68.183.57.150 Open in urlscan Pro
68.183.57.150 Malicious Activity! Public Scan

URL:
http://68.183.57.150/
Submission: On February 11 via manual (February 11th 2019, 4:48:42 pm UTC) from US

Summary HTTP 16 Redirects Behaviour Indicators

Summary

This website contacted 7 IPs in 2 countries across 5 domains to perform 16 HTTP transactions. The main IP is 68.183.57.150, located in Northridge, United States and belongs to DIGITALOCEAN-ASN - DigitalOcean, LLC, US. The main domain is 68.183.57.150.

This is the only time 68.183.57.150 was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic (Online) Tech Support Scam (Consumer)

Downloads These files were downloaded by the website

This computer is BLOCKED.html 24 KB text/html

SHA256: 0da5b3ccc49c5dbb11b0ceb71a4db2a18a268de3fe1a0680121ecc7acd36bf2c

MIME: HTML document, UTF-8 Unicode text, with very long lines

Domain & IP information

	IP Address	AS Autonomous System
9	68.183.57.150 68.183.57.150	14061 (DIGITALOC...) (DIGITALOCEAN-ASN - DigitalOcean)
2	209.197.3.15 209.197.3.15	20446 (HIGHWINDS3) (HIGHWINDS3 - Highwinds Network Group)
2	205.185.208.52 205.185.208.52	20446 (HIGHWINDS3) (HIGHWINDS3 - Highwinds Network Group)
1	2a00:1450:400... 2a00:1450:4001:808::200a	15169 (GOOGLE) (GOOGLE - Google LLC)
1	143.204.208.216 143.204.208.216	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1	34.239.81.37 34.239.81.37	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
16	7

9 68.183.57.150 (Northridge, United States)

ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US)

68.183.57.150	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 209.197.3.15 (Phoenix, United States)

ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US)
PTR: vip0x00f.map2.ssl.hwcdn.net

maxcdn.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 205.185.208.52 (Phoenix, United States)

ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US)
PTR: vip052.ssl.hwcdn.net

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:808::200a (Ireland)

ASN15169 (GOOGLE - Google LLC, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 143.204.208.216 (Wilmington, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-143-204-208-216.fra53.r.cloudfront.net

d2fuc4clr7gvcn.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.239.81.37 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-34-239-81-37.compute-1.amazonaws.com

track.gaug.es	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	jquery.com code.jquery.com	60 KB
2	bootstrapcdn.com maxcdn.bootstrapcdn.com	22 KB
1	gaug.es track.gaug.es	389 B
1	cloudfront.net d2fuc4clr7gvcn.cloudfront.net	2 KB
1	googleapis.com fonts.googleapis.com	2 KB
16	5

	Domain	Requested by
2	code.jquery.com	68.183.57.150
2	maxcdn.bootstrapcdn.com	68.183.57.150
1	track.gaug.es	68.183.57.150
1	d2fuc4clr7gvcn.cloudfront.net	68.183.57.150
1	fonts.googleapis.com	68.183.57.150
16	5

This site contains no links.

Subject Issuer	Validity	Valid
*.bootstrapcdn.com COMODO RSA Domain Validation Secure Server CA	`2018-10-03` - `2019-10-12`	a year	crt.sh
jquery.org COMODO RSA Domain Validation Secure Server CA	`2018-10-17` - `2020-10-16`	2 years	crt.sh
*.googleapis.com Google Internet Authority G3	`2019-01-23` - `2019-04-17`	3 months	crt.sh
*.cloudfront.net DigiCert Global CA G2	`2018-10-08` - `2019-10-09`	a year	crt.sh
*.gaug.es COMODO RSA Domain Validation Secure Server CA	`2018-01-31` - `2021-01-30`	3 years	crt.sh

This page contains 2 frames:

Primary Page: http://68.183.57.150/
Frame ID: 1C0CBFC3A9FDDA58CAD4C2C4D0B6C0AC
Requests: 15 HTTP requests in this frame

Frame: http://68.183.57.150/sound/err.mp3
Frame ID: 0912BA176D4EE9DF5609818DC02E63F9
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Gauges (Analytics) Expand

Overall confidence: 100%
Detected patterns

env /^_gauges$/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery(?:\-|\.)([\d.]*\d)[^\/]*\.js/i
script /jquery.*\.js/i
env /^jQuery$/i

Twitter Bootstrap () Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]+?href="[^"]+bootstrap(?:\.min)?\.css/i

Page Statistics

16
Requests

38 %
HTTPS

17 %
IPv6

5
Domains

5
Subdomains

7
IPs

2
Countries

682 kB
Transfer

993 kB
Size

6
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

16 HTTP transactions
8 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
68.183.57.150/ 24 KB
9 KB 208ms
106ms Document
text/html 68.183.57.150
DigitalOcean

General

Check archive.org

Show headers Download Go to

Full URL: http://68.183.57.150/
Protocol: HTTP/1.1
Server: 68.183.57.150 Northridge, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
Software: nginx /
Resource Hash: 0da5b3ccc49c5dbb11b0ceb71a4db2a18a268de3fe1a0680121ecc7acd36bf2c

Request headers

Host: 68.183.57.150
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Server: nginx
Date: Mon, 11 Feb 2019 16:48:26 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Last-Modified: Mon, 11 Feb 2019 13:11:37 GMT
ETag: W/"610f-5819e0c7c835e"
Content-Encoding: gzip

GET
H2 200 bootstrap.min.css
maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/ 118 KB
20 KB 68ms
19ms Stylesheet
text/css 209.197.3.15
Highwinds Network...

General

Check archive.org

Show headers Download Go to

Full URL: https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css
Requested by: Host: 68.183.57.150
URL: http://68.183.57.150/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 209.197.3.15 Phoenix, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS: vip0x00f.map2.ssl.hwcdn.net
Software: /
Resource Hash: f75e846cc83bd11432f4b1e21a45f31bc85283d11d372f7b19accd1bf6a2635c

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: http://68.183.57.150/
Origin: http://68.183.57.150

Response headers

date: Mon, 11 Feb 2019 16:48:26 GMT
content-encoding: gzip
last-modified: Wed, 12 Dec 2018 18:34:07 GMT
access-control-allow-origin: *
etag: "1544639647"
vary: Accept-Encoding
x-cache: HIT
content-type: text/css; charset=utf-8
status: 200
cache-control: public, max-age=31536000
x-hello-human: Say hello back! @getBootstrapCDN on Twitter
accept-ranges: bytes
timing-allow-origin: *
content-length: 19740

GET
H2 200 bootstrap-theme.min.css
maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/ 23 KB
3 KB 69ms
19ms Stylesheet
text/css 209.197.3.15
Highwinds Network...

General

Check archive.org

Show headers Download Go to

Full URL: https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap-theme.min.css
Requested by: Host: 68.183.57.150
URL: http://68.183.57.150/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 209.197.3.15 Phoenix, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS: vip0x00f.map2.ssl.hwcdn.net
Software: /
Resource Hash: 653e073e97423adda5bc3917a241ee8497dd38a48f14bcde0098a4e54fd0fa5e

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: http://68.183.57.150/
Origin: http://68.183.57.150

Response headers

date: Mon, 11 Feb 2019 16:48:26 GMT
content-encoding: gzip
last-modified: Wed, 12 Dec 2018 18:34:07 GMT
access-control-allow-origin: *
etag: "1544639647"
vary: Accept-Encoding
x-cache: HIT
content-type: text/css; charset=utf-8
status: 200
cache-control: public, max-age=31536000
x-hello-human: Say hello back! @getBootstrapCDN on Twitter
accept-ranges: bytes
timing-allow-origin: *
content-length: 2776

GET
H/1.1 200
OK style.css
68.183.57.150/css/ 4 KB
2 KB 105ms
103ms Stylesheet
text/css 68.183.57.150
DigitalOcean

General

Check archive.org

Show headers Download Go to

Full URL: http://68.183.57.150/css/style.css
Requested by: Host: 68.183.57.150
URL: http://68.183.57.150/
Protocol: HTTP/1.1
Server: 68.183.57.150 Northridge, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
Software: nginx /
Resource Hash: 4ac2980bc9e19d2e8d86d2c569157e306603602fc5afb706327f4d1062b63d36

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: 68.183.57.150
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: http://68.183.57.150/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://68.183.57.150/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 11 Feb 2019 16:48:26 GMT
Content-Encoding: gzip
Last-Modified: Mon, 11 Feb 2019 13:11:51 GMT
Server: nginx
ETag: W/"1036-5819e0d52e1e8"
Vary: Accept-Encoding
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive

GET
H/1.1 200
OK support.svg
68.183.57.150/images/ 16 KB
5 KB 177ms
89ms Image
image/svg+xml 68.183.57.150
DigitalOcean

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://68.183.57.150/images/support.svg
Requested by: Host: 68.183.57.150
URL: http://68.183.57.150/
Protocol: HTTP/1.1
Server: 68.183.57.150 Northridge, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
Software: nginx /
Resource Hash: ea2cefd1f0e8aaac01aa58121d8e5e763b42965325b97f11ba504bf8e1ed8081

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: 68.183.57.150
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://68.183.57.150/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://68.183.57.150/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 11 Feb 2019 16:48:26 GMT
Content-Encoding: gzip
Last-Modified: Mon, 11 Feb 2019 13:11:48 GMT
Server: nginx
ETag: W/"3eaf-5819e0d1b36f6"
Vary: Accept-Encoding
Content-Type: image/svg+xml
Transfer-Encoding: chunked
Connection: keep-alive

GET
H/1.1 200
OK 335158-windows-8-window.png
68.183.57.150/images/ 103 KB
104 KB 177ms
89ms Image
image/png 68.183.57.150
DigitalOcean

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://68.183.57.150/images/335158-windows-8-window.png
Requested by: Host: 68.183.57.150
URL: http://68.183.57.150/
Protocol: HTTP/1.1
Server: 68.183.57.150 Northridge, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
Software: nginx /
Resource Hash: 5413d6d070d30c2841ce2854ea35190be38eead330ea4cecae3e8a2424bc2681

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: 68.183.57.150
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://68.183.57.150/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://68.183.57.150/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 11 Feb 2019 16:48:26 GMT
Last-Modified: Mon, 11 Feb 2019 13:11:46 GMT
Server: nginx
ETag: "19d29-5819e0d044393"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 105769

GET
H/1.1 200
OK jquery-3.3.1.min.js Show response
code.jquery.com/ 85 KB
30 KB 41ms
18ms Script
application/javascript 205.185.208.52
Highwinds Network...

General

Check archive.org

Show headers Download Go to

Full URL: http://code.jquery.com/jquery-3.3.1.min.js
Requested by: Host: 68.183.57.150
URL: http://68.183.57.150/
Protocol: HTTP/1.1
Server: 205.185.208.52 Phoenix, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS: vip052.ssl.hwcdn.net
Software: nginx /
Resource Hash: 160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: http://68.183.57.150/
Origin: http://68.183.57.150

Response headers

Date: Mon, 11 Feb 2019 16:48:26 GMT
Content-Encoding: gzip
Last-Modified: Sat, 20 Jan 2018 17:26:44 GMT
Server: nginx
ETag: "5a637bd4-1538f"
Vary: Accept-Encoding
X-HW: 1549903706.dop007.pa1.t,1549903706.cds033.pa1.c
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=315360000, public
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 30288

GET
H/1.1 200
OK jquery-3.3.1.min.js Show response
code.jquery.com/ 85 KB
30 KB 58ms
19ms Script
application/javascript 205.185.208.52
Highwinds Network...

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.3.1.min.js
Requested by: Host: 68.183.57.150
URL: http://68.183.57.150/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 205.185.208.52 Phoenix, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS: vip052.ssl.hwcdn.net
Software: nginx /
Resource Hash: 160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: http://68.183.57.150/
Origin: http://68.183.57.150

Response headers

Date: Mon, 11 Feb 2019 16:48:26 GMT
Content-Encoding: gzip
Last-Modified: Sat, 20 Jan 2018 17:26:44 GMT
Server: nginx
ETag: W/"5a637bd4-1538f"
Vary: Accept-Encoding
X-HW: 1549903706.dop013.pa1.shc,1549903706.dop013.pa1.t,1549903706.cds033.pa1.c
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=315360000, public
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 30288

GET
H/1.1 200
OK script.js Show response
68.183.57.150/js/ 8 KB
2 KB 105ms
104ms Script
application/javascript 68.183.57.150
DigitalOcean

General

Check archive.org

Show headers Download Go to

Full URL: http://68.183.57.150/js/script.js
Requested by: Host: 68.183.57.150
URL: http://68.183.57.150/
Protocol: HTTP/1.1
Server: 68.183.57.150 Northridge, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
Software: nginx /
Resource Hash: 41ae6129a5b555a62d882ea0d19bb1e01106f3696fa1f566f3844db874d38e38

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: 68.183.57.150
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: */*
Referer: http://68.183.57.150/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://68.183.57.150/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 11 Feb 2019 16:48:26 GMT
Content-Encoding: gzip
Last-Modified: Mon, 11 Feb 2019 13:11:43 GMT
Server: nginx
ETag: W/"1ee7-5819e0ccb1201"
Vary: Accept-Encoding
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive

GET
H2 200 css
fonts.googleapis.com/ 33 KB
2 KB 19ms
18ms Stylesheet
text/css 2a00:1450:4001:808::200a
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: 68.183.57.150
URL: http://68.183.57.150/

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:808::200a , Ireland, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

38d779f1251e75f224c215b990a644317cc6cf2c480b048901f58eb5987b1653

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: http://68.183.57.150/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Mon, 11 Feb 2019 16:48:26 GMT
server: ESF
access-control-allow-origin: *
date: Mon, 11 Feb 2019 16:48:26 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
status: 200
alt-svc: quic=":443"; ma=2592000; v="44,43,39"
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
x-xss-protection: 1; mode=block
expires: Mon, 11 Feb 2019 16:48:26 GMT

GET
H/1.1 200
OK background.png
68.183.57.150/images/ 82 KB
82 KB 129ms
89ms Image
image/png 68.183.57.150
DigitalOcean

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://68.183.57.150/images/background.png
Requested by: Host: 68.183.57.150
URL: http://68.183.57.150/
Protocol: HTTP/1.1
Server: 68.183.57.150 Northridge, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
Software: nginx /
Resource Hash: bee4c2f32eccd96fd70d0a31ade0cfa39e9ba0979eb9a0b98f09cb4279b143d8

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: 68.183.57.150
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://68.183.57.150/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://68.183.57.150/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 11 Feb 2019 16:48:26 GMT
Last-Modified: Mon, 11 Feb 2019 13:11:47 GMT
Server: nginx
ETag: "14625-5819e0d0df81d"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 83493

GET
DATA 200
OK truncated
/ 239 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bd08b9849632e73574f62ca80572a17f9bbd9bb1010fe8c6380e641460abd96c

Request headers

Response headers

Content-Type: image/png

GET
H/1.1 206
Partial Content err.mp3
68.183.57.150/sound/ 196 KB
196 KB 169ms
103ms Media
audio/mpeg 68.183.57.150
DigitalOcean

General

Check archive.org

Show headers Download Go to

Full URL: http://68.183.57.150/sound/err.mp3
Requested by: Host: 68.183.57.150
URL: http://68.183.57.150/
Protocol: HTTP/1.1
Server: 68.183.57.150 Northridge, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
Software: nginx /
Resource Hash: fc59bbb18f923747b9cd3f3b23537ff09c5ad2fdfc1505a4800a3f269a234e65

Request headers

Pragma: no-cache
Accept-Encoding: identity;q=1, *;q=0
Host: 68.183.57.150
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
chrome-proxy: frfr
Accept: */*
Cache-Control: no-cache
Referer: http://68.183.57.150/
Connection: keep-alive
Range: bytes=0-
Referer: http://68.183.57.150/
Accept-Encoding: identity;q=1, *;q=0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Range: bytes=0-
chrome-proxy: frfr

Response headers

Date: Mon, 11 Feb 2019 16:48:26 GMT
Last-Modified: Mon, 11 Feb 2019 13:11:42 GMT
Server: nginx
ETag: "31080-5819e0cc1ab9a"
Content-Type: audio/mpeg
Content-Range: bytes 0-200831/200832
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 200832

GET
H2 200 track.js Show response
d2fuc4clr7gvcn.cloudfront.net/ 4 KB
2 KB 53ms
8ms Script
application/javascript 143.204.208.216
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://d2fuc4clr7gvcn.cloudfront.net/track.js
Requested by: Host: 68.183.57.150
URL: http://68.183.57.150/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 143.204.208.216 Wilmington, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-143-204-208-216.fra53.r.cloudfront.net
Software: nginx/1.10.3 (Ubuntu) /
Resource Hash: 33feb1429eef1b60bb87733edac8280636a822a29a902c6fa9d6af8b20a1b4aa

Request headers

Referer: http://68.183.57.150/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Mon, 11 Feb 2019 02:12:48 GMT
content-encoding: gzip
last-modified: Wed, 14 Nov 2018 10:53:00 GMT
server: nginx/1.10.3 (Ubuntu)
age: 101746
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
status: 200
x-amz-cf-id: EkSLGXa_HMRDf7LVszSQek0KXgICEsCEiJFvBXiMndloMq_L_A3mOA==
via: 1.1 12c16baed6578bf50fb0eaa233f2bc84.cloudfront.net (CloudFront)

GET
H/1.1 200
OK err.mp3
68.183.57.150/sound/ Frame 0912 12 KB
0 89ms
88ms Document
audio/mpeg 68.183.57.150
DigitalOcean

General

Check archive.org

Show headers Download Go to

Full URL: http://68.183.57.150/sound/err.mp3
Requested by: Host: 68.183.57.150
URL: http://68.183.57.150/
Protocol: HTTP/1.1
Server: 68.183.57.150 Northridge, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Host: 68.183.57.150
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: http://68.183.57.150/
Accept-Encoding: gzip, deflate
Cookie: _gauges_cookie=1; _gauges_unique_hour=1; _gauges_unique_day=1; _gauges_unique_month=1; _gauges_unique_year=1; _gauges_unique=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: http://68.183.57.150/

Response headers

Server: nginx
Date: Mon, 11 Feb 2019 16:48:26 GMT
Content-Type: audio/mpeg
Content-Length: 200832
Connection: keep-alive
Last-Modified: Mon, 11 Feb 2019 13:11:42 GMT
ETag: "31080-5819e0cc1ab9a"
Accept-Ranges: bytes

GET
H/1.1 200
OK track.gif
track.gaug.es/ 35 B
389 B 504ms
160ms Image
image/gif 34.239.81.37
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.gaug.es/track.gif?h[site_id]=5c616f8d70e46a1906daf666&h[resource]=http%3A%2F%2F68.183.57.150%2F&h[referrer]=&h[title]=Microsoft%20Official%20Support&h[user_agent]=Mozilla%2F5.0%20(Macintosh%3B%20Intel%20Mac%20OS%20X%2010_13_5)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F67.0.3396.87%20Safari%2F537.36&h[unique]=1&h[unique_hour]=1&h[unique_day]=1&h[unique_month]=1&h[unique_year]=1&h[screenx]=1600&h[browserx]=1600&h[browsery]=1200&timestamp=1549903706317

Requested by

Host: 68.183.57.150
URL: http://68.183.57.150/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.239.81.37 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-34-239-81-37.compute-1.amazonaws.com

Software

nginx/1.10.3 (Ubuntu) /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://68.183.57.150/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 11 Feb 2019 16:48:26 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 11 Feb 2019 16:48:26 GMT
Server: nginx/1.10.3 (Ubuntu)
Content-Type: image/gif
Cache-Control: no-store, no-cache, must-revalidate, private
Connection: keep-alive
Content-Length: 35
Expires: Sat, 25 Nov 2000 05:00:00 GMT

GET
DATA 200
OK truncated
/ Frame 0912 2 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9d02d662da8a47fb5fb610b545007507b6017028043dbb63cd09ec897d3b9627

Request headers

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 0912 715 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5a3f1dd74233f605e511f1b5b244bedf85ac88ba264caf4d6401bc7ec2017dcd

Request headers

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 0912 178 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3ee0806e69f2ae70a2267a58ac5fc5d52b5aa7aca6f3c0c08adad605fd8fbc16

Request headers

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ Frame 0912 352 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5f3592a8b8037ea064764a2815799612063c6722d314d1d66d3a9391c3c16d66

Request headers

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ Frame 0912 299 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a3d5b21692435e785aa0e698356735093bb93f6c2f61410c49761ee2448f7289

Request headers

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ Frame 0912 243 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9d2d8043c302d3a9da9277374a53e2285c471d5dc8397885b4931b82771d5cae

Request headers

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ Frame 0912 381 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 63271dcce1a2518271ecc2b0bdcc5afc9c5f0968a8635e0f97a4c9747309eb82

Request headers

Response headers

Content-Type: image/svg+xml

GET
H/1.1 206
Partial Content err.mp3
68.183.57.150/sound/ Frame 0912 196 KB
196 KB 91ms
90ms Media
audio/mpeg 68.183.57.150
DigitalOcean

General

Check archive.org

Show headers Download Go to

Full URL: http://68.183.57.150/sound/err.mp3
Requested by: Host: 68.183.57.150
URL: http://68.183.57.150/
Protocol: HTTP/1.1
Server: 68.183.57.150 Northridge, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
Software: nginx /
Resource Hash: fc59bbb18f923747b9cd3f3b23537ff09c5ad2fdfc1505a4800a3f269a234e65

Request headers

Pragma: no-cache
Accept-Encoding: identity;q=1, *;q=0
Host: 68.183.57.150
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
chrome-proxy: frfr
Accept: */*
Cache-Control: no-cache
Referer: http://68.183.57.150/sound/err.mp3
Cookie: _gauges_cookie=1; _gauges_unique_hour=1; _gauges_unique_day=1; _gauges_unique_month=1; _gauges_unique_year=1; _gauges_unique=1
Connection: keep-alive
Range: bytes=0-
Referer: http://68.183.57.150/sound/err.mp3
Accept-Encoding: identity;q=1, *;q=0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Range: bytes=0-
chrome-proxy: frfr

Response headers

Date: Mon, 11 Feb 2019 16:48:26 GMT
Last-Modified: Mon, 11 Feb 2019 13:11:42 GMT
Server: nginx
ETag: "31080-5819e0cc1ab9a"
Content-Type: audio/mpeg
Content-Range: bytes 0-200831/200832
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 200832

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic (Online) Tech Support Scam (Consumer)

29 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

6 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
68.183.57.150/	1970-01-19 07:17:19	Name: _gauges_unique_year Value: 1
68.183.57.150/	1970-01-18 23:16:22	Name: _gauges_unique_month Value: 1
68.183.57.150/	1970-01-18 22:33:10	Name: _gauges_unique_day Value: 1
68.183.57.150/	1970-01-18 22:31:47	Name: _gauges_unique_hour Value: 1
68.183.57.150/	1970-01-19 07:17:19	Name: _gauges_unique Value: 1
68.183.57.150/	1970-01-18 22:31:43	Name: _gauges_cookie Value: 1

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

code.jquery.com
d2fuc4clr7gvcn.cloudfront.net
fonts.googleapis.com
maxcdn.bootstrapcdn.com
track.gaug.es
143.204.208.216
205.185.208.52
209.197.3.15
2a00:1450:4001:808::200a
34.239.81.37
68.183.57.150
0da5b3ccc49c5dbb11b0ceb71a4db2a18a268de3fe1a0680121ecc7acd36bf2c
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
33feb1429eef1b60bb87733edac8280636a822a29a902c6fa9d6af8b20a1b4aa
38d779f1251e75f224c215b990a644317cc6cf2c480b048901f58eb5987b1653
3ee0806e69f2ae70a2267a58ac5fc5d52b5aa7aca6f3c0c08adad605fd8fbc16
41ae6129a5b555a62d882ea0d19bb1e01106f3696fa1f566f3844db874d38e38
4ac2980bc9e19d2e8d86d2c569157e306603602fc5afb706327f4d1062b63d36
5413d6d070d30c2841ce2854ea35190be38eead330ea4cecae3e8a2424bc2681
5a3f1dd74233f605e511f1b5b244bedf85ac88ba264caf4d6401bc7ec2017dcd
5f3592a8b8037ea064764a2815799612063c6722d314d1d66d3a9391c3c16d66
63271dcce1a2518271ecc2b0bdcc5afc9c5f0968a8635e0f97a4c9747309eb82
653e073e97423adda5bc3917a241ee8497dd38a48f14bcde0098a4e54fd0fa5e
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
9d02d662da8a47fb5fb610b545007507b6017028043dbb63cd09ec897d3b9627
9d2d8043c302d3a9da9277374a53e2285c471d5dc8397885b4931b82771d5cae
a3d5b21692435e785aa0e698356735093bb93f6c2f61410c49761ee2448f7289
bd08b9849632e73574f62ca80572a17f9bbd9bb1010fe8c6380e641460abd96c
bee4c2f32eccd96fd70d0a31ade0cfa39e9ba0979eb9a0b98f09cb4279b143d8
ea2cefd1f0e8aaac01aa58121d8e5e763b42965325b97f11ba504bf8e1ed8081
f75e846cc83bd11432f4b1e21a45f31bc85283d11d372f7b19accd1bf6a2635c
fc59bbb18f923747b9cd3f3b23537ff09c5ad2fdfc1505a4800a3f269a234e65

68.183.57.150 Open in urlscan Pro 68.183.57.150 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Downloads These files were downloaded by the website

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

16 Requests

38 %HTTPS

17 %IPv6

5 Domains

5 Subdomains

7 IPs

2 Countries

682 kBTransfer

993 kBSize

6 Cookies

0 Outgoing links

Redirected requests

16 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 8 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

29 JavaScript Global Variables

6 Cookies

Indicators

68.183.57.150 Open in urlscan Pro
68.183.57.150 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

16
Requests

38 %
HTTPS

17 %
IPv6

5
Domains

5
Subdomains

7
IPs

2
Countries

682 kB
Transfer

993 kB
Size

6
Cookies

16 HTTP transactions
8 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!