147.75.199.129
Open in
urlscan Pro
147.75.199.129
Malicious Activity!
Public Scan
Effective URL: http://147.75.199.129/alert/ch/?a5b119c45c664f0tfn1b5b119c45c668c=+18443951479&c5b119c45c66c60ftfn1d5b119c45c6700=(844...
Submission: On June 01 via manual from US
Summary
This is the only time 147.75.199.129 was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Tech Support Scam (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
3 6 | 147.75.199.129 147.75.199.129 | 54825 (PACKET) (PACKET - Packet Host) | |
1 | 216.58.207.72 216.58.207.72 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
2 | 216.58.207.78 216.58.207.78 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
6 | 3 |
ASN54825 (PACKET - Packet Host, Inc., US)
PTR: special
147.75.199.129 |
ASN15169 (GOOGLE - Google LLC, US)
PTR: fra16s25-in-f8.1e100.net
www.googletagmanager.com |
ASN15169 (GOOGLE - Google LLC, US)
PTR: fra16s25-in-f14.1e100.net
www.google-analytics.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
2 |
google-analytics.com
www.google-analytics.com |
14 KB |
1 |
googletagmanager.com
www.googletagmanager.com |
24 KB |
6 | 2 |
Domain | Requested by | |
---|---|---|
2 | www.google-analytics.com |
www.googletagmanager.com
147.75.199.129 |
1 | www.googletagmanager.com |
147.75.199.129
|
6 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid |
---|
This page contains 1 frames:
Primary Page:
http://147.75.199.129/alert/ch/?a5b119c45c664f0tfn1b5b119c45c668c=+18443951479&c5b119c45c66c60ftfn1d5b119c45c6700=(844)%20395-1479
Frame ID: CEECA461129F481A36C9AF83634FAEA4
Requests: 6 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://147.75.199.129/alert?a=10012293&campid=62
HTTP 301
http://147.75.199.129/alert/?a=10012293&campid=62 HTTP 302
http://147.75.199.129/alert/ch?a5b119c45c664f0tfn1b5b119c45c668c=+18443951479&c5b119c45c66c60ftfn1... HTTP 301
http://147.75.199.129/alert/ch/?a5b119c45c664f0tfn1b5b119c45c668c=+18443951479&c5b119c45c66c60ftfn... Page URL
Detected technologies
Nginx (Web Servers) ExpandDetected patterns
- headers server /nginx(?:\/([\d.]+))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://147.75.199.129/alert?a=10012293&campid=62
HTTP 301
http://147.75.199.129/alert/?a=10012293&campid=62 HTTP 302
http://147.75.199.129/alert/ch?a5b119c45c664f0tfn1b5b119c45c668c=+18443951479&c5b119c45c66c60ftfn1d5b119c45c6700=(844)%20395-1479 HTTP 301
http://147.75.199.129/alert/ch/?a5b119c45c664f0tfn1b5b119c45c668c=+18443951479&c5b119c45c66c60ftfn1d5b119c45c6700=(844)%20395-1479 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
6 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
147.75.199.129/alert/ch/ Redirect Chain
|
7 KB 7 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
js
www.googletagmanager.com/gtag/ |
68 KB 24 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
defender.png
147.75.199.129/alert/files/ |
13 KB 13 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Texts.mp3
147.75.199.129/alert/files/ |
130 KB 0 |
Media
audio/mpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
analytics.js
www.google-analytics.com/ |
34 KB 14 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
collect
www.google-analytics.com/r/ |
35 B 131 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Tech Support Scam (Consumer)0 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
4 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
147.75.199.129/ | Name: _gat_gtag_UA_111939382_1 Value: 1 |
|
147.75.199.129/ | Name: _gid Value: GA1.1.1816384063.1527880774 |
|
147.75.199.129/ | Name: _ga Value: GA1.1.774436173.1527880774 |
|
147.75.199.129/ | Name: PHPSESSID Value: 488fmoc90bgec382n7mbi055n3 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
www.google-analytics.com
www.googletagmanager.com
147.75.199.129
216.58.207.72
216.58.207.78
3fab1c883847e4b5a02f3749a9f4d9eab15cd4765873d3b2904a1a4c8755fba3
7ce2ae13d717596ff63a6d0694e87f94d96246a2d5fa7d8d153fb17af7d0d42d
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
a15ad1e477d2ebc8e6d62eee380a679ad045a7c9cd25355adafea2e408035e89
beae41538682dfedeb395534015e3e577b30c71ccc6b3a9f7fb047dacd1ddf2c