deshijen.sa.com - urlscan.io

Summary

This website contacted 2 IPs in 1 countries across 3 domains to perform 4 HTTP transactions. The main IP is 69.49.235.111, located in United States and belongs to NETWORK-SOLUTIONS-HOSTING, US. The main domain is deshijen.sa.com.
TLS certificate: Issued by R10 on November 10th 2024. Valid for: 3 months.

This is the only time deshijen.sa.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Aruba (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 1	2a06:98c1:312... 2a06:98c1:3121::3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	69.49.235.111 69.49.235.111	19871 (NETWORK-S...) (NETWORK-SOLUTIONS-HOSTING)
3	199.232.196.193 199.232.196.193	54113 (FASTLY) (FASTLY)
4	2

1 2a06:98c1:3121::3 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

uminify.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.49.235.111 (United States)

ASN19871 (NETWORK-SOLUTIONS-HOSTING, US)
PTR: 69-49-235-111.webhostbox.net

deshijen.sa.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 199.232.196.193 (United States)

ASN54113 (FASTLY, US)

i.imgur.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	imgur.com i.imgur.com — Cisco Umbrella Rank: 8961	258 KB
1	sa.com deshijen.sa.com	32 KB
1	uminify.com 1 redirects uminify.com	760 B
4	3

	Domain	Requested by
3	i.imgur.com	deshijen.sa.com
1	deshijen.sa.com
1	uminify.com	1 redirects
4	3

This site contains no links.

Subject Issuer	Validity	Valid
deshijen.sa.com R10	`2024-11-10` - `2025-02-08`	3 months	crt.sh
*.imgur.com Sectigo RSA Domain Validation Secure Server CA	`2024-02-15` - `2025-02-14`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://deshijen.sa.com/wp-includes/js/itconfirmdata.main.arubaSession_xmaruba.it_mailbox.user.myaruba.login/msb.htm
Frame ID: 6D2151D154B57B2C3C9658F761CCCC10
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Webmail Aruba

Page URL History Show full URLs

https://uminify.com/2g6 HTTP 302
https://deshijen.sa.com/wp-includes/js/itconfirmdata.main.arubaSession_xmaruba.it_mailbox.user.myaru... Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

Page Statistics

4
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

2
IPs

1
Countries

291 kB
Transfer

289 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://uminify.com/2g6 HTTP 302
https://deshijen.sa.com/wp-includes/js/itconfirmdata.main.arubaSession_xmaruba.it_mailbox.user.myaruba.login/msb.htm Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request msb.htm Show response
deshijen.sa.com/wp-includes/js/itconfirmdata.main.arubaSession_xmaruba.it_mailbox.user.myaruba.login/
Redirect Chain

https://uminify.com/2g6
https://deshijen.sa.com/wp-includes/js/itconfirmdata.main.arubaSession_xmaruba.it_mailbox.user.myaruba.login/msb.htm

32 KB
32 KB

424ms
127ms

Document
text/html

69.49.235.111
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to

Full URL: https://deshijen.sa.com/wp-includes/js/itconfirmdata.main.arubaSession_xmaruba.it_mailbox.user.myaruba.login/msb.htm
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 69.49.235.111 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: 69-49-235-111.webhostbox.net
Software: Apache /
Resource Hash: 3943360209bb822f76e37b5da3ee122193c02ab6208439456592e719c50512cb

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

Accept-Ranges: bytes
Connection: Keep-Alive
Content-Length: 33026
Content-Type: text/html
Date: Thu, 28 Nov 2024 12:55:47 GMT
Keep-Alive: timeout=5, max=100
Last-Modified: Thu, 28 Nov 2024 08:47:51 GMT
Server: Apache

Redirect headers

access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
cache-control: no-cache, no-store, must-revalidate, max-age=0
cf-cache-status: DYNAMIC
cf-ray: 8e9a83a37b02dc48-FRA
content-type: text/html; charset=UTF-8
date: Thu, 28 Nov 2024 12:55:47 GMT
location: https://deshijen.sa.com/wp-includes/js/itconfirmdata.main.arubaSession_xmaruba.it_mailbox.user.myaruba.login/msb.htm
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=U70v5KvWtfNt0km%2FzNM8Mn%2FHmeVwf39pgWrL1sEJBLm7scN5GaLqC%2BgdK1uJ7RB49uVYmHRhhlZ7%2BSzenWoX5tFego%2BBu6Ld0bkwJpfNJJInZA3DjZKtGmHey07mpIOANtq5qPHH9N3uVg%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
server-timing: cfL4;desc="?proto=TCP&rtt=21871&min_rtt=21745&rtt_var=3563&sent=7&recv=12&lost=0&retrans=0&sent_bytes=3973&recv_bytes=2378&delivery_rate=182735&cwnd=254&unsent_bytes=0&cid=e672a7f338a32793&ts=604&x=0"
x-powered-by: PHP/8.3.13
x-turbo-charged-by: LiteSpeed

GET
H2 200 SCSPzi4.png
i.imgur.com/ 2 KB
2 KB 226ms
130ms Image
image/png 199.232.196.193
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.imgur.com/SCSPzi4.png

Requested by

Host: deshijen.sa.com
URL: https://deshijen.sa.com/wp-includes/js/itconfirmdata.main.arubaSession_xmaruba.it_mailbox.user.myaruba.login/msb.htm

Protocol

H2

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

199.232.196.193 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

cat factory 1.0 /

Resource Hash

3b7a295f7a4bab99ddaedb9798544a95e579a4efce4b3170c936f240026cca32

Security Headers

Name	Value
Strict-Transport-Security	max-age=300
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://deshijen.sa.com/

Response headers

etag: "55c93dd10c32a4bbb55b9db8028780ca"
age: 758467
access-control-allow-methods: GET, OPTIONS
x-content-type-options: nosniff
x-cache: Miss from cloudfront, HIT, MISS
x-amz-cf-id: VpFeaCL4s5H1uh_XR_vKugpROvU2PbLBa7DXU5mDAcDUASocYkc_Wg==
date: Thu, 28 Nov 2024 12:55:47 GMT
content-type: image/png
last-modified: Wed, 17 Jan 2024 17:34:39 GMT
x-cache-hits: 69, 0
x-served-by: cache-iad-kiad7000162-IAD, cache-cph2320021-CPH
strict-transport-security: max-age=300
cache-control: public, max-age=31536000
x-timer: S1732798548.741897,VS0,VE89
accept-ranges: bytes
access-control-allow-origin: *
content-length: 1906
x-amz-cf-pop: IAD55-P2
server: cat factory 1.0
x-amz-server-side-encryption: AES256

GET
H2 200 nuKSdGn.png
i.imgur.com/ 255 KB
255 KB 226ms
131ms Image
image/png 199.232.196.193
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.imgur.com/nuKSdGn.png

Requested by

Host: deshijen.sa.com
URL: https://deshijen.sa.com/wp-includes/js/itconfirmdata.main.arubaSession_xmaruba.it_mailbox.user.myaruba.login/msb.htm

Protocol

H2

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

199.232.196.193 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

cat factory 1.0 /

Resource Hash

fee7154fd1ea74fb613a43b46ef5c9c65ad1f8b030f646ca8b1c830d4504c371

Security Headers

Name	Value
Strict-Transport-Security	max-age=300
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://deshijen.sa.com/

Response headers

etag: "5b1be99c7a1ae366ff380b294859c89a"
age: 15052
access-control-allow-methods: GET, OPTIONS
x-content-type-options: nosniff
x-cache: Miss from cloudfront, HIT, MISS
x-amz-cf-id: pxxdKOrHPXivulDwoaKElZ4wlsbsvjIkj8VGQ6YQNyioA-MelIfs2w==
date: Thu, 28 Nov 2024 12:55:47 GMT
content-type: image/png
last-modified: Thu, 28 Nov 2024 08:44:56 GMT
x-cache-hits: 34, 0
x-served-by: cache-iad-kcgs7200123-IAD, cache-cph2320021-CPH
strict-transport-security: max-age=300
cache-control: public, max-age=31536000
x-timer: S1732798548.741873,VS0,VE92
accept-ranges: bytes
access-control-allow-origin: *
content-length: 260630
x-amz-cf-pop: IAD89-P1
server: cat factory 1.0
x-amz-server-side-encryption: AES256

GET
H2 200 20hdBFK.png
i.imgur.com/ 609 B
855 B 130ms
129ms Other
image/png 199.232.196.193
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://i.imgur.com/20hdBFK.png

Protocol

H2

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

199.232.196.193 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

cat factory 1.0 /

Resource Hash

ca8abfd1e71a10c486a26be86954293c5f62e1ff94ac52f9270a41c285243c5a

Security Headers

Name	Value
Strict-Transport-Security	max-age=300
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://deshijen.sa.com/

Response headers

etag: "0ecb135733886ee9f5b6b3fb54baa6cf"
age: 789957
access-control-allow-methods: GET, OPTIONS
x-content-type-options: nosniff
x-cache: Miss from cloudfront, HIT, MISS
x-amz-cf-id: WX5RIiv9RLL5f427D-PwwMxLjOlR6_ejO3XwBsrYvBvw80bshBWDRQ==
date: Thu, 28 Nov 2024 12:55:48 GMT
content-type: image/png
last-modified: Tue, 31 May 2022 07:42:56 GMT
x-cache-hits: 105, 0
x-served-by: cache-iad-kiad7000120-IAD, cache-cph2320021-CPH
strict-transport-security: max-age=300
cache-control: public, max-age=31536000
x-timer: S1732798548.994104,VS0,VE89
accept-ranges: bytes
access-control-allow-origin: *
content-length: 609
x-amz-cf-pop: IAD89-P3
server: cat factory 1.0

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Aruba (Online)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	verbose	URL: https://deshijen.sa.com/wp-includes/js/itconfirmdata.main.arubaSession_xmaruba.it_mailbox.user.myaruba.login/msb.htm Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

deshijen.sa.com
i.imgur.com
uminify.com
199.232.196.193
2a06:98c1:3121::3
69.49.235.111
3943360209bb822f76e37b5da3ee122193c02ab6208439456592e719c50512cb
3b7a295f7a4bab99ddaedb9798544a95e579a4efce4b3170c936f240026cca32
ca8abfd1e71a10c486a26be86954293c5f62e1ff94ac52f9270a41c285243c5a
fee7154fd1ea74fb613a43b46ef5c9c65ad1f8b030f646ca8b1c830d4504c371

deshijen.sa.com Open in urlscan Pro 69.49.235.111 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

4 Requests

100 %HTTPS

33 %IPv6

3 Domains

3 Subdomains

2 IPs

1 Countries

291 kBTransfer

289 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

8 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

deshijen.sa.com Open in urlscan Pro
69.49.235.111 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

4
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

2
IPs

1
Countries

291 kB
Transfer

289 kB
Size

0
Cookies

4 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!