billing-management-business.threatdown.com Open in urlscan Pro
18.164.96.52 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://billing-management-business.threatdown.com/
Submission: On March 26 via api (March 26th 2024, 11:38:15 am UTC) from US — Scanned from US

Summary HTTP 12 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 1 countries across 2 domains to perform 12 HTTP transactions. The main IP is 18.164.96.52, located in United States and belongs to AMAZON-02, US. The main domain is billing-management-business.threatdown.com.
TLS certificate: Issued by Amazon ECDSA 256 M02 on March 26th 2024. Valid for: a year.

This is the only time billing-management-business.threatdown.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
9	18.164.96.52 18.164.96.52	16509 (AMAZON-02) (AMAZON-02)
2	2607:f8b0:400... 2607:f8b0:4006:816::200e	15169 (GOOGLE) (GOOGLE)
1	142.251.40.110 142.251.40.110	15169 (GOOGLE) (GOOGLE)
12	3

9 18.164.96.52 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-164-96-52.jfk50.r.cloudfront.net

billing-management-business.threatdown.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4006:816::200e (United States)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.251.40.110 (Queens, United States)

ASN15169 (GOOGLE, US)
PTR: lga25s79-in-f14.1e100.net

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	threatdown.com billing-management-business.threatdown.com	1015 KB
3	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 101	21 KB
12	2

	Domain	Requested by
9	billing-management-business.threatdown.com	billing-management-business.threatdown.com
3	www.google-analytics.com	billing-management-business.threatdown.com www.google-analytics.com
12	2

This site contains no links.

Subject Issuer	Validity	Valid
buy.threatdown.com Amazon ECDSA 256 M02	`2024-03-26` - `2025-04-24`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2024-02-26` - `2024-05-20`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://billing-management-business.threatdown.com/
Frame ID: E9A9966A9E50FE04F014DC2288957BAF
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Malwarebytes Subscription and Billing Management

Detected technologies

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Page Statistics

12
Requests

100 %
HTTPS

33 %
IPv6

2
Domains

2
Subdomains

3
IPs

1
Countries

1036 kB
Transfer

3905 kB
Size

3
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
billing-management-business.threatdown.com/ 2 KB
2 KB 317ms
159ms Document
text/html 18.164.96.52
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://billing-management-business.threatdown.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.164.96.52 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-164-96-52.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 018239cdd4c598dc969784c1e4a4d8cd53ee90be7c0f66cf7e0f1c2f0437a97c

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-language: en-US,en;q=0.9
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

content-encoding: gzip
content-type: text/html
date: Tue, 26 Mar 2024 11:38:10 GMT
etag: W/"e6b0837132aec29ccc96d92496dc07a7"
last-modified: Thu, 27 Jul 2023 15:57:12 GMT
server: AmazonS3
vary: Accept-Encoding
via: 1.1 eb2e4893b47f0d155cd51b82c2a8d596.cloudfront.net (CloudFront)
x-amz-cf-id: u2jGHLx3cGhntoeaqZAzAoOc5VmYYbZpmInOZo45qchuVMio-2xrDQ==
x-amz-cf-pop: JFK50-P5
x-amz-server-side-encryption: AES256
x-amz-version-id: 8gY1OQtDqW0m.ZUL7xHWm5hd4O94NPY1
x-cache: Miss from cloudfront

GET
H2 200 2.c08114fc.chunk.css
billing-management-business.threatdown.com/static/css/ 589 KB
84 KB 190ms
189ms Stylesheet
text/css 18.164.96.52
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://billing-management-business.threatdown.com/static/css/2.c08114fc.chunk.css
Requested by: Host: billing-management-business.threatdown.com
URL: https://billing-management-business.threatdown.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.164.96.52 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-164-96-52.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 422e283fe0a499fdc08d30e648256b7cff8fa5ab198acfb1a878cd4815b1491d

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://billing-management-business.threatdown.com/
accept-language: en-US,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 26 Mar 2024 11:38:10 GMT
x-amz-version-id: u8n8ROnFyayKTwsrlYO4tupGWZ6OSPrr
content-encoding: gzip
last-modified: Thu, 27 Jul 2023 15:57:12 GMT
server: AmazonS3
via: 1.1 eb2e4893b47f0d155cd51b82c2a8d596.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK50-P5
etag: W/"fac907c1550621f9b8d670bc7d0c047f"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: Miss from cloudfront
content-type: text/css
x-amz-cf-id: IZBNX9HPxGcZ6es4O_TKzXAenIDB1LcvoIgQ7vllUa5yZ0RwtVPHKQ==

GET
H2 200 main.a68fefcb.chunk.css
billing-management-business.threatdown.com/static/css/ 2 KB
1 KB 178ms
177ms Stylesheet
text/css 18.164.96.52
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://billing-management-business.threatdown.com/static/css/main.a68fefcb.chunk.css
Requested by: Host: billing-management-business.threatdown.com
URL: https://billing-management-business.threatdown.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.164.96.52 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-164-96-52.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 4c54381fe5f7f4d2e2f68cf9d79873f1fb0f29b01e3659736ba6ba7187547917

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://billing-management-business.threatdown.com/
accept-language: en-US,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 26 Mar 2024 11:38:10 GMT
x-amz-version-id: 5VYINuFelTw0tl9BqDVdvuYutbLCDQEW
content-encoding: gzip
last-modified: Thu, 27 Jul 2023 15:57:12 GMT
server: AmazonS3
via: 1.1 eb2e4893b47f0d155cd51b82c2a8d596.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK50-P5
etag: W/"835d6d8b08ed0fa0cf9584c9a2f7bc3a"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: Miss from cloudfront
content-type: text/css
x-amz-cf-id: tVG7RWmB_GaTGOLVTPFRA7V5QJtskVVf8M3KGKkAFAXH1rEvv1jqfg==

GET
H2 200 2.c9e258a3.chunk.js Show response
billing-management-business.threatdown.com/static/js/ 3 MB
790 KB 289ms
289ms Script
application/javascript 18.164.96.52
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://billing-management-business.threatdown.com/static/js/2.c9e258a3.chunk.js
Requested by: Host: billing-management-business.threatdown.com
URL: https://billing-management-business.threatdown.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.164.96.52 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-164-96-52.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 4edfefb2c3aa68f5da33924929c36ef60636ee4ebdf0e1ed192d681bb4221427

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://billing-management-business.threatdown.com/
accept-language: en-US,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 26 Mar 2024 11:38:10 GMT
x-amz-version-id: 1o.z9eCjvGRxfOfjMTU5punNii8EI9lO
content-encoding: gzip
last-modified: Thu, 27 Jul 2023 15:57:12 GMT
server: AmazonS3
via: 1.1 eb2e4893b47f0d155cd51b82c2a8d596.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK50-P5
etag: W/"e2b7625d4722a4c11828cb70d60546aa"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: Miss from cloudfront
content-type: application/javascript
x-amz-cf-id: JwNilpitO7aSRt-X2EIdrn-E5zQreae8jxtdb7_Ahh_1bHJm1mTMqw==

GET
H2 200 main.fa8b8118.chunk.js Show response
billing-management-business.threatdown.com/static/js/ 77 KB
31 KB 154ms
154ms Script
application/javascript 18.164.96.52
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://billing-management-business.threatdown.com/static/js/main.fa8b8118.chunk.js
Requested by: Host: billing-management-business.threatdown.com
URL: https://billing-management-business.threatdown.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.164.96.52 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-164-96-52.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5820b7a747e7d1e12c4a53b0b63538d0db6fe5c477ebe295c0ca5f03457e0b6c

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://billing-management-business.threatdown.com/
accept-language: en-US,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 26 Mar 2024 11:38:10 GMT
x-amz-version-id: bZYWh7Vd0GVrmqmEZ9EkTwNl1apPLp22
content-encoding: gzip
last-modified: Thu, 27 Jul 2023 15:57:12 GMT
server: AmazonS3
via: 1.1 eb2e4893b47f0d155cd51b82c2a8d596.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK50-P5
etag: W/"00aca7f185b98d39784b6f553a89b089"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: Miss from cloudfront
content-type: application/javascript
x-amz-cf-id: O-mtpKyLYNw5BBiosDX5EZKqRlhbI0mv9mO1MTYc_AedSwFl-zkJjg==

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 209ms
65ms Script
text/javascript 2607:f8b0:4006:816::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: billing-management-business.threatdown.com
URL: https://billing-management-business.threatdown.com/static/js/2.c9e258a3.chunk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:816::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://billing-management-business.threatdown.com/
accept-language: en-US,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Tue, 26 Mar 2024 09:51:49 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
server: Golfe2
age: 6381
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Tue, 26 Mar 2024 11:51:49 GMT

GET
H2 200 unknown-light.5361110a.svg
billing-management-business.threatdown.com/static/media/ 6 KB
3 KB 146ms
145ms Image
image/svg+xml 18.164.96.52
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://billing-management-business.threatdown.com/static/media/unknown-light.5361110a.svg
Requested by: Host: billing-management-business.threatdown.com
URL: https://billing-management-business.threatdown.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.164.96.52 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-164-96-52.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: f352bcc8772da5b486f0aae3e96c6c4e2c4172803b0077376206dd3b322b9f8d

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://billing-management-business.threatdown.com/
accept-language: en-US,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 26 Mar 2024 11:38:11 GMT
x-amz-version-id: dwfDE78DGIud0r0Q2zqWuEMyHB09zcea
content-encoding: gzip
last-modified: Thu, 27 Jul 2023 15:57:13 GMT
server: AmazonS3
via: 1.1 eb2e4893b47f0d155cd51b82c2a8d596.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK50-P5
etag: W/"f3a15a8d940aa61617d38d5cd2d21a99"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: Miss from cloudfront
content-type: image/svg+xml
x-amz-cf-id: mN1dIbcYVbTmZjqAHdRxsodCKG0zuHgjZkFrGEY0JkHV6FA_IC1FkA==

GET
H2 200 GraphikRegular..32974657.otf
billing-management-business.threatdown.com/static/media/ 123 KB
48 KB 183ms
183ms Font
font/ttf 18.164.96.52
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://billing-management-business.threatdown.com/static/media/GraphikRegular..32974657.otf
Requested by: Host: billing-management-business.threatdown.com
URL: https://billing-management-business.threatdown.com/static/css/2.c08114fc.chunk.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.164.96.52 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-164-96-52.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 8e758310065d56c81731fadefacd48f77fe962456070bcd42b4fab78e044a69d

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://billing-management-business.threatdown.com/static/css/2.c08114fc.chunk.css
Origin: https://billing-management-business.threatdown.com
accept-language: en-US,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 26 Mar 2024 11:38:11 GMT
x-amz-version-id: C23Iq6rxXkmXuLntcjF6X9fLGxUsO2xZ
content-encoding: gzip
last-modified: Thu, 27 Jul 2023 15:57:12 GMT
server: AmazonS3
via: 1.1 eb2e4893b47f0d155cd51b82c2a8d596.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK50-P5
etag: W/"e2a1876e68b3885d03062214bc6016e9"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: Miss from cloudfront
content-type: font/ttf
x-amz-cf-id: KOsn3HlKwAxs3wZthA6fo-otSG2HiWA9VuWbGrh-LzoI2RVoxg8HlQ==

GET
H2 200 GraphikMedium..f58d53eb.otf
billing-management-business.threatdown.com/static/media/ 129 KB
53 KB 187ms
187ms Font
font/ttf 18.164.96.52
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://billing-management-business.threatdown.com/static/media/GraphikMedium..f58d53eb.otf
Requested by: Host: billing-management-business.threatdown.com
URL: https://billing-management-business.threatdown.com/static/css/2.c08114fc.chunk.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.164.96.52 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-164-96-52.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: ebd6d32400095fb406e63e748a6a8451eb6cdefc0f57d5f3217de10fdc57b416

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://billing-management-business.threatdown.com/static/css/2.c08114fc.chunk.css
Origin: https://billing-management-business.threatdown.com
accept-language: en-US,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 26 Mar 2024 11:38:11 GMT
x-amz-version-id: gyfeUawMY2r7TKnpE0dJp0_WZ4C2gl3I
content-encoding: gzip
last-modified: Thu, 27 Jul 2023 15:57:12 GMT
server: AmazonS3
via: 1.1 eb2e4893b47f0d155cd51b82c2a8d596.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK50-P5
etag: W/"4a127c955329def8ac32316e4c6b55a5"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: Miss from cloudfront
content-type: font/ttf
x-amz-cf-id: jrBdkVJyv3F4CGeISjk-YW6alc7PmUJ0acIslJbpoo4oG_DOABXiKA==

POST
H2 200 collect Show response
www.google-analytics.com/j/ 3 B
226 B 80ms
79ms XHR
text/plain 2607:f8b0:4006:816::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1539021745&t=pageview&_s=1&dl=https%3A%2F%2Fbilling-management-business.threatdown.com%2F&dp=%2F&ul=en-us&de=UTF-8&dt=Malwarebytes%20Subscription%20and%20Billing%20Management&sd=24-bit&sr=800x600&vp=1600x1113&je=0&_u=IEBAAEABAAAAACAAI~&jid=98906540&gjid=744253412&cid=77934534.1711453091&tid=none&_gid=101599698.1711453091&_r=1&_slc=1&z=645786529

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:816::200e , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform: "Win32"
Referer: https://billing-management-business.threatdown.com/
accept-language: en-US,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 26 Mar 2024 11:38:10 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://billing-management-business.threatdown.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 favicon-32x32.png
billing-management-business.threatdown.com/static/icons/ 1 KB
2 KB 154ms
154ms Other
image/png 18.164.96.52
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://billing-management-business.threatdown.com/static/icons/favicon-32x32.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.164.96.52 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-164-96-52.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 28fc861a8db366c7d92b6baa1fe3f6ef578b9fa951b68a60449760709a561713

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://billing-management-business.threatdown.com/
accept-language: en-US,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 26 Mar 2024 11:38:11 GMT
x-amz-version-id: GS3Xpe89A2cssIPF5rZWCdTfbs6Qa43M
via: 1.1 eb2e4893b47f0d155cd51b82c2a8d596.cloudfront.net (CloudFront)
last-modified: Thu, 27 Jul 2023 15:57:12 GMT
server: AmazonS3
x-amz-cf-pop: JFK50-P5
etag: "07b41e4ba1ea26b0ba40cf49324b263f"
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
content-type: image/png
accept-ranges: bytes
content-length: 1255
x-amz-cf-id: BE8qT5ylvYFg4NxT8UldhlBH-SPrIbQUF8OmUGTp9hY7ewwebi9eGA==

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 65ms
65ms Image
image/gif 142.251.40.110
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=1539021745&t=timing&_s=2&dl=https%3A%2F%2Fbilling-management-business.threatdown.com%2F&ul=en-us&de=UTF-8&dt=Malwarebytes%20Subscription%20and%20Billing%20Management&sd=24-bit&sr=800x600&vp=1600x1113&je=0&plt=1280&pdt=1&dns=0&rrt=0&srt=158&tcp=129&dit=1032&clt=1032&_gst=840&_gbt=1119&_u=IEBAAEABAAAAACAAI~&jid=&gjid=&cid=77934534.1711453091&tid=none&_gid=101599698.1711453091&z=1357884966

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.40.110 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s79-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://billing-management-business.threatdown.com/
accept-language: en-US,en;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Mon, 25 Mar 2024 21:06:01 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 52329
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

14 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.threatdown.com/	1970-01-21 05:00:13	Name: _ga Value: GA1.2.77934534.1711453091
.threatdown.com/	1970-01-20 19:25:39	Name: _gid Value: GA1.2.101599698.1711453091
.threatdown.com/	1970-01-20 19:24:13	Name: _gat Value: 1

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	warning	URL: https://billing-management-business.threatdown.com/static/js/main.fa8b8118.chunk.js Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://cloud.malwarebytes.com') does not match the recipient window's origin ('https://billing-management-business.threatdown.com').
security	warning	URL: https://billing-management-business.threatdown.com/static/js/main.fa8b8118.chunk.js Message: Failed to execute 'postMessage' on 'DOMWindow': The target origin provided ('https://cloud.malwarebytes.com') does not match the recipient window's origin ('https://billing-management-business.threatdown.com').

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

billing-management-business.threatdown.com
www.google-analytics.com
142.251.40.110
18.164.96.52
2607:f8b0:4006:816::200e
018239cdd4c598dc969784c1e4a4d8cd53ee90be7c0f66cf7e0f1c2f0437a97c
1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26
28fc861a8db366c7d92b6baa1fe3f6ef578b9fa951b68a60449760709a561713
422e283fe0a499fdc08d30e648256b7cff8fa5ab198acfb1a878cd4815b1491d
4c54381fe5f7f4d2e2f68cf9d79873f1fb0f29b01e3659736ba6ba7187547917
4edfefb2c3aa68f5da33924929c36ef60636ee4ebdf0e1ed192d681bb4221427
5820b7a747e7d1e12c4a53b0b63538d0db6fe5c477ebe295c0ca5f03457e0b6c
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8e758310065d56c81731fadefacd48f77fe962456070bcd42b4fab78e044a69d
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
ebd6d32400095fb406e63e748a6a8451eb6cdefc0f57d5f3217de10fdc57b416
f352bcc8772da5b486f0aae3e96c6c4e2c4172803b0077376206dd3b322b9f8d

billing-management-business.threatdown.com Open in urlscan Pro 18.164.96.52 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

12 Requests

100 %HTTPS

33 %IPv6

2 Domains

2 Subdomains

3 IPs

1 Countries

1036 kBTransfer

3905 kBSize

3 Cookies

0 Outgoing links

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

14 JavaScript Global Variables

3 Cookies

2 Console Messages

Indicators

billing-management-business.threatdown.com Open in urlscan Pro
18.164.96.52 Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

100 %
HTTPS

33 %
IPv6

2
Domains

2
Subdomains

3
IPs

1
Countries

1036 kB
Transfer

3905 kB
Size

3
Cookies

12 HTTP transactions
0 data transactions