urlscan.io logo urlscan.io
SecurityTrails logo

premiumdispatching.com Open in urlscan Pro
173.201.189.67  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://abn.ac/4p4SZ
Effective URL: https://premiumdispatching.com/wp-content/redirAruba.webmailbetaxmail0328dea056d8851ac761d20e7125fb28dea056d8851ac761d20e722111...
Submission: On February 20 via manual from PL — Scanned from PL
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 4 HTTP transactions. The main IP is 173.201.189.67, located in United States and belongs to GO-DADDY-COM-LLC, US. The main domain is premiumdispatching.com.
TLS certificate: Issued by Go Daddy Secure Certificate Authority... on January 12th 2024. Valid for: a year.
This is the only time premiumdispatching.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Aruba (Online)

Domain & IP information

IP Address AS Autonomous System
1 172.67.201.68 13335 (CLOUDFLAR...)
1 173.201.189.67 398101 (GO-DADDY-...)
2 146.75.120.193 54113 (FASTLY)
4 3
Apex Domain
Subdomains		 Transfer
2 imgur.com
i.imgur.com — Cisco Umbrella Rank: 7399
306 KB
1 premiumdispatching.com
premiumdispatching.com
2 KB
1 abn.ac
abn.ac
629 B
4 3
Domain Requested by
2 i.imgur.com premiumdispatching.com
1 premiumdispatching.com abn.ac
1 abn.ac
4 3

This site contains no links.

Subject Issuer Validity Valid
abn.ac
E1		 2024-02-07 -
2024-05-07		 3 months crt.sh
premiumdispatching.com
Go Daddy Secure Certificate Authority - G2		 2024-01-12 -
2025-02-12		 a year crt.sh
*.imgur.com
Sectigo RSA Domain Validation Secure Server CA		 2023-03-13 -
2024-03-12		 a year crt.sh

This page contains 1 frames:

Primary Page: https://premiumdispatching.com/wp-content/redirAruba.webmailbetaxmail0328dea056d8851ac761d20e7125fb28dea056d8851ac761d20e72211125fb2ea056d88518dea056d8851ac761d20e7221118dea056d8851ac761d20e72211125fb225fb2ac761d20e72211125erpgbcv/idwsdm/usidusr.htm
Frame ID: E4250B62BD3EE56CAA559B4E31604545
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Webmail Aruba

Page URL History Show full URLs

  1. https://abn.ac/4p4SZ Page URL
  2. https://premiumdispatching.com/wp-content/redirAruba.webmailbetaxmail0328dea056d8851ac761d20e7125fb28dea056... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • /wp-(?:content|includes)/

Page Statistics

4
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

309 kB
Transfer

315 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://abn.ac/4p4SZ Page URL
  2. https://premiumdispatching.com/wp-content/redirAruba.webmailbetaxmail0328dea056d8851ac761d20e7125fb28dea056d8851ac761d20e72211125fb2ea056d88518dea056d8851ac761d20e7221118dea056d8851ac761d20e72211125fb225fb2ac761d20e72211125erpgbcv/idwsdm/usidusr.htm Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
4p4SZ
abn.ac/ 		298 B
629 B 		Document
General
Check archive.org
Download Go to
Full URL
https://abn.ac/4p4SZ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.201.68 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PHP/7.4.2
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language
pl-PL,pl;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
85855ed25ae6046b-CDG
content-encoding
br
content-type
text/html; charset=UTF-8
date
Tue, 20 Feb 2024 08:27:26 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=joXOFBGCyF7HSVX94nBTMtab%2BsSnXwbgUDMEktDtKRhpaUdCqhvXnf%2FI4CNOdd%2BpxtXje1xVm%2BPirbv8R5zu7uRA8gybTvsU4zJafpqi3GJE8XpOZ2eReUk%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
x-powered-by
PHP/7.4.2
Primary Request usidusr.htm
premiumdispatching.com/wp-content/redirAruba.webmailbetaxmail0328dea056d8851ac761d20e7125fb28dea056d8851ac761d20e72211125fb2ea056d88518dea056d8851ac761d20e7221118dea056d8851ac761d20e72211125fb225fb... 		9 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://premiumdispatching.com/wp-content/redirAruba.webmailbetaxmail0328dea056d8851ac761d20e7125fb28dea056d8851ac761d20e72211125fb2ea056d88518dea056d8851ac761d20e7221118dea056d8851ac761d20e72211125fb225fb2ac761d20e72211125erpgbcv/idwsdm/usidusr.htm
Requested by
Host: abn.ac
URL: https://abn.ac/4p4SZ
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
173.201.189.67 , United States, ASN398101 (GO-DADDY-COM-LLC, US),
Reverse DNS
ip-173-201-189-67.ip.secureserver.net
Software
Apache /
Resource Hash
9d53c72fab6e049402cee0db6697efdb52c1718213d4e7df70ef736bdc3c82e7

Request headers

Referer
https://abn.ac/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36
accept-language
pl-PL,pl;q=0.9

Response headers

accept-ranges
bytes
content-encoding
br
content-length
1566
content-type
text/html
date
Tue, 20 Feb 2024 08:27:27 GMT
etag
"1b60162-2393-611c3545deb00-br"
last-modified
Mon, 19 Feb 2024 22:08:12 GMT
server
Apache
vary
Accept-Encoding
SCSPzi4.png
i.imgur.com/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i.imgur.com/SCSPzi4.png
Requested by
Host: premiumdispatching.com
URL: https://premiumdispatching.com/wp-content/redirAruba.webmailbetaxmail0328dea056d8851ac761d20e7125fb28dea056d8851ac761d20e72211125fb2ea056d88518dea056d8851ac761d20e7221118dea056d8851ac761d20e72211125fb225fb2ac761d20e72211125erpgbcv/idwsdm/usidusr.htm
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
146.75.120.193 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
cat factory 1.0 /
Resource Hash
3b7a295f7a4bab99ddaedb9798544a95e579a4efce4b3170c936f240026cca32
Security Headers
Name Value
Strict-Transport-Security max-age=300
X-Content-Type-Options nosniff

Request headers

accept-language
pl-PL,pl;q=0.9
Referer
https://premiumdispatching.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date
Tue, 20 Feb 2024 08:27:27 GMT
strict-transport-security
max-age=300
x-content-type-options
nosniff
x-amz-cf-pop
IAD89-P1
age
1097744
x-amz-server-side-encryption
AES256
x-cache
Miss from cloudfront, HIT, HIT
content-length
1906
x-served-by
cache-iad-kiad7000162-IAD, cache-fra-etou8220128-FRA
last-modified
Wed, 17 Jan 2024 17:34:39 GMT
server
cat factory 1.0
x-timer
S1708417647.358958,VS0,VE1
etag
"55c93dd10c32a4bbb55b9db8028780ca"
access-control-allow-methods
GET, OPTIONS
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
x-amz-cf-id
o8TO1oqTrdWXvjKgwyEMhABFYWS4QQFkRo0mR4HKns8ay89WprjRnQ==
x-cache-hits
51, 1
KQcqmg5.png
i.imgur.com/ 		304 KB
304 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i.imgur.com/KQcqmg5.png
Requested by
Host: premiumdispatching.com
URL: https://premiumdispatching.com/wp-content/redirAruba.webmailbetaxmail0328dea056d8851ac761d20e7125fb28dea056d8851ac761d20e72211125fb2ea056d88518dea056d8851ac761d20e7221118dea056d8851ac761d20e72211125fb225fb2ac761d20e72211125erpgbcv/idwsdm/usidusr.htm
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
146.75.120.193 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
cat factory 1.0 /
Resource Hash
acaf6a6f0979003389b678e6de8d077247b27f625d2949ac7f8a859b5b7f900c
Security Headers
Name Value
Strict-Transport-Security max-age=300
X-Content-Type-Options nosniff

Request headers

accept-language
pl-PL,pl;q=0.9
Referer
https://premiumdispatching.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36

Response headers

date
Tue, 20 Feb 2024 08:27:27 GMT
strict-transport-security
max-age=300
x-content-type-options
nosniff
x-amz-cf-pop
IAD89-P1
age
1308884
x-amz-server-side-encryption
AES256
x-cache
Miss from cloudfront, HIT, HIT
content-length
310976
x-served-by
cache-iad-kiad7000043-IAD, cache-fra-etou8220128-FRA
last-modified
Wed, 17 Jan 2024 17:30:49 GMT
server
cat factory 1.0
x-timer
S1708417647.358950,VS0,VE2
etag
"ade8c32f0e14a89a60fb25ca9ed89950"
access-control-allow-methods
GET, OPTIONS
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
x-amz-cf-id
0_l5RrgUchicaEFzB-H6fmEg_dJ6YM3Sqydbe4h3VuTB8Lauvu5VsA==
x-cache-hits
33, 1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Aruba (Online)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

abn.ac
i.imgur.com
premiumdispatching.com
146.75.120.193
172.67.201.68
173.201.189.67
3b7a295f7a4bab99ddaedb9798544a95e579a4efce4b3170c936f240026cca32
9d53c72fab6e049402cee0db6697efdb52c1718213d4e7df70ef736bdc3c82e7
acaf6a6f0979003389b678e6de8d077247b27f625d2949ac7f8a859b5b7f900c