aruba-it-983dfb47e22.gruporaotes.com.br Open in urlscan Pro
172.96.117.22 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://5b6bdb89.dbcorr.com.br/?id=arredamentibonacini.it
Effective URL:
http://aruba-it-983dfb47e22.gruporaotes.com.br/?290939e41&id=arredamentibonacini.it
Submission: On December 28 via manual (December 28th 2023, 8:46:49 am UTC) from IT — Scanned from IT

Summary HTTP 1 Redirects Links 8 Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 1 HTTP transactions. The main IP is 172.96.117.22, located in San Jose, United States and belongs to ZEN-ECN, US. The main domain is aruba-it-983dfb47e22.gruporaotes.com.br.

This is the only time aruba-it-983dfb47e22.gruporaotes.com.br was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Aruba (Online)

Domain & IP information

	IP Address		AS Autonomous System
1 2	172.96.117.22 172.96.117.22		21859 (ZEN-ECN) (ZEN-ECN)
1	2

2 172.96.117.22 (San Jose, United States) 1 redirects

ASN21859 (ZEN-ECN, US)

5b6bdb89.dbcorr.com.br	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
aruba-it-983dfb47e22.gruporaotes.com.br	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
1	gruporaotes.com.br aruba-it-983dfb47e22.gruporaotes.com.br	305 KB
1	dbcorr.com.br 1 redirects 5b6bdb89.dbcorr.com.br	267 B
1	2

	Domain	Requested by
1	aruba-it-983dfb47e22.gruporaotes.com.br
1	5b6bdb89.dbcorr.com.br	1 redirects
1	2

This site contains links to these domains. Also see Links.

Domain
managehosting.aruba.it
hosting.aruba.it
webmail.aruba.it
pagamenti.aruba.it
assistenza.aruba.it

Subject Issuer	Validity	Valid

This page contains 2 frames:

Primary Page: http://aruba-it-983dfb47e22.gruporaotes.com.br/?290939e41&id=arredamentibonacini.it
Frame ID: 269DE54076DCFA3F9D8D6A775098C40C
Requests: 10 HTTP requests in this frame

Frame: data://truncated
Frame ID: 11D4CE9ACB2FBAD39544FEA8C173A4B0
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Servizio Hosting - Aruba.it

Page URL History Show full URLs

http://5b6bdb89.dbcorr.com.br/?id=arredamentibonacini.it HTTP 302
http://aruba-it-983dfb47e22.gruporaotes.com.br/?290939e41&id=arredamentibonacini.it Page URL

Page Statistics

1
Requests

0 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

351 kB
Transfer

507 kB
Size

0
Cookies

8 Outgoing links

These are links going to different origins than the main page.

URL: https://managehosting.aruba.it/AreaUtenti.asp?Lang=EN
Title: English

Search URL Search Domain Scan URL

URL: https://managehosting.aruba.it/AreaUtenti.asp?Lang=ES
Title: Español

Search URL Search Domain Scan URL

URL: http://hosting.aruba.it/Home.aspx?Lang=it-IT
Title: home

Search URL Search Domain Scan URL

URL: https://webmail.aruba.it/
Title: webmail

Search URL Search Domain Scan URL

URL: https://managehosting.aruba.it/rinnovi/checkrinnovo.asp?Lang=IT
Title: rinnovi

Search URL Search Domain Scan URL

URL: https://pagamenti.aruba.it/Home/Default.aspx?Lang=it
Title: pagamenti

Search URL Search Domain Scan URL

URL: https://managehosting.aruba.it/AreaUtenti.asp?Lang=IT
Title: area clienti

Search URL Search Domain Scan URL

URL: https://assistenza.aruba.it/
Title: assistenza 24/7

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://5b6bdb89.dbcorr.com.br/?id=arredamentibonacini.it HTTP 302
http://aruba-it-983dfb47e22.gruporaotes.com.br/?290939e41&id=arredamentibonacini.it Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

1 HTTP transactions
10 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response aruba-it-983dfb47e22.gruporaotes.com.br/ Redirect Chain http://5b6bdb89.dbcorr.com.br/?id=arredamentibonacini.it http://aruba-it-983dfb47e22.gruporaotes.com.br/?290939e41&id=arredamentibonacini.it	305 KB 305 KB	570ms 366ms	Document text/html	172.96.117.22 ZEN-ECN
General Check archive.org Show headers Download Go to Full URL http://aruba-it-983dfb47e22.gruporaotes.com.br/?290939e41&id=arredamentibonacini.it Protocol HTTP/1.1 Server 172.96.117.22 San Jose, United States, ASN21859 (ZEN-ECN, US), Reverse DNS Software Microsoft-IIS/10.0 / PHP/7.4.33 Resource Hash `0eaad38b1c01024f7e3d63dcfd34bc0b040b92ec9f0355b5f4c4e0709abe70b8` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 accept-language it-IT,it;q=0.9 Response headers Content-Length 312393 Content-Type text/html; charset=UTF-8 Date Thu, 28 Dec 2023 08:46:42 GMT Server Microsoft-IIS/10.0 X-Powered-By PHP/7.4.33 Redirect headers Content-Length 0 Content-Type text/html; charset=UTF-8 Date Thu, 28 Dec 2023 08:46:41 GMT Location http://aruba-it-983dfb47e22.gruporaotes.com.br/?290939e41&id=arredamentibonacini.it Server Microsoft-IIS/10.0 X-Powered-By PHP/7.4.33
GET DATA	200 OK	truncated /	17 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `a525f163e73542be1b82c5ae4e4beed74d137d56161ac5b02833a279ef6d9b61` Request headers accept-language it-IT,it;q=0.9 Referer http://aruba-it-983dfb47e22.gruporaotes.com.br/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	15 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `bcedcafd81248b08cb428b22618a38866d0cee85b4e9ecd27ef734d0533e2792` Request headers accept-language it-IT,it;q=0.9 Referer http://aruba-it-983dfb47e22.gruporaotes.com.br/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	23 KB 23 KB		Font font/woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537` Request headers Referer http://aruba-it-983dfb47e22.gruporaotes.com.br/ Origin http://aruba-it-983dfb47e22.gruporaotes.com.br accept-language it-IT,it;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Response headers Content-Type font/woff2
GET DATA	200 OK	truncated /	113 KB 0		Image image/jpeg
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `f57daf620928f5fd26bf5bd258d8e9772507df2dcf038df7437a6c8e8c7eb245` Request headers accept-language it-IT,it;q=0.9 Referer http://aruba-it-983dfb47e22.gruporaotes.com.br/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Response headers Content-Type image/jpeg
GET DATA	200 OK	truncated /	23 KB 23 KB		Font font/woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `c447dd7677b419db7b21dbdfc6277c7816a913ffda76fd2e52702df538de0e49` Request headers Referer http://aruba-it-983dfb47e22.gruporaotes.com.br/ Origin http://aruba-it-983dfb47e22.gruporaotes.com.br accept-language it-IT,it;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Response headers Content-Type font/woff2
GET DATA	200 OK	truncated /	822 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `27a9a24907f8907c98afcf081684fe8fe95f3381ef49ff0d56c9e8e1eb525b6f` Request headers accept-language it-IT,it;q=0.9 Referer http://aruba-it-983dfb47e22.gruporaotes.com.br/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	2 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `6676b05ef9626756989d9dbc09608830af666a330ad1bfa12438b9775330c474` Request headers accept-language it-IT,it;q=0.9 Referer http://aruba-it-983dfb47e22.gruporaotes.com.br/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	2 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `6c46bf722fb11c3066171661ece073b58b6ea6c16b00a9d3cc162a6f215b57f1` Request headers accept-language it-IT,it;q=0.9 Referer http://aruba-it-983dfb47e22.gruporaotes.com.br/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	45 B 0		Image image/gif
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `d9ad9ccafbc7696d83a75b36483dc07f3a1465c7d4443047f7d2803045435dcd` Request headers accept-language it-IT,it;q=0.9 Referer http://aruba-it-983dfb47e22.gruporaotes.com.br/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Response headers Content-Type image/gif
GET DATA	200 OK	truncated / Frame 11D4	6 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `d5864d5ddff471eb051069bf32bbf80f0bfa0cc842e2c24f563d9822109de55f` Request headers accept-language it-IT,it;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36 Response headers Content-Type image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Aruba (Online)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 function| togglePasswordVisibility

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

5b6bdb89.dbcorr.com.br
aruba-it-983dfb47e22.gruporaotes.com.br
172.96.117.22
0eaad38b1c01024f7e3d63dcfd34bc0b040b92ec9f0355b5f4c4e0709abe70b8
27a9a24907f8907c98afcf081684fe8fe95f3381ef49ff0d56c9e8e1eb525b6f
6676b05ef9626756989d9dbc09608830af666a330ad1bfa12438b9775330c474
6c46bf722fb11c3066171661ece073b58b6ea6c16b00a9d3cc162a6f215b57f1
918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537
a525f163e73542be1b82c5ae4e4beed74d137d56161ac5b02833a279ef6d9b61
bcedcafd81248b08cb428b22618a38866d0cee85b4e9ecd27ef734d0533e2792
c447dd7677b419db7b21dbdfc6277c7816a913ffda76fd2e52702df538de0e49
d5864d5ddff471eb051069bf32bbf80f0bfa0cc842e2c24f563d9822109de55f
d9ad9ccafbc7696d83a75b36483dc07f3a1465c7d4443047f7d2803045435dcd
f57daf620928f5fd26bf5bd258d8e9772507df2dcf038df7437a6c8e8c7eb245

aruba-it-983dfb47e22.gruporaotes.com.br Open in urlscan Pro 172.96.117.22 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

1 Requests

0 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

1 Countries

351 kBTransfer

507 kBSize

0 Cookies

8 Outgoing links

Page URL History

Redirected requests

1 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 10 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

0 Cookies

Indicators

aruba-it-983dfb47e22.gruporaotes.com.br Open in urlscan Pro
172.96.117.22 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

1
Requests

0 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

351 kB
Transfer

507 kB
Size

0
Cookies

1 HTTP transactions
10 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!