xcisky.tk Open in urlscan Pro
178.159.36.241 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://xcisky.tk/dropboxsalam/dropboxtoday/auth/view/share/
Submission: On July 06 via api (July 6th 2017, 1:35:51 pm UTC) from CA

Summary HTTP 22 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 5 IPs in 2 countries across 4 domains to perform 22 HTTP transactions. The main IP is 178.159.36.241, located in Russian Federation and belongs to AS-MAROSNET Moscow, Russia, RU. The main domain is xcisky.tk.

This is the only time xcisky.tk was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Google (Online)

Domain & IP information

	IP Address	AS Autonomous System
16	178.159.36.241 178.159.36.241	48666 (AS-MAROSN...) (AS-MAROSNET Moscow)
2	2a00:1450:400... 2a00:1450:4001:814::200a	15169 (GOOGLE) (GOOGLE - Google Inc.)
3	2a00:1450:400... 2a00:1450:4001:814::2003	15169 (GOOGLE) (GOOGLE - Google Inc.)
1	2a00:1450:400... 2a00:1450:4001:814::200e	15169 (GOOGLE) (GOOGLE - Google Inc.)
22	5

16 178.159.36.241 (Russian Federation)

ASN48666 (AS-MAROSNET Moscow, Russia, RU)

xcisky.tk	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:814::200a (Ireland)

ASN15169 (GOOGLE - Google Inc., US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:814::2003 (Ireland)

ASN15169 (GOOGLE - Google Inc., US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:814::200e (Ireland)

ASN15169 (GOOGLE - Google Inc., US)

tools.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
16	xcisky.tk xcisky.tk	995 KB
3	gstatic.com fonts.gstatic.com	54 KB
2	googleapis.com fonts.googleapis.com	633 B
1	google.com tools.google.com
22	4

	Domain	Requested by
16	xcisky.tk	xcisky.tk
3	fonts.gstatic.com	xcisky.tk
2	fonts.googleapis.com	xcisky.tk
1	tools.google.com	xcisky.tk
22	4

This site contains links to these domains. Also see Links.

Domain
drive.google.com

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://xcisky.tk/dropboxsalam/dropboxtoday/auth/view/share/
Frame ID: 2282.1
Requests: 23 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Statistics

22
Requests

0 %
HTTPS

75 %
IPv6

4
Domains

4
Subdomains

5
IPs

2
Countries

1049 kB
Transfer

1078 kB
Size

1
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: http://drive.google.com/?utm_source=en&utm_medium=button&utm_campaign=web&utm_content=gotodrive&usp=drive_landing
Title: Open Drive

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

22 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
xcisky.tk/dropboxsalam/dropboxtoday/auth/view/share/ 18 KB
18 KB 149ms
43ms Document
text/html 178.159.36.241
AS-MAROSNET Moscow

General

Check archive.org

Show headers Download Go to

Full URL: http://xcisky.tk/dropboxsalam/dropboxtoday/auth/view/share/
Protocol: HTTP/1.1
Server: 178.159.36.241 , Russian Federation, ASN48666 (AS-MAROSNET Moscow, Russia, RU),
Reverse DNS
Software: Apache /
Resource Hash: cd8afff09862066648693568b76b7469e56c3004e78bdc498e70220a2a240a65

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date: Thu, 06 Jul 2017 13:35:51 GMT
Last-Modified: Fri, 28 Nov 2014 07:20:26 GMT
Server: Apache
Content-Type: text/html
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 18190

GET
H/1.1 200
OK css
fonts.googleapis.com/ 1 KB
350 B 16ms
15ms Stylesheet
text/css 2a00:1450:4001:814::200a
Google Inc.

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.googleapis.com/css?family=Open+Sans:300,400,600,700&lang=en

Requested by

Host: xcisky.tk
URL: http://xcisky.tk/dropboxsalam/dropboxtoday/auth/view/share/

Protocol

HTTP/1.1

Server

2a00:1450:4001:814::200a , Ireland, ASN15169 (GOOGLE - Google Inc., US),

Reverse DNS

Software

ESF /

Resource Hash

ca18764330100e7f48b96a00925190d5e2faee344206c1f02acd7c03a2c18ebf

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: http://xcisky.tk/dropboxsalam/dropboxtoday/auth/view/share/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date: Thu, 06 Jul 2017 13:35:39 GMT
Content-Encoding: gzip
Server: ESF
X-Frame-Options: SAMEORIGIN
Content-Type: text/css; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: private, max-age=86400
Transfer-Encoding: chunked
Timing-Allow-Origin: *
X-XSS-Protection: 1; mode=block
Expires: Thu, 06 Jul 2017 13:35:39 GMT

GET
H/1.1 200
OK drive-dlpage.css
xcisky.tk/dropboxsalam/dropboxtoday/auth/view/res/drive/css/ 9 KB
9 KB 89ms
45ms Stylesheet
text/css 178.159.36.241
AS-MAROSNET Moscow

General

Check archive.org

Show headers Download Go to

Full URL: http://xcisky.tk/dropboxsalam/dropboxtoday/auth/view/res/drive/css/drive-dlpage.css
Requested by: Host: xcisky.tk
URL: http://xcisky.tk/dropboxsalam/dropboxtoday/auth/view/share/
Protocol: HTTP/1.1
Server: 178.159.36.241 , Russian Federation, ASN48666 (AS-MAROSNET Moscow, Russia, RU),
Reverse DNS
Software: Apache /
Resource Hash: b927138c8add3717eeded4aed4a8d01cbace679715efafa1c2fa18aff32273d2

Request headers

Referer: http://xcisky.tk/dropboxsalam/dropboxtoday/auth/view/share/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date: Thu, 06 Jul 2017 13:35:51 GMT
Last-Modified: Fri, 28 Nov 2014 07:28:10 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 9270

GET
H/1.1 200
OK maia.css
xcisky.tk/dropboxsalam/dropboxtoday/www.google.com/css/ 41 KB
41 KB 90ms
44ms Stylesheet
text/css 178.159.36.241
AS-MAROSNET Moscow

General

Check archive.org

Show headers Download Go to

Full URL: http://xcisky.tk/dropboxsalam/dropboxtoday/www.google.com/css/maia.css
Requested by: Host: xcisky.tk
URL: http://xcisky.tk/dropboxsalam/dropboxtoday/auth/view/share/
Protocol: HTTP/1.1
Server: 178.159.36.241 , Russian Federation, ASN48666 (AS-MAROSNET Moscow, Russia, RU),
Reverse DNS
Software: Apache /
Resource Hash: fcc92c066b4b240747c5b6067fa8e954f5cc93a3cc3d9cf840e6301c7e02da7c

Request headers

Referer: http://xcisky.tk/dropboxsalam/dropboxtoday/auth/view/share/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date: Thu, 06 Jul 2017 13:35:51 GMT
Last-Modified: Sun, 19 Oct 2014 08:28:52 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 41706

GET
H/1.1 200
OK drive-download.css
xcisky.tk/dropboxsalam/dropboxtoday/auth/view/res/drive/css/ 15 KB
15 KB 89ms
44ms Stylesheet
text/css 178.159.36.241
AS-MAROSNET Moscow

General

Check archive.org

Show headers Download Go to

Full URL: http://xcisky.tk/dropboxsalam/dropboxtoday/auth/view/res/drive/css/drive-download.css
Requested by: Host: xcisky.tk
URL: http://xcisky.tk/dropboxsalam/dropboxtoday/auth/view/share/
Protocol: HTTP/1.1
Server: 178.159.36.241 , Russian Federation, ASN48666 (AS-MAROSNET Moscow, Russia, RU),
Reverse DNS
Software: Apache /
Resource Hash: 437398aae3cd98321fb24ce478d22a94e5f90f92d01284ea2bb61f0c1b8e74bd

Request headers

Referer: http://xcisky.tk/dropboxsalam/dropboxtoday/auth/view/share/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date: Thu, 06 Jul 2017 13:35:51 GMT
Last-Modified: Sun, 19 Oct 2014 08:28:52 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 15363

GET
H/1.1 200
OK modernizr.js Show response
xcisky.tk/dropboxsalam/dropboxtoday/www.gstatic.com/external_hosted/modernizr/ 18 KB
18 KB 94ms
48ms Script
application/javascript 178.159.36.241
AS-MAROSNET Moscow

General

Check archive.org

Show headers Download Go to

Full URL: http://xcisky.tk/dropboxsalam/dropboxtoday/www.gstatic.com/external_hosted/modernizr/modernizr.js
Requested by: Host: xcisky.tk
URL: http://xcisky.tk/dropboxsalam/dropboxtoday/auth/view/share/
Protocol: HTTP/1.1
Server: 178.159.36.241 , Russian Federation, ASN48666 (AS-MAROSNET Moscow, Russia, RU),
Reverse DNS
Software: Apache /
Resource Hash: 8c2d2e5d88589a1283ec0cdf49bedc2dd3a8f40fe77c39c3e00ed8cef1968ff3

Request headers

Referer: http://xcisky.tk/dropboxsalam/dropboxtoday/auth/view/share/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date: Thu, 06 Jul 2017 13:35:51 GMT
Last-Modified: Sun, 19 Oct 2014 08:28:52 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 18121

GET
H/1.1 200
OK gu-util.js Show response
xcisky.tk/dropboxsalam/dropboxtoday/auth/tools/dlpage/res/c/ 7 KB
7 KB 92ms
46ms Script
application/javascript 178.159.36.241
AS-MAROSNET Moscow

General

Check archive.org

Show headers Download Go to

Full URL: http://xcisky.tk/dropboxsalam/dropboxtoday/auth/tools/dlpage/res/c/gu-util.js
Requested by: Host: xcisky.tk
URL: http://xcisky.tk/dropboxsalam/dropboxtoday/auth/view/share/
Protocol: HTTP/1.1
Server: 178.159.36.241 , Russian Federation, ASN48666 (AS-MAROSNET Moscow, Russia, RU),
Reverse DNS
Software: Apache /
Resource Hash: 45120993a137bcca95ccfe97fb236f8dd7827c89fe7385c76a63df739ce731a1

Request headers

Referer: http://xcisky.tk/dropboxsalam/dropboxtoday/auth/view/share/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date: Thu, 06 Jul 2017 13:35:51 GMT
Last-Modified: Sun, 19 Oct 2014 08:28:52 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 6717

GET
H/1.1 404
Not Found logo-drive.png
xcisky.tk/dropboxsalam/dropboxtoday/auth/view/res/drive/images/ 384 B
0 56ms
56ms Image
text/html 178.159.36.241
AS-MAROSNET Moscow

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://xcisky.tk/dropboxsalam/dropboxtoday/auth/view/res/drive/images/logo-drive.png
Requested by: Host: xcisky.tk
URL: http://xcisky.tk/dropboxsalam/dropboxtoday/auth/view/share/
Protocol: HTTP/1.1
Server: 178.159.36.241 , Russian Federation, ASN48666 (AS-MAROSNET Moscow, Russia, RU),
Reverse DNS
Software: Apache /
Resource Hash: 1eff427c0cde8deaf4a1bd995519737c138b124d5dfa0fc6c5d60ca8e2ae40ee

Request headers

Referer: http://xcisky.tk/dropboxsalam/dropboxtoday/auth/view/share/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date: Thu, 06 Jul 2017 13:35:51 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=99
Content-Length: 384
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 200
OK drive-devices.jpg
xcisky.tk/dropboxsalam/dropboxtoday/auth/view/res/drive/images/ 721 KB
721 KB 52ms
51ms Image
image/jpeg 178.159.36.241
AS-MAROSNET Moscow

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://xcisky.tk/dropboxsalam/dropboxtoday/auth/view/res/drive/images/drive-devices.jpg
Requested by: Host: xcisky.tk
URL: http://xcisky.tk/dropboxsalam/dropboxtoday/auth/view/share/
Protocol: HTTP/1.1
Server: 178.159.36.241 , Russian Federation, ASN48666 (AS-MAROSNET Moscow, Russia, RU),
Reverse DNS
Software: Apache /
Resource Hash: 47f60f88513755e18ea6e52813e00e90225696d3566a662b62ac100182fcd42c

Request headers

Referer: http://xcisky.tk/dropboxsalam/dropboxtoday/auth/view/share/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date: Thu, 06 Jul 2017 13:35:51 GMT
Last-Modified: Sun, 19 Oct 2014 08:28:52 GMT
Server: Apache
Content-Type: image/jpeg
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 738149

GET
H/1.1 200
OK dlpage-ui.js Show response
xcisky.tk/dropboxsalam/dropboxtoday/auth/view/res/drive/scripts/ 23 KB
23 KB 44ms
43ms Script
application/javascript 178.159.36.241
AS-MAROSNET Moscow

General

Check archive.org

Show headers Download Go to

Full URL: http://xcisky.tk/dropboxsalam/dropboxtoday/auth/view/res/drive/scripts/dlpage-ui.js
Requested by: Host: xcisky.tk
URL: http://xcisky.tk/dropboxsalam/dropboxtoday/auth/view/share/
Protocol: HTTP/1.1
Server: 178.159.36.241 , Russian Federation, ASN48666 (AS-MAROSNET Moscow, Russia, RU),
Reverse DNS
Software: Apache /
Resource Hash: 144833da7db985fa98ebd0a0b7d45ca3fb94df849cedb280957957f658211b27

Request headers

Referer: http://xcisky.tk/dropboxsalam/dropboxtoday/auth/view/share/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date: Thu, 06 Jul 2017 13:35:51 GMT
Last-Modified: Sun, 19 Oct 2014 08:28:52 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 24028

GET
H/1.1 200
OK logo.png
xcisky.tk/dropboxsalam/dropboxtoday/auth/view/share/ 38 KB
38 KB 54ms
54ms Image
image/png 178.159.36.241
AS-MAROSNET Moscow

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://xcisky.tk/dropboxsalam/dropboxtoday/auth/view/share/logo.png
Requested by: Host: xcisky.tk
URL: http://xcisky.tk/dropboxsalam/dropboxtoday/auth/view/share/
Protocol: HTTP/1.1
Server: 178.159.36.241 , Russian Federation, ASN48666 (AS-MAROSNET Moscow, Russia, RU),
Reverse DNS
Software: Apache /
Resource Hash: e6e2256b73bc828ed2c8c92650c242c70da88e8e429c6d4d701cacdce24690c3

Request headers

Referer: http://xcisky.tk/dropboxsalam/dropboxtoday/auth/view/share/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date: Thu, 06 Jul 2017 13:35:51 GMT
Last-Modified: Sun, 19 Oct 2014 08:28:52 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 39063

GET
H/1.1 200
OK loading-16.gif
xcisky.tk/dropboxsalam/dropboxtoday/auth/view/res/c/image/ 2 KB
2 KB 60ms
59ms Image
image/gif 178.159.36.241
AS-MAROSNET Moscow

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://xcisky.tk/dropboxsalam/dropboxtoday/auth/view/res/c/image/loading-16.gif
Requested by: Host: xcisky.tk
URL: http://xcisky.tk/dropboxsalam/dropboxtoday/auth/view/share/
Protocol: HTTP/1.1
Server: 178.159.36.241 , Russian Federation, ASN48666 (AS-MAROSNET Moscow, Russia, RU),
Reverse DNS
Software: Apache /
Resource Hash: e76c2eee68acdf5bdb9aa39ba51a3697d45af022bbfef1dba87a4866e4868201

Request headers

Referer: http://xcisky.tk/dropboxsalam/dropboxtoday/auth/view/share/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date: Thu, 06 Jul 2017 13:35:51 GMT
Last-Modified: Sun, 19 Oct 2014 08:28:52 GMT
Server: Apache
Content-Type: image/gif
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 1969

GET
H/1.1 200
OK TweenMax.min.js Show response
xcisky.tk/dropboxsalam/dropboxtoday/www.gstatic.com/external_hosted/gsap/ 92 KB
92 KB 54ms
53ms Script
application/javascript 178.159.36.241
AS-MAROSNET Moscow

General

Check archive.org

Show headers Download Go to

Full URL: http://xcisky.tk/dropboxsalam/dropboxtoday/www.gstatic.com/external_hosted/gsap/TweenMax.min.js
Requested by: Host: xcisky.tk
URL: http://xcisky.tk/dropboxsalam/dropboxtoday/auth/view/share/
Protocol: HTTP/1.1
Server: 178.159.36.241 , Russian Federation, ASN48666 (AS-MAROSNET Moscow, Russia, RU),
Reverse DNS
Software: Apache /
Resource Hash: 06f0ebc812f5443ad3361835c8c7fd24de9117a13d59d59a99e516d5a6323f0d

Request headers

Referer: http://xcisky.tk/dropboxsalam/dropboxtoday/auth/view/share/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date: Thu, 06 Jul 2017 13:35:51 GMT
Last-Modified: Sun, 19 Oct 2014 08:28:52 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=96
Content-Length: 94229

GET
H/1.1 200
OK drive-base.css
xcisky.tk/dropboxsalam/dropboxtoday/auth/view/res/drive/css/ 5 KB
5 KB 45ms
44ms Stylesheet
text/css 178.159.36.241
AS-MAROSNET Moscow

General

Check archive.org

Show headers Download Go to

Full URL: http://xcisky.tk/dropboxsalam/dropboxtoday/auth/view/res/drive/css/drive-base.css
Requested by: Host: xcisky.tk
URL: http://xcisky.tk/dropboxsalam/dropboxtoday/auth/view/share/
Protocol: HTTP/1.1
Server: 178.159.36.241 , Russian Federation, ASN48666 (AS-MAROSNET Moscow, Russia, RU),
Reverse DNS
Software: Apache /
Resource Hash: 899a954829dd74b84d635b637521dc7600cf1a27647f151cfe28e729defb0c7f

Request headers

Referer: http://xcisky.tk/dropboxsalam/dropboxtoday/auth/view/share/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date: Thu, 06 Jul 2017 13:35:51 GMT
Last-Modified: Sun, 19 Oct 2014 08:28:52 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 5410

GET
H/1.1 200
OK css
fonts.googleapis.com/ 522 B
283 B 15ms
15ms Stylesheet
text/css 2a00:1450:4001:814::200a
Google Inc.

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.googleapis.com/css?family=Open+Sans:400,600&subset=latin&effect=smoothing

Requested by

Host: xcisky.tk
URL: http://xcisky.tk/dropboxsalam/dropboxtoday/auth/view/share/

Protocol

HTTP/1.1

Server

2a00:1450:4001:814::200a , Ireland, ASN15169 (GOOGLE - Google Inc., US),

Reverse DNS

Software

ESF /

Resource Hash

299e3a3e10fc0d4874c1efef96805c885c46d5263e4a4609bbd80f57026354dc

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: http://xcisky.tk/dropboxsalam/dropboxtoday/auth/view/share/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date: Thu, 06 Jul 2017 13:35:39 GMT
Content-Encoding: gzip
Server: ESF
X-Frame-Options: SAMEORIGIN
Content-Type: text/css; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: private, max-age=86400
Transfer-Encoding: chunked
Timing-Allow-Origin: *
X-XSS-Protection: 1; mode=block
Expires: Thu, 06 Jul 2017 13:35:39 GMT

GET
H/1.1 200
OK goog.css
xcisky.tk/dropboxsalam/dropboxtoday/www.google.com/tools/dlpage/res/c/css/ 770 B
770 B 42ms
42ms Stylesheet
text/css 178.159.36.241
AS-MAROSNET Moscow

General

Check archive.org

Show headers Download Go to

Full URL: http://xcisky.tk/dropboxsalam/dropboxtoday/www.google.com/tools/dlpage/res/c/css/goog.css
Requested by: Host: xcisky.tk
URL: http://xcisky.tk/dropboxsalam/dropboxtoday/auth/view/share/
Protocol: HTTP/1.1
Server: 178.159.36.241 , Russian Federation, ASN48666 (AS-MAROSNET Moscow, Russia, RU),
Reverse DNS
Software: Apache /
Resource Hash: 15b929a7975171a1b952c66987fef0d3221c92f03b77cceef77494f68dcada47

Request headers

Referer: http://xcisky.tk/dropboxsalam/dropboxtoday/auth/view/share/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date: Thu, 06 Jul 2017 13:35:51 GMT
Last-Modified: Sun, 19 Oct 2014 08:28:52 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=97
Content-Length: 770

GET
H/1.1 200
OK cJZKeOuBrn4kERxqtaUH3aCWcynf_cDxXwCLxiixG1c.ttf
fonts.gstatic.com/s/opensans/v14/ 26 KB
17 KB 6ms
6ms Font
font/ttf 2a00:1450:4001:814::2003
Google Inc.

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.gstatic.com/s/opensans/v14/cJZKeOuBrn4kERxqtaUH3aCWcynf_cDxXwCLxiixG1c.ttf

Requested by

Host: xcisky.tk
URL: http://xcisky.tk/dropboxsalam/dropboxtoday/www.gstatic.com/external_hosted/modernizr/modernizr.js

Protocol

HTTP/1.1

Server

2a00:1450:4001:814::2003 , Ireland, ASN15169 (GOOGLE - Google Inc., US),

Reverse DNS

Software

sffe /

Resource Hash

793c9557c2fcfd79a48b2ace2d2c2e6a14a09f50d1d3812828838623d643e455

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36
Referer: http://fonts.googleapis.com/css?family=Open+Sans:300,400,600,700&lang=en
Origin: http://xcisky.tk

Response headers

Date: Wed, 14 Jun 2017 16:49:17 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Wed, 14 Jun 2017 16:46:31 GMT
Server: sffe
Age: 1889183
Vary: Accept-Encoding
Content-Type: font/ttf
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31536000
Accept-Ranges: bytes
Timing-Allow-Origin: *
Content-Length: 17789
X-XSS-Protection: 1; mode=block
Expires: Thu, 14 Jun 2018 16:49:17 GMT

GET
H/1.1 200
OK icons.png
xcisky.tk/dropboxsalam/dropboxtoday/auth/view/res/drive/images/ 6 KB
6 KB 71ms
45ms Image
image/png 178.159.36.241
AS-MAROSNET Moscow

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://xcisky.tk/dropboxsalam/dropboxtoday/auth/view/res/drive/images/icons.png
Requested by: Host: xcisky.tk
URL: http://xcisky.tk/dropboxsalam/dropboxtoday/auth/view/share/
Protocol: HTTP/1.1
Server: 178.159.36.241 , Russian Federation, ASN48666 (AS-MAROSNET Moscow, Russia, RU),
Reverse DNS
Software: Apache /
Resource Hash: c3520de5b04afec506116b6bf980719dd2dce0b16f989a89f2cf48436ef95cc7

Request headers

Referer: http://xcisky.tk/dropboxsalam/dropboxtoday/auth/view/res/drive/css/drive-download.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date: Thu, 06 Jul 2017 13:35:51 GMT
Last-Modified: Sun, 19 Oct 2014 08:28:52 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 5779

GET
H/1.1 200
OK DXI1ORHCpsQm3Vp6mXoaTYnF5uFdDttMLvmWuJdhhgs.ttf
fonts.gstatic.com/s/opensans/v14/ 27 KB
18 KB 7ms
7ms Font
font/ttf 2a00:1450:4001:814::2003
Google Inc.

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.gstatic.com/s/opensans/v14/DXI1ORHCpsQm3Vp6mXoaTYnF5uFdDttMLvmWuJdhhgs.ttf

Requested by

Host: xcisky.tk
URL: http://xcisky.tk/dropboxsalam/dropboxtoday/auth/view/share/

Protocol

HTTP/1.1

Server

2a00:1450:4001:814::2003 , Ireland, ASN15169 (GOOGLE - Google Inc., US),

Reverse DNS

Software

sffe /

Resource Hash

cd4c8f51bee563540c10456abc2cc84185f4ecf5af8a45b80eb8c16c620cfc0a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36
Referer: http://fonts.googleapis.com/css?family=Open+Sans:300,400,600,700&lang=en
Origin: http://xcisky.tk

Response headers

Date: Wed, 14 Jun 2017 16:50:04 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Wed, 14 Jun 2017 16:45:42 GMT
Server: sffe
Age: 1889136
Vary: Accept-Encoding
Content-Type: font/ttf
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31536000
Accept-Ranges: bytes
Timing-Allow-Origin: *
Content-Length: 18391
X-XSS-Protection: 1; mode=block
Expires: Thu, 14 Jun 2018 16:50:04 GMT

GET
H/1.1 200
OK k3k702ZOKiLJc3WVjuplzInF5uFdDttMLvmWuJdhhgs.ttf
fonts.gstatic.com/s/opensans/v14/ 27 KB
18 KB 12ms
6ms Font
font/ttf 2a00:1450:4001:814::2003
Google Inc.

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.gstatic.com/s/opensans/v14/k3k702ZOKiLJc3WVjuplzInF5uFdDttMLvmWuJdhhgs.ttf

Requested by

Host: xcisky.tk
URL: http://xcisky.tk/dropboxsalam/dropboxtoday/auth/view/share/

Protocol

HTTP/1.1

Server

2a00:1450:4001:814::2003 , Ireland, ASN15169 (GOOGLE - Google Inc., US),

Reverse DNS

Software

sffe /

Resource Hash

f8f7011da51c1d4c55a123107fa854c1750daff3c8dcc3331e0c0633727c797d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36
Referer: http://fonts.googleapis.com/css?family=Open+Sans:300,400,600,700&lang=en
Origin: http://xcisky.tk

Response headers

Date: Wed, 14 Jun 2017 16:49:17 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Wed, 14 Jun 2017 16:46:24 GMT
Server: sffe
Age: 1889183
Vary: Accept-Encoding
Content-Type: font/ttf
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31536000
Accept-Ranges: bytes
Timing-Allow-Origin: *
Content-Length: 18604
X-XSS-Protection: 1; mode=block
Expires: Thu, 14 Jun 2018 16:49:17 GMT

GET
DATA 200
OK truncated
/ 339 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4891a6ebd7de6bf1116d1178bc74a16ef68b1a0cec2b6c3e152bb4b905b7e082

Request headers

Response headers

Access-Control-Allow-Origin: *
Content-Type: image/png

GET
H/1.1 200
OK dropdownarrow.png
xcisky.tk/dropboxsalam/dropboxtoday/auth/view/res/drive/images/ 426 B
426 B 86ms
43ms Image
image/png 178.159.36.241
AS-MAROSNET Moscow

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://xcisky.tk/dropboxsalam/dropboxtoday/auth/view/res/drive/images/dropdownarrow.png
Requested by: Host: xcisky.tk
URL: http://xcisky.tk/dropboxsalam/dropboxtoday/auth/view/share/
Protocol: HTTP/1.1
Server: 178.159.36.241 , Russian Federation, ASN48666 (AS-MAROSNET Moscow, Russia, RU),
Reverse DNS
Software: Apache /
Resource Hash: 8889e592d65dbf8cfa84026d728b9dda8ef61c02896d44ca0be8cd9ed5c16848

Request headers

Referer: http://xcisky.tk/dropboxsalam/dropboxtoday/auth/view/res/drive/css/drive-download.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date: Thu, 06 Jul 2017 13:35:51 GMT
Last-Modified: Sun, 19 Oct 2014 08:28:52 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 426

GET
H/1.1 200
OK dlpageping
tools.google.com/service/update2/ 0
0 27ms
21ms Image
text/plain 2a00:1450:4001:814::200e
Google Inc.

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://tools.google.com/service/update2/dlpageping?appguid={3C122445-AECE-4309-90B7-85A6AEF42AC0}&iid={5A1C6C8F-5172-C414-859E-7D4F035448C2}&lang=en-GB&browser=4&usagestats=0&appname=Google%20Drive&needsadmin=true&stage=index&installsource=download

Requested by

Host: xcisky.tk
URL: http://xcisky.tk/dropboxsalam/dropboxtoday/auth/view/share/

Protocol

HTTP/1.1

Server

2a00:1450:4001:814::200e , Ireland, ASN15169 (GOOGLE - Google Inc., US),

Reverse DNS

Software

GSE /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: http://xcisky.tk/dropboxsalam/dropboxtoday/auth/view/share/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 06 Jul 2017 13:35:41 GMT
X-Content-Type-Options: nosniff
Server: GSE
X-Frame-Options: SAMEORIGIN
Content-Type: text/plain; charset=UTF-8
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Content-Length: 0
X-XSS-Protection: 1; mode=block
Expires: Mon, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Google (Online)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			xcisky.tk/dropboxsalam/dropboxtoday/auth/view/share	1970-01-01 00:00:00	Name: iid Value: %7B5A1C6C8F-5172-C414-859E-7D4F035448C2%7D

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.googleapis.com
fonts.gstatic.com
tools.google.com
xcisky.tk
178.159.36.241
2a00:1450:4001:814::2003
2a00:1450:4001:814::200a
2a00:1450:4001:814::200e
06f0ebc812f5443ad3361835c8c7fd24de9117a13d59d59a99e516d5a6323f0d
144833da7db985fa98ebd0a0b7d45ca3fb94df849cedb280957957f658211b27
15b929a7975171a1b952c66987fef0d3221c92f03b77cceef77494f68dcada47
1eff427c0cde8deaf4a1bd995519737c138b124d5dfa0fc6c5d60ca8e2ae40ee
299e3a3e10fc0d4874c1efef96805c885c46d5263e4a4609bbd80f57026354dc
437398aae3cd98321fb24ce478d22a94e5f90f92d01284ea2bb61f0c1b8e74bd
45120993a137bcca95ccfe97fb236f8dd7827c89fe7385c76a63df739ce731a1
47f60f88513755e18ea6e52813e00e90225696d3566a662b62ac100182fcd42c
4891a6ebd7de6bf1116d1178bc74a16ef68b1a0cec2b6c3e152bb4b905b7e082
793c9557c2fcfd79a48b2ace2d2c2e6a14a09f50d1d3812828838623d643e455
8889e592d65dbf8cfa84026d728b9dda8ef61c02896d44ca0be8cd9ed5c16848
899a954829dd74b84d635b637521dc7600cf1a27647f151cfe28e729defb0c7f
8c2d2e5d88589a1283ec0cdf49bedc2dd3a8f40fe77c39c3e00ed8cef1968ff3
b927138c8add3717eeded4aed4a8d01cbace679715efafa1c2fa18aff32273d2
c3520de5b04afec506116b6bf980719dd2dce0b16f989a89f2cf48436ef95cc7
ca18764330100e7f48b96a00925190d5e2faee344206c1f02acd7c03a2c18ebf
cd4c8f51bee563540c10456abc2cc84185f4ecf5af8a45b80eb8c16c620cfc0a
cd8afff09862066648693568b76b7469e56c3004e78bdc498e70220a2a240a65
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e6e2256b73bc828ed2c8c92650c242c70da88e8e429c6d4d701cacdce24690c3
e76c2eee68acdf5bdb9aa39ba51a3697d45af022bbfef1dba87a4866e4868201
f8f7011da51c1d4c55a123107fa854c1750daff3c8dcc3331e0c0633727c797d
fcc92c066b4b240747c5b6067fa8e954f5cc93a3cc3d9cf840e6301c7e02da7c

xcisky.tk Open in urlscan Pro 178.159.36.241 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Statistics

22 Requests

0 %HTTPS

75 %IPv6

4 Domains

4 Subdomains

5 IPs

2 Countries

1049 kBTransfer

1078 kBSize

1 Cookies

1 Outgoing links

Redirected requests

22 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

1 Cookies

Indicators

xcisky.tk Open in urlscan Pro
178.159.36.241 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

22
Requests

0 %
HTTPS

75 %
IPv6

4
Domains

4
Subdomains

5
IPs

2
Countries

1049 kB
Transfer

1078 kB
Size

1
Cookies

22 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!