urlquery Scam - Fake AntiVirus / Security software
Verdictscam
Severitymedium
WEBSITE ANALYSIS REPORT
http://giltroom-e10a8dedb705.herokuapp.com/?gad_source\\=5&gad_campaignid\\=24162979591&gclid =EAIaIQobChMI3PrFgMWvlgMVQVmdBh2X3xCcEAEYASAAEgJSLPD_BwE
public
Suspicious activity
Review evidence →2 detections · review the detection signals
Report summary
Submitted and final observations · captured HTTP activity
- Submitted URL
- http://giltroom-e10a8dedb705.herokuapp.com/?gad_source\\=5&gad_campaignid\\=24162979591&gclid =EAIaIQobChMI3PrFgMWvlgMVQVmdBh2X3xCcEAEYASAAEgJSLPD_BwE
- Submitted IP / ASN
3.210.192.5 AS14618 · AMAZON-AES
- Final URL
- https://pub-c0550cc316744fbeaed8a504e6dc38f3.r2.dev/Wi0n042HelpSaiErr0082/index.html
- Final IP / ASN
104.18.50.34 AS13335 · CLOUDFLARENET
Final page
- Page title
- Security center
- Final DOM MIME
- text/html; charset=utf-8
- Final DOM size
- 28.8 KB (29478 bytes)
Detections
Activity
- HTTP requests
- 68
- Observed hosts
- 10
- Script records
- 44
Estimated HTTP data
- Sent
- ~40.1 KB
- Received
- ~4.98 MB
Page capture
Final browser state
pub-c0550cc316744fbeaed8a504e6dc38f3.r2.dev
Screenshot unavailableNo screenshot pixels areavailable for this report.
Detection signals
URLQuery findings, Threat Detection Systems, and IDS alerts
URLQuery
1Host infrastructure
Observed hosts are context, not independent maliciousness verdicts
| Host | Rank | Registered | First seen | Last seen | Sent | Received | IP | Fingerprints |
|---|---|---|---|---|---|---|---|---|
| images.unsplash.com | 86676 | 2013-05-29 | 2015-08-06 | 2026-08-19 | 1.2 KB | 214.8 KB | 151.101.130.208 | |
| pub-c0550cc316744fbeaed8a504e6dc38f3.r2.dev 46 alerts | N/A | N/A | N/A | N/A | 27.6 KB | 4.01 MB | 104.18.50.34 | Cloudflare CDN Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services. jQuery JavaScript libraries jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax. Bootstrap UI frameworks Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components. |
| va.tawk.to | 51316 | N/A | 2017-01-30 | 2026-08-18 | 1.8 KB | 4.8 KB | 172.66.161.212 | Cloudflare CDN Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services. HSTS Security HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS. |
| vsb138.tawk.to | 1498645 | N/A | 2025-02-25 | 2026-08-13 | 1.1 KB | 0 B | Not recorded | |
| giltroom-e10a8dedb705.herokuapp.com | N/A | 2010-09-19 | 2026-08-20 | 2026-08-20 | 1.7 KB | 67.3 KB | 3.229.186.102 | |
| embed.tawk.to | 52083 | N/A | 2014-03-19 | 2026-08-17 | 4.6 KB | 691.7 KB | 172.66.161.212 | Cloudflare CDN Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services. HSTS Security HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS. |
| ipwho.is | 18239 | 2022-01-29 | 2020-06-08 | 2026-08-18 | 500 B | 941 B | 172.66.175.107 | Cloudflare CDN Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services. |
| userstatics.com | 262534 | 2020-11-05 | 2020-11-05 | 2026-08-12 | 581 B | 560 B |  94.154.32.91 | Ubuntu Operating systems Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT. PHP:8.2.1 Programming languages PHP is a general-purpose scripting language used for web development. Nginx:1.24.0 Web servers, Reverse proxies Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache. |
| cloakpro.online | N/A | 2026-01-30 | 2026-06-22 | 2026-08-17 | 507 B | 1.1 KB | 104.26.13.136 | HSTS Security HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS. Cloudflare CDN Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services. Express Web frameworks, Web servers Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs. Node.js Programming languages Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser. |
| analytics-data-ui.github.io | N/A | 2013-03-08 | 2025-04-30 | 2026-05-13 | 508 B | 4.0 KB | 185.199.110.153 | GitHub Pages PaaS GitHub Pages is a static site hosting service. HSTS Security HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS. Varnish Caching Varnish is a reverse caching proxy. Fastly CDN Fastly is a cloud computing services provider. Fastly's cloud platform provides a content delivery network, Internet security services, load balancing, and video & streaming services. |