venongg.sa.com Open in urlscan Pro
107.182.128.31  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request cssl.htm Show response venongg.sa.com/urssl/mxaruba.it_arubauser.MsG.fix_receptionErrorMSG_aruba.user.SignIn.MyAccount/mailbox.aruba.id/	32 KB 33 KB	431ms 93ms	Document text/html	107.182.128.31 AS-SERVERION
General Check archive.org Show headers Download Go to Full URL https://venongg.sa.com/urssl/mxaruba.it_arubauser.MsG.fix_receptionErrorMSG_aruba.user.SignIn.MyAccount/mailbox.aruba.id/cssl.htm Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 107.182.128.31 Dallas, United States, ASN399471 (AS-SERVERION, US), Reverse DNS Software Apache / Resource Hash e5e5d3b542435359869434a4abff90a6a20d8cb721e8c7371dba912b304d907e Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Response headers Accept-Ranges bytes Connection Keep-Alive Content-Length 33038 Content-Type text/html Date Thu, 14 Nov 2024 16:41:03 GMT Keep-Alive timeout=5, max=100 Last-Modified Thu, 14 Nov 2024 09:24:25 GMT Server Apache
GET H2	200	SCSPzi4.png i.imgur.com/	2 KB 2 KB	313ms 24ms	Image image/png	199.232.192.193 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://i.imgur.com/SCSPzi4.png Requested by Host: venongg.sa.com URL: https://venongg.sa.com/urssl/mxaruba.it_arubauser.MsG.fix_receptionErrorMSG_aruba.user.SignIn.MyAccount/mailbox.aruba.id/cssl.htm Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 199.232.192.193 , United States, ASN54113 (FASTLY, US), Reverse DNS Software cat factory 1.0 / Resource Hash 3b7a295f7a4bab99ddaedb9798544a95e579a4efce4b3170c936f240026cca32 Security Headers Name Value Strict-Transport-Security max-age=300 X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://venongg.sa.com/ Response headers etag "55c93dd10c32a4bbb55b9db8028780ca" age 805871 access-control-allow-methods GET, OPTIONS x-content-type-options nosniff x-cache Miss from cloudfront, HIT, HIT x-amz-cf-id lBeNO1luRIUW1MTdVEG9oFUcKytRmW_QAel38ui0ACh2IhS8m-6IZA== date Thu, 14 Nov 2024 16:41:04 GMT content-type image/png last-modified Wed, 17 Jan 2024 17:34:39 GMT x-cache-hits 8, 0 x-served-by cache-iad-kiad7000162-IAD, cache-fra-eddf8230044-FRA strict-transport-security max-age=300 cache-control public, max-age=31536000 x-timer S1731602464.431836,VS0,VE2 accept-ranges bytes access-control-allow-origin * content-length 1906 x-amz-cf-pop IAD89-P1 server cat factory 1.0 x-amz-server-side-encryption AES256
GET H2	200	l8EQonT.png i.imgur.com/	257 KB 258 KB	300ms 11ms	Image image/png	199.232.192.193 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://i.imgur.com/l8EQonT.png Requested by Host: venongg.sa.com URL: https://venongg.sa.com/urssl/mxaruba.it_arubauser.MsG.fix_receptionErrorMSG_aruba.user.SignIn.MyAccount/mailbox.aruba.id/cssl.htm Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 199.232.192.193 , United States, ASN54113 (FASTLY, US), Reverse DNS Software cat factory 1.0 / Resource Hash effc5e1c24bed120cb6764f5dff8bfbf2fbbbe94b96d7e6ff538b0730a16c1b3 Security Headers Name Value Strict-Transport-Security max-age=300 X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://venongg.sa.com/ Response headers etag "2afa338f6f65e824e142ac635b549245" age 29412 access-control-allow-methods GET, OPTIONS x-content-type-options nosniff x-cache Miss from cloudfront, HIT, HIT x-amz-cf-id 0P8gLGuq9uL7PdDPBFhBECv3SIqJ4yMoocBWv6q6VBy3Ular04YU5g== date Thu, 14 Nov 2024 16:41:04 GMT content-type image/png last-modified Thu, 14 Nov 2024 08:30:52 GMT x-cache-hits 16, 0 x-served-by cache-iad-kjyo7100075-IAD, cache-fra-eddf8230044-FRA strict-transport-security max-age=300 cache-control public, max-age=31536000 x-timer S1731602464.430795,VS0,VE2 accept-ranges bytes access-control-allow-origin * content-length 263138 x-amz-cf-pop MIA50-P3 server cat factory 1.0 x-amz-server-side-encryption AES256
GET H2	200	20hdBFK.png i.imgur.com/	609 B 833 B	9ms 9ms	Other image/png	199.232.192.193 FASTLY
General Check archive.org Show headers Download Go to Full URL https://i.imgur.com/20hdBFK.png Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 199.232.192.193 , United States, ASN54113 (FASTLY, US), Reverse DNS Software cat factory 1.0 / Resource Hash ca8abfd1e71a10c486a26be86954293c5f62e1ff94ac52f9270a41c285243c5a Security Headers Name Value Strict-Transport-Security max-age=300 X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://venongg.sa.com/ Response headers etag "0ecb135733886ee9f5b6b3fb54baa6cf" age 1849439 access-control-allow-methods GET, OPTIONS x-content-type-options nosniff x-cache Miss from cloudfront, HIT, HIT x-amz-cf-id 6R1PkyZNdO9TdZsUY7Jxev3S9DIyDy2BtA2Zr3K5NKTMqi17oY4xPg== date Thu, 14 Nov 2024 16:41:04 GMT content-type image/png last-modified Tue, 31 May 2022 07:42:56 GMT x-cache-hits 86, 0 x-served-by cache-iad-kiad7000120-IAD, cache-fra-eddf8230044-FRA strict-transport-security max-age=300 cache-control public, max-age=31536000 x-timer S1731602464.476674,VS0,VE2 accept-ranges bytes access-control-allow-origin * content-length 609 x-amz-cf-pop JFK50-P6 server cat factory 1.0

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Aruba (Online)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| _A50H35mL12qk99eWjM12SQ049X1R4ejpfo function| _QTW7v07E7O88q9h34lb8s995Gkyp1qUk0c1B3e75Bz object| _$ object| _V77u0W95chN2s6C2VUJ84CW9S number| _D0S246T0881I4cS3K907pW5iY75jOeEZnYTC8xOgKjw334F object| _WB0KDTM76i2UD0zV3VK object| _Lm10XZapTpHikci0EGx1Hbug8RKH0Ok48yXJRYdb object| _YuYfU6W7jGd081eXnOuti4t1NY

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	verbose	URL: https://venongg.sa.com/urssl/mxaruba.it_arubauser.MsG.fix_receptionErrorMSG_aruba.user.SignIn.MyAccount/mailbox.aruba.id/cssl.htm Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

i.imgur.com
venongg.sa.com
107.182.128.31
199.232.192.193
3b7a295f7a4bab99ddaedb9798544a95e579a4efce4b3170c936f240026cca32
ca8abfd1e71a10c486a26be86954293c5f62e1ff94ac52f9270a41c285243c5a
e5e5d3b542435359869434a4abff90a6a20d8cb721e8c7371dba912b304d907e
effc5e1c24bed120cb6764f5dff8bfbf2fbbbe94b96d7e6ff538b0730a16c1b3