urlscan.io logo urlscan.io
SecurityTrails logo

securelogon.securelogonreviews.com Open in urlscan Pro
170.130.165.12  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://mediatheekwise-demo.wise-nl.oclc.org/cgi-bin/bx.pl?event=redir;urlescape=no;by=wcp;var=portal;sid=3788190d-7438-4c6f-9d67-a845c0b1dbe...
Effective URL: https://securelogon.securelogonreviews.com/?username=dcrawford@bruceflint.com
Submission: On May 23 via manual from US — Scanned from NL
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 3 countries across 3 domains to perform 3 HTTP transactions. The main IP is 170.130.165.12, located in Gilbert, United States and belongs to AS62904, US. The main domain is securelogon.securelogonreviews.com.
TLS certificate: Issued by R3 on May 23rd 2023. Valid for: 3 months.
This is the only time securelogon.securelogonreviews.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

IP Address AS Autonomous System
1 1 193.240.184.22 4373 (OCLC-AS)
1 185.101.226.25 50926 (AXARNET-AS)
2 170.130.165.12 62904 (AS62904)
3 3
Domain Requested by
2 securelogon.securelogonreviews.com securelogon.securelogonreviews.com
1 primerospasos.net
1 mediatheekwise-demo.wise-nl.oclc.org 1 redirects
3 3

This site contains no links.

Subject Issuer Validity Valid
primerospasos.net
R3		 2023-05-02 -
2023-07-31		 3 months crt.sh
securelogonreviews.com
R3		 2023-05-23 -
2023-08-21		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://securelogon.securelogonreviews.com/?username=dcrawford@bruceflint.com
Frame ID: 629140732DDBA8778CD39ECC7317F23F
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

reCAPTCHA

Page Statistics

3
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

161 kB
Transfer

449 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://mediatheekwise-demo.wise-nl.oclc.org/cgi-bin/bx.pl?event=redir;urlescape=no;by=wcp;var=portal;sid=3788190d-7438-4c6f-9d67-a845c0b1dbe3;vestnr=8000;url=%68%74%74%70%73%3A%2F%2F%70%72%69%6D%65%72%6F%73%70%61%73%6F%73%2E%6E%65%74%2F%66%69%6C%65%2F%3F%75%73%65%72%69%64%3D%64%63%72%61%77%66%6F%72%64%40%62%72%75%63%65%66%6C%69%6E%74%2E%63%6F%6D HTTP 302
  • https://primerospasos.net/file/?userid=dcrawford@bruceflint.com

3 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
primerospasos.net/file/
Redirect Chain
  • https://mediatheekwise-demo.wise-nl.oclc.org/cgi-bin/bx.pl?event=redir;urlescape=no;by=wcp;var=portal;sid=3788190d-7438-4c6f-9d67-a845c0b1dbe3;vestnr=8000;url=%68%74%74%70%73%3A%2F%2F%70%72%69%6D%6...
  • https://primerospasos.net/file/?userid=dcrawford@bruceflint.com
0
130 B 		Document
General
Check archive.org
Download Go to
Full URL
https://primerospasos.net/file/?userid=dcrawford@bruceflint.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
185.101.226.25 , Spain, ASN50926 (AXARNET-AS, ES),
Reverse DNS
mail.ehost6025.hostinet.com
Software
Apache /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language
nl-NL,nl;q=0.9

Response headers

content-length
0
content-type
text/html; charset=UTF-8
date
Tue, 23 May 2023 21:13:20 GMT
refresh
0;url=https://securelogon.securelogonreviews.com/?username=dcrawford@bruceflint.com
server
Apache

Redirect headers

Access-Control-Allow-Credentials
true
Access-Control-Allow-Methods
GET, PUT, OPTIONS
Access-Control-Allow-Origin
https://mediatheekwise-demo.wise-nl.oclc.org
Cache-Control
private
Connection
Keep-Alive
Content-Length
247
Content-Security-Policy
frame-ancestors 'self' ; report-to default; report-uri https://www.wise-nl.oclc.org/csp_reports/prod/;
Content-Type
text/html; charset=iso-8859-1
Date
Tue, 23 May 2023 21:13:20 GMT
Keep-Alive
timeout=5, max=100
Location
https://primerospasos.net/file/?userid=dcrawford@bruceflint.com
Referrer-Policy
strict-origin-when-cross-origin
Report-To
{"group":"default","max_age":86400,"endpoints":[{"url":"https://www.wise-nl.oclc.org/csp_reports/prod/"}],"include_subdomains":true}
Server
nginx
Strict-Transport-Security
max-age=31536000 ; includeSubDomains
Vary
Origin
X-Content-Type-Options
nosniff
X-XSS-Protection
1; mode=block
Primary Request /
securelogon.securelogonreviews.com/ 		409 KB
160 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://securelogon.securelogonreviews.com/?username=dcrawford@bruceflint.com
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
170.130.165.12 Gilbert, United States, ASN62904 (AS62904, US),
Reverse DNS
Software
nginx /
Resource Hash
5992d1bc4468da17d81bbffa642f736faf4946be987bec8d9a9ee480e3831151
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://primerospasos.net/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language
nl-NL,nl;q=0.9

Response headers

content-encoding
gzip
content-type
text/html; charset=utf-8
date
Tue, 23 May 2023 21:13:23 GMT
server
nginx
strict-transport-security
max-age=31536000; includeSubDomains
vary
Accept-Encoding
truncated
/ 		858 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
19b8ee66ab60c45d5d24988d090b61c938b44c2ee9a5f8558335b27a2f315072

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Content-Type
image/jpeg
truncated
/ 		40 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
64c2019b369b4f3b45009d1740f4c7ae0856bb2608aea7d7628b78f43cecb3fa

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Content-Type
image/png
/
securelogon.securelogonreviews.com/ 		209 B
349 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securelogon.securelogonreviews.com/?username=dcrawford@bruceflint.com
Requested by
Host: securelogon.securelogonreviews.com
URL: https://securelogon.securelogonreviews.com/?username=dcrawford@bruceflint.com
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
170.130.165.12 Gilbert, United States, ASN62904 (AS62904, US),
Reverse DNS
Software
nginx /
Resource Hash
135960808697642cc9144d5f3dd25c23636be1b198539e4596dc7d4f8062586d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
Content-Type
application/json

Response headers

date
Tue, 23 May 2023 21:13:24 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
server
nginx
vary
Accept-Encoding
content-type
application/json

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless function| a0_0xa44f function| a0_0x31ef function| setCookie function| onCheckBoxChange

0 Cookies