outlook-update.hexat.com

Summary

This website contacted 5 IPs in 3 countries across 4 domains to perform 6 HTTP transactions. The main IP is 54.36.158.42, located in France and belongs to OVH, FR. The main domain is outlook-update.hexat.com.

This is the only time outlook-update.hexat.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	54.36.158.42 54.36.158.42	16276 (OVH) (OVH)
2	178.33.123.218 178.33.123.218	16276 (OVH) (OVH)
1	91.228.74.195 91.228.74.195	27281 (QUANTCAST) (QUANTCAST - Quantcast Corporation)
1 2	2600:9000:200... 2600:9000:200d:c800:6:44e3:f8c0:93a1	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1	91.228.74.219 91.228.74.219	27281 (QUANTCAST) (QUANTCAST - Quantcast Corporation)
6	5

1 54.36.158.42 (France)

ASN16276 (OVH, FR)
PTR: lb.xtgem.com

outlook-update.hexat.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 178.33.123.218 (France)

ASN16276 (OVH, FR)
PTR: d2.xtgem.com

xtgem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 91.228.74.195 (United Kingdom)

ASN27281 (QUANTCAST - Quantcast Corporation, US)

edge.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:200d:c800:6:44e3:f8c0:93a1 (United States) 1 redirects

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)

rules.quantcount.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 91.228.74.219 (United Kingdom)

ASN27281 (QUANTCAST - Quantcast Corporation, US)

pixel.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	quantcount.com 1 redirects rules.quantcount.com	778 B
2	quantserve.com edge.quantserve.com pixel.quantserve.com	6 KB
2	xtgem.com xtgem.com	19 KB
1	hexat.com outlook-update.hexat.com	2 KB
6	4

	Domain	Requested by
2	rules.quantcount.com	1 redirects outlook-update.hexat.com
2	xtgem.com	outlook-update.hexat.com
1	pixel.quantserve.com	outlook-update.hexat.com
1	edge.quantserve.com	outlook-update.hexat.com
1	outlook-update.hexat.com
6	5

This site contains links to these domains. Also see Links.

Domain
xtgem.com

Subject Issuer	Validity	Valid
	`1970-01-01` - `1970-01-01`	a few seconds	crt.sh
*.quantserve.com DigiCert SHA2 High Assurance Server CA	`2018-10-16` - `2019-10-21`	a year	crt.sh

This page contains 1 frames:

Primary Page: http://outlook-update.hexat.com/index
Frame ID: 1A45E04C14C366D2B18B706A03E18229
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Quantcast (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /edge\.quantserve\.com\/quant\.js/i
env /^quantserve$/i

Page Statistics

6
Requests

17 %
HTTPS

20 %
IPv6

4
Domains

5
Subdomains

5
IPs

3
Countries

28 kB
Transfer

38 kB
Size

1
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: http://xtgem.com/click?p=forums_catalog_web&u=__urlaHR0cDovL3h0Z2VtLmNvbS9mb3J1bXM/YWQ9MQ==&s=outlook-update.hexat.com&t=KhseGh0aGQICAgsZAw8PDgsPDg8ECAl5eQ==&_is_adult=No&_ad_pos=Bottom&_ad_format=Plain&_ad_url=b3V0bG9vay11cGRhdGUuaGV4YXQuY29tL2luZGV4&_ad_networks=&_ad_type=Banner

Search URL Search Domain Scan URL

URL: http://xtgem.com/

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 3

http://rules.quantcount.com/rules-p-0cfM8Oh7M9bVQ.js HTTP 301
https://rules.quantcount.com/rules-p-0cfM8Oh7M9bVQ.js

6 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	404 Not Found	Primary Request index Show response outlook-update.hexat.com/	7 KB 2 KB	733ms 679ms	Document text/html	54.36.158.42 OVH
General Check archive.org Show headers Download Go to Full URL http://outlook-update.hexat.com/index Protocol HTTP/1.1 Server 54.36.158.42 , France, ASN16276 (OVH, FR), Reverse DNS lb.xtgem.com Software / Resource Hash `6139b3be04c747294d81f08f894fc44ca2099ebdd1233e715d05bd68f99199d7` Request headers Host outlook-update.hexat.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3 Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Thu, 13 Jun 2019 21:45:08 GMT Vary Host,Accept-Encoding Content-Encoding gzip Content-Length 1998 Content-Type text/html;charset=UTF-8 X-App-Server bk-xtgem/w3 Age 0 X-Cache MISS X-Cache-Hits 0 Connection close
GET H/1.1	200 OK	xtgem-forums.jpg xtgem.com/images/forum/	8 KB 9 KB	75ms 46ms	Image image/jpeg	178.33.123.218 OVH
General Check archive.org Show headers Download Go to Show image Full URL http://xtgem.com/images/forum/xtgem-forums.jpg Requested by Host: outlook-update.hexat.com URL: http://outlook-update.hexat.com/index Protocol HTTP/1.1 Security , , Server 178.33.123.218 , France, ASN16276 (OVH, FR), Reverse DNS d2.xtgem.com Software / Resource Hash `12af88849dcd3b09838185efbbaa7eae7231159ace07004afc5793d80378c34f` Request headers Referer http://outlook-update.hexat.com/index User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Thu, 13 Jun 2019 21:45:09 GMT X-Ngz 1 Last-Modified Mon, 11 Dec 2017 13:05:49 GMT Age 0 ETag "20c8-5601031744540" X-Cache MISS Content-Type image/jpeg Cache-Control max-age=2592000 X-Cache-Hits 0 Connection close Accept-Ranges bytes X-App-Server bk-creator/w3 Content-Length 8392 Expires Sat, 13 Jul 2019 21:45:09 GMT
GET H/1.1	200 OK	powered_by_xtgem.png xtgem.com/images/	10 KB 11 KB	62ms 32ms	Image image/png	178.33.123.218 OVH
General Check archive.org Show headers Download Go to Show image Full URL http://xtgem.com/images/powered_by_xtgem.png Requested by Host: outlook-update.hexat.com URL: http://outlook-update.hexat.com/index Protocol HTTP/1.1 Security , , Server 178.33.123.218 , France, ASN16276 (OVH, FR), Reverse DNS d2.xtgem.com Software / Resource Hash `4e99adbc172ae5f3d664308a109b0ad623f6f0fc869eb421b58c5e05578495bf` Request headers Referer http://outlook-update.hexat.com/index User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Thu, 13 Jun 2019 21:45:09 GMT X-Ngz 1 Last-Modified Mon, 11 Dec 2017 13:05:49 GMT Age 0 ETag "28b0-5601031744540" X-Cache MISS Content-Type image/png Cache-Control max-age=2592000 X-Cache-Hits 0 Connection close Accept-Ranges bytes X-App-Server bk-creator/d2 Content-Length 10416 Expires Sat, 13 Jul 2019 21:45:09 GMT
GET H/1.1	200 OK	quant.js Show response edge.quantserve.com/	12 KB 6 KB	84ms 22ms	Script application/x-javascript	91.228.74.195 Quantcast Corpora...
General Check archive.org Show headers Download Go to Full URL http://edge.quantserve.com/quant.js Requested by Host: outlook-update.hexat.com URL: http://outlook-update.hexat.com/index Protocol HTTP/1.1 Security , , Server 91.228.74.195 , United Kingdom, ASN27281 (QUANTCAST - Quantcast Corporation, US), Reverse DNS Software QS / Resource Hash `404a9b0ffbcc813e8ddbb8d8510a24a69c09079282f8083ee94f4adc5d627176` Request headers Referer http://outlook-update.hexat.com/index User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Thu, 13 Jun 2019 21:45:09 GMT Content-Encoding gzip Last-Modified Thu, 13-Jun-2019 21:45:09 GMT Server QS ETag M0-e2b9884a Vary Accept-Encoding Content-Type application/x-javascript Cache-Control private, no-transform, max-age=604800 Connection keep-alive Content-Length 5456 Expires Thu, 20 Jun 2019 21:45:09 GMT
GET H2	200	rules-p-0cfM8Oh7M9bVQ.js Show response rules.quantcount.com/ Redirect Chain http://rules.quantcount.com/rules-p-0cfM8Oh7M9bVQ.js https://rules.quantcount.com/rules-p-0cfM8Oh7M9bVQ.js	3 B 354 B	35ms 7ms	Script application/x-javascript	2600:9000:200d:c800:6:44e3:f8c0:93a1 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://rules.quantcount.com/rules-p-0cfM8Oh7M9bVQ.js Requested by Host: outlook-update.hexat.com URL: http://outlook-update.hexat.com/index Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2600:9000:200d:c800:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS Software AmazonS3 / Resource Hash `ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356` Request headers Referer http://outlook-update.hexat.com/index User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 13 Jun 2019 04:26:26 GMT via 1.1 a034346227db119f7e0813186ca2d2c2.cloudfront.net (CloudFront) last-modified Sat, 04 Mar 2017 19:40:53 GMT server AmazonS3 age 62324 etag "8a80554c91d9fca8acb82f023de02f11" x-cache Hit from cloudfront content-type application/x-javascript status 200 cache-control max-age=86400 x-amz-cf-pop FRA50 accept-ranges bytes content-length 3 x-amz-cf-id 06_JxzB2PR8YQiOeGzeeKN47jc42tsAvmjTepHJR5PTZwcDWVBoAJA== Redirect headers Date Thu, 13 Jun 2019 21:45:09 GMT Via 1.1 41903dc3828cdce2b3daa3c944827b92.cloudfront.net (CloudFront) Server CloudFront X-Amz-Cf-Pop FRA50 X-Cache Redirect from cloudfront Content-Type text/html Location https://rules.quantcount.com/rules-p-0cfM8Oh7M9bVQ.js Connection keep-alive Content-Length 183 X-Amz-Cf-Id Rv6y-PSexNKG9H3TfXI00a06DS_Mbf3MOHyHOv-WjuOcmHBCe4954Q==
GET H/1.1	200 OK	pixel;r=1299876702;rf=0;a=p-0cfM8Oh7M9bVQ;url=http%3A%2F%2Foutlook-update.hexat.com%2Findex;fpan=1;fpa=P0-686901821-1560462309816;ns=0;ce=1;qjs=1;qv=4c19192-20180628134937;cm=;ref=;je=0;sr=1600x120... pixel.quantserve.com/	35 B 479 B	44ms 14ms	Image image/gif	91.228.74.219 Quantcast Corpora...
General Check archive.org Show headers Download Go to Show image Full URL http://pixel.quantserve.com/pixel;r=1299876702;rf=0;a=p-0cfM8Oh7M9bVQ;url=http%3A%2F%2Foutlook-update.hexat.com%2Findex;fpan=1;fpa=P0-686901821-1560462309816;ns=0;ce=1;qjs=1;qv=4c19192-20180628134937;cm=;ref=;je=0;sr=1600x1200x24;enc=n;dst=0;et=1560462309816;tzo=0;ogl= Requested by Host: outlook-update.hexat.com URL: http://outlook-update.hexat.com/index Protocol HTTP/1.1 Security , , Server 91.228.74.219 , United Kingdom, ASN27281 (QUANTCAST - Quantcast Corporation, US), Reverse DNS Software QS / Resource Hash `a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8` Request headers Referer http://outlook-update.hexat.com/index User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Pragma no-cache Date Thu, 13 Jun 2019 21:45:09 GMT Server QS P3P CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV" Cache-Control private, no-cache, no-store, proxy-revalidate Connection keep-alive Content-Type image/gif Content-Length 35 Expires Fri, 04 Aug 1978 12:00:00 GMT

Verdicts & Comments Add Verdict or Comment

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.hexat.com/	1970-01-19 10:52:11	Name: __qca Value: P0-686901821-1560462309816

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

edge.quantserve.com
outlook-update.hexat.com
pixel.quantserve.com
rules.quantcount.com
xtgem.com
178.33.123.218
2600:9000:200d:c800:6:44e3:f8c0:93a1
54.36.158.42
91.228.74.195
91.228.74.219
12af88849dcd3b09838185efbbaa7eae7231159ace07004afc5793d80378c34f
404a9b0ffbcc813e8ddbb8d8510a24a69c09079282f8083ee94f4adc5d627176
4e99adbc172ae5f3d664308a109b0ad623f6f0fc869eb421b58c5e05578495bf
6139b3be04c747294d81f08f894fc44ca2099ebdd1233e715d05bd68f99199d7
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

outlook-update.hexat.com Open in urlscan Pro 54.36.158.42 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

6 Requests

17 %HTTPS

20 %IPv6

4 Domains

5 Subdomains

5 IPs

3 Countries

28 kBTransfer

38 kBSize

1 Cookies

2 Outgoing links

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

8 JavaScript Global Variables

1 Cookies

Indicators

outlook-update.hexat.com Open in urlscan Pro
54.36.158.42 Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

17 %
HTTPS

20 %
IPv6

4
Domains

5
Subdomains

5
IPs

3
Countries

28 kB
Transfer

38 kB
Size

1
Cookies

6 HTTP transactions
0 data transactions