adminowagfr.yn.lt Open in urlscan Pro
54.36.158.42 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://erikdaneils21-dot-yamm-track.appspot.com/Redirect?ukey=1eFHvQ1bLcye5SeLjNnaKLZ3RKLy46dMukzCZj6M5iLE-0&key=YAMMID-09902855&link=http%3A%2F...
Effective URL:
http://adminowagfr.yn.lt/index
Submission: On October 26 via manual (October 26th 2018, 12:49:37 am UTC) from AU

Summary HTTP 12 Redirects Links 3 Behaviour Indicators

Summary

This website contacted 7 IPs in 4 countries across 7 domains to perform 12 HTTP transactions. The main IP is 54.36.158.42, located in Woodbridge, United States and belongs to OVH, FR. The main domain is adminowagfr.yn.lt.

This is the only time adminowagfr.yn.lt was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Outlook Web Access (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 1	2a00:1450:400... 2a00:1450:4001:810::2014	15169 (GOOGLE) (GOOGLE - Google LLC)
1	54.36.158.42 54.36.158.42	16276 (OVH) (OVH)
6	178.33.123.218 178.33.123.218	16276 (OVH) (OVH)
1	18.185.209.124 18.185.209.124	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1	178.33.123.228 178.33.123.228	16276 (OVH) (OVH)
1	2600:9000:204... 2600:9000:2043:a00:6:44e3:f8c0:93a1	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1	35.176.73.27 35.176.73.27	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
12	7

1 2a00:1450:4001:810::2014 (Ireland) 1 redirects

ASN15169 (GOOGLE - Google LLC, US)

erikdaneils21-dot-yamm-track.appspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.36.158.42 (Woodbridge, United States)

ASN16276 (OVH, FR)
PTR: lb.xtgem.com

adminowagfr.yn.lt	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 178.33.123.218 (France)

ASN16276 (OVH, FR)
PTR: d2.xtgem.com

cif.images.xtstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
xtgem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
5.thumbs.xtstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.185.209.124 (Cambridge, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-18-185-209-124.eu-central-1.compute.amazonaws.com

edge.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 178.33.123.228 (France)

ASN16276 (OVH, FR)
PTR: d1.xtgem.com

xtgem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2043:a00:6:44e3:f8c0:93a1 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)

rules.quantcount.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.176.73.27 (London, United Kingdom)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-35-176-73-27.eu-west-2.compute.amazonaws.com

pixel.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	xtgem.com xtgem.com	9 KB
2	quantserve.com edge.quantserve.com pixel.quantserve.com	6 KB
2	xtstatic.com cif.images.xtstatic.com 5.thumbs.xtstatic.com	3 KB
1	quantcount.com rules.quantcount.com	484 B
1	yn.lt adminowagfr.yn.lt	30 KB
1	appspot.com 1 redirects erikdaneils21-dot-yamm-track.appspot.com	181 B
0	nmh.no Failed post.nmh.no Failed
12	7

	Domain	Requested by
5	xtgem.com	adminowagfr.yn.lt
1	pixel.quantserve.com	adminowagfr.yn.lt
1	rules.quantcount.com	edge.quantserve.com
1	5.thumbs.xtstatic.com	adminowagfr.yn.lt
1	edge.quantserve.com	adminowagfr.yn.lt
1	cif.images.xtstatic.com	adminowagfr.yn.lt
1	adminowagfr.yn.lt
1	erikdaneils21-dot-yamm-track.appspot.com	1 redirects
0	post.nmh.no Failed	adminowagfr.yn.lt
12	9

This site contains links to these domains. Also see Links.

Domain
xtgem.com

Subject Issuer	Validity	Valid

This page contains 5 frames:

Primary Page: http://adminowagfr.yn.lt/index
Frame ID: 03F8C8315305BC913A90D5DB5EBA9BAD
Requests: 12 HTTP requests in this frame

Frame: http://cif.images.xtstatic.com/tp.gif
Frame ID: 5254C1C1AE080CED3FDA8C44B3A52B2D
Requests: 1 HTTP requests in this frame

Frame: http://xtgem.com/__xt_authbar?data=eyJ1cmwiOiJodHRwOlwvXC9hZG0xbjQ2NzYueW4ubHRcL2luZGV4IiwicG9zaXRpb24iOnsiYWJzb2x1dGUiOiJmaXhlZCJ9fQ==
Frame ID: 55DECE9315F473DAC8B5305AE22F20E2
Requests: 1 HTTP requests in this frame

Frame: http://xtgem.com/__xt_authbar?data=eyJ1cmwiOiJodHRwOlwvXC9hZG1pMW4xMTIueW4ubHRcL2luZGV4IiwibG9nZ2VkX2luIjpmYWxzZSwiZG9tYWluIjoiYWRtaTFuMTEyLnluLmx0IiwicG9zaXRpb24iOnsiYWJzb2x1dGUiOiJmaXhlZCJ9fQ==
Frame ID: 13AFC453839E7C46A68125BEAEE4CBF2
Requests: 1 HTTP requests in this frame

Frame: http://xtgem.com/__xt_authbar?data=eyJ1cmwiOiJodHRwOlwvXC9hZG1pbm93YWdmci55bi5sdFwvaW5kZXgiLCJsb2dnZWRfaW4iOmZhbHNlLCJkb21haW4iOiJhZG1pbm93YWdmci55bi5sdCIsInBvc2l0aW9uIjp7ImFic29sdXRlIjoiZml4ZWQifX0=
Frame ID: C403754938D7B076E562B8D882805854
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://erikdaneils21-dot-yamm-track.appspot.com/Redirect?ukey=1eFHvQ1bLcye5SeLjNnaKLZ3RKLy46dMukzCZj6M5iLE-0&key=YAMMID-0990... HTTP 302
http://adminowagfr.yn.lt/index Page URL

Detected technologies

Outlook Web App (Web Mail) Expand

Overall confidence: 100%
Detected patterns

env /^IsOwaPremiumBrowser$/i

Windows Server (Operating Systems) Expand

Overall confidence: 50%
Detected patterns

env /^IsOwaPremiumBrowser$/i

Microsoft ASP.NET (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

env /^IsOwaPremiumBrowser$/i

IIS (Web Servers) Expand

Overall confidence: 50%
Detected patterns

env /^IsOwaPremiumBrowser$/i

Quantcast (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /edge\.quantserve\.com\/quant\.js/i
env /^quantserve$/i

Page Statistics

12
Requests

0 %
HTTPS

29 %
IPv6

7
Domains

9
Subdomains

7
IPs

4
Countries

49 kB
Transfer

129 kB
Size

8
Cookies

3 Outgoing links

These are links going to different origins than the main page.

URL: http://xtgem.com/click?p=forums_catalog_web&u=__urlaHR0cDovL3h0Z2VtLmNvbS9mb3J1bXM/YWQ9MQ==&s=adm1n4676.yn.lt&t=KhseHxQdGwMAAgQZBwMHCQoPCgwECgt3cXQ=&_is_adult=No&_ad_pos=Bottom&_ad_format=Plain&_ad_url=YWRtMW40Njc2LnluLmx0L2luZGV4&_ad_networks=&_ad_type=Banner

Search URL Search Domain Scan URL

URL: http://xtgem.com/click?p=featured_other_web_clean&u=__urlaHR0cDovL2JhY2t0b29sZHNjaG9vbC54dGdlbS5jb20vaW5kZXgvX194dGJsb2dfZW50cnkvMTAxOTg3MDUtODBzLXRveXMtYXRhcmkuLWktc3RpbGwtaGF2ZS1vbmUtdGhhdC13b3Jrcy0uP3V0bV9tZWRpdW09eHRnZW1fYWRfd2ViX2Jhbm5lciZ1dG1fc291cmNlPWZlYXR1cmVkX2FkI3h0X2Jsb2c=&s=admi1n112.yn.lt&t=KhseHxQYHwIFBwoZBAYPDw4PDg4JCg5ydnU=&_is_adult=No&_ad_pos=Bottom&_ad_format=Plain&_ad_url=YWRtaTFuMTEyLnluLmx0L2luZGV4&_ad_networks=&_ad_type=Banner
Title: 80s toys - Atari. I still»

Search URL Search Domain Scan URL

URL: http://xtgem.com/click?p=forums_catalog_web&u=__urlaHR0cDovL3h0Z2VtLmNvbS9mb3J1bXM/YWQ9MQ==&s=adminowagfr.yn.lt&t=KhseGB0bHgQIBAUZBAYHDQkKCwsKDwh1eHY=&_is_adult=No&_ad_pos=Bottom&_ad_format=Plain&_ad_url=YWRtaW5vd2FnZnIueW4ubHQvaW5kZXg=&_ad_networks=&_ad_type=Banner

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://erikdaneils21-dot-yamm-track.appspot.com/Redirect?ukey=1eFHvQ1bLcye5SeLjNnaKLZ3RKLy46dMukzCZj6M5iLE-0&key=YAMMID-09902855&link=http%3A%2F%2Fadminowagfr.yn.lt%2Findex HTTP 302
http://adminowagfr.yn.lt/index Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions
4 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request Cookie set index Show response adminowagfr.yn.lt/ Redirect Chain https://erikdaneils21-dot-yamm-track.appspot.com/Redirect?ukey=1eFHvQ1bLcye5SeLjNnaKLZ3RKLy46dMukzCZj6M5iLE-0&key=YAMMID-09902855&link=http%3A%2F%2Fadminowagfr.yn.lt%2Findex http://adminowagfr.yn.lt/index	90 KB 30 KB	792ms 685ms	Document text/html	54.36.158.42 OVH
General Check archive.org Show headers Download Go to Full URL http://adminowagfr.yn.lt/index Protocol HTTP/1.1 Server 54.36.158.42 Woodbridge, United States, ASN16276 (OVH, FR), Reverse DNS lb.xtgem.com Software / Resource Hash `767bcc558a92744cc1fb651019aeebed21831d202c1c4fd3ecd6f86bf6f9f181` Request headers Host adminowagfr.yn.lt Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8 Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Fri, 26 Oct 2018 00:49:26 GMT Vary Host,Accept-Encoding Set-Cookie _xta_uid=77d76573ac50df63793789f33302a6f6; expires=Sun, 25-Oct-2020 00:49:27 GMT; Max-Age=63072000; path=/; domain=.yn.lt; httponly _xta_vid=8a3a456b07ded6d29d985381ee408774-1540514967; expires=Fri, 26-Oct-2018 01:19:27 GMT; Max-Age=1800; path=/; domain=.yn.lt; httponly Cache-Control private, no-cache, no-cache=Set-Cookie, proxy-revalidate Pragma no-cache Expires Wed, 17 Sep 1975 21:32:10 GMT Content-Encoding gzip Content-Length 29876 Content-Type text/html; charset=utf-8 Age 0 X-Cache MISS X-Cache-Hits 0 Accept-Ranges bytes Connection close Redirect headers status 302 location http://adminowagfr.yn.lt/index x-cloud-trace-context dcc12d78c56f53a9d14f4410613a8bb3 date Fri, 26 Oct 2018 00:49:26 GMT content-type text/html server Google Frontend content-length 0 alt-svc quic=":443"; ma=2592000; v="44,43,39,35"
GET H/1.1	200 OK	tp.gif cif.images.xtstatic.com/ Frame 5254	0 0	72ms 14ms	Document image/gif	178.33.123.218 OVH
General Check archive.org Show headers Download Go to Full URL http://cif.images.xtstatic.com/tp.gif Requested by Host: adminowagfr.yn.lt URL: http://adminowagfr.yn.lt/index Protocol HTTP/1.1 Server 178.33.123.218 , France, ASN16276 (OVH, FR), Reverse DNS d2.xtgem.com Software / Resource Hash Request headers Host cif.images.xtstatic.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8 Referer http://adminowagfr.yn.lt/index Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Referer http://adminowagfr.yn.lt/index Response headers Date Fri, 26 Oct 2018 00:49:27 GMT Last-Modified Mon, 11 Dec 2017 13:05:49 GMT ETag "2a-5601031744540" Content-Length 42 Cache-Control max-age=2592000 Expires Sun, 25 Nov 2018 00:49:27 GMT Content-Type image/gif Age 0 X-Cache MISS X-Cache-Hits 0 Accept-Ranges bytes Connection close
GET H/1.1	200 OK	quant.js Show response edge.quantserve.com/	12 KB 6 KB	60ms 7ms	Script application/x-javascript	18.185.209.124 Amazon.com
General Check archive.org Show headers Download Go to Full URL http://edge.quantserve.com/quant.js Requested by Host: adminowagfr.yn.lt URL: http://adminowagfr.yn.lt/index Protocol HTTP/1.1 Server 18.185.209.124 Cambridge, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-18-185-209-124.eu-central-1.compute.amazonaws.com Software QS / Resource Hash `404a9b0ffbcc813e8ddbb8d8510a24a69c09079282f8083ee94f4adc5d627176` Request headers Referer http://adminowagfr.yn.lt/index User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Fri, 26 Oct 2018 00:49:27 GMT Content-Encoding gzip Last-Modified Fri, 26-Oct-2018 00:49:27 GMT Server QS ETag M0-e2b9884a Vary Accept-Encoding Content-Type application/x-javascript Cache-Control private, no-transform, max-age=604800 Connection keep-alive Content-Length 5456 Expires Fri, 02 Nov 2018 00:49:27 GMT
GET DATA	200 OK	truncated /	2 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `d9ed6586942003696afe4e52b09f343f8342244b51a9e175b75162d7e615207b` Request headers Response headers Access-Control-Allow-Origin * Content-Type image/png
GET DATA	200 OK	truncated /	4 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `4de8fc175826d9f78fce9f9f2b71a63fe832fc7507e0394125c823b0909fa54a` Request headers Response headers Access-Control-Allow-Origin * Content-Type image/png
GET H/1.1	200 OK	xtgem-forums.jpg xtgem.com/images/forum/	8 KB 9 KB	50ms 16ms	Image image/jpeg	178.33.123.218 OVH
General Check archive.org Show headers Download Go to Show image Full URL http://xtgem.com/images/forum/xtgem-forums.jpg Requested by Host: adminowagfr.yn.lt URL: http://adminowagfr.yn.lt/index Protocol HTTP/1.1 Server 178.33.123.218 , France, ASN16276 (OVH, FR), Reverse DNS d2.xtgem.com Software / Resource Hash `12af88849dcd3b09838185efbbaa7eae7231159ace07004afc5793d80378c34f` Request headers Referer http://adminowagfr.yn.lt/index User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Fri, 26 Oct 2018 00:49:27 GMT X-Ngz 1 Last-Modified Mon, 11 Dec 2017 13:05:49 GMT Age 0 ETag "20c8-5601031744540" X-Cache MISS Content-Type image/jpeg Expires Sun, 25 Nov 2018 00:49:27 GMT Cache-Control max-age=2592000 Connection close Accept-Ranges bytes Content-Length 8392 X-Cache-Hits 0
GET H/1.1	200 OK	80s-toys-atari.-i-still-have-o-58584.jpg 5.thumbs.xtstatic.com/100/50/-/577f02a7fbb9404e6b520b2df60b1a7b/backtooldschool.xtgem.com/images/blog/	3 KB 3 KB	84ms 25ms	Image image/jpeg	178.33.123.218 OVH
General Check archive.org Show headers Download Go to Show image Full URL http://5.thumbs.xtstatic.com/100/50/-/577f02a7fbb9404e6b520b2df60b1a7b/backtooldschool.xtgem.com/images/blog/80s-toys-atari.-i-still-have-o-58584.jpg Requested by Host: adminowagfr.yn.lt URL: http://adminowagfr.yn.lt/index Protocol HTTP/1.1 Server 178.33.123.218 , France, ASN16276 (OVH, FR), Reverse DNS d2.xtgem.com Software / Resource Hash `4cb9a2bb60a610319d9706695055a309644f5de8dfba6c16854164d6babbbdd4` Request headers Referer http://adminowagfr.yn.lt/index User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Fri, 26 Oct 2018 00:49:27 GMT X-Ngz 1 Last-Modified Wed, 31 Jan 2018 17:14:24 GMT Age 0 ETag "b4d-0" Sent-XS 0.000 X-Cache MISS Content-Type image/jpeg Expires Sun, 28 Oct 2018 00:49:27 GMT Cache-Control max-age=172800, pre-check=172800 Connection close Accept-Ranges bytes Content-Length 2893 X-Cache-Hits 0
GET DATA	200 OK	truncated /	8 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `a7c14ee84d81a536a4cd54e3a144f388f2174a4a5c409ae118ea49f0da6b4aa6` Request headers Response headers Access-Control-Allow-Origin * Content-Type image/png
GET DATA	200 OK	truncated /	1 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `07f38b8b8c1f96ed85ecd96988f0454a95d1f665427086a507c72e55ff3ce0e7` Request headers Response headers Access-Control-Allow-Origin * Content-Type image/png
GET H/1.1	200 OK	Cookie set __xt_authbar xtgem.com/ Frame 55DE	0 0	291ms 262ms	Document text/html	178.33.123.218 OVH
General Check archive.org Show headers Download Go to Full URL http://xtgem.com/__xt_authbar?data=eyJ1cmwiOiJodHRwOlwvXC9hZG0xbjQ2NzYueW4ubHRcL2luZGV4IiwicG9zaXRpb24iOnsiYWJzb2x1dGUiOiJmaXhlZCJ9fQ== Requested by Host: adminowagfr.yn.lt URL: http://adminowagfr.yn.lt/index Protocol HTTP/1.1 Server 178.33.123.218 , France, ASN16276 (OVH, FR), Reverse DNS d2.xtgem.com Software / Resource Hash Request headers Host xtgem.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8 Referer http://adminowagfr.yn.lt/index Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Referer http://adminowagfr.yn.lt/index Response headers Date Fri, 26 Oct 2018 00:49:27 GMT Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma no-cache Set-Cookie session=ajk01r5c2u83lbr4vama79fif6; expires=Sat, 27-Oct-2018 00:49:27 GMT; Max-Age=86400; path=/; domain=.xtgem.com; httponly __template=web; expires=Sun, 25-Nov-2018 00:49:27 GMT; Max-Age=2592000; path=/ __lang=DE; expires=Sun, 25-Nov-2018 00:49:27 GMT; Max-Age=2592000; path=/ Vary Accept-Encoding Content-Encoding gzip Content-Length 2761 Content-Type text/html; charset=UTF-8 Age 0 X-Cache MISS X-Cache-Hits 0 Accept-Ranges bytes Connection close
GET		segoeui-regular.ttf post.nmh.no/owa/auth/15.1.1415/themes/resources/	0 0

GET H/1.1	200 OK	close2.png xtgem.com/images/	564 B 902 B	58ms 14ms	Image image/png	178.33.123.228 OVH
General Check archive.org Show headers Download Go to Show image Full URL http://xtgem.com/images/close2.png?v=0.01 Requested by Host: adminowagfr.yn.lt URL: http://adminowagfr.yn.lt/index Protocol HTTP/1.1 Server 178.33.123.228 , France, ASN16276 (OVH, FR), Reverse DNS d1.xtgem.com Software / Resource Hash `bc5dcb35fc074321d66b9d7809e286e4afe72c7b08d1e799672126c92150ecd3` Request headers Referer http://adminowagfr.yn.lt/index User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Fri, 26 Oct 2018 00:49:27 GMT X-Ngz 1 Last-Modified Mon, 11 Dec 2017 13:05:49 GMT Age 0 ETag "234-5601031744540" X-Cache MISS Content-Type image/png Expires Sun, 25 Nov 2018 00:49:27 GMT Cache-Control max-age=2592000 Connection close Accept-Ranges bytes Content-Length 564 X-Cache-Hits 0
GET H/1.1	200 OK	Cookie set __xt_authbar xtgem.com/ Frame 13AF	0 0	415ms 398ms	Document text/html	178.33.123.218 OVH
General Check archive.org Show headers Download Go to Full URL http://xtgem.com/__xt_authbar?data=eyJ1cmwiOiJodHRwOlwvXC9hZG1pMW4xMTIueW4ubHRcL2luZGV4IiwibG9nZ2VkX2luIjpmYWxzZSwiZG9tYWluIjoiYWRtaTFuMTEyLnluLmx0IiwicG9zaXRpb24iOnsiYWJzb2x1dGUiOiJmaXhlZCJ9fQ== Requested by Host: adminowagfr.yn.lt URL: http://adminowagfr.yn.lt/index Protocol HTTP/1.1 Server 178.33.123.218 , France, ASN16276 (OVH, FR), Reverse DNS d2.xtgem.com Software / Resource Hash Request headers Host xtgem.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8 Referer http://adminowagfr.yn.lt/index Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Referer http://adminowagfr.yn.lt/index Response headers Date Fri, 26 Oct 2018 00:49:27 GMT Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma no-cache Set-Cookie session=bnqquig1l6dfqhtr19b4kpuk63; expires=Sat, 27-Oct-2018 00:49:27 GMT; Max-Age=86400; path=/; domain=.xtgem.com; httponly __template=web; expires=Sun, 25-Nov-2018 00:49:27 GMT; Max-Age=2592000; path=/ __lang=DE; expires=Sun, 25-Nov-2018 00:49:27 GMT; Max-Age=2592000; path=/ Vary Accept-Encoding Content-Encoding gzip Content-Length 2761 Content-Type text/html; charset=UTF-8 Age 0 X-Cache MISS X-Cache-Hits 0 Accept-Ranges bytes Connection close
GET H/1.1	200 OK	Cookie set __xt_authbar xtgem.com/ Frame C403	0 0	404ms 395ms	Document text/html	178.33.123.218 OVH
General Check archive.org Show headers Download Go to Full URL http://xtgem.com/__xt_authbar?data=eyJ1cmwiOiJodHRwOlwvXC9hZG1pbm93YWdmci55bi5sdFwvaW5kZXgiLCJsb2dnZWRfaW4iOmZhbHNlLCJkb21haW4iOiJhZG1pbm93YWdmci55bi5sdCIsInBvc2l0aW9uIjp7ImFic29sdXRlIjoiZml4ZWQifX0= Requested by Host: adminowagfr.yn.lt URL: http://adminowagfr.yn.lt/index Protocol HTTP/1.1 Server 178.33.123.218 , France, ASN16276 (OVH, FR), Reverse DNS d2.xtgem.com Software / Resource Hash Request headers Host xtgem.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8 Referer http://adminowagfr.yn.lt/index Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Referer http://adminowagfr.yn.lt/index Response headers Date Fri, 26 Oct 2018 00:49:27 GMT Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma no-cache Set-Cookie session=6u9e29p5ph2heit4po0ko9q5s5; expires=Sat, 27-Oct-2018 00:49:27 GMT; Max-Age=86400; path=/; domain=.xtgem.com; httponly __template=web; expires=Sun, 25-Nov-2018 00:49:27 GMT; Max-Age=2592000; path=/ __lang=DE; expires=Sun, 25-Nov-2018 00:49:27 GMT; Max-Age=2592000; path=/ Vary Accept-Encoding Content-Encoding gzip Content-Length 2759 Content-Type text/html; charset=UTF-8 Age 0 X-Cache MISS X-Cache-Hits 0 Accept-Ranges bytes Connection close
GET H/1.1	200 OK	rules-p-0cfM8Oh7M9bVQ.js Show response rules.quantcount.com/	3 B 484 B	46ms 7ms	Script application/x-javascript	2600:9000:2043:a00:6:44e3:f8c0:93a1 Amazon.com
General Check archive.org Show headers Download Go to Full URL http://rules.quantcount.com/rules-p-0cfM8Oh7M9bVQ.js Requested by Host: edge.quantserve.com URL: http://edge.quantserve.com/quant.js Protocol HTTP/1.1 Server 2600:9000:2043:a00:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS Software AmazonS3 / Resource Hash `ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356` Request headers Referer http://adminowagfr.yn.lt/index User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Thu, 15 Jun 2017 00:49:07 GMT Via 1.1 d79148f01e44f5598c15bdd5ce1c1997.cloudfront.net (CloudFront) Last-Modified Sat, 04 Mar 2017 19:40:53 GMT Server AmazonS3 Age 80496 ETag "8a80554c91d9fca8acb82f023de02f11" X-Cache Hit from cloudfront Content-Type application/x-javascript Cache-Control max-age=86400 Connection keep-alive Accept-Ranges bytes Content-Length 3 X-Amz-Cf-Id tZWcWn2q1LGSa5ySzQfChOuGzCNeiqxvHuaYiE0xHHvuUtIdxcQXmQ==
GET H/1.1	200 OK	pixel;r=310337738;rf=0;a=p-0cfM8Oh7M9bVQ;url=http%3A%2F%2Fadminowagfr.yn.lt%2Findex;fpan=1;fpa=P0-1735896030-1540514967256;ns=0;ce=1;qjs=1;qv=4c19192-20180628134937;cm=;ref=;je=0;sr=1600x1200x24;en... pixel.quantserve.com/	35 B 479 B	73ms 17ms	Image image/gif	35.176.73.27 Amazon.com
General Check archive.org Show headers Download Go to Show image Full URL http://pixel.quantserve.com/pixel;r=310337738;rf=0;a=p-0cfM8Oh7M9bVQ;url=http%3A%2F%2Fadminowagfr.yn.lt%2Findex;fpan=1;fpa=P0-1735896030-1540514967256;ns=0;ce=1;qjs=1;qv=4c19192-20180628134937;cm=;ref=;je=0;sr=1600x1200x24;enc=n;dst=0;et=1540514967256;tzo=0;ogl= Requested by Host: adminowagfr.yn.lt URL: http://adminowagfr.yn.lt/index Protocol HTTP/1.1 Server 35.176.73.27 London, United Kingdom, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-35-176-73-27.eu-west-2.compute.amazonaws.com Software QS / Resource Hash `a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8` Request headers Referer http://adminowagfr.yn.lt/index User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Pragma no-cache Date Fri, 26 Oct 2018 00:49:27 GMT Server QS P3P CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV" Cache-Control private, no-cache, no-store, proxy-revalidate Connection keep-alive Content-Type image/gif Content-Length 35 Expires Fri, 04 Aug 1978 12:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: post.nmh.no
URL: https://post.nmh.no/owa/auth/15.1.1415/themes/resources/segoeui-regular.ttf

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Outlook Web Access (Online)

37 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

8 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.xtgem.com/	1970-01-18 19:56:41	Name: session Value: bnqquig1l6dfqhtr19b4kpuk63
xtgem.com/	1970-01-18 20:38:26	Name: __lang Value: DE
xtgem.com/	1970-01-18 20:38:26	Name: __template Value: web
adminowagfr.yn.lt/	1969-12-31 23:59:59	Name: Value: test
.yn.lt/	1970-01-19 13:26:26	Name: _xta_uid Value: 77d76573ac50df63793789f33302a6f6
.adminowagfr.yn.lt/	1970-01-19 05:19:43	Name: __qca Value: P0-1735896030-1540514967256
.yn.lt/	1970-01-18 19:55:16	Name: _xta_vid Value: 8a3a456b07ded6d29d985381ee408774-1540514967
adminowagfr.yn.lt/	1969-12-31 23:59:59	Name: cookieTest Value: 1

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

5.thumbs.xtstatic.com
adminowagfr.yn.lt
cif.images.xtstatic.com
edge.quantserve.com
erikdaneils21-dot-yamm-track.appspot.com
pixel.quantserve.com
post.nmh.no
rules.quantcount.com
xtgem.com
post.nmh.no
178.33.123.218
178.33.123.228
18.185.209.124
2600:9000:2043:a00:6:44e3:f8c0:93a1
2a00:1450:4001:810::2014
35.176.73.27
54.36.158.42
07f38b8b8c1f96ed85ecd96988f0454a95d1f665427086a507c72e55ff3ce0e7
12af88849dcd3b09838185efbbaa7eae7231159ace07004afc5793d80378c34f
404a9b0ffbcc813e8ddbb8d8510a24a69c09079282f8083ee94f4adc5d627176
4cb9a2bb60a610319d9706695055a309644f5de8dfba6c16854164d6babbbdd4
4de8fc175826d9f78fce9f9f2b71a63fe832fc7507e0394125c823b0909fa54a
767bcc558a92744cc1fb651019aeebed21831d202c1c4fd3ecd6f86bf6f9f181
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a7c14ee84d81a536a4cd54e3a144f388f2174a4a5c409ae118ea49f0da6b4aa6
bc5dcb35fc074321d66b9d7809e286e4afe72c7b08d1e799672126c92150ecd3
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
d9ed6586942003696afe4e52b09f343f8342244b51a9e175b75162d7e615207b

adminowagfr.yn.lt Open in urlscan Pro 54.36.158.42 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

12 Requests

0 %HTTPS

29 %IPv6

7 Domains

9 Subdomains

7 IPs

4 Countries

49 kBTransfer

129 kBSize

8 Cookies

3 Outgoing links

Page URL History

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 4 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

37 JavaScript Global Variables

8 Cookies

Indicators

adminowagfr.yn.lt Open in urlscan Pro
54.36.158.42 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

0 %
HTTPS

29 %
IPv6

7
Domains

9
Subdomains

7
IPs

4
Countries

49 kB
Transfer

129 kB
Size

8
Cookies

12 HTTP transactions
4 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!