aromac.xyz
Open in
urlscan Pro
172.67.157.175
Malicious Activity!
Public Scan
Effective URL: https://aromac.xyz/
Submission: On September 16 via api from PL — Scanned from PL
Summary
TLS certificate: Issued by WE1 on August 26th 2024. Valid for: 3 months.
This is the only time aromac.xyz was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Cloudflare (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 28 | 172.67.157.175 172.67.157.175 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
26 | 1 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
28 |
aromac.xyz
2 redirects
aromac.xyz |
966 KB |
26 | 1 |
Domain | Requested by | |
---|---|---|
28 | aromac.xyz |
2 redirects
aromac.xyz
|
26 | 1 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
aromac.xyz WE1 |
2024-08-26 - 2024-11-24 |
3 months | crt.sh |
This page contains 2 frames:
Primary Page:
https://aromac.xyz/
Frame ID: 104223EA4F9FBCDA7971BC0557F2BABC
Requests: 24 HTTP requests in this frame
Frame:
https://aromac.xyz/cdn-cgi/challenge-platform/h/b/scripts/jsd/388c99dd0998/main.js
Frame ID: 088494DD7F875D7E76439AB261E96192
Requests: 2 HTTP requests in this frame
Screenshot
Page Title
Immediate ProPage URL History Show full URLs
-
http://aromac.xyz/
HTTP 307
https://aromac.xyz/ Page URL
-
https://aromac.xyz/cdn-cgi/phish-bypass?atok=5tTxSNZrQT1frnWW52GTUP7h_7el6tp9n7oSCl0ci8U-172647...
HTTP 301
https://aromac.xyz/ Page URL
Detected technologies
jQuery (JavaScript Libraries) ExpandDetected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://aromac.xyz/
HTTP 307
https://aromac.xyz/ Page URL
-
https://aromac.xyz/cdn-cgi/phish-bypass?atok=5tTxSNZrQT1frnWW52GTUP7h_7el6tp9n7oSCl0ci8U-1726475445-0.0.1.1-%2F
HTTP 301
https://aromac.xyz/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://aromac.xyz/ HTTP 307
- https://aromac.xyz/
- https://aromac.xyz/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
- https://aromac.xyz/cdn-cgi/challenge-platform/h/b/scripts/jsd/388c99dd0998/main.js
26 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H3 |
/
aromac.xyz/ Redirect Chain
|
4 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
cf.errors.css
aromac.xyz/cdn-cgi/styles/ |
23 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
icon-exclamation.png
aromac.xyz/cdn-cgi/images/ |
452 B 634 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
favicon.ico
aromac.xyz/ |
139 B 538 B |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
Primary Request
/
aromac.xyz/ Redirect Chain
|
16 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
main.min.css
aromac.xyz/css/ |
6 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
fonts.css
aromac.xyz/css/ |
683 B 752 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
index.css
aromac.xyz/css/ |
5 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
form.css
aromac.xyz/css/ |
6 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
cookie.css
aromac.xyz/css/ |
915 B 977 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
styles.css
aromac.xyz/css/ |
10 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
modal.css
aromac.xyz/css/ |
785 B 965 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
clock_tablet.png
aromac.xyz/images/ |
9 KB 10 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
castle_tablet.png
aromac.xyz/images/ |
8 KB 8 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
confident_tablet.png
aromac.xyz/images/ |
9 KB 9 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
jquery-3.7.1.js
aromac.xyz/js/ |
324 KB 88 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
main.js
aromac.xyz/js/ |
839 B 849 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
script.js
aromac.xyz/js/ |
764 B 938 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
img_1-min.jpg
aromac.xyz/images/ |
659 KB 659 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
Vector.svg
aromac.xyz/images/ |
658 B 949 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
ProximaNova-Regular.woff
aromac.xyz/fonts/ |
51 KB 52 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
ProximaNova-Bold.woff
aromac.xyz/fonts/ |
51 KB 52 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
ProximaNova-Extrabld.woff
aromac.xyz/fonts/ |
50 KB 51 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
main.js
aromac.xyz/cdn-cgi/challenge-platform/h/b/scripts/jsd/388c99dd0998/ Frame 0884 Redirect Chain
|
8 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
8c3f7f25d97734e5
aromac.xyz/cdn-cgi/challenge-platform/h/b/jsd/r/ Frame 0884 |
0 905 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
fav.ico
aromac.xyz/images/ |
91 KB 4 KB |
Other
image/vnd.microsoft.icon |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Cloudflare (Online)4 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| yearDisclaimerNew function| $ function| jQuery2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.aromac.xyz/ | Name: __cf_mw_byp Value: 5tTxSNZrQT1frnWW52GTUP7h_7el6tp9n7oSCl0ci8U-1726475445-0.0.1.1-/ |
|
.aromac.xyz/ | Name: cf_clearance Value: Bb1GYQbCi9KNAPsmIGaNEjcrfQrdydBvqEVgBqpItds-1726475450-1.2.1.1-28ETdWawxLXT9wQYZ1MmRs87GH88W3e4NpbciwDkqd5ms0gAe0u7cz4cIa1NDJxGX8wjkRxNcC_.K9Cup8dlytaeHGCPizFcoeL4Z0darreoiXarqHcxpsGhRxO_2ZD.UCTA332pMYv8_eeoFfSpD4miHuBnutlZgIYlxIRM85tANpuf0_PPZNAAd3s.GsH1YWJlQ6FRe_9n99LitHxmVblq03kKloe_NTGcIQlywhGWcZT0Khc6PHKAr_yq_wsmR.uIjvT._HbKT27ORP2WXCgvi61jHX8H7t2cTJ56dgtmirZjtH_IHkEGC7ggpcpfF7.XcC_V5GpNVVxq3S6LfJbfAG0ZRZjtS1vQbt6weF2FN7c1soun0S.DK.qijDR0 |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Frame-Options | SAMEORIGIN |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
aromac.xyz
172.67.157.175
307f2bcd15520fc8f5d71936b1bd8a2a97770ede859f7a75d633fd828f291a69
30dbd7b5e633819b6e4610d1b2b1307c613621adf423dbf5437e95de95d3aa17
3f7074783c5966f0c890a3a112b8e8c6c68468c4305a04aafaffc1d25f1f660e
4cca7cc3915ee966973179dce5dd4c61a3cee84ce0d2f91441c3885592544f7c
50247e8195b89c960cb7238e2542f485b5386876d27d690b8dd2745a9107f0e8
54649217b71b281de0bdaccd131906fc75e11abacdc0e64a55e5d1c1974e3b4d
5b9b501dce07ff48d1cecdd86c131524993b453b65dfd83389ece70a334081c9
627edc7af1a77f8be3cf27ed6c4e972a419e510e94ffecdf36cdd8a43b370449
73e783c47a79eb1da30ce7b344af5297b1118bb2b408f10c8e9d1840cac5b113
81c6d1a13227777d009f275f5ecb80bd6c780d2843b9b18fe2809ff9822a2066
84e3c77025ace5af143972b4a40fc834dcdfd4e449d4b36a57e62326f16b3091
99a24fdd4e16d8dd4fdd79a5dd2dd7b71c2c68473fd6b3cb4eca4fa3f33d9ac1
99c8b9b254d39a79e4c5b9361ec8cd7980d4b947639f57403b150b3784d4eb05
ab0b12972401ac5a0cb20b1095f55f67cfbe6b9b905d6c4d38fbb5fd7b33b93b
ae02621dc87db43eb7fc2a6d67ce3fc12d848b4291ce62e9a06ebc806ea57ad3
ae3c096563174ca8bfe6a1ac3ec84feddd75f5ea5cccac9b21ee4c6de1205030
bacfe29ae65ca4e070d60e9d3dd073d510d4c92c9d57e4fd2055ebe2614f8b73
c6e4f6e0b32c8dd6a033cd93b921fec58c93a9c5f5a7089ba261ba23651a2549
ca82db648d147f7963a2d2fcb33dabacf83c4d128a23632f39ae3722210c475b
d1085c7e74f3bab5ac8cc264dabb5e36859d1425c8b3087b9c94c291ee29d7d3
d5c147348b5f3b9c99e8faf8cd3deaf749dbfdd215ceda25c86e117ec71fca8d
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e42e98c2461175554aba95f64d85a49488d1cc2b48d8eb7579e5b2a5016f5083
f10eb8cc0cf0ff162da018e8590df5294d4e85db52425f1e51bfaf5da4016928
f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016
f4934273a223c73bddd6c84969b6c3f7acbeb410338b1124090493e12c33c29f