3.22.48.189 Open in urlscan Pro
3.22.48.189 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://3.22.48.189/j1147/Call-Support1/
Submission: On March 27 via manual (March 27th 2020, 2:58:56 am UTC) from JP

Summary HTTP 14 Redirects Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 6 IPs in 5 countries across 3 domains to perform 14 HTTP transactions. The main IP is 3.22.48.189, located in Seattle, United States and belongs to AMAZON-02, US. The main domain is 3.22.48.189.

This is the only time 3.22.48.189 was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic (Online) Tech Support Scam (Consumer)

Domain & IP information

	IP Address		AS Autonomous System
10	3.22.48.189 3.22.48.189		16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:81f::200a		15169 (GOOGLE) (GOOGLE)
1	2001:4de0:ac1... 2001:4de0:ac19::1:b:3a		20446 (HIGHWINDS3) (HIGHWINDS3)
1	46.105.201.240 46.105.201.240		16276 (OVH) (OVH)
1	198.27.80.143 198.27.80.143		16276 (OVH) (OVH)
14	6

10 3.22.48.189 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-22-48-189.us-east-2.compute.amazonaws.com

3.22.48.189	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81f::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac19::1:b:3a (Netherlands)

ASN20446 (HIGHWINDS3, US)

maxcdn.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 46.105.201.240 (France)

ASN16276 (OVH, FR)

s10.histats.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 198.27.80.143 (Montreal, Canada)

ASN16276 (OVH, FR)
PTR: ns558056.ip-198-27-80.net

s4.histats.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	histats.com s10.histats.com s4.histats.com	5 KB
1	bootstrapcdn.com maxcdn.bootstrapcdn.com	10 KB
1	googleapis.com ajax.googleapis.com	30 KB
14	3

	Domain	Requested by
1	s4.histats.com	s10.histats.com
1	s10.histats.com	3.22.48.189
1	maxcdn.bootstrapcdn.com	3.22.48.189
1	ajax.googleapis.com	3.22.48.189
14	4

This site contains no links.

Subject Issuer	Validity	Valid
*.storage.googleapis.com GTS CA 1O1	`2020-03-03` - `2020-05-26`	3 months	crt.sh
*.bootstrapcdn.com Sectigo RSA Domain Validation Secure Server CA	`2019-09-14` - `2020-10-13`	a year	crt.sh

This page contains 2 frames:

Primary Page: http://3.22.48.189/j1147/Call-Support1/
Frame ID: 82F4D65A5F20739276DE22AE73BD5E97
Requests: 13 HTTP requests in this frame

Frame: http://3.22.48.189/j1147/Call-Support1/beep.mp3
Frame ID: 27E2D9E9BF53AACE96CA6F0B9B887963
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

headers server /php\/?([\d.]+)?/i

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

script /(?:\/([\d.]+))?(?:\/js)?\/bootstrap(?:\.min)?\.js/i

Amazon EC2 (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /\(Amazon\)/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Amazon Web Services (PaaS) Expand

Overall confidence: 100%
Detected patterns

headers server /\(Amazon\)/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

14
Requests

14 %
HTTPS

40 %
IPv6

3
Domains

4
Subdomains

6
IPs

5
Countries

128 kB
Transfer

311 kB
Size

7
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
3.22.48.189/j1147/Call-Support1/ 12 KB
13 KB 289ms
273ms Document
text/html 3.22.48.189
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: http://3.22.48.189/j1147/Call-Support1/
Protocol: HTTP/1.1
Server: 3.22.48.189 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-22-48-189.us-east-2.compute.amazonaws.com
Software: Apache/2.4.41 (Amazon) PHP/7.2.28 /
Resource Hash: 3129464106b873454351f8ee3dc0bfa877b6b66e5e1821c1701e5f1a0686a5e6

Request headers

Host: 3.22.48.189
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 27 Mar 2020 02:58:38 GMT
Server: Apache/2.4.41 (Amazon) PHP/7.2.28
Last-Modified: Wed, 11 Mar 2020 17:43:47 GMT
ETag: "31cb-5a097c7413ac0"
Accept-Ranges: bytes
Content-Length: 12747
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK style.min.css
3.22.48.189/j1147/Call-Support1/ 4 KB
5 KB 123ms
122ms Stylesheet
text/css 3.22.48.189
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: http://3.22.48.189/j1147/Call-Support1/style.min.css
Requested by: Host: 3.22.48.189
URL: http://3.22.48.189/j1147/Call-Support1/
Protocol: HTTP/1.1
Server: 3.22.48.189 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-22-48-189.us-east-2.compute.amazonaws.com
Software: Apache/2.4.41 (Amazon) PHP/7.2.28 /
Resource Hash: 4a74d6b33324b196502c0736ad5237f9f4a4fe1707aee8f7c916d3828a1ccca5

Request headers

Referer: http://3.22.48.189/j1147/Call-Support1/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 27 Mar 2020 02:58:38 GMT
Last-Modified: Fri, 19 Apr 2019 01:53:22 GMT
Server: Apache/2.4.41 (Amazon) PHP/7.2.28
ETag: "11d3-586d862312880"
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 4563

GET
H/1.1 200
OK index.css
3.22.48.189/j1147/Call-Support1/ 2 KB
2 KB 245ms
228ms Stylesheet
text/css 3.22.48.189
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: http://3.22.48.189/j1147/Call-Support1/index.css
Requested by: Host: 3.22.48.189
URL: http://3.22.48.189/j1147/Call-Support1/
Protocol: HTTP/1.1
Server: 3.22.48.189 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-22-48-189.us-east-2.compute.amazonaws.com
Software: Apache/2.4.41 (Amazon) PHP/7.2.28 /
Resource Hash: 6cccd74e4ec557ccb5e871c718ddb70b5a39b42b0d489399fee95423af5b30fb

Request headers

Referer: http://3.22.48.189/j1147/Call-Support1/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 27 Mar 2020 02:58:39 GMT
Last-Modified: Fri, 19 Apr 2019 01:53:54 GMT
Server: Apache/2.4.41 (Amazon) PHP/7.2.28
ETag: "7c2-586d864197080"
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 1986

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.3.1/ 85 KB
30 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:81f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js

Requested by

Host: 3.22.48.189
URL: http://3.22.48.189/j1147/Call-Support1/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: http://3.22.48.189/j1147/Call-Support1/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Tue, 25 Feb 2020 02:08:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2681425
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length: 30399
x-xss-protection: 0
last-modified: Thu, 25 Jan 2018 15:33:24 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 24 Feb 2021 02:08:13 GMT

GET
H2 200 bootstrap.min.js Show response
maxcdn.bootstrapcdn.com/bootstrap/3.4.0/js/ 37 KB
10 KB 26ms
9ms Script
text/javascript 2001:4de0:ac19::1:b:3a
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://maxcdn.bootstrapcdn.com/bootstrap/3.4.0/js/bootstrap.min.js
Requested by: Host: 3.22.48.189
URL: http://3.22.48.189/j1147/Call-Support1/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac19::1:b:3a , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: /
Resource Hash: 909ae563eb34f7e4285a3a643ab5d7c21c5e6a80f3f455b949ac45f08d0389b4

Request headers

Referer: http://3.22.48.189/j1147/Call-Support1/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Fri, 27 Mar 2020 02:58:38 GMT
content-encoding: gzip
last-modified: Fri, 14 Dec 2018 05:14:43 GMT
access-control-allow-origin: *
etag: "1544764483"
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript; charset=utf-8
status: 200
cache-control: public, max-age=31536000
x-hello-human: Say hello back! @getBootstrapCDN on Twitter
accept-ranges: bytes
timing-allow-origin: *
content-length: 10035

GET
H/1.1 200
OK header-bar3.png
3.22.48.189/j1147/Call-Support1/ 37 KB
38 KB 245ms
228ms Image
image/png 3.22.48.189
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://3.22.48.189/j1147/Call-Support1/header-bar3.png
Requested by: Host: 3.22.48.189
URL: http://3.22.48.189/j1147/Call-Support1/
Protocol: HTTP/1.1
Server: 3.22.48.189 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-22-48-189.us-east-2.compute.amazonaws.com
Software: Apache/2.4.41 (Amazon) PHP/7.2.28 /
Resource Hash: 6d3b279048e5a339ec909382e5e36c77ea557e3e98d6f73b72e1b5cd8e5f3d5c

Request headers

Referer: http://3.22.48.189/j1147/Call-Support1/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 27 Mar 2020 02:58:39 GMT
Last-Modified: Tue, 16 Apr 2019 17:02:42 GMT
Server: Apache/2.4.41 (Amazon) PHP/7.2.28
ETag: "953c-586a8bcb29080"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 38204

GET
H/1.1 200
OK micro-logo.png
3.22.48.189/j1147/Call-Support1/ 8 KB
9 KB 245ms
228ms Image
image/png 3.22.48.189
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://3.22.48.189/j1147/Call-Support1/micro-logo.png
Requested by: Host: 3.22.48.189
URL: http://3.22.48.189/j1147/Call-Support1/
Protocol: HTTP/1.1
Server: 3.22.48.189 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-22-48-189.us-east-2.compute.amazonaws.com
Software: Apache/2.4.41 (Amazon) PHP/7.2.28 /
Resource Hash: a72a29dd6ea55287a8861c060b563edea8f0ce0b545a850ec4894257581f7963

Request headers

Referer: http://3.22.48.189/j1147/Call-Support1/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 27 Mar 2020 02:58:39 GMT
Last-Modified: Tue, 09 Apr 2019 19:57:24 GMT
Server: Apache/2.4.41 (Amazon) PHP/7.2.28
ETag: "21d9-5861e5c959100"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 8665

GET
H/1.1 404
Not Found main.js
3.22.48.189/j1147/Call-Support1/js/ 0
0 122ms
121ms Script
text/html 3.22.48.189
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: http://3.22.48.189/j1147/Call-Support1/js/main.js
Requested by: Host: 3.22.48.189
URL: http://3.22.48.189/j1147/Call-Support1/
Protocol: HTTP/1.1
Server: 3.22.48.189 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-22-48-189.us-east-2.compute.amazonaws.com
Software: Apache/2.4.41 (Amazon) PHP/7.2.28 /
Resource Hash

Request headers

Referer: http://3.22.48.189/j1147/Call-Support1/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 27 Mar 2020 02:58:39 GMT
Server: Apache/2.4.41 (Amazon) PHP/7.2.28
Connection: Keep-Alive
Keep-Alive: timeout=5, max=99
Content-Length: 196
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 200
OK js15_as.js Show response
s10.histats.com/ 11 KB
5 KB 51ms
33ms Script
text/javascript 46.105.201.240
OVH

General

Check archive.org

Show headers Download Go to

Full URL: http://s10.histats.com/js15_as.js
Requested by: Host: 3.22.48.189
URL: http://3.22.48.189/j1147/Call-Support1/
Protocol: HTTP/1.1
Server: 46.105.201.240 , France, ASN16276 (OVH, FR),
Reverse DNS
Software: /
Resource Hash: 1f730c8b78091c3479abc2fb805b9093138f05acd0de421b8da96389cbbb9668

Request headers

Referer: http://3.22.48.189/j1147/Call-Support1/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 27 Mar 2020 02:58:15 GMT
Content-Encoding: gzip
Last-Modified: Thu, 06 Dec 2018 14:12:12 GMT
X-CDN-Pop-IP: 51.254.41.128/26
ETag: "-139234964"
X-Cacheable: Matched cache
Vary: Accept-Encoding
X-IPLB-Instance: 28228
Content-Type: text/javascript
X-CDN-Pop: rbx1
Accept-Ranges: bytes
Content-Length: 4525
X-Request-ID: 606930540

GET
DATA 200
OK truncated
/ 239 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bd08b9849632e73574f62ca80572a17f9bbd9bb1010fe8c6380e641460abd96c

Request headers

Referer: http://3.22.48.189/j1147/Call-Support1/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 206
Partial Content err.mp3
3.22.48.189/j1147/Call-Support1/ 97 KB
0 122ms
122ms Media
audio/mpeg 3.22.48.189
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: http://3.22.48.189/j1147/Call-Support1/err.mp3
Requested by: Host: 3.22.48.189
URL: http://3.22.48.189/j1147/Call-Support1/
Protocol: HTTP/1.1
Server: 3.22.48.189 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-22-48-189.us-east-2.compute.amazonaws.com
Software: Apache/2.4.41 (Amazon) PHP/7.2.28 /
Resource Hash

Request headers

Referer: http://3.22.48.189/j1147/Call-Support1/
Accept-Encoding: identity;q=1, *;q=0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Range: bytes=0-

Response headers

Date: Fri, 27 Mar 2020 02:58:39 GMT
Last-Modified: Sun, 30 Jun 2019 01:55:18 GMT
Server: Apache/2.4.41 (Amazon) PHP/7.2.28
ETag: "34ea2-58c80cdae2d80"
Content-Type: audio/mpeg
Content-Range: bytes 0-216737/216738
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 216738

GET
H/1.1 206
Partial Content beep.mp3
3.22.48.189/j1147/Call-Support1/ 8 KB
9 KB 122ms
122ms Media
audio/mpeg 3.22.48.189
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: http://3.22.48.189/j1147/Call-Support1/beep.mp3
Requested by: Host: 3.22.48.189
URL: http://3.22.48.189/j1147/Call-Support1/
Protocol: HTTP/1.1
Server: 3.22.48.189 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-22-48-189.us-east-2.compute.amazonaws.com
Software: Apache/2.4.41 (Amazon) PHP/7.2.28 /
Resource Hash: 0589be7715d2320e559eae6bd26f3528e97450c70293da2e1e8ce45f77f99ab1

Request headers

Referer: http://3.22.48.189/j1147/Call-Support1/
Accept-Encoding: identity;q=1, *;q=0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Range: bytes=0-

Response headers

Date: Fri, 27 Mar 2020 02:58:39 GMT
Last-Modified: Tue, 27 Feb 2018 19:37:56 GMT
Server: Apache/2.4.41 (Amazon) PHP/7.2.28
ETag: "20d5-56636c3650d00"
Content-Type: audio/mpeg
Content-Range: bytes 0-8404/8405
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 8405

GET
H/1.1 200
OK 0.php Show response
s4.histats.com/stats/ 52 B
323 B 183ms
167ms Script
text/html 198.27.80.143
OVH

General

Check archive.org

Show headers Download Go to

Full URL: http://s4.histats.com/stats/0.php?3858354&@f16&@g1&@h1&@i1&@j1585277919148&@k0&@l1&@mOfficial%20Microsoft%20Support&@n0&@o1000&@q0&@r0&@s0&@ten-US&@u1600&@b1:179555291&@b3:1585277919&@b4:js15_as.js&@b5:60&@a-_0.2.1&@vhttp%3A%2F%2F3.22.48.189%2Fj1147%2FCall-Support1%2F&@w
Requested by: Host: s10.histats.com
URL: http://s10.histats.com/js15_as.js
Protocol: HTTP/1.1
Server: 198.27.80.143 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS: ns558056.ip-198-27-80.net
Software: /
Resource Hash: 17ec9b0c261602c90595ee7085b98b5688cba41a216fc39e08604ba0c9adfb6f

Request headers

Referer: http://3.22.48.189/j1147/Call-Support1/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 27 Mar 2020 02:58:39 GMT
Connection: close
Content-Length: 52
Content-Type: text/html;charset=UTF-8

GET
H/1.1 200
OK beep.mp3
3.22.48.189/j1147/Call-Support1/ Frame 27E2 0
0 121ms
121ms Document
audio/mpeg 3.22.48.189
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: http://3.22.48.189/j1147/Call-Support1/beep.mp3
Requested by: Host: 3.22.48.189
URL: http://3.22.48.189/j1147/Call-Support1/
Protocol: HTTP/1.1
Server: 3.22.48.189 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-22-48-189.us-east-2.compute.amazonaws.com
Software: Apache/2.4.41 (Amazon) PHP/7.2.28 /
Resource Hash

Request headers

Host: 3.22.48.189
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://3.22.48.189/j1147/Call-Support1/
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Cookie: HstCfa3858354=1585277919148; HstCla3858354=1585277919148; HstCmu3858354=1585277919148; HstPn3858354=1; HstPt3858354=1; HstCnv3858354=1; HstCns3858354=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: http://3.22.48.189/j1147/Call-Support1/

Response headers

Date: Fri, 27 Mar 2020 02:58:39 GMT
Server: Apache/2.4.41 (Amazon) PHP/7.2.28
Last-Modified: Tue, 27 Feb 2018 19:37:56 GMT
ETag: "20d5-56636c3650d00"
Accept-Ranges: bytes
Content-Length: 8405
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: audio/mpeg

GET
H/1.1 206
Partial Content beep.mp3
3.22.48.189/j1147/Call-Support1/ Frame 27E2 8 KB
9 KB 122ms
121ms Media
audio/mpeg 3.22.48.189
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: http://3.22.48.189/j1147/Call-Support1/beep.mp3
Requested by: Host: 3.22.48.189
URL: http://3.22.48.189/j1147/Call-Support1/
Protocol: HTTP/1.1
Server: 3.22.48.189 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-22-48-189.us-east-2.compute.amazonaws.com
Software: Apache/2.4.41 (Amazon) PHP/7.2.28 /
Resource Hash: 0589be7715d2320e559eae6bd26f3528e97450c70293da2e1e8ce45f77f99ab1

Request headers

Referer: http://3.22.48.189/j1147/Call-Support1/beep.mp3
Accept-Encoding: identity;q=1, *;q=0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Range: bytes=0-

Response headers

Date: Fri, 27 Mar 2020 02:58:39 GMT
Last-Modified: Tue, 27 Feb 2018 19:37:56 GMT
Server: Apache/2.4.41 (Amazon) PHP/7.2.28
ETag: "20d5-56636c3650d00"
Content-Type: audio/mpeg
Content-Range: bytes 0-8404/8405
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=97
Content-Length: 8405

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic (Online) Tech Support Scam (Consumer)

14 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate object| _Hasync function| $ function| jQuery object| modal object| btn object| span function| addEvent function| chfh function| chfh2 string| _HST_cntval object| Histats object| _HistatsCounterGraphics_0_setValues

7 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			3.22.48.189/	1970-01-19 17:06:53	Name: HstCns3858354 Value: 1
			3.22.48.189/	1970-01-19 17:06:53	Name: HstCnv3858354 Value: 1
			3.22.48.189/	1970-01-19 17:06:53	Name: HstPt3858354 Value: 1
			3.22.48.189/	1970-01-19 17:06:53	Name: HstPn3858354 Value: 1
			3.22.48.189/	1970-01-19 17:06:53	Name: HstCmu3858354 Value: 1585277919148
			3.22.48.189/	1970-01-19 17:06:53	Name: HstCla3858354 Value: 1585277919148
			3.22.48.189/	1970-01-19 17:06:53	Name: HstCfa3858354 Value: 1585277919148

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
maxcdn.bootstrapcdn.com
s10.histats.com
s4.histats.com
198.27.80.143
2001:4de0:ac19::1:b:3a
2a00:1450:4001:81f::200a
3.22.48.189
46.105.201.240
0589be7715d2320e559eae6bd26f3528e97450c70293da2e1e8ce45f77f99ab1
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
17ec9b0c261602c90595ee7085b98b5688cba41a216fc39e08604ba0c9adfb6f
1f730c8b78091c3479abc2fb805b9093138f05acd0de421b8da96389cbbb9668
3129464106b873454351f8ee3dc0bfa877b6b66e5e1821c1701e5f1a0686a5e6
4a74d6b33324b196502c0736ad5237f9f4a4fe1707aee8f7c916d3828a1ccca5
6cccd74e4ec557ccb5e871c718ddb70b5a39b42b0d489399fee95423af5b30fb
6d3b279048e5a339ec909382e5e36c77ea557e3e98d6f73b72e1b5cd8e5f3d5c
909ae563eb34f7e4285a3a643ab5d7c21c5e6a80f3f455b949ac45f08d0389b4
a72a29dd6ea55287a8861c060b563edea8f0ce0b545a850ec4894257581f7963
bd08b9849632e73574f62ca80572a17f9bbd9bb1010fe8c6380e641460abd96c