xplainit.dk - urlscan.io

Summary

This website contacted 2 IPs in 3 countries across 3 domains to perform 7 HTTP transactions. The main IP is 142.93.106.4, located in Frankfurt am Main, Germany and belongs to DIGITALOCEAN-ASN, US. The main domain is xplainit.dk.
TLS certificate: Issued by Let's Encrypt Authority X3 on March 21st 2020. Valid for: 3 months.

This is the only time xplainit.dk was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
1 1	51.81.135.80 51.81.135.80	16276 (OVH) (OVH)
1 7	142.93.106.4 142.93.106.4	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
1	2.20.143.58 2.20.143.58	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
7	2

1 51.81.135.80 (United States) 1 redirects

ASN16276 (OVH, FR)
PTR: ip80.ip-51-81-135.us

web1.anushit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 142.93.106.4 (Frankfurt am Main, Germany) 1 redirects

ASN14061 (DIGITALOCEAN-ASN, US)
PTR: mail2.xplainit.dk

xplainit.dk	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.20.143.58 (Ascension Island)

ASN20940 (AKAMAI-ASN1, EU)
PTR: a2-20-143-58.deploy.static.akamaitechnologies.com

aadcdn.msftauthimages.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	xplainit.dk 1 redirects xplainit.dk	392 KB
1	msftauthimages.net aadcdn.msftauthimages.net	5 KB
1	anushit.com 1 redirects web1.anushit.com	408 B
7	3

	Domain	Requested by
7	xplainit.dk	1 redirects xplainit.dk
1	aadcdn.msftauthimages.net	xplainit.dk
1	web1.anushit.com	1 redirects
7	3

This site contains no links.

Subject Issuer	Validity	Valid
www.xplainit.dk Let's Encrypt Authority X3	`2020-03-21` - `2020-06-19`	3 months	crt.sh
aadcdn.msftauthimages.net Microsoft IT TLS CA 5	`2018-11-29` - `2020-11-29`	2 years	crt.sh

This page contains 1 frames:

Primary Page: https://xplainit.dk/outlook.office365/?ss=2&ea=bcherif@euronext.com&session=cb1c00943b36cbb959bf4f095bcb4f46cb1c00943b36cbb959bf4f095bcb4f46
Frame ID: E906DC8134AA45295001452533A1017B
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://web1.anushit.com/outlook.php/YmNoZXJpZkBldXJvbmV4dC5jb20= HTTP 302
https://xplainit.dk/outlook.office365?ss=2&ea=bcherif@euronext.com&session=cb1c00943b36cbb959bf4... HTTP 301
https://xplainit.dk/outlook.office365/?ss=2&ea=bcherif@euronext.com&session=cb1c00943b36cbb959bf... Page URL

Detected technologies

UNIX (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /Unix/i

OpenSSL (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

7
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

2
IPs

3
Countries

397 kB
Transfer

395 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://web1.anushit.com/outlook.php/YmNoZXJpZkBldXJvbmV4dC5jb20= HTTP 302
https://xplainit.dk/outlook.office365?ss=2&ea=bcherif@euronext.com&session=cb1c00943b36cbb959bf4f095bcb4f46cb1c00943b36cbb959bf4f095bcb4f46 HTTP 301
https://xplainit.dk/outlook.office365/?ss=2&ea=bcherif@euronext.com&session=cb1c00943b36cbb959bf4f095bcb4f46cb1c00943b36cbb959bf4f095bcb4f46 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request

Cookie set / Show response
xplainit.dk/outlook.office365/
Redirect Chain

https://web1.anushit.com/outlook.php/YmNoZXJpZkBldXJvbmV4dC5jb20=
https://xplainit.dk/outlook.office365?ss=2&ea=bcherif@euronext.com&session=cb1c00943b36cbb959bf4f095bcb4f46cb1c00943b36cbb959bf4f095bcb4f46
https://xplainit.dk/outlook.office365/?ss=2&ea=bcherif@euronext.com&session=cb1c00943b36cbb959bf4f095bcb4f46cb1c00943b36cbb959bf4f095bcb4f46

9 KB
10 KB

999ms
998ms

Document
text/html

142.93.106.4
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://xplainit.dk/outlook.office365/?ss=2&ea=bcherif@euronext.com&session=cb1c00943b36cbb959bf4f095bcb4f46cb1c00943b36cbb959bf4f095bcb4f46
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 142.93.106.4 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: mail2.xplainit.dk
Software: Apache/2.4.39 (Unix) OpenSSL/1.0.2k-fips / PHP/7.3.15
Resource Hash: 59c0c7e5c6c468a343f9f4da99d8f0a569365c5f0a514705da9418595f54acfe

Request headers

Host: xplainit.dk
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 20 May 2020 12:47:21 GMT
Server: Apache/2.4.39 (Unix) OpenSSL/1.0.2k-fips
X-Powered-By: PHP/7.3.15
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Set-Cookie: PHPSESSID=6eec4159e8e84b856ee512fe6a9ad9fd; path=/
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

Redirect headers

Date: Wed, 20 May 2020 12:47:21 GMT
Server: Apache/2.4.39 (Unix) OpenSSL/1.0.2k-fips
Location: https://xplainit.dk/outlook.office365/?ss=2&ea=bcherif@euronext.com&session=cb1c00943b36cbb959bf4f095bcb4f46cb1c00943b36cbb959bf4f095bcb4f46
Content-Length: 356
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 200
OK Converged1033.css
xplainit.dk/outlook.office365/files2/ 86 KB
86 KB 12ms
11ms Stylesheet
text/css 142.93.106.4
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://xplainit.dk/outlook.office365/files2/Converged1033.css
Requested by: Host: xplainit.dk
URL: https://xplainit.dk/outlook.office365/?ss=2&ea=bcherif@euronext.com&session=cb1c00943b36cbb959bf4f095bcb4f46cb1c00943b36cbb959bf4f095bcb4f46
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 142.93.106.4 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: mail2.xplainit.dk
Software: Apache/2.4.39 (Unix) OpenSSL/1.0.2k-fips /
Resource Hash: 4ab7658cf047ebb6d8ca59ad1c66a3dc4edf94b2b26ff98e2525fc57320de69c

Request headers

Referer: https://xplainit.dk/outlook.office365/?ss=2&ea=bcherif@euronext.com&session=cb1c00943b36cbb959bf4f095bcb4f46cb1c00943b36cbb959bf4f095bcb4f46
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 20 May 2020 12:47:22 GMT
Last-Modified: Wed, 20 May 2020 07:19:36 GMT
Server: Apache/2.4.39 (Unix) OpenSSL/1.0.2k-fips
ETag: "1564c-5a60f37f36619"
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 87628

GET
H/1.1 200
OK load2.gif
xplainit.dk/outlook.office365/files/ 3 KB
3 KB 29ms
14ms Image
image/gif 142.93.106.4
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://xplainit.dk/outlook.office365/files/load2.gif
Requested by: Host: xplainit.dk
URL: https://xplainit.dk/outlook.office365/?ss=2&ea=bcherif@euronext.com&session=cb1c00943b36cbb959bf4f095bcb4f46cb1c00943b36cbb959bf4f095bcb4f46
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 142.93.106.4 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: mail2.xplainit.dk
Software: Apache/2.4.39 (Unix) OpenSSL/1.0.2k-fips /
Resource Hash: a46201581a7c7c667fd42787cd1e9adf2f6bf809efb7596e61a03e8dba9ada13

Request headers

Referer: https://xplainit.dk/outlook.office365/?ss=2&ea=bcherif@euronext.com&session=cb1c00943b36cbb959bf4f095bcb4f46cb1c00943b36cbb959bf4f095bcb4f46
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 20 May 2020 12:47:22 GMT
Last-Modified: Wed, 20 May 2020 07:19:36 GMT
Server: Apache/2.4.39 (Unix) OpenSSL/1.0.2k-fips
ETag: "a70-5a60f37f35679"
Content-Type: image/gif
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 2672

GET
H2 200 bannerlogo
aadcdn.msftauthimages.net/c1c6b6c8-xdlwtjdrmuc8oapl-priy7xtu8-765-819loevpnzg8/logintenantbranding/0/ 5 KB
5 KB 155ms
71ms Image
image/* 2.20.143.58
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://aadcdn.msftauthimages.net/c1c6b6c8-xdlwtjdrmuc8oapl-priy7xtu8-765-819loevpnzg8/logintenantbranding/0/bannerlogo?ts=636988009225420719

Requested by

Host: xplainit.dk
URL: https://xplainit.dk/outlook.office365/?ss=2&ea=bcherif@euronext.com&session=cb1c00943b36cbb959bf4f095bcb4f46cb1c00943b36cbb959bf4f095bcb4f46

Protocol

H2

Security

TLS 1.3, , AES_256_GCM

Server

2.20.143.58 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a2-20-143-58.deploy.static.akamaitechnologies.com

Software

/

Resource Hash

b50a8cf694fdf06e6ddf78256cf17850f0fa272acae2bc490d7c035aec9fcbe0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://xplainit.dk/outlook.office365/?ss=2&ea=bcherif@euronext.com&session=cb1c00943b36cbb959bf4f095bcb4f46cb1c00943b36cbb959bf4f095bcb4f46
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 20 May 2020 12:47:22 GMT
last-modified: Mon, 15 Jul 2019 15:22:02 GMT
content-md5: ILutyb8nBDehoPtj+OH7jQ==
strict-transport-security: max-age=31536000
content-type: image/*
status: 200
cache-control: public, max-age=86400
content-length: 5313

GET
H/1.1 200
OK arrow_left.png
xplainit.dk/outlook.office365/files/ 240 B
542 B 24ms
10ms Image
image/png 142.93.106.4
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://xplainit.dk/outlook.office365/files/arrow_left.png
Requested by: Host: xplainit.dk
URL: https://xplainit.dk/outlook.office365/?ss=2&ea=bcherif@euronext.com&session=cb1c00943b36cbb959bf4f095bcb4f46cb1c00943b36cbb959bf4f095bcb4f46
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 142.93.106.4 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: mail2.xplainit.dk
Software: Apache/2.4.39 (Unix) OpenSSL/1.0.2k-fips /
Resource Hash: ab50358475adae73a435466c72d1a48ab124e8ae06614663716a46dce5ac8b83

Request headers

Referer: https://xplainit.dk/outlook.office365/?ss=2&ea=bcherif@euronext.com&session=cb1c00943b36cbb959bf4f095bcb4f46cb1c00943b36cbb959bf4f095bcb4f46
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 20 May 2020 12:47:22 GMT
Last-Modified: Wed, 20 May 2020 07:19:36 GMT
Server: Apache/2.4.39 (Unix) OpenSSL/1.0.2k-fips
ETag: "f0-5a60f37f34ea9"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 240

GET
H/1.1 200
OK 0-small.jpg
xplainit.dk/outlook.office365/files2/ 1 KB
1 KB 9ms
8ms Image
image/jpeg 142.93.106.4
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://xplainit.dk/outlook.office365/files2/0-small.jpg
Requested by: Host: xplainit.dk
URL: https://xplainit.dk/outlook.office365/?ss=2&ea=bcherif@euronext.com&session=cb1c00943b36cbb959bf4f095bcb4f46cb1c00943b36cbb959bf4f095bcb4f46
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 142.93.106.4 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: mail2.xplainit.dk
Software: Apache/2.4.39 (Unix) OpenSSL/1.0.2k-fips /
Resource Hash: c13db279143e1845ee4aaee5afedc5bd75e9f7d50024b63883b45332c4960b3b

Request headers

Referer: https://xplainit.dk/outlook.office365/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 20 May 2020 12:47:22 GMT
Last-Modified: Wed, 20 May 2020 07:19:36 GMT
Server: Apache/2.4.39 (Unix) OpenSSL/1.0.2k-fips
ETag: "405-5a60f37f35679"
Content-Type: image/jpeg
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 1029

GET
H/1.1 200
OK 0.jpg
xplainit.dk/outlook.office365/files/ 291 KB
291 KB 11ms
11ms Image
image/jpeg 142.93.106.4
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://xplainit.dk/outlook.office365/files/0.jpg
Requested by: Host: xplainit.dk
URL: https://xplainit.dk/outlook.office365/?ss=2&ea=bcherif@euronext.com&session=cb1c00943b36cbb959bf4f095bcb4f46cb1c00943b36cbb959bf4f095bcb4f46
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 142.93.106.4 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: mail2.xplainit.dk
Software: Apache/2.4.39 (Unix) OpenSSL/1.0.2k-fips /
Resource Hash: 62faab60433070e2ea52c235f0f18db228759f2a08bb6f9e5711630df8321214

Request headers

Referer: https://xplainit.dk/outlook.office365/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 20 May 2020 12:47:22 GMT
Last-Modified: Wed, 20 May 2020 07:19:36 GMT
Server: Apache/2.4.39 (Unix) OpenSSL/1.0.2k-fips
ETag: "48c79-5a60f37f34ea9"
Content-Type: image/jpeg
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 298105

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aadcdn.msftauthimages.net
web1.anushit.com
xplainit.dk
142.93.106.4
2.20.143.58
51.81.135.80
4ab7658cf047ebb6d8ca59ad1c66a3dc4edf94b2b26ff98e2525fc57320de69c
59c0c7e5c6c468a343f9f4da99d8f0a569365c5f0a514705da9418595f54acfe
62faab60433070e2ea52c235f0f18db228759f2a08bb6f9e5711630df8321214
a46201581a7c7c667fd42787cd1e9adf2f6bf809efb7596e61a03e8dba9ada13
ab50358475adae73a435466c72d1a48ab124e8ae06614663716a46dce5ac8b83
b50a8cf694fdf06e6ddf78256cf17850f0fa272acae2bc490d7c035aec9fcbe0
c13db279143e1845ee4aaee5afedc5bd75e9f7d50024b63883b45332c4960b3b

xplainit.dk Open in urlscan Pro 142.93.106.4 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

7 Requests

100 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

2 IPs

3 Countries

397 kBTransfer

395 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

7 JavaScript Global Variables

0 Cookies

Indicators

xplainit.dk Open in urlscan Pro
142.93.106.4 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

7
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

2
IPs

3
Countries

397 kB
Transfer

395 kB
Size

0
Cookies

7 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!