outlookserver.hexat.com Open in urlscan Pro
54.36.158.41  Malicious Activity! Public Scan

1 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

15 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request Cookie set index Show response outlookserver.hexat.com/	21 KB 6 KB	2699ms 1436ms	Document text/html	54.36.158.41 OVH
General Check archive.org Show headers Download Go to Full URL http://outlookserver.hexat.com/index Protocol HTTP/1.1 Server 54.36.158.41 , France, ASN16276 (OVH, FR), Reverse DNS lb.xtgem.com Software / Resource Hash 4402748ff3bc2e6d8247dd5676c1a20d1a0fb4971d9ddbe0dd0905ac52d25864 Request headers Host outlookserver.hexat.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3 Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Thu, 27 Jun 2019 15:55:36 GMT Vary Host,Accept-Encoding Set-Cookie _xta_uid=c23adbf26fdced01c1949bff9b4eb89d; expires=Sat, 26-Jun-2021 15:55:37 GMT; Max-Age=63072000; path=/; domain=.hexat.com; httponly _xta_vid=3082a3517851a8d47e332acdfda442ef-1561650938; expires=Thu, 27-Jun-2019 16:25:38 GMT; Max-Age=1800; path=/; domain=.hexat.com; httponly Cache-Control private, no-cache, no-cache=Set-Cookie, proxy-revalidate Pragma no-cache Expires Wed, 17 Sep 1975 21:32:10 GMT Content-Encoding gzip Content-Length 5816 Content-Type text/html; charset=utf-8 X-App-Server bk-xtgem/w4 Age 0 X-Cache MISS X-Cache-Hits 0 Accept-Ranges bytes Connection close
GET H/1.1	200 OK	logon.css outlook.rch.org.au/owa/auth/15.0.847/themes/resources/	10 KB 10 KB	3099ms 633ms	Stylesheet text/css	203.16.41.161 UNIMELB-AS-AP The...
General Check archive.org Show headers Download Go to Full URL https://outlook.rch.org.au/owa/auth/15.0.847/themes/resources/logon.css Requested by Host: outlookserver.hexat.com URL: http://outlookserver.hexat.com/index Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_CBC Server 203.16.41.161 , Australia, ASN10148 (UNIMELB-AS-AP The University of Melbourne, Melbourne, Victoria, AU), Reverse DNS Software Microsoft-IIS/8.5 / ASP.NET Resource Hash 3c56a7d6987506e5f6717b38a93d8eef986cc2ffb9b590cb393e1310972d91cc Request headers Referer http://outlookserver.hexat.com/index User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Thu, 27 Jun 2019 15:55:40 GMT ETag "050875422ecf1:0" Last-Modified Thu, 20 Feb 2014 06:09:36 GMT Server Microsoft-IIS/8.5 X-Powered-By ASP.NET Content-Type text/css Cache-Control public,max-age=2592000 Accept-Ranges bytes request-id 1f5ac4a6-b6b4-464d-ad80-0b5bb9e007f5 Content-Length 10174
GET H/1.1	200 OK	flogon.js Show response outlook.rch.org.au/owa/auth/15.0.847/scripts/premium/	15 KB 15 KB	3423ms 324ms	Script application/javascript	203.16.41.161 UNIMELB-AS-AP The...
General Check archive.org Show headers Download Go to Full URL https://outlook.rch.org.au/owa/auth/15.0.847/scripts/premium/flogon.js Requested by Host: outlookserver.hexat.com URL: http://outlookserver.hexat.com/index Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_CBC Server 203.16.41.161 , Australia, ASN10148 (UNIMELB-AS-AP The University of Melbourne, Melbourne, Victoria, AU), Reverse DNS Software Microsoft-IIS/8.5 / ASP.NET Resource Hash 19c90326f386496efc6fa59724f5cbd579c069c3cbfdab55dcb2ddad541e65dd Request headers Referer http://outlookserver.hexat.com/index User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Thu, 27 Jun 2019 15:55:40 GMT ETag "050875422ecf1:0" Last-Modified Thu, 20 Feb 2014 06:09:36 GMT Server Microsoft-IIS/8.5 X-Powered-By ASP.NET Content-Type application/javascript Cache-Control public,max-age=2592000 Accept-Ranges bytes request-id 66e8a6fd-7c09-4abd-825c-828b6ee1eb87 Content-Length 15416
GET H/1.1	200 OK	olk_logo_white.png outlook.rch.org.au/owa/auth/15.0.847/themes/resources/	2 KB 3 KB	3740ms 316ms	Image image/png	203.16.41.161 UNIMELB-AS-AP The...
General Check archive.org Show headers Download Go to Show image Full URL https://outlook.rch.org.au/owa/auth/15.0.847/themes/resources/olk_logo_white.png Requested by Host: outlookserver.hexat.com URL: http://outlookserver.hexat.com/index Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_CBC Server 203.16.41.161 , Australia, ASN10148 (UNIMELB-AS-AP The University of Melbourne, Melbourne, Victoria, AU), Reverse DNS Software Microsoft-IIS/8.5 / ASP.NET Resource Hash d9ed6586942003696afe4e52b09f343f8342244b51a9e175b75162d7e615207b Request headers Referer http://outlookserver.hexat.com/index User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Thu, 27 Jun 2019 15:55:42 GMT ETag "050875422ecf1:0" Last-Modified Thu, 20 Feb 2014 06:09:36 GMT Server Microsoft-IIS/8.5 X-Powered-By ASP.NET Content-Type image/png Cache-Control public,max-age=2592000 Accept-Ranges bytes request-id 84268540-976d-478d-95d4-c4401cd9135b Content-Length 2503
GET H/1.1	200 OK	olk_logo_white_small.png outlook.rch.org.au/owa/auth/15.0.847/themes/resources/	4 KB 4 KB	4069ms 328ms	Image image/png	203.16.41.161 UNIMELB-AS-AP The...
General Check archive.org Show headers Download Go to Show image Full URL https://outlook.rch.org.au/owa/auth/15.0.847/themes/resources/olk_logo_white_small.png Requested by Host: outlookserver.hexat.com URL: http://outlookserver.hexat.com/index Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_CBC Server 203.16.41.161 , Australia, ASN10148 (UNIMELB-AS-AP The University of Melbourne, Melbourne, Victoria, AU), Reverse DNS Software Microsoft-IIS/8.5 / ASP.NET Resource Hash 4de8fc175826d9f78fce9f9f2b71a63fe832fc7507e0394125c823b0909fa54a Request headers Referer http://outlookserver.hexat.com/index User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Thu, 27 Jun 2019 15:55:42 GMT ETag "050875422ecf1:0" Last-Modified Thu, 20 Feb 2014 06:09:36 GMT Server Microsoft-IIS/8.5 X-Powered-By ASP.NET Content-Type image/png Cache-Control public,max-age=2592000 Accept-Ranges bytes request-id 1f87ef81-5f2a-455a-b2db-c63ec9bf7942 Content-Length 3595
GET H/1.1	200 OK	owa_text_blue.png outlook.rch.org.au/owa/auth/15.0.847/themes/resources/	6 KB 6 KB	1243ms 623ms	Image image/png	203.16.41.161 UNIMELB-AS-AP The...
General Check archive.org Show headers Download Go to Show image Full URL https://outlook.rch.org.au/owa/auth/15.0.847/themes/resources/owa_text_blue.png Requested by Host: outlookserver.hexat.com URL: http://outlookserver.hexat.com/index Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_CBC Server 203.16.41.161 , Australia, ASN10148 (UNIMELB-AS-AP The University of Melbourne, Melbourne, Victoria, AU), Reverse DNS Software Microsoft-IIS/8.5 / ASP.NET Resource Hash 6bd745cac7dd2e979f9e89dcd3c1ed3058812be0c88a06fc066360f74120b717 Request headers Referer http://outlookserver.hexat.com/index User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Thu, 27 Jun 2019 15:55:42 GMT ETag "050875422ecf1:0" Last-Modified Thu, 20 Feb 2014 06:09:36 GMT Server Microsoft-IIS/8.5 X-Powered-By ASP.NET Content-Type image/png Cache-Control public,max-age=2592000 Accept-Ranges bytes request-id f393c741-7866-4502-95c2-40789212722a Content-Length 5856
GET H/1.1	200 OK	Sign_in_arrow.png outlook.rch.org.au/owa/auth/15.0.847/themes/resources/	1 KB 2 KB	963ms 320ms	Image image/png	203.16.41.161 UNIMELB-AS-AP The...
General Check archive.org Show headers Download Go to Show image Full URL https://outlook.rch.org.au/owa/auth/15.0.847/themes/resources/Sign_in_arrow.png Requested by Host: outlookserver.hexat.com URL: http://outlookserver.hexat.com/index Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_CBC Server 203.16.41.161 , Australia, ASN10148 (UNIMELB-AS-AP The University of Melbourne, Melbourne, Victoria, AU), Reverse DNS Software Microsoft-IIS/8.5 / ASP.NET Resource Hash 07f38b8b8c1f96ed85ecd96988f0454a95d1f665427086a507c72e55ff3ce0e7 Request headers Referer http://outlookserver.hexat.com/index User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Thu, 27 Jun 2019 15:55:42 GMT ETag "050875422ecf1:0" Last-Modified Thu, 20 Feb 2014 06:09:36 GMT Server Microsoft-IIS/8.5 X-Powered-By ASP.NET Content-Type image/png Cache-Control public,max-age=2592000 Accept-Ranges bytes request-id 1845c522-7b83-4b3c-a9bb-ce252648ff1c Content-Length 1441
GET		xtgem-forums.jpg xtgem.com/images/forum/	0 0
GET		quant.js edge.quantserve.com/	0 0
GET		tp.gif enif.images.xtstatic.com/ Frame C20B	0 0
GET		tp.gif cif.images.xtstatic.com/ Frame 9BF6	0 0
GET H/1.1	404 Not Found	bg_gradient_login.png outlookserver.hexat.com/owa/auth/15.0.847/themes/resources/	1 KB 1 KB	1037ms 23ms	Image text/html	54.36.158.41 OVH
General Check archive.org Show headers Download Go to Show image Full URL http://outlookserver.hexat.com/owa/auth/15.0.847/themes/resources/bg_gradient_login.png Requested by Host: outlookserver.hexat.com URL: http://outlookserver.hexat.com/index Protocol HTTP/1.1 Security , , Server 54.36.158.41 , France, ASN16276 (OVH, FR), Reverse DNS lb.xtgem.com Software / Resource Hash fc0d7caa36e3501250c6adf0446ec8171304a33792ab430d24b0915b9bd179a1 Request headers Referer http://outlookserver.hexat.com/index User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Thu, 27 Jun 2019 15:55:39 GMT X-Ngz 1 Age 2 X-Cache HIT Content-Type text/html; charset=UTF-8 Connection close X-App-Server bk-xtgem/w3 Content-Length 1311 X-Cache-Hits 1
GET		segoeui-regular.ttf outlook.rch.org.au/owa/auth/15.0.847/themes/resources/	0 0
GET		__xt_authbar xtgem.com/ Frame 70DD	0 0
GET		close2.png xtgem.com/images/	0 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

xtgem.com

URL

http://xtgem.com/images/forum/xtgem-forums.jpg

Domain

edge.quantserve.com

URL

http://edge.quantserve.com/quant.js

Domain

enif.images.xtstatic.com

URL

http://enif.images.xtstatic.com/tp.gif

Domain

cif.images.xtstatic.com

URL

http://cif.images.xtstatic.com/tp.gif

Domain

outlook.rch.org.au

URL

https://outlook.rch.org.au/owa/auth/15.0.847/themes/resources/segoeui-regular.ttf

Domain

xtgem.com

URL

http://xtgem.com/__xt_authbar?data=eyJ1cmwiOiJodHRwOlwvXC9vdXRsb29rc2VydmVyLmhleGF0LmNvbVwvaW5kZXgiLCJsb2dnZWRfaW4iOmZhbHNlLCJkb21haW4iOiJvdXRsb29rc2VydmVyLmhleGF0LmNvbSIsInBvc2l0aW9uIjp7ImFic29sdXRlIjoiZml4ZWQifX0=

Domain

xtgem.com

URL

http://xtgem.com/images/close2.png?v=0.01

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Outlook Web Access (Online)

37 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask function| initLogon function| redir function| shw function| hd function| clkExp function| clkSecExp function| kdSecExp function| clkSec function| clkBsc function| checkSubmit function| clkLgn function| clkRtry function| clkReLgn function| gbid function| IsOwaPremiumBrowser function| hres function| LogoffMime function| addPerfMarker number| a_fRC number| g_fFcs number| a_fLOff number| a_fCAC number| a_fEnbSMm function| IsMimeCtlInst function| RndMimeCtl function| RndMimeCtlHlpr object| mainLogonDiv boolean| showPlaceholderText string| mainLogonDivClassName function| setPlaceholderText function| showPasswordClick object| _qevents boolean| cookies number| len

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cif.images.xtstatic.com
edge.quantserve.com
enif.images.xtstatic.com
outlook.rch.org.au
outlookserver.hexat.com
xtgem.com
cif.images.xtstatic.com
edge.quantserve.com
enif.images.xtstatic.com
outlook.rch.org.au
xtgem.com
203.16.41.161
54.36.158.41
07f38b8b8c1f96ed85ecd96988f0454a95d1f665427086a507c72e55ff3ce0e7
19c90326f386496efc6fa59724f5cbd579c069c3cbfdab55dcb2ddad541e65dd
3c56a7d6987506e5f6717b38a93d8eef986cc2ffb9b590cb393e1310972d91cc
4402748ff3bc2e6d8247dd5676c1a20d1a0fb4971d9ddbe0dd0905ac52d25864
4de8fc175826d9f78fce9f9f2b71a63fe832fc7507e0394125c823b0909fa54a
6bd745cac7dd2e979f9e89dcd3c1ed3058812be0c88a06fc066360f74120b717
d9ed6586942003696afe4e52b09f343f8342244b51a9e175b75162d7e615207b
fc0d7caa36e3501250c6adf0446ec8171304a33792ab430d24b0915b9bd179a1