aramks-sa-pay.netlify.app
Open in
urlscan Pro
3.72.140.173
Malicious Activity!
Public Scan
Submission Tags: @phish_report
Submission: On April 15 via api from FI — Scanned from FI
Summary
TLS certificate: Issued by DigiCert Global G2 TLS RSA SHA256 202... on January 15th 2024. Valid for: a year.
This is the only time aramks-sa-pay.netlify.app was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Community Verdicts: Malicious — 1 votes Show Verdicts
Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
6 | 3.72.140.173 3.72.140.173 | 16509 (AMAZON-02) (AMAZON-02) | |
10 | 23.38.123.171 23.38.123.171 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
3 | 142.250.186.170 142.250.186.170 | 15169 (GOOGLE) (GOOGLE) | |
2 | 142.250.186.131 142.250.186.131 | 15169 (GOOGLE) (GOOGLE) | |
1 | 20.150.84.228 20.150.84.228 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
22 | 5 |
ASN16509 (AMAZON-02, US)
PTR: ec2-3-72-140-173.eu-central-1.compute.amazonaws.com
aramks-sa-pay.netlify.app |
ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-38-123-171.deploy.static.akamaitechnologies.com
www.aramex.com |
ASN15169 (GOOGLE, US)
PTR: fra24s08-in-f10.1e100.net
fonts.googleapis.com |
ASN15169 (GOOGLE, US)
PTR: fra24s07-in-f3.1e100.net
fonts.gstatic.com |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
dotcomaramexprod.blob.core.windows.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
10 |
aramex.com
www.aramex.com — Cisco Umbrella Rank: 623885 |
465 KB |
6 |
netlify.app
aramks-sa-pay.netlify.app |
51 KB |
3 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 35 |
3 KB |
2 |
gstatic.com
fonts.gstatic.com |
62 KB |
1 |
windows.net
dotcomaramexprod.blob.core.windows.net |
2 KB |
22 | 5 |
Domain | Requested by | |
---|---|---|
10 | www.aramex.com |
aramks-sa-pay.netlify.app
www.aramex.com |
6 | aramks-sa-pay.netlify.app |
aramks-sa-pay.netlify.app
|
3 | fonts.googleapis.com |
www.aramex.com
|
2 | fonts.gstatic.com |
fonts.googleapis.com
|
1 | dotcomaramexprod.blob.core.windows.net |
aramks-sa-pay.netlify.app
|
22 | 5 |
This site contains links to these domains. Also see Links.
Domain |
---|
dotcomaramexprod.blob.core.windows.net |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.netlify.app DigiCert Global G2 TLS RSA SHA256 2020 CA1 |
2024-01-15 - 2025-02-14 |
a year | crt.sh |
www.aramex.com R3 |
2024-03-05 - 2024-06-03 |
3 months | crt.sh |
upload.video.google.com GTS CA 1C3 |
2024-03-04 - 2024-05-27 |
3 months | crt.sh |
*.gstatic.com GTS CA 1C3 |
2024-03-04 - 2024-05-27 |
3 months | crt.sh |
*.blob.core.windows.net Microsoft RSA TLS CA 01 |
2023-09-28 - 2024-09-28 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://aramks-sa-pay.netlify.app/
Frame ID: 902E403D459EC92C0054811FF1AFE16F
Requests: 22 HTTP requests in this frame
Screenshot
Page Title
الرئيسية - أرامكسDetected technologies
Bootstrap (Web Frameworks) ExpandDetected patterns
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Netlify (Web Servers) Expand
Detected patterns
- ^https?://[^/]+\.netlify\.(?:com|app)/
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: هنا
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
22 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
aramks-sa-pay.netlify.app/ |
483 KB 38 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
project-arabic.css
www.aramex.com/Sitefinity/WebsiteTemplates/aramex-ar/App_Themes/aramex-ar/Global-New/ |
915 KB 207 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
widgets.min.css
www.aramex.com/Sitefinity/WebsiteTemplates/aramex/App_Themes/aramex/global/ |
131 KB 21 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
popper.min.js
www.aramex.com/ResourcePackages/Bootstrap4/assets/dist/js/ |
21 KB 10 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
new-vendors.js
www.aramex.com/Sitefinity/WebsiteTemplates/Global_them/js/ |
574 KB 179 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
GuestPrepareShipment_ar.css
www.aramex.com/Widgets/GuestPrepareShipment/ |
76 KB 12 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
check-ic.svg
aramks-sa-pay.netlify.app/Sitefinity/WebsiteTemplates/aramex/App_Themes/aramex/Images/svg/ |
3 KB 3 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
check-ic.svg
www.aramex.com/Sitefinity/WebsiteTemplates/aramex/App_Themes/aramex/Images/svg/ |
602 B 796 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mobile-ic.svg
aramks-sa-pay.netlify.app/Sitefinity/WebsiteTemplates/aramex/App_Themes/aramex/Images/svg/ |
3 KB 3 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mobile-active-ic.svg
aramks-sa-pay.netlify.app/Sitefinity/WebsiteTemplates/aramex/App_Themes/aramex/Images/svg/ |
3 KB 3 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
droidarabickufi.css
fonts.googleapis.com/earlyaccess/ |
1 KB 624 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
notokufiarabic.css
fonts.googleapis.com/earlyaccess/ |
39 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css2
fonts.googleapis.com/ |
3 KB 527 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
DroidKufi-Regular.woff2
fonts.gstatic.com/ea/droidarabickufi/v6/ |
31 KB 31 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
check-ic.svg
www.aramex.com/Sitefinity/WebsiteTemplates/aramex/App_Themes/aramex/Images/svg/ |
602 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
check-ic.svg
aramks-sa-pay.netlify.app/Sitefinity/WebsiteTemplates/aramex/App_Themes/aramex/Images/svg/ |
3 KB 3 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
flags.webp
www.aramex.com/Sitefinity/WebsiteTemplates/aramex-ar/App_Themes/aramex-ar/images/ |
32 KB 33 KB |
Image
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
DroidKufi-Bold.woff2
fonts.gstatic.com/ea/droidarabickufi/v6/ |
31 KB 31 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Aramex%20logo%20Arabic.webp
www.aramex.com/Sitefinity/WebsiteTemplates/aramex-ar/App_Themes/aramex-ar/Images/ |
1 KB 2 KB |
Image
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
aramex-logo-ar.png
dotcomaramexprod.blob.core.windows.net/default/docs/default-source/default-document-library/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
tiktok.svg
www.aramex.com/Sitefinity/WebsiteTemplates/aramex/App_Themes/aramex/Images/ |
625 B 743 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
favicon.ico
aramks-sa-pay.netlify.app/ |
3 KB 1 KB |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Malicious
page.url
Submitted on
April 15th 2024, 11:50:43 pm
UTC —
From Saudi Arabia
Threats:
Phishing
Comment: this website
https://aramks-sa-pay.netlify.app/
claiming to be Aramex shipping company in Saudi Arabia
and this is fake and phishing and not true at all
the Website asks for private information such as credit card number and password
all of this Is to steal the victim money
see this picture on this link
https://i.ibb.co/bgDTRqj/Screenshot-Samsung-Internet.jpg
the real website for Aramex in Saudi Arabia is
https://www.aramex.com/sa/en/home
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
16 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| Popper function| outdatedBrowser function| Swiper object| html5 object| Modernizr function| picturefill function| Hammer function| $ function| jQuery object| validator function| SearchIndex function| Bloodhound function| Pikaday function| $clamp function| iFrameResize object| bootstrap0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
13 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=31536000; includeSubDomains; preload |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
aramks-sa-pay.netlify.app
dotcomaramexprod.blob.core.windows.net
fonts.googleapis.com
fonts.gstatic.com
www.aramex.com
142.250.186.131
142.250.186.170
20.150.84.228
23.38.123.171
3.72.140.173
03f5c3670a8445c0af75a1b934be176f6c1cde339fbe76b1062cc51e590bca98
06eb9b648fd1429d0cef25265009259c35f053a76118194b4073c98e161812be
122e1196975502da0c78da989394f1bea82c85ffe1c1fb2a68f4c5afbeec42f1
31f02fb9a8ae77e5d8bb229bf73f473f783e8155042655926cafca211cd11c98
334189357f666a4ec8cabfb0d637dd0eb9e9001ed86ad22c97f6a2c6afc1bcc8
472906d3eadd9e3e3a4e801fa21ab87943422943baf1bb9406094d90a19d6b65
4af9dbcaaffc152724b379d0d7013aad64c4045bb13acd749b1faa0caf287d19
5106b39dafb4bac5f8907f6e45da6abdaa96493b6866c35dd8c40048fdda38e3
69e48d9db7c27991e0dce1a56f246fec93363cc286c71e6160282a31bf05e867
a4b78ef7475c88493b5e311bce2ed89d261e1010c508de78b88937587cd454d9
a7b09bb9c8e8e2fb189204e08ed94bd8096c118780b5e926847cf2748ca7c5c2
b875fb5945a28b4d03564e213c0278dae919d2e9e1cdc23de50ca11d2f81116a
bb186d0cd8d33b3f165441b35aaf1dea8df2afffe92a560b5327d5884ee178a3
d9ae85b109af37a1469fa34331b79998623455a565621153a239da342138df3f
db47e036d5f73d56b0ee26d89e97f30bd1a34c7178969f6dc1c9f32f08d4c9ba
f141610d0a97dc15a43605431f13ebe6de4f3bb48f01813611330a20d092b52f
f9e89b4f6953d21bb499efab058cfda5d474d58764532d2a0dfb903bb05a5051