![](/screenshots/f08d5d20-4c2b-4603-92a0-746b25d3527b.png)
uyk.ndi.mybluehost.me
Open in
urlscan Pro
162.241.216.65
Malicious Activity!
Public Scan
Effective URL: http://uyk.ndi.mybluehost.me/ar/ar06/Servizio%20Hosting%20-%20Aruba.it.php
Submission: On October 20 via api from NL — Scanned from IT
Summary
This is the only time uyk.ndi.mybluehost.me was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Aruba (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 212.158.159.117 212.158.159.117 | 25248 (BLUETONE-...) (BLUETONE-AS The Czech Republic) | |
1 3 | 162.241.216.65 162.241.216.65 | 46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1) | |
2 | 2 |
ASN25248 (BLUETONE-AS The Czech Republic, CZ)
PTR: 212-158-159-117.static.svethostingu.cz
www.nachytano.cz |
ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: box5383.bluehost.com
uyk.ndi.mybluehost.me |
Apex Domain Subdomains |
Transfer | |
---|---|---|
3 |
mybluehost.me
1 redirects
uyk.ndi.mybluehost.me |
285 KB |
1 |
nachytano.cz
1 redirects
www.nachytano.cz |
129 B |
2 | 2 |
Domain | Requested by | |
---|---|---|
3 | uyk.ndi.mybluehost.me |
1 redirects
uyk.ndi.mybluehost.me
|
1 | www.nachytano.cz | 1 redirects |
2 | 2 |
Subject Issuer | Validity | Valid |
---|
This page contains 1 frames:
Primary Page:
http://uyk.ndi.mybluehost.me/ar/ar06/Servizio%20Hosting%20-%20Aruba.it.php
Frame ID: E7B622C37DEDB590F9E6EA33DDC2839B
Requests: 8 HTTP requests in this frame
Screenshot
![](/screenshots/f08d5d20-4c2b-4603-92a0-746b25d3527b.png)
Page Title
Servizio Hosting - Aruba.itPage URL History Show full URLs
-
https://www.nachytano.cz/redirect.php?url=uyk.ndi.mybluehost.me/ar
HTTP 302
http://uyk.ndi.mybluehost.me/ar HTTP 301
http://uyk.ndi.mybluehost.me/ar/ Page URL
- http://uyk.ndi.mybluehost.me/ar/ar06/Servizio%20Hosting%20-%20Aruba.it.php Page URL
Detected technologies
Detected patterns
- \.php(?:$|\?)
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: Hai perso i dati?
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://www.nachytano.cz/redirect.php?url=uyk.ndi.mybluehost.me/ar
HTTP 302
http://uyk.ndi.mybluehost.me/ar HTTP 301
http://uyk.ndi.mybluehost.me/ar/ Page URL
- http://uyk.ndi.mybluehost.me/ar/ar06/Servizio%20Hosting%20-%20Aruba.it.php Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://www.nachytano.cz/redirect.php?url=uyk.ndi.mybluehost.me/ar HTTP 302
- http://uyk.ndi.mybluehost.me/ar HTTP 301
- http://uyk.ndi.mybluehost.me/ar/
2 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
/
uyk.ndi.mybluehost.me/ar/ Redirect Chain
|
114 B 555 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
Servizio%20Hosting%20-%20Aruba.it.php
uyk.ndi.mybluehost.me/ar/ar06/ |
601 KB 284 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
15 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
17 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
15 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
841 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
23 KB 23 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
22 KB 22 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Aruba (Online)0 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
uyk.ndi.mybluehost.me/ | Name: PHPSESSID Value: ca60e3a4c54d51b53eb197a0ea1142be |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
uyk.ndi.mybluehost.me
www.nachytano.cz
162.241.216.65
212.158.159.117
3f17168698a35c8156a22b0483d20469ae01fe5e714f94bf575b073f4c20ba02
50c0214cab06f02e4e1501e2edd9e707dfcb1a6c3e1c38c05235b49dae984033
8d3ca80fa271e94b0c36cf3053b0f806b7a42bb3395b424c99dc0bd218f0ac20
a525f163e73542be1b82c5ae4e4beed74d137d56161ac5b02833a279ef6d9b61
bcedcafd81248b08cb428b22618a38866d0cee85b4e9ecd27ef734d0533e2792
c3c0d3f472358aac78455515c4800771426770c22698e2486d39fdb5505634e1
f7d4f46e5b853727d9fe49f79faadb7c77d3235992542e1229b5c3f9cc1184a2