globally-data495.ml Open in urlscan Pro
2606:4700:3031::681b:a02d Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://globally-data495.ml/Help1001010_get01001.kmo/CHfdfdfdfddfd99900
Effective URL:
https://globally-data495.ml/Help1001010_get01001.kmo/CHfdfdfdfddfd99900/
Submission Tags: 6463436
Submission: On March 23 via api (March 23rd 2020, 2:23:36 am UTC) from GB

Summary HTTP 13 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 13 HTTP transactions. The main IP is 2606:4700:3031::681b:a02d, located in United States and belongs to CLOUDFLARENET, US. The main domain is globally-data495.ml.
TLS certificate: Issued by CloudFlare Inc ECC CA-2 on March 18th 2020. Valid for: 7 months.

This is the only time globally-data495.ml was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Tech Support Scam (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
2 12	2606:4700:303... 2606:4700:3031::681b:a02d	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:825::2008	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:817::200e	15169 (GOOGLE) (GOOGLE)
13	3

12 2606:4700:3031::681b:a02d (United States) 2 redirects

ASN13335 (CLOUDFLARENET, US)

globally-data495.ml	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:825::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:817::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	globally-data495.ml 2 redirects globally-data495.ml	157 KB
2	google-analytics.com www.google-analytics.com	18 KB
1	googletagmanager.com www.googletagmanager.com	28 KB
13	3

	Domain	Requested by
12	globally-data495.ml	2 redirects globally-data495.ml
2	www.google-analytics.com	www.googletagmanager.com globally-data495.ml
1	www.googletagmanager.com	globally-data495.ml
13	3

This site contains no links.

Subject Issuer	Validity	Valid
sni.cloudflaressl.com CloudFlare Inc ECC CA-2	`2020-03-18` - `2020-10-09`	7 months	crt.sh
*.google-analytics.com GTS CA 1O1	`2020-03-03` - `2020-05-26`	3 months	crt.sh
*.google.com GTS CA 1O1	`2020-03-03` - `2020-05-26`	3 months	crt.sh

This page contains 5 frames:

Primary Page: https://globally-data495.ml/Help1001010_get01001.kmo/CHfdfdfdfddfd99900/
Frame ID: 9343383412495AB77D6B25AAA4D33EAB
Requests: 9 HTTP requests in this frame

Frame: https://globally-data495.ml/Help1001010_get01001.kmo/CHfdfdfdfddfd99900/Hdsdsdsdsuewewewew44m.php
Frame ID: 25F9B6665842B3E462C36A09AC65CC83
Requests: 1 HTTP requests in this frame

Frame: https://globally-data495.ml/Help1001010_get01001.kmo/CHfdfdfdfddfd99900/Hdsdsdsdsuewewewew44m.php
Frame ID: CEBE1555468A8FB59E2A71ACA9D68724
Requests: 1 HTTP requests in this frame

Frame: https://globally-data495.ml/Help1001010_get01001.kmo/CHfdfdfdfddfd99900/Hdsdsdsdsuewewewew44m.php
Frame ID: A58AE35B516F6BAA424145199DE44B2D
Requests: 1 HTTP requests in this frame

Frame: https://globally-data495.ml/Help1001010_get01001.kmo/CHfdfdfdfddfd99900/Hdsdsdsdsuewewewew44m.php
Frame ID: 1CADA792A37DAF32846178A54BD61380
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://globally-data495.ml/Help1001010_get01001.kmo/CHfdfdfdfddfd99900 HTTP 301
https://globally-data495.ml/Help1001010_get01001.kmo/CHfdfdfdfddfd99900 HTTP 301
https://globally-data495.ml/Help1001010_get01001.kmo/CHfdfdfdfddfd99900/ Page URL

Detected technologies

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

13
Requests

100 %
HTTPS

100 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

202 kB
Transfer

418 kB
Size

4
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://globally-data495.ml/Help1001010_get01001.kmo/CHfdfdfdfddfd99900 HTTP 301
https://globally-data495.ml/Help1001010_get01001.kmo/CHfdfdfdfddfd99900 HTTP 301
https://globally-data495.ml/Help1001010_get01001.kmo/CHfdfdfdfddfd99900/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
globally-data495.ml/Help1001010_get01001.kmo/CHfdfdfdfddfd99900/
Redirect Chain

http://globally-data495.ml/Help1001010_get01001.kmo/CHfdfdfdfddfd99900
https://globally-data495.ml/Help1001010_get01001.kmo/CHfdfdfdfddfd99900
https://globally-data495.ml/Help1001010_get01001.kmo/CHfdfdfdfddfd99900/

18 KB
5 KB

192ms
192ms

Document
text/html

2606:4700:3031::681b:a02d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://globally-data495.ml/Help1001010_get01001.kmo/CHfdfdfdfddfd99900/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::681b:a02d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7d860e9462c9bda447588ffb6297b95566404b2faf6afcee7b3fe933f02ed2bd

Request headers

:method: GET
:authority: globally-data495.ml
:scheme: https
:path: /Help1001010_get01001.kmo/CHfdfdfdfddfd99900/
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: __cfduid=dc8abdcba6260cf112a62f4834684d2b91584930199
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 200
date: Mon, 23 Mar 2020 02:23:20 GMT
content-type: text/html
vary: Accept-Encoding
last-modified: Fri, 20 Mar 2020 19:56:36 GMT
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 5784b0951c43c277-FRA
content-encoding: br

Redirect headers

status: 301
date: Mon, 23 Mar 2020 02:23:19 GMT
content-type: text/html; charset=iso-8859-1
set-cookie: __cfduid=dc8abdcba6260cf112a62f4834684d2b91584930199; expires=Wed, 22-Apr-20 02:23:19 GMT; path=/; domain=.globally-data495.ml; HttpOnly; SameSite=Lax; Secure
location: https://globally-data495.ml/Help1001010_get01001.kmo/CHfdfdfdfddfd99900/
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 5784b093ca8cc277-FRA

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 75 KB
28 KB 17ms
16ms Script
application/javascript 2a00:1450:4001:825::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-144577619-1

Requested by

Host: globally-data495.ml
URL: https://globally-data495.ml/Help1001010_get01001.kmo/CHfdfdfdfddfd99900/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

4fea4b6e9d86dc6757c53f2feb9b8e79a2ee577140509b2b74bd0c7519770804

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://globally-data495.ml/Help1001010_get01001.kmo/CHfdfdfdfddfd99900/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Mon, 23 Mar 2020 02:23:20 GMT
content-encoding: br
status: 200
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 28650
x-xss-protection: 0
last-modified: Mon, 23 Mar 2020 00:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: http://www.googletagmanager.com
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Mon, 23 Mar 2020 02:23:20 GMT

GET
H2 200 jquery.min.js Show response
globally-data495.ml/Help1001010_get01001.kmo/CHfdfdfdfddfd99900/js/ 95 KB
32 KB 750ms
750ms Script
application/javascript 2606:4700:3031::681b:a02d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://globally-data495.ml/Help1001010_get01001.kmo/CHfdfdfdfddfd99900/js/jquery.min.js
Requested by: Host: globally-data495.ml
URL: https://globally-data495.ml/Help1001010_get01001.kmo/CHfdfdfdfddfd99900/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::681b:a02d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 95914789b5f3307a3718679e867d61b9d4c03f749cd2e2970570331d7d6c8ed9

Request headers

Referer: https://globally-data495.ml/Help1001010_get01001.kmo/CHfdfdfdfddfd99900/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Mon, 23 Mar 2020 02:23:20 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 20 Mar 2020 19:56:41 GMT
server: cloudflare
etag: W/"17bdc-5a14eaf24f11f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: max-age=14400
cf-ray: 5784b096fecdc277-FRA

GET
H2 200 bg-1.jpg
globally-data495.ml/Help1001010_get01001.kmo/CHfdfdfdfddfd99900/img/ 12 KB
12 KB 188ms
187ms Image
image/jpeg 2606:4700:3031::681b:a02d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://globally-data495.ml/Help1001010_get01001.kmo/CHfdfdfdfddfd99900/img/bg-1.jpg
Requested by: Host: globally-data495.ml
URL: https://globally-data495.ml/Help1001010_get01001.kmo/CHfdfdfdfddfd99900/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::681b:a02d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b91c55f5f6c3e7f4868b22a07b618e6800d16fcf292e30f504a7bfe811b867f3

Request headers

Referer: https://globally-data495.ml/Help1001010_get01001.kmo/CHfdfdfdfddfd99900/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 23 Mar 2020 02:23:20 GMT
cf-cache-status: HIT
last-modified: Fri, 20 Mar 2020 19:56:43 GMT
server: cloudflare
etag: "2e5a-5a14eaf4848c8"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/jpeg
status: 200
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 5784b096fecec277-FRA
content-length: 11866

GET
H2 200 bg-3.jpg
globally-data495.ml/Help1001010_get01001.kmo/CHfdfdfdfddfd99900/img/ 3 KB
3 KB 195ms
195ms Image
image/jpeg 2606:4700:3031::681b:a02d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://globally-data495.ml/Help1001010_get01001.kmo/CHfdfdfdfddfd99900/img/bg-3.jpg
Requested by: Host: globally-data495.ml
URL: https://globally-data495.ml/Help1001010_get01001.kmo/CHfdfdfdfddfd99900/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::681b:a02d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e10d4fc1e82baa4008a190b5c4be5f2010da7d3b2fb11c805d10eec5b5fb5842

Request headers

Referer: https://globally-data495.ml/Help1001010_get01001.kmo/CHfdfdfdfddfd99900/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 23 Mar 2020 02:23:20 GMT
cf-cache-status: HIT
last-modified: Fri, 20 Mar 2020 19:56:43 GMT
server: cloudflare
etag: "ac8-5a14eaf41e004"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/jpeg
status: 200
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 5784b0971f09c277-FRA
content-length: 2760

GET
H2 200 2.png
globally-data495.ml/Help1001010_get01001.kmo/CHfdfdfdfddfd99900/ 103 KB
104 KB 202ms
202ms Image
image/png 2606:4700:3031::681b:a02d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://globally-data495.ml/Help1001010_get01001.kmo/CHfdfdfdfddfd99900/2.png
Requested by: Host: globally-data495.ml
URL: https://globally-data495.ml/Help1001010_get01001.kmo/CHfdfdfdfddfd99900/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::681b:a02d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b4b3668bf33e42581f2066ee00028907c6ca3fc3b94d1fab5650e3acf889e6f2

Request headers

Referer: https://globally-data495.ml/Help1001010_get01001.kmo/CHfdfdfdfddfd99900/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Mon, 23 Mar 2020 02:23:20 GMT
cf-cache-status: HIT
last-modified: Fri, 20 Mar 2020 19:56:37 GMT
server: cloudflare
etag: "19d48-5a14eaee3914c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
status: 200
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 5784b0981893c277-FRA
content-length: 105800

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 44 KB
18 KB 5ms
5ms Script
text/javascript 2a00:1450:4001:817::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-144577619-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

eaf1b128b927ac2868755cb7366d35554255c8af362235afe270f9614f8c806d

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://globally-data495.ml/Help1001010_get01001.kmo/CHfdfdfdfddfd99900/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 06 Feb 2020 00:21:02 GMT
server: Golfe2
age: 6285
date: Mon, 23 Mar 2020 00:38:35 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 18174
expires: Mon, 23 Mar 2020 02:38:35 GMT

GET
H2 200 collect
www.google-analytics.com/r/ 35 B
109 B 13ms
13ms Image
image/gif 2a00:1450:4001:817::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/r/collect?v=1&_v=j81&a=107097389&t=pageview&_s=1&dl=https%3A%2F%2Fglobally-data495.ml%2FHelp1001010_get01001.kmo%2FCHfdfdfdfddfd99900%2F&ul=en-us&de=UTF-8&dt=Official%20Microsoft-Windows-Help-and-Services&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAUAB~&jid=662724402&gjid=141826899&cid=663532949.1584930200&tid=UA-144577619-1&_gid=927885351.1584930200&_r=1&gtm=2ou3b2&z=1304940608

Requested by

Host: globally-data495.ml
URL: https://globally-data495.ml/Help1001010_get01001.kmo/CHfdfdfdfddfd99900/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://globally-data495.ml/Help1001010_get01001.kmo/CHfdfdfdfddfd99900/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Mon, 23 Mar 2020 02:23:20 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
access-control-allow-origin: *
content-type: image/gif
status: 200
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 206 err.mp3
globally-data495.ml/Help1001010_get01001.kmo/CHfdfdfdfddfd99900/sound/ 66 KB
0 190ms
190ms Media
audio/mpeg 2606:4700:3031::681b:a02d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://globally-data495.ml/Help1001010_get01001.kmo/CHfdfdfdfddfd99900/sound/err.mp3
Requested by: Host: globally-data495.ml
URL: https://globally-data495.ml/Help1001010_get01001.kmo/CHfdfdfdfddfd99900/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::681b:a02d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Referer: https://globally-data495.ml/Help1001010_get01001.kmo/CHfdfdfdfddfd99900/
Sec-Fetch-Dest: audio
Accept-Encoding: identity;q=1, *;q=0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Range: bytes=0-

Response headers

date: Mon, 23 Mar 2020 02:23:21 GMT
cf-cache-status: DYNAMIC
last-modified: Fri, 20 Mar 2020 19:56:45 GMT
server: cloudflare
etag: "2b4ff-5a14eaf693f03"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
status: 206
content-type: audio/mpeg
Content-Range: bytes 0-177406/177407
accept-ranges: bytes
cf-ray: 5784b09bcd47c277-FRA
Content-Length: 177407

GET
H2 404 Hdsdsdsdsuewewewew44m.php Show response
globally-data495.ml/Help1001010_get01001.kmo/CHfdfdfdfddfd99900/ Frame 25F9 371 B
272 B 202ms
201ms Document
text/html 2606:4700:3031::681b:a02d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://globally-data495.ml/Help1001010_get01001.kmo/CHfdfdfdfddfd99900/Hdsdsdsdsuewewewew44m.php
Requested by: Host: globally-data495.ml
URL: https://globally-data495.ml/Help1001010_get01001.kmo/CHfdfdfdfddfd99900/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::681b:a02d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 35c07c7ddde722dc024a6ee7775398f42f509d00aeda26feedca69b9a77f80c0

Request headers

:method: GET
:authority: globally-data495.ml
:scheme: https
:path: /Help1001010_get01001.kmo/CHfdfdfdfddfd99900/Hdsdsdsdsuewewewew44m.php
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
referer: https://globally-data495.ml/Help1001010_get01001.kmo/CHfdfdfdfddfd99900/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: __cfduid=dc8abdcba6260cf112a62f4834684d2b91584930199; _ga=GA1.2.663532949.1584930200; _gid=GA1.2.927885351.1584930200; _gat_gtag_UA_144577619_1=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://globally-data495.ml/Help1001010_get01001.kmo/CHfdfdfdfddfd99900/

Response headers

status: 404
date: Mon, 23 Mar 2020 02:23:21 GMT
content-type: text/html; charset=iso-8859-1
vary: Accept-Encoding
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 5784b09bcd4cc277-FRA
content-encoding: br

GET
H2 404 Hdsdsdsdsuewewewew44m.php Show response
globally-data495.ml/Help1001010_get01001.kmo/CHfdfdfdfddfd99900/ Frame CEBE 371 B
295 B 181ms
181ms Document
text/html 2606:4700:3031::681b:a02d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://globally-data495.ml/Help1001010_get01001.kmo/CHfdfdfdfddfd99900/Hdsdsdsdsuewewewew44m.php
Requested by: Host: globally-data495.ml
URL: https://globally-data495.ml/Help1001010_get01001.kmo/CHfdfdfdfddfd99900/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::681b:a02d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 35c07c7ddde722dc024a6ee7775398f42f509d00aeda26feedca69b9a77f80c0

Request headers

:method: GET
:authority: globally-data495.ml
:scheme: https
:path: /Help1001010_get01001.kmo/CHfdfdfdfddfd99900/Hdsdsdsdsuewewewew44m.php
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
referer: https://globally-data495.ml/Help1001010_get01001.kmo/CHfdfdfdfddfd99900/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: __cfduid=dc8abdcba6260cf112a62f4834684d2b91584930199; _ga=GA1.2.663532949.1584930200; _gid=GA1.2.927885351.1584930200; _gat_gtag_UA_144577619_1=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://globally-data495.ml/Help1001010_get01001.kmo/CHfdfdfdfddfd99900/

Response headers

status: 404
date: Mon, 23 Mar 2020 02:23:21 GMT
content-type: text/html; charset=iso-8859-1
vary: Accept-Encoding
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 5784b09bdd4fc277-FRA
content-encoding: br

GET
H2 404 Hdsdsdsdsuewewewew44m.php Show response
globally-data495.ml/Help1001010_get01001.kmo/CHfdfdfdfddfd99900/ Frame A58A 371 B
272 B 185ms
185ms Document
text/html 2606:4700:3031::681b:a02d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://globally-data495.ml/Help1001010_get01001.kmo/CHfdfdfdfddfd99900/Hdsdsdsdsuewewewew44m.php
Requested by: Host: globally-data495.ml
URL: https://globally-data495.ml/Help1001010_get01001.kmo/CHfdfdfdfddfd99900/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::681b:a02d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 35c07c7ddde722dc024a6ee7775398f42f509d00aeda26feedca69b9a77f80c0

Request headers

:method: GET
:authority: globally-data495.ml
:scheme: https
:path: /Help1001010_get01001.kmo/CHfdfdfdfddfd99900/Hdsdsdsdsuewewewew44m.php
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
referer: https://globally-data495.ml/Help1001010_get01001.kmo/CHfdfdfdfddfd99900/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: __cfduid=dc8abdcba6260cf112a62f4834684d2b91584930199; _ga=GA1.2.663532949.1584930200; _gid=GA1.2.927885351.1584930200; _gat_gtag_UA_144577619_1=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://globally-data495.ml/Help1001010_get01001.kmo/CHfdfdfdfddfd99900/

Response headers

status: 404
date: Mon, 23 Mar 2020 02:23:21 GMT
content-type: text/html; charset=iso-8859-1
vary: Accept-Encoding
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 5784b09bdd51c277-FRA
content-encoding: br

GET
H2 404 Hdsdsdsdsuewewewew44m.php Show response
globally-data495.ml/Help1001010_get01001.kmo/CHfdfdfdfddfd99900/ Frame 1CAD 371 B
281 B 190ms
190ms Document
text/html 2606:4700:3031::681b:a02d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://globally-data495.ml/Help1001010_get01001.kmo/CHfdfdfdfddfd99900/Hdsdsdsdsuewewewew44m.php
Requested by: Host: globally-data495.ml
URL: https://globally-data495.ml/Help1001010_get01001.kmo/CHfdfdfdfddfd99900/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::681b:a02d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 35c07c7ddde722dc024a6ee7775398f42f509d00aeda26feedca69b9a77f80c0

Request headers

:method: GET
:authority: globally-data495.ml
:scheme: https
:path: /Help1001010_get01001.kmo/CHfdfdfdfddfd99900/Hdsdsdsdsuewewewew44m.php
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
referer: https://globally-data495.ml/Help1001010_get01001.kmo/CHfdfdfdfddfd99900/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: __cfduid=dc8abdcba6260cf112a62f4834684d2b91584930199; _ga=GA1.2.663532949.1584930200; _gid=GA1.2.927885351.1584930200; _gat_gtag_UA_144577619_1=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://globally-data495.ml/Help1001010_get01001.kmo/CHfdfdfdfddfd99900/

Response headers

status: 404
date: Mon, 23 Mar 2020 02:23:21 GMT
content-type: text/html; charset=iso-8859-1
vary: Accept-Encoding
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 5784b09bdd52c277-FRA
content-encoding: br

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Tech Support Scam (Consumer)

30 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.globally-data495.ml/	1970-01-19 08:15:30	Name: _gat_gtag_UA_144577619_1 Value: 1
.globally-data495.ml/	1970-01-19 08:16:56	Name: _gid Value: GA1.2.927885351.1584930200
.globally-data495.ml/	1970-01-20 01:46:42	Name: _ga Value: GA1.2.663532949.1584930200
.globally-data495.ml/	1970-01-19 08:58:42	Name: __cfduid Value: dc8abdcba6260cf112a62f4834684d2b91584930199

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

globally-data495.ml
www.google-analytics.com
www.googletagmanager.com
2606:4700:3031::681b:a02d
2a00:1450:4001:817::200e
2a00:1450:4001:825::2008
35c07c7ddde722dc024a6ee7775398f42f509d00aeda26feedca69b9a77f80c0
4fea4b6e9d86dc6757c53f2feb9b8e79a2ee577140509b2b74bd0c7519770804
7d860e9462c9bda447588ffb6297b95566404b2faf6afcee7b3fe933f02ed2bd
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
95914789b5f3307a3718679e867d61b9d4c03f749cd2e2970570331d7d6c8ed9
b4b3668bf33e42581f2066ee00028907c6ca3fc3b94d1fab5650e3acf889e6f2
b91c55f5f6c3e7f4868b22a07b618e6800d16fcf292e30f504a7bfe811b867f3
e10d4fc1e82baa4008a190b5c4be5f2010da7d3b2fb11c805d10eec5b5fb5842
eaf1b128b927ac2868755cb7366d35554255c8af362235afe270f9614f8c806d

globally-data495.ml Open in urlscan Pro 2606:4700:3031::681b:a02d Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

13 Requests

100 %HTTPS

100 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

202 kBTransfer

418 kBSize

4 Cookies

0 Outgoing links

Page URL History

Redirected requests

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

30 JavaScript Global Variables

4 Cookies

Indicators

globally-data495.ml Open in urlscan Pro
2606:4700:3031::681b:a02d Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

13
Requests

100 %
HTTPS

100 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

202 kB
Transfer

418 kB
Size

4
Cookies

13 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!