scanner-3071.win
Open in
urlscan Pro
2606:4700:30::681b:988d
Malicious Activity!
Public Scan
Submission: On May 06 via manual from US
Summary
This is the only time scanner-3071.win was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft Defender (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
3 | 2606:4700:30:... 2606:4700:30::681b:988d | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
4 | 2606:4700:30:... 2606:4700:30::681b:998d | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
1 | 46.105.201.240 46.105.201.240 | 16276 (OVH) (OVH) | |
1 | 198.27.67.211 198.27.67.211 | 16276 (OVH) (OVH) | |
9 | 5 |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
scanner-3071.win |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
scanner-3071.win |
ASN16276 (OVH, FR)
PTR: ns510716.ip-198-27-67.net
s4.histats.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
scanner-3071.win
scanner-3071.win |
194 KB |
2 |
histats.com
s10.histats.com s4.histats.com |
5 KB |
9 | 2 |
Domain | Requested by | |
---|---|---|
7 | scanner-3071.win |
scanner-3071.win
|
1 | s4.histats.com |
s10.histats.com
|
1 | s10.histats.com |
scanner-3071.win
|
9 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid |
---|
This page contains 2 frames:
Primary Page:
http://scanner-3071.win/en/
Frame ID: F9E37388475B010E9686B1A46348ECC2
Requests: 8 HTTP requests in this frame
Frame:
http://scanner-3071.win/en/warning.mp3
Frame ID: EC4E8D0ABBCD40D66C246FC14D759794
Requests: 13 HTTP requests in this frame
Screenshot
Detected technologies
CloudFlare (CDN) ExpandDetected patterns
- headers server /cloudflare/i
Twitter Bootstrap () Expand
Detected patterns
- html /<link[^>]+?href="[^"]+bootstrap(?:\.min)?\.css/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
9 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
Cookie set
/
scanner-3071.win/en/ |
11 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bootstrap.css
scanner-3071.win/en/index_files/ |
118 KB 20 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
style.css
scanner-3071.win/en/index_files/ |
23 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
alert.css
scanner-3071.win/en/index_files/ |
3 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
windows.png
scanner-3071.win/en/index_files/ |
2 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
68 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
js15_as.js
s10.histats.com/ |
11 KB 5 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
warning.mp3
scanner-3071.win/en/ Frame EC4E |
14 KB 0 |
Document
audio/mpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame EC4E |
2 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame EC4E |
715 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame EC4E |
178 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame EC4E |
299 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame EC4E |
243 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame EC4E |
381 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
warning.mp3
scanner-3071.win/en/ Frame EC4E |
161 KB 161 KB |
Media
audio/mpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
0.php
s4.histats.com/stats/ |
48 B 319 B |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame EC4E |
547 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame EC4E |
552 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame EC4E |
195 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame EC4E |
242 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame EC4E |
364 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft Defender (Consumer)25 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask function| toggleFullScreen string| subid string| clickid string| postback boolean| cl boolean| isFullScreen function| kzogExQSrDChY4Iq function| setCookie function| hTRnKeAy1lgYB4La function| gpAkSJDl9ENT5gLQ function| hCPNapvlhFicLoDm function| hxvw7JrbMUZBqVhN function| f5WOxk2dF74GMRLf function| dsfsf function| addEvent function| removeEvent object| _Hasync function| chfh function| chfh2 string| _HST_cntval object| Histats object| _HistatsCounterGraphics_0_setValues8 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
scanner-3071.win/ | Name: HstCnv4023616 Value: 1 |
|
scanner-3071.win/ | Name: HstPt4023616 Value: 1 |
|
scanner-3071.win/ | Name: HstCmu4023616 Value: 1557185569771 |
|
scanner-3071.win/ | Name: HstPn4023616 Value: 1 |
|
scanner-3071.win/ | Name: HstCfa4023616 Value: 1557185569771 |
|
scanner-3071.win/ | Name: HstCla4023616 Value: 1557185569771 |
|
scanner-3071.win/ | Name: HstCns4023616 Value: 1 |
|
.scanner-3071.win/ | Name: __cfduid Value: da44b7fd07a6f41dc8c4438d8d82c1cb81557185569 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
s10.histats.com
s4.histats.com
scanner-3071.win
198.27.67.211
2606:4700:30::681b:988d
2606:4700:30::681b:998d
46.105.201.240
1f730c8b78091c3479abc2fb805b9093138f05acd0de421b8da96389cbbb9668
223dbeaf95c21e29aad42c8656d9ad41dbe9497df36c95118158609625d95c53
3ee0806e69f2ae70a2267a58ac5fc5d52b5aa7aca6f3c0c08adad605fd8fbc16
4ac0dc6db4035706a64bc070d10945b2f5ba37ea3459c330351f43fc4886428e
5a3f1dd74233f605e511f1b5b244bedf85ac88ba264caf4d6401bc7ec2017dcd
62f3f809487194fcc55a3ebd88811a604ae496027bb425d4ebd15d9ae1921945
63271dcce1a2518271ecc2b0bdcc5afc9c5f0968a8635e0f97a4c9747309eb82
63ef318d96b5d0d0ceba6e04a4e622b1158335cdc67c49e27839132c6f655058
6f5fd89dc30e876d179c838ecc69d93b84b52afa22dde42548b7f95eb1ac385d
78dcaaf93c8b138b0d84e81e3a30a31daa07b00d733304977762a2c9636c6b5e
91eb7001a90f9178135eede72f1c8a5300cababa4a078cb59debaa50de4b1788
98b26d722140d37b99ac957bdc9d34318a86d8ea6800b7f8749fb96e74c916fb
9d02d662da8a47fb5fb610b545007507b6017028043dbb63cd09ec897d3b9627
9d2d8043c302d3a9da9277374a53e2285c471d5dc8397885b4931b82771d5cae
9e590c1c5e7601413a44e2c7b8611dab5fb2ee6d6287d3c88bf137465279ef54
a3d5b21692435e785aa0e698356735093bb93f6c2f61410c49761ee2448f7289
df76fb7518b1201acc79262e0dc6c773a85f04c36e0a9ea61994c22fbd97087b
dfa16b4a1e6d34f5d50df7dfc436e91d75ed4454827f530b9b6011402a49cecf
e8c8396c5ab9cd8e6db526222e96aa0d5e6208907a33f8c9032359398e0236b7
eb14baeac955bb11e33cd7fd3fd2f698cf20db1b450325f45ea843b6cdc82366