aruba-loginmail.website.yandexcloud.net Open in urlscan Pro
2a02:6b8::1da  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

16 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response aruba-loginmail.website.yandexcloud.net/	19 KB 4 KB	166ms 67ms	Document text/html	2a02:6b8::1da YANDEX
General Check archive.org Show headers Download Go to Full URL https://aruba-loginmail.website.yandexcloud.net/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a02:6b8::1da Moscow, Russian Federation, ASN13238 (YANDEX, RU), Reverse DNS Software nginx / Resource Hash 6a7c86f248293d267e761b803fa30d6cc568fd66368e6740739c8ba7211be358 Request headers Host aruba-loginmail.website.yandexcloud.net Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site none Sec-Fetch-Mode navigate Sec-Fetch-User ?1 Sec-Fetch-Dest document Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Server nginx Date Tue, 02 Mar 2021 15:25:38 GMT Content-Type text/html Transfer-Encoding chunked Connection keep-alive Keep-Alive timeout=60 Etag W/"da5397ea5dd7b2d2afa082ecad2f93b0" Last-Modified Tue, 02 Mar 2021 08:10:48 UTC X-Amz-Request-Id 299832dc41702819 Content-Encoding gzip
GET H2	200	css fonts.googleapis.com/	2 KB 517 B	15ms 13ms	Stylesheet text/css	2a00:1450:4001:800::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Lato:300,400,700&subset=latin,latin-ext Requested by Host: aruba-loginmail.website.yandexcloud.net URL: https://aruba-loginmail.website.yandexcloud.net/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:800::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 4c50acf54e17870e9a5ebe944f589ecc5e1d947426519c6a969ae9db93040c88 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://aruba-loginmail.website.yandexcloud.net/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Tue, 02 Mar 2021 14:34:28 GMT server ESF date Tue, 02 Mar 2021 15:25:38 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Tue, 02 Mar 2021 15:25:38 GMT
GET H2	200	login.css fromano.xyz/aruba2/web_imgs/login/css/	11 KB 3 KB	35ms 16ms	Stylesheet text/css	2606:4700:3033::ac43:9757 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://fromano.xyz/aruba2/web_imgs/login/css/login.css?_v_=v4r2b57.20200506_1230 Requested by Host: aruba-loginmail.website.yandexcloud.net URL: https://aruba-loginmail.website.yandexcloud.net/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3033::ac43:9757 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash b94c5158a9afa36c819f92b1e85dc50d2119ed7319c13471c86b0326edfe680c Request headers Referer https://aruba-loginmail.website.yandexcloud.net/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 02 Mar 2021 15:25:38 GMT content-encoding br cf-cache-status HIT last-modified Mon, 15 Feb 2021 22:08:23 GMT server cloudflare age 6091 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding,User-Agent report-to {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=OjN%2Fa2ZhIjBzhz8qcJ2b%2FbKfIgUOF3tUhLaRRVcve%2BB78onI%2BFMwDYS5WPd0FYamwjswsXV7TkqT0Wl1FTUbg%2B2OxXdMqokfGvNkcazzWVvmeT9Q8rwO2g%3D%3D"}],"max_age":604800} content-type text/css cache-control max-age=14400 nel {"max_age":604800,"report_to":"cf-nel"} cf-ray 629ba38958fd97f0-FRA cf-request-id 08952489d5000097f02309a000000001
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/2.2.4/	84 KB 29 KB	8ms 6ms	Script text/javascript	2a00:1450:4001:80e::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js Requested by Host: aruba-loginmail.website.yandexcloud.net URL: https://aruba-loginmail.website.yandexcloud.net/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://aruba-loginmail.website.yandexcloud.net/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Mon, 01 Mar 2021 15:36:00 GMT content-encoding gzip x-content-type-options nosniff age 85778 cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 30028 x-xss-protection 0 last-modified Tue, 03 Mar 2020 19:15:00 GMT server sffe vary Accept-Encoding content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Tue, 01 Mar 2022 15:36:00 GMT
GET H2	200	dojo.js Show response fromano.xyz/aruba2/javascript/startup/dojo/dojo/	89 KB 30 KB	38ms 19ms	Script application/javascript	2606:4700:3033::ac43:9757 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://fromano.xyz/aruba2/javascript/startup/dojo/dojo/dojo.js?_v_=v4r2b57.20200506_1230 Requested by Host: aruba-loginmail.website.yandexcloud.net URL: https://aruba-loginmail.website.yandexcloud.net/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3033::ac43:9757 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 5cc109dd2ea302de6ee7df3c4dd0d4d25b41277efcf7f370f50efe934544fd0c Request headers Referer https://aruba-loginmail.website.yandexcloud.net/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Tue, 02 Mar 2021 15:25:38 GMT content-encoding br cf-cache-status HIT last-modified Mon, 15 Feb 2021 22:08:23 GMT server cloudflare age 6091 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding,User-Agent report-to {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=4rYTH3uDpZ5Dge8oXQxrbzb1Mbvfp8Qj7lHJo%2F5JB%2FrriGmIVB4BoKcWz3dRRTBZ1C%2Bu8wzNAlWKpJgL4gR8Xif1VuNEt%2Fyt6qySsQjLbXtt2aY6wykjzA%3D%3D"}],"max_age":604800} content-type application/javascript cache-control max-age=14400 nel {"max_age":604800,"report_to":"cf-nel"} cf-ray 629ba38958fe97f0-FRA cf-request-id 08952489d5000097f056890000000001
GET H2	200	gb.png fromano.xyz/aruba2/web_imgs/login/images/flag/	599 B 1 KB	31ms 13ms	Image image/png	2606:4700:3033::ac43:9757 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://fromano.xyz/aruba2/web_imgs/login/images/flag/gb.png Requested by Host: aruba-loginmail.website.yandexcloud.net URL: https://aruba-loginmail.website.yandexcloud.net/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3033::ac43:9757 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 5d72c5a8bef80fca6f99f476e15ec95ce2d5e5f65c6dab9ee8e56348be0d39fc Request headers Referer https://aruba-loginmail.website.yandexcloud.net/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 02 Mar 2021 15:25:38 GMT cf-cache-status HIT last-modified Mon, 15 Feb 2021 22:08:23 GMT server cloudflare age 6091 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=bFFQ5KFlc1fqDeuCS7TrHxesZNorb1d6RCGeJO4fvxjm3Q2Ky4BNHXYbhQMnMXD5CsOWkfrKzfkdC0MCGOyqhVB1ynu9F9QmzLuLAlkFoiCNtpQthmDFQw%3D%3D"}],"max_age":604800} content-type image/png cache-control max-age=14400 nel {"max_age":604800,"report_to":"cf-nel"} accept-ranges bytes cf-ray 629ba389590097f0-FRA content-length 599 cf-request-id 08952489d6000097f063a3b000000001
GET H2	200	login.js Show response fromano.xyz/aruba2/ext_aruba/js/	20 KB 5 KB	34ms 15ms	Script application/javascript	2606:4700:3033::ac43:9757 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://fromano.xyz/aruba2/ext_aruba/js/login.js?_v_=v4r2b57.20200506_1230 Requested by Host: aruba-loginmail.website.yandexcloud.net URL: https://aruba-loginmail.website.yandexcloud.net/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3033::ac43:9757 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 926dbda18381253b1159a9d0d33866e018a6963edc64f53522ff9c5d53a4953f Request headers Referer https://aruba-loginmail.website.yandexcloud.net/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Tue, 02 Mar 2021 15:25:38 GMT content-encoding br cf-cache-status HIT last-modified Mon, 15 Feb 2021 22:08:23 GMT server cloudflare age 6091 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding,User-Agent report-to {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=yXBVB2A9qRWmW4tXoqoBrTPPXJodB6%2FBHTSOi1%2Fh%2BjdVsrfxqp5J573w291qHIM8I9d99QwtDTwn1%2B%2BJ4Bx17x%2BVxS2RBe5pU0r7HUf0bfYnYdYVMYwSRQ%3D%3D"}],"max_age":604800} content-type application/javascript cache-control max-age=14400 nel {"max_age":604800,"report_to":"cf-nel"} cf-ray 629ba38958ff97f0-FRA cf-request-id 08952489d6000097f045886000000001
GET H2	200	S6uyw4BMUTPHjx4wXiWtFCc.woff2 fonts.gstatic.com/s/lato/v17/	14 KB 14 KB	6ms 6ms	Font font/woff2	2a00:1450:4001:82b::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/lato/v17/S6uyw4BMUTPHjx4wXiWtFCc.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Lato:300,400,700&subset=latin,latin-ext Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 036d841b132c14046e26d8f2da1bc634c6ad34885ed1295660694a91c98933a6 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Origin https://aruba-loginmail.website.yandexcloud.net Referer https://fonts.googleapis.com/css?family=Lato:300,400,700&subset=latin,latin-ext User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Mon, 01 Mar 2021 13:34:51 GMT x-content-type-options nosniff last-modified Tue, 15 Sep 2020 18:12:59 GMT server sffe age 93047 content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 14044 x-xss-protection 0 expires Tue, 01 Mar 2022 13:34:51 GMT
GET H/1.1	404 Not Found	left_block.html Show response aruba-loginmail.website.yandexcloud.net/ Frame FC95	225 B 443 B	70ms 70ms	Document text/html	2a02:6b8::1da YANDEX
General Check archive.org Show headers Download Go to Full URL https://aruba-loginmail.website.yandexcloud.net/left_block.html Requested by Host: aruba-loginmail.website.yandexcloud.net URL: https://aruba-loginmail.website.yandexcloud.net/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a02:6b8::1da Moscow, Russian Federation, ASN13238 (YANDEX, RU), Reverse DNS Software nginx / Resource Hash 41bdaa89ea0725fbd5d9368679c75d1459034b9c4da231bbe4367e96bbf8d57e Request headers Host aruba-loginmail.website.yandexcloud.net Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site same-origin Sec-Fetch-Mode navigate Sec-Fetch-Dest iframe Referer https://aruba-loginmail.website.yandexcloud.net/ Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://aruba-loginmail.website.yandexcloud.net/ Response headers Server nginx Date Tue, 02 Mar 2021 15:25:38 GMT Content-Type text/html; charset=utf-8 Transfer-Encoding chunked Connection keep-alive Keep-Alive timeout=60 X-Amz-Request-Id b02c266e7720fa3a Content-Encoding gzip
GET H2	200	left-block-image.jpg fromano.xyz/aruba2/web_imgs/login/images/	122 KB 122 KB	21ms 20ms	Image image/jpeg	2606:4700:3033::ac43:9757 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://fromano.xyz/aruba2/web_imgs/login/images/left-block-image.jpg Requested by Host: fromano.xyz URL: https://fromano.xyz/aruba2/web_imgs/login/css/login.css?_v_=v4r2b57.20200506_1230 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3033::ac43:9757 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash cc33975886ef8f7d3ebdcce9323d19bbe0729a87c6e29cec425d481547c81f7a Request headers Referer https://fromano.xyz/aruba2/web_imgs/login/css/login.css?_v_=v4r2b57.20200506_1230 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 02 Mar 2021 15:25:38 GMT cf-cache-status HIT last-modified Mon, 15 Feb 2021 22:08:23 GMT server cloudflare age 6091 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=o42pcA1XORFMJVfqpKIGe2dE5fE%2F2ZRPxoML34bTqrlZdarnL0eV2uuN%2FdktSbrvji0QZrl2dTPKqB43fNnAWDzISMblmw37GvQxV2MhBBotmqR95QeUiQ%3D%3D"}],"max_age":604800} content-type image/jpeg cache-control max-age=14400 nel {"max_age":604800,"report_to":"cf-nel"} accept-ranges bytes cf-ray 629ba389a91097f0-FRA content-length 124481 cf-request-id 0895248a0c000097f0243c0000000001
GET H2	200	aruba-logo.svg fromano.xyz/aruba2/web_imgs/login/images/	15 KB 6 KB	19ms 18ms	Image image/svg+xml	2606:4700:3033::ac43:9757 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://fromano.xyz/aruba2/web_imgs/login/images/aruba-logo.svg Requested by Host: fromano.xyz URL: https://fromano.xyz/aruba2/web_imgs/login/css/login.css?_v_=v4r2b57.20200506_1230 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3033::ac43:9757 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a32e14929dae4030d8fe0164ac57453ec28a2927b4e6f22d445934b829f6df14 Request headers Referer https://fromano.xyz/aruba2/web_imgs/login/css/login.css?_v_=v4r2b57.20200506_1230 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 02 Mar 2021 15:25:38 GMT content-encoding br cf-cache-status HIT last-modified Mon, 15 Feb 2021 22:08:23 GMT server cloudflare age 6091 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding,User-Agent report-to {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=7bfzr0f77iPjhNpZ1FiwRYF799AOk%2Bm0kY0BzM3%2F49PPd3bC4kUxljO%2F2GEUv9AY6WkF8ZneWsXGHXoSGYkMK156SedqgdMYt1DJ85eXu6KenHgqbmgAGw%3D%3D"}],"max_age":604800} content-type image/svg+xml cache-control max-age=14400 nel {"max_age":604800,"report_to":"cf-nel"} cf-ray 629ba389a91197f0-FRA cf-request-id 0895248a0c000097f03518f000000001
GET H2	200	envelope.svg fromano.xyz/aruba2/web_imgs/login/images/	681 B 675 B	15ms 14ms	Image image/svg+xml	2606:4700:3033::ac43:9757 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://fromano.xyz/aruba2/web_imgs/login/images/envelope.svg Requested by Host: fromano.xyz URL: https://fromano.xyz/aruba2/web_imgs/login/css/login.css?_v_=v4r2b57.20200506_1230 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3033::ac43:9757 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 5e96c408271ce2999c052da5821e78872d784aa9a08b87fc6f4fb036e46eab99 Request headers Referer https://fromano.xyz/aruba2/web_imgs/login/css/login.css?_v_=v4r2b57.20200506_1230 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 02 Mar 2021 15:25:38 GMT content-encoding br cf-cache-status HIT last-modified Mon, 15 Feb 2021 22:08:23 GMT server cloudflare age 6091 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding,User-Agent report-to {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=27FzlUYvc%2BK5uT33c5Sea9nifXIwgZtu1RnRk%2BWpGY%2BrLePcDkTTYjMIOE25gGsZbUEndYWW0wdOsUpr6viX8IA1E4ST4PdcVlfS92%2BLmBS9NFecefZ%2BOw%3D%3D"}],"max_age":604800} content-type image/svg+xml cache-control max-age=14400 nel {"max_age":604800,"report_to":"cf-nel"} cf-ray 629ba389a91297f0-FRA cf-request-id 0895248a0c000097f02309b000000001
GET H2	200	login-icon.svg fromano.xyz/aruba2/web_imgs/login/images/	666 B 746 B	13ms 12ms	Image image/svg+xml	2606:4700:3033::ac43:9757 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://fromano.xyz/aruba2/web_imgs/login/images/login-icon.svg Requested by Host: fromano.xyz URL: https://fromano.xyz/aruba2/web_imgs/login/css/login.css?_v_=v4r2b57.20200506_1230 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3033::ac43:9757 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash c7eca97d84ed3469e7d1a20a8c28ef7177270b93a2d9913a0adad9a3e4bdfc9a Request headers Referer https://fromano.xyz/aruba2/web_imgs/login/css/login.css?_v_=v4r2b57.20200506_1230 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 02 Mar 2021 15:25:38 GMT content-encoding br cf-cache-status HIT last-modified Mon, 15 Feb 2021 22:08:23 GMT server cloudflare age 6091 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding,User-Agent report-to {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=NL%2BWwCe2Gonbq%2Fi6IkR17%2Fmxo9TlxXT4gjnujEMEzVfIgw5ailDMBLFz8pMAdL94tXZdemBS2kaxfN1fG6tFd%2FnmADbfdm3s6mz3vziIiioQ2v4rR8gpKw%3D%3D"}],"max_age":604800} content-type image/svg+xml cache-control max-age=14400 nel {"max_age":604800,"report_to":"cf-nel"} cf-ray 629ba389a91397f0-FRA cf-request-id 0895248a0d000097f056891000000001
GET H2	200	password-icon.svg fromano.xyz/aruba2/web_imgs/login/images/	585 B 598 B	17ms 17ms	Image image/svg+xml	2606:4700:3033::ac43:9757 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://fromano.xyz/aruba2/web_imgs/login/images/password-icon.svg Requested by Host: fromano.xyz URL: https://fromano.xyz/aruba2/web_imgs/login/css/login.css?_v_=v4r2b57.20200506_1230 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3033::ac43:9757 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d1a498e72f62f80af25d958364158a781a8cdee723e700756b28756c97ee2fa1 Request headers Referer https://fromano.xyz/aruba2/web_imgs/login/css/login.css?_v_=v4r2b57.20200506_1230 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 02 Mar 2021 15:25:38 GMT content-encoding br cf-cache-status HIT last-modified Mon, 15 Feb 2021 22:08:23 GMT server cloudflare age 6091 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding,User-Agent report-to {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=onYP1wcbdf7B6KSckznNyWIU7qJPv3BLAEZtYe2U7HI22Oz1zmS5NSCPv7s%2FHNo0oswm8qwbJJfL7AKSAv3uiOIoeOmv5PDIiQEsyLvYAn7GTHm7CztyyA%3D%3D"}],"max_age":604800} content-type image/svg+xml cache-control max-age=14400 nel {"max_age":604800,"report_to":"cf-nel"} cf-ray 629ba389a91497f0-FRA cf-request-id 0895248a0e000097f045887000000001
GET H2	200	password-icon-2.svg fromano.xyz/aruba2/web_imgs/login/images/	947 B 700 B	18ms 17ms	Image image/svg+xml	2606:4700:3033::ac43:9757 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://fromano.xyz/aruba2/web_imgs/login/images/password-icon-2.svg Requested by Host: fromano.xyz URL: https://fromano.xyz/aruba2/web_imgs/login/css/login.css?_v_=v4r2b57.20200506_1230 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3033::ac43:9757 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8955ee5e3071f91ed2460b5b634cdab6f6c15d5d8adefac0e3328de7f5889a97 Request headers Referer https://fromano.xyz/aruba2/web_imgs/login/css/login.css?_v_=v4r2b57.20200506_1230 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 02 Mar 2021 15:25:38 GMT content-encoding br cf-cache-status HIT last-modified Mon, 15 Feb 2021 22:08:23 GMT server cloudflare age 6091 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding,User-Agent report-to {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=bUBGpvD65mOP2vdHttgVySwnCIhl0ZeUtHicNxhy2v8aSWeZ7pBrc%2BcUDCjniNxyOIWp%2Fo2qB8cfK0aGNKZ6noHdy0j7u4KX4nozl%2BmmvwDLcPxKEmkRpg%3D%3D"}],"max_age":604800} content-type image/svg+xml cache-control max-age=14400 nel {"max_age":604800,"report_to":"cf-nel"} cf-ray 629ba389a91597f0-FRA cf-request-id 0895248a0e000097f063a3c000000001
GET H3-Q050	200	S6u9w4BMUTPHh6UVSwiPGQ3q5d0.woff2 fonts.gstatic.com/s/lato/v17/	14 KB 14 KB	36ms 21ms	Font font/woff2	2a00:1450:4001:82b::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/lato/v17/S6u9w4BMUTPHh6UVSwiPGQ3q5d0.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Lato:300,400,700&subset=latin,latin-ext Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 9baad10e85c5be8d5697086479983b6b477197103bf8f0f11817b1bdfb9a7451 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Origin https://aruba-loginmail.website.yandexcloud.net Referer https://fonts.googleapis.com/css?family=Lato:300,400,700&subset=latin,latin-ext User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 27 Feb 2021 06:32:15 GMT x-content-type-options nosniff last-modified Tue, 15 Sep 2020 18:12:25 GMT server sffe age 291203 content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 14176 x-xss-protection 0 expires Sun, 27 Feb 2022 06:32:15 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Aruba (Online)

63 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery object| dojo object| dijit object| dojox string| UX_LEGGERA string| UX_WEB2CS string| UX_FIZZER string| UX_HTML string| UX_PEC boolean| manage boolean| classic object| i18n_login function| isBrowserSupported object| JsonFormatter function| encodeCredentials function| login_setCredentials function| login_getCookie function| login_setCookie function| login_initAdvancedPage function| login_initPage function| login_initRadios function| displayTab function| getLanguage function| login_showPopup function| login_errorPopup function| login_hidePopup function| login_getSelectedUx function| launchLogin function| launchUser function| launchAdmin function| login_web2cs function| login_errorCallback function| isBetaOptimizable function| login_leggera function| auto_login function| isPecDomain function| login_pec function| login_html function| login_fizzer function| display_redirect function| showPassword function| onInputFocus function| onInputBlur function| onInputChange function| DOMContentLoadedListener function| login_setLanguageCookie function| loginGetLanguage function| login_initLocalization function| changeLanguage function| showLanguage function| login_localize function| fstring

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
aruba-loginmail.website.yandexcloud.net
fonts.googleapis.com
fonts.gstatic.com
fromano.xyz
2606:4700:3033::ac43:9757
2a00:1450:4001:800::200a
2a00:1450:4001:80e::200a
2a00:1450:4001:82b::2003
2a02:6b8::1da
036d841b132c14046e26d8f2da1bc634c6ad34885ed1295660694a91c98933a6
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
41bdaa89ea0725fbd5d9368679c75d1459034b9c4da231bbe4367e96bbf8d57e
4c50acf54e17870e9a5ebe944f589ecc5e1d947426519c6a969ae9db93040c88
5cc109dd2ea302de6ee7df3c4dd0d4d25b41277efcf7f370f50efe934544fd0c
5d72c5a8bef80fca6f99f476e15ec95ce2d5e5f65c6dab9ee8e56348be0d39fc
5e96c408271ce2999c052da5821e78872d784aa9a08b87fc6f4fb036e46eab99
6a7c86f248293d267e761b803fa30d6cc568fd66368e6740739c8ba7211be358
8955ee5e3071f91ed2460b5b634cdab6f6c15d5d8adefac0e3328de7f5889a97
926dbda18381253b1159a9d0d33866e018a6963edc64f53522ff9c5d53a4953f
9baad10e85c5be8d5697086479983b6b477197103bf8f0f11817b1bdfb9a7451
a32e14929dae4030d8fe0164ac57453ec28a2927b4e6f22d445934b829f6df14
b94c5158a9afa36c819f92b1e85dc50d2119ed7319c13471c86b0326edfe680c
c7eca97d84ed3469e7d1a20a8c28ef7177270b93a2d9913a0adad9a3e4bdfc9a
cc33975886ef8f7d3ebdcce9323d19bbe0729a87c6e29cec425d481547c81f7a
d1a498e72f62f80af25d958364158a781a8cdee723e700756b28756c97ee2fa1