urlscan.io logo urlscan.io
SecurityTrails logo

salvadorfernandez.net Open in urlscan Pro
46.21.192.6  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://salvadorfernandez.net/drupal/webmail.aruba.it/Logon.html
Submission Tags: @ipnigh
Submission: On April 27 via api from GB
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 11 HTTP transactions. The main IP is 46.21.192.6, located in Madrid, Spain and belongs to EURO-WEB-AS, FR. The main domain is salvadorfernandez.net.
TLS certificate: Issued by Let's Encrypt Authority X3 on March 27th 2020. Valid for: 3 months.
This is the only time salvadorfernandez.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Aruba (Online)

Domain & IP information

IP Address AS Autonomous System
1 46.21.192.6 35393 (EURO-WEB-AS)
7 62.149.188.175 31034 (ARUBA-ASN)
11 3
Domain Requested by
7 admin.aruba.it salvadorfernandez.net
1 salvadorfernandez.net
0 visual.arubamediamarketing.it Failed salvadorfernandez.net
0 tracks.arubamediamarketing.it Failed salvadorfernandez.net
11 4
Subject Issuer Validity Valid
salvadorfernandez.net
Let's Encrypt Authority X3		 2020-03-27 -
2020-06-25		 3 months crt.sh
admin.aruba.it
Actalis Extended Validation Server CA G2		 2019-03-20 -
2021-03-20		 2 years crt.sh

This page contains 1 frames:

Primary Page: https://salvadorfernandez.net/drupal/webmail.aruba.it/Logon.html
Frame ID: 008DBBAF98492C28F02C678F44EC811A
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

11
Requests

73 %
HTTPS

0 %
IPv6

3
Domains

4
Subdomains

3
IPs

2
Countries

36 kB
Transfer

42 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request Logon.html
salvadorfernandez.net/drupal/webmail.aruba.it/ 		12 KB
13 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://salvadorfernandez.net/drupal/webmail.aruba.it/Logon.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
46.21.192.6 Madrid, Spain, ASN35393 (EURO-WEB-AS, FR),
Reverse DNS
web6.magiconline.es
Software
Apache / PleskLin
Resource Hash
b62fe5fb9f3a3a7ee7f322bc3cf1cf4cdc1d485b5d8dd8dc8395cf0d66a4b5cf

Request headers

Host
salvadorfernandez.net
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
none
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1
Sec-Fetch-Dest
document
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 27 Apr 2020 08:37:43 GMT
Server
Apache
Last-Modified
Sun, 16 Jun 2019 18:08:46 GMT
ETag
"30aa-58b74c557ba8b"
Accept-Ranges
bytes
Content-Length
12458
Cache-Control
max-age=1
Expires
Mon, 27 Apr 2020 08:37:44 GMT
X-Powered-By
PleskLin
Keep-Alive
timeout=5, max=100
Connection
Keep-Alive
Content-Type
text/html
javascript_cookies.js
admin.aruba.it/PannelloAdmin/ 		2 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://admin.aruba.it/PannelloAdmin/javascript_cookies.js
Requested by
Host: salvadorfernandez.net
URL: https://salvadorfernandez.net/drupal/webmail.aruba.it/Logon.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
62.149.188.175 Arezzo, Italy, ASN31034 (ARUBA-ASN, IT),
Reverse DNS
Software
Microsoft-IIS/8.5 / ASP.NET
Resource Hash
e89c0f39c5016431213a8d45f4d5f4639b2bd38af7c45711975746bbe6aef4da

Request headers

Referer
https://salvadorfernandez.net/drupal/webmail.aruba.it/Logon.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 27 Apr 2020 08:37:42 GMT
Last-Modified
Sat, 11 Apr 2020 13:25:32 GMT
Server
Microsoft-IIS/8.5
X-Powered-By
ASP.NET
ETag
"0aedbac410d61:0"
Content-Type
application/javascript
Accept-Ranges
bytes
Content-Length
2112
Login.css
admin.aruba.it/PannelloAdmin/ 		11 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://admin.aruba.it/PannelloAdmin/Login.css?v1.0
Requested by
Host: salvadorfernandez.net
URL: https://salvadorfernandez.net/drupal/webmail.aruba.it/Logon.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
62.149.188.175 Arezzo, Italy, ASN31034 (ARUBA-ASN, IT),
Reverse DNS
Software
Microsoft-IIS/8.5 / ASP.NET
Resource Hash
9cccb34e1743089bb7cbd1596f51dea4fe898adb1118fb7bd44c49812083182e

Request headers

Referer
https://salvadorfernandez.net/drupal/webmail.aruba.it/Logon.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 27 Apr 2020 08:37:42 GMT
Content-Encoding
gzip
Last-Modified
Sat, 11 Apr 2020 13:25:32 GMT
Server
Microsoft-IIS/8.5
X-Powered-By
ASP.NET
ETag
"0aedbac410d61:0"
Vary
Accept-Encoding
Content-Type
text/css
Accept-Ranges
bytes
Content-Length
2828
logo_aruba.png
admin.aruba.it/PannelloAdmin/UI/Images/general_tmpl/ 		9 KB
9 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://admin.aruba.it/PannelloAdmin/UI/Images/general_tmpl/logo_aruba.png
Requested by
Host: salvadorfernandez.net
URL: https://salvadorfernandez.net/drupal/webmail.aruba.it/Logon.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
62.149.188.175 Arezzo, Italy, ASN31034 (ARUBA-ASN, IT),
Reverse DNS
Software
Microsoft-IIS/8.5 / ASP.NET
Resource Hash
2b5da352f8cac1ec98ed11f27d0d4661aac2f6473096a11bbeb636d34fd20e67

Request headers

Referer
https://salvadorfernandez.net/drupal/webmail.aruba.it/Logon.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 27 Apr 2020 08:37:43 GMT
Last-Modified
Sat, 11 Apr 2020 13:25:26 GMT
Server
Microsoft-IIS/8.5
X-Powered-By
ASP.NET
ETag
"02748a9410d61:0"
Content-Type
image/png
Accept-Ranges
bytes
Content-Length
9433
imgCaratteristicheAccesso.png
admin.aruba.it/PannelloAdmin/image_pannello_controllo/ 		508 B
753 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://admin.aruba.it/PannelloAdmin/image_pannello_controllo/imgCaratteristicheAccesso.png
Requested by
Host: salvadorfernandez.net
URL: https://salvadorfernandez.net/drupal/webmail.aruba.it/Logon.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
62.149.188.175 Arezzo, Italy, ASN31034 (ARUBA-ASN, IT),
Reverse DNS
Software
Microsoft-IIS/8.5 / ASP.NET
Resource Hash
b1adb27a5e38c7bbbfd8712b4103eb8e405d2bca562e600c7787a214be6c99e9

Request headers

Referer
https://salvadorfernandez.net/drupal/webmail.aruba.it/Logon.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 27 Apr 2020 08:37:43 GMT
Last-Modified
Sat, 11 Apr 2020 13:25:32 GMT
Server
Microsoft-IIS/8.5
X-Powered-By
ASP.NET
ETag
"0aedbac410d61:0"
Content-Type
image/png
Accept-Ranges
bytes
Content-Length
508
arrox_previous.png
admin.aruba.it/PannelloAdmin/image_pannello_controllo/ 		338 B
583 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://admin.aruba.it/PannelloAdmin/image_pannello_controllo/arrox_previous.png
Requested by
Host: salvadorfernandez.net
URL: https://salvadorfernandez.net/drupal/webmail.aruba.it/Logon.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
62.149.188.175 Arezzo, Italy, ASN31034 (ARUBA-ASN, IT),
Reverse DNS
Software
Microsoft-IIS/8.5 / ASP.NET
Resource Hash
399db74019a306cb82125431dbbb99137dffa0669d9b84b3cd4dded32b438f5d

Request headers

Referer
https://salvadorfernandez.net/drupal/webmail.aruba.it/Logon.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 27 Apr 2020 08:37:43 GMT
Last-Modified
Sat, 11 Apr 2020 13:25:32 GMT
Server
Microsoft-IIS/8.5
X-Powered-By
ASP.NET
ETag
"0aedbac410d61:0"
Content-Type
image/png
Accept-Ranges
bytes
Content-Length
338
imgHaiPersoDati.png
admin.aruba.it/PannelloAdmin/image_pannello_controllo/ 		775 B
1020 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://admin.aruba.it/PannelloAdmin/image_pannello_controllo/imgHaiPersoDati.png
Requested by
Host: salvadorfernandez.net
URL: https://salvadorfernandez.net/drupal/webmail.aruba.it/Logon.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
62.149.188.175 Arezzo, Italy, ASN31034 (ARUBA-ASN, IT),
Reverse DNS
Software
Microsoft-IIS/8.5 / ASP.NET
Resource Hash
8ab2d4dd46d9a7d2997be422628f891222a304e1b0c9bed486129ae6f0f9eb96

Request headers

Referer
https://salvadorfernandez.net/drupal/webmail.aruba.it/Logon.html
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 27 Apr 2020 08:37:43 GMT
Last-Modified
Sat, 11 Apr 2020 13:25:32 GMT
Server
Microsoft-IIS/8.5
X-Powered-By
ASP.NET
ETag
"0aedbac410d61:0"
Content-Type
image/png
Accept-Ranges
bytes
Content-Length
775
tsends.js
tracks.arubamediamarketing.it/track/ 		0
0
59b1da0be8266e06e6a75a5d0f2aa14d.js
visual.arubamediamarketing.it/cjs/ 		0
0
include.js
visual.arubamediamarketing.it/track/ 		0
0
PannelloControlloBottomLogo.png
admin.aruba.it/PannelloAdmin/image_pannello_controllo/ 		6 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://admin.aruba.it/PannelloAdmin/image_pannello_controllo/PannelloControlloBottomLogo.png
Requested by
Host: salvadorfernandez.net
URL: https://salvadorfernandez.net/drupal/webmail.aruba.it/Logon.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
62.149.188.175 Arezzo, Italy, ASN31034 (ARUBA-ASN, IT),
Reverse DNS
Software
Microsoft-IIS/8.5 / ASP.NET
Resource Hash
336a136d1ec7b4f2fa42ebaf724293a544b0451fa6b254778d59672d49a1ac12

Request headers

Referer
https://admin.aruba.it/PannelloAdmin/Login.css?v1.0
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Mon, 27 Apr 2020 08:37:43 GMT
Last-Modified
Sat, 11 Apr 2020 13:25:34 GMT
Server
Microsoft-IIS/8.5
X-Powered-By
ASP.NET
ETag
"0dbcae410d61:0"
Content-Type
image/png
Accept-Ranges
bytes
Content-Length
6604

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
tracks.arubamediamarketing.it
URL
https://tracks.arubamediamarketing.it/track/tsends.js
Domain
visual.arubamediamarketing.it
URL
https://visual.arubamediamarketing.it/cjs/59b1da0be8266e06e6a75a5d0f2aa14d.js
Domain
visual.arubamediamarketing.it
URL
https://visual.arubamediamarketing.it/track/include.js

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Aruba (Online)

16 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate function| Get_Cookie function| Set_Cookie function| createCookie function| Delete_Cookie function| SetLingua function| setCaretPosition function| cda function| clickButton object| vp3_startSess object| today function| print_date number| year boolean| cookie_set string| us

0 Cookies