aruba-mail.website.yandexcloud.net
Open in
urlscan Pro
2a02:6b8::1da
Malicious Activity!
Public Scan
Submission: On March 03 via automatic, source phishtank
Summary
TLS certificate: Issued by Yandex CA on October 2nd 2020. Valid for: 6 months.
This is the only time aruba-mail.website.yandexcloud.net was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Aruba (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 | 2a02:6b8::1da 2a02:6b8::1da | 13238 (YANDEX) (YANDEX) | |
1 | 2a00:1450:400... 2a00:1450:4001:811::200a | 15169 (GOOGLE) (GOOGLE) | |
10 | 2606:4700:303... 2606:4700:3033::ac43:9757 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a00:1450:400... 2a00:1450:4001:80e::200a | 15169 (GOOGLE) (GOOGLE) | |
2 | 2a00:1450:400... 2a00:1450:4001:810::2003 | 15169 (GOOGLE) (GOOGLE) | |
16 | 5 |
ASN13238 (YANDEX, RU)
aruba-mail.website.yandexcloud.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
10 |
fromano.xyz
fromano.xyz |
169 KB |
2 |
gstatic.com
fonts.gstatic.com |
28 KB |
2 |
googleapis.com
fonts.googleapis.com ajax.googleapis.com |
30 KB |
2 |
yandexcloud.net
aruba-mail.website.yandexcloud.net |
5 KB |
16 | 4 |
Domain | Requested by | |
---|---|---|
10 | fromano.xyz |
aruba-mail.website.yandexcloud.net
fromano.xyz |
2 | fonts.gstatic.com |
fonts.googleapis.com
|
2 | aruba-mail.website.yandexcloud.net |
aruba-mail.website.yandexcloud.net
|
1 | ajax.googleapis.com |
aruba-mail.website.yandexcloud.net
|
1 | fonts.googleapis.com |
aruba-mail.website.yandexcloud.net
|
16 | 5 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.website.yandexcloud.net Yandex CA |
2020-10-02 - 2021-04-02 |
6 months | crt.sh |
upload.video.google.com GTS CA 1O1 |
2021-01-26 - 2021-04-20 |
3 months | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2021-01-23 - 2022-01-22 |
a year | crt.sh |
*.gstatic.com GTS CA 1O1 |
2021-01-26 - 2021-04-20 |
3 months | crt.sh |
This page contains 2 frames:
Primary Page:
https://aruba-mail.website.yandexcloud.net/
Frame ID: 83B75EF56B011F112EBADA9DCF283B5B
Requests: 15 HTTP requests in this frame
Frame:
https://aruba-mail.website.yandexcloud.net/left_block.html
Frame ID: 1A0908B8AC0B5B7E48434CBFDC0B4C6D
Requests: 1 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
16 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
aruba-mail.website.yandexcloud.net/ |
19 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
2 KB 517 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
login.css
fromano.xyz/aruba2/web_imgs/login/css/ |
11 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/2.2.4/ |
84 KB 29 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
dojo.js
fromano.xyz/aruba2/javascript/startup/dojo/dojo/ |
89 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
gb.png
fromano.xyz/aruba2/web_imgs/login/images/flag/ |
599 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
login.js
fromano.xyz/aruba2/ext_aruba/js/ |
20 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
S6uyw4BMUTPHjx4wXiWtFCc.woff2
fonts.gstatic.com/s/lato/v17/ |
14 KB 14 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
left_block.html
aruba-mail.website.yandexcloud.net/ Frame 1A09 |
208 B 422 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
left-block-image.jpg
fromano.xyz/aruba2/web_imgs/login/images/ |
122 KB 122 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
aruba-logo.svg
fromano.xyz/aruba2/web_imgs/login/images/ |
15 KB 6 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
envelope.svg
fromano.xyz/aruba2/web_imgs/login/images/ |
681 B 794 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
login-icon.svg
fromano.xyz/aruba2/web_imgs/login/images/ |
666 B 654 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
password-icon.svg
fromano.xyz/aruba2/web_imgs/login/images/ |
585 B 608 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
password-icon-2.svg
fromano.xyz/aruba2/web_imgs/login/images/ |
947 B 910 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-Q050 |
S6u9w4BMUTPHh6UVSwiPGQ3q5d0.woff2
fonts.gstatic.com/s/lato/v17/ |
14 KB 14 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Aruba (Online)63 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery object| dojo object| dijit object| dojox string| UX_LEGGERA string| UX_WEB2CS string| UX_FIZZER string| UX_HTML string| UX_PEC boolean| manage boolean| classic object| i18n_login function| isBrowserSupported object| JsonFormatter function| encodeCredentials function| login_setCredentials function| login_getCookie function| login_setCookie function| login_initAdvancedPage function| login_initPage function| login_initRadios function| displayTab function| getLanguage function| login_showPopup function| login_errorPopup function| login_hidePopup function| login_getSelectedUx function| launchLogin function| launchUser function| launchAdmin function| login_web2cs function| login_errorCallback function| isBetaOptimizable function| login_leggera function| auto_login function| isPecDomain function| login_pec function| login_html function| login_fizzer function| display_redirect function| showPassword function| onInputFocus function| onInputBlur function| onInputChange function| DOMContentLoadedListener function| login_setLanguageCookie function| loginGetLanguage function| login_initLocalization function| changeLanguage function| showLanguage function| login_localize function| fstring0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
aruba-mail.website.yandexcloud.net
fonts.googleapis.com
fonts.gstatic.com
fromano.xyz
2606:4700:3033::ac43:9757
2a00:1450:4001:80e::200a
2a00:1450:4001:810::2003
2a00:1450:4001:811::200a
2a02:6b8::1da
036d841b132c14046e26d8f2da1bc634c6ad34885ed1295660694a91c98933a6
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
4957d1c429ec92d8e4e0879927a136876ff79fa33a5f04720ed245bd5f3098c7
4c50acf54e17870e9a5ebe944f589ecc5e1d947426519c6a969ae9db93040c88
5cc109dd2ea302de6ee7df3c4dd0d4d25b41277efcf7f370f50efe934544fd0c
5d72c5a8bef80fca6f99f476e15ec95ce2d5e5f65c6dab9ee8e56348be0d39fc
5e96c408271ce2999c052da5821e78872d784aa9a08b87fc6f4fb036e46eab99
6a7c86f248293d267e761b803fa30d6cc568fd66368e6740739c8ba7211be358
8955ee5e3071f91ed2460b5b634cdab6f6c15d5d8adefac0e3328de7f5889a97
926dbda18381253b1159a9d0d33866e018a6963edc64f53522ff9c5d53a4953f
9baad10e85c5be8d5697086479983b6b477197103bf8f0f11817b1bdfb9a7451
a32e14929dae4030d8fe0164ac57453ec28a2927b4e6f22d445934b829f6df14
b94c5158a9afa36c819f92b1e85dc50d2119ed7319c13471c86b0326edfe680c
c7eca97d84ed3469e7d1a20a8c28ef7177270b93a2d9913a0adad9a3e4bdfc9a
cc33975886ef8f7d3ebdcce9323d19bbe0729a87c6e29cec425d481547c81f7a
d1a498e72f62f80af25d958364158a781a8cdee723e700756b28756c97ee2fa1