heiipmicros.info
Open in
urlscan Pro
166.62.73.64
Malicious Activity!
Public Scan
URL:
http://heiipmicros.info/micr/chrx-np/
Submission: On September 30 via manual from BG
Submission: On September 30 via manual from BG
Summary
This website contacted 3 IPs
in 2 countries
across 3 domains to perform 14 HTTP transactions.
The main IP is 166.62.73.64, located in
Scottsdale, United States and
belongs to AS-26496-GO-DADDY-COM-LLC, US.
The main domain is heiipmicros.info.
This is the only time heiipmicros.info was scanned on urlscan.io!
This is the only time heiipmicros.info was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Tech Support Scam (Consumer) Generic (Online)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 13 | 166.62.73.64 166.62.73.64 | 26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC) | |
| 1 | 2001:4de0:ac1... 2001:4de0:ac19::1:b:2a | 20446 (HIGHWINDS3) (HIGHWINDS3) | |
| 14 | 3 |
13
166.62.73.64
(Scottsdale, United States)
ASN26496 (AS-26496-GO-DADDY-COM-LLC, US)
PTR: ip-166-62-73-64.ip.secureserver.net
ASN26496 (AS-26496-GO-DADDY-COM-LLC, US)
PTR: ip-166-62-73-64.ip.secureserver.net
| heiipmicros.info |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 13 |
heiipmicros.info
heiipmicros.info |
287 KB |
| 1 |
jquery.com
code.jquery.com |
30 KB |
| 0 |
Failed
function sub() { [native code] }. Failed |
|
| 14 | 3 |
| Domain | Requested by | |
|---|---|---|
| 13 | heiipmicros.info |
heiipmicros.info
|
| 1 | code.jquery.com |
heiipmicros.info
|
| 0 | truncated Failed |
heiipmicros.info
|
| 14 | 3 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| jquery.org COMODO RSA Domain Validation Secure Server CA |
2018-10-17 - 2020-10-16 |
2 years | crt.sh |
This page contains 2 frames:
Primary Page:
http://heiipmicros.info/micr/chrx-np/
Frame ID: B224DC52728E3D072F9CE844CD16C501
Requests: 15 HTTP requests in this frame
Frame:
http://heiipmicros.info/micr/chrx-np/beep.mp3
Frame ID: B80E0CB46CD2411643CCC61FC4C15B18
Requests: 1 HTTP requests in this frame
Screenshot
Detected technologies
Bootstrap
(Web Frameworks)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i
Apache
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- script /jquery[.-]([\d.]*\d)[^/]*\.js/i
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
14 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
/
heiipmicros.info/micr/chrx-np/ |
143 KB 80 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bootstrap.min.css
heiipmicros.info/micr/chrx-np/ |
119 KB 20 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bootstrap.min.js
heiipmicros.info/micr/chrx-np/ |
36 KB 10 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
alert.css
heiipmicros.info/micr/chrx-np/ |
3 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery-3.js
heiipmicros.info/micr/chrx-np/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery-3.2.1.min.js
code.jquery.com/ |
85 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
microsoft.png
heiipmicros.info/micr/chrx-np/ |
8 KB 9 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
def.gif
heiipmicros.info/micr/chrx-np/ |
166 KB 166 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
x.png
heiipmicros.info/micr/chrx-np/ |
628 B 896 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery-3.js
heiipmicros.info/micr/chrx-np/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
truncated
/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
239 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
Funk.ogg
heiipmicros.info/micr/chrx-np/ |
0 0 |
Media
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
err.mp3
heiipmicros.info/micr/chrx-np/ |
0 0 |
Media
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
beep.mp3
heiipmicros.info/micr/chrx-np/ |
0 0 |
Media
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
beep.mp3
heiipmicros.info/micr/chrx-np/ Frame B80E |
315 B 507 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- truncated
- URL
- data:truncated
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Tech Support Scam (Consumer) Generic (Online)34 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| trustedTypes function| getURLParameter string| gourl function| move function| pop function| PopIt function| UnPopIt function| $ function| jQuery string| stroka function| toggleFullScreen number| idleTime function| timerIncrement boolean| is_chrome undefined| isChromium string| vendorName boolean| isOpera function| alertCall function| alertTimed function| alertLoop function| addEvent function| ajay function| openMultipleTabs function| poponload string| link_redirect undefined| ignoreHashChange object| msgAudioEl number| playMsgInt function| nocontextmenu function| norightclick function| reloadIFrame object| modal object| btn object| span0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
code.jquery.com
heiipmicros.info
truncated
truncated
166.62.73.64
2001:4de0:ac19::1:b:2a
2cfe1662f91c6d34fb14bdd4b502f64ea0c6eaea5bb10ade310da51cf187b8b1
35872af4a794ff3d791b41c4eb58879f4a382d634c7668cd6a5ff42d947c6eb2
5c8450e11602890fa79b9e1ba51e93305115192651b9da05b32a6cb0aaacd65c
80cbc41c1a530eeb197217238124801000ff39d1ce583d1d5ebd497a061cc350
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
abbb8724a9c69848de604e65aad7a5f6ae3fd7ef2c071b84b41b9cabfabbf2a4
b3a3a1066a9857409123d91b75148a0f6b0e2c1abfa53da652a1828b9105450c
bd08b9849632e73574f62ca80572a17f9bbd9bb1010fe8c6380e641460abd96c
d1b1c21d40b064f5901ac09ad5b6e7ca7026e13d7e2390dcadf655e1ec061597
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3