uyk.ndi.mybluehost.me Open in urlscan Pro
162.241.216.65 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://www.nachytano.cz/redirect.php?url=uyk.ndi.mybluehost.me/ar
Effective URL:
http://uyk.ndi.mybluehost.me/ar/ar06/Servizio%20Hosting%20-%20Aruba.it.php
Submission: On October 20 via api (October 20th 2023, 3:07:29 pm UTC) from NL — Scanned from IT

Summary HTTP 2 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 2 HTTP transactions. The main IP is 162.241.216.65, located in United States and belongs to UNIFIEDLAYER-AS-1, US. The main domain is uyk.ndi.mybluehost.me.

This is the only time uyk.ndi.mybluehost.me was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Aruba (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 1	212.158.159.117 212.158.159.117	25248 (BLUETONE-...) (BLUETONE-AS The Czech Republic)
1 3	162.241.216.65 162.241.216.65	46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1)
2	2

1 212.158.159.117 (Czech Republic) 1 redirects

ASN25248 (BLUETONE-AS The Czech Republic, CZ)
PTR: 212-158-159-117.static.svethostingu.cz

www.nachytano.cz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 162.241.216.65 (United States) 1 redirects

ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: box5383.bluehost.com

uyk.ndi.mybluehost.me	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	mybluehost.me 1 redirects uyk.ndi.mybluehost.me	285 KB
1	nachytano.cz 1 redirects www.nachytano.cz	129 B
2	2

	Domain	Requested by
3	uyk.ndi.mybluehost.me	1 redirects uyk.ndi.mybluehost.me
1	www.nachytano.cz	1 redirects
2	2

This site contains links to these domains. Also see Links.

Domain
href.li

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://uyk.ndi.mybluehost.me/ar/ar06/Servizio%20Hosting%20-%20Aruba.it.php
Frame ID: E7B622C37DEDB590F9E6EA33DDC2839B
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Servizio Hosting - Aruba.it

Page URL History Show full URLs

https://www.nachytano.cz/redirect.php?url=uyk.ndi.mybluehost.me/ar HTTP 302
http://uyk.ndi.mybluehost.me/ar HTTP 301
http://uyk.ndi.mybluehost.me/ar/ Page URL
http://uyk.ndi.mybluehost.me/ar/ar06/Servizio%20Hosting%20-%20Aruba.it.php Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

2
Requests

0 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

330 kB
Transfer

694 kB
Size

1
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://href.li/?https://managehosting.aruba.it/Domini/spediscidatidominio.asp
Title: Hai perso i dati?

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://www.nachytano.cz/redirect.php?url=uyk.ndi.mybluehost.me/ar HTTP 302
http://uyk.ndi.mybluehost.me/ar HTTP 301
http://uyk.ndi.mybluehost.me/ar/ Page URL
http://uyk.ndi.mybluehost.me/ar/ar06/Servizio%20Hosting%20-%20Aruba.it.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://www.nachytano.cz/redirect.php?url=uyk.ndi.mybluehost.me/ar HTTP 302
http://uyk.ndi.mybluehost.me/ar HTTP 301
http://uyk.ndi.mybluehost.me/ar/

2 HTTP transactions
6 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	/ uyk.ndi.mybluehost.me/ar/ Redirect Chain https://www.nachytano.cz/redirect.php?url=uyk.ndi.mybluehost.me/ar http://uyk.ndi.mybluehost.me/ar http://uyk.ndi.mybluehost.me/ar/	114 B 555 B	2140ms 2140ms	Document text/html	162.241.216.65 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL http://uyk.ndi.mybluehost.me/ar/ Protocol HTTP/1.1 Server 162.241.216.65 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS box5383.bluehost.com Software nginx/1.21.6 / Resource Hash Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1 accept-language it-IT,it;q=0.9 Response headers Cache-Control no-store, no-cache, must-revalidate Content-Encoding gzip Content-Length 103 Content-Type text/html; charset=UTF-8 Date Fri, 20 Oct 2023 15:07:09 GMT Expires Thu, 19 Nov 1981 08:52:00 GMT Pragma no-cache Server nginx/1.21.6 Vary Accept-Encoding X-Newfold-Cache-Level 2 X-Server-Cache false host-header c2hhcmVkLmJsdWVob3N0LmNvbQ== Redirect headers Cache-Control max-age=7200 Content-Length 240 Content-Type text/html; charset=iso-8859-1 Date Fri, 20 Oct 2023 15:07:07 GMT Expires Fri, 20 Oct 2023 17:07:21 GMT Location http://uyk.ndi.mybluehost.me/ar/ Server nginx/1.21.6 X-Server-Cache false host-header c2hhcmVkLmJsdWVob3N0LmNvbQ==
GET H/1.1	200 OK	Primary Request Servizio%20Hosting%20-%20Aruba.it.php Show response uyk.ndi.mybluehost.me/ar/ar06/	601 KB 284 KB	240ms 240ms	Document text/html	162.241.216.65 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL http://uyk.ndi.mybluehost.me/ar/ar06/Servizio%20Hosting%20-%20Aruba.it.php Requested by Host: uyk.ndi.mybluehost.me URL: http://uyk.ndi.mybluehost.me/ar/ Protocol HTTP/1.1 Server 162.241.216.65 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS box5383.bluehost.com Software nginx/1.21.6 / Resource Hash `3f17168698a35c8156a22b0483d20469ae01fe5e714f94bf575b073f4c20ba02` Request headers Referer http://uyk.ndi.mybluehost.me/ar/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1 accept-language it-IT,it;q=0.9 Response headers Cache-Control max-age=7200 Content-Encoding gzip Content-Type text/html; charset=UTF-8 Date Fri, 20 Oct 2023 15:07:10 GMT Expires Fri, 20 Oct 2023 17:07:23 GMT Server nginx/1.21.6 Transfer-Encoding chunked Vary Accept-Encoding X-Newfold-Cache-Level 2 X-Server-Cache false host-header c2hhcmVkLmJsdWVob3N0LmNvbQ==
GET DATA	200 OK	truncated /	15 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `f7d4f46e5b853727d9fe49f79faadb7c77d3235992542e1229b5c3f9cc1184a2` Request headers accept-language it-IT,it;q=0.9 Referer http://uyk.ndi.mybluehost.me/ User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	17 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `a525f163e73542be1b82c5ae4e4beed74d137d56161ac5b02833a279ef6d9b61` Request headers accept-language it-IT,it;q=0.9 Referer http://uyk.ndi.mybluehost.me/ User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	15 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `bcedcafd81248b08cb428b22618a38866d0cee85b4e9ecd27ef734d0533e2792` Request headers accept-language it-IT,it;q=0.9 Referer http://uyk.ndi.mybluehost.me/ User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	841 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `50c0214cab06f02e4e1501e2edd9e707dfcb1a6c3e1c38c05235b49dae984033` Request headers accept-language it-IT,it;q=0.9 Referer http://uyk.ndi.mybluehost.me/ User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	23 KB 23 KB		Font font/woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `c3c0d3f472358aac78455515c4800771426770c22698e2486d39fdb5505634e1` Request headers Referer http://uyk.ndi.mybluehost.me/ Origin http://uyk.ndi.mybluehost.me accept-language it-IT,it;q=0.9 User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1 Response headers Content-Type font/woff2
GET DATA	200 OK	truncated /	22 KB 22 KB		Font font/woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `8d3ca80fa271e94b0c36cf3053b0f806b7a42bb3395b424c99dc0bd218f0ac20` Request headers Referer http://uyk.ndi.mybluehost.me/ Origin http://uyk.ndi.mybluehost.me accept-language it-IT,it;q=0.9 User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1 Response headers Content-Type font/woff2

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Aruba (Online)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			uyk.ndi.mybluehost.me/	1969-12-31 23:59:59	Name: PHPSESSID Value: ca60e3a4c54d51b53eb197a0ea1142be

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

uyk.ndi.mybluehost.me
www.nachytano.cz
162.241.216.65
212.158.159.117
3f17168698a35c8156a22b0483d20469ae01fe5e714f94bf575b073f4c20ba02
50c0214cab06f02e4e1501e2edd9e707dfcb1a6c3e1c38c05235b49dae984033
8d3ca80fa271e94b0c36cf3053b0f806b7a42bb3395b424c99dc0bd218f0ac20
a525f163e73542be1b82c5ae4e4beed74d137d56161ac5b02833a279ef6d9b61
bcedcafd81248b08cb428b22618a38866d0cee85b4e9ecd27ef734d0533e2792
c3c0d3f472358aac78455515c4800771426770c22698e2486d39fdb5505634e1
f7d4f46e5b853727d9fe49f79faadb7c77d3235992542e1229b5c3f9cc1184a2

uyk.ndi.mybluehost.me Open in urlscan Pro 162.241.216.65 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

2 Requests

0 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

330 kBTransfer

694 kBSize

1 Cookies

1 Outgoing links

Page URL History

Redirected requests

2 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 6 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

1 Cookies

Indicators

uyk.ndi.mybluehost.me Open in urlscan Pro
162.241.216.65 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

2
Requests

0 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

330 kB
Transfer

694 kB
Size

1
Cookies

2 HTTP transactions
6 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!