![](/screenshots/5e6f1910-72cd-472a-8b55-7b01b40dd8e6.png)
206.189.196.57
Open in
urlscan Pro
206.189.196.57
Malicious Activity!
Public Scan
Submission: On May 04 via manual from US
Summary
This is the only time 206.189.196.57 was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Tech Support Scam (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
10 | 206.189.196.57 206.189.196.57 | 14061 (DIGITALOC...) (DIGITALOCEAN-ASN - DigitalOcean) | |
1 | 216.58.214.74 216.58.214.74 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
1 | 216.58.214.84 216.58.214.84 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
1 | 184.25.158.226 184.25.158.226 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
2 | 216.58.214.67 216.58.214.67 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
1 | 45.40.130.22 45.40.130.22 | 26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com) | |
16 | 6 |
ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US)
206.189.196.57 |
ASN15169 (GOOGLE - Google LLC, US)
PTR: fra15s10-in-f74.1e100.net
fonts.googleapis.com |
ASN15169 (GOOGLE - Google LLC, US)
PTR: fra15s10-in-f84.1e100.net
geoapi123.appspot.com |
ASN20940 (AKAMAI-ASN1, US)
PTR: a184-25-158-226.deploy.static.akamaitechnologies.com
img1.wsimg.com |
ASN15169 (GOOGLE - Google LLC, US)
PTR: fra15s10-in-f3.1e100.net
fonts.gstatic.com |
ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US)
PTR: ip-45-40-130-22.ip.secureserver.net
img.secureserver.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
2 |
gstatic.com
fonts.gstatic.com |
34 KB |
1 |
secureserver.net
img.secureserver.net |
585 B |
1 |
wsimg.com
img1.wsimg.com |
5 KB |
1 |
appspot.com
geoapi123.appspot.com |
|
1 |
googleapis.com
fonts.googleapis.com |
349 B |
16 | 5 |
Domain | Requested by | |
---|---|---|
2 | fonts.gstatic.com |
206.189.196.57
|
1 | img.secureserver.net | |
1 | img1.wsimg.com |
206.189.196.57
|
1 | geoapi123.appspot.com |
206.189.196.57
|
1 | fonts.googleapis.com |
206.189.196.57
|
16 | 5 |
This site contains no links.
Subject Issuer | Validity | Valid |
---|
This page contains 1 frames:
Primary Page:
http://206.189.196.57/Windows-Security/?utm_source=rc&utm_medium=history_and_facts&utm_term=88859
Frame ID: FC8205909BB51ECAD4A3B308BBFE2988
Requests: 16 HTTP requests in this frame
Screenshot
![](/screenshots/5e6f1910-72cd-472a-8b55-7b01b40dd8e6.png)
Detected technologies
![](/vendor/wappa/icons/Ubuntu.png)
Detected patterns
- headers server /Ubuntu/i
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
![](/vendor/wappa/icons/Google Font API.png)
Detected patterns
- html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
16 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
206.189.196.57/Windows-Security/ |
69 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
css
fonts.googleapis.com/ |
524 B 349 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
geoapi123.appspot.com/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
style.css
206.189.196.57/Windows-Security/files/ |
2 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
background-2.png
206.189.196.57/Windows-Security/files/ |
74 KB 74 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
alert.jpg
206.189.196.57/Windows-Security/files/ |
35 KB 35 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
microsoft.png
206.189.196.57/Windows-Security/files/ |
977 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
tcc_l.combined.1.0.6.min.js
img1.wsimg.com/tcc/ |
12 KB 5 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
css.css
206.189.196.57/ |
655 B 572 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
mem5YaGs126MiZpBA-UNirkOUuhs.ttf
206.189.196.57/s/opensans/v15/ |
27 KB 27 KB |
Font
application/font-sfnt |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
mem5YaGs126MiZpBA-UN7rgOUuhs.ttf
206.189.196.57/s/opensans/v15/ |
28 KB 28 KB |
Font
application/font-sfnt |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
NaPecZTIAOhVxoMyOr9n_E7fdMPmCA.ttf
fonts.gstatic.com/s/titilliumweb/v6/ |
29 KB 17 KB |
Font
font/ttf |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
alertmicrosoft.mp3
206.189.196.57/Windows-Security/files/ |
140 KB 140 KB |
Media
audio/mpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
warning.mp3
206.189.196.57/Windows-Security/files/ |
13 KB 14 KB |
Media
audio/mpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
event
img.secureserver.net/t/1/tl/ |
43 B 585 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
NaPDcZTIAOhVxoMyOr9n_E7ffHjDGItzZg.ttf
fonts.gstatic.com/s/titilliumweb/v6/ |
28 KB 16 KB |
Font
font/ttf |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Tech Support Scam (Consumer)10 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
string| phone_number function| evali function| eval1 object| _trfd function| tcg function| tcp object| perfhandler object| TCCTracker object| _trfq object| true0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
fonts.googleapis.com
fonts.gstatic.com
geoapi123.appspot.com
img.secureserver.net
img1.wsimg.com
184.25.158.226
206.189.196.57
216.58.214.67
216.58.214.74
216.58.214.84
45.40.130.22
0782a52179d0e25f19c39b43253795b25787d65abdbd8bfa38be0f21a4512748
103f94713fcf6d1356d310ef766552aba0d1f132e2c5e01c1e9ee97c764d67c8
24c1f8b80ecbe76a190b19501fff9df8235dca7908d6f696ff77789868c6a26c
74461248f0a3edd43acbe67fbd98bb8bc6f26bb6b2e8b948c4757724717bde5c
844a92ee435552f7f26b4ec467220c537841f8245a16bbb265975ce4b3081f36
8c5bc2da769a808653559f02db5f3dcf58a0a9ae69d14239a071e65a6b2d6e95
8dd75a13c2b410a988bccc7e5cbd38291e79d7f1f0c6f715109c8f66129edae4
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
aa5c1ec4d2ea00eb517eadeb3b65e55b577b7a5ed42d7c2611d15d9050c18350
b0a1cefd0513370a6e4d345229bc3f46e1bb554aca35079d0e23f844c4268fc2
b79ab56c96c2a5e39be7101bee0f18cc315dc9aeb831e8b1fa92f9e013aa2498
b9ebdf76330ecf5ad89b191de82e35ed78803e7a2fc424db5515902bda209ef3
c38865468ef3bc8fd6705dd62ff33fe740ab5726db9a582c9055a80730909f7a
eecb7831a1cbf233c74bfc0edb4db9dfa245d55756e87b8e66d3465b42e2ff4a
f4d5cae00178437f63e868ded066dde7503207230142ab3c37ef8ca70a03574d