159.65.41.210 Open in urlscan Pro
159.65.41.210 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://159.65.41.210/Windows-Security/?utm_source=rc&utm_medium=cpc&utm_term=85375&utm_content=mens_lifestyle
Submission: On March 27 via manual (March 27th 2018, 10:06:03 pm UTC) from IN

Summary HTTP 16 Redirects Behaviour Indicators

Summary

This website contacted 6 IPs in 2 countries across 5 domains to perform 16 HTTP transactions. The main IP is 159.65.41.210, located in Dallas, United States and belongs to DIGITALOCEAN-ASN - DigitalOcean, LLC, US. The main domain is 159.65.41.210.

This is the only time 159.65.41.210 was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Tech Support Scam (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
10	159.65.41.210 159.65.41.210	14061 (DIGITALOC...) (DIGITALOCEAN-ASN - DigitalOcean)
1	216.58.206.10 216.58.206.10	15169 (GOOGLE) (GOOGLE - Google LLC)
1	216.58.206.20 216.58.206.20	15169 (GOOGLE) (GOOGLE - Google LLC)
1	184.25.158.226 184.25.158.226	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	172.217.18.3 172.217.18.3	15169 (GOOGLE) (GOOGLE - Google LLC)
1	45.40.130.22 45.40.130.22	26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com)
16	6

10 159.65.41.210 (Dallas, United States)

ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US)

159.65.41.210	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 216.58.206.10 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra16s20-in-f10.1e100.net

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 216.58.206.20 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra16s20-in-f20.1e100.net

geoapi123.appspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 184.25.158.226 (Amsterdam, Netherlands)

ASN20940 (AKAMAI-ASN1, US)
PTR: a184-25-158-226.deploy.static.akamaitechnologies.com

img1.wsimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.217.18.3 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra02s19-in-f3.1e100.net

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 45.40.130.22 (Scottsdale, United States)

ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US)
PTR: ip-45-40-130-22.ip.secureserver.net

img.secureserver.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	gstatic.com fonts.gstatic.com	24 KB
1	secureserver.net img.secureserver.net	584 B
1	wsimg.com img1.wsimg.com	5 KB
1	appspot.com geoapi123.appspot.com	391 B
1	googleapis.com fonts.googleapis.com	566 B
16	5

	Domain	Requested by
2	fonts.gstatic.com	159.65.41.210
1	img.secureserver.net
1	img1.wsimg.com	159.65.41.210
1	geoapi123.appspot.com	159.65.41.210
1	fonts.googleapis.com	159.65.41.210
16	5

This site contains no links.

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://159.65.41.210/Windows-Security/?utm_source=rc&utm_medium=cpc&utm_term=85375&utm_content=mens_lifestyle
Frame ID: 474326D694E6242CA89406CC3E51E976
Requests: 16 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Ubuntu (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /Ubuntu/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i

Page Statistics

16
Requests

0 %
HTTPS

0 %
IPv6

5
Domains

5
Subdomains

6
IPs

2
Countries

356 kB
Transfer

426 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

16 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
159.65.41.210/Windows-Security/ 69 KB
5 KB 175ms
89ms Document
text/html 159.65.41.210
DigitalOcean

General

Check archive.org

Show headers Download Go to

Full URL: http://159.65.41.210/Windows-Security/?utm_source=rc&utm_medium=cpc&utm_term=85375&utm_content=mens_lifestyle
Protocol: HTTP/1.1
Server: 159.65.41.210 Dallas, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
Software: Apache/2.4.18 (Ubuntu) /
Resource Hash: cdf7514cdbd78bc816291cf8dd79afe06031315c94d0fbc5ec2a1a8490f11437

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: 159.65.41.210
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Cache-Control: no-cache
Connection: keep-alive
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Tue, 27 Mar 2018 22:05:52 GMT
Content-Encoding: gzip
Last-Modified: Tue, 27 Mar 2018 20:47:49 GMT
Server: Apache/2.4.18 (Ubuntu)
ETag: "11324-5686b00e79032-gzip"
Vary: Accept-Encoding
Content-Type: text/html
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 5079

GET
S 200 css
fonts.googleapis.com/ 2 KB
566 B 17ms
16ms Stylesheet
text/css 216.58.206.10
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Titillium+Web:400,700

Requested by

Host: 159.65.41.210
URL: http://159.65.41.210/Windows-Security/?utm_source=rc&utm_medium=cpc&utm_term=85375&utm_content=mens_lifestyle

Protocol

SPDY

Server

216.58.206.10 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra16s20-in-f10.1e100.net

Software

ESF /

Resource Hash

3d49296055d42972e1275138fd3f5023fa2cf390a0e6617cf05e97a51d1eda39

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: http://159.65.41.210/Windows-Security/?utm_source=rc&utm_medium=cpc&utm_term=85375&utm_content=mens_lifestyle
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Tue, 27 Mar 2018 22:05:52 GMT
content-encoding: gzip
last-modified: Tue, 27 Mar 2018 22:05:52 GMT
server: ESF
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
status: 200
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
alt-svc: hq=":443"; ma=2592000; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="42,41,39,35"
x-xss-protection: 1; mode=block
expires: Tue, 27 Mar 2018 22:05:52 GMT

GET
H/1.1 200
OK / Show response
geoapi123.appspot.com/ 366 B
391 B 143ms
122ms Script
text/html 216.58.206.20
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: http://geoapi123.appspot.com/
Requested by: Host: 159.65.41.210
URL: http://159.65.41.210/Windows-Security/?utm_source=rc&utm_medium=cpc&utm_term=85375&utm_content=mens_lifestyle
Protocol: HTTP/1.1
Server: 216.58.206.20 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: fra16s20-in-f20.1e100.net
Software: Google Frontend /
Resource Hash: d299075f7b387d8a9db625fc10e23e409f4b59155a4125552ff8f97c221ff20a

Request headers

Referer: http://159.65.41.210/Windows-Security/?utm_source=rc&utm_medium=cpc&utm_term=85375&utm_content=mens_lifestyle
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Tue, 27 Mar 2018 22:05:52 GMT
Content-Encoding: gzip
Server: Google Frontend
Vary: Accept-Encoding
Content-Type: text/html; charset=utf-8
X-Cloud-Trace-Context: 5f29d44809e6ce3b7289c79c33c34f71
Cache-Control: private
Content-Length: 121

GET
H/1.1 200
OK style.css
159.65.41.210/Windows-Security/files/ 2 KB
1 KB 92ms
92ms Stylesheet
text/css 159.65.41.210
DigitalOcean

General

Check archive.org

Show headers Download Go to

Full URL: http://159.65.41.210/Windows-Security/files/style.css
Requested by: Host: 159.65.41.210
URL: http://159.65.41.210/Windows-Security/?utm_source=rc&utm_medium=cpc&utm_term=85375&utm_content=mens_lifestyle
Protocol: HTTP/1.1
Server: 159.65.41.210 Dallas, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
Software: Apache/2.4.18 (Ubuntu) /
Resource Hash: 8c5bc2da769a808653559f02db5f3dcf58a0a9ae69d14239a071e65a6b2d6e95

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: 159.65.41.210
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: http://159.65.41.210/Windows-Security/?utm_source=rc&utm_medium=cpc&utm_term=85375&utm_content=mens_lifestyle
Connection: keep-alive
Cache-Control: no-cache
Referer: http://159.65.41.210/Windows-Security/?utm_source=rc&utm_medium=cpc&utm_term=85375&utm_content=mens_lifestyle
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Tue, 27 Mar 2018 22:05:52 GMT
Content-Encoding: gzip
Last-Modified: Tue, 27 Mar 2018 20:47:54 GMT
Server: Apache/2.4.18 (Ubuntu)
ETag: "855-5686b01335e6e-gzip"
Vary: Accept-Encoding
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 741

GET
H/1.1 200
OK background-2.png
159.65.41.210/Windows-Security/files/ 74 KB
74 KB 86ms
86ms Image
image/png 159.65.41.210
DigitalOcean

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://159.65.41.210/Windows-Security/files/background-2.png
Requested by: Host: 159.65.41.210
URL: http://159.65.41.210/Windows-Security/?utm_source=rc&utm_medium=cpc&utm_term=85375&utm_content=mens_lifestyle
Protocol: HTTP/1.1
Server: 159.65.41.210 Dallas, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
Software: Apache/2.4.18 (Ubuntu) /
Resource Hash: 24c1f8b80ecbe76a190b19501fff9df8235dca7908d6f696ff77789868c6a26c

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: 159.65.41.210
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://159.65.41.210/Windows-Security/?utm_source=rc&utm_medium=cpc&utm_term=85375&utm_content=mens_lifestyle
Connection: keep-alive
Cache-Control: no-cache
Referer: http://159.65.41.210/Windows-Security/?utm_source=rc&utm_medium=cpc&utm_term=85375&utm_content=mens_lifestyle
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Tue, 27 Mar 2018 22:05:52 GMT
Last-Modified: Tue, 27 Mar 2018 20:47:53 GMT
Server: Apache/2.4.18 (Ubuntu)
ETag: "12689-5686b0123ddaf"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 75401

GET
H/1.1 200
OK alert.jpg
159.65.41.210/Windows-Security/files/ 35 KB
35 KB 86ms
86ms Image
image/jpeg 159.65.41.210
DigitalOcean

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://159.65.41.210/Windows-Security/files/alert.jpg
Requested by: Host: 159.65.41.210
URL: http://159.65.41.210/Windows-Security/?utm_source=rc&utm_medium=cpc&utm_term=85375&utm_content=mens_lifestyle
Protocol: HTTP/1.1
Server: 159.65.41.210 Dallas, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
Software: Apache/2.4.18 (Ubuntu) /
Resource Hash: b0a1cefd0513370a6e4d345229bc3f46e1bb554aca35079d0e23f844c4268fc2

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: 159.65.41.210
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://159.65.41.210/Windows-Security/?utm_source=rc&utm_medium=cpc&utm_term=85375&utm_content=mens_lifestyle
Connection: keep-alive
Cache-Control: no-cache
Referer: http://159.65.41.210/Windows-Security/?utm_source=rc&utm_medium=cpc&utm_term=85375&utm_content=mens_lifestyle
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Tue, 27 Mar 2018 22:05:52 GMT
Last-Modified: Tue, 27 Mar 2018 20:47:52 GMT
Server: Apache/2.4.18 (Ubuntu)
ETag: "8c82-5686b011055b0"
Content-Type: image/jpeg
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 35970

GET
H/1.1 200
OK microsoft.png
159.65.41.210/Windows-Security/files/ 977 B
1 KB 223ms
107ms Image
image/png 159.65.41.210
DigitalOcean

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://159.65.41.210/Windows-Security/files/microsoft.png
Requested by: Host: 159.65.41.210
URL: http://159.65.41.210/Windows-Security/?utm_source=rc&utm_medium=cpc&utm_term=85375&utm_content=mens_lifestyle
Protocol: HTTP/1.1
Server: 159.65.41.210 Dallas, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
Software: Apache/2.4.18 (Ubuntu) /
Resource Hash: 844a92ee435552f7f26b4ec467220c537841f8245a16bbb265975ce4b3081f36

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: 159.65.41.210
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://159.65.41.210/Windows-Security/?utm_source=rc&utm_medium=cpc&utm_term=85375&utm_content=mens_lifestyle
Connection: keep-alive
Cache-Control: no-cache
Referer: http://159.65.41.210/Windows-Security/?utm_source=rc&utm_medium=cpc&utm_term=85375&utm_content=mens_lifestyle
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Tue, 27 Mar 2018 22:05:53 GMT
Last-Modified: Tue, 27 Mar 2018 20:47:53 GMT
Server: Apache/2.4.18 (Ubuntu)
ETag: "3d1-5686b012479ef"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 977

GET
S 200 tcc_l.combined.1.0.6.min.js Show response
img1.wsimg.com/tcc/ 12 KB
5 KB 29ms
6ms Script
application/x-javascript 184.25.158.226
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://img1.wsimg.com/tcc/tcc_l.combined.1.0.6.min.js
Requested by: Host: 159.65.41.210
URL: http://159.65.41.210/Windows-Security/?utm_source=rc&utm_medium=cpc&utm_term=85375&utm_content=mens_lifestyle
Protocol: SPDY
Server: 184.25.158.226 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a184-25-158-226.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: aa5c1ec4d2ea00eb517eadeb3b65e55b577b7a5ed42d7c2611d15d9050c18350

Request headers

Referer: http://159.65.41.210/Windows-Security/?utm_source=rc&utm_medium=cpc&utm_term=85375&utm_content=mens_lifestyle
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

date: Tue, 27 Mar 2018 22:05:52 GMT
content-encoding: gzip
last-modified: Fri, 31 Mar 2017 16:26:41 GMT
status: 200
etag: "52ef5c943baad21:0"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
content-length: 4564
expires: Wed, 27 Mar 2019 22:05:52 GMT

GET
H/1.1 200
OK css.css
159.65.41.210/ 655 B
572 B 177ms
86ms Stylesheet
text/css 159.65.41.210
DigitalOcean

General

Check archive.org

Show headers Download Go to

Full URL: http://159.65.41.210/css.css
Requested by: Host: 159.65.41.210
URL: http://159.65.41.210/Windows-Security/?utm_source=rc&utm_medium=cpc&utm_term=85375&utm_content=mens_lifestyle
Protocol: HTTP/1.1
Server: 159.65.41.210 Dallas, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
Software: Apache/2.4.18 (Ubuntu) /
Resource Hash: c38865468ef3bc8fd6705dd62ff33fe740ab5726db9a582c9055a80730909f7a

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: 159.65.41.210
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: http://159.65.41.210/Windows-Security/?utm_source=rc&utm_medium=cpc&utm_term=85375&utm_content=mens_lifestyle
Connection: keep-alive
Cache-Control: no-cache
Referer: http://159.65.41.210/Windows-Security/?utm_source=rc&utm_medium=cpc&utm_term=85375&utm_content=mens_lifestyle
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Tue, 27 Mar 2018 22:05:52 GMT
Content-Encoding: gzip
Last-Modified: Tue, 27 Mar 2018 20:47:48 GMT
Server: Apache/2.4.18 (Ubuntu)
ETag: "28f-5686b00db5b33-gzip"
Vary: Accept-Encoding
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 236

GET
H/1.1 200
OK mem5YaGs126MiZpBA-UNirkOUuhs.ttf
159.65.41.210/s/opensans/v15/ 27 KB
27 KB 102ms
97ms Font
application/font-sfnt 159.65.41.210
DigitalOcean

General

Check archive.org

Show headers Download Go to

Full URL: http://159.65.41.210/s/opensans/v15/mem5YaGs126MiZpBA-UNirkOUuhs.ttf
Requested by: Host: 159.65.41.210
URL: http://159.65.41.210/Windows-Security/?utm_source=rc&utm_medium=cpc&utm_term=85375&utm_content=mens_lifestyle
Protocol: HTTP/1.1
Server: 159.65.41.210 Dallas, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
Software: Apache/2.4.18 (Ubuntu) /
Resource Hash: 74461248f0a3edd43acbe67fbd98bb8bc6f26bb6b2e8b948c4757724717bde5c

Request headers

Pragma: no-cache
Origin: http://159.65.41.210
Accept-Encoding: gzip, deflate
Host: 159.65.41.210
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept: */*
Referer: http://159.65.41.210/css.css
Connection: keep-alive
Cache-Control: no-cache
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Referer: http://159.65.41.210/css.css
Origin: http://159.65.41.210

Response headers

Date: Tue, 27 Mar 2018 22:05:52 GMT
Last-Modified: Tue, 27 Mar 2018 20:47:57 GMT
Server: Apache/2.4.18 (Ubuntu)
ETag: "6b68-5686b0166842b"
Content-Type: application/font-sfnt
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=97
Content-Length: 27496

GET
H/1.1 200
OK mem5YaGs126MiZpBA-UN7rgOUuhs.ttf
159.65.41.210/s/opensans/v15/ 28 KB
28 KB 172ms
86ms Font
application/font-sfnt 159.65.41.210
DigitalOcean

General

Check archive.org

Show headers Download Go to

Full URL: http://159.65.41.210/s/opensans/v15/mem5YaGs126MiZpBA-UN7rgOUuhs.ttf
Requested by: Host: 159.65.41.210
URL: http://159.65.41.210/Windows-Security/?utm_source=rc&utm_medium=cpc&utm_term=85375&utm_content=mens_lifestyle
Protocol: HTTP/1.1
Server: 159.65.41.210 Dallas, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
Software: Apache/2.4.18 (Ubuntu) /
Resource Hash: 0782a52179d0e25f19c39b43253795b25787d65abdbd8bfa38be0f21a4512748

Request headers

Pragma: no-cache
Origin: http://159.65.41.210
Accept-Encoding: gzip, deflate
Host: 159.65.41.210
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept: */*
Referer: http://159.65.41.210/css.css
Connection: keep-alive
Cache-Control: no-cache
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Referer: http://159.65.41.210/css.css
Origin: http://159.65.41.210

Response headers

Date: Tue, 27 Mar 2018 22:05:52 GMT
Last-Modified: Tue, 27 Mar 2018 20:47:57 GMT
Server: Apache/2.4.18 (Ubuntu)
ETag: "6e20-5686b0162bb6b"
Content-Type: application/font-sfnt
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 28192

GET
S 200 NaPecZTIAOhVxoMyOr9n_E7fdMPmDaZRbrw.woff2
fonts.gstatic.com/s/titilliumweb/v6/ 12 KB
12 KB 6ms
6ms Font
font/woff2 172.217.18.3
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/titilliumweb/v6/NaPecZTIAOhVxoMyOr9n_E7fdMPmDaZRbrw.woff2

Requested by

Host: 159.65.41.210
URL: http://159.65.41.210/Windows-Security/?utm_source=rc&utm_medium=cpc&utm_term=85375&utm_content=mens_lifestyle

Protocol

SPDY

Server

172.217.18.3 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra02s19-in-f3.1e100.net

Software

sffe /

Resource Hash

00eefad8cfe42f52ba984740be5df503849b4d4603913570d515db8f1bb1fffd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Titillium+Web:400,700
Origin: http://159.65.41.210

Response headers

date: Mon, 12 Feb 2018 18:28:05 GMT
x-content-type-options: nosniff
last-modified: Wed, 11 Oct 2017 18:27:30 GMT
server: sffe
age: 3728267
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: hq=":443"; ma=2592000; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="42,41,39,35"
content-length: 12252
x-xss-protection: 1; mode=block
expires: Tue, 12 Feb 2019 18:28:05 GMT

GET
H/1.1 206
Partial Content alertmicrosoft.mp3
159.65.41.210/Windows-Security/files/ 140 KB
140 KB 179ms
86ms Media
audio/mpeg 159.65.41.210
DigitalOcean

General

Check archive.org

Show headers Download Go to

Full URL: http://159.65.41.210/Windows-Security/files/alertmicrosoft.mp3
Requested by: Host: 159.65.41.210
URL: http://159.65.41.210/Windows-Security/?utm_source=rc&utm_medium=cpc&utm_term=85375&utm_content=mens_lifestyle
Protocol: HTTP/1.1
Server: 159.65.41.210 Dallas, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
Software: Apache/2.4.18 (Ubuntu) /
Resource Hash: 8dd75a13c2b410a988bccc7e5cbd38291e79d7f1f0c6f715109c8f66129edae4

Request headers

Pragma: no-cache
Accept-Encoding: identity;q=1, *;q=0
Host: 159.65.41.210
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
chrome-proxy: frfr
Accept: */*
Cache-Control: no-cache
Referer: http://159.65.41.210/Windows-Security/?utm_source=rc&utm_medium=cpc&utm_term=85375&utm_content=mens_lifestyle
Connection: keep-alive
Range: bytes=0-
Referer: http://159.65.41.210/Windows-Security/?utm_source=rc&utm_medium=cpc&utm_term=85375&utm_content=mens_lifestyle
Accept-Encoding: identity;q=1, *;q=0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Range: bytes=0-
chrome-proxy: frfr

Response headers

Date: Tue, 27 Mar 2018 22:05:53 GMT
Last-Modified: Tue, 27 Mar 2018 20:47:52 GMT
Server: Apache/2.4.18 (Ubuntu)
ETag: "2305d-5686b01157630"
Content-Type: audio/mpeg
Content-Range: bytes 0-143452/143453
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 143453

GET
H/1.1 206
Partial Content warning.mp3
159.65.41.210/Windows-Security/files/ 13 KB
14 KB 190ms
98ms Media
audio/mpeg 159.65.41.210
DigitalOcean

General

Check archive.org

Show headers Download Go to

Full URL: http://159.65.41.210/Windows-Security/files/warning.mp3
Requested by: Host: 159.65.41.210
URL: http://159.65.41.210/Windows-Security/?utm_source=rc&utm_medium=cpc&utm_term=85375&utm_content=mens_lifestyle
Protocol: HTTP/1.1
Server: 159.65.41.210 Dallas, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
Software: Apache/2.4.18 (Ubuntu) /
Resource Hash: f4d5cae00178437f63e868ded066dde7503207230142ab3c37ef8ca70a03574d

Request headers

Pragma: no-cache
Accept-Encoding: identity;q=1, *;q=0
Host: 159.65.41.210
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
chrome-proxy: frfr
Accept: */*
Cache-Control: no-cache
Referer: http://159.65.41.210/Windows-Security/?utm_source=rc&utm_medium=cpc&utm_term=85375&utm_content=mens_lifestyle
Connection: keep-alive
Range: bytes=0-
Referer: http://159.65.41.210/Windows-Security/?utm_source=rc&utm_medium=cpc&utm_term=85375&utm_content=mens_lifestyle
Accept-Encoding: identity;q=1, *;q=0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Range: bytes=0-
chrome-proxy: frfr

Response headers

Date: Tue, 27 Mar 2018 22:05:53 GMT
Last-Modified: Tue, 27 Mar 2018 20:47:54 GMT
Server: Apache/2.4.18 (Ubuntu)
ETag: "3565-5686b0137b3ce"
Content-Type: audio/mpeg
Content-Range: bytes 0-13668/13669
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 13669

GET
H/1.1 200
OK event
img.secureserver.net/t/1/tl/ 43 B
584 B 308ms
155ms Image
image/gif 45.40.130.22
GoDaddy.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://img.secureserver.net/t/1/tl/event?cts=1522188353342&tce=1522188352397&tcs=1522188352311&tdc=1522188353141&tdclee=1522188352877&tdcles=1522188352877&tdi=1522188352877&tdl=1522188352487&tdle=1522188352311&tdls=1522188352311&tfs=1522188352310&tns=1522188352310&trqs=1522188352397&tre=1522188352486&trps=1522188352485&tles=1522188353141&tlee=1522188353141&ht=perf&dh=159.65.41.210&ua=Mozilla%2F5.0%20(Macintosh%3B%20Intel%20Mac%20OS%20X%2010_12_6)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F63.0.3239.84%20Safari%2F537.36&vci=682229937&cv=1.0.6&z=984825004&vg=1f1ff641-3343-4d40-888e-06d979c1ee99&vtg=1f1ff641-3343-4d40-888e-06d979c1ee99&ap=cpsh&trfd=%7B%22cts%22%3A1522188352877%2C%22tccl.baseHost%22%3A%22secureserver.net%22%2C%22ap%22%3A%22cpsh%22%2C%22server%22%3A%22a2plcpnl0830%22%7D&dp=%2FWindows-Security
Protocol: HTTP/1.1
Server: 45.40.130.22 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US),
Reverse DNS: ip-45-40-130-22.ip.secureserver.net
Software: Microsoft-IIS/8.5 / ARR/2.5, ASP.NET
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Referer: http://159.65.41.210/Windows-Security/?utm_source=rc&utm_medium=cpc&utm_term=85375&utm_content=mens_lifestyle
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Tue, 27 Mar 2018 22:05:53 GMT
Server: Microsoft-IIS/8.5
X-Powered-By: ARR/2.5, ASP.NET
Access-Control-Max-Age: 1000
Access-Control-Allow-Methods: GET, PUT, POST, DELETE, OPTIONS
P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA"
Access-Control-Allow-Origin: http://159.65.41.210, *
Cache-Control: 0
Content-Type: image/gif
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept
Content-Length: 43

GET
S 200 NaPDcZTIAOhVxoMyOr9n_E7ffHjDGItzY5abuWI.woff2
fonts.gstatic.com/s/titilliumweb/v6/ 11 KB
11 KB 6ms
6ms Font
font/woff2 172.217.18.3
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/titilliumweb/v6/NaPDcZTIAOhVxoMyOr9n_E7ffHjDGItzY5abuWI.woff2

Protocol

SPDY

Server

172.217.18.3 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra02s19-in-f3.1e100.net

Software

sffe /

Resource Hash

d16b62e9833a9777233cdc8b707d56dc5fe4d50f1999fa677155a6a9ec504b64

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Titillium+Web:400,700
Origin: http://159.65.41.210

Response headers

date: Thu, 08 Feb 2018 18:39:15 GMT
x-content-type-options: nosniff
last-modified: Wed, 11 Oct 2017 18:26:23 GMT
server: sffe
age: 4073198
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: hq=":443"; ma=2592000; quic=51303432; quic=51303431; quic=51303339; quic=51303335,quic=":443"; ma=2592000; v="42,41,39,35"
content-length: 11612
x-xss-protection: 1; mode=block
expires: Fri, 08 Feb 2019 18:39:15 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Tech Support Scam (Consumer)

20 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	(Line 1) Message: City fails!!!

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.googleapis.com
fonts.gstatic.com
geoapi123.appspot.com
img.secureserver.net
img1.wsimg.com
159.65.41.210
172.217.18.3
184.25.158.226
216.58.206.10
216.58.206.20
45.40.130.22
00eefad8cfe42f52ba984740be5df503849b4d4603913570d515db8f1bb1fffd
0782a52179d0e25f19c39b43253795b25787d65abdbd8bfa38be0f21a4512748
24c1f8b80ecbe76a190b19501fff9df8235dca7908d6f696ff77789868c6a26c
3d49296055d42972e1275138fd3f5023fa2cf390a0e6617cf05e97a51d1eda39
74461248f0a3edd43acbe67fbd98bb8bc6f26bb6b2e8b948c4757724717bde5c
844a92ee435552f7f26b4ec467220c537841f8245a16bbb265975ce4b3081f36
8c5bc2da769a808653559f02db5f3dcf58a0a9ae69d14239a071e65a6b2d6e95
8dd75a13c2b410a988bccc7e5cbd38291e79d7f1f0c6f715109c8f66129edae4
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
aa5c1ec4d2ea00eb517eadeb3b65e55b577b7a5ed42d7c2611d15d9050c18350
b0a1cefd0513370a6e4d345229bc3f46e1bb554aca35079d0e23f844c4268fc2
c38865468ef3bc8fd6705dd62ff33fe740ab5726db9a582c9055a80730909f7a
cdf7514cdbd78bc816291cf8dd79afe06031315c94d0fbc5ec2a1a8490f11437
d16b62e9833a9777233cdc8b707d56dc5fe4d50f1999fa677155a6a9ec504b64
d299075f7b387d8a9db625fc10e23e409f4b59155a4125552ff8f97c221ff20a
f4d5cae00178437f63e868ded066dde7503207230142ab3c37ef8ca70a03574d

159.65.41.210 Open in urlscan Pro 159.65.41.210 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

16 Requests

0 %HTTPS

0 %IPv6

5 Domains

5 Subdomains

6 IPs

2 Countries

356 kBTransfer

426 kBSize

0 Cookies

0 Outgoing links

Redirected requests

16 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

20 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

159.65.41.210 Open in urlscan Pro
159.65.41.210 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

16
Requests

0 %
HTTPS

0 %
IPv6

5
Domains

5
Subdomains

6
IPs

2
Countries

356 kB
Transfer

426 kB
Size

0
Cookies

16 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!