![](/screenshots/a6e2ba09-e5cd-4efd-a6f7-80140dcde5f4.png)
xtydu.ml
Open in
urlscan Pro
80.211.63.128
Malicious Activity!
Public Scan
Submission: On June 22 via api from CA
Summary
This is the only time xtydu.ml was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Office 365 (Online) Generic (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
12 | 80.211.63.128 80.211.63.128 | 31034 (ARUBA-ASN) (ARUBA-ASN) | |
2 | 2a00:1450:400... 2a00:1450:4001:820::200a | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
1 | 151.101.12.193 151.101.12.193 | 54113 (FASTLY) (FASTLY - Fastly) | |
2 | 2a00:1450:400... 2a00:1450:4001:820::2003 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
1 2 | 2a00:1450:400... 2a00:1450:4001:820::200e | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
1 1 | 2a00:1450:400... 2a00:1450:400c:c00::9d | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
1 1 | 2a00:1450:400... 2a00:1450:4001:81a::2004 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
1 | 2a00:1450:401... 2a00:1450:4011:80b::100f | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
19 | 6 |
ASN31034 (ARUBA-ASN, IT)
PTR: host128-63-211-80.serverdedicati.aruba.it
xtydu.ml |
Apex Domain Subdomains |
Transfer | |
---|---|---|
12 |
xtydu.ml
xtydu.ml |
813 KB |
2 |
google-analytics.com
1 redirects
www.google-analytics.com |
14 KB |
2 |
gstatic.com
fonts.gstatic.com |
36 KB |
2 |
googleapis.com
fonts.googleapis.com |
1 KB |
1 |
google.de
www.google.de |
109 B |
1 |
google.com
1 redirects
www.google.com |
181 B |
1 |
doubleclick.net
1 redirects
stats.g.doubleclick.net |
165 B |
1 |
imgur.com
i.imgur.com |
29 KB |
19 | 8 |
Domain | Requested by | |
---|---|---|
12 | xtydu.ml |
xtydu.ml
|
2 | www.google-analytics.com |
1 redirects
xtydu.ml
|
2 | fonts.gstatic.com |
xtydu.ml
|
2 | fonts.googleapis.com |
xtydu.ml
|
1 | www.google.de |
xtydu.ml
|
1 | www.google.com | 1 redirects |
1 | stats.g.doubleclick.net | 1 redirects |
1 | i.imgur.com |
xtydu.ml
|
19 | 8 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.docusign.com |
www.twitter.com |
www.facebook.com |
Subject Issuer | Validity | Valid |
---|
This page contains 1 frames:
Primary Page:
http://xtydu.ml/dsd/DoCuSigN/
Frame ID: 90F6144E55C4135D6BE3259430F1180A
Requests: 19 HTTP requests in this frame
Screenshot
![](/screenshots/a6e2ba09-e5cd-4efd-a6f7-80140dcde5f4.png)
Detected technologies
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
![](/vendor/wappa/icons/Mustache.png)
Detected patterns
- env /^Mustache$/i
Detected patterns
- script /google-analytics\.com\/(?:ga|urchin|(analytics))\.js/i
- env /^gaGlobal$/i
![](/vendor/wappa/icons/Google Font API.png)
Detected patterns
- html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i
Detected patterns
- script /modernizr(?:-([\d.]*[\d]))?.*\.js/i
- env /^Modernizr$/i
Detected patterns
- script /jquery.*\.js/i
- env /^jQuery$/i
Page Statistics
6 Outgoing links
These are links going to different origins than the main page.
Title: Privacy Policy
Search URL Search Domain Scan URL
Title: Terms of Use
Search URL Search Domain Scan URL
Title: Services Agreement
Search URL Search Domain Scan URL
Title: twitter
Search URL Search Domain Scan URL
Title: facebook
Search URL Search Domain Scan URL
Title: Support
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 16- http://www.google-analytics.com/analytics.js HTTP 307
- https://www.google-analytics.com/analytics.js
- http://www.google-analytics.com/r/collect?v=1&_v=j68&a=199232766&t=pageview&_s=1&dl=http%3A%2F%2Fxtydu.ml%2Fdsd%2FDoCuSigN%2F&ul=en-us&de=UTF-8&dt=Sign%20In%20-%20DocuSign&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEAB~&jid=1302203576&gjid=1805837523&cid=1397766557.1529645366&tid=UA-39550292-1&_gid=1740611690.1529645366&_r=1&z=1365117115 HTTP 307
- https://www.google-analytics.com/r/collect?v=1&_v=j68&a=199232766&t=pageview&_s=1&dl=http%3A%2F%2Fxtydu.ml%2Fdsd%2FDoCuSigN%2F&ul=en-us&de=UTF-8&dt=Sign%20In%20-%20DocuSign&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEAB~&jid=1302203576&gjid=1805837523&cid=1397766557.1529645366&tid=UA-39550292-1&_gid=1740611690.1529645366&_r=1&z=1365117115 HTTP 302
- https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-39550292-1&cid=1397766557.1529645366&jid=1302203576&_gid=1740611690.1529645366&gjid=1805837523&_v=j68&z=1365117115 HTTP 302
- https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-39550292-1&cid=1397766557.1529645366&jid=1302203576&_v=j68&z=1365117115 HTTP 302
- https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-39550292-1&cid=1397766557.1529645366&jid=1302203576&_v=j68&z=1365117115&slf_rd=1&random=4155320142
19 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
xtydu.ml/dsd/DoCuSigN/ |
6 KB 7 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
css
fonts.googleapis.com/ |
727 B 628 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
site.css
xtydu.ml/dsd/DoCuSigN/css/ |
145 KB 145 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.js
xtydu.ml/dsd/DoCuSigN/js/ |
101 KB 101 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ios_gmail_icon.png
xtydu.ml/dsd/DoCuSigN/images/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
R2CkTs2S_400x400.png
xtydu.ml/dsd/DoCuSigN/images/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
live_id.png
xtydu.ml/dsd/DoCuSigN/images/ |
440 B 681 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ggfffsss.png
xtydu.ml/dsd/DoCuSigN/images/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
office365logo.png
xtydu.ml/dsd/DoCuSigN/images/ |
18 KB 19 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
modernizr.js
xtydu.ml/dsd/DoCuSigN/js/ |
12 KB 12 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
scripts.js
xtydu.ml/dsd/DoCuSigN/js/ |
519 KB 520 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
css
fonts.googleapis.com/ |
0 628 B |
Other
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
dfA9LLf.png
i.imgur.com/ |
29 KB 29 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ctv-icon-sprite.png
xtydu.ml/images/ |
343 B 343 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
mem8YaGs126MiZpBA-UFVZ0e.ttf
fonts.gstatic.com/s/opensans/v15/ |
26 KB 18 KB |
Font
font/ttf |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo-dstr-login.png
xtydu.ml/images/ |
343 B 343 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
mem5YaGs126MiZpBA-UNirkOUuhs.ttf
fonts.gstatic.com/s/opensans/v15/ |
27 KB 18 KB |
Font
font/ttf |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
analytics.js
www.google-analytics.com/ Redirect Chain
|
34 KB 14 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
ga-audiences
www.google.de/ads/ Redirect Chain
|
42 B 109 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Office 365 (Online) Generic (Online)19 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery object| html5 object| Modernizr function| yepnope object| Foundation object| Mustache function| purl object| Select2 object| jQuery111006690239297592815 object| plupload function| SimpleWidget object| Tree object| ctv string| GoogleAnalyticsObject function| ga object| gaplugins object| gaGlobal object| gaData3 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.xtydu.ml/ | Name: _gat Value: 1 |
|
.xtydu.ml/ | Name: _gid Value: GA1.2.1740611690.1529645366 |
|
.xtydu.ml/ | Name: _ga Value: GA1.2.1397766557.1529645366 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
fonts.googleapis.com
fonts.gstatic.com
i.imgur.com
stats.g.doubleclick.net
www.google-analytics.com
www.google.com
www.google.de
xtydu.ml
151.101.12.193
2a00:1450:4001:81a::2004
2a00:1450:4001:820::2003
2a00:1450:4001:820::200a
2a00:1450:4001:820::200e
2a00:1450:400c:c00::9d
2a00:1450:4011:80b::100f
80.211.63.128
17f12442bcf61f0ce7903a8abd7434da0a702b36fdaed50261e26e81050bb76f
1e78d13dfde3f49739c38858fc2cd5f65cf484ec5c7a62c4b6c915d5eef1827d
201252a0397b3970232b33717076c8614187524bda208e0f0d05c48f6eb72825
3192fed093aa24aae0fa3340a2a32d962ea4c8a58da1b3693b710cc8dfd9dea8
3333a0b1f1d2031bea53021a8ea5ace8ff2814381f70ec19126f17975060b985
3fab1c883847e4b5a02f3749a9f4d9eab15cd4765873d3b2904a1a4c8755fba3
4a13c0da84f5aef7d559981d031c52e5edcb020c639b0b004ed37988774e076f
565ba04f8d1bbe89b6bd04982ff90474a7f292c6391684a03bcb0556e0171721
74461248f0a3edd43acbe67fbd98bb8bc6f26bb6b2e8b948c4757724717bde5c
744979e5ea01429ed85799be4a13370803085222cd8a79ca8c0bab36a0159491
8b623356ef47a42e3aca4c850fd5d56c8705348100e3278646581220c3d59934
927658fe940c899225567ad7885c40a7871dee09c2b9f00d31f7ca62d1f424fc
aa0034a3d565c8dda497b31b9b7c0c38bb47a51afb18a1cd070fe08f478ef4c3
d861b8dc9c3a7d5943e4b7547af6f646775ea8d286a92a7c0a76aa3c0146935b
d9beba06b7206cd19cbf052b1dc7a84149404e88af33e2b27c0c91bf7efaef37
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e769ee4af1c574e9927cafd4f49fcd25bcf546b2d91274fc8df604881316b32f
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f4b013459ec08eac601b9062849965844f311e9c1dd0b3e37d68dbe6976900c7