www-micros0fteam.livewireremote.com Open in urlscan Pro
23.227.202.190 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://teva45986.arenabet168.org/click/PvqDq929BSx_A_D_M1n_a.php
Effective URL:
https://www-micros0fteam.livewireremote.com/?nxxx&qrc=%3E%EF%BF%BD%EF%BF%BD%EF%BF%BD%DD%BD%05,@%0C%EF%BF%BDgj%EF%BF%BDi
Submission Tags: threatshare
Submission: On March 15 via api (March 15th 2023, 6:00:23 pm UTC) from GB — Scanned from SG

Summary HTTP 2 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 3 domains to perform 2 HTTP transactions. The main IP is 23.227.202.190, located in Tampa, United States and belongs to HVC-AS, US. The main domain is www-micros0fteam.livewireremote.com.
TLS certificate: Issued by R3 on March 14th 2023. Valid for: 3 months.

This is the only time www-micros0fteam.livewireremote.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	180.210.207.159 180.210.207.159	45634 (SPARKSTAT...) (SPARKSTATION-SG-AP 10 Science Park Road)
1 1	107.174.202.144 107.174.202.144	36352 (AS-COLOCR...) (AS-COLOCROSSING)
1	23.227.202.190 23.227.202.190	29802 (HVC-AS) (HVC-AS)
2	2

1 180.210.207.159 (Singapore)

ASN45634 (SPARKSTATION-SG-AP 10 Science Park Road, SG)

teva45986.arenabet168.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 107.174.202.144 (United States) 1 redirects

ASN36352 (AS-COLOCROSSING, US)
PTR: 107-174-202-144-host.colocrossing.com

win88.ernestoherrera.cl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.227.202.190 (Tampa, United States)

ASN29802 (HVC-AS, US)
PTR: 23-227-202-190.static.hvvc.us

www-micros0fteam.livewireremote.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
1	livewireremote.com www-micros0fteam.livewireremote.com	663 B
1	ernestoherrera.cl 1 redirects win88.ernestoherrera.cl	268 B
1	arenabet168.org teva45986.arenabet168.org	477 B
2	3

	Domain	Requested by
1	www-micros0fteam.livewireremote.com	teva45986.arenabet168.org
1	win88.ernestoherrera.cl	1 redirects
1	teva45986.arenabet168.org
2	3

This site contains no links.

Subject Issuer	Validity	Valid
*.arenabet168.org R3	`2023-03-07` - `2023-06-05`	3 months	crt.sh
www-micros0fteam.livewireremote.com R3	`2023-03-14` - `2023-06-12`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://www-micros0fteam.livewireremote.com/?nxxx&qrc=%3E%EF%BF%BD%EF%BF%BD%EF%BF%BD%DD%BD%05,@%0C%EF%BF%BDgj%EF%BF%BDi
Frame ID: 8655B4E441A85E2A9D44FA05BC60FE65
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://teva45986.arenabet168.org/click/PvqDq929BSx_A_D_M1n_a.php Page URL
http://win88.ernestoherrera.cl:2000/P2U9===$%3E%EF%BF%BD%EF%BF%BD%EF%BF%BD%DD%BD%05,@%0C%EF%BF%BDgj%EF%BF%BDi HTTP 301
https://www-micros0fteam.livewireremote.com/?nxxx&qrc=%3E%EF%BF%BD%EF%BF%BD%EF%BF%BD%DD%BD%05,@%0C%EF%BF%BDgj%EF%BF%BDi Page URL

Page Statistics

2
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

2
IPs

2
Countries

1 kB
Transfer

1 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://teva45986.arenabet168.org/click/PvqDq929BSx_A_D_M1n_a.php Page URL
http://win88.ernestoherrera.cl:2000/P2U9===$%3E%EF%BF%BD%EF%BF%BD%EF%BF%BD%DD%BD%05,@%0C%EF%BF%BDgj%EF%BF%BDi HTTP 301
https://www-micros0fteam.livewireremote.com/?nxxx&qrc=%3E%EF%BF%BD%EF%BF%BD%EF%BF%BD%DD%BD%05,@%0C%EF%BF%BDgj%EF%BF%BDi Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

2 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	PvqDq929BSx_A_D_M1n_a.php teva45986.arenabet168.org/click/	125 B 477 B	361ms 48ms	Document text/html	180.210.207.159 SPARKSTATION-SG-A...
General Check archive.org Show headers Download Go to Full URL https://teva45986.arenabet168.org/click/PvqDq929BSx_A_D_M1n_a.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 180.210.207.159 , Singapore, ASN45634 (SPARKSTATION-SG-AP 10 Science Park Road, SG), Reverse DNS Software LiteSpeed / Resource Hash Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 accept-language zh-SG,zh;q=0.9 Response headers alt-svc quic=":443"; ma=2592000; v="43,46", h3-Q043=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-25=":443"; ma=2592000, h3-27=":443"; ma=2592000 cache-control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 content-encoding br content-length 106 content-type text/html; charset=UTF-8 date Wed, 15 Mar 2023 17:40:07 GMT expires Thu, 19 Nov 1981 08:52:00 GMT pragma no-cache server LiteSpeed vary Accept-Encoding
GET H/1.1	500 Internal Server Error	Primary Request / Show response www-micros0fteam.livewireremote.com/ Redirect Chain http://win88.ernestoherrera.cl:2000/P2U9===$%3E%EF%BF%BD%EF%BF%BD%EF%BF%BD%DD%BD%05,@%0C%EF%BF%BDgj%EF%BF%BDi https://www-micros0fteam.livewireremote.com/?nxxx&qrc=%3E%EF%BF%BD%EF%BF%BD%EF%BF%BD%DD%BD%05,@%0C%EF%BF%BDgj%EF%BF%BDi	495 B 663 B	1015ms 225ms	Document text/plain	23.227.202.190 HVC-AS
General Check archive.org Show headers Download Go to Full URL https://www-micros0fteam.livewireremote.com/?nxxx&qrc=%3E%EF%BF%BD%EF%BF%BD%EF%BF%BD%DD%BD%05,@%0C%EF%BF%BDgj%EF%BF%BDi Requested by Host: teva45986.arenabet168.org URL: https://teva45986.arenabet168.org/click/PvqDq929BSx_A_D_M1n_a.php Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 23.227.202.190 Tampa, United States, ASN29802 (HVC-AS, US), Reverse DNS 23-227-202-190.static.hvvc.us Software / Resource Hash `95356ffb7069deacad89f50b8939c217bbc176bdb1c2f93fb81eb777d73107e4` Request headers Referer https://teva45986.arenabet168.org/click/PvqDq929BSx_A_D_M1n_a.php Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 accept-language zh-SG,zh;q=0.9 Response headers Connection keep-alive Date Wed, 15 Mar 2023 18:00:18 GMT Keep-Alive timeout=5 Transfer-Encoding chunked Redirect headers Connection keep-alive Content-Length 0 Date Wed, 15 Mar 2023 18:00:17 GMT X-Powered-By Express location https://www-micros0fteam.livewireremote.com/?nxxx&qrc=%3E%EF%BF%BD%EF%BF%BD%EF%BF%BD%DD%BD%05,@%0C%EF%BF%BDgj%EF%BF%BDi

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			teva45986.arenabet168.org/	1969-12-31 23:59:59	Name: PHPSESSID Value: 909f14d243kesgej3h8fu6iia6

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://www-micros0fteam.livewireremote.com/?nxxx&qrc=%3E%EF%BF%BD%EF%BF%BD%EF%BF%BD%DD%BD%05,@%0C%EF%BF%BDgj%EF%BF%BDi Message: Failed to load resource: the server responded with a status of 500 (Internal Server Error)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

teva45986.arenabet168.org
win88.ernestoherrera.cl
www-micros0fteam.livewireremote.com
107.174.202.144
180.210.207.159
23.227.202.190
95356ffb7069deacad89f50b8939c217bbc176bdb1c2f93fb81eb777d73107e4

www-micros0fteam.livewireremote.com Open in urlscan Pro 23.227.202.190 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Page Statistics

2 Requests

100 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

2 IPs

2 Countries

1 kBTransfer

1 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

2 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

1 Cookies

1 Console Messages

Indicators

www-micros0fteam.livewireremote.com Open in urlscan Pro
23.227.202.190 Public Scan

Screenshot
Live screenshot

Full Image

2
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

2
IPs

2
Countries

1 kB
Transfer

1 kB
Size

1
Cookies

2 HTTP transactions
0 data transactions