admin-extremtk.info
130.12.181.99AS197769 · USthe page is a self-hosted ScreenConnect remote-support console on a host ScreenConnect's vendor does not run, and its title presents it as Norton, a brand this address is not associated with
- Browser Analysissuspicious
- Threat Intelligenceclean
- Network & Hostingclean
- Related Infrastructureclean
- Content Inspectionunknown
- Domain Intelligenceunknown
- TLS Fingerprintunknown
What happened
Step by step, from what the scanner recorded.Be careful — warning signs found
AutomatedIts page title claims to be Norton, which this address is not associated with. It is a self-hosted ScreenConnect remote-support console, the kind of server that hands out remote-access installers, presented as Norton on an address that neither Norton nor the console's vendor runs. This site shows signs commonly seen in scams or impersonation, but we could not confirm it for certain. It may be a real threat, or it may be a legitimate site that simply looks unusual to our automated checks.
What to do
Avoid entering passwords or payment details until you are sure it is genuine. Open the company directly from its known website or app instead of this link. Check the evidence below and escalate to your analyst if unsure.
"Suspicious" is a caution, not a confirmation — it can be a false alarm. The evidence below explains why it was flagged.
Findings
Strongest firstThe page is a ScreenConnect server's own web console, recognised from the routes the product itself serves, hosted on a domain the vendor does not run. Its title presents it as Norton, a brand whose own domains do not include this host. A console is the server that hands out remote-access installers; one wearing a brand it is not is staged to do so under a pretext.
Analyst noteCheck who the domain belongs to and whether that organisation could plausibly carry this brand's name. If a session code or an installer download appears on this host later, the delivery family applies. No installer was observed on this scan — the verdict is capped at Suspicious for that reason.
The page presents itself as a known brand (brand keywords/branding detected).
Analyst noteLow/medium confidence (keyword only) — can be a news article or partner page. Corroborate before acting.
File
The file was not analysed, so the scan carries no verdict on the file itself.
Infrastructure
- IP
- 130.12.181.99VPSDEDICATED-AS - VPS Dedicated LLC, US · AS197769US
- TLS
- CN=YR1, O=Let's Encrypt, C=US · expires Nov 19, 2026
WHOIS
- Registrar
- NameCheap, Inc.
- Created
- Jul 2, 2026
- Expires
- Jul 2, 2027
- Nameservers
- wesley.ns.cloudflare.comblakely.ns.cloudflare.com
Hashes & fingerprints
Page capture
LiveTitle “Norton world” · brand shown: Norton (low)
Engines
7 · time to verdictPage
- HTTP
- 200 · Completed
- Title
- Norton world
- Load
- 1.55 s · 14 requests