urlquery Scam - Fake AntiVirus / Security software
Verdictscam
Severitymedium
WEBSITE ANALYSIS REPORT
http://tatrck.com/v1/go/?deeplink=https://r.salegains.com?cid=106&mid=56032&uid=3Cep5Vtm4e85VVCvYlJOXq7fapNmL93qYA0vJdewnpESqz&p=Kb8xTsh9se
public
Suspicious activity
Review evidence →2 detections · review the detection signals
Report summary
Submitted and final observations · captured HTTP activity
- Submitted URL
- http://tatrck.com/v1/go/?deeplink=https://r.salegains.com?cid=106&mid=56032&uid=3Cep5Vtm4e85VVCvYlJOXq7fapNmL93qYA0vJdewnpESqz&p=Kb8xTsh9se
- Submitted IP / ASN
172.67.173.8 AS13335 · CLOUDFLARENET
- Final URL
- https://r.salegains.com/?cid=106
- Final IP / ASN
- 104.21.69.88 AS13335 · CLOUDFLARENET
Final page
- Page title
- System Error
- Final DOM MIME
- text/html; charset=utf-8
- Final DOM size
- 5.1 KB (5230 bytes)
Detections
Activity
- HTTP requests
- 12
- Observed hosts
- 4
- Script records
- 6
Estimated HTTP data
- Sent
- ~34.5 KB
- Received
- ~104.1 KB
Page capture
Final browser state
Detection signals
URLQuery findings, Threat Detection Systems, and IDS alerts
URLQuery
1Host infrastructure
Observed hosts are context, not independent maliciousness verdicts
| Host | Rank | Registered | First seen | Last seen | Sent | Received | IP | Fingerprints |
|---|---|---|---|---|---|---|---|---|
| tatrck.com | 131147 | 2023-06-15 | 2023-06-16 | 2026-07-18 | 600 B | 627 B | 172.67.173.8 | Cloudflare CDN Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services. |
| r.salegains.com 9 alerts | 7239561 | 2023-12-23 | 2025-03-25 | 2026-07-18 | 5.7 KB | 66.5 KB | 104.21.69.88 | Cloudflare CDN Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services. Cloudflare Browser Insights Analytics, RUM Cloudflare Browser Insights is a tool that measures the performance of websites from the perspective of users. HSTS Security HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS. |
| fonts.googleapis.com | 313 | 2005-01-25 | 2012-05-23 | 2026-07-12 | 532 B | 5.5 KB |  142.250.178.106 | HSTS Security HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS. |
| fonts.gstatic.com | N/A | 2008-02-11 | 2014-04-02 | 2026-07-12 | 604 B | 31.5 KB | 142.250.178.35 |