nqm6jx5y.xyz
Open in
urlscan Pro
2606:4700:30::681b:b093
Malicious Activity!
Public Scan
Submission: On May 07 via manual from US
Summary
This is the only time nqm6jx5y.xyz was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer) Generic (Online) Tech Support Scam (Consumer)Downloads These files were downloaded by the website
Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
4 | 2606:4700:30:... 2606:4700:30::681b:b093 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
2 | 209.197.3.15 209.197.3.15 | 20446 (HIGHWINDS3) (HIGHWINDS3 - Highwinds Network Group) | |
1 | 2a00:1450:400... 2a00:1450:4001:81a::2008 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
4 | 2606:4700:30:... 2606:4700:30::681b:b193 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
2 | 205.185.208.52 205.185.208.52 | 20446 (HIGHWINDS3) (HIGHWINDS3 - Highwinds Network Group) | |
1 | 2a00:1450:400... 2a00:1450:4001:817::200a | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
1 2 | 2a00:1450:400... 2a00:1450:4001:81d::200e | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
1 | 2a00:1450:400... 2a00:1450:400c:c0a::9b | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
16 | 9 |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
nqm6jx5y.xyz |
ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US)
PTR: vip0x00f.map2.ssl.hwcdn.net
maxcdn.bootstrapcdn.com |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
nqm6jx5y.xyz |
ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US)
PTR: vip052.ssl.hwcdn.net
code.jquery.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
8 |
nqm6jx5y.xyz
nqm6jx5y.xyz |
97 KB |
2 |
google-analytics.com
1 redirects
www.google-analytics.com |
17 KB |
2 |
jquery.com
code.jquery.com |
60 KB |
2 |
bootstrapcdn.com
maxcdn.bootstrapcdn.com |
22 KB |
1 |
doubleclick.net
stats.g.doubleclick.net |
102 B |
1 |
googleapis.com
fonts.googleapis.com |
2 KB |
1 |
googletagmanager.com
www.googletagmanager.com |
24 KB |
16 | 7 |
Domain | Requested by | |
---|---|---|
8 | nqm6jx5y.xyz |
nqm6jx5y.xyz
|
2 | www.google-analytics.com |
1 redirects
www.googletagmanager.com
|
2 | code.jquery.com |
nqm6jx5y.xyz
|
2 | maxcdn.bootstrapcdn.com |
nqm6jx5y.xyz
|
1 | stats.g.doubleclick.net |
nqm6jx5y.xyz
|
1 | fonts.googleapis.com |
nqm6jx5y.xyz
|
1 | www.googletagmanager.com |
nqm6jx5y.xyz
|
16 | 7 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.bootstrapcdn.com COMODO RSA Domain Validation Secure Server CA |
2018-10-03 - 2019-10-12 |
a year | crt.sh |
*.google-analytics.com Google Internet Authority G3 |
2019-04-16 - 2019-07-09 |
3 months | crt.sh |
jquery.org COMODO RSA Domain Validation Secure Server CA |
2018-10-17 - 2020-10-16 |
2 years | crt.sh |
*.googleapis.com Google Internet Authority G3 |
2019-04-16 - 2019-07-09 |
3 months | crt.sh |
*.g.doubleclick.net Google Internet Authority G3 |
2019-04-16 - 2019-07-09 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
http://nqm6jx5y.xyz/kingshishuen7/qingyunzhuxian/index.html
Frame ID: 83F162BAC8A7BA2CCF03EF7CB7118CE4
Requests: 17 HTTP requests in this frame
Screenshot
Detected technologies
CloudFlare (CDN) ExpandDetected patterns
- headers server /cloudflare/i
Google Analytics (Analytics) Expand
Detected patterns
- script /google-analytics\.com\/(?:ga|urchin|(analytics))\.js/i
- env /^gaGlobal$/i
Google Tag Manager (Tag Managers) Expand
Detected patterns
- env /^google_tag_manager$/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /jquery(?:\-|\.)([\d.]*\d)[^\/]*\.js/i
- script /jquery.*\.js/i
- env /^jQuery$/i
Twitter Bootstrap () Expand
Detected patterns
- html /<link[^>]+?href="[^"]+bootstrap(?:\.min)?\.css/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 15- https://www.google-analytics.com/r/collect?v=1&_v=j73&a=1929451238&t=pageview&_s=1&dl=http%3A%2F%2Fnqm6jx5y.xyz%2Fkingshishuen7%2Fqingyunzhuxian%2Findex.html&ul=en-us&de=UTF-8&dt=Microsoft%20Official%20Support&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAUAB~&jid=1306586737&gjid=2023991948&cid=202877012.1557257791&tid=UA-60390451-1&_gid=207788491.1557257791&_r=1>m=2ou430&z=428362739 HTTP 302
- https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-60390451-1&cid=202877012.1557257791&jid=1306586737&_gid=207788491.1557257791&gjid=2023991948&_v=j73&z=428362739
16 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
Cookie set
index.html
nqm6jx5y.xyz/kingshishuen7/qingyunzhuxian/ |
24 KB 9 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/ |
118 KB 20 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap-theme.min.css
maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/ |
23 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
style.css
nqm6jx5y.xyz/kingshishuen7/qingyunzhuxian/css/ |
4 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
js
www.googletagmanager.com/gtag/ |
63 KB 24 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
time.js
nqm6jx5y.xyz/kingshishuen7/qingyunzhuxian/ |
6 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
rsod.png
nqm6jx5y.xyz/kingshishuen7/qingyunzhuxian/images/ |
11 KB 11 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
335158-windows-8-window.png
nqm6jx5y.xyz/kingshishuen7/qingyunzhuxian/images/ |
28 KB 28 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-3.3.1.min.js
code.jquery.com/ |
85 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-3.3.1.min.js
code.jquery.com/ |
85 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
script.js
nqm6jx5y.xyz/kingshishuen7/qingyunzhuxian/js/ |
8 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
33 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
analytics.js
www.google-analytics.com/ |
43 KB 17 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
background.png
nqm6jx5y.xyz/kingshishuen7/qingyunzhuxian/images/ |
41 KB 42 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
239 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
sound.mp3
nqm6jx5y.xyz/kingshishuen7/qingyunzhuxian/assets/audio/ |
97 KB 0 |
Media
audio/mpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
collect
stats.g.doubleclick.net/r/ Redirect Chain
|
35 B 102 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer) Generic (Online) Tech Support Scam (Consumer)38 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask object| google_tag_manager object| dataLayer function| gtag string| GoogleAnalyticsObject function| ga object| TimeMe number| at_live_120 number| at_live_1200 function| afilter function| atpay function| atgo object| google_tag_data object| gaplugins object| gaGlobal object| gaData function| $ function| jQuery function| fillForm function| closeCode function| getCode function| modalClose function| getModal function| _toggleFullScreen function| open1 function| isPlaying function| forceDownload function| catchControlKeys function| prevent boolean| state function| confirmExit function| get_browser boolean| InternetEx boolean| isIEedge object| browser undefined| msg_ff4 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.nqm6jx5y.xyz/ | Name: _gat_gtag_UA_60390451_1 Value: 1 |
|
.nqm6jx5y.xyz/ | Name: _ga Value: GA1.2.202877012.1557257791 |
|
.nqm6jx5y.xyz/ | Name: _gid Value: GA1.2.207788491.1557257791 |
|
.nqm6jx5y.xyz/ | Name: __cfduid Value: d6d6370610e4d0a63b3de893e1ab8fc371557257790 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
code.jquery.com
fonts.googleapis.com
maxcdn.bootstrapcdn.com
nqm6jx5y.xyz
stats.g.doubleclick.net
www.google-analytics.com
www.googletagmanager.com
205.185.208.52
209.197.3.15
2606:4700:30::681b:b093
2606:4700:30::681b:b193
2a00:1450:4001:817::200a
2a00:1450:4001:81a::2008
2a00:1450:4001:81d::200e
2a00:1450:400c:c0a::9b
143e1c0ed6cc6582749c9d73680356200d02b37fd0c66372cd2a1ea20a62b5fd
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
195e971b0ab47e9484914db60c36589144dfaafce37408fdacf99aef82ebc5c9
312c6606235f1ba63b2141b812fef5398536390a76c85f5ab8bcc35a7aa8737e
3e552578c7d450b023f2cd9d28f830be4335c3acc6c4ab6dadda0769f09e5f22
4c98fcc57f3c84f714057e6286714f3ef22b25129d6899b46718a22db4bcb08d
598e4e2b51c984a30b69e5fb52ebb12f9669ffab4ffad4ca1667d77b6dde3f49
606a248227b8bfb26e81383ad9d7fa4d01a31ed02a31b282dc57790cf285d42a
653e073e97423adda5bc3917a241ee8497dd38a48f14bcde0098a4e54fd0fa5e
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8a341385e96880052ae350401544af4213cb320a318d4d4c17ea0662f28d135c
bd08b9849632e73574f62ca80572a17f9bbd9bb1010fe8c6380e641460abd96c
e6155c8765cddcfc94a631542e159e26df0f7f1c2ba95358b4f415d946c0a1c0
f75e846cc83bd11432f4b1e21a45f31bc85283d11d372f7b19accd1bf6a2635c
fcae9a7e0427744ff2199897d14c0d69e8434112f16851f587f7002b3fbe8704