URL: http://74.48.151.189:12345/
Submission Tags: @phish_report
Submission: On May 28 via api from FI — Scanned from FI

Summary

This website contacted 6 IPs in 3 countries across 3 domains to perform 8 HTTP transactions. The main IP is 74.48.151.189, located in Los Angeles, United States and belongs to MULTA-ASN1, US. The main domain is 74.48.151.189.
This is the only time 74.48.151.189 was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
2 74.48.151.189 35916 (MULTA-ASN1)
1 2a00:1450:400... 15169 (GOOGLE)
1 2606:4700:10:... 13335 (CLOUDFLAR...)
1 163.181.56.233 24429 (TAOBAO Zh...)
1 142.4.219.198 16276 (OVH)
2 142.250.186.33 15169 (GOOGLE)
8 6
Apex Domain
Subdomains
Transfer
3 ampproject.org
cdn.ampproject.org — Cisco Umbrella Rank: 421
79 KB
2 histats.com
s10.histats.com — Cisco Umbrella Rank: 13913
s4.histats.com — Cisco Umbrella Rank: 13947
5 KB
1 66kbet44p.top
66kbet44p.top
8 3
Domain Requested by
3 cdn.ampproject.org 74.48.151.189
cdn.ampproject.org
1 s4.histats.com s10.histats.com
1 66kbet44p.top 74.48.151.189
1 s10.histats.com 74.48.151.189
8 4

This site contains links to these domains. Also see Links.

Domain
66kbet22h.top
66kbet22g.top
66kbet22f.top
Subject Issuer Validity Valid
misc-sni.google.com
WR2
2024-05-13 -
2024-08-05
3 months crt.sh
*.66kbet44p.top
ZeroSSL RSA Domain Secure Site CA
2024-05-22 -
2024-08-20
3 months crt.sh
histats.com
R3
2024-05-13 -
2024-08-11
3 months crt.sh

This page contains 2 frames:

Primary Page: http://74.48.151.189:12345/
Frame ID: 4E17233372320E4A82DD0E1B4B44DCCC
Requests: 7 HTTP requests in this frame

Frame: https://66kbet44p.top/?id=40357037
Frame ID: 190E56099A3CC9EFFC2278FC0E716A84
Requests: 1 HTTP requests in this frame

Screenshot

Page Title

66kbet

Page URL History Show full URLs

  1. http://74.48.151.189:12345/ HTTP 307
    https://74.48.151.189:12345/ HTTP 307
    http://74.48.151.189:12345/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Overall confidence: 100%
Detected patterns
  • lightbox(?:-plus-jquery)?.{0,32}\.js

Page Statistics

8
Requests

63 %
HTTPS

33 %
IPv6

3
Domains

4
Subdomains

6
IPs

3
Countries

812 kB
Transfer

1040 kB
Size

7
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://74.48.151.189:12345/ HTTP 307
    https://74.48.151.189:12345/ HTTP 307
    http://74.48.151.189:12345/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 2
  • http://s10.histats.com/js15_as.js HTTP 307
  • https://s10.histats.com/js15_as.js

8 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
74.48.151.189/
Redirect Chain
  • http://74.48.151.189:12345/
  • https://74.48.151.189:12345/
  • http://74.48.151.189:12345/
6 KB
2 KB
Document
General
Full URL
http://74.48.151.189:12345/
Protocol
HTTP/1.1
Server
74.48.151.189 Los Angeles, United States, ASN35916 (MULTA-ASN1, US),
Reverse DNS
189-121-82-173-dedicated.multacom.com
Software
Apache /
Resource Hash
18539886484391853bd06571dfe383bd69286fd03d33efa32f34e3fcaf2d2b5e

Request headers

Accept-Language
fi-FI,fi;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36

Response headers

Accept-Ranges
bytes
Connection
Upgrade, close
Content-Encoding
gzip
Content-Length
2212
Content-Type
text/html
Date
Tue, 28 May 2024 12:46:47 GMT
ETag
"16da-619571da2bbc5-gzip"
Last-Modified
Sun, 26 May 2024 08:23:30 GMT
Server
Apache
Upgrade
h2
Vary
Accept-Encoding

Redirect headers

Location
http://74.48.151.189:12345/
Non-Authoritative-Reason
HttpsUpgrades
66K.png
74.48.151.189/index_files/
725 KB
725 KB
Image
General
Full URL
http://74.48.151.189:12345/index_files/66K.png
Requested by
Host: 74.48.151.189
URL: http://74.48.151.189:12345/
Protocol
HTTP/1.1
Server
74.48.151.189 Los Angeles, United States, ASN35916 (MULTA-ASN1, US),
Reverse DNS
189-121-82-173-dedicated.multacom.com
Software
Apache /
Resource Hash
cc7d9cfbd61e81202f01557d3bd61a8dd9dbd3b32ec93a8573e732bf2d41b1d0

Request headers

Accept-Language
fi-FI,fi;q=0.9;q=0.9
Referer
http://74.48.151.189:12345/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36

Response headers

Date
Tue, 28 May 2024 12:46:48 GMT
Last-Modified
Sat, 28 Oct 2023 08:25:29 GMT
Server
Apache
ETag
"b53cf-608c28c319040"
Upgrade
h2
Content-Type
image/png
Connection
Upgrade, close
Accept-Ranges
bytes
Content-Length
742351
v0.js
cdn.ampproject.org/
278 KB
73 KB
Script
General
Full URL
https://cdn.ampproject.org/v0.js
Requested by
Host: 74.48.151.189
URL: http://74.48.151.189:12345/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
9b1dfc68c26a392e1750151c564732a7ce792b7c1a2fe34a2c2c087626bf0594
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
http://74.48.151.189:12345/
Accept-Language
fi-FI,fi;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
date
Tue, 28 May 2024 12:46:47 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
73140
x-xss-protection
0
server
sffe
etag
"e8f9c8a01f99a3e1"
vary
Accept-Encoding
report-to
{"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=3000, stale-while-revalidate=1206600
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="amphtml-china-available"
expires
Tue, 28 May 2024 12:46:47 GMT
js15_as.js
s10.histats.com/
Redirect Chain
  • http://s10.histats.com/js15_as.js
  • https://s10.histats.com/js15_as.js
11 KB
5 KB
Script
General
Full URL
https://s10.histats.com/js15_as.js
Requested by
Host: 74.48.151.189
URL: http://74.48.151.189:12345/
Protocol
H2
Server
2606:4700:10::6814:1247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2defe59e357a7d0683c8283ac42841db404a0884cae2eaecebf4b676e559dede

Request headers

Accept-Language
fi-FI,fi;q=0.9;q=0.9
Referer
http://74.48.151.189:12345/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36

Response headers

date
Tue, 28 May 2024 12:46:47 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Thu, 16 Apr 2020 10:44:16 GMT
server
cloudflare
age
69945
etag
"-375139978"
vary
Accept-Encoding
content-type
text/javascript
cache-control
max-age=28800
accept-ranges
bytes
cf-ray
88ae59793ad3d94b-HEL
content-length
4547

Redirect headers

Location
https://s10.histats.com/js15_as.js
Non-Authoritative-Reason
DNS
Cross-Origin-Resource-Policy
Cross-Origin
/
66kbet44p.top/ Frame 190E
0
0
Document
General
Full URL
https://66kbet44p.top/?id=40357037
Requested by
Host: 74.48.151.189
URL: http://74.48.151.189:12345/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
163.181.56.233 Frankfurt am Main, Germany, ASN24429 (TAOBAO Zhejiang Taobao Network Co.,Ltd, CN),
Reverse DNS
Software
Tengine /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=5184000

Request headers

Accept-Language
fi-FI,fi;q=0.9;q=0.9
Referer
http://74.48.151.189:12345/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

accept-ranges
bytes
age
0
ali-swift-global-savetime
1716900408
cache-control
s-maxage=600,public,max-age=0
content-encoding
gzip
content-length
10890
content-md5
M77KskFtkQ71Sw2eCGyb2g==
content-type
text/html
date
Tue, 28 May 2024 12:46:48 GMT
eagleid
2ff62b1917169004080928351e
last-modified
Mon, 27 May 2024 18:32:10 GMT
server
Tengine
strict-transport-security
max-age=5184000
timing-allow-origin
*
vary
Accept-Encoding
via
cache3.l2fr1[651,651,200-0,H], cache8.l2fr1[652,0], ens-cache2.de4[716,716,200-0,M], ens-cache1.de4[721,0]
x-cache
MISS TCP_MISS dirn:-2:-2
x-oss-hash-crc64ecma
886760884498206971
x-oss-object-type
Normal
x-oss-request-id
6655D2380900E639320A309C
x-oss-server-time
2
x-oss-storage-class
Standard
x-swift-cachetime
600
x-swift-savetime
Tue, 28 May 2024 12:46:48 GMT
0.php
s4.histats.com/stats/
51 B
185 B
Script
General
Full URL
https://s4.histats.com/stats/0.php?4848612&@f16&@g1&@h1&@i1&@j1716900407274&@k0&@l1&@m66kbet&@n0&@o1000&@q0&@r0&@s0&@tfi-FI&@u1600&@b1:-18348053&@b3:1716900407&@b4:js15_as.js&@b5:180&@a-_0.2.1&@vhttp%3A%2F%2F74.48.151.189%3A12345%2F&@w
Requested by
Host: s10.histats.com
URL: http://s10.histats.com/js15_as.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
142.4.219.198 , Canada, ASN16276 (OVH, FR),
Reverse DNS
ns5000868.ip-142-4-219.net
Software
/
Resource Hash
b80c90e9fe7d4ab38ce88b08829e5e219d3cf8a25d24fc6512b9ea5a23f7dc89

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
http://74.48.151.189:12345/
Accept-Language
fi-FI,fi;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Tue, 28 May 2024 12:46:47 GMT
Connection
close
Content-Length
51
Content-Type
text/html;charset=UTF-8
amp-auto-lightbox-0.1.js
cdn.ampproject.org/rtv/012405101652000/v0/
8 KB
3 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/012405101652000/v0/amp-auto-lightbox-0.1.js
Requested by
Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.186.33 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s04-in-f1.1e100.net
Software
sffe /
Resource Hash
1559ae073662ed1ea21869d4c7aca513c4ff12b93ba36f28d12285d68488acfe
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
http://74.48.151.189:12345/
Origin
http://74.48.151.189:12345
Accept-Language
fi-FI,fi;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Fri, 24 May 2024 15:00:15 GMT
age
337592
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
2976
x-xss-protection
0
server
sffe
etag
"48990bbd1549baa4"
vary
Accept-Encoding
report-to
{"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="amphtml-china-available"
expires
Sat, 24 May 2025 15:00:15 GMT
amp-loader-0.1.js
cdn.ampproject.org/rtv/012405101652000/v0/
12 KB
4 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/012405101652000/v0/amp-loader-0.1.js
Requested by
Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/v0.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.186.33 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s04-in-f1.1e100.net
Software
sffe /
Resource Hash
91919685c14829a92e1ac8b51c1486d82858a0ba8bf4ba8c17a6b0a1ce0aabc6
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
http://74.48.151.189:12345/
Origin
http://74.48.151.189:12345
Accept-Language
fi-FI,fi;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Fri, 24 May 2024 15:00:15 GMT
age
337592
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
3936
x-xss-protection
0
server
sffe
etag
"6823a8665ae8e501"
vary
Accept-Encoding
report-to
{"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="amphtml-china-available"
expires
Sat, 24 May 2025 15:00:15 GMT

Verdicts & Comments Add Verdict or Comment

24 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| _Hasync function| isMobile function| getIosVersion function| chfh function| chfh2 string| _HST_cntval object| Histats object| AMP_CONFIG object| AMP_EXP object| AMP object| __AMP_LOG function| HTMLElementOrig object| __AMP_ERRORS object| __AMP_MODE function| __AMP_REPORT_ERROR object| __AMP_TOP object| __AMP_SERVICES object| __AMP__EXPERIMENT_TOGGLES object| __AMP_URL_CACHE boolean| __AMP_TAG object| __AMP_EXTENDED_ELEMENTS function| __AMP_BASE_CE_CLASS object| _HistatsCounterGraphics_0_setValues

7 Cookies

Domain/Path Name / Value
74.48.151.189/ Name: HstCfa4848612
Value: 1716900407274
74.48.151.189/ Name: HstCla4848612
Value: 1716900407274
74.48.151.189/ Name: HstCmu4848612
Value: 1716900407274
74.48.151.189/ Name: HstPn4848612
Value: 1
74.48.151.189/ Name: HstPt4848612
Value: 1
74.48.151.189/ Name: HstCnv4848612
Value: 1
74.48.151.189/ Name: HstCns4848612
Value: 1