urlscan.io logo urlscan.io
SecurityTrails logo

cheapcast.xyz Open in urlscan Pro
51.75.20.240  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://cheapcast.xyz/yah/mail.html
Submission: On August 30 via automatic, source openphish
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 16 HTTP transactions. The main IP is 51.75.20.240, located in United Kingdom and belongs to OVH, FR. The main domain is cheapcast.xyz.
TLS certificate: Issued by cheapcast.xyz on August 29th 2018. Valid for: a year.
This is the only time cheapcast.xyz was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Yahoo (Online)

Domain & IP information

IP Address AS Autonomous System
1 51.75.20.240 16276 (OVH)
4 2.16.186.48 20940 (AKAMAI-ASN1)
16 3
Apex Domain
Subdomains		 Transfer
4 yimg.com
us.i1.yimg.com
us.js2.yimg.com Failed
21 KB
1 cheapcast.xyz
cheapcast.xyz
16 KB
16 2
Domain Requested by
4 us.i1.yimg.com cheapcast.xyz
1 cheapcast.xyz
0 us.js2.yimg.com Failed cheapcast.xyz
16 3
Subject Issuer Validity Valid
cheapcast.xyz
cheapcast.xyz		 2018-08-29 -
2019-08-29		 a year crt.sh

This page contains 1 frames:

Primary Page: https://cheapcast.xyz/yah/mail.html
Frame ID: 3EF4B9927A4882DF742B648AA88EC21E
Requests: 16 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

Page Statistics

16
Requests

0 %
HTTPS

0 %
IPv6

2
Domains

3
Subdomains

3
IPs

2
Countries

37 kB
Transfer

35 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

16 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request mail.html
cheapcast.xyz/yah/ 		16 KB
16 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://cheapcast.xyz/yah/mail.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
51.75.20.240 , United Kingdom, ASN16276 (OVH, FR),
Reverse DNS
240.ip-51-75-20.eu
Software
Apache /
Resource Hash
d7abac1a425fc66c04e7fe5094b434ee09c4db8477d612bfd369aafd0be10c89

Request headers

Host
cheapcast.xyz
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id
3EF4B9927A4882DF742B648AA88EC21E

Response headers

Date
Thu, 30 Aug 2018 15:33:12 GMT
Server
Apache
Last-Modified
Thu, 30 Aug 2018 11:59:45 GMT
Accept-Ranges
bytes
Content-Length
16125
Keep-Alive
timeout=5, max=100
Connection
Keep-Alive
Content-Type
text/html
ma_mail_1.gif
us.i1.yimg.com/us.yimg.com/i/us/nt/ma/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://us.i1.yimg.com/us.yimg.com/i/us/nt/ma/ma_mail_1.gif
Requested by
Host: cheapcast.xyz
URL: https://cheapcast.xyz/yah/mail.html
Protocol
HTTP/1.1
Server
2.16.186.48 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-16-186-48.deploy.static.akamaitechnologies.com
Software
ATS /
Resource Hash
7d0a669fdd13175e1bfb5127e33e7f597063e9520636b31c2c51ae07df588972

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 30 Aug 2018 15:33:12 GMT
x-ysws-request-id
D72CB38BA8226A15
Server
ATS
ETag
f58e218168f47c5044295ea0900d8c78
Vary
Origin, Accept-Encoding
x-ysws-visited-replicas
s3-us-west-2.amazonaws.com WdxmUr4Jks5KXeMlF1Mc9lt4wx79zX42NfbWDa/l8nJVSmxO3OAXDCl6D4tHTD0Pw/+6iUaCij4=
x-ysws-storage-provider
S3
Cache-Control
public, max-age=315282192
Last-Modified
Sat, 19 May 2018 22:44:24 GMT
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
image/gif
Content-Length
1402
Expires
Sat, 26 Aug 2028 17:56:24 GMT
bnr_28.jpg
us.i1.yimg.com/us.yimg.com/i/reg/ 		11 KB
11 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://us.i1.yimg.com/us.yimg.com/i/reg/bnr_28.jpg
Requested by
Host: cheapcast.xyz
URL: https://cheapcast.xyz/yah/mail.html
Protocol
HTTP/1.1
Server
2.16.186.48 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-16-186-48.deploy.static.akamaitechnologies.com
Software
ATS /
Resource Hash
6e8a2cf2d44dbe0fe070edff9ece8e048a48f0debaf1ac64ff885e852859463c

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 30 Aug 2018 15:33:12 GMT
x-ysws-request-id
A795B69A5381F65B
Server
ATS
ETag
595812acaaf22feb0a385cdb23e68f58
Vary
Origin, Accept-Encoding
x-ysws-visited-replicas
s3-us-west-2.amazonaws.com Ms0ByjBMn1EMSaBrFtxdyZJBbGoNGSp85kciBylvYu3ljhHyfbVLStRjEB8tVL8vtRZuX8lu+Ao=
x-ysws-storage-provider
S3
Cache-Control
public, max-age=315360000
Last-Modified
Sun, 13 May 2018 04:13:44 GMT
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
image/jpeg
Content-Length
10853
Expires
Sun, 27 Aug 2028 15:33:12 GMT
title_tb_flag.gif
us.i1.yimg.com/us.yimg.com/i/reg/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://us.i1.yimg.com/us.yimg.com/i/reg/title_tb_flag.gif
Requested by
Host: cheapcast.xyz
URL: https://cheapcast.xyz/yah/mail.html
Protocol
HTTP/1.1
Server
2.16.186.48 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-16-186-48.deploy.static.akamaitechnologies.com
Software
ATS /
Resource Hash
cfd2cb6d374b43a33a1d42441026d2d6ff20f9326f4902da97ce40af95c44628

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 30 Aug 2018 15:33:12 GMT
x-ysws-request-id
290867CA9A876744
Server
ATS
ETag
450589970950fd7d0e4894642a7609e9
Vary
Origin, Accept-Encoding
x-ysws-visited-replicas
s3-us-west-2.amazonaws.com XIgVotcqw1aLPNeD36zGfviC3wyiq0DaZ4bphXRhCV4msDDeS0Dugr80rCRzY71JWdK6FO0D8Xo=
x-ysws-storage-provider
S3
Cache-Control
public, max-age=315283475
Last-Modified
Tue, 22 May 2018 09:50:20 GMT
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
image/gif
Content-Length
1740
Expires
Sat, 26 Aug 2028 18:17:47 GMT
fonts_200502080901.css
us.js2.yimg.com/us.js.yimg.com/lib/common/ 		0
0
yregml_200602161700.css
us.js2.yimg.com/us.js.yimg.com/lib/reg/css/ 		0
0
ygma_200506171349.css
us.i1.yimg.com/us.yimg.com/lib/hdr/ 		0
0
bc_1.7.3.js
us.js2.yimg.com/us.js.yimg.com/lib/bc/ 		0
0
ymail_ec_logo_1.gif
us.i1.yimg.com/us.yimg.com/i/us/pim/lgn/ 		5 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://us.i1.yimg.com/us.yimg.com/i/us/pim/lgn/ymail_ec_logo_1.gif
Requested by
Host: cheapcast.xyz
URL: https://cheapcast.xyz/yah/mail.html
Protocol
HTTP/1.1
Server
2.16.186.48 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a2-16-186-48.deploy.static.akamaitechnologies.com
Software
ATS /
Resource Hash
6a8ee06d4effdce6d80958c101e184e03fda26dec7c64de16d9eacc074faa649

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Thu, 30 Aug 2018 15:33:12 GMT
x-ysws-request-id
C8078D9432EEF855
Server
ATS
ETag
896904ebc1a2f332989f017c36801054
Vary
Origin, Accept-Encoding
x-ysws-visited-replicas
s3-us-west-2.amazonaws.com S8IcyT5GLMxagoE4VTA0KI2EOrk4FMsjf80ZjEt2DAwyqfAvhbm67P8FohpTZ0tUGmuA+8ApkbE=
x-ysws-storage-provider
S3
Cache-Control
public, max-age=315282179
Last-Modified
Mon, 21 May 2018 19:22:50 GMT
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
image/gif
Content-Length
5315
Expires
Sat, 26 Aug 2028 17:56:11 GMT
bc_1.7.3.js
us.js2.yimg.com/us.js.yimg.com/lib/bc/ 		0
0
mc.js
us.js2.yimg.com/us.js.yimg.com/lib/reg/js/ 		0
0
login_md5_1_12.js
us.js2.yimg.com/us.js.yimg.com/lib/reg/js/ 		0
0
ylib_dom.js
us.js2.yimg.com/us.js.yimg.com/lib/g/ 		0
0
yg_browserext_1_5.js
us.js2.yimg.com/us.js.yimg.com/lib/g/util/ 		0
0
yregml_200507281530.js
us.js2.yimg.com/us.js.yimg.com/lib/reg/js/ 		0
0
bc_1.7.3.js
us.js2.yimg.com/us.js.yimg.com/lib/bc/ 		0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
us.js2.yimg.com
URL
http://us.js2.yimg.com/us.js.yimg.com/lib/common/fonts_200502080901.css
Domain
us.js2.yimg.com
URL
http://us.js2.yimg.com/us.js.yimg.com/lib/reg/css/yregml_200602161700.css
Domain
us.i1.yimg.com
URL
http://us.i1.yimg.com/us.yimg.com/lib/hdr/ygma_200506171349.css
Domain
us.js2.yimg.com
URL
http://us.js2.yimg.com/us.js.yimg.com/lib/bc/bc_1.7.3.js
Domain
us.js2.yimg.com
URL
http://us.js2.yimg.com/us.js.yimg.com/lib/bc/bc_1.7.3.js
Domain
us.js2.yimg.com
URL
http://us.js2.yimg.com/us.js.yimg.com/lib/reg/js/mc.js
Domain
us.js2.yimg.com
URL
http://us.js2.yimg.com/us.js.yimg.com/lib/reg/js/login_md5_1_12.js
Domain
us.js2.yimg.com
URL
http://us.js2.yimg.com/us.js.yimg.com/lib/g/ylib_dom.js
Domain
us.js2.yimg.com
URL
http://us.js2.yimg.com/us.js.yimg.com/lib/g/util/yg_browserext_1_5.js
Domain
us.js2.yimg.com
URL
http://us.js2.yimg.com/us.js.yimg.com/lib/reg/js/yregml_200507281530.js
Domain
us.js2.yimg.com
URL
http://us.js2.yimg.com/us.js.yimg.com/lib/bc/bc_1.7.3.js

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Yahoo (Online)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| dontGotIt function| doGotIt function| setFocus string| browser_string number| hasMsgr

0 Cookies