tbgpz.club
Open in
urlscan Pro
2606:4700:30::6818:63b2
Malicious Activity!
Public Scan
Effective URL: https://tbgpz.club/ry9itcrgwu/z3uaw90it3/xxysd2oruk/?p_x=
Submission: On July 26 via manual from US
Summary
TLS certificate: Issued by CloudFlare Inc ECC CA-2 on July 24th 2019. Valid for: a year.
This is the only time tbgpz.club was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic (Online) Tech Support Scam (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 2606:4700:30:... 2606:4700:30::681b:a10d | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
11 | 2606:4700:30:... 2606:4700:30::6818:63b2 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
1 | 2a00:1450:400... 2a00:1450:4001:824::2008 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
1 | 2a00:1450:400... 2a00:1450:4001:815::200a | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
1 | 209.197.3.15 209.197.3.15 | 20446 (HIGHWINDS3) (HIGHWINDS3 - Highwinds Network Group) | |
2 | 2a00:1450:400... 2a00:1450:4001:81e::200e | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
17 | 7 |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
zzscw.club |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
tbgpz.club |
ASN15169 (GOOGLE - Google LLC, US)
www.googletagmanager.com |
ASN15169 (GOOGLE - Google LLC, US)
ajax.googleapis.com |
ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US)
PTR: vip0x00f.map2.ssl.hwcdn.net
maxcdn.bootstrapcdn.com |
ASN15169 (GOOGLE - Google LLC, US)
www.google-analytics.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
11 |
tbgpz.club
tbgpz.club |
268 KB |
2 |
google-analytics.com
www.google-analytics.com |
17 KB |
1 |
bootstrapcdn.com
maxcdn.bootstrapcdn.com |
10 KB |
1 |
googleapis.com
ajax.googleapis.com |
30 KB |
1 |
googletagmanager.com
www.googletagmanager.com |
26 KB |
1 |
zzscw.club
zzscw.club |
587 B |
17 | 6 |
Domain | Requested by | |
---|---|---|
11 | tbgpz.club |
zzscw.club
tbgpz.club |
2 | www.google-analytics.com |
www.googletagmanager.com
tbgpz.club |
1 | maxcdn.bootstrapcdn.com |
tbgpz.club
|
1 | ajax.googleapis.com |
tbgpz.club
|
1 | www.googletagmanager.com |
tbgpz.club
|
1 | zzscw.club | |
17 | 6 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni.cloudflaressl.com CloudFlare Inc ECC CA-2 |
2019-07-24 - 2020-07-23 |
a year | crt.sh |
*.google-analytics.com Google Internet Authority G3 |
2019-07-02 - 2019-09-24 |
3 months | crt.sh |
*.googleapis.com Google Internet Authority G3 |
2019-06-18 - 2019-09-10 |
3 months | crt.sh |
*.bootstrapcdn.com COMODO RSA Domain Validation Secure Server CA |
2018-10-03 - 2019-10-12 |
a year | crt.sh |
This page contains 2 frames:
Primary Page:
https://tbgpz.club/ry9itcrgwu/z3uaw90it3/xxysd2oruk/?p_x=
Frame ID: 5C6DB1984E16ABE82EA76F7BA5CFFFF9
Requests: 16 HTTP requests in this frame
Frame:
https://tbgpz.club/ry9itcrgwu/z3uaw90it3/xxysd2oruk/beep.mp3
Frame ID: A4BA36D605F55F6F207D9FB4A8EC1436
Requests: 2 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
- http://zzscw.club/jj.php?p_n=1%20(844)%20876%203112 Page URL
- https://tbgpz.club/ry9itcrgwu/z3uaw90it3/?p_x= Page URL
- https://tbgpz.club/ry9itcrgwu/z3uaw90it3/xxysd2oruk/?p_x= Page URL
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- url /\.php(?:$|\?)/i
Bootstrap (Web Frameworks) Expand
Detected patterns
- script /(?:\/([\d.]+))?(?:\/js)?\/bootstrap(?:\.min)?\.js/i
CloudFlare (CDN) Expand
Detected patterns
- headers server /^cloudflare$/i
Google Analytics (Analytics) Expand
Detected patterns
- script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- http://zzscw.club/jj.php?p_n=1%20(844)%20876%203112 Page URL
- https://tbgpz.club/ry9itcrgwu/z3uaw90it3/?p_x= Page URL
- https://tbgpz.club/ry9itcrgwu/z3uaw90it3/xxysd2oruk/?p_x= Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
17 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Cookie set
jj.php
zzscw.club/ |
182 B 587 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
tbgpz.club/ry9itcrgwu/z3uaw90it3/ |
1 KB 719 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
/
tbgpz.club/ry9itcrgwu/z3uaw90it3/xxysd2oruk/ |
10 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
www.googletagmanager.com/gtag/ |
68 KB 26 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
style.min.css
tbgpz.club/ry9itcrgwu/z3uaw90it3/xxysd2oruk/ |
4 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
index.css
tbgpz.club/ry9itcrgwu/z3uaw90it3/xxysd2oruk/ |
2 KB 678 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.3.1/ |
85 KB 30 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.js
maxcdn.bootstrapcdn.com/bootstrap/3.4.0/js/ |
37 KB 10 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
apple.png
tbgpz.club/ry9itcrgwu/z3uaw90it3/xxysd2oruk/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.js
tbgpz.club/ry9itcrgwu/z3uaw90it3/xxysd2oruk/js/ |
3 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
analytics.js
www.google-analytics.com/ |
43 KB 17 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
background.png
tbgpz.club/ry9itcrgwu/z3uaw90it3/xxysd2oruk/ |
43 KB 43 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
239 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
err.mp3
tbgpz.club/ry9itcrgwu/z3uaw90it3/xxysd2oruk/ |
196 KB 196 KB |
Media
audio/mpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
beep.mp3
tbgpz.club/ry9itcrgwu/z3uaw90it3/xxysd2oruk/ |
8 KB 8 KB |
Media
audio/mpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
collect
www.google-analytics.com/r/ |
35 B 101 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
beep.mp3
tbgpz.club/ry9itcrgwu/z3uaw90it3/xxysd2oruk/ Frame A4BA |
0 0 |
Document
audio/mpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
beep.mp3
tbgpz.club/ry9itcrgwu/z3uaw90it3/xxysd2oruk/ Frame A4BA |
8 KB 8 KB |
Media
audio/mpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic (Online) Tech Support Scam (Consumer)21 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask function| gtag object| dataLayer object| google_tag_manager string| GoogleAnalyticsObject function| ga function| $ function| jQuery object| modal object| btn undefined| span function| addEvent object| google_tag_data object| gaplugins object| gaGlobal object| gaData number| _i function| newLine function| toggleFullScreen4 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.tbgpz.club/ | Name: _gid Value: GA1.2.1052500753.1564183373 |
|
.tbgpz.club/ | Name: _gat_gtag_UA_140514612_1 Value: 1 |
|
.tbgpz.club/ | Name: _ga Value: GA1.2.806182836.1564183373 |
|
.tbgpz.club/ | Name: __cfduid Value: de2cac004493f8ccc60913410b2a426c61564183372 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
maxcdn.bootstrapcdn.com
tbgpz.club
www.google-analytics.com
www.googletagmanager.com
zzscw.club
209.197.3.15
2606:4700:30::6818:63b2
2606:4700:30::681b:a10d
2a00:1450:4001:815::200a
2a00:1450:4001:81e::200e
2a00:1450:4001:824::2008
035f18de6a2e149d4d657accc183abff4e1b1dc1526190123123d1ec5d3574ff
0589be7715d2320e559eae6bd26f3528e97450c70293da2e1e8ce45f77f99ab1
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
2c105cf7505b4a76ffcc85c7b6197a37419b60cc41d5488ba937b881ff65a8b9
2f11121f2e4bd16481c7bda9d3e07a4260c2828f768c9d64e82fe5f6b8f49024
4a74d6b33324b196502c0736ad5237f9f4a4fe1707aee8f7c916d3828a1ccca5
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8534415eb2e954341a5e1cf6d4dff503817a6a59868dc3762065c8d6b9e1382d
909ae563eb34f7e4285a3a643ab5d7c21c5e6a80f3f455b949ac45f08d0389b4
96ebd43ad060daa3755cd441a936cd36371732d7a74b2ae4df30183eb128df9a
a4883cce814b6793c5bd6dd3639d6048ecab39a93a90b560d39a9fd0aff6e263
bd08b9849632e73574f62ca80572a17f9bbd9bb1010fe8c6380e641460abd96c
c9cf33e9e57d1c944d430b98133aaf0cb30c24a735b1106c6a0800d58b10f023
ecae241c213560768ec10c16da638f559abb30919cfeacbd2936396d826a59e3
f74f9f07c59ae9af25762ef4204d2dda6476bf20c37e4a34cc159b736ec5ccf1
fc59bbb18f923747b9cd3f3b23537ff09c5ad2fdfc1505a4800a3f269a234e65