,User-Agent
cf-cache-status
DYNAMIC
cf-request-id
03d0bd6a67000097166a81f200000001
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
5afafe8a3b389716-FRA
content-encoding
br
jquery-3.js
pc-firewall-alert.ga/LaBlanca-X-78558/ 		85 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pc-firewall-alert.ga/LaBlanca-X-78558/jquery-3.js
Requested by
Host: pc-firewall-alert.ga
URL: https://pc-firewall-alert.ga/LaBlanca-X-78558/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3035::681b:ac16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf

Request headers

Referer
https://pc-firewall-alert.ga/LaBlanca-X-78558/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 08 Jul 2020 15:56:16 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Sat, 02 Nov 2019 05:53:06 GMT
server
cloudflare
age
2132
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding,User-Agent
content-type
application/javascript
status
200
cache-control
max-age=14400
cf-ray
5afafe8d2d479716-FRA
cf-request-id
03d0bd6c3b000097166a828200000001
logo.png
pc-firewall-alert.ga/LaBlanca-X-78558/ 		6 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pc-firewall-alert.ga/LaBlanca-X-78558/logo.png
Requested by
Host: pc-firewall-alert.ga
URL: https://pc-firewall-alert.ga/LaBlanca-X-78558/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3035::681b:ac16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
53181878e809f02b06009c518c38027acdd87ce41fa60958f13c2a596b001ff9

Request headers

Referer
https://pc-firewall-alert.ga/LaBlanca-X-78558/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 08 Jul 2020 15:56:17 GMT
cf-cache-status
HIT
last-modified
Sat, 02 Nov 2019 05:53:04 GMT
server
cloudflare
age
2133
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
status
200
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
5afafe8e8e5a9716-FRA
content-length
6467
cf-request-id
03d0bd6d14000097166a830200000001
ajax2.gif
pc-firewall-alert.ga/LaBlanca-X-78558/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pc-firewall-alert.ga/LaBlanca-X-78558/ajax2.gif
Requested by
Host: pc-firewall-alert.ga
URL: https://pc-firewall-alert.ga/LaBlanca-X-78558/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3035::681b:ac16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3d520d6c4219bd80b31b9607f51622a3b2980eac46e149216ed5348cc7d74855

Request headers

Referer
https://pc-firewall-alert.ga/LaBlanca-X-78558/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 08 Jul 2020 15:56:17 GMT
cf-cache-status
HIT
last-modified
Sat, 02 Nov 2019 05:53:10 GMT
server
cloudflare
age
2132
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/gif
status
200
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
5afafe8e8e5b9716-FRA
content-length
1816
cf-request-id
03d0bd6d14000097166a831200000001
v1.png
pc-firewall-alert.ga/LaBlanca-X-78558/ 		315 B
315 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pc-firewall-alert.ga/LaBlanca-X-78558/v1.png
Requested by
Host: pc-firewall-alert.ga
URL: https://pc-firewall-alert.ga/LaBlanca-X-78558/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3035::681b:ac16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

Request headers

Referer
https://pc-firewall-alert.ga/LaBlanca-X-78558/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 08 Jul 2020 15:56:17 GMT
content-encoding
br
cf-cache-status
EXPIRED
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/html; charset=iso-8859-1
status
404
cache-control
max-age=14400
cf-ray
5afafe8e8e5e9716-FRA
cf-request-id
03d0bd6d17000097166a832200000001
counter.js
www.statcounter.com/counter/ 		35 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.statcounter.com/counter/counter.js
Requested by
Host: pc-firewall-alert.ga
URL: https://pc-firewall-alert.ga/LaBlanca-X-78558/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.53.65 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e6e7da65e2749bc2567b71e675f0ce7788700dfbea19c0d96dbe76187e983c97

Request headers

Referer
https://pc-firewall-alert.ga/LaBlanca-X-78558/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 08 Jul 2020 15:56:17 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 10 Jun 2020 16:24:01 GMT
server
cloudflare
age
38327
etag
W/"5ee10921-8b02"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
max-age=43200
cf-ray
5afafe8edc870bed-AMS
cf-request-id
03d0bd6d4700000bed9c97e200000001
expires
Wed, 08 Jul 2020 17:17:30 GMT
js
static.getclicky.com/ 		15 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.getclicky.com/js
Requested by
Host: pc-firewall-alert.ga
URL: https://pc-firewall-alert.ga/LaBlanca-X-78558/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:dd1d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3c29235c7537fb21c1de7b20aec0870b95532cdc39b60a00d45a72c2a7fb2376

Request headers

Referer
https://pc-firewall-alert.ga/LaBlanca-X-78558/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 08 Jul 2020 15:56:17 GMT
content-encoding
gzip
cf-cache-status
HIT
server
cloudflare
age
577519
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding, Accept-Encoding
content-type
text/javascript; charset=utf-8
status
200
expires
Wed, 15 Jul 2020 15:56:17 GMT
cache-control
public, max-age=604800
cf-ray
5afafe8ebadcd70d-FRA
cf-request-id
03d0bd6d300000d70d98161200000001
x-proxy-cache
HIT
/
pc-firewall-alert.ga/LaBlanca-X-78558/ 		24 KB
24 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pc-firewall-alert.ga/LaBlanca-X-78558/
Requested by
Host: pc-firewall-alert.ga
URL: https://pc-firewall-alert.ga/LaBlanca-X-78558/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3035::681b:ac16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://pc-firewall-alert.ga/LaBlanca-X-78558/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 08 Jul 2020 15:56:17 GMT
content-encoding
br
cf-cache-status
DYNAMIC
last-modified
Wed, 08 Jul 2020 15:44:06 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding,User-Agent
content-type
text/html
status
200
cf-ray
5afafe8e8e609716-FRA
cf-request-id
03d0bd6d19000097166a833200000001
Funk.ogg
pc-firewall-alert.ga/LaBlanca-X-78558/ 		315 B
391 B 		Media
General
Check archive.org
Download Go to
Full URL
https://pc-firewall-alert.ga/LaBlanca-X-78558/Funk.ogg
Requested by
Host: pc-firewall-alert.ga
URL: https://pc-firewall-alert.ga/LaBlanca-X-78558/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3035::681b:ac16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

Request headers

Referer
https://pc-firewall-alert.ga/LaBlanca-X-78558/
Accept-Encoding
identity;q=1, *;q=0
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Range
bytes=0-

Response headers

date
Wed, 08 Jul 2020 15:56:17 GMT
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type
text/html; charset=iso-8859-1
status
404
cf-ray
5afafe8f3ebb9716-FRA
cf-request-id
03d0bd6d80000097166a836200000001
log.js
u.heatmap.it/ 		27 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://u.heatmap.it/log.js
Requested by
Host: pc-firewall-alert.ga
URL: https://pc-firewall-alert.ga/LaBlanca-X-78558/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
46.105.202.39 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
/
Resource Hash
79c79d9039382cd34e2e9aa463f85c160d3890c688941fc6837cc2cf81919643

Request headers

Referer
https://pc-firewall-alert.ga/LaBlanca-X-78558/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 08 Jul 2020 08:42:48 GMT
content-encoding
br
last-modified
Mon, 22 Jun 2020 07:05:45 GMT
x-cdn-pop-ip
137.74.120.32/27
etag
W/"5ef05849-6b2c"
x-cacheable
Matched cache
vary
Accept-Encoding
content-type
application/x-javascript; charset=UTF-8
status
200
cache-control
max-age=3600
x-cdn-pop
sbg
accept-ranges
bytes
content-length
10533
x-request-id
683115762
expires
Wed, 08 Jul 2020 09:42:48 GMT
w.js
static.woopra.com/js/ 		17 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.woopra.com/js/w.js
Requested by
Host: pc-firewall-alert.ga
URL: https://pc-firewall-alert.ga/LaBlanca-X-78558/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
93.184.220.20 London, United Kingdom, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (amb/6BC2) /
Resource Hash
aa431faef57d16ba7ce8a754eb1f670b6204a479a663c4a6ab89d7d3fe440354

Request headers

Referer
https://pc-firewall-alert.ga/LaBlanca-X-78558/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 08 Jul 2020 15:56:17 GMT
content-encoding
gzip
last-modified
Fri, 09 Aug 2019 20:10:01 GMT
server
ECS (amb/6BC2)
age
5981
status
200
etag
"23fc2-4334-58fb4c25997a0"
vary
Accept-Encoding
x-cache
HIT
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=86400, proxy-revalidate
accept-ranges
bytes
content-length
6116
mixpanel-2-latest.min.js
cdn4.mxpnl.com/libs/ 		79 KB
27 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn4.mxpnl.com/libs/mixpanel-2-latest.min.js
Requested by
Host: pc-firewall-alert.ga
URL: https://pc-firewall-alert.ga/LaBlanca-X-78558/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.186.235.23 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
23.235.186.35.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
ad2e9d818a624183e056f9a6aae4d99852ab74d5cd9d43e0ca243ecbe7762ece

Request headers

Referer
https://pc-firewall-alert.ga/LaBlanca-X-78558/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 08 Jul 2020 15:53:41 GMT
content-encoding
gzip
age
156
x-guploader-uploadid
AAANsUkb-iySQ8taSLSDU_86EhJoOGg3zodv5RKSJREHmZpePiUk8bhPngbuME6xpwuP8q_NKTbxEOZg5MOwd3wFp74
x-goog-storage-class
MULTI_REGIONAL
status
200
x-goog-metageneration
2
x-goog-stored-content-encoding
gzip
alt-svc
clear
content-length
26889
last-modified
Fri, 12 Jun 2020 22:29:38 GMT
server
UploadServer
etag
"5a8b0c73e7b7380b715a6857a7b375d1"
vary
Accept-Encoding
x-goog-hash
crc32c=1R8HAg==, md5=WosMc+e3OAtxWmhXp7N10Q==
content-language
en
access-control-allow-origin
*
x-goog-generation
1592000978467495
cache-control
public,max-age=600
x-goog-stored-content-length
26889
accept-ranges
bytes
content-type
text/javascript
expires
Wed, 08 Jul 2020 16:03:41 GMT
beep.mp3
pc-firewall-alert.ga/LaBlanca-X-78558/ 		8 KB
8 KB 		Media
General
Check archive.org
Download Go to
Full URL
https://pc-firewall-alert.ga/LaBlanca-X-78558/beep.mp3
Requested by
Host: pc-firewall-alert.ga
URL: https://pc-firewall-alert.ga/LaBlanca-X-78558/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3035::681b:ac16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0589be7715d2320e559eae6bd26f3528e97450c70293da2e1e8ce45f77f99ab1

Request headers

Referer
https://pc-firewall-alert.ga/LaBlanca-X-78558/
Accept-Encoding
identity;q=1, *;q=0
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Range
bytes=0-

Response headers

date
Wed, 08 Jul 2020 15:56:17 GMT
cf-cache-status
DYNAMIC
last-modified
Sat, 02 Nov 2019 05:53:08 GMT
server
cloudflare
status
206
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding,User-Agent
content-type
audio/mpeg
Content-Range
bytes 0-6097/6098
cf-ray
5afafe8f7ee29716-FRA
Content-Length
6098
cf-request-id
03d0bd6da8000097166a83a200000001
t.php
c.statcounter.com/ 		162 B
575 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.statcounter.com/t.php?sc_project=12354563&java=1&security=84a1c7c7&u1=160995CF35AC4F262278D99BAFE3AFBA&sc_rum_f_s=0&sc_rum_f_e=757&sc_rum_e_s=838&sc_rum_e_e=845&sc_random=0.17015810912120632&jg=new&rr=1.1.1.1.1.1.1.1.1&resolution=1600&h=1200&camefrom=https%3A//pc-firewall-alert.ga/&u=https%3A//pc-firewall-alert.ga/LaBlanca-X-78558/%23forward&t=Apple%20Support%20-%20Call%20Now&sc_snum=1&sess=1b3daf&p=0&invisible=1&get_config=true
Requested by
Host: www.statcounter.com
URL: https://www.statcounter.com/counter/counter.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.22.53.65 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0564d20c6662fa83c89b22ef3e1185cede3d6e4dfbc1525e936930e8ea58fb13

Request headers

Referer
https://pc-firewall-alert.ga/LaBlanca-X-78558/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

cf-ray
5afafe8f9dd40bed-AMS
date
Wed, 08 Jul 2020 15:56:17 GMT
content-encoding
br
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
status
200
p3p
policyref="http://www.statcounter.com/w3c/p3p.xml", CP="ADMa OUR COM NAV NID DSP NOI COR"
access-control-allow-origin
https://pc-firewall-alert.ga
access-control-allow-credentials
true
content-type
application/json
cf-request-id
03d0bd6dbd00000bed9c986200000001
expires
Mon, 26 Jul 1997 05:00:00 GMT
pc-firewall-alert.ga.js
u.heatmap.it/conf/ 		43 B
291 B 		Script
General
Check archive.org
Download Go to
Full URL
https://u.heatmap.it/conf/pc-firewall-alert.ga.js
Requested by
Host: u.heatmap.it
URL: https://u.heatmap.it/log.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
46.105.202.39 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
/
Resource Hash
012e8c4dc15ef8dfd1f031e3ee202c2acef4789b6c88d35d9417467b16e5f443

Request headers

Referer
https://pc-firewall-alert.ga/LaBlanca-X-78558/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 08 Jul 2020 15:56:17 GMT
content-encoding
br
x-cacheable
Cacheable
x-cdn-pop-ip
137.74.120.32/27
content-type
text/javascript;charset=UTF-8
status
200
cache-control
max-age=60
x-cdn-pop
sbg
accept-ranges
bytes
x-request-id
273679243
expires
Wed, 08 Jul 2020 16:01:17 GMT
/
www.woopra.com/track/ce/ 		67 B
337 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.woopra.com/track/ce/?project=pc-firewall-alert.ga&instance=woopra&meta=&screen=1600x1200&language=en-US&app=js-client&referer=https%3A%2F%2Fpc-firewall-alert.ga%2F&cookie=6wd592ZfFZ7A&event=pv&ce_url=%2FLaBlanca-X-78558%2F&ce_title=Apple%20Support%20-%20Call%20Now&ce_domain=pc-firewall-alert.ga&ce_uri=https%3A%2F%2Fpc-firewall-alert.ga%2FLaBlanca-X-78558%2F%23forward&ce_hash=%23forward
Requested by
Host: static.woopra.com
URL: https://static.woopra.com/js/w.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
46.4.89.108 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
Software
Jetty(9.4.9.v20180320) /
Resource Hash
3e99b129ea61e1f4763a0010353b8b9421c810d6dcf7d85fac4908e78051ec4d

Request headers

Referer
https://pc-firewall-alert.ga/LaBlanca-X-78558/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 08 Jul 2020 15:56:17 GMT
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
server
Jetty(9.4.9.v20180320)
connection
close
content-length
67
content-type
text/javascript; charset=utf-8
/
api-js.mixpanel.com/decide/ 		65 B
330 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://api-js.mixpanel.com/decide/?verbose=1&version=1&lib=web&token=cb0ef3e7b5d4e3e487a8f15377c2ae51&ip=1&_=1594223777286
Requested by
Host: cdn4.mxpnl.com
URL: https://cdn4.mxpnl.com/libs/mixpanel-2-latest.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
130.211.34.183 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
gunicorn/19.9.0 /
Resource Hash
5fcb16854bcf34558fc9100ea313b2f61a3394ca23e65719553f09c902b2476e

Request headers

Referer
https://pc-firewall-alert.ga/LaBlanca-X-78558/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 08 Jul 2020 15:56:17 GMT
via
1.1 google
server
gunicorn/19.9.0
access-control-allow-headers
X-Requested-With
status
200
access-control-max-age
1728000
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/json
access-control-allow-origin
https://pc-firewall-alert.ga
cache-control
no-cache, no-store
access-control-allow-credentials
true
alt-svc
clear
pv
eu6.heatmap.it/log/ 		0
212 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eu6.heatmap.it/log/pv?pid=93239&u=https%3A%2F%2Fpc-firewall-alert.ga%2FLaBlanca-X-78558%2F&tpl=.&pt=Apple%20Support%20-%20Call%20Now&t=66645&fr=pc-firewall-alert.ga
Requested by
Host: pc-firewall-alert.ga
URL: https://pc-firewall-alert.ga/LaBlanca-X-78558/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
149.202.74.47 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://pc-firewall-alert.ga/LaBlanca-X-78558/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 08 Jul 2020 15:56:17 GMT
Cache-Control
no-cache
Server
nginx
Connection
keep-alive
Content-Type
image/gif
Content-Length
0
Expires
Wed, 08 Jul 2020 15:56:16 GMT
in.php
in.getclicky.com/ 		63 B
371 B 		Script
General
Check archive.org
Download Go to
Full URL
https://in.getclicky.com/in.php?site_id=101265583&type=pageview&href=%2FLaBlanca-X-78558%2F&title=Apple%20Support%20-%20Call%20Now&res=1600x1200&lang=en&jsuid=1602225770&mime=js&x=0.2689050484213722
Requested by
Host: static.getclicky.com
URL: https://static.getclicky.com/js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
198.145.13.11 , United States, ASN2044 (IINET-2044, US),
Reverse DNS
Software
nginx /
Resource Hash
e8fcafd195a7011a3e97d38dda374640b3fd2c63da37bc88ef5425bbb985beca

Request headers

Referer
https://pc-firewall-alert.ga/LaBlanca-X-78558/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 08 Jul 2020 15:56:17 GMT
content-encoding
gzip
server
nginx
status
200
vary
Accept-Encoding, Accept-Encoding
content-type
text/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
no-cache, must-revalidate, post-check=0, pre-check=0
expires
Mon, 26 Jul 1997 05:00:00 GMT
/
www.woopra.com/track/ping/ 		21 B
291 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.woopra.com/track/ping/?project=pc-firewall-alert.ga&instance=woopra&meta=&screen=1600x1200&language=en-US&app=js-client&referer=https%3A%2F%2Fpc-firewall-alert.ga%2F&cookie=6wd592ZfFZ7A
Requested by
Host: static.woopra.com
URL: https://static.woopra.com/js/w.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
46.4.89.108 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
Software
Jetty(9.4.9.v20180320) /
Resource Hash
165ae275d12728abb8e83af307618f67a75f518f6e61affe70a8bc5898439747

Request headers

Referer
https://pc-firewall-alert.ga/LaBlanca-X-78558/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 08 Jul 2020 15:56:29 GMT
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
server
Jetty(9.4.9.v20180320)
connection
close
content-length
21
content-type
text/javascript; charset=utf-8

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Apple Software Update (Online) Tech Support Scam (Consumer)

56 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| test function| catchControlKeys function| docReady function| goodbye function| getURLParameter string| gourl function| $ function| jQuery function| move function| pop function| PopIt function| UnPopIt number| idleTime function| timerIncrement string| stroka boolean| is_chrome undefined| isChromium string| vendorName boolean| isOpera function| alertCall function| alertTimed function| alertLoop function| addEvent function| toggleFullScreen function| ajay function| openMultipleTabs function| poponload string| link_redirect undefined| ignoreHashChange object| w object| m object| td function| countdown function| nocontextmenu function| norightclick number| sc_project number| sc_invisible string| sc_security number| sc_https object| clicky_site_ids object| _w object| woopra object| mixpanel object| clicky_obj object| clicky object| clicky_custom object| _genericStats object| _genericStatsCustom function| _statcounter object| values object| heatmap function| WoopraTracker function| WoopraLoadScript object| woopraTracker number| nmins number| nsecs

6 Cookies

Domain/Path Name / Value
.pc-firewall-alert.ga/ Name: _jsuid
Value: 1602225770
.pc-firewall-alert.ga/ Name: sc_is_visitor_unique
Value: rx12354563.1594223777.160995CF35AC4F262278D99BAFE3AFBA.1.1.1.1.1.1.1.1.1
.pc-firewall-alert.ga/ Name: _first_pageview
Value: 1
.pc-firewall-alert.ga/ Name: mp_cb0ef3e7b5d4e3e487a8f15377c2ae51_mixpanel
Value: %7B%22distinct_id%22%3A%20%221732f245603942-07bed1a9eaef59-1b396256-1d4c00-1732f24560478f%22%2C%22%24device_id%22%3A%20%221732f245603942-07bed1a9eaef59-1b396256-1d4c00-1732f24560478f%22%2C%22%24initial_referrer%22%3A%20%22https%3A%2F%2Fpc-firewall-alert.ga%2F%22%2C%22%24initial_referring_domain%22%3A%20%22pc-firewall-alert.ga%22%7D
.pc-firewall-alert.ga/ Name: wooTracker
Value: 6wd592ZfFZ7A
.pc-firewall-alert.ga/ Name: __cfduid
Value: dad674aacc1ccc4655a1723afa085d3141594223775

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api-js.mixpanel.com
c.statcounter.com
cdn4.mxpnl.com
eu6.heatmap.it
in.getclicky.com
pc-firewall-alert.ga
static.getclicky.com
static.woopra.com
u.heatmap.it
www.statcounter.com
www.woopra.com
104.22.53.65
130.211.34.183
149.202.74.47
198.145.13.11
2606:4700:3035::681b:ac16
2606:4700::6810:dd1d
35.186.235.23
46.105.202.39
46.4.89.108
93.184.220.20
012e8c4dc15ef8dfd1f031e3ee202c2acef4789b6c88d35d9417467b16e5f443
0564d20c6662fa83c89b22ef3e1185cede3d6e4dfbc1525e936930e8ea58fb13
0589be7715d2320e559eae6bd26f3528e97450c70293da2e1e8ce45f77f99ab1
165ae275d12728abb8e83af307618f67a75f518f6e61affe70a8bc5898439747
3c29235c7537fb21c1de7b20aec0870b95532cdc39b60a00d45a72c2a7fb2376
3d520d6c4219bd80b31b9607f51622a3b2980eac46e149216ed5348cc7d74855
3e99b129ea61e1f4763a0010353b8b9421c810d6dcf7d85fac4908e78051ec4d
53181878e809f02b06009c518c38027acdd87ce41fa60958f13c2a596b001ff9
5fcb16854bcf34558fc9100ea313b2f61a3394ca23e65719553f09c902b2476e
79c79d9039382cd34e2e9aa463f85c160d3890c688941fc6837cc2cf81919643
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
aa431faef57d16ba7ce8a754eb1f670b6204a479a663c4a6ab89d7d3fe440354
ad2e9d818a624183e056f9a6aae4d99852ab74d5cd9d43e0ca243ecbe7762ece
d3955cb7e0a908bbcf029cfcc3083d0df02bd70084c41442736e1b3d03fada8b
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e6e7da65e2749bc2567b71e675f0ce7788700dfbea19c0d96dbe76187e983c97
e8fcafd195a7011a3e97d38dda374640b3fd2c63da37bc88ef5425bbb985beca