![](/screenshots/575b1547-7125-4f77-8cc2-6f87a3e9ddef.png)
romantic-dubinsky.159-223-23-67.plesk.page
Open in
urlscan Pro
159.223.23.67
Malicious Activity!
Public Scan
Effective URL: https://romantic-dubinsky.159-223-23-67.plesk.page/?phone=050-5534-8160&gclid=EAIaIQobChMImeCvgo6ugAMV9M0WBR2x8AnjEAEYASAAEgJNMfD_BwE
Submission: On July 27 via manual from JP — Scanned from JP
Summary
TLS certificate: Issued by R3 on July 27th 2023. Valid for: 3 months.
This is the only time romantic-dubinsky.159-223-23-67.plesk.page was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Tech Support Scam (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 2 | 207.154.205.119 207.154.205.119 | 14061 (DIGITALOC...) (DIGITALOCEAN-ASN) | |
18 | 159.223.23.67 159.223.23.67 | 14061 (DIGITALOC...) (DIGITALOCEAN-ASN) | |
1 | 142.250.76.136 142.250.76.136 | 15169 (GOOGLE) (GOOGLE) | |
2 | 142.250.76.142 142.250.76.142 | 15169 (GOOGLE) (GOOGLE) | |
21 | 3 |
ASN14061 (DIGITALOCEAN-ASN, US)
PTR: route4.info
route4.info |
ASN14061 (DIGITALOCEAN-ASN, US)
romantic-dubinsky.159-223-23-67.plesk.page |
ASN15169 (GOOGLE, US)
PTR: kix07s06-in-f8.1e100.net
www.googletagmanager.com |
ASN15169 (GOOGLE, US)
PTR: kix07s06-in-f14.1e100.net
www.google-analytics.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
18 |
plesk.page
romantic-dubinsky.159-223-23-67.plesk.page |
256 KB |
2 |
google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 59 |
327 B |
2 |
route4.info
2 redirects
route4.info |
699 B |
1 |
googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 72 |
87 KB |
21 | 4 |
Domain | Requested by | |
---|---|---|
18 | romantic-dubinsky.159-223-23-67.plesk.page |
romantic-dubinsky.159-223-23-67.plesk.page
|
2 | www.google-analytics.com |
www.googletagmanager.com
|
2 | route4.info | 2 redirects |
1 | www.googletagmanager.com |
romantic-dubinsky.159-223-23-67.plesk.page
|
21 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
romantic-dubinsky.159-223-23-67.plesk.page R3 |
2023-07-27 - 2023-10-25 |
3 months | crt.sh |
*.google-analytics.com GTS CA 1C3 |
2023-07-10 - 2023-10-02 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://romantic-dubinsky.159-223-23-67.plesk.page/?phone=050-5534-8160&gclid=EAIaIQobChMImeCvgo6ugAMV9M0WBR2x8AnjEAEYASAAEgJNMfD_BwE
Frame ID: DDAD125D99DAC91670B8F14AEE483337
Requests: 21 HTTP requests in this frame
Screenshot
![](/screenshots/575b1547-7125-4f77-8cc2-6f87a3e9ddef.png)
Page Title
Security CenterPage URL History Show full URLs
-
http://route4.info/?gclid=EAIaIQobChMImeCvgo6ugAMV9M0WBR2x8AnjEAEYASAAEgJNMfD_BwE
HTTP 301
https://route4.info/?gclid=EAIaIQobChMImeCvgo6ugAMV9M0WBR2x8AnjEAEYASAAEgJNMfD_BwE HTTP 301
https://romantic-dubinsky.159-223-23-67.plesk.page/?phone=050-5534-8160&gclid=EAIaIQobChMImeCvgo6ugAMV9M0WBR2x8AnjEAEYASAAEgJNM... Page URL
Detected technologies
![](/vendor/wappa/icons/Bootstrap.png)
Detected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
![](/vendor/wappa/icons/Font Awesome.png)
Detected patterns
- <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Detected patterns
![](/vendor/wappa/icons/Google Tag Manager.png)
Detected patterns
- googletagmanager\.com/gtag/js
Detected patterns
- ([\d.]+)?/modernizr(?:\.([\d.]+))?.*\.js
Detected patterns
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://route4.info/?gclid=EAIaIQobChMImeCvgo6ugAMV9M0WBR2x8AnjEAEYASAAEgJNMfD_BwE
HTTP 301
https://route4.info/?gclid=EAIaIQobChMImeCvgo6ugAMV9M0WBR2x8AnjEAEYASAAEgJNMfD_BwE HTTP 301
https://romantic-dubinsky.159-223-23-67.plesk.page/?phone=050-5534-8160&gclid=EAIaIQobChMImeCvgo6ugAMV9M0WBR2x8AnjEAEYASAAEgJNMfD_BwE Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
21 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
romantic-dubinsky.159-223-23-67.plesk.page/ Redirect Chain
|
17 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
www.googletagmanager.com/gtag/ |
260 KB 87 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
romantic-dubinsky.159-223-23-67.plesk.page/cdn.jsdelivr.net/npm/bootstrap%404.6.0/dist/css/ |
158 KB 21 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
romantic-dubinsky.159-223-23-67.plesk.page/cdnjs.cloudflare.com/ajax/libs/jquery/2.1.3/ |
82 KB 28 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.css
romantic-dubinsky.159-223-23-67.plesk.page/ |
12 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
font-awesome.min.css
romantic-dubinsky.159-223-23-67.plesk.page/maxcdn.bootstrapcdn.com/font-awesome/4.5.0/css/ |
27 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bg2.jpg
romantic-dubinsky.159-223-23-67.plesk.page/ |
111 KB 111 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
microsoft.png
romantic-dubinsky.159-223-23-67.plesk.page/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
def.png
romantic-dubinsky.159-223-23-67.plesk.page/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cross.png
romantic-dubinsky.159-223-23-67.plesk.page/ |
43 KB 43 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
virus-images.jpg
romantic-dubinsky.159-223-23-67.plesk.page/ |
8 KB 8 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
modernizr.min.js
romantic-dubinsky.159-223-23-67.plesk.page/cdnjs.cloudflare.com/ajax/libs/modernizr/2.8.3/ |
11 KB 4 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.bundle.min.js
romantic-dubinsky.159-223-23-67.plesk.page/cdn.jsdelivr.net/npm/bootstrap%404.6.0/dist/js/ |
82 KB 20 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fullscreen.js
romantic-dubinsky.159-223-23-67.plesk.page/ |
245 B 368 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
before.js
romantic-dubinsky.159-223-23-67.plesk.page/ |
366 B 430 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.js
romantic-dubinsky.159-223-23-67.plesk.page/ |
1 KB 475 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
light.js
romantic-dubinsky.159-223-23-67.plesk.page/ |
503 B 460 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
www.google-analytics.com/g/ |
0 273 B |
Ping
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wa0lDErtm0s.mp3
romantic-dubinsky.159-223-23-67.plesk.page/ |
128 KB 0 |
Media
audio/mpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wa0lDErtm0s.mp3
romantic-dubinsky.159-223-23-67.plesk.page/ |
64 KB 0 |
Media
audio/mpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
collect
www.google-analytics.com/g/ |
0 54 B |
Ping
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Tech Support Scam (Consumer)19 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| gtag object| dataLayer object| google_tag_manager object| google_tag_data function| onYouTubeIframeAPIReady object| gaGlobal function| $ function| jQuery function| dadasdwqerewqaasd string| phone string| phone_number object| html5 object| Modernizr object| bootstrap function| addEvent object| modal object| btn undefined| span function| play2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.159-223-23-67.plesk.page/ | Name: _ga Value: GA1.1.493227022.1690434657 |
|
.159-223-23-67.plesk.page/ | Name: _ga_90T961KXJ8 Value: GS1.1.1690434656.1.0.1690434656.0.0.0 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
romantic-dubinsky.159-223-23-67.plesk.page
route4.info
www.google-analytics.com
www.googletagmanager.com
142.250.76.136
142.250.76.142
159.223.23.67
207.154.205.119
2051d61446d4dbffb03727031022a08c84528ab44d203a7669c101e5fbdd5515
31681779c6f394370dad146169896e9ec2b8f7c716c4b1db78c459033e48bf95
316e6a6737bd296ab30aca2ef7fa36f119d15786a2432d01e31fdc130272f15c
318698ae5e67c32550d6b40ac09848d598f6317f51a8f09638ba925f6e7cc479
36cdf78af474a0d530ecc3bd8cb731d5e47e677b717c0c77cb5c38bd52beb0a2
3821ef20f5904fdb993e34d87ff8fb9c5786a382efb0eeee8b4f00c91428b701
3b531d403dc8ce7cbb0efb1a0c307cfb2bbaaf21feaff9f3546f13bebda71887
43703d37b8fe2769cb2e12db7aa281dbcca175124d05ff4b0cc3d152534698a4
4ffcc598ee6cff4692c1cea272cd8a2f195f6dec32473e94370d6cdcfa5fe601
948b1331677d0f9991d50376bfba436033c5a9cc5919cf9f74c03424b6f3e342
aad2c99d72e6b95ba180a0ea0ceb42bf4d6643ae9e067dbec8eabba12308c46e
b0212543cc5a4a0a31c1b5a9d1e8973261992116b4cfde3e7dfcf33b4e81a97b
c1782a8e7e3ff0043f0b4312520e07f8477299e2ac89a11ec473f847c1bc3dc3
cf748e3d39606a19baa3f6c59f5b606a9aa47c1620606284d2ca4c3e6f47016e
d2b82e612d2a812e8be2a57300dab8923c4f2edbe7a799e7da70791b595646fe
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
eb198073ab0552061f6c160f3a63c0bc4e4ef42a1491c173bbb1c892bc9044a9
ee4bc5fe81fa7c1e8497d79c9c8a96485df217092d334e9b48fa8840fed11d03