xyn.uyh.mybluehost.me
Open in
urlscan Pro
162.241.252.179
Malicious Activity!
Public Scan
Effective URL: http://xyn.uyh.mybluehost.me/free/space/Excel/xl/link/Excel/PO/page.php?mylove=&.rand=13vqcr8bp0gud&lc=1033&id=64855&mkt=en-u...
Submission: On January 11 via manual from US
Summary
This is the only time xyn.uyh.mybluehost.me was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Excel / PDF download (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
11 | 162.241.252.179 162.241.252.179 | 46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1 - Unified Layer) | |
1 | 2a00:1450:400... 2a00:1450:4001:81b::200a | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
1 2 | 2a00:1450:400... 2a00:1450:4001:821::200e | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
1 1 | 2a00:1450:400... 2a00:1450:400c:c0c::9a | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
1 1 | 2a00:1450:400... 2a00:1450:4001:818::2004 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
1 | 2a00:1450:400... 2a00:1450:4001:81b::2003 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
14 | 5 |
ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US)
PTR: box5730.bluehost.com
xyn.uyh.mybluehost.me |
Apex Domain Subdomains |
Transfer | |
---|---|---|
11 |
mybluehost.me
xyn.uyh.mybluehost.me |
350 KB |
2 |
google-analytics.com
1 redirects
www.google-analytics.com |
17 KB |
1 |
google.de
www.google.de |
109 B |
1 |
google.com
1 redirects
www.google.com |
331 B |
1 |
doubleclick.net
1 redirects
stats.g.doubleclick.net |
165 B |
1 |
googleapis.com
fonts.googleapis.com |
989 B |
14 | 6 |
Domain | Requested by | |
---|---|---|
11 | xyn.uyh.mybluehost.me |
xyn.uyh.mybluehost.me
|
2 | www.google-analytics.com |
1 redirects
xyn.uyh.mybluehost.me
|
1 | www.google.de |
xyn.uyh.mybluehost.me
|
1 | www.google.com | 1 redirects |
1 | stats.g.doubleclick.net | 1 redirects |
1 | fonts.googleapis.com |
xyn.uyh.mybluehost.me
|
14 | 6 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.google-analytics.com Google Internet Authority G3 |
2018-12-19 - 2019-03-13 |
3 months | crt.sh |
www.google.de Google Internet Authority G3 |
2018-12-19 - 2019-03-13 |
3 months | crt.sh |
This page contains 3 frames:
Primary Page:
http://xyn.uyh.mybluehost.me/free/space/Excel/xl/link/Excel/PO/page.php?mylove=&.rand=13vqcr8bp0gud&lc=1033&id=64855&mkt=en-us&cbcxt=mai&snsc=1
Frame ID: 9D96773C88A4AE09DD0A348EB6B0C07A
Requests: 6 HTTP requests in this frame
Frame:
http://xyn.uyh.mybluehost.me/free/space/Excel/xl/link/Excel/PO/log.php?mylove=
Frame ID: F6F1BBF0F742F1B635DD2A938EA11D69
Requests: 1 HTTP requests in this frame
Frame:
http://xyn.uyh.mybluehost.me/free/space/Excel/xl/link/Excel/PO/l0gins.php?mylove=
Frame ID: 067C149365CDB47F1B2E1607F29764B9
Requests: 9 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
- http://xyn.uyh.mybluehost.me/free/space/Excel/xl/link/Excel/index.php Page URL
- http://xyn.uyh.mybluehost.me/free/space/Excel/xl/link/Excel/PO/page.php?mylove=&.rand=13vqcr8bp0gud&lc=10... Page URL
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- url /\.php(?:$|\?)/i
Apache (Web Servers) Expand
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- http://xyn.uyh.mybluehost.me/free/space/Excel/xl/link/Excel/index.php Page URL
- http://xyn.uyh.mybluehost.me/free/space/Excel/xl/link/Excel/PO/page.php?mylove=&.rand=13vqcr8bp0gud&lc=1033&id=64855&mkt=en-us&cbcxt=mai&snsc=1 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 12- http://www.google-analytics.com/ga.js HTTP 307
- https://www.google-analytics.com/ga.js
- http://www.google-analytics.com/r/__utm.gif?utmwv=5.6.7&utms=1&utmn=1871969614&utmhn=xyn.uyh.mybluehost.me&utmcs=UTF-8&utmsr=1600x1200&utmvp=504x276&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmhid=1068970343&utmr=0&utmp=%2Ffree%2Fspace%2FExcel%2Fxl%2Flink%2FExcel%2FPO%2Fl0gins.php%3Fmylove%3D&utmht=1547242017750&utmac=UA-43981329-1&utmcc=__utma%3D252899328.601369549.1547242018.1547242018.1547242018.1%3B%2B__utmz%3D252899328.1547242018.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=2002027464&utmredir=1&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~ HTTP 307
- https://www.google-analytics.com/r/__utm.gif?utmwv=5.6.7&utms=1&utmn=1871969614&utmhn=xyn.uyh.mybluehost.me&utmcs=UTF-8&utmsr=1600x1200&utmvp=504x276&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmhid=1068970343&utmr=0&utmp=%2Ffree%2Fspace%2FExcel%2Fxl%2Flink%2FExcel%2FPO%2Fl0gins.php%3Fmylove%3D&utmht=1547242017750&utmac=UA-43981329-1&utmcc=__utma%3D252899328.601369549.1547242018.1547242018.1547242018.1%3B%2B__utmz%3D252899328.1547242018.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=2002027464&utmredir=1&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~ HTTP 302
- https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-43981329-1&cid=601369549.1547242018&jid=2002027464&_v=5.6.7&z=1871969614 HTTP 302
- https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-43981329-1&cid=601369549.1547242018&jid=2002027464&_v=5.6.7&z=1871969614 HTTP 302
- https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-43981329-1&cid=601369549.1547242018&jid=2002027464&_v=5.6.7&z=1871969614&slf_rd=1&random=3725720627
14 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
index.php
xyn.uyh.mybluehost.me/free/space/Excel/xl/link/Excel/ |
909 B 812 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
loading.gif
xyn.uyh.mybluehost.me/free/space/Excel/xl/link/Excel/ |
4 KB 4 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
lintex.png
xyn.uyh.mybluehost.me/free/space/Excel/xl/link/Excel/ |
119 KB 119 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
page.php
xyn.uyh.mybluehost.me/free/space/Excel/xl/link/Excel/PO/ |
19 KB 11 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
3 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headersResponse headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
log.php
xyn.uyh.mybluehost.me/free/space/Excel/xl/link/Excel/PO/ Frame F6F1 |
657 B 612 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
pobg.gif
xyn.uyh.mybluehost.me/free/space/Excel/xl/link/Excel/PO/ |
149 KB 149 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
l0gins.php
xyn.uyh.mybluehost.me/free/space/Excel/xl/link/Excel/PO/ Frame 067C |
6 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ga.js
xyn.uyh.mybluehost.me/free/space/Excel/xl/link/Excel/PO/ Frame 067C |
42 KB 18 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.js
xyn.uyh.mybluehost.me/free/space/Excel/xl/link/Excel/PO/ Frame 067C |
94 KB 42 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery_popup.css
xyn.uyh.mybluehost.me/free/space/Excel/xl/link/Excel/PO/ Frame 067C |
2 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery_popup.js
xyn.uyh.mybluehost.me/free/space/Excel/xl/link/Excel/PO/ Frame 067C |
2 KB 1008 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
css
fonts.googleapis.com/ Frame 067C |
2 KB 989 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ga.js
www.google-analytics.com/ Frame 067C Redirect Chain
|
45 KB 17 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ga-audiences
www.google.de/ads/ Frame 067C Redirect Chain
|
42 B 109 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame 067C |
622 B 0 |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headersResponse headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Excel / PDF download (Online)6 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask number| myVar function| myFunction function| showPage5 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.xyn.uyh.mybluehost.me/ | Name: __utmb Value: 252899328.1.10.1547242018 |
|
.xyn.uyh.mybluehost.me/ | Name: __utmt Value: 1 |
|
.xyn.uyh.mybluehost.me/ | Name: __utmz Value: 252899328.1547242018.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none) |
|
.xyn.uyh.mybluehost.me/ | Name: __utmc Value: 252899328 |
|
.xyn.uyh.mybluehost.me/ | Name: __utma Value: 252899328.601369549.1547242018.1547242018.1547242018.1 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
fonts.googleapis.com
stats.g.doubleclick.net
www.google-analytics.com
www.google.com
www.google.de
xyn.uyh.mybluehost.me
162.241.252.179
2a00:1450:4001:818::2004
2a00:1450:4001:81b::2003
2a00:1450:4001:81b::200a
2a00:1450:4001:821::200e
2a00:1450:400c:c0c::9a
06c16a259eae4270acd719c7aa7420b5e0b5104f65b325e47dc55a8d31343b7a
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
4e2ed635abf0b2dcbac3ea04d16ccf58bb2195364d65b76190f03da0f43255c5
523c7a09818c209425f94502d83c5dc3b162b720ae8a1e7a21c852927d31ea19
642b823bfda63344a1342fbc28bc61fde43119e208b77bffe545d2d4f0518e85
7900a6daf04859fef2501b2cf08851772deae586328d56d79a36e86c689851c5
8180ef2d3d03fad302b169e59b768fadf177b947ffd376b7d2dfe06f3a23d73e
82f04c5d953b2ccb07f301b00299566e9a6efcc00a654259cd44ca71bb4db7fb
8308cd4f7dbe8a301e058f6ed215fdeca44bdec56c2ea2ff7d645bf631afe7b2
8ca3883a0ab4a909fe78d219e4d2380d3013ea3e0e83542d71cc0a0a759d3ac3
b294e973896f8f874e90a8eb1a8908ac790980d034c4c4bdf0fc3d37b8abf682
baa9df790a290c26723f44e85f9d8a09b08ef7a4409f7bd1f2804f5b3e30a4ae
c04cf09840411f295ff69f2918f3b47668034fecc79e11211d2cef3436c1c513
e9c6d9cac375cc5fb90af25b47287a11f77163ff788777143df127c074d661f6
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
fe588fb24571bca588aa968f1ef9ed6864d89c476273a003d0cefddfdf9a5a1f