managehosting144202b3-aruba.zukunst.at
Open in
urlscan Pro
172.171.241.51
Malicious Activity!
Public Scan
Effective URL: https://managehosting144202b3-aruba.zukunst.at/login.php?TTDxV8CJ2u7PoG1j5jPQPU4sjXIaZvW8ZvrP1k65JGtt05T5kyoyNwvwJ8WvP9s7NYTipExsW9rKLqSceCRzM6...
Submission: On September 17 via api from JP — Scanned from AT
Summary
TLS certificate: Issued by R3 on September 15th 2023. Valid for: 3 months.
This is the only time managehosting144202b3-aruba.zukunst.at was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Aruba (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 2 | 172.171.241.51 172.171.241.51 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
4 | 2 |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
managehosting144202b3-aruba.zukunst.at |
Apex Domain Subdomains |
Transfer | |
---|---|---|
2 |
zukunst.at
1 redirects
managehosting144202b3-aruba.zukunst.at |
1 MB |
0 |
usabilla.com
Failed
w.usabilla.com Failed |
|
0 |
google-analytics.com
Failed
www.google-analytics.com Failed |
|
4 | 3 |
Domain | Requested by | |
---|---|---|
2 | managehosting144202b3-aruba.zukunst.at | 1 redirects |
0 | w.usabilla.com Failed |
managehosting144202b3-aruba.zukunst.at
|
0 | www.google-analytics.com Failed |
managehosting144202b3-aruba.zukunst.at
|
4 | 3 |
This site contains links to these domains. Also see Links.
Domain |
---|
pagamenti.aruba.it |
webmail.aruba.it |
managehosting.aruba.it |
assistenza.aruba.it |
gestioneaccessi.aruba.it |
www.aruba.it |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.zukunst.at R3 |
2023-09-15 - 2023-12-14 |
3 months | crt.sh |
This page contains 3 frames:
Primary Page:
https://managehosting144202b3-aruba.zukunst.at/login.php?TTDxV8CJ2u7PoG1j5jPQPU4sjXIaZvW8ZvrP1k65JGtt05T5kyoyNwvwJ8WvP9s7NYTipExsW9rKLqSceCRzM6gBE9XVZUuWAr7PlNGLAaa6vLTS7SXvZuQS
Frame ID: 9915080B5C64C5AA65971719CB255EDA
Requests: 20 HTTP requests in this frame
Frame:
https://w.usabilla.com/719697a0b3af.js?lv=1
Frame ID: C7558ECAD58641AA07F44829B69D76DE
Requests: 1 HTTP requests in this frame
Frame:
data://truncated
Frame ID: 31CA57624E42033EC3A0B31C791A1177
Requests: 1 HTTP requests in this frame
Screenshot
Page Title
Pagamenti.aruba.itPage URL History Show full URLs
-
https://managehosting144202b3-aruba.zukunst.at/indexxx.php?RxzQSWz3tFxQ5pFKx1FTqKdBhAQRYX46h1cDL4SQ9dCra4dBc0N9Mm6tB6c8jcD7...
HTTP 302
https://managehosting144202b3-aruba.zukunst.at/login.php?TTDxV8CJ2u7PoG1j5jPQPU4sjXIaZvW8ZvrP1k65JGtt05T5kyoyNwvwJ8WvP9s7NY... Page URL
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- \.php(?:$|\?)
Google Analytics (Analytics) Expand
Detected patterns
Page Statistics
8 Outgoing links
These are links going to different origins than the main page.
Title: Italiano
Search URL Search Domain Scan URL
Title: webmail
Search URL Search Domain Scan URL
Title: rinnovi
Search URL Search Domain Scan URL
Title: area clienti
Search URL Search Domain Scan URL
Title: assistenza h24
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Title: Non ricordi lo username o la password?
Search URL Search Domain Scan URL
Title: Cookie
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://managehosting144202b3-aruba.zukunst.at/indexxx.php?RxzQSWz3tFxQ5pFKx1FTqKdBhAQRYX46h1cDL4SQ9dCra4dBc0N9Mm6tB6c8jcD7jPk9aBHJb8Rvcrp3FAsybU8KGpbQbSMvNp7GzGktNshQNFetxhzUy0Qg
HTTP 302
https://managehosting144202b3-aruba.zukunst.at/login.php?TTDxV8CJ2u7PoG1j5jPQPU4sjXIaZvW8ZvrP1k65JGtt05T5kyoyNwvwJ8WvP9s7NYTipExsW9rKLqSceCRzM6gBE9XVZUuWAr7PlNGLAaa6vLTS7SXvZuQS Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
4 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
login.php
managehosting144202b3-aruba.zukunst.at/ Redirect Chain
|
1 MB 1 MB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
401 B 0 |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
49 KB 0 |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
293 KB 0 |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
96 KB 0 |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
105 KB 0 |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
10 KB 0 |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
5 KB 0 |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
101 KB 0 |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
23 KB 0 |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
26 KB 0 |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
100 KB 0 |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
POST |
collect
www.google-analytics.com/j/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET |
analytics.js
www.google-analytics.com/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
39 KB 0 |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
13 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
13 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
17 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
15 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
23 KB 23 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET |
719697a0b3af.js
w.usabilla.com/ Frame C755 |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame 31CA |
6 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- www.google-analytics.com
- URL
- https://www.google-analytics.com/j/collect?v=1&_v=j96&a=321014491&t=pageview&_s=1&dl=https%3A%2F%2Fmanagehosting144202b3-aruba.zukunst.at%2Flogin.php%3FTTDxV8CJ2u7PoG1j5jPQPU4sjXIaZvW8ZvrP1k65JGtt05T5kyoyNwvwJ8WvP9s7NYTipExsW9rKLqSceCRzM6gBE9XVZUuWAr7PlNGLAaa6vLTS7SXvZuQS&ul=en-us&de=UTF-8&dt=Pagamenti.aruba.it&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aEBAAUABEAAAAC~&jid=1934373928&gjid=1397644646&cid=168594249.1694939587&tid=UA-47997651-24&_gid=1957986988.1694939587&_r=1>m=2ou6f0&z=532965116
- Domain
- www.google-analytics.com
- URL
- https://www.google-analytics.com/analytics.js
- Domain
- w.usabilla.com
- URL
- https://w.usabilla.com/719697a0b3af.js?lv=1
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Aruba (Online)138 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| 1 object| 2 object| 3 object| 4 object| documentPictureInPicture object| google_tag_data function| ga object| gaplugins undefined| CookiebotDialog undefined| CookieConsentDialog function| lightningjs function| usabilla_live object| CookieControl function| __uspapi function| addUspapiLocatorFrame function| __handleUspapiMessage function| propagateIABStub function| $ function| jQuery undefined| isXHTML function| NiftyCheck function| Rounded function| AddBorder function| AddTop function| AddBottom function| CreateEl function| getElementsBySelector function| Mix function| openMenu function| closeMenu function| IntxlaALSprecheck function| SetLingua function| createCookie function| ShowP function| CheckSelectedOption function| setSelectedDevice function| gtag object| dataLayer object| theForm function| __doPostBack function| WebForm_PostBackOptions function| WebForm_DoPostBackWithOptions object| __pendingCallbacks number| __synchronousCallBackIndex function| WebForm_DoCallback function| WebForm_CallbackComplete function| WebForm_ExecuteCallback function| WebForm_FillFirstAvailableSlot boolean| __nonMSDOMBrowser string| __theFormPostData object| __theFormPostCollection object| __callbackTextTypes function| WebForm_InitCallback function| WebForm_InitCallbackAddField function| WebForm_EncodeCallback object| __disabledControlArray function| WebForm_ReEnableControls function| WebForm_ReDisableControls function| WebForm_SimulateClick function| WebForm_FireDefaultButton function| WebForm_GetScrollX function| WebForm_GetScrollY function| WebForm_SaveScrollPositionSubmit function| WebForm_SaveScrollPositionOnSubmit function| WebForm_RestoreScrollPosition function| WebForm_TextBoxKeyHandler function| WebForm_TrimString function| WebForm_AppendToClassName function| WebForm_RemoveClassName function| WebForm_GetElementById function| WebForm_GetElementByTagName function| WebForm_GetElementsByTagName function| WebForm_GetElementDir function| WebForm_GetElementPosition function| WebForm_GetParentByTagName function| WebForm_SetElementHeight function| WebForm_SetElementWidth function| WebForm_SetElementX function| WebForm_SetElementY object| google_tag_manager string| Page_ValidationVer boolean| Page_IsValid boolean| Page_BlockSubmit object| Page_InvalidControlToBeFocused object| Page_TextTypes function| ValidatorUpdateDisplay function| ValidatorUpdateIsValid function| AllValidatorsValid function| ValidatorHookupControlID function| ValidatorHookupControl function| ValidatorHookupEvent function| ValidatorGetValue function| ValidatorGetValueRecursive function| Page_ClientValidate function| ValidatorCommonOnSubmit function| ValidatorEnable function| ValidatorOnChange function| ValidatedTextBoxOnKeyPress function| ValidatedControlOnBlur function| ValidatorValidate function| ValidatorSetFocus function| IsInVisibleContainer function| IsValidationGroupMatch function| ValidatorOnLoad function| ValidatorConvert function| ValidatorCompare function| CompareValidatorEvaluateIsValid function| CustomValidatorEvaluateIsValid function| RegularExpressionValidatorEvaluateIsValid function| ValidatorTrim function| RequiredFieldValidatorEvaluateIsValid function| RangeValidatorEvaluateIsValid function| ValidationSummaryOnSubmit function| Sys$Enum$parse function| Sys$Enum$toString function| Sys$Component$_setProperties function| Sys$Component$_setReferences function| $create function| $addHandler function| $addHandlers function| $clearHandlers function| $removeHandler function| $get function| $find function| Type object| Sys object| _events string| GoogleAnalyticsObject object| gaGlobal object| gaData function| WebForm_OnSubmit object| Page_Validators object| cphBody_rfvOrderValidator boolean| Page_ValidationActive function| ValidatorOnSubmit string| theAgent object| Page_ValidationSummaries6 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
managehosting144202b3-aruba.zukunst.at/ | Name: PHPSESSID Value: ata0gqmi0jgi7vjpt8lqq3ol2u |
|
managehosting144202b3-aruba.zukunst.at/ | Name: cleana Value: true |
|
.zukunst.at/ | Name: _ga Value: GA1.2.168594249.1694939587 |
|
.zukunst.at/ | Name: _gid Value: GA1.2.1957986988.1694939587 |
|
.zukunst.at/ | Name: _gat_gtag_UA_47997651_24 Value: 1 |
|
managehosting144202b3-aruba.zukunst.at/ | Name: OpenChatControl Value: true |
4 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
managehosting144202b3-aruba.zukunst.at
w.usabilla.com
www.google-analytics.com
w.usabilla.com
www.google-analytics.com
172.171.241.51
015fcd7aac5929a1c6619aaa37ab852552ed42a800c116216049ab9e8433ea27
398cdf1b27ef247e5bc77805f266bb441e60355463fc3d1776f41aae58b08cf1
402a2a5420e7d4bd3943ae8770d80858e3449b96e7df4a3973b87b1d08ce5813
40732e9dcfa704cf615e4691bb07aecfd1cc5e063220a46e4a7ff6560c77f5db
42070923ab969239a90ad7906011ed437355696d75340bb7677313fcb945b08a
502a3766309b1092890b0e535e784678bfd584a598bf84e20fd530424c79ecbd
52897547cfc7be3ea57d0a07398a6c8d5f01c9cb02309c7ab2ba9ab27ebd73a4
528a1886f07e7777a6ee359f49155202a3ca8670e7f8feb399ca186a8bf80ac6
66b804e7a96a87c11e1dd74ea04ac2285df5ad9043f48046c3e5000114d39b1c
86ad3d8f9f61e5f04d64235f71997729afae5272d54e276dd0165f6ef288bd85
918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537
933586ce236a056afb0307f7439bfa146555502a99d2d3f3f60af907c7a56e1d
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a525f163e73542be1b82c5ae4e4beed74d137d56161ac5b02833a279ef6d9b61
ae3759174cc8b31507df02ef40c88a63857b4ef7b8dd8733899c08e557ce9366
bcedcafd81248b08cb428b22618a38866d0cee85b4e9ecd27ef734d0533e2792
e2aea7d05ea8c125ee448f0c47b1aef02c52ce13a16871992bc4158c80546f83
ec227d9ca399ba8a2e7cebb750bee9a167f55232808dffe912449692df8fa4b3
ef9453f74b2617d43dcef4242cf5845101fcfb57289c81bceb20042b0023a192