![](/screenshots/73921ae7-f6b9-4de6-9fd9-b5ed142c3288.png)
mail-aruba.tk
Open in
urlscan Pro
185.120.7.1
Malicious Activity!
Public Scan
Submission Tags: 7404185
Submission: On January 06 via api from US — Scanned from IT
Summary
This is the only time mail-aruba.tk was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Aruba (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
7 | 185.120.7.1 185.120.7.1 | 25926 (HOSTUS-SO...) (HOSTUS-SOLUTIONS-LLC) | |
7 | 1 |
ASN25926 (HOSTUS-SOLUTIONS-LLC, US)
PTR: server54.mainpacket.com
mail-aruba.tk |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
mail-aruba.tk
mail-aruba.tk |
257 KB |
7 | 1 |
Domain | Requested by | |
---|---|---|
7 | mail-aruba.tk |
mail-aruba.tk
|
7 | 1 |
This site contains links to these domains. Also see Links.
Domain |
---|
guide.hosting.aruba.it |
webmail.aruba.it |
www.aruba.it |
Subject Issuer | Validity | Valid |
---|
This page contains 1 frames:
Primary Page:
http://mail-aruba.tk/
Frame ID: B251298B2E43E1A4F41DF38DB110A6DD
Requests: 7 HTTP requests in this frame
4 Outgoing links
These are links going to different origins than the main page.
Title: Forgotten your password?
Search URL Search Domain Scan URL
Title: Accessible version
Search URL Search Domain Scan URL
Title: Privacy policy
Search URL Search Domain Scan URL
Title: Cookie policy
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
7 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
mail-aruba.tk/ |
771 B 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
app.65891181.css
mail-aruba.tk/css/ |
10 KB 11 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
app.8d251d56.js
mail-aruba.tk/js/ |
25 KB 25 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
chunk-vendors.94c6015d.js
mail-aruba.tk/js/ |
116 KB 116 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bg.c8022bbb.jpeg
mail-aruba.tk/img/ |
88 KB 88 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
aruba-logo.9b8f9f3e.svg
mail-aruba.tk/img/ |
15 KB 15 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
envelope.c13dbf61.svg
mail-aruba.tk/img/ |
681 B 952 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Aruba (Online)4 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onsecuritypolicyviolation object| onslotchange object| webpackJsonp boolean| __VUE__0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
mail-aruba.tk
185.120.7.1
068dc4a2d059a3441923ac02ddd727d5dd53839bd4d84e688903ac56b8178451
2674ef6e8e32566e890dee65d9db476150e2c0fca4e0f7399b131171e51c86fb
2e46b967354cb12e86438e31c9ae53fb820a4d78f87c83548d4f5b3da5603173
5e96c408271ce2999c052da5821e78872d784aa9a08b87fc6f4fb036e46eab99
860083edbb0964a48afeb4b1857d048322724d7a709a6bf45245a273bc7983fb
a32e14929dae4030d8fe0164ac57453ec28a2927b4e6f22d445934b829f6df14
e8eca73020f1d72c08a566eaa337ca5db2b108e0c6bfd5fc0a7ed0bc8b422c44