aruler-channel.com
Open in
urlscan Pro
150.95.9.227
Malicious Activity!
Public Scan
Submitted URL: http://aruler-channel.com/wp-includes/js/tinymce/plugins/hr/xyz/login/index.php?email=victim@email.com
Effective URL: http://aruler-channel.com/wp-includes/js/tinymce/plugins/hr/xyz/login/page/index.php?src=DluZDluZHNmNDBlb2RzaDluZHNmNDDBlb...
Submission: On May 23 via manual from SG
Effective URL: http://aruler-channel.com/wp-includes/js/tinymce/plugins/hr/xyz/login/page/index.php?src=DluZDluZHNmNDBlb2RzaDluZHNmNDDBlb...
Submission: On May 23 via manual from SG
Summary
This website contacted 7 IPs
in 3 countries
across 6 domains to perform 9 HTTP transactions.
The main IP is 150.95.9.227, located in
Japan and
belongs to GMOOSK-NET GMO Internet,Inc, JP.
The main domain is aruler-channel.com.
This is the only time aruler-channel.com was scanned on urlscan.io!
This is the only time aruler-channel.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Email (Online)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 4 | 150.95.9.227 150.95.9.227 | 58791 (GMOOSK-NE...) (GMOOSK-NET GMO Internet) | |
| 1 | 192.229.133.221 192.229.133.221 | 15133 (EDGECAST) (EDGECAST - MCI Communications Services) | |
| 1 | 52.69.95.9 52.69.95.9 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
| 1 | 2a00:1450:400... 2a00:1450:4001:820::2004 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
| 1 1 | 204.74.99.100 204.74.99.100 | 12008 (ULTRADNS) (ULTRADNS - NeuStar) | |
| 1 2 | 68.178.213.60 68.178.213.60 | 26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com) | |
| 1 | 13.35.253.49 13.35.253.49 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
| 9 | 7 |
4
150.95.9.227
(Japan)
ASN58791 (GMOOSK-NET GMO Internet,Inc, JP)
PTR: s1007.xrea.com
ASN58791 (GMOOSK-NET GMO Internet,Inc, JP)
PTR: s1007.xrea.com
| aruler-channel.com |
1
192.229.133.221
(United States)
ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US)
ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US)
| www.w3schools.com |
1
52.69.95.9
(Tokyo, Japan)
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-69-95-9.ap-northeast-1.compute.amazonaws.com
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-69-95-9.ap-northeast-1.compute.amazonaws.com
| cache1.value-domain.com |
1
2a00:1450:4001:820::2004
(Frankfurt am Main, Germany)
ASN15169 (GOOGLE - Google LLC, US)
ASN15169 (GOOGLE - Google LLC, US)
| www.google.com |
1
204.74.99.100
(United States)
ASN12008 (ULTRADNS - NeuStar, Inc., US)
PTR: crs.ultradns.net
ASN12008 (ULTRADNS - NeuStar, Inc., US)
PTR: crs.ultradns.net
| mail.email.com |
2
68.178.213.60
(Scottsdale, United States)
ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US)
PTR: ip-68-178-213-60.ip.secureserver.net
ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US)
PTR: ip-68-178-213-60.ip.secureserver.net
| www.email.com |
1
13.35.253.49
(Seattle, United States)
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-13-35-253-49.fra6.r.cloudfront.net
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-13-35-253-49.fra6.r.cloudfront.net
| www.colorfulbox.jp |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 4 |
aruler-channel.com
1 redirects
aruler-channel.com |
4 KB |
| 3 |
email.com
2 redirects
mail.email.com www.email.com |
356 B |
| 1 |
colorfulbox.jp
www.colorfulbox.jp |
14 KB |
| 1 |
google.com
www.google.com |
1 KB |
| 1 |
value-domain.com
cache1.value-domain.com |
2 KB |
| 1 |
w3schools.com
www.w3schools.com |
5 KB |
| 9 | 6 |
| Domain | Requested by | |
|---|---|---|
| 4 | aruler-channel.com |
1 redirects
aruler-channel.com
|
| 2 | www.email.com |
1 redirects
aruler-channel.com
|
| 1 | www.colorfulbox.jp | |
| 1 | mail.email.com | 1 redirects |
| 1 | www.google.com |
aruler-channel.com
|
| 1 | cache1.value-domain.com |
aruler-channel.com
|
| 1 | www.w3schools.com |
aruler-channel.com
|
| 9 | 7 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| www.colorfulbox.jp |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| *.w3schools.com DigiCert SHA2 Secure Server CA |
2017-10-25 - 2020-05-05 |
3 years | crt.sh |
| www.google.com Google Internet Authority G3 |
2019-04-30 - 2019-07-23 |
3 months | crt.sh |
| *.colorfulbox.jp Amazon |
2018-06-21 - 2019-07-21 |
a year | crt.sh |
This page contains 2 frames:
Primary Page:
http://aruler-channel.com/wp-includes/js/tinymce/plugins/hr/xyz/login/page/index.php?src=DluZDluZHNmNDBlb2RzaDluZHNmNDDBlb2RzaTRpZWprMzBka2prZWtjamtkIGNuZmk0bmZpbTRpZWprMzBka2prZWtjamtkIGNuZmk0bmZpbHNmNDBlb2RzaTRDluZHNmNDBlb2RzaTRpZWprMzBka2prZWtjamtkIGNuZmk0bmZpbpZWprMzBka2prZWtjamtkIGNuZmk0bmZpbZWppZXdpb2U5NDluZHNmNDBlb2RzaTRpZWprMzBka2prZWtjamtkIGNuZmk0bmZpb25ja29uc2NrIGtjIGtqIHZqayBj&access=victim@email.com
Frame ID: 121CA4F79DC80D40A255FCD9C24CD967
Requests: 7 HTTP requests in this frame
Frame:
http://www.email.com/
Frame ID: 45F9447637B25C2D717A18C581AE2130
Requests: 2 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://aruler-channel.com/wp-includes/js/tinymce/plugins/hr/xyz/login/index.php?email=victim@email.com
HTTP 302
http://aruler-channel.com/wp-includes/js/tinymce/plugins/hr/xyz/login/page/index.php?src=DluZDluZHNmND... Page URL
Detected technologies
PHP
(Programming Languages)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- url /\.php(?:$|\?)/i
Apache
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
YUI
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- env /^YAHOO$/i
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
URL: https://www.colorfulbox.jp/?adref=xrea_ad&argument=DLHtsrgz&dmai=a5b5a809166ed7
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://aruler-channel.com/wp-includes/js/tinymce/plugins/hr/xyz/login/index.php?email=victim@email.com
HTTP 302
http://aruler-channel.com/wp-includes/js/tinymce/plugins/hr/xyz/login/page/index.php?src=DluZDluZHNmNDBlb2RzaDluZHNmNDDBlb2RzaTRpZWprMzBka2prZWtjamtkIGNuZmk0bmZpbTRpZWprMzBka2prZWtjamtkIGNuZmk0bmZpbHNmNDBlb2RzaTRDluZHNmNDBlb2RzaTRpZWprMzBka2prZWtjamtkIGNuZmk0bmZpbpZWprMzBka2prZWtjamtkIGNuZmk0bmZpbZWppZXdpb2U5NDluZHNmNDBlb2RzaTRpZWprMzBka2prZWtjamtkIGNuZmk0bmZpb25ja29uc2NrIGtjIGtqIHZqayBj&access=victim@email.com Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 6- http://mail.email.com/ HTTP 301
- http://www.email.com/ HTTP 302
- http://www.email.com/
9 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
 Cookie set
index.php
aruler-channel.com/wp-includes/js/tinymce/plugins/hr/xyz/login/page/ Redirect Chain
|
2 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
w3.css
www.w3schools.com/w3css/4/ |
23 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
design.css
aruler-channel.com/wp-includes/js/tinymce/plugins/hr/xyz/login/page/assets/css/ |
330 B 533 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
xrea_header.js
cache1.value-domain.com/ |
2 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
validate.js
aruler-channel.com/wp-includes/js/tinymce/plugins/hr/xyz/login/page/assets/js/ |
3 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
index.php
aruler-channel.com/wp-includes/js/tinymce/plugins/hr/xyz/login/page/ Frame 45F9 |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
favicons
www.google.com/s2/ |
492 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
Cookie set
/
www.email.com/ Frame 45F9 Redirect Chain
|
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
colorfulbox_bnr01.png
www.colorfulbox.jp/common/img/bnr/ |
13 KB 14 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- aruler-channel.com
- URL
- http://aruler-channel.com/wp-includes/js/tinymce/plugins/hr/xyz/login/page/index.php?src=DluZDluZHNmNDBlb2RzaDluZHNmNDDBlb2RzaTRpZWprMzBka2prZWtjamtkIGNuZmk0bmZpbTRpZWprMzBka2prZWtjamtkIGNuZmk0bmZpbHNmNDBlb2RzaTRDluZHNmNDBlb2RzaTRpZWprMzBka2prZWtjamtkIGNuZmk0bmZpbpZWprMzBka2prZWtjamtkIGNuZmk0bmZpbZWppZXdpb2U5NDluZHNmNDBlb2RzaTRpZWprMzBka2prZWtjamtkIGNuZmk0bmZpb25ja29uc2NrIGtjIGtqIHZqayBj&access=victim@email.com
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Email (Online)19 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask function| getUrlVars string| email string| domain string| provider string| locateFav string| aol string| cn21 string| yandex string| yahoo string| a163 string| sina string| mailru string| office string| godaddy string| gmail string| locate23 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| www.email.com/ | Name: _nm_ga_last_page_feed Value: AD |
|
| www.email.com/ | Name: _nm_ga_last_page Value: lander |
|
| .www.email.com/ | Name: date Value: 1558590618380 |
|
| .www.email.com/ | Name: java Value: No |
|
| .www.email.com/ | Name: brNum Value: 5.0%20%28X11%3B%20Linux%20x86_64%29%20AppleWebKit/537.36%20%28KHTML%2C%20like%20Gecko%29%20HeadlessChrome/74.0.3729.157%20Safari/537.36 |
|
| .www.email.com/ | Name: brVerId Value: 7 |
|
| .www.email.com/ | Name: platform Value: Linux%20x86_64 |
|
| www.email.com/ | Name: FeedProvider--email.com Value: Google |
|
| www.email.com/ | Name: Template--email.com Value: Simple2C |
|
| .www.email.com/ | Name: screen Value: 1600%201200 |
|
| .www.email.com/ | Name: brVer Value: Mozilla/5.0%20%28X11%3B%20Linux%20x86_64%29%20AppleWebKit/537.36%20%28KHTML%2C%20like%20Gecko%29%20HeadlessChrome/74.0.3729.157%20Safari/537.36 |
|
| www.email.com/ | Name: visitorxemail.com Value: 1 |
|
| aruler-channel.com/ | Name: PHPSESSID Value: o9kkesrord654q0bs20amf53u6 |
|
| www.email.com/ | Name: caf_ipaddr Value: 83.143.245.70 |
|
| .www.email.com/ | Name: navName Value: Netscape |
|
| www.email.com/ | Name: caf_referrer Value: http://aruler-channel.com/wp-includes/js/tinymce/plugins/hr/xyz/login/page/index.php?src=DluZDluZHNmNDBlb2RzaDluZHNmNDDBlb2RzaTRpZWprMzBka2prZWtjamtkIGNuZmk0bmZpbTRpZWprMzBka2prZWtjamtkIGNuZmk0bmZpbHNmNDBlb2RzaTRDluZHNmNDBlb2RzaTRpZWprMzBka2prZWtjamtkIGNuZmk0bmZpbpZWprMzBka2prZWtjamtkIGNuZmk0bmZpbZWppZXdpb2U5NDluZHNmNDBlb2RzaTRpZWprMzBka2prZWtjamtkIGNuZmk0bmZpb25ja29uc2NrIGtjIGtqIHZqayBj&access=victim@email.com |
|
| .www.email.com/ | Name: pv.email.com Value: 1 |
|
| www.email.com/ | Name: caf_last_page_url Value: http://www.email.com/ |
|
| www.email.com/ | Name: caf_geolocation Value: Germany |
|
| www.email.com/ | Name: caf_remotehost Value: 10.22.16.235 |
|
| www.email.com/ | Name: t Value: a4fd37e07d1e11e991e6fa163e44d115 |
|
| www.email.com/ | Name: referrer Value: http://aruler-channel.com/wp-includes/js/tinymce/plugins/hr/xyz/login/page/index.php?src=DluZDluZHNmNDBlb2RzaDluZHNmNDDBlb2RzaTRpZWprMzBka2prZWtjamtkIGNuZmk0bmZpbTRpZWprMzBka2prZWtjamtkIGNuZmk0bmZpbHNmNDBlb2RzaTRDluZHNmNDBlb2RzaTRpZWprMzBka2prZWtjamtkIGNuZmk0bmZpbpZWprMzBka2prZWtjamtkIGNuZmk0bmZpbZWppZXdpb2U5NDluZHNmNDBlb2RzaTRpZWprMzBka2prZWtjamtkIGNuZmk0bmZpb25ja29uc2NrIGtjIGtqIHZqayBj&access=victim@email.com |
|
| www.email.com/ | Name: COOKIE Value: 10.22.16.235.1558590618204600 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
aruler-channel.com
cache1.value-domain.com
mail.email.com
www.colorfulbox.jp
www.email.com
www.google.com
www.w3schools.com
aruler-channel.com
13.35.253.49
150.95.9.227
192.229.133.221
204.74.99.100
2a00:1450:4001:820::2004
52.69.95.9
68.178.213.60
0d62fc0a1291dde00cbf4f3e32efbfa941ec30b02be8f24c3e8676073bc59b11
2e30ff33270fd8687b0eb4d12652bfd967f23975f158bf8da93bece2ba4ab947
3caa97102ce1b55bd1b64da618f4be3d7fbe654d653540826c0f4026b23273ec
76a21d0234aa0522e9a63b8706f5d54152a32a3abdf37d56a49df4a79f9672e5
8a1666209ffc8b3e5398352fe43683713e97960b4fba25049726cc49fec486e2
d1b4f54ddb1ddbb4932bdc896bedf651ca3e163bcad06d859ec38269fec6959b
d35a1ab30d065cb8a0a0274c1b8a8b6140685228f14da41e53d7cfb4782ab531