sign-cvlspwpe9k33dnf98u4l5vj3nil8efyr3wtj4ls8yyn.hb.ru-msk.vkcs.cloud
Open in
urlscan Pro
95.163.53.117
Malicious Activity!
Public Scan
Effective URL: https://sign-cvlspwpe9k33dnf98u4l5vj3nil8efyr3wtj4ls8yyn.hb.ru-msk.vkcs.cloud/index.html
Submission: On July 05 via automatic, source phishtank — Scanned from DE
Summary
TLS certificate: Issued by GlobalSign RSA OV SSL CA 2018 on February 21st 2023. Valid for: 10 months.
This is the only time sign-cvlspwpe9k33dnf98u4l5vj3nil8efyr3wtj4ls8yyn.hb.ru-msk.vkcs.cloud was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Aruba (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 | 95.163.53.117 95.163.53.117 | 47764 (VK-AS) (VK-AS) | |
1 | 2a00:1450:400... 2a00:1450:4001:80f::200a | 15169 (GOOGLE) (GOOGLE) | |
10 | 162.0.222.139 162.0.222.139 | 22612 (NAMECHEAP...) (NAMECHEAP-NET) | |
1 | 2a00:1450:400... 2a00:1450:4001:813::200a | 15169 (GOOGLE) (GOOGLE) | |
2 | 2a00:1450:400... 2a00:1450:4001:80f::2003 | 15169 (GOOGLE) (GOOGLE) | |
16 | 5 |
ASN47764 (VK-AS, RU)
PTR: hb.ru-msk.vkcs.cloud
sign-cvlspwpe9k33dnf98u4l5vj3nil8efyr3wtj4ls8yyn.hb.ru-msk.vkcs.cloud |
Apex Domain Subdomains |
Transfer | |
---|---|---|
10 |
arabcoinvestmentltd.online
arabcoinvestmentltd.online |
170 KB |
2 |
gstatic.com
fonts.gstatic.com |
46 KB |
2 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 88 ajax.googleapis.com — Cisco Umbrella Rank: 433 |
31 KB |
2 |
vkcs.cloud
sign-cvlspwpe9k33dnf98u4l5vj3nil8efyr3wtj4ls8yyn.hb.ru-msk.vkcs.cloud |
4 KB |
16 | 4 |
Domain | Requested by | |
---|---|---|
10 | arabcoinvestmentltd.online |
sign-cvlspwpe9k33dnf98u4l5vj3nil8efyr3wtj4ls8yyn.hb.ru-msk.vkcs.cloud
arabcoinvestmentltd.online |
2 | fonts.gstatic.com |
fonts.googleapis.com
|
2 | sign-cvlspwpe9k33dnf98u4l5vj3nil8efyr3wtj4ls8yyn.hb.ru-msk.vkcs.cloud |
sign-cvlspwpe9k33dnf98u4l5vj3nil8efyr3wtj4ls8yyn.hb.ru-msk.vkcs.cloud
|
1 | ajax.googleapis.com |
sign-cvlspwpe9k33dnf98u4l5vj3nil8efyr3wtj4ls8yyn.hb.ru-msk.vkcs.cloud
|
1 | fonts.googleapis.com |
sign-cvlspwpe9k33dnf98u4l5vj3nil8efyr3wtj4ls8yyn.hb.ru-msk.vkcs.cloud
|
16 | 5 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.hb.ru-msk.vkcs.cloud GlobalSign RSA OV SSL CA 2018 |
2023-02-21 - 2024-01-02 |
10 months | crt.sh |
upload.video.google.com GTS CA 1C3 |
2023-06-19 - 2023-09-11 |
3 months | crt.sh |
arabcoinvestmentltd.online cPanel, Inc. Certification Authority |
2023-06-29 - 2023-09-27 |
3 months | crt.sh |
*.gstatic.com GTS CA 1C3 |
2023-06-19 - 2023-09-11 |
3 months | crt.sh |
This page contains 2 frames:
Primary Page:
https://sign-cvlspwpe9k33dnf98u4l5vj3nil8efyr3wtj4ls8yyn.hb.ru-msk.vkcs.cloud/index.html
Frame ID: 8B2FE5E13E3430FFADB40FDF765B2D87
Requests: 15 HTTP requests in this frame
Frame:
https://sign-cvlspwpe9k33dnf98u4l5vj3nil8efyr3wtj4ls8yyn.hb.ru-msk.vkcs.cloud/left_block.html
Frame ID: 57D569FF74AB6307328521A674D8C945
Requests: 1 HTTP requests in this frame
Screenshot
Page Title
WebMail Aruba LoginDetected technologies
Google Font API (Font Scripts) ExpandDetected patterns
- <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
jQuery (JavaScript Libraries) Expand
Detected patterns
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
16 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
index.html
sign-cvlspwpe9k33dnf98u4l5vj3nil8efyr3wtj4ls8yyn.hb.ru-msk.vkcs.cloud/ |
19 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
2 KB 837 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
login.css
arabcoinvestmentltd.online/aruba%20html/web_imgs/login/css/ |
11 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/2.2.4/ |
84 KB 30 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
dojo.js
arabcoinvestmentltd.online/aruba%20html/javascript/startup/dojo/dojo/ |
89 KB 31 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
gb.png
arabcoinvestmentltd.online/aruba%20html/web_imgs/login/images/flag/ |
599 B 841 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
login.js
arabcoinvestmentltd.online/aruba%20html/ext_aruba/js/ |
20 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
S6uyw4BMUTPHjx4wXg.woff2
fonts.gstatic.com/s/lato/v24/ |
23 KB 24 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
left_block.html
sign-cvlspwpe9k33dnf98u4l5vj3nil8efyr3wtj4ls8yyn.hb.ru-msk.vkcs.cloud/ Frame 57D5 |
145 B 371 B |
Document
application/xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
left-block-image.jpg
arabcoinvestmentltd.online/aruba%20html/web_imgs/login/images/ |
122 KB 122 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
aruba-logo.svg
arabcoinvestmentltd.online/aruba%20html/web_imgs/login/images/ |
15 KB 6 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
envelope.svg
arabcoinvestmentltd.online/aruba%20html/web_imgs/login/images/ |
681 B 735 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
login-icon.svg
arabcoinvestmentltd.online/aruba%20html/web_imgs/login/images/ |
666 B 679 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
password-icon.svg
arabcoinvestmentltd.online/aruba%20html/web_imgs/login/images/ |
585 B 651 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
password-icon-2.svg
arabcoinvestmentltd.online/aruba%20html/web_imgs/login/images/ |
947 B 709 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
S6u9w4BMUTPHh6UVSwiPGQ.woff2
fonts.gstatic.com/s/lato/v24/ |
23 KB 23 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Aruba (Online)57 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 boolean| credentialless object| onbeforetoggle object| onscrollend function| $ function| jQuery object| dojo object| dijit object| dojox string| UX_LEGGERA string| UX_WEB2CS string| UX_FIZZER string| UX_HTML string| UX_PEC boolean| manage boolean| classic object| i18n_login function| isBrowserSupported object| JsonFormatter function| encodeCredentials function| login_setCredentials function| login_getCookie function| login_setCookie function| login_initAdvancedPage function| login_initPage function| login_initRadios function| displayTab function| getLanguage function| login_showPopup function| login_errorPopup function| login_hidePopup function| login_getSelectedUx function| launchLogin function| launchUser function| launchAdmin function| login_web2cs function| login_errorCallback function| isBetaOptimizable function| login_leggera function| auto_login function| isPecDomain function| login_pec function| login_html function| login_fizzer function| display_redirect function| showPassword function| onInputFocus function| onInputBlur function| onInputChange function| DOMContentLoadedListener function| login_setLanguageCookie function| loginGetLanguage function| login_initLocalization function| changeLanguage function| showLanguage function| login_localize function| fstring0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
4 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
arabcoinvestmentltd.online
fonts.googleapis.com
fonts.gstatic.com
sign-cvlspwpe9k33dnf98u4l5vj3nil8efyr3wtj4ls8yyn.hb.ru-msk.vkcs.cloud
162.0.222.139
2a00:1450:4001:80f::2003
2a00:1450:4001:80f::200a
2a00:1450:4001:813::200a
95.163.53.117
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
4ea2880bbb5055eb6493499d243a86911663924955d78ac35d672a5a0e9995ae
5b6011b21c9df9b7bf76d8f8124772b20d340b4dbf85fc510da8da287d899583
5cc109dd2ea302de6ee7df3c4dd0d4d25b41277efcf7f370f50efe934544fd0c
5d72c5a8bef80fca6f99f476e15ec95ce2d5e5f65c6dab9ee8e56348be0d39fc
5e96c408271ce2999c052da5821e78872d784aa9a08b87fc6f4fb036e46eab99
8955ee5e3071f91ed2460b5b634cdab6f6c15d5d8adefac0e3328de7f5889a97
918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537
926dbda18381253b1159a9d0d33866e018a6963edc64f53522ff9c5d53a4953f
a32e14929dae4030d8fe0164ac57453ec28a2927b4e6f22d445934b829f6df14
b94c5158a9afa36c819f92b1e85dc50d2119ed7319c13471c86b0326edfe680c
c447dd7677b419db7b21dbdfc6277c7816a913ffda76fd2e52702df538de0e49
c7eca97d84ed3469e7d1a20a8c28ef7177270b93a2d9913a0adad9a3e4bdfc9a
cc33975886ef8f7d3ebdcce9323d19bbe0729a87c6e29cec425d481547c81f7a
d1a498e72f62f80af25d958364158a781a8cdee723e700756b28756c97ee2fa1
fc803039b012ca6f8ecfc3295fa1a69e15655a62da20e3576276a6946e2dd806