aruba-loginmail.website.yandexcloud.net Open in urlscan Pro
2a02:6b8::1da  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

16 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response aruba-loginmail.website.yandexcloud.net/	19 KB 4 KB	202ms 63ms	Document text/html	2a02:6b8::1da YANDEX
General Check archive.org Show headers Download Go to Full URL https://aruba-loginmail.website.yandexcloud.net/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a02:6b8::1da Moscow, Russian Federation, ASN13238 (YANDEX, RU), Reverse DNS Software nginx / Resource Hash 6a7c86f248293d267e761b803fa30d6cc568fd66368e6740739c8ba7211be358 Request headers Host aruba-loginmail.website.yandexcloud.net Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site none Sec-Fetch-Mode navigate Sec-Fetch-User ?1 Sec-Fetch-Dest document Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Server nginx Date Wed, 03 Mar 2021 00:32:28 GMT Content-Type text/html Transfer-Encoding chunked Connection keep-alive Keep-Alive timeout=60 Etag W/"da5397ea5dd7b2d2afa082ecad2f93b0" Last-Modified Tue, 02 Mar 2021 08:10:48 UTC X-Amz-Request-Id ad9d6d8ebaff3d74 Content-Encoding gzip
GET H2	200	css fonts.googleapis.com/	2 KB 517 B	15ms 13ms	Stylesheet text/css	2a00:1450:4001:811::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Lato:300,400,700&subset=latin,latin-ext Requested by Host: aruba-loginmail.website.yandexcloud.net URL: https://aruba-loginmail.website.yandexcloud.net/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:811::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 4c50acf54e17870e9a5ebe944f589ecc5e1d947426519c6a969ae9db93040c88 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://aruba-loginmail.website.yandexcloud.net/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Tue, 02 Mar 2021 23:35:09 GMT server ESF date Wed, 03 Mar 2021 00:32:28 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Wed, 03 Mar 2021 00:32:28 GMT
GET H2	200	login.css fromano.xyz/aruba2/web_imgs/login/css/	11 KB 3 KB	39ms 10ms	Stylesheet text/css	2606:4700:3035::6815:509b CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://fromano.xyz/aruba2/web_imgs/login/css/login.css?_v_=v4r2b57.20200506_1230 Requested by Host: aruba-loginmail.website.yandexcloud.net URL: https://aruba-loginmail.website.yandexcloud.net/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3035::6815:509b , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash b94c5158a9afa36c819f92b1e85dc50d2119ed7319c13471c86b0326edfe680c Request headers Referer https://aruba-loginmail.website.yandexcloud.net/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 03 Mar 2021 00:32:28 GMT content-encoding br cf-cache-status HIT last-modified Mon, 15 Feb 2021 22:08:23 GMT server cloudflare age 3775 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding,User-Agent report-to {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=YaYpf3yNPSYRoF1SNzr9Gv4elVJTfftCPS3bnCYGkZ0n0qpnEtntiR8t9E1lg1hTq2vl99zSyEM%2BHJqfDbWbD3CRGF0OV%2F%2FPj%2BYrdKh%2BKtPa01SmDJFzKA%3D%3D"}],"max_age":604800} content-type text/css cache-control max-age=14400 nel {"max_age":604800,"report_to":"cf-nel"} cf-ray 629ec492c85e05dc-FRA alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id 0897192fba000005dc40199000000001
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/2.2.4/	84 KB 84 KB	28ms 7ms	Script text/javascript	2a00:1450:4001:802::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js Requested by Host: aruba-loginmail.website.yandexcloud.net URL: https://aruba-loginmail.website.yandexcloud.net/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://aruba-loginmail.website.yandexcloud.net/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Tue, 02 Mar 2021 10:12:53 GMT x-content-type-options nosniff age 51575 cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 85578 x-xss-protection 0 last-modified Tue, 03 Mar 2020 19:15:00 GMT server sffe vary Accept-Encoding content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Wed, 02 Mar 2022 10:12:53 GMT
GET H2	200	dojo.js Show response fromano.xyz/aruba2/javascript/startup/dojo/dojo/	89 KB 30 KB	44ms 16ms	Script application/javascript	2606:4700:3035::6815:509b CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://fromano.xyz/aruba2/javascript/startup/dojo/dojo/dojo.js?_v_=v4r2b57.20200506_1230 Requested by Host: aruba-loginmail.website.yandexcloud.net URL: https://aruba-loginmail.website.yandexcloud.net/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3035::6815:509b , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 5cc109dd2ea302de6ee7df3c4dd0d4d25b41277efcf7f370f50efe934544fd0c Request headers Referer https://aruba-loginmail.website.yandexcloud.net/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Wed, 03 Mar 2021 00:32:28 GMT content-encoding br cf-cache-status HIT last-modified Mon, 15 Feb 2021 22:08:23 GMT server cloudflare age 3775 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding,User-Agent report-to {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=jR2sl2f7GGt%2F%2FkbDblVDqdImO9O93Yviefu%2BT0ksMCLm0jlvRH00Y8GIwapkoIY9W8DtFmEC8riI%2BtXuohfws3sKJYeXy6jkol1IzyuPMa1G8QmcZs49TA%3D%3D"}],"max_age":604800} content-type application/javascript cache-control max-age=14400 nel {"max_age":604800,"report_to":"cf-nel"} cf-ray 629ec492c86005dc-FRA alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id 0897192fba000005dc731b3000000001
GET H2	200	gb.png fromano.xyz/aruba2/web_imgs/login/images/flag/	599 B 910 B	39ms 11ms	Image image/png	2606:4700:3035::6815:509b CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://fromano.xyz/aruba2/web_imgs/login/images/flag/gb.png Requested by Host: aruba-loginmail.website.yandexcloud.net URL: https://aruba-loginmail.website.yandexcloud.net/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3035::6815:509b , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 5d72c5a8bef80fca6f99f476e15ec95ce2d5e5f65c6dab9ee8e56348be0d39fc Request headers Referer https://aruba-loginmail.website.yandexcloud.net/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 03 Mar 2021 00:32:28 GMT cf-cache-status HIT nel {"max_age":604800,"report_to":"cf-nel"} age 3775 alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 599 cf-request-id 0897192fbb000005dcbe13b000000001 last-modified Mon, 15 Feb 2021 22:08:23 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=sHx%2FBepjsSNtrscVeMJ8l3Q1Jd9%2BMjyX06gEyzJSCcdbbaATf0qYa9zxt34qfxNEIsaf6DBAbcRX9nsbdYVsqQIl23U1PG9lhl%2Fdnrf6ZxieVNx7AXYo9g%3D%3D"}],"max_age":604800} content-type image/png cache-control max-age=14400 accept-ranges bytes cf-ray 629ec492c86205dc-FRA
GET H2	200	login.js Show response fromano.xyz/aruba2/ext_aruba/js/	20 KB 5 KB	39ms 12ms	Script application/javascript	2606:4700:3035::6815:509b CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://fromano.xyz/aruba2/ext_aruba/js/login.js?_v_=v4r2b57.20200506_1230 Requested by Host: aruba-loginmail.website.yandexcloud.net URL: https://aruba-loginmail.website.yandexcloud.net/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3035::6815:509b , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 926dbda18381253b1159a9d0d33866e018a6963edc64f53522ff9c5d53a4953f Request headers Referer https://aruba-loginmail.website.yandexcloud.net/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Wed, 03 Mar 2021 00:32:28 GMT content-encoding br cf-cache-status HIT last-modified Mon, 15 Feb 2021 22:08:23 GMT server cloudflare age 3775 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding,User-Agent report-to {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=%2FjQNloL07Ara65oeT4KIFSZDoHxRCcIb67XaXereu0COOMA4uv1GCbXlk%2FQCbSHOFpTqcT66a%2BRnikXKSdz8IjuXT8fZ3AKhrRxRVaV9GoldIFNKXAWgOQ%3D%3D"}],"max_age":604800} content-type application/javascript cache-control max-age=14400 nel {"max_age":604800,"report_to":"cf-nel"} cf-ray 629ec492c86105dc-FRA alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id 0897192fba000005dc9f00c000000001
GET H2	200	S6uyw4BMUTPHjx4wXiWtFCc.woff2 fonts.gstatic.com/s/lato/v17/	14 KB 14 KB	6ms 5ms	Font font/woff2	2a00:1450:4001:810::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/lato/v17/S6uyw4BMUTPHjx4wXiWtFCc.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Lato:300,400,700&subset=latin,latin-ext Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 036d841b132c14046e26d8f2da1bc634c6ad34885ed1295660694a91c98933a6 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Origin https://aruba-loginmail.website.yandexcloud.net Referer https://fonts.googleapis.com/css?family=Lato:300,400,700&subset=latin,latin-ext User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Sat, 27 Feb 2021 06:30:25 GMT x-content-type-options nosniff last-modified Tue, 15 Sep 2020 18:12:59 GMT server sffe age 324123 content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 14044 x-xss-protection 0 expires Sun, 27 Feb 2022 06:30:25 GMT
GET H/1.1	403 Forbidden	left_block.html Show response aruba-loginmail.website.yandexcloud.net/ Frame F985	208 B 423 B	63ms 63ms	Document text/html	2a02:6b8::1da YANDEX
General Check archive.org Show headers Download Go to Full URL https://aruba-loginmail.website.yandexcloud.net/left_block.html Requested by Host: aruba-loginmail.website.yandexcloud.net URL: https://aruba-loginmail.website.yandexcloud.net/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a02:6b8::1da Moscow, Russian Federation, ASN13238 (YANDEX, RU), Reverse DNS Software nginx / Resource Hash 501bca6154a273f391094d21a54102cfa1ada501d7c36180b14bbacee27c7a0c Request headers Host aruba-loginmail.website.yandexcloud.net Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site same-origin Sec-Fetch-Mode navigate Sec-Fetch-Dest iframe Referer https://aruba-loginmail.website.yandexcloud.net/ Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://aruba-loginmail.website.yandexcloud.net/ Response headers Server nginx Date Wed, 03 Mar 2021 00:32:28 GMT Content-Type text/html; charset=utf-8 Transfer-Encoding chunked Connection keep-alive Keep-Alive timeout=60 X-Amz-Request-Id f7fe65a79264baa5 Content-Encoding gzip
GET H2	200	left-block-image.jpg fromano.xyz/aruba2/web_imgs/login/images/	122 KB 122 KB	10ms 9ms	Image image/jpeg	2606:4700:3035::6815:509b CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://fromano.xyz/aruba2/web_imgs/login/images/left-block-image.jpg Requested by Host: fromano.xyz URL: https://fromano.xyz/aruba2/web_imgs/login/css/login.css?_v_=v4r2b57.20200506_1230 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3035::6815:509b , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash cc33975886ef8f7d3ebdcce9323d19bbe0729a87c6e29cec425d481547c81f7a Request headers Referer https://fromano.xyz/aruba2/web_imgs/login/css/login.css?_v_=v4r2b57.20200506_1230 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 03 Mar 2021 00:32:28 GMT cf-cache-status HIT nel {"max_age":604800,"report_to":"cf-nel"} age 3775 alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 124481 cf-request-id 0897192fe9000005dcb3048000000001 last-modified Mon, 15 Feb 2021 22:08:23 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=sh8sqtrtWqRDgKVvjE7XEaqRvRd85iPxI23mMYtUmINuUsvQd%2BIczl8cZdt4v0DMO3NInb4GHiuAHiiNYbyqGSgLzpvAXW%2B7gAFaipCIzFZ9wpBU%2Fh1V9A%3D%3D"}],"max_age":604800} content-type image/jpeg cache-control max-age=14400 accept-ranges bytes cf-ray 629ec49308b505dc-FRA
GET H2	200	aruba-logo.svg fromano.xyz/aruba2/web_imgs/login/images/	15 KB 6 KB	17ms 17ms	Image image/svg+xml	2606:4700:3035::6815:509b CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://fromano.xyz/aruba2/web_imgs/login/images/aruba-logo.svg Requested by Host: fromano.xyz URL: https://fromano.xyz/aruba2/web_imgs/login/css/login.css?_v_=v4r2b57.20200506_1230 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3035::6815:509b , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a32e14929dae4030d8fe0164ac57453ec28a2927b4e6f22d445934b829f6df14 Request headers Referer https://fromano.xyz/aruba2/web_imgs/login/css/login.css?_v_=v4r2b57.20200506_1230 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 03 Mar 2021 00:32:28 GMT content-encoding br cf-cache-status HIT last-modified Mon, 15 Feb 2021 22:08:23 GMT server cloudflare age 3775 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding,User-Agent report-to {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=llG%2FoEmDqOLIpxEv42z25ThYmEpJnjgrkAm8BU2kfeBozx9W5JsrB9EzyQCWSSUxCtp9%2Bi7WKSH3JpFNyNsftLwJg0bh2QcRTM8kdfZzpssk3tuK%2Ff7rQA%3D%3D"}],"max_age":604800} content-type image/svg+xml cache-control max-age=14400 nel {"max_age":604800,"report_to":"cf-nel"} cf-ray 629ec49308b605dc-FRA alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id 0897192fe9000005dc6a019000000001
GET H2	200	envelope.svg fromano.xyz/aruba2/web_imgs/login/images/	681 B 675 B	17ms 16ms	Image image/svg+xml	2606:4700:3035::6815:509b CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://fromano.xyz/aruba2/web_imgs/login/images/envelope.svg Requested by Host: fromano.xyz URL: https://fromano.xyz/aruba2/web_imgs/login/css/login.css?_v_=v4r2b57.20200506_1230 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3035::6815:509b , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 5e96c408271ce2999c052da5821e78872d784aa9a08b87fc6f4fb036e46eab99 Request headers Referer https://fromano.xyz/aruba2/web_imgs/login/css/login.css?_v_=v4r2b57.20200506_1230 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 03 Mar 2021 00:32:28 GMT content-encoding br cf-cache-status HIT last-modified Mon, 15 Feb 2021 22:08:23 GMT server cloudflare age 3775 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding,User-Agent report-to {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=yuTkNUpDNlWRn7NG8WUsXhdObGapxOnIPyM2rdAEW11i4h3NM8VWgMSQ1cr27QRlQZWijLrJ3UOZgia%2FmKqRAkE%2BzZlvDGujWJKlXR%2BxLII5nXkYgQ28OA%3D%3D"}],"max_age":604800} content-type image/svg+xml cache-control max-age=14400 nel {"max_age":604800,"report_to":"cf-nel"} cf-ray 629ec49308b705dc-FRA alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id 0897192fe9000005dc4610f000000001
GET H2	200	login-icon.svg fromano.xyz/aruba2/web_imgs/login/images/	666 B 633 B	17ms 17ms	Image image/svg+xml	2606:4700:3035::6815:509b CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://fromano.xyz/aruba2/web_imgs/login/images/login-icon.svg Requested by Host: fromano.xyz URL: https://fromano.xyz/aruba2/web_imgs/login/css/login.css?_v_=v4r2b57.20200506_1230 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3035::6815:509b , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash c7eca97d84ed3469e7d1a20a8c28ef7177270b93a2d9913a0adad9a3e4bdfc9a Request headers Referer https://fromano.xyz/aruba2/web_imgs/login/css/login.css?_v_=v4r2b57.20200506_1230 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 03 Mar 2021 00:32:28 GMT content-encoding br cf-cache-status HIT last-modified Mon, 15 Feb 2021 22:08:23 GMT server cloudflare age 3775 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding,User-Agent report-to {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=rfpM5hzI%2B%2FKDejM1YMe%2BxuFQsi1LWoXLmo%2Fo3UKMfdnI8qbDTs5AQFxR%2BMEtObraibubTP8gJYijKJObTOsOoRw6h8bkMsGxsbtAF%2Fivecub%2F8zObazhoQ%3D%3D"}],"max_age":604800} content-type image/svg+xml cache-control max-age=14400 nel {"max_age":604800,"report_to":"cf-nel"} cf-ray 629ec49308b805dc-FRA alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id 0897192fea000005dc558e6000000001
GET H2	200	password-icon.svg fromano.xyz/aruba2/web_imgs/login/images/	585 B 884 B	16ms 15ms	Image image/svg+xml	2606:4700:3035::6815:509b CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://fromano.xyz/aruba2/web_imgs/login/images/password-icon.svg Requested by Host: fromano.xyz URL: https://fromano.xyz/aruba2/web_imgs/login/css/login.css?_v_=v4r2b57.20200506_1230 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3035::6815:509b , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash d1a498e72f62f80af25d958364158a781a8cdee723e700756b28756c97ee2fa1 Request headers Referer https://fromano.xyz/aruba2/web_imgs/login/css/login.css?_v_=v4r2b57.20200506_1230 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 03 Mar 2021 00:32:28 GMT content-encoding br cf-cache-status HIT last-modified Mon, 15 Feb 2021 22:08:23 GMT server cloudflare age 3775 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding,User-Agent report-to {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=rxpBrL%2F3VgPUBd2YoEUmA%2B1hh5tl6kvZ85AkpCoTCII8B7WWoyoJcwG3qQ4crBiKLkQw4bySwtw1lIYdn91TLdGh2W2YUh%2FHSpFB%2FZe8I866emWNC27CUw%3D%3D"}],"max_age":604800} content-type image/svg+xml cache-control max-age=14400 nel {"max_age":604800,"report_to":"cf-nel"} cf-ray 629ec49318ba05dc-FRA alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id 0897192fea000005dc64973000000001
GET H2	200	password-icon-2.svg fromano.xyz/aruba2/web_imgs/login/images/	947 B 696 B	15ms 15ms	Image image/svg+xml	2606:4700:3035::6815:509b CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://fromano.xyz/aruba2/web_imgs/login/images/password-icon-2.svg Requested by Host: fromano.xyz URL: https://fromano.xyz/aruba2/web_imgs/login/css/login.css?_v_=v4r2b57.20200506_1230 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3035::6815:509b , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8955ee5e3071f91ed2460b5b634cdab6f6c15d5d8adefac0e3328de7f5889a97 Request headers Referer https://fromano.xyz/aruba2/web_imgs/login/css/login.css?_v_=v4r2b57.20200506_1230 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 03 Mar 2021 00:32:28 GMT content-encoding br cf-cache-status HIT last-modified Mon, 15 Feb 2021 22:08:23 GMT server cloudflare age 3775 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding,User-Agent report-to {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=TLtPEITLkimxuokUGsVtcOtSQJc%2B4%2Fx33L%2BnwxVGBnXrYyXav3v%2BT9zQ5q9OfDevplcWbWW%2FePZGsqn7dCTNIL6X9BVz6wIcxr4oZiwjUthKFLrJn%2BOtKg%3D%3D"}],"max_age":604800} content-type image/svg+xml cache-control max-age=14400 nel {"max_age":604800,"report_to":"cf-nel"} cf-ray 629ec49318bb05dc-FRA alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id 0897192fea000005dc4019b000000001
GET H3-Q050	200	S6u9w4BMUTPHh6UVSwiPGQ3q5d0.woff2 fonts.gstatic.com/s/lato/v17/	14 KB 14 KB	34ms 21ms	Font font/woff2	2a00:1450:4001:810::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/lato/v17/S6u9w4BMUTPHh6UVSwiPGQ3q5d0.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Lato:300,400,700&subset=latin,latin-ext Protocol H3-Q050 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 9baad10e85c5be8d5697086479983b6b477197103bf8f0f11817b1bdfb9a7451 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Origin https://aruba-loginmail.website.yandexcloud.net Referer https://fonts.googleapis.com/css?family=Lato:300,400,700&subset=latin,latin-ext User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Fri, 26 Feb 2021 07:56:54 GMT x-content-type-options nosniff last-modified Tue, 15 Sep 2020 18:12:25 GMT server sffe age 405334 content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 14176 x-xss-protection 0 expires Sat, 26 Feb 2022 07:56:54 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Aruba (Online)

63 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery object| dojo object| dijit object| dojox string| UX_LEGGERA string| UX_WEB2CS string| UX_FIZZER string| UX_HTML string| UX_PEC boolean| manage boolean| classic object| i18n_login function| isBrowserSupported object| JsonFormatter function| encodeCredentials function| login_setCredentials function| login_getCookie function| login_setCookie function| login_initAdvancedPage function| login_initPage function| login_initRadios function| displayTab function| getLanguage function| login_showPopup function| login_errorPopup function| login_hidePopup function| login_getSelectedUx function| launchLogin function| launchUser function| launchAdmin function| login_web2cs function| login_errorCallback function| isBetaOptimizable function| login_leggera function| auto_login function| isPecDomain function| login_pec function| login_html function| login_fizzer function| display_redirect function| showPassword function| onInputFocus function| onInputBlur function| onInputChange function| DOMContentLoadedListener function| login_setLanguageCookie function| loginGetLanguage function| login_initLocalization function| changeLanguage function| showLanguage function| login_localize function| fstring

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
aruba-loginmail.website.yandexcloud.net
fonts.googleapis.com
fonts.gstatic.com
fromano.xyz
2606:4700:3035::6815:509b
2a00:1450:4001:802::200a
2a00:1450:4001:810::2003
2a00:1450:4001:811::200a
2a02:6b8::1da
036d841b132c14046e26d8f2da1bc634c6ad34885ed1295660694a91c98933a6
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
4c50acf54e17870e9a5ebe944f589ecc5e1d947426519c6a969ae9db93040c88
501bca6154a273f391094d21a54102cfa1ada501d7c36180b14bbacee27c7a0c
5cc109dd2ea302de6ee7df3c4dd0d4d25b41277efcf7f370f50efe934544fd0c
5d72c5a8bef80fca6f99f476e15ec95ce2d5e5f65c6dab9ee8e56348be0d39fc
5e96c408271ce2999c052da5821e78872d784aa9a08b87fc6f4fb036e46eab99
6a7c86f248293d267e761b803fa30d6cc568fd66368e6740739c8ba7211be358
8955ee5e3071f91ed2460b5b634cdab6f6c15d5d8adefac0e3328de7f5889a97
926dbda18381253b1159a9d0d33866e018a6963edc64f53522ff9c5d53a4953f
9baad10e85c5be8d5697086479983b6b477197103bf8f0f11817b1bdfb9a7451
a32e14929dae4030d8fe0164ac57453ec28a2927b4e6f22d445934b829f6df14
b94c5158a9afa36c819f92b1e85dc50d2119ed7319c13471c86b0326edfe680c
c7eca97d84ed3469e7d1a20a8c28ef7177270b93a2d9913a0adad9a3e4bdfc9a
cc33975886ef8f7d3ebdcce9323d19bbe0729a87c6e29cec425d481547c81f7a
d1a498e72f62f80af25d958364158a781a8cdee723e700756b28756c97ee2fa1