URL: https://nr.kjlc5.za.com/.well-known/acme-challenge/lebe/I/xx.php?ee=&.rand=dfzeWm5IpJ6hfZla&hdfzeWm5IpJ6hfZla&hdfzeWm5Ip...
Submission: On December 01 via automatic, source phishtank — Scanned from DE

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 3 HTTP transactions. The main IP is 147.93.133.7, located in Belgium and belongs to . The main domain is nr.kjlc5.za.com.
TLS certificate: Issued by R10 on November 21st 2024. Valid for: 3 months.
This is the only time nr.kjlc5.za.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
3 147.93.133.7 ()
3 1
Apex Domain
Subdomains
Transfer
3 za.com
nr.kjlc5.za.com
376 KB
3 1
Domain Requested by
3 nr.kjlc5.za.com nr.kjlc5.za.com
3 1

This site contains no links.

Subject Issuer Validity Valid
nr.kjlc5.za.com
R10
2024-11-21 -
2025-02-19
3 months crt.sh

This page contains 1 frames:

Primary Page: https://nr.kjlc5.za.com/.well-known/acme-challenge/lebe/I/xx.php?ee=&.rand=dfzeWm5IpJ6hfZla&hdfzeWm5IpJ6hfZla&hdfzeWm5IpJ6hfZla&h
Frame ID: 7FC9E3E5CBACDC36CAC7C534A9BDEEBB
Requests: 3 HTTP requests in this frame

Screenshot

Page Title

Webmail Aruba

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Page Statistics

3
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

376 kB
Transfer

376 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request xx.php
nr.kjlc5.za.com/.well-known/acme-challenge/lebe/I/
2 KB
2 KB
Document
General
Full URL
https://nr.kjlc5.za.com/.well-known/acme-challenge/lebe/I/xx.php?ee=&.rand=dfzeWm5IpJ6hfZla&hdfzeWm5IpJ6hfZla&hdfzeWm5IpJ6hfZla&h
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
147.93.133.7 , Belgium, ASN (),
Reverse DNS
vmi2285866.contaboserver.net
Software
Apache /
Resource Hash
b116daacd4fa468ebc2b271ed8efac4418bd69184c63677a65c4468f3cebdc53

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8
Date
Sun, 01 Dec 2024 09:39:54 GMT
Keep-Alive
timeout=5, max=100
Server
Apache
Transfer-Encoding
chunked
qiye.png
nr.kjlc5.za.com/.well-known/acme-challenge/lebe/I/img/
374 KB
374 KB
Image
General
Full URL
https://nr.kjlc5.za.com/.well-known/acme-challenge/lebe/I/img/qiye.png
Requested by
Host: nr.kjlc5.za.com
URL: https://nr.kjlc5.za.com/.well-known/acme-challenge/lebe/I/xx.php?ee=&.rand=dfzeWm5IpJ6hfZla&hdfzeWm5IpJ6hfZla&hdfzeWm5IpJ6hfZla&h
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
147.93.133.7 , Belgium, ASN (),
Reverse DNS
vmi2285866.contaboserver.net
Software
Apache /
Resource Hash
e1a087a4591f10c41fb23aed669b698f1e187548fced60bcd9177caf85ef57c2

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://nr.kjlc5.za.com/.well-known/acme-challenge/lebe/I/xx.php?ee=&.rand=dfzeWm5IpJ6hfZla&hdfzeWm5IpJ6hfZla&hdfzeWm5IpJ6hfZla&h

Response headers

Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
382531
Keep-Alive
timeout=5, max=99
Date
Sun, 01 Dec 2024 09:39:55 GMT
Last-Modified
Sun, 29 Sep 2024 11:51:36 GMT
Content-Type
image/png
Server
Apache
favicon.ico
nr.kjlc5.za.com/.well-known/acme-challenge/lebe/I/img/
114 B
320 B
Other
General
Full URL
https://nr.kjlc5.za.com/.well-known/acme-challenge/lebe/I/img/favicon.ico
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
147.93.133.7 , Belgium, ASN (),
Reverse DNS
vmi2285866.contaboserver.net
Software
Apache /
Resource Hash
9ca3743653a45b2a036c3b150b990b9f8108a1890689231f0fec42238bcc6a07

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://nr.kjlc5.za.com/.well-known/acme-challenge/lebe/I/xx.php?ee=&.rand=dfzeWm5IpJ6hfZla&hdfzeWm5IpJ6hfZla&hdfzeWm5IpJ6hfZla&h

Response headers

Transfer-Encoding
chunked
Keep-Alive
timeout=5, max=98
Date
Sun, 01 Dec 2024 09:39:56 GMT
Content-Type
text/html; charset=UTF-8
Server
Apache
Connection
Keep-Alive

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

1 Console Messages

Source Level URL
Text
recommendation verbose URL: https://nr.kjlc5.za.com/.well-known/acme-challenge/lebe/I/xx.php?ee=&.rand=dfzeWm5IpJ6hfZla&hdfzeWm5IpJ6hfZla&hdfzeWm5IpJ6hfZla&h
Message:
[DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

nr.kjlc5.za.com
147.93.133.7
9ca3743653a45b2a036c3b150b990b9f8108a1890689231f0fec42238bcc6a07
b116daacd4fa468ebc2b271ed8efac4418bd69184c63677a65c4468f3cebdc53
e1a087a4591f10c41fb23aed669b698f1e187548fced60bcd9177caf85ef57c2