8incoada.sa.com - urlscan.io

Summary

This website contacted 2 IPs in 2 countries across 4 domains to perform 4 HTTP transactions. The main IP is 69.49.245.118, located in United States and belongs to NETWORK-SOLUTIONS-HOSTING, US. The main domain is 8incoada.sa.com.
TLS certificate: Issued by R11 on June 27th 2024. Valid for: 3 months.

This is the only time 8incoada.sa.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Aruba (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 1	154.12.247.213 154.12.247.213	40021 (NL-811-40021) (NL-811-40021)
1 1	2a01:4f8:d0a:... 2a01:4f8:d0a:52b9::2	24940 (HETZNER-AS) (HETZNER-AS)
1	69.49.245.118 69.49.245.118	19871 (NETWORK-S...) (NETWORK-SOLUTIONS-HOSTING)
3	199.232.196.193 199.232.196.193	54113 (FASTLY) (FASTLY)
4	2

1 154.12.247.213 (Seattle, United States) 1 redirects

ASN40021 (NL-811-40021, US)
PTR: vmi1404936.contaboserver.net

hey.tf	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a01:4f8:d0a:52b9::2 (Bad Soden-Salmuenster, Germany) 1 redirects

ASN24940 (HETZNER-AS, DE)

li-nk.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.49.245.118 (United States)

ASN19871 (NETWORK-SOLUTIONS-HOSTING, US)
PTR: 69-49-245-118.webhostbox.net

8incoada.sa.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 199.232.196.193 (United States)

ASN54113 (FASTLY, US)

i.imgur.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	imgur.com i.imgur.com — Cisco Umbrella Rank: 6864	260 KB
1	sa.com 8incoada.sa.com	3 KB
1	li-nk.net 1 redirects li-nk.net	327 B
1	hey.tf 1 redirects hey.tf	211 B
4	4

	Domain	Requested by
3	i.imgur.com	8incoada.sa.com
1	8incoada.sa.com
1	li-nk.net	1 redirects
1	hey.tf	1 redirects
4	4

This site contains no links.

Subject Issuer	Validity	Valid
8incoada.sa.com R11	`2024-06-27` - `2024-09-25`	3 months	crt.sh
*.imgur.com Sectigo RSA Domain Validation Secure Server CA	`2024-02-15` - `2025-02-14`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://8incoada.sa.com/usr/webmailbeta.aruba.it/my_account.main_user_upgrade/mailbox_aruba.sign_in/cms/verifica.htm
Frame ID: 2FDE0B11595BEED9E0B31E8201D12DFB
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Webmail Aruba

Page URL History Show full URLs

https://hey.tf/1p HTTP 301
https://li-nk.net/ATTDo HTTP 301
https://8incoada.sa.com/usr/webmailbeta.aruba.it/my_account.main_user_upgrade/mailbox_aruba.sign_in/... Page URL

Page Statistics

4
Requests

100 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

2
IPs

2
Countries

264 kB
Transfer

262 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://hey.tf/1p HTTP 301
https://li-nk.net/ATTDo HTTP 301
https://8incoada.sa.com/usr/webmailbeta.aruba.it/my_account.main_user_upgrade/mailbox_aruba.sign_in/cms/verifica.htm Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request verifica.htm Show response
8incoada.sa.com/usr/webmailbeta.aruba.it/my_account.main_user_upgrade/mailbox_aruba.sign_in/cms/
Redirect Chain

https://hey.tf/1p
https://li-nk.net/ATTDo
https://8incoada.sa.com/usr/webmailbeta.aruba.it/my_account.main_user_upgrade/mailbox_aruba.sign_in/cms/verifica.htm

3 KB
3 KB

443ms
134ms

Document
text/html

69.49.245.118
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to

Full URL: https://8incoada.sa.com/usr/webmailbeta.aruba.it/my_account.main_user_upgrade/mailbox_aruba.sign_in/cms/verifica.htm
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 69.49.245.118 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: 69-49-245-118.webhostbox.net
Software: Apache /
Resource Hash: 97e07417225996b7e0ccdbcc18223841de187de8c6d018fa8d02a4d581633403

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Accept-Ranges: bytes
Connection: Keep-Alive
Content-Length: 2997
Content-Type: text/html
Date: Tue, 09 Jul 2024 06:25:44 GMT
Keep-Alive: timeout=5, max=100
Last-Modified: Mon, 08 Jul 2024 19:50:36 GMT
Server: Apache

Redirect headers

cache-control: no-store, no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=utf-8
date: Tue, 09 Jul 2024 06:25:43 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
location: https://8incoada.sa.com/usr/webmailbeta.aruba.it/my_account.main_user_upgrade/mailbox_aruba.sign_in/cms/verifica.htm
pragma: no-cache
server: Apache

GET
H2 200 lnCZ7Ys.png
i.imgur.com/ 1 KB
2 KB 123ms
38ms Image
image/png 199.232.196.193
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.imgur.com/lnCZ7Ys.png

Requested by

Host: 8incoada.sa.com
URL: https://8incoada.sa.com/usr/webmailbeta.aruba.it/my_account.main_user_upgrade/mailbox_aruba.sign_in/cms/verifica.htm

Protocol

H2

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

199.232.196.193 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

cat factory 1.0 /

Resource Hash

32cb57ecd9a2ad6051ebd2620d2d1a7d5e8fe5aa37c283bd6ffe7e9bf29e51fb

Security Headers

Name	Value
Strict-Transport-Security	max-age=300
X-Content-Type-Options	nosniff

Request headers

Referer: https://8incoada.sa.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Tue, 09 Jul 2024 06:25:44 GMT
strict-transport-security: max-age=300
x-content-type-options: nosniff
x-amz-cf-pop: BOS50-P4
age: 661828
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront, HIT, HIT
content-length: 1211
x-served-by: cache-iad-kcgs7200029-IAD, cache-fra-etou8220030-FRA
last-modified: Fri, 28 Jun 2024 00:44:36 GMT
server: cat factory 1.0
x-timer: S1720506344.446286,VS0,VE1
etag: "3161ccaf487c5a7007e08ca1b41049c3"
access-control-allow-methods: GET, OPTIONS
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-amz-cf-id: snk97xqDSj90znwownlIC9R9NVJMimrBJX6dUQ7wA_cbSbyL44FGKA==
x-cache-hits: 9, 0

GET
H2 200 VtNNJUg.png
i.imgur.com/ 258 KB
258 KB 123ms
38ms Image
image/png 199.232.196.193
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.imgur.com/VtNNJUg.png

Requested by

Host: 8incoada.sa.com
URL: https://8incoada.sa.com/usr/webmailbeta.aruba.it/my_account.main_user_upgrade/mailbox_aruba.sign_in/cms/verifica.htm

Protocol

H2

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

199.232.196.193 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

cat factory 1.0 /

Resource Hash

b1364b6995d72b1f3d33ee472b5c280e7254f4549c4f79beefc9a4caa3fd0260

Security Headers

Name	Value
Strict-Transport-Security	max-age=300
X-Content-Type-Options	nosniff

Request headers

Referer: https://8incoada.sa.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Tue, 09 Jul 2024 06:25:44 GMT
strict-transport-security: max-age=300
x-content-type-options: nosniff
x-amz-cf-pop: IAD12-P2
age: 970850
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront, HIT, HIT
content-length: 263760
x-served-by: cache-iad-kjyo7100170-IAD, cache-fra-etou8220030-FRA
last-modified: Fri, 28 Jun 2024 00:44:54 GMT
server: cat factory 1.0
x-timer: S1720506344.446348,VS0,VE1
etag: "51dcc11e98b29491c1ca008d5d39e8fe"
access-control-allow-methods: GET, OPTIONS
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-amz-cf-id: HwWyUGVKe3YeN5DPIbaTUdAajLwJDFUUIb4LdwfhdsYKoDZyvGOUsw==
x-cache-hits: 9, 0

GET
H2 200 20hdBFK.png
i.imgur.com/ 609 B
832 B 39ms
39ms Other
image/png 199.232.196.193
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://i.imgur.com/20hdBFK.png

Protocol

H2

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

199.232.196.193 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

cat factory 1.0 /

Resource Hash

ca8abfd1e71a10c486a26be86954293c5f62e1ff94ac52f9270a41c285243c5a

Security Headers

Name	Value
Strict-Transport-Security	max-age=300
X-Content-Type-Options	nosniff

Request headers

Referer: https://8incoada.sa.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Tue, 09 Jul 2024 06:25:44 GMT
strict-transport-security: max-age=300
x-content-type-options: nosniff
age: 3261574
x-amz-cf-pop: JFK50-P6
x-cache: Miss from cloudfront, HIT, HIT
content-length: 609
x-served-by: cache-iad-kiad7000120-IAD, cache-fra-etou8220030-FRA
last-modified: Tue, 31 May 2022 07:42:56 GMT
server: cat factory 1.0
x-timer: S1720506345.603008,VS0,VE1
etag: "0ecb135733886ee9f5b6b3fb54baa6cf"
access-control-allow-methods: GET, OPTIONS
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-amz-cf-id: 6R1PkyZNdO9TdZsUY7Jxev3S9DIyDy2BtA2Zr3K5NKTMqi17oY4xPg==
x-cache-hits: 86, 0

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Aruba (Online)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			li-nk.net/	1969-12-31 23:59:59	Name: PHPSESSID Value: b2b9892e4deb36182a68d39855bff8e6
			li-nk.net/	1970-01-20 21:55:07	Name: short_74121 Value: 1

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	verbose	URL: https://8incoada.sa.com/usr/webmailbeta.aruba.it/my_account.main_user_upgrade/mailbox_aruba.sign_in/cms/verifica.htm Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

8incoada.sa.com
hey.tf
i.imgur.com
li-nk.net
154.12.247.213
199.232.196.193
2a01:4f8:d0a:52b9::2
69.49.245.118
32cb57ecd9a2ad6051ebd2620d2d1a7d5e8fe5aa37c283bd6ffe7e9bf29e51fb
97e07417225996b7e0ccdbcc18223841de187de8c6d018fa8d02a4d581633403
b1364b6995d72b1f3d33ee472b5c280e7254f4549c4f79beefc9a4caa3fd0260
ca8abfd1e71a10c486a26be86954293c5f62e1ff94ac52f9270a41c285243c5a

8incoada.sa.com Open in urlscan Pro 69.49.245.118 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

4 Requests

100 %HTTPS

25 %IPv6

4 Domains

4 Subdomains

2 IPs

2 Countries

264 kBTransfer

262 kBSize

2 Cookies

0 Outgoing links

Page URL History

Redirected requests

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

2 Cookies

1 Console Messages

Indicators

8incoada.sa.com Open in urlscan Pro
69.49.245.118 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

4
Requests

100 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

2
IPs

2
Countries

264 kB
Transfer

262 kB
Size

2
Cookies

4 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!