buyteches.xyz Open in urlscan Pro
91.211.91.186 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://buyteches.xyz/csch/shoppng/u.php
Submission: On June 19 via api (June 19th 2022, 12:03:22 pm UTC) from JP — Scanned from JP

Summary HTTP 8 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 8 HTTP transactions. The main IP is 91.211.91.186, located in Ukraine and belongs to HOSTFORY, UA. The main domain is buyteches.xyz.
TLS certificate: Issued by cPanel, Inc. Certification Authority on May 5th 2022. Valid for: 3 months.

This is the only time buyteches.xyz was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: DocuSign (Online)

Domain & IP information

	IP Address	AS Autonomous System
7	91.211.91.186 91.211.91.186	206638 (HOSTFORY) (HOSTFORY)
1 2	162.248.186.53 162.248.186.53	62856 (DOCUS-6-PROD) (DOCUS-6-PROD)
8	2

7 91.211.91.186 (Ukraine)

ASN206638 (HOSTFORY, UA)

buyteches.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 162.248.186.53 (United States) 1 redirects

ASN62856 (DOCUS-6-PROD, US)

account.docusign.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	buyteches.xyz buyteches.xyz	133 KB
2	docusign.com 1 redirects account.docusign.com — Cisco Umbrella Rank: 10547	447 B
8	2

	Domain	Requested by
7	buyteches.xyz	buyteches.xyz
2	account.docusign.com	1 redirects buyteches.xyz
8	2

This site contains no links.

Subject Issuer	Validity	Valid
buyteches.xyz cPanel, Inc. Certification Authority	`2022-05-05` - `2022-08-03`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://buyteches.xyz/csch/shoppng/u.php
Frame ID: B5E161EBACDA22633842D5A0951D6C01
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

DocuSign Login

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

8
Requests

88 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

133 kB
Transfer

131 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 6

https://account.docusign.com/LoginAppNext/images/social/social_auth_providers.png HTTP 302
https://account.docusign.com/error?aspxerrorpath=/LoginAppNext/images/social/social_auth_providers.png

8 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request u.php Show response buyteches.xyz/csch/shoppng/	5 KB 5 KB	1049ms 263ms	Document text/html	91.211.91.186 HOSTFORY
General Check archive.org Show headers Download Go to Full URL https://buyteches.xyz/csch/shoppng/u.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 91.211.91.186 , Ukraine, ASN206638 (HOSTFORY, UA), Reverse DNS Software Apache / Resource Hash `0560e5be01afc3a8f4b417d7afecce0439627ff79e90e0e52bd538854e35b892` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36 accept-language jp-JP,jp;q=0.9 Response headers Connection Keep-Alive Content-Type text/html; charset=UTF-8 Date Sun, 19 Jun 2022 12:03:16 GMT Keep-Alive timeout=5, max=100 Server Apache Transfer-Encoding chunked
GET H/1.1	200 OK	facebox.css buyteches.xyz/csch/shoppng/	1 KB 1 KB	257ms 257ms	Stylesheet text/css	91.211.91.186 HOSTFORY
General Check archive.org Show headers Download Go to Full URL https://buyteches.xyz/csch/shoppng/facebox.css Requested by Host: buyteches.xyz URL: https://buyteches.xyz/csch/shoppng/u.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 91.211.91.186 , Ukraine, ASN206638 (HOSTFORY, UA), Reverse DNS Software Apache / Resource Hash `c614122e326d88fffd8495fc3ccbac314634f3c36ea1f003cd222288bf67686b` Request headers accept-language jp-JP,jp;q=0.9 Referer https://buyteches.xyz/csch/shoppng/u.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36 Response headers Date Sun, 19 Jun 2022 12:03:17 GMT Last-Modified Mon, 23 Jan 2017 04:42:12 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 1168
GET H/1.1	200 OK	jquery-1.6.2.min.js Show response buyteches.xyz/csch/shoppng/javascript/	89 KB 90 KB	267ms 267ms	Script application/javascript	91.211.91.186 HOSTFORY
General Check archive.org Show headers Download Go to Full URL https://buyteches.xyz/csch/shoppng/javascript/jquery-1.6.2.min.js Requested by Host: buyteches.xyz URL: https://buyteches.xyz/csch/shoppng/u.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 91.211.91.186 , Ukraine, ASN206638 (HOSTFORY, UA), Reverse DNS Software Apache / Resource Hash `d16d07a0353405fcec95f7efc50a2621bc7425f9a5e8895078396fb0dc460c4f` Request headers accept-language jp-JP,jp;q=0.9 Referer https://buyteches.xyz/csch/shoppng/u.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36 Response headers Date Sun, 19 Jun 2022 12:03:17 GMT Last-Modified Sun, 22 Jan 2017 21:49:36 GMT Server Apache Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 91556
GET H/1.1	200 OK	facebox.js Show response buyteches.xyz/csch/shoppng/javascript/facebox/src/	9 KB 10 KB	518ms 260ms	Script application/javascript	91.211.91.186 HOSTFORY
General Check archive.org Show headers Download Go to Full URL https://buyteches.xyz/csch/shoppng/javascript/facebox/src/facebox.js Requested by Host: buyteches.xyz URL: https://buyteches.xyz/csch/shoppng/u.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 91.211.91.186 , Ukraine, ASN206638 (HOSTFORY, UA), Reverse DNS Software Apache / Resource Hash `fc1051ff8ece6493b643873b420df97c3cb5037337891450cad3051a9bba1754` Request headers accept-language jp-JP,jp;q=0.9 Referer https://buyteches.xyz/csch/shoppng/u.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36 Response headers Date Sun, 19 Jun 2022 12:03:17 GMT Last-Modified Mon, 23 Jan 2017 03:56:08 GMT Server Apache Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 9532
GET H/1.1	200 OK	jquery.watermark.js Show response buyteches.xyz/csch/shoppng/javascript/watermark/	19 KB 19 KB	776ms 258ms	Script application/javascript	91.211.91.186 HOSTFORY
General Check archive.org Show headers Download Go to Full URL https://buyteches.xyz/csch/shoppng/javascript/watermark/jquery.watermark.js Requested by Host: buyteches.xyz URL: https://buyteches.xyz/csch/shoppng/u.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 91.211.91.186 , Ukraine, ASN206638 (HOSTFORY, UA), Reverse DNS Software Apache / Resource Hash `016f9cfa001792db7ad2be1e1ea1424cea09f108f68e7efb1caf4c5e65ac1335` Request headers accept-language jp-JP,jp;q=0.9 Referer https://buyteches.xyz/csch/shoppng/u.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36 Response headers Date Sun, 19 Jun 2022 12:03:17 GMT Last-Modified Sun, 22 Jan 2017 21:49:36 GMT Server Apache Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=97 Content-Length 19229
GET H/1.1	200 OK	javascript1.js Show response buyteches.xyz/csch/shoppng/	3 KB 3 KB	810ms 271ms	Script application/javascript	91.211.91.186 HOSTFORY
General Check archive.org Show headers Download Go to Full URL https://buyteches.xyz/csch/shoppng/javascript1.js Requested by Host: buyteches.xyz URL: https://buyteches.xyz/csch/shoppng/u.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 91.211.91.186 , Ukraine, ASN206638 (HOSTFORY, UA), Reverse DNS Software Apache / Resource Hash `9d57619bd1338db2ee3a7fb1dd7774b4e76e49113b21a07be33d70818433d869` Request headers accept-language jp-JP,jp;q=0.9 Referer https://buyteches.xyz/csch/shoppng/u.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36 Response headers Date Sun, 19 Jun 2022 12:03:17 GMT Last-Modified Thu, 26 Oct 2017 12:04:50 GMT Server Apache Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 3045
GET H/1.1	200 OK	hl.jpg buyteches.xyz/csch/shoppng/img/	5 KB 5 KB	285ms 285ms	Image image/jpeg	91.211.91.186 HOSTFORY
General Check archive.org Show headers Download Go to Show image Full URL https://buyteches.xyz/csch/shoppng/img/hl.jpg Requested by Host: buyteches.xyz URL: https://buyteches.xyz/csch/shoppng/u.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 91.211.91.186 , Ukraine, ASN206638 (HOSTFORY, UA), Reverse DNS Software Apache / Resource Hash `ee3cec3c33913424b8a94f2ba811277a4aaf0a8476d61653769c5d953ddeecbd` Request headers accept-language jp-JP,jp;q=0.9 Referer https://buyteches.xyz/csch/shoppng/u.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36 Response headers Date Sun, 19 Jun 2022 12:03:17 GMT Last-Modified Tue, 19 Dec 2017 00:35:04 GMT Server Apache Content-Type image/jpeg Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 5352
GET H/1.1	200 OK	error account.docusign.com/ Redirect Chain https://account.docusign.com/LoginAppNext/images/social/social_auth_providers.png https://account.docusign.com/error?aspxerrorpath=/LoginAppNext/images/social/social_auth_providers.png	0 0	152ms 152ms	Image text/html	162.248.186.53 DOCUS-6-PROD
General Check archive.org Show headers Download Go to Show image Full URL https://account.docusign.com/error?aspxerrorpath=/LoginAppNext/images/social/social_auth_providers.png Requested by Host: buyteches.xyz URL: https://buyteches.xyz/csch/shoppng/u.php Protocol HTTP/1.1 Server 162.248.186.53 , United States, ASN62856 (DOCUS-6-PROD, US), Reverse DNS Software / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers accept-language jp-JP,jp;q=0.9 Referer https://buyteches.xyz/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36 Response headers Redirect headers Strict-Transport-Security max-age=31536000; includeSubDomains; preload Referrer-Policy no-referrer,strict-origin-when-cross-origin Date Sun, 19 Jun 2022 12:03:18 GMT Vary Accept-Encoding Content-Type text/html; charset=utf-8 Location /error?aspxerrorpath=/LoginAppNext/images/social/social_auth_providers.png Cache-Control private X-DocuSign-Node DA5FE92 Content-Length 191 X-Content-Type-Options nosniff

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: DocuSign (Online)

15 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

account.docusign.com
buyteches.xyz
162.248.186.53
91.211.91.186
016f9cfa001792db7ad2be1e1ea1424cea09f108f68e7efb1caf4c5e65ac1335
0560e5be01afc3a8f4b417d7afecce0439627ff79e90e0e52bd538854e35b892
9d57619bd1338db2ee3a7fb1dd7774b4e76e49113b21a07be33d70818433d869
c614122e326d88fffd8495fc3ccbac314634f3c36ea1f003cd222288bf67686b
d16d07a0353405fcec95f7efc50a2621bc7425f9a5e8895078396fb0dc460c4f
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ee3cec3c33913424b8a94f2ba811277a4aaf0a8476d61653769c5d953ddeecbd
fc1051ff8ece6493b643873b420df97c3cb5037337891450cad3051a9bba1754

buyteches.xyz Open in urlscan Pro 91.211.91.186 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

8 Requests

88 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

133 kBTransfer

131 kBSize

0 Cookies

0 Outgoing links

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

15 JavaScript Global Variables

0 Cookies

Indicators

buyteches.xyz Open in urlscan Pro
91.211.91.186 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

88 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

133 kB
Transfer

131 kB
Size

0
Cookies

8 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!