dqs18el7f50bs.cloudfront.net Open in urlscan Pro
52.84.31.113  Malicious Activity! Public Scan

URL: https://dqs18el7f50bs.cloudfront.net/?367556795536==raZaxe&rsz=1260340
Submission: On September 20 via manual from US

Summary

This website contacted 8 IPs in 2 countries across 5 domains to perform 16 HTTP transactions. The main IP is 52.84.31.113, located in Seattle, United States and belongs to AMAZON-02 - Amazon.com, Inc., US. The main domain is dqs18el7f50bs.cloudfront.net.
TLS certificate: Issued by Symantec Class 3 Secure Server CA - G4 on October 26th 2016. Valid for: a year.
This is the only time dqs18el7f50bs.cloudfront.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Tech Support Scam (Consumer)

Domain & IP information

IP Address AS Autonomous System
3 52.84.31.113 16509 (AMAZON-02)
2 2a00:1450:400... 15169 (GOOGLE)
1 52.84.31.11 16509 (AMAZON-02)
2 52.84.31.210 16509 (AMAZON-02)
4 2a00:1450:400... 15169 (GOOGLE)
1 52.84.31.190 16509 (AMAZON-02)
2 2a00:1450:400... 15169 (GOOGLE)
16 8
Domain Requested by
7 dqs18el7f50bs.cloudfront.net dqs18el7f50bs.cloudfront.net
4 fonts.gstatic.com dqs18el7f50bs.cloudfront.net
2 www.google-analytics.com dqs18el7f50bs.cloudfront.net
2 fonts.googleapis.com dqs18el7f50bs.cloudfront.net
0 geoapi123.appspot.com Failed dqs18el7f50bs.cloudfront.net
16 5

This site contains no links.

Subject Issuer Validity Valid
*.cloudfront.net
Symantec Class 3 Secure Server CA - G4
2016-10-26 -
2017-12-17
a year crt.sh
*.googleapis.com
Google Internet Authority G2
2017-09-13 -
2017-12-06
3 months crt.sh
*.google.com
Google Internet Authority G2
2017-09-13 -
2017-12-06
3 months crt.sh
*.google-analytics.com
Google Internet Authority G2
2017-09-13 -
2017-12-06
3 months crt.sh

This page contains 1 frames:

Primary Page: https://dqs18el7f50bs.cloudfront.net/?367556795536==raZaxe&rsz=1260340
Frame ID: 31877.1
Requests: 16 HTTP requests in this frame

Screenshot


Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /AmazonS3/i

Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/(?:ga|urchin|(analytics))\.js/i

Overall confidence: 100%
Detected patterns
  • html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i

Page Statistics

16
Requests

94 %
HTTPS

43 %
IPv6

5
Domains

5
Subdomains

8
IPs

2
Countries

595 kB
Transfer

655 kB
Size

3
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

16 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
dqs18el7f50bs.cloudfront.net/
69 KB
69 KB
Document
General
Full URL
https://dqs18el7f50bs.cloudfront.net/?367556795536==raZaxe&rsz=1260340
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.84.31.113 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-52-84-31-113.ewr50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
55dcfbcb75743281e1050935d215ad06a826f41d28b4f7daccf717068a2c6fe3

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36

Response headers

Date
Wed, 20 Sep 2017 03:59:52 GMT
Via
1.1 f542b972205e4ce339fc52e6b515e4b2.cloudfront.net (CloudFront)
Last-Modified
Wed, 20 Sep 2017 03:44:39 GMT
Server
AmazonS3
ETag
"12a151c0b61f72a52651e3bba55cad89"
X-Cache
RefreshHit from cloudfront
Content-Type
text/html
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
70447
X-Amz-Cf-Id
aaYFkaRNr7ElsSI5bSukv3PMeKhp3Ez1ujzAIqYmDr5LVTLasgj7_A==
css
fonts.googleapis.com/
546 B
302 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Titillium+Web:400,700
Requested by
Host: dqs18el7f50bs.cloudfront.net
URL: https://dqs18el7f50bs.cloudfront.net/?367556795536==raZaxe&rsz=1260340
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:816::200a , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
ESF /
Resource Hash
9d48531f76ae7ea19a01d733fe3e1357631ae212af78d5b9c7a5739919537913
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://dqs18el7f50bs.cloudfront.net/?367556795536==raZaxe&rsz=1260340
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36

Response headers

date
Wed, 20 Sep 2017 15:17:19 GMT
content-encoding
gzip
server
ESF
status
200
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="39,38,37,35"
x-xss-protection
1; mode=block
expires
Wed, 20 Sep 2017 15:17:19 GMT
style.css
dqs18el7f50bs.cloudfront.net/files/
2 KB
2 KB
Stylesheet
General
Full URL
https://dqs18el7f50bs.cloudfront.net/files/style.css
Requested by
Host: dqs18el7f50bs.cloudfront.net
URL: https://dqs18el7f50bs.cloudfront.net/?367556795536==raZaxe&rsz=1260340
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.84.31.113 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-52-84-31-113.ewr50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
af799a6513553c4aa0e6c1ba49c34043563b2fbe2ff87708584220908890b982

Request headers

Referer
https://dqs18el7f50bs.cloudfront.net/?367556795536==raZaxe&rsz=1260340
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36

Response headers

Date
Wed, 20 Sep 2017 03:59:52 GMT
Via
1.1 f542b972205e4ce339fc52e6b515e4b2.cloudfront.net (CloudFront)
Last-Modified
Wed, 20 Sep 2017 03:44:38 GMT
Server
AmazonS3
ETag
"ee18825b427f97f1c7fd232626d4fb68"
X-Cache
RefreshHit from cloudfront
Content-Type
text/css
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
2178
X-Amz-Cf-Id
7AJE2lYhTvto3Bj0VnGxh352bMZI9QU0t-BJQIz2TCoE7jfkiJoMuQ==
/
geoapi123.appspot.com/
0
0

background-2.png
dqs18el7f50bs.cloudfront.net/files/
251 KB
251 KB
Image
General
Full URL
https://dqs18el7f50bs.cloudfront.net/files/background-2.png
Requested by
Host: dqs18el7f50bs.cloudfront.net
URL: https://dqs18el7f50bs.cloudfront.net/?367556795536==raZaxe&rsz=1260340
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.84.31.11 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-52-84-31-11.ewr50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
166dedb9f977c9f52f3e1b475e1c19ec9f0559a3c13de1b1da6d6aaf44bff2ea

Request headers

Referer
https://dqs18el7f50bs.cloudfront.net/?367556795536==raZaxe&rsz=1260340
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36

Response headers

Date
Wed, 20 Sep 2017 03:59:52 GMT
Via
1.1 cf50699455d063ab813aee70063811cf.cloudfront.net (CloudFront)
Last-Modified
Wed, 20 Sep 2017 03:44:40 GMT
Server
AmazonS3
ETag
"ecb872795e4e8afc251962a54c26c157"
X-Cache
RefreshHit from cloudfront
Content-Type
application/octet-stream
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
256524
X-Amz-Cf-Id
KgCdZPBXHnku22TYqTsUNS-EXwO-kJEcjFj9jwcfyHNy7smT3xIZKA==
alert.jpg
dqs18el7f50bs.cloudfront.net/files/
37 KB
37 KB
Image
General
Full URL
https://dqs18el7f50bs.cloudfront.net/files/alert.jpg
Requested by
Host: dqs18el7f50bs.cloudfront.net
URL: https://dqs18el7f50bs.cloudfront.net/?367556795536==raZaxe&rsz=1260340
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.84.31.113 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-52-84-31-113.ewr50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
c73175a61d649c35682fbe86a7843ba99bad811cba32cb6e59d50cae3bdf34ca

Request headers

Referer
https://dqs18el7f50bs.cloudfront.net/?367556795536==raZaxe&rsz=1260340
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36

Response headers

Date
Wed, 20 Sep 2017 03:59:52 GMT
Via
1.1 f542b972205e4ce339fc52e6b515e4b2.cloudfront.net (CloudFront)
Last-Modified
Wed, 20 Sep 2017 03:44:39 GMT
Server
AmazonS3
ETag
"f9a46dfbac093c4bbcc1003d76b5a804"
X-Cache
RefreshHit from cloudfront
Content-Type
application/octet-stream
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
38167
X-Amz-Cf-Id
Dc74P3PB8ufdMh5kgdLcRsc4FNmJUwKj3HFw5F4V2kHxSOcR9EFVGQ==
microsoft.png
dqs18el7f50bs.cloudfront.net/files/
977 B
977 B
Image
General
Full URL
https://dqs18el7f50bs.cloudfront.net/files/microsoft.png
Requested by
Host: dqs18el7f50bs.cloudfront.net
URL: https://dqs18el7f50bs.cloudfront.net/?367556795536==raZaxe&rsz=1260340
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.84.31.210 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-52-84-31-210.ewr50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
844a92ee435552f7f26b4ec467220c537841f8245a16bbb265975ce4b3081f36

Request headers

Referer
https://dqs18el7f50bs.cloudfront.net/?367556795536==raZaxe&rsz=1260340
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36

Response headers

Date
Wed, 20 Sep 2017 03:59:52 GMT
Via
1.1 d2732303fd1054eafb760187913561e3.cloudfront.net (CloudFront)
Last-Modified
Wed, 20 Sep 2017 03:44:38 GMT
Server
AmazonS3
ETag
"ab563722ebc08ab73e4c72a3fa0d28c7"
X-Cache
RefreshHit from cloudfront
Content-Type
application/octet-stream
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
977
X-Amz-Cf-Id
18QN3JDiJZTx54E_k7bmiUHqY-kk7miPijkRF-XqMZZCBM0MtK25ZA==
css
fonts.googleapis.com/
779 B
345 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Open+Sans:400,600,700
Requested by
Host: dqs18el7f50bs.cloudfront.net
URL: https://dqs18el7f50bs.cloudfront.net/?367556795536==raZaxe&rsz=1260340
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:816::200a , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
ESF /
Resource Hash
2f2c048f5289f4057f1b6f402a4310ddc6ca553f23033c672b708fe43dfee58e
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://dqs18el7f50bs.cloudfront.net/?367556795536==raZaxe&rsz=1260340
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36

Response headers

date
Wed, 20 Sep 2017 15:17:19 GMT
content-encoding
gzip
server
ESF
status
200
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="39,38,37,35"
x-xss-protection
1; mode=block
expires
Wed, 20 Sep 2017 15:17:19 GMT
MTP_ySUJH_bn48VBG8sNSonF5uFdDttMLvmWuJdhhgs.ttf
fonts.gstatic.com/s/opensans/v14/
27 KB
18 KB
Font
General
Full URL
https://fonts.gstatic.com/s/opensans/v14/MTP_ySUJH_bn48VBG8sNSonF5uFdDttMLvmWuJdhhgs.ttf
Requested by
Host: dqs18el7f50bs.cloudfront.net
URL: https://dqs18el7f50bs.cloudfront.net/?367556795536==raZaxe&rsz=1260340
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:816::2003 , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
sffe /
Resource Hash
7dd58a918046093c157c030be6774b2360d43529e2393f3b665c4727e6e3df61
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36
Referer
https://fonts.googleapis.com/css?family=Open+Sans:400,600,700
Origin
https://dqs18el7f50bs.cloudfront.net

Response headers

date
Mon, 04 Sep 2017 10:35:31 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
1399308
status
200
alt-svc
quic=":443"; ma=2592000; v="39,38,37,35"
content-length
18380
x-xss-protection
1; mode=block
last-modified
Wed, 14 Jun 2017 16:46:35 GMT
server
sffe
vary
Accept-Encoding
content-type
font/ttf
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 04 Sep 2018 10:35:31 GMT
k3k702ZOKiLJc3WVjuplzInF5uFdDttMLvmWuJdhhgs.ttf
fonts.gstatic.com/s/opensans/v14/
27 KB
18 KB
Font
General
Full URL
https://fonts.gstatic.com/s/opensans/v14/k3k702ZOKiLJc3WVjuplzInF5uFdDttMLvmWuJdhhgs.ttf
Requested by
Host: dqs18el7f50bs.cloudfront.net
URL: https://dqs18el7f50bs.cloudfront.net/?367556795536==raZaxe&rsz=1260340
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:816::2003 , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
sffe /
Resource Hash
f8f7011da51c1d4c55a123107fa854c1750daff3c8dcc3331e0c0633727c797d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36
Referer
https://fonts.googleapis.com/css?family=Open+Sans:400,600,700
Origin
https://dqs18el7f50bs.cloudfront.net

Response headers

date
Mon, 04 Sep 2017 17:03:29 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
1376030
status
200
alt-svc
quic=":443"; ma=2592000; v="39,38,37,35"
content-length
18604
x-xss-protection
1; mode=block
last-modified
Wed, 14 Jun 2017 16:46:24 GMT
server
sffe
vary
Accept-Encoding
content-type
font/ttf
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 04 Sep 2018 17:03:29 GMT
7XUFZ5tgS-tD6QamInJTcU3KvHLhcNjEHFQzwNtdMQY.ttf
fonts.gstatic.com/s/titilliumweb/v5/
27 KB
16 KB
Font
General
Full URL
https://fonts.gstatic.com/s/titilliumweb/v5/7XUFZ5tgS-tD6QamInJTcU3KvHLhcNjEHFQzwNtdMQY.ttf
Requested by
Host: dqs18el7f50bs.cloudfront.net
URL: https://dqs18el7f50bs.cloudfront.net/?367556795536==raZaxe&rsz=1260340
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:816::2003 , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
sffe /
Resource Hash
4a448f9dd31a321475a6572bf431cbb41844dee9838f135c5a6e9abef0adda3a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36
Referer
https://fonts.googleapis.com/css?family=Titillium+Web:400,700
Origin
https://dqs18el7f50bs.cloudfront.net

Response headers

date
Mon, 04 Sep 2017 10:37:07 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
1399212
status
200
alt-svc
quic=":443"; ma=2592000; v="39,38,37,35"
content-length
16680
x-xss-protection
1; mode=block
last-modified
Tue, 16 May 2017 22:23:38 GMT
server
sffe
vary
Accept-Encoding
content-type
font/ttf
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 04 Sep 2018 10:37:07 GMT
alertmicrosoft.mp3
dqs18el7f50bs.cloudfront.net/files/
140 KB
140 KB
Media
General
Full URL
https://dqs18el7f50bs.cloudfront.net/files/alertmicrosoft.mp3
Requested by
Host: dqs18el7f50bs.cloudfront.net
URL: https://dqs18el7f50bs.cloudfront.net/?367556795536==raZaxe&rsz=1260340
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.84.31.210 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-52-84-31-210.ewr50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
8dd75a13c2b410a988bccc7e5cbd38291e79d7f1f0c6f715109c8f66129edae4

Request headers

Referer
https://dqs18el7f50bs.cloudfront.net/?367556795536==raZaxe&rsz=1260340
Accept-Encoding
identity;q=1, *;q=0
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36
Range
bytes=0-
chrome-proxy
frfr

Response headers

Date
Wed, 20 Sep 2017 04:07:25 GMT
Via
1.1 d2732303fd1054eafb760187913561e3.cloudfront.net (CloudFront)
Last-Modified
Wed, 20 Sep 2017 03:44:40 GMT
Server
AmazonS3
ETag
"6ed16685648cc6c15a7da8263543a65c"
X-Cache
RefreshHit from cloudfront
Content-Type
binary/octet-stream
Content-Range
bytes 0-143452/143453
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
143453
X-Amz-Cf-Id
Il4E9FCPfEefVfR2z0RDap9GISrwMumyEay883j96O7F43kFKsooIw==
warning.mp3
dqs18el7f50bs.cloudfront.net/files/
13 KB
13 KB
Media
General
Full URL
https://dqs18el7f50bs.cloudfront.net/files/warning.mp3
Requested by
Host: dqs18el7f50bs.cloudfront.net
URL: https://dqs18el7f50bs.cloudfront.net/?367556795536==raZaxe&rsz=1260340
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.84.31.190 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-52-84-31-190.ewr50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
f4d5cae00178437f63e868ded066dde7503207230142ab3c37ef8ca70a03574d

Request headers

Referer
https://dqs18el7f50bs.cloudfront.net/?367556795536==raZaxe&rsz=1260340
Accept-Encoding
identity;q=1, *;q=0
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36
Range
bytes=0-
chrome-proxy
frfr

Response headers

Date
Wed, 20 Sep 2017 04:07:40 GMT
Via
1.1 7784648d4cd8093712670c85a22e6c54.cloudfront.net (CloudFront)
Last-Modified
Wed, 20 Sep 2017 03:44:38 GMT
Server
AmazonS3
ETag
"00b0b7579d355157c552145ce7720cb2"
X-Cache
RefreshHit from cloudfront
Content-Type
binary/octet-stream
Content-Range
bytes 0-13668/13669
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
13669
X-Amz-Cf-Id
8ISBkNkJlZsQK2yBu_1sozK4-jjDqFR90OXszC3Sw6HK-TsBzKTmKg==
analytics.js
www.google-analytics.com/
33 KB
13 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: dqs18el7f50bs.cloudfront.net
URL: https://dqs18el7f50bs.cloudfront.net/?367556795536==raZaxe&rsz=1260340
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:816::200e , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
Golfe2 /
Resource Hash
684517d124adb46b27ef07bdf06ecbff34c2897f4aa53bdf50e8342c5a22d989
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://dqs18el7f50bs.cloudfront.net/?367556795536==raZaxe&rsz=1260340
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 12 Sep 2017 04:27:56 GMT
server
Golfe2
age
852
date
Wed, 20 Sep 2017 15:03:07 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="39,38,37,35"
content-length
13799
expires
Wed, 20 Sep 2017 17:03:07 GMT
collect
www.google-analytics.com/r/
35 B
53 B
Image
General
Full URL
https://www.google-analytics.com/r/collect?v=1&_v=j62&a=986109428&t=pageview&_s=1&dl=https%3A%2F%2Fdqs18el7f50bs.cloudfront.net%2F%3F367556795536%3D%3DraZaxe%26rsz%3D1260340&ul=en-us&de=UTF-8&dt=Microsoft%20Official%20Support&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEABI~&jid=1701718362&gjid=650012666&cid=1847610237.1505920640&tid=UA-98509628-1&_gid=786638109.1505920640&_r=1&z=2015357770
Requested by
Host: dqs18el7f50bs.cloudfront.net
URL: https://dqs18el7f50bs.cloudfront.net/?367556795536==raZaxe&rsz=1260340
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:816::200e , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://dqs18el7f50bs.cloudfront.net/?367556795536==raZaxe&rsz=1260340
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 20 Sep 2017 15:17:19 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
status
200
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
alt-svc
quic=":443"; ma=2592000; v="39,38,37,35"
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT
anMUvcNT0H1YN4FII8wprzsSLeNQG2cy_mKit6iEdYs.ttf
fonts.gstatic.com/s/titilliumweb/v5/
26 KB
15 KB
Font
General
Full URL
https://fonts.gstatic.com/s/titilliumweb/v5/anMUvcNT0H1YN4FII8wprzsSLeNQG2cy_mKit6iEdYs.ttf
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:816::2003 , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
sffe /
Resource Hash
8fa38e21c2f1297bf54af08cd589d884c887d3681f4d81a88687962ab549ae4f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/60.0.3112.113 Safari/537.36
Referer
https://fonts.googleapis.com/css?family=Titillium+Web:400,700
Origin
https://dqs18el7f50bs.cloudfront.net

Response headers

date
Mon, 04 Sep 2017 11:58:38 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
1394322
status
200
alt-svc
quic=":443"; ma=2592000; v="39,38,37,35"
content-length
15736
x-xss-protection
1; mode=block
last-modified
Tue, 16 May 2017 22:22:37 GMT
server
sffe
vary
Accept-Encoding
content-type
font/ttf
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 04 Sep 2018 11:58:38 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
geoapi123.appspot.com
URL
http://geoapi123.appspot.com/

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Tech Support Scam (Consumer)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Domain/Path Name / Value
.dqs18el7f50bs.cloudfront.net/ Name: _gat
Value: 1
.dqs18el7f50bs.cloudfront.net/ Name: _gid
Value: GA1.3.786638109.1505920640
.dqs18el7f50bs.cloudfront.net/ Name: _ga
Value: GA1.3.1847610237.1505920640

1 Console Messages

Source Level URL
Text
console-api log (Line 1)
Message:
City fails!!!