mail.markets-today.com

Summary

This website contacted 2 IPs in 3 countries across 3 domains to perform 3 HTTP transactions. The main IP is 50.87.150.161, located in United States and belongs to UNIFIEDLAYER-AS-1, US. The main domain is mail.markets-today.com.
TLS certificate: Issued by R3 on March 27th 2022. Valid for: 3 months.

This is the only time mail.markets-today.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Aruba (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 1	45.117.170.194 45.117.170.194	45544 (SUPERDATA...) (SUPERDATA-AS-VN SUPERDATA-)
1	50.87.150.161 50.87.150.161	46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1)
2	151.101.112.193 151.101.112.193	54113 (FASTLY) (FASTLY)
3	2

1 45.117.170.194 (Viet Nam) 1 redirects

ASN45544 (SUPERDATA-AS-VN SUPERDATA-, VN)
PTR: mx170194.superdata.vn

s.ixorat.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 50.87.150.161 (United States)

ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: 50-87-150-161.unifiedlayer.com

mail.markets-today.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.112.193 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

i.imgur.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	imgur.com i.imgur.com — Cisco Umbrella Rank: 5468	300 KB
1	markets-today.com mail.markets-today.com	1 KB
1	ixorat.com 1 redirects s.ixorat.com	501 B
3	3

	Domain	Requested by
2	i.imgur.com	mail.markets-today.com
1	mail.markets-today.com
1	s.ixorat.com	1 redirects
3	3

This site contains no links.

Subject Issuer	Validity	Valid
markets-today.com R3	`2022-03-27` - `2022-06-25`	3 months	crt.sh
*.imgur.com DigiCert TLS RSA SHA256 2020 CA1	`2022-03-08` - `2023-03-16`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://mail.markets-today.com//wp-admin/user/account/aruba_it/login/index/user2/Info.aruba.it.htm
Frame ID: 606F7C8411AEB596B62542EB4BD3656E
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Webmail Aruba

Page URL History Show full URLs

https://s.ixorat.com/XJvZo HTTP 301
https://mail.markets-today.com//wp-admin/user/account/aruba_it/login/index/user2/Info.aruba.it.htm Page URL

Page Statistics

3
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

2
IPs

3
Countries

301 kB
Transfer

302 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://s.ixorat.com/XJvZo HTTP 301
https://mail.markets-today.com//wp-admin/user/account/aruba_it/login/index/user2/Info.aruba.it.htm Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request Info.aruba.it.htm Show response
mail.markets-today.com//wp-admin/user/account/aruba_it/login/index/user2/
Redirect Chain

https://s.ixorat.com/XJvZo
https://mail.markets-today.com//wp-admin/user/account/aruba_it/login/index/user2/Info.aruba.it.htm

3 KB
1 KB

523ms
180ms

Document
text/html

50.87.150.161
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://mail.markets-today.com//wp-admin/user/account/aruba_it/login/index/user2/Info.aruba.it.htm
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 50.87.150.161 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: 50-87-150-161.unifiedlayer.com
Software: Apache /
Resource Hash: 3f7d591f942ec4b6c17b612d22f5fe77e01cc6ff2f31d79a896aa072bb0be5a1

Request headers

Accept-Language: it-IT,it;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

accept-ranges: bytes
content-encoding: gzip
content-length: 1158
content-type: text/html
date: Wed, 06 Apr 2022 07:27:29 GMT
last-modified: Wed, 06 Apr 2022 06:16:09 GMT
server: Apache
vary: Accept-Encoding

Redirect headers

cache-control: no-store, no-cache, must-revalidate
content-type: text/html; charset=UTF-8
date: Wed, 06 Apr 2022 07:27:28 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
location: https://mail.markets-today.com//wp-admin/user/account/aruba_it/login/index/user2/Info.aruba.it.htm
pragma: no-cache
referrer-policy: no-referrer-when-downgrade
server: HOSTVN.NET
strict-transport-security: "max-age=31536000; includeSubDomains; preload" always
x-content-type-options: "nosniff" always
x-xss-protection: "1; mode=block" always

GET
H2 200 8PpkrjA.png
i.imgur.com/ 1 KB
2 KB 112ms
36ms Image
image/png 151.101.112.193
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.imgur.com/8PpkrjA.png

Requested by

Host: mail.markets-today.com
URL: https://mail.markets-today.com//wp-admin/user/account/aruba_it/login/index/user2/Info.aruba.it.htm

Protocol

H2

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.112.193 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

cat factory 1.0 /

Resource Hash

7d75d4f2f3b99296150edf71c829dfeced3275b40a09eeb7c89bc99e81ca0668

Security Headers

Name	Value
Strict-Transport-Security	max-age=300
X-Content-Type-Options	nosniff

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://mail.markets-today.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Wed, 06 Apr 2022 07:27:29 GMT
x-content-type-options: nosniff
fastly-original-body-size: 1428
age: 1190642
x-cache: HIT, HIT
content-length: 1428
x-served-by: cache-iad-kjyo7100126-IAD, cache-hhn4057-HHN
last-modified: Wed, 10 Nov 2021 07:45:33 GMT
server: cat factory 1.0
x-timer: S1649230049.494254,VS0,VE1
etag: "bfbc381e425a5a6f9a04c0dab11bb672"
strict-transport-security: max-age=300
access-control-allow-methods: GET, OPTIONS
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-cache-hits: 1, 1

GET
H2 200 wHqsmNU.png
i.imgur.com/ 298 KB
298 KB 112ms
36ms Image
image/png 151.101.112.193
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.imgur.com/wHqsmNU.png

Requested by

Host: mail.markets-today.com
URL: https://mail.markets-today.com//wp-admin/user/account/aruba_it/login/index/user2/Info.aruba.it.htm

Protocol

H2

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.112.193 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

cat factory 1.0 /

Resource Hash

6e135e101b1230a00f1917d540597e0cec953683aa65491adf7b1dc47770a77d

Security Headers

Name	Value
Strict-Transport-Security	max-age=300
X-Content-Type-Options	nosniff

Request headers

Accept-Language: it-IT,it;q=0.9
Referer: https://mail.markets-today.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36

Response headers

date: Wed, 06 Apr 2022 07:27:29 GMT
x-content-type-options: nosniff
fastly-original-body-size: 304665
age: 75020
x-cache: HIT, HIT
x-amz-storage-class: STANDARD_IA
content-length: 304665
x-served-by: cache-iad-kjyo7100110-IAD, cache-hhn4057-HHN
last-modified: Wed, 10 Nov 2021 07:22:37 GMT
server: cat factory 1.0
x-timer: S1649230049.494358,VS0,VE1
etag: "198a562b2e0c5e6a0096b8a36207b940"
strict-transport-security: max-age=300
access-control-allow-methods: GET, OPTIONS
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-cache-hits: 1, 1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Aruba (Online)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| structuredClone object| oncontextlost object| oncontextrestored function| getScreenDetails

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			s.ixorat.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: pif6iib6ahfc7mn3rlcelrsa44
			s.ixorat.com/	1970-01-20 02:07:10	Name: short_174 Value: 1

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

i.imgur.com
mail.markets-today.com
s.ixorat.com
151.101.112.193
45.117.170.194
50.87.150.161
3f7d591f942ec4b6c17b612d22f5fe77e01cc6ff2f31d79a896aa072bb0be5a1
6e135e101b1230a00f1917d540597e0cec953683aa65491adf7b1dc47770a77d
7d75d4f2f3b99296150edf71c829dfeced3275b40a09eeb7c89bc99e81ca0668

mail.markets-today.com Open in urlscan Pro 50.87.150.161 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

3 Requests

100 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

2 IPs

3 Countries

301 kBTransfer

302 kBSize

2 Cookies

0 Outgoing links

Page URL History

Redirected requests

3 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

2 Cookies

Indicators

mail.markets-today.com Open in urlscan Pro
50.87.150.161 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

3
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

2
IPs

3
Countries

301 kB
Transfer

302 kB
Size

2
Cookies

3 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!