webmail-aruba.com
Open in
urlscan Pro
46.17.41.141
Malicious Activity!
Public Scan
Submitted URL: https://artificialgrasscumbria.com/VJB090TZP?c=ogpmWbc2FsYUBzdHVkaW9mcmVkZWxsYS5jb20=kLjah
Effective URL: https://webmail-aruba.com/?c=MzI0TFZSbFJVNWcrNURMbmFXNEVjWDIzbXpTcERqTT0=
Submission Tags: 7493229
Submission: On April 20 via api from US — Scanned from IT
Effective URL: https://webmail-aruba.com/?c=MzI0TFZSbFJVNWcrNURMbmFXNEVjWDIzbXpTcERqTT0=
Submission Tags: 7493229
Submission: On April 20 via api from US — Scanned from IT
Summary
This website contacted 1 IPs
in 2 countries
across 3 domains to perform 11 HTTP transactions.
The main IP is 46.17.41.141, located in
Moscow, Russian Federation and
belongs to ASBAXET, RU.
The main domain is webmail-aruba.com.
TLS certificate: Issued by R3 on April 19th 2022. Valid for: 3 months.
This is the only time webmail-aruba.com was scanned on urlscan.io!
TLS certificate: Issued by R3 on April 19th 2022. Valid for: 3 months.
This is the only time webmail-aruba.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Aruba (Online)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 1 | 92.255.57.122 92.255.57.122 | 57523 (CHANGWAY-AS) (CHANGWAY-AS) | |
| 1 12 | 46.17.41.141 46.17.41.141 | 51659 (ASBAXET) (ASBAXET) | |
| 11 | 1 |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 11 |
webmail-aruba.com
webmail-aruba.com |
254 KB |
| 1 |
arbrdrcts.com
1 redirects
arbrdrcts.com |
258 B |
| 1 |
artificialgrasscumbria.com
1 redirects
artificialgrasscumbria.com |
280 B |
| 11 | 3 |
| Domain | Requested by | |
|---|---|---|
| 11 | webmail-aruba.com |
webmail-aruba.com
|
| 1 | arbrdrcts.com | 1 redirects |
| 1 | artificialgrasscumbria.com | 1 redirects |
| 11 | 3 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| webmail-aruba.com R3 |
2022-04-19 - 2022-07-18 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://webmail-aruba.com/?c=MzI0TFZSbFJVNWcrNURMbmFXNEVjWDIzbXpTcERqTT0=
Frame ID: B8B92EA8CE2565D9063C971F95D02DD0
Requests: 11 HTTP requests in this frame
Screenshot
Page Title
WebMail ArubaPage URL History Show full URLs
-
https://artificialgrasscumbria.com/VJB090TZP?c=ogpmWbc2FsYUBzdHVkaW9mcmVkZWxsYS5jb20=kLjah
HTTP 301
https://arbrdrcts.com/?c=ogpmWbc2FsYUBzdHVkaW9mcmVkZWxsYS5jb20=kLjah HTTP 302
https://webmail-aruba.com/?c=MzI0TFZSbFJVNWcrNURMbmFXNEVjWDIzbXpTcERqTT0= Page URL
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://artificialgrasscumbria.com/VJB090TZP?c=ogpmWbc2FsYUBzdHVkaW9mcmVkZWxsYS5jb20=kLjah
HTTP 301
https://arbrdrcts.com/?c=ogpmWbc2FsYUBzdHVkaW9mcmVkZWxsYS5jb20=kLjah HTTP 302
https://webmail-aruba.com/?c=MzI0TFZSbFJVNWcrNURMbmFXNEVjWDIzbXpTcERqTT0= Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
11 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
/
webmail-aruba.com/ Redirect Chain
|
8 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
login.css
webmail-aruba.com/css/ |
13 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
dojo.js
webmail-aruba.com/js/ |
193 KB 38 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
login.js
webmail-aruba.com/js/ |
31 KB 8 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
aruba-logo.svg
webmail-aruba.com/img/ |
15 KB 15 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
envelope.svg
webmail-aruba.com/img/ |
681 B 937 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
login-icon.svg
webmail-aruba.com/img/ |
666 B 922 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
password-icon.svg
webmail-aruba.com/img/ |
585 B 841 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
password-icon-2.svg
webmail-aruba.com/img/ |
947 B 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
check.svg
webmail-aruba.com/img/ |
298 B 554 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
left-block-image.jpg
webmail-aruba.com/img/ |
183 KB 184 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Aruba (Online)58 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| structuredClone object| oncontextlost object| oncontextrestored function| getScreenDetails object| dojo object| dijit object| dojox string| UX_LEGGERA string| UX_WEB2CS string| UX_FIZZER string| UX_HTML string| UX_PEC boolean| manage boolean| classic object| i18n_login function| isBrowserSupported object| JsonFormatter function| encodeCredentials function| login_setCredentials function| login_getCookie function| login_setCookie function| login_initAdvancedPage function| login_initPage function| login_initRadios function| displayTab function| getLanguage function| login_showPopup function| login_errorPopup function| login_getSelectedUx function| launchUser function| launchAdmin function| login_web2cs function| login_errorCallback function| isBetaOptimizable function| login_leggera function| auto_login function| isPecDomain function| login_pec function| login_html function| login_fizzer function| display_redirect function| showPassword function| onInputFocus function| onInputBlur function| onInputChange function| DOMContentLoadedListener function| login_setLanguageCookie function| loginGetLanguage function| login_initLocalization function| changeLanguage function| showLanguage function| hideLanguage function| login_localize function| fstring function| focusFirstInput function| validateForm function| keyup string| _domain0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
arbrdrcts.com
artificialgrasscumbria.com
webmail-aruba.com
46.17.41.141
92.255.57.122
2769b657782eb332897d00cc4b4aa1d093a109dbe0efae4d0a0fbcbe2a38152d
46a60bbee6e3b99b76568bde0bb9bb78d6bdba76c91b58f452a3f9cfea8c0de0
5e96c408271ce2999c052da5821e78872d784aa9a08b87fc6f4fb036e46eab99
6ec247348bc2eff9c1a12d3bbc8e553a30a536679ee4f442644e195fe0fc7b6a
8955ee5e3071f91ed2460b5b634cdab6f6c15d5d8adefac0e3328de7f5889a97
9499d557d67e15a8e682e8b8ec23e80cff64e6b0ba55a0a5696acd1d52db8f77
a32e14929dae4030d8fe0164ac57453ec28a2927b4e6f22d445934b829f6df14
bf4e3b74bd09dd7fad26258518cc633279df367c545eaa668bbca0a81c4f6236
c7eca97d84ed3469e7d1a20a8c28ef7177270b93a2d9913a0adad9a3e4bdfc9a
d1a498e72f62f80af25d958364158a781a8cdee723e700756b28756c97ee2fa1
dc6450f154b8613cd1ba7a36f672e82df3d6b9d92957252ec67580d454b008a1