scanner-9206.win Open in urlscan Pro
2606:4700:30::6812:2249 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://scanner-9206.win/aviso/
Effective URL:
http://scanner-9206.win/aviso/
Submission: On November 18 via api (November 18th 2018, 3:28:49 pm UTC) from US

Summary HTTP 14 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 2 countries across 2 domains to perform 14 HTTP transactions. The main IP is 2606:4700:30::6812:2249, located in United States and belongs to CLOUDFLARENET - Cloudflare, Inc., US. The main domain is scanner-9206.win.

This is the only time scanner-9206.win was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft Defender (Consumer) Generic (Online) Tech Support Scam (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
5	2606:4700:30:... 2606:4700:30::6812:2249	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
7	2606:4700:30:... 2606:4700:30::6812:2349	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1	46.105.201.240 46.105.201.240	16276 (OVH) (OVH)
1	208.43.241.179 208.43.241.179	36351 (SOFTLAYER) (SOFTLAYER - SoftLayer Technologies Inc.)
14	5

5 2606:4700:30::6812:2249 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

scanner-9206.win	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2606:4700:30::6812:2349 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

scanner-9206.win	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 46.105.201.240 (France)

ASN16276 (OVH, FR)

s10.histats.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 208.43.241.179 (Chantilly, United States)

ASN36351 (SOFTLAYER - SoftLayer Technologies Inc., US)
PTR: b3.f1.2bd0.ip4.static.sl-reverse.com

s4.histats.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	scanner-9206.win scanner-9206.win	80 KB
2	histats.com s10.histats.com s4.histats.com	5 KB
14	2

	Domain	Requested by
12	scanner-9206.win	scanner-9206.win
1	s4.histats.com	s10.histats.com
1	s10.histats.com	scanner-9206.win
14	3

This site contains no links.

Subject Issuer	Validity	Valid

This page contains 2 frames:

Primary Page: http://scanner-9206.win/aviso/
Frame ID: C81086256FF1963E2B139C42E7122B43
Requests: 14 HTTP requests in this frame

Frame: http://scanner-9206.win/aviso/index_files/a.htm
Frame ID: 1FEBB92CB656D154384AC7C1974143B3
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /cloudflare/i

Twitter Bootstrap () Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]+?href="[^"]+bootstrap(?:\.min)?\.css/i

Page Statistics

14
Requests

0 %
HTTPS

50 %
IPv6

2
Domains

3
Subdomains

5
IPs

2
Countries

85 kB
Transfer

332 kB
Size

8
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request Cookie set / Show response scanner-9206.win/aviso/	89 KB 45 KB	31ms 25ms	Document text/html	2606:4700:30::6812:2249 Cloudflare
General Check archive.org Show headers Download Go to Full URL http://scanner-9206.win/aviso/ Protocol HTTP/1.1 Server 2606:4700:30::6812:2249 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / PHP/5.4.16 Resource Hash `0790d6e7b1d913a80a9d5592a50634d19abecee08b903d3ce0b92302ecc8ca8d` Request headers Host scanner-9206.win Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8 Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Sun, 18 Nov 2018 15:28:38 GMT Content-Type text/html Transfer-Encoding chunked Connection keep-alive Set-Cookie __cfduid=d58702cc80a8f23db0ccbffff68383a101542554918; expires=Mon, 18-Nov-19 15:28:38 GMT; path=/; domain=.scanner-9206.win; HttpOnly X-Powered-By PHP/5.4.16 Server cloudflare CF-RAY 47bb77d20193bf20-FRA Content-Encoding gzip
GET H/1.1	200 OK	bootstrap.css scanner-9206.win/aviso/index_files/	118 KB 20 KB	61ms 55ms	Stylesheet text/css	2606:4700:30::6812:2349 Cloudflare
General Check archive.org Show headers Download Go to Full URL http://scanner-9206.win/aviso/index_files/bootstrap.css Requested by Host: scanner-9206.win URL: http://scanner-9206.win/aviso/ Protocol HTTP/1.1 Server 2606:4700:30::6812:2349 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `df76fb7518b1201acc79262e0dc6c773a85f04c36e0a9ea61994c22fbd97087b` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host scanner-9206.win User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/css,/;q=0.1 Referer http://scanner-9206.win/aviso/ Cookie __cfduid=d58702cc80a8f23db0ccbffff68383a101542554918 Connection keep-alive Cache-Control no-cache Referer http://scanner-9206.win/aviso/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Sun, 18 Nov 2018 15:28:38 GMT Content-Encoding gzip CF-Cache-Status MISS Last-Modified Thu, 15 Mar 2018 13:33:39 GMT Server cloudflare ETag W/"5aaa7633-1d9bc" Vary Accept-Encoding Content-Type text/css Access-Control-Allow-Origin * Cache-Control public, max-age=14400 Transfer-Encoding chunked Connection keep-alive CF-RAY 47bb77d2420c636d-FRA Expires Sun, 18 Nov 2018 19:28:38 GMT
GET H/1.1	200 OK	style.css scanner-9206.win/aviso/index_files/	23 KB 6 KB	40ms 35ms	Stylesheet text/css	2606:4700:30::6812:2349 Cloudflare
General Check archive.org Show headers Download Go to Full URL http://scanner-9206.win/aviso/index_files/style.css Requested by Host: scanner-9206.win URL: http://scanner-9206.win/aviso/ Protocol HTTP/1.1 Server 2606:4700:30::6812:2349 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `78dcaaf93c8b138b0d84e81e3a30a31daa07b00d733304977762a2c9636c6b5e` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host scanner-9206.win User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/css,/;q=0.1 Referer http://scanner-9206.win/aviso/ Cookie __cfduid=d58702cc80a8f23db0ccbffff68383a101542554918 Connection keep-alive Cache-Control no-cache Referer http://scanner-9206.win/aviso/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Sun, 18 Nov 2018 15:28:38 GMT Content-Encoding gzip CF-Cache-Status MISS Last-Modified Thu, 15 Mar 2018 13:33:39 GMT Server cloudflare ETag W/"5aaa7633-5a79" Vary Accept-Encoding Content-Type text/css Access-Control-Allow-Origin * Cache-Control public, max-age=14400 Transfer-Encoding chunked Connection keep-alive CF-RAY 47bb77d2420d636d-FRA Expires Sun, 18 Nov 2018 19:28:38 GMT
GET H/1.1	200 OK	translator.css scanner-9206.win/aviso/index_files/	20 KB 5 KB	36ms 30ms	Stylesheet text/css	2606:4700:30::6812:2249 Cloudflare
General Check archive.org Show headers Download Go to Full URL http://scanner-9206.win/aviso/index_files/translator.css Requested by Host: scanner-9206.win URL: http://scanner-9206.win/aviso/ Protocol HTTP/1.1 Server 2606:4700:30::6812:2249 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `b2b61d5cb1712e3bf658a1008ddf27236f0eaefb0c88271df843d225c579d512` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host scanner-9206.win User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/css,/;q=0.1 Referer http://scanner-9206.win/aviso/ Cookie __cfduid=d58702cc80a8f23db0ccbffff68383a101542554918 Connection keep-alive Cache-Control no-cache Referer http://scanner-9206.win/aviso/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Sun, 18 Nov 2018 15:28:38 GMT Content-Encoding gzip CF-Cache-Status MISS Last-Modified Thu, 15 Mar 2018 13:33:39 GMT Server cloudflare ETag W/"5aaa7633-511c" Vary Accept-Encoding Content-Type text/css Access-Control-Allow-Origin * Cache-Control public, max-age=14400 Transfer-Encoding chunked Connection keep-alive CF-RAY 47bb77d241a9bf20-FRA Expires Sun, 18 Nov 2018 19:28:38 GMT
GET H/1.1	200 OK	alert.css scanner-9206.win/aviso/index_files/	3 KB 1 KB	31ms 25ms	Stylesheet text/css	2606:4700:30::6812:2249 Cloudflare
General Check archive.org Show headers Download Go to Full URL http://scanner-9206.win/aviso/index_files/alert.css Requested by Host: scanner-9206.win URL: http://scanner-9206.win/aviso/ Protocol HTTP/1.1 Server 2606:4700:30::6812:2249 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `e8c8396c5ab9cd8e6db526222e96aa0d5e6208907a33f8c9032359398e0236b7` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host scanner-9206.win User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/css,/;q=0.1 Referer http://scanner-9206.win/aviso/ Cookie __cfduid=d58702cc80a8f23db0ccbffff68383a101542554918 Connection keep-alive Cache-Control no-cache Referer http://scanner-9206.win/aviso/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Sun, 18 Nov 2018 15:28:38 GMT Content-Encoding gzip CF-Cache-Status MISS Last-Modified Thu, 15 Mar 2018 13:33:38 GMT Server cloudflare ETag W/"5aaa7632-ba5" Vary Accept-Encoding Content-Type text/css Access-Control-Allow-Origin * Cache-Control public, max-age=14400 Transfer-Encoding chunked Connection keep-alive CF-RAY 47bb77d242e5bf1b-FRA Expires Sun, 18 Nov 2018 19:28:38 GMT
GET H/1.1	200 OK	windows.png scanner-9206.win/aviso/index_files/	2 KB 3 KB	22ms 21ms	Image image/png	2606:4700:30::6812:2249 Cloudflare
General Check archive.org Show headers Download Go to Show image Full URL http://scanner-9206.win/aviso/index_files/windows.png Requested by Host: scanner-9206.win URL: http://scanner-9206.win/aviso/ Protocol HTTP/1.1 Server 2606:4700:30::6812:2249 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `9e590c1c5e7601413a44e2c7b8611dab5fb2ee6d6287d3c88bf137465279ef54` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host scanner-9206.win User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept image/webp,image/apng,image/,/;q=0.8 Referer* http://scanner-9206.win/aviso/ Cookie __cfduid=d58702cc80a8f23db0ccbffff68383a101542554918 Connection keep-alive Cache-Control no-cache Referer http://scanner-9206.win/aviso/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Sun, 18 Nov 2018 15:28:38 GMT CF-Cache-Status MISS Last-Modified Thu, 15 Mar 2018 13:33:39 GMT Server cloudflare ETag "5aaa7633-9d3" Vary Accept-Encoding Content-Type image/png Access-Control-Allow-Origin * Cache-Control public, max-age=14400 Connection keep-alive Accept-Ranges bytes CF-RAY 47bb77d241b1bf20-FRA Content-Length 2515 Expires Sun, 18 Nov 2018 19:28:38 GMT
GET H/1.1	200 OK	a.htm Show response scanner-9206.win/aviso/index_files/ Frame 1FEB	107 B 416 B	28ms 27ms	Document text/html	2606:4700:30::6812:2349 Cloudflare
General Check archive.org Show headers Download Go to Full URL http://scanner-9206.win/aviso/index_files/a.htm Requested by Host: scanner-9206.win URL: http://scanner-9206.win/aviso/ Protocol HTTP/1.1 Server 2606:4700:30::6812:2349 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `1df25d4bd4693b4d105b6aa0bbe82a9cb141b9db9e1285b4e0610ea53e378bc9` Request headers Host scanner-9206.win Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8 Referer http://scanner-9206.win/aviso/ Accept-Encoding gzip, deflate Cookie __cfduid=d58702cc80a8f23db0ccbffff68383a101542554918 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Referer http://scanner-9206.win/aviso/ Response headers Date Sun, 18 Nov 2018 15:28:38 GMT Content-Type text/html Transfer-Encoding chunked Connection keep-alive Last-Modified Thu, 15 Mar 2018 13:33:38 GMT Access-Control-Allow-Origin * Server cloudflare CF-RAY 47bb77d2a222636d-FRA Content-Encoding gzip
GET DATA	200 OK	truncated /	239 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `bd08b9849632e73574f62ca80572a17f9bbd9bb1010fe8c6380e641460abd96c` Request headers Response headers Access-Control-Allow-Origin * Content-Type image/png
GET H/1.1	404 Not Found	glyphicons-halflings-regular.woff2 scanner-9206.win/aviso/fonts/	0 0	23ms 23ms	Font text/html	2606:4700:30::6812:2349 Cloudflare
General Check archive.org Show headers Download Go to Full URL http://scanner-9206.win/aviso/fonts/glyphicons-halflings-regular.woff2 Requested by Host: scanner-9206.win URL: http://scanner-9206.win/aviso/ Protocol HTTP/1.1 Server 2606:4700:30::6812:2349 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash Request headers Pragma no-cache Origin http://scanner-9206.win Accept-Encoding gzip, deflate Host scanner-9206.win User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept / Referer http://scanner-9206.win/aviso/index_files/bootstrap.css Cookie __cfduid=d58702cc80a8f23db0ccbffff68383a101542554918 Connection keep-alive Cache-Control no-cache User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Referer http://scanner-9206.win/aviso/index_files/bootstrap.css Origin http://scanner-9206.win Response headers Date Sun, 18 Nov 2018 15:28:38 GMT Content-Encoding gzip CF-Cache-Status MISS Server cloudflare Vary Accept-Encoding Content-Type text/html Cache-Control public, max-age=14400 Transfer-Encoding chunked Connection keep-alive CF-RAY 47bb77d2b228636d-FRA Expires Sun, 18 Nov 2018 19:28:38 GMT
GET H/1.1	404 Not Found	fr.mp3 scanner-9206.win/aviso/	571 B 773 B	15ms 14ms	Media text/html	2606:4700:30::6812:2349 Cloudflare
General Check archive.org Show headers Download Go to Full URL http://scanner-9206.win/aviso/fr.mp3 Requested by Host: scanner-9206.win URL: http://scanner-9206.win/aviso/ Protocol HTTP/1.1 Server 2606:4700:30::6812:2349 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash `023c54a1285c76d07951260b121e14893cd199ae0e557e479c7796f5212709dc` Request headers Pragma no-cache Accept-Encoding identity;q=1, ;q=0 Host* scanner-9206.win User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 chrome-proxy frfr Accept / Cache-Control no-cache Referer http://scanner-9206.win/aviso/ Cookie __cfduid=d58702cc80a8f23db0ccbffff68383a101542554918 Connection keep-alive Range bytes=0- Referer http://scanner-9206.win/aviso/ Accept-Encoding identity;q=1, ;q=0 User-Agent* Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Range bytes=0- chrome-proxy frfr Response headers Date Sun, 18 Nov 2018 15:28:38 GMT Server cloudflare Connection keep-alive CF-RAY 47bb77d2e22e636d-FRA Transfer-Encoding chunked Content-Type text/html
GET H/1.1	206 Partial Content	es.mp3 scanner-9206.win/aviso/	65 KB 0	23ms 22ms	Media audio/mpeg	2606:4700:30::6812:2249 Cloudflare
General Check archive.org Show headers Download Go to Full URL http://scanner-9206.win/aviso/es.mp3 Requested by Host: scanner-9206.win URL: http://scanner-9206.win/aviso/ Protocol HTTP/1.1 Server 2606:4700:30::6812:2249 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash Request headers Pragma no-cache Accept-Encoding identity;q=1, ;q=0 Host* scanner-9206.win User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 chrome-proxy frfr Accept / Cache-Control no-cache Referer http://scanner-9206.win/aviso/ Cookie __cfduid=d58702cc80a8f23db0ccbffff68383a101542554918 Connection keep-alive Range bytes=0- Referer http://scanner-9206.win/aviso/ Accept-Encoding identity;q=1, ;q=0 User-Agent* Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Range bytes=0- chrome-proxy frfr Response headers Date Sun, 18 Nov 2018 15:28:38 GMT Last-Modified Thu, 15 Mar 2018 13:33:38 GMT Server cloudflare Access-Control-Allow-Origin * ETag "5aaa7632-50480" Content-Type audio/mpeg Content-Range bytes 0-328831/328832 Connection keep-alive CF-RAY 47bb77d2e1dcbf20-FRA Content-Length 328832
GET H/1.1	200 OK	js15_as.js Show response s10.histats.com/	10 KB 4 KB	39ms 9ms	Script text/javascript	46.105.201.240 OVH
General Check archive.org Show headers Download Go to Full URL http://s10.histats.com/js15_as.js Requested by Host: scanner-9206.win URL: http://scanner-9206.win/aviso/ Protocol HTTP/1.1 Server 46.105.201.240 , France, ASN16276 (OVH, FR), Reverse DNS Software / Resource Hash `cba2dd9d00ef6c95d4cb86a6c42e8f86d0935e0276348138f47e8f787107d560` Request headers Referer http://scanner-9206.win/aviso/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Sun, 18 Nov 2018 15:24:15 GMT Content-Encoding gzip Last-Modified Mon, 12 Jun 2017 15:26:33 GMT X-CDN-Pop-IP 137.74.120.32/27 ETag "1262556565" X-Cacheable Matched cache Vary Accept-Encoding X-IPLB-Instance 4746 Content-Type text/javascript X-CDN-Pop sbg Accept-Ranges bytes Content-Length 4243
GET H/1.1	404 Not Found	glyphicons-halflings-regular.woff scanner-9206.win/aviso/fonts/	0 0	36ms 35ms	Font text/html	2606:4700:30::6812:2349 Cloudflare
General Check archive.org Show headers Download Go to Full URL http://scanner-9206.win/aviso/fonts/glyphicons-halflings-regular.woff Requested by Host: scanner-9206.win URL: http://scanner-9206.win/aviso/ Protocol HTTP/1.1 Server 2606:4700:30::6812:2349 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash Request headers Pragma no-cache Origin http://scanner-9206.win Accept-Encoding gzip, deflate Host scanner-9206.win User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept / Referer http://scanner-9206.win/aviso/index_files/bootstrap.css Cookie __cfduid=d58702cc80a8f23db0ccbffff68383a101542554918 Connection keep-alive Cache-Control no-cache User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Referer http://scanner-9206.win/aviso/index_files/bootstrap.css Origin http://scanner-9206.win Response headers Date Sun, 18 Nov 2018 15:28:38 GMT Content-Encoding gzip CF-Cache-Status MISS Server cloudflare Vary Accept-Encoding Content-Type text/html Cache-Control public, max-age=14400 Transfer-Encoding chunked Connection keep-alive CF-RAY 47bb77d2e230636d-FRA Expires Sun, 18 Nov 2018 19:28:38 GMT
GET H/1.1	404 Not Found	glyphicons-halflings-regular.ttf scanner-9206.win/aviso/fonts/	0 0	30ms 29ms	Font text/html	2606:4700:30::6812:2349 Cloudflare
General Check archive.org Show headers Download Go to Full URL http://scanner-9206.win/aviso/fonts/glyphicons-halflings-regular.ttf Requested by Host: scanner-9206.win URL: http://scanner-9206.win/aviso/ Protocol HTTP/1.1 Server 2606:4700:30::6812:2349 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash Request headers Pragma no-cache Origin http://scanner-9206.win Accept-Encoding gzip, deflate Host scanner-9206.win User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept / Referer http://scanner-9206.win/aviso/index_files/bootstrap.css Cookie __cfduid=d58702cc80a8f23db0ccbffff68383a101542554918 Connection keep-alive Cache-Control no-cache User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Referer http://scanner-9206.win/aviso/index_files/bootstrap.css Origin http://scanner-9206.win Response headers Date Sun, 18 Nov 2018 15:28:38 GMT Content-Encoding gzip CF-Cache-Status MISS Server cloudflare Vary Accept-Encoding Content-Type text/html Cache-Control public, max-age=14400 Transfer-Encoding chunked Connection keep-alive CF-RAY 47bb77d3223f636d-FRA Expires Sun, 18 Nov 2018 19:28:38 GMT
GET H/1.1	200 OK	0.php Show response s4.histats.com/stats/	50 B 321 B	184ms 89ms	Script text/html	208.43.241.179 SoftLayer Technol...
General Check archive.org Show headers Download Go to Full URL http://s4.histats.com/stats/0.php?4024417&@f16&@g1&@h1&@i1&@j1542554918906&@k0&@l1&@mInformaci%C3%B3n&@n0&@o1000&@q0&@r0&@s0&@ten-US&@u1600&@vhttp%3A%2F%2Fscanner-9206.win%2Faviso%2F&@w Requested by Host: s10.histats.com URL: http://s10.histats.com/js15_as.js Protocol HTTP/1.1 Server 208.43.241.179 Chantilly, United States, ASN36351 (SOFTLAYER - SoftLayer Technologies Inc., US), Reverse DNS b3.f1.2bd0.ip4.static.sl-reverse.com Software / Resource Hash `830af7ec5b7c9d4f273ffc122766d44e80fbdcd6de72b4c7488f44d73105920d` Request headers Referer http://scanner-9206.win/aviso/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Sun, 18 Nov 2018 15:28:39 GMT Connection close Content-Length 50 Content-Type text/html;charset=UTF-8

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft Defender (Consumer) Generic (Online) Tech Support Scam (Consumer)

28 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

8 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
scanner-9206.win/	1970-01-19 05:14:50	Name: HstCns4024417 Value: 1
scanner-9206.win/	1970-01-19 05:14:50	Name: HstCnv4024417 Value: 1
scanner-9206.win/	1970-01-19 05:14:50	Name: HstCla4024417 Value: 1542554918906
scanner-9206.win/	1970-01-19 05:14:50	Name: HstPn4024417 Value: 1
scanner-9206.win/	1970-01-19 05:14:50	Name: HstCfa4024417 Value: 1542554918906
scanner-9206.win/	1970-01-19 05:14:50	Name: HstCmu4024417 Value: 1542554918906
scanner-9206.win/	1970-01-19 05:14:50	Name: HstPt4024417 Value: 1
.scanner-9206.win/	1970-01-19 05:14:50	Name: __cfduid Value: d58702cc80a8f23db0ccbffff68383a101542554918

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

s10.histats.com
s4.histats.com
scanner-9206.win
208.43.241.179
2606:4700:30::6812:2249
2606:4700:30::6812:2349
46.105.201.240
023c54a1285c76d07951260b121e14893cd199ae0e557e479c7796f5212709dc
0790d6e7b1d913a80a9d5592a50634d19abecee08b903d3ce0b92302ecc8ca8d
1df25d4bd4693b4d105b6aa0bbe82a9cb141b9db9e1285b4e0610ea53e378bc9
78dcaaf93c8b138b0d84e81e3a30a31daa07b00d733304977762a2c9636c6b5e
830af7ec5b7c9d4f273ffc122766d44e80fbdcd6de72b4c7488f44d73105920d
9e590c1c5e7601413a44e2c7b8611dab5fb2ee6d6287d3c88bf137465279ef54
b2b61d5cb1712e3bf658a1008ddf27236f0eaefb0c88271df843d225c579d512
bd08b9849632e73574f62ca80572a17f9bbd9bb1010fe8c6380e641460abd96c
cba2dd9d00ef6c95d4cb86a6c42e8f86d0935e0276348138f47e8f787107d560
df76fb7518b1201acc79262e0dc6c773a85f04c36e0a9ea61994c22fbd97087b
e8c8396c5ab9cd8e6db526222e96aa0d5e6208907a33f8c9032359398e0236b7

scanner-9206.win Open in urlscan Pro 2606:4700:30::6812:2249 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

14 Requests

0 %HTTPS

50 %IPv6

2 Domains

3 Subdomains

5 IPs

2 Countries

85 kBTransfer

332 kBSize

8 Cookies

0 Outgoing links

Redirected requests

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

28 JavaScript Global Variables

8 Cookies

Indicators

scanner-9206.win Open in urlscan Pro
2606:4700:30::6812:2249 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

14
Requests

0 %
HTTPS

50 %
IPv6

2
Domains

3
Subdomains

5
IPs

2
Countries

85 kB
Transfer

332 kB
Size

8
Cookies

14 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!