nujohuol34.club
Open in
urlscan Pro
107.180.47.3
Malicious Activity!
Public Scan
Effective URL: http://nujohuol34.club/chrome/?a=0002&source=106064_107821_731876__4kstreams.net
Submission: On June 16 via manual from US
Summary
This is the only time nujohuol34.club was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Tech Support Scam (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 4 | 107.180.47.3 107.180.47.3 | 26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com) | |
1 | 172.217.18.168 172.217.18.168 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
1 | 172.217.22.42 172.217.22.42 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
1 | 184.25.158.226 184.25.158.226 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
1 2 | 172.217.18.174 172.217.18.174 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
1 | 74.125.140.154 74.125.140.154 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
1 | 45.40.130.22 45.40.130.22 | 26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com) | |
9 | 7 |
ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US)
PTR: ip-107-180-47-3.ip.secureserver.net
nujohuol34.club |
ASN15169 (GOOGLE - Google LLC, US)
PTR: fra15s29-in-f8.1e100.net
www.googletagmanager.com |
ASN15169 (GOOGLE - Google LLC, US)
PTR: fra15s16-in-f10.1e100.net
ajax.googleapis.com |
ASN20940 (AKAMAI-ASN1, US)
PTR: a184-25-158-226.deploy.static.akamaitechnologies.com
img1.wsimg.com |
ASN15169 (GOOGLE - Google LLC, US)
PTR: fra15s29-in-f14.1e100.net
www.google-analytics.com |
ASN15169 (GOOGLE - Google LLC, US)
PTR: wq-in-f154.1e100.net
stats.g.doubleclick.net |
ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US)
PTR: ip-45-40-130-22.ip.secureserver.net
img.secureserver.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
4 |
nujohuol34.club
1 redirects
nujohuol34.club |
18 KB |
2 |
google-analytics.com
1 redirects
www.google-analytics.com |
14 KB |
1 |
secureserver.net
img.secureserver.net |
586 B |
1 |
doubleclick.net
stats.g.doubleclick.net |
102 B |
1 |
wsimg.com
img1.wsimg.com |
5 KB |
1 |
googleapis.com
ajax.googleapis.com |
34 KB |
1 |
googletagmanager.com
www.googletagmanager.com |
24 KB |
9 | 7 |
Domain | Requested by | |
---|---|---|
4 | nujohuol34.club |
1 redirects
nujohuol34.club
|
2 | www.google-analytics.com |
1 redirects
www.googletagmanager.com
|
1 | img.secureserver.net | |
1 | stats.g.doubleclick.net |
nujohuol34.club
|
1 | img1.wsimg.com |
nujohuol34.club
|
1 | ajax.googleapis.com |
nujohuol34.club
|
1 | www.googletagmanager.com |
nujohuol34.club
|
9 | 7 |
This site contains no links.
Subject Issuer | Validity | Valid |
---|
This page contains 1 frames:
Primary Page:
http://nujohuol34.club/chrome/?a=0002&source=106064_107821_731876__4kstreams.net
Frame ID: 3D8C4A443DFEE8DB21DB0D266480A151
Requests: 9 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://nujohuol34.club/?a=0002&source=106064_107821_731876__4kstreams.net
HTTP 302
http://nujohuol34.club/chrome/?a=0002&source=106064_107821_731876__4kstreams.net Page URL
Detected technologies
Apache (Web Servers) ExpandDetected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
Google Analytics (Analytics) Expand
Detected patterns
- script /google-analytics\.com\/(?:ga|urchin|(analytics))\.js/i
- env /^gaGlobal$/i
Google Tag Manager (Tag Managers) Expand
Detected patterns
- env /^google_tag_manager$/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
- script /jquery.*\.js/i
- env /^jQuery$/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://nujohuol34.club/?a=0002&source=106064_107821_731876__4kstreams.net
HTTP 302
http://nujohuol34.club/chrome/?a=0002&source=106064_107821_731876__4kstreams.net Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 6- https://www.google-analytics.com/r/collect?v=1&_v=j68&a=1739554619&t=pageview&_s=1&dl=http%3A%2F%2Fnujohuol34.club%2Fchrome%2F%3Fa%3D0002%26source%3D106064_107821_731876__4kstreams.net&ul=en-us&de=UTF-8&dt=Security%20Warning&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAUAB~&jid=1825026808&gjid=765552812&cid=818315742.1529114183&tid=UA-83791121-8&_gid=2017435441.1529114183&_r=1>m=u64&z=948359876 HTTP 302
- https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-83791121-8&cid=818315742.1529114183&jid=1825026808&_gid=2017435441.1529114183&gjid=765552812&_v=j68&z=948359876
9 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
nujohuol34.club/chrome/ Redirect Chain
|
18 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
js
www.googletagmanager.com/gtag/ |
69 KB 24 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/1.12.2/ |
95 KB 34 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
defender.png
nujohuol34.club/chrome/files/ |
13 KB 13 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
tcc_l.combined.1.0.6.min.js
img1.wsimg.com/tcc/ |
12 KB 5 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
analytics.js
www.google-analytics.com/ |
34 KB 14 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Texts.mp3
nujohuol34.club/chrome/files/ |
134 KB 0 |
Media
audio/mpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
collect
stats.g.doubleclick.net/r/ Redirect Chain
|
35 B 102 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
event
img.secureserver.net/t/1/tl/ |
43 B 586 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Tech Support Scam (Consumer)36 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| gtag object| dataLayer object| google_tag_manager string| GoogleAnalyticsObject function| ga function| $ function| jQuery object| _0x4797 object| _0xf4d2 string| stroka string| urrl object| _0x5759 function| openBrowser function| toggleFullScreen object| _0x2bf1 object| _0x2290 object| _0x80f8 object| _0xda4c object| _0x4b34 object| _0xc711 function| nocontextmenu function| norightclick object| _0x96ec string| params object| _0xa5f6 function| confirmExit object| _trfd function| tcg function| tcp object| perfhandler object| TCCTracker object| _trfq object| true object| gaplugins object| gaGlobal object| gaData3 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.nujohuol34.club/ | Name: _gid Value: GA1.2.2017435441.1529114183 |
|
.nujohuol34.club/ | Name: _gat_gtag_UA_83791121_8 Value: 1 |
|
.nujohuol34.club/ | Name: _ga Value: GA1.2.818315742.1529114183 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
img.secureserver.net
img1.wsimg.com
nujohuol34.club
stats.g.doubleclick.net
www.google-analytics.com
www.googletagmanager.com
107.180.47.3
172.217.18.168
172.217.18.174
172.217.22.42
184.25.158.226
45.40.130.22
74.125.140.154
304d823a11896041fbd1bbf80e7b81300807e75cfb1466b7a42deb3fa262296a
3fab1c883847e4b5a02f3749a9f4d9eab15cd4765873d3b2904a1a4c8755fba3
7ce2ae13d717596ff63a6d0694e87f94d96246a2d5fa7d8d153fb17af7d0d42d
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
95914789b5f3307a3718679e867d61b9d4c03f749cd2e2970570331d7d6c8ed9
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
aa5c1ec4d2ea00eb517eadeb3b65e55b577b7a5ed42d7c2611d15d9050c18350
c4214d230bdf5ec9f5a77877a57816c0f1190d17d82ac11b4b03694fd2c99b04