hektirs.sa.com Open in urlscan Pro
107.182.128.31  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request be56ml98xrubas.htm Show response hektirs.sa.com/lder/conarubstructivemailJsp/ee82hr00sl21mde4u9mailcr2cu37sd92cs02m73dces/msgID.usr.sign_in/	33 KB 33 KB	672ms 184ms	Document text/html	107.182.128.31 AS-SERVERION
General Check archive.org Show headers Download Go to Full URL https://hektirs.sa.com/lder/conarubstructivemailJsp/ee82hr00sl21mde4u9mailcr2cu37sd92cs02m73dces/msgID.usr.sign_in/be56ml98xrubas.htm Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 107.182.128.31 Dallas, United States, ASN399471 (AS-SERVERION, US), Reverse DNS Software Apache / Resource Hash 89612f39c86784ca543f07751072b8a719af135b2185da12159913c43e1ca830 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Response headers Accept-Ranges bytes Connection Keep-Alive Content-Length 33464 Content-Type text/html Date Thu, 24 Oct 2024 06:50:23 GMT Keep-Alive timeout=5, max=100 Last-Modified Thu, 24 Oct 2024 05:01:32 GMT Server Apache
GET H2	200	SCSPzi4.png i.imgur.com/	2 KB 2 KB	206ms 38ms	Image image/png	199.232.192.193 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://i.imgur.com/SCSPzi4.png Requested by Host: hektirs.sa.com URL: https://hektirs.sa.com/lder/conarubstructivemailJsp/ee82hr00sl21mde4u9mailcr2cu37sd92cs02m73dces/msgID.usr.sign_in/be56ml98xrubas.htm Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 199.232.192.193 , United States, ASN54113 (FASTLY, US), Reverse DNS Software cat factory 1.0 / Resource Hash 3b7a295f7a4bab99ddaedb9798544a95e579a4efce4b3170c936f240026cca32 Security Headers Name Value Strict-Transport-Security max-age=300 X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://hektirs.sa.com/ Response headers etag "55c93dd10c32a4bbb55b9db8028780ca" age 1932076 access-control-allow-methods GET, OPTIONS x-content-type-options nosniff x-cache Miss from cloudfront, HIT, HIT x-amz-cf-id lBeNO1luRIUW1MTdVEG9oFUcKytRmW_QAel38ui0ACh2IhS8m-6IZA== date Thu, 24 Oct 2024 06:50:24 GMT content-type image/png last-modified Wed, 17 Jan 2024 17:34:39 GMT x-cache-hits 226, 2 x-served-by cache-iad-kiad7000162-IAD, cache-mxp6945-MXP strict-transport-security max-age=300 cache-control public, max-age=31536000 x-timer S1729752624.395853,VS0,VE0 accept-ranges bytes access-control-allow-origin * content-length 1906 x-amz-cf-pop IAD89-P1 server cat factory 1.0 x-amz-server-side-encryption AES256
GET H2	200	XQfyneH.png i.imgur.com/	257 KB 257 KB	216ms 49ms	Image image/png	199.232.192.193 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://i.imgur.com/XQfyneH.png Requested by Host: hektirs.sa.com URL: https://hektirs.sa.com/lder/conarubstructivemailJsp/ee82hr00sl21mde4u9mailcr2cu37sd92cs02m73dces/msgID.usr.sign_in/be56ml98xrubas.htm Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 199.232.192.193 , United States, ASN54113 (FASTLY, US), Reverse DNS Software cat factory 1.0 / Resource Hash cbe439d2bbb0367798048b063d99b1fd2355837d4ecc856407e50c4141f9d7f2 Security Headers Name Value Strict-Transport-Security max-age=300 X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://hektirs.sa.com/ Response headers etag "2c3c8a811d861705c03229a5833646f6" age 553211 access-control-allow-methods GET, OPTIONS x-content-type-options nosniff x-cache Miss from cloudfront, HIT, HIT x-amz-cf-id 9PFaiQWveTm1S4d61JX-PTP8dfn_VBCVUgKRdfRySiGP-h0wtvmVfw== date Thu, 24 Oct 2024 06:50:24 GMT content-type image/png last-modified Thu, 17 Oct 2024 21:10:13 GMT x-cache-hits 34, 0 x-served-by cache-iad-kcgs7200073-IAD, cache-mxp6945-MXP strict-transport-security max-age=300 cache-control public, max-age=31536000 x-timer S1729752624.395811,VS0,VE2 accept-ranges bytes access-control-allow-origin * content-length 263254 x-amz-cf-pop IAD89-P1 server cat factory 1.0 x-amz-server-side-encryption AES256
GET H2	200	20hdBFK.png i.imgur.com/	609 B 827 B	60ms 58ms	Other image/png	199.232.192.193 FASTLY
General Check archive.org Show headers Download Go to Full URL https://i.imgur.com/20hdBFK.png Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 199.232.192.193 , United States, ASN54113 (FASTLY, US), Reverse DNS Software cat factory 1.0 / Resource Hash ca8abfd1e71a10c486a26be86954293c5f62e1ff94ac52f9270a41c285243c5a Security Headers Name Value Strict-Transport-Security max-age=300 X-Content-Type-Options nosniff Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://hektirs.sa.com/ Response headers etag "0ecb135733886ee9f5b6b3fb54baa6cf" age 1991654 access-control-allow-methods GET, OPTIONS x-content-type-options nosniff x-cache Miss from cloudfront, HIT, HIT x-amz-cf-id eN1nXsORYJ8_cC2jUAZmwzN5rLNWZP7SpF4z_CaAb_4fwuNeDYC0vw== date Thu, 24 Oct 2024 06:50:24 GMT content-type image/png last-modified Tue, 31 May 2022 07:42:56 GMT x-cache-hits 127, 0 x-served-by cache-iad-kiad7000120-IAD, cache-mxp6945-MXP strict-transport-security max-age=300 cache-control public, max-age=31536000 x-timer S1729752625.631881,VS0,VE1 accept-ranges bytes access-control-allow-origin * content-length 609 x-amz-cf-pop IAD55-P7 server cat factory 1.0

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Aruba (Online)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| _TnvD4h58gdI59ysb45Rcn1oyyI8S39T7LDG0U0DYCLNKHpfo function| _XEs5oG59W9h3nQY3KK8NBxY057j0R63Uw28gpAf7xXMfV5kvM object| _$ object| _LaIQ84Ms8rZH09r8gfj8EH9A25CgyT2Ksb3MIs37q number| _SpP66Vb3kXEg95Sa9o2uD98LO object| _JJvC0a2dy0Wh421p9aNS4g object| _VFrGvH27MR9xPiQ64 object| _BwtI52wKNbxUdf1qZTJ26m5Ak5BI

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	verbose	URL: https://hektirs.sa.com/lder/conarubstructivemailJsp/ee82hr00sl21mde4u9mailcr2cu37sd92cs02m73dces/msgID.usr.sign_in/be56ml98xrubas.htm Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

hektirs.sa.com
i.imgur.com
107.182.128.31
199.232.192.193
3b7a295f7a4bab99ddaedb9798544a95e579a4efce4b3170c936f240026cca32
89612f39c86784ca543f07751072b8a719af135b2185da12159913c43e1ca830
ca8abfd1e71a10c486a26be86954293c5f62e1ff94ac52f9270a41c285243c5a
cbe439d2bbb0367798048b063d99b1fd2355837d4ecc856407e50c4141f9d7f2