urlscan.io logo urlscan.io
SecurityTrails logo

securitynotifications.org Open in urlscan Pro
13.225.214.41  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://securitynotifications.org/?u=24862-984b98dd260836cfef84208cf131689b8f37f1680ee146e19d720e859f716732
Effective URL: https://securitynotifications.org/?u=24862-984b98dd260836cfef84208cf131689b8f37f1680ee146e19d720e859f716732
Submission: On January 20 via api from US — Scanned from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 1 countries across 4 domains to perform 6 HTTP transactions. The main IP is 13.225.214.41, located in United States and belongs to AMAZON-02, US. The main domain is securitynotifications.org.
TLS certificate: Issued by Amazon RSA 2048 M03 on January 18th 2024. Valid for: a year.
This is the only time securitynotifications.org was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

IP Address AS Autonomous System
1 1 13.225.214.94 16509 (AMAZON-02)
1 13.225.214.41 16509 (AMAZON-02)
3 54.231.230.128 16509 (AMAZON-02)
1 151.101.130.137 54113 (FASTLY)
6 4
Apex Domain
Subdomains		 Transfer
3 amazonaws.com
s3.amazonaws.com
284 KB
2 securitynotifications.org
securitynotifications.org
58 KB
1 newrelic.com
js-agent.newrelic.com — Cisco Umbrella Rank: 600
29 KB
0 nr-data.net Failed
bam.nr-data.net Failed
6 4
Domain Requested by
3 s3.amazonaws.com securitynotifications.org
2 securitynotifications.org 1 redirects
1 js-agent.newrelic.com securitynotifications.org
0 bam.nr-data.net Failed securitynotifications.org
6 4

This site contains no links.

Subject Issuer Validity Valid
securitynotifications.org
Amazon RSA 2048 M03		 2024-01-18 -
2025-02-15		 a year crt.sh
s3.amazonaws.com
Amazon RSA 2048 M01		 2023-10-10 -
2024-07-10		 9 months crt.sh
js-agent.newrelic.com
GlobalSign Atlas R3 DV TLS CA 2024 Q1		 2024-01-15 -
2025-02-15		 a year crt.sh

This page contains 1 frames:

Primary Page: https://securitynotifications.org/?u=24862-984b98dd260836cfef84208cf131689b8f37f1680ee146e19d720e859f716732
Frame ID: C8525337636262DA28EFA6A9277BEABD
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Sign in to your account

Page URL History Show full URLs

  1. http://securitynotifications.org/?u=24862-984b98dd260836cfef84208cf131689b8f37f1680ee146e19d720e859f716732 HTTP 301
    https://securitynotifications.org/?u=24862-984b98dd260836cfef84208cf131689b8f37f1680ee146e19d720e859f716732 Page URL

Page Statistics

6
Requests

83 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

4
IPs

1
Countries

369 kB
Transfer

425 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://securitynotifications.org/?u=24862-984b98dd260836cfef84208cf131689b8f37f1680ee146e19d720e859f716732 HTTP 301
    https://securitynotifications.org/?u=24862-984b98dd260836cfef84208cf131689b8f37f1680ee146e19d720e859f716732 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
securitynotifications.org/
Redirect Chain
  • http://securitynotifications.org/?u=24862-984b98dd260836cfef84208cf131689b8f37f1680ee146e19d720e859f716732
  • https://securitynotifications.org/?u=24862-984b98dd260836cfef84208cf131689b8f37f1680ee146e19d720e859f716732
57 KB
57 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://securitynotifications.org/?u=24862-984b98dd260836cfef84208cf131689b8f37f1680ee146e19d720e859f716732
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.225.214.41 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-214-41.ewr50.r.cloudfront.net
Software
/
Resource Hash
ccf91516ed4822a92ca7d7f0f17440839400ecdfa470fe651bec5d6de3a81ab5

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language
en-US,en;q=0.9

Response headers

cache-control
no-cache, private
content-length
58068
content-type
text/html; charset=UTF-8
date
Sat, 20 Jan 2024 21:49:29 GMT
via
1.1 6e131451bd3f2f00145987b931606ec0.cloudfront.net (CloudFront)
x-amz-apigw-id
R27sdGmwIAMEiQw=
x-amz-cf-id
9H4KLrD0yLzJLuklMTwLxNfM4XguMfTXI-srI0NU6q_rT150aIPQNQ==
x-amz-cf-pop
EWR50-C1
x-amzn-remapped-date
Sat, 20 Jan 2024 21:49:29 GMT
x-amzn-requestid
815142f8-e44a-44b8-88be-5399e15ffa17
x-amzn-trace-id
Root=1-65ac3fe9-77aabe530686064b5238f453;Sampled=0;lineage=499f168b:0
x-cache
Miss from cloudfront

Redirect headers

Connection
keep-alive
Content-Length
167
Content-Type
text/html
Date
Sat, 20 Jan 2024 21:49:28 GMT
Location
https://securitynotifications.org/?u=24862-984b98dd260836cfef84208cf131689b8f37f1680ee146e19d720e859f716732
Server
CloudFront
Via
1.1 3aa2aa1b7b816f70e94675c9a63f98d0.cloudfront.net (CloudFront)
X-Amz-Cf-Id
phGpcdvjRFlN0NXt8HWONPkkSHVFmEusS8d5Oh1z5DTA7y0h0Ppy-A==
X-Amz-Cf-Pop
EWR50-C1
X-Cache
Redirect from cloudfront
microsoft%2Fhome%2Fstyle.css
s3.amazonaws.com/media.aws-cdn/ 		2 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://s3.amazonaws.com/media.aws-cdn/microsoft%2Fhome%2Fstyle.css
Requested by
Host: securitynotifications.org
URL: https://securitynotifications.org/?u=24862-984b98dd260836cfef84208cf131689b8f37f1680ee146e19d720e859f716732
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.231.230.128 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-1.amazonaws.com
Software
AmazonS3 /
Resource Hash
e07e15a16cc0a9cb1c728d890c3bd082b6a00e31722218dc368d801ca987caf9

Request headers

accept-language
en-US,en;q=0.9
Referer
https://securitynotifications.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date
Sat, 20 Jan 2024 21:49:30 GMT
Last-Modified
Fri, 29 Mar 2019 13:36:56 GMT
Server
AmazonS3
x-amz-request-id
T09MVHVMB57C0H7S
ETag
"7a4873a58a76a0e37ddecd2422b330a4"
Content-Type
text/css
Accept-Ranges
bytes
Content-Length
2311
x-amz-id-2
IL63CHtUT4gXx76615OXuBBesRf8b9L+w92qRkVun07Patyqrv9HF69jhxpHl3uyUroMvsIi6ag=
microsoft%2Fhome%2Flogo.svg
s3.amazonaws.com/media.aws-cdn/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s3.amazonaws.com/media.aws-cdn/microsoft%2Fhome%2Flogo.svg
Requested by
Host: securitynotifications.org
URL: https://securitynotifications.org/?u=24862-984b98dd260836cfef84208cf131689b8f37f1680ee146e19d720e859f716732
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.231.230.128 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-1.amazonaws.com
Software
AmazonS3 /
Resource Hash
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a

Request headers

accept-language
en-US,en;q=0.9
Referer
https://securitynotifications.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date
Sat, 20 Jan 2024 21:49:30 GMT
Last-Modified
Fri, 29 Mar 2019 13:05:56 GMT
Server
AmazonS3
x-amz-request-id
T09M68N6BQT3RRMX
ETag
"ee5c8d9fb6248c938fd0dc19370e90bd"
Content-Type
image/svg+xml
Accept-Ranges
bytes
Content-Length
3651
x-amz-id-2
W06bRhtKHD6sjghP5OBYMIehhq9OxASAy9uAeOeNSBBGZnd2Qm67B1MsNIHtCBd6DihN/tNoouM=
microsoft%2Fhome%2Fbackground_scene.jpg
s3.amazonaws.com/media.aws-cdn/ 		277 KB
277 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s3.amazonaws.com/media.aws-cdn/microsoft%2Fhome%2Fbackground_scene.jpg
Requested by
Host: securitynotifications.org
URL: https://securitynotifications.org/?u=24862-984b98dd260836cfef84208cf131689b8f37f1680ee146e19d720e859f716732
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.231.230.128 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-1.amazonaws.com
Software
AmazonS3 /
Resource Hash
211a907de2da0ff4a0e90917ac8054e2f35c351180977550c26e51b4909f2beb

Request headers

accept-language
en-US,en;q=0.9
Referer
https://securitynotifications.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date
Sat, 20 Jan 2024 21:49:30 GMT
Last-Modified
Fri, 29 Mar 2019 12:59:37 GMT
Server
AmazonS3
x-amz-request-id
T09VVFDJ8MDGJA1W
ETag
"a5dbd4393ff6a725c7e62b61df7e72f0"
Content-Type
image/jpeg
Accept-Ranges
bytes
Content-Length
283351
x-amz-id-2
B/+AFmNzazxDPEosoELxEDrrmF/VqIEemCQpGDEapbMEfw9ZjyNpstiTPyE/cSsN5JVWr1rSC3U=
nr-spa-1.250.0.min.js
js-agent.newrelic.com/ 		86 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js-agent.newrelic.com/nr-spa-1.250.0.min.js
Requested by
Host: securitynotifications.org
URL: https://securitynotifications.org/?u=24862-984b98dd260836cfef84208cf131689b8f37f1680ee146e19d720e859f716732
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.130.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
8aaf0af04baf8eaa35b1ac46ed02d131a8d3c44896b92a45fa1555c70ebc94c9
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

Referer
https://securitynotifications.org/
Origin
https://securitynotifications.org
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-amz-version-id
9CPSHfU_b43id9HPDI1ELov4Sz01U0Ym
content-encoding
br
via
1.1 varnish
date
Sat, 20 Jan 2024 21:49:30 GMT
strict-transport-security
max-age=300
x-amz-request-id
HST3B0FW3N9P31WB
x-amz-server-side-encryption
AES256
x-cache
HIT
cross-origin-resource-policy
cross-origin
content-length
28786
x-amz-id-2
HMMTt/D0nZXZLvTJpXJUuRrdZUlE4rr4DZJh1yOBBgmklGzIR5Z0LvRAf0U1kg9TkrrkE5iTrjQ=
x-served-by
cache-mia-kmia1760065-MIA
last-modified
Tue, 09 Jan 2024 19:15:56 GMT
server
AmazonS3
x-timer
S1705787371.608762,VS0,VE0
etag
"6e3b65f7f44fa4b3bf86d1f0187490ce"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=86400, stale-if-error=86400
accept-ranges
bytes
x-cache-hits
507828
undefined
bam.nr-data.net/1/ 		0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
bam.nr-data.net
URL
https://bam.nr-data.net/1/undefined?a=undefined&v=1.250.0&t=Unnamed%20Transaction&rst=1878&ck=0&s=6d33091dfb9bc5d2&ref=https://securitynotifications.org/&hr=0&af=err,xhr,stn,ins,spa&be=694&fe=674&dc=104&fsh=1&perf=%7B%22timing%22:%7B%22of%22:1705787368781,%22n%22:0,%22f%22:150,%22dn%22:152,%22dne%22:152,%22c%22:152,%22s%22:215,%22ce%22:283,%22rq%22:284,%22rp%22:694,%22rpe%22:755,%22di%22:798,%22ds%22:798,%22de%22:798,%22dc%22:1364,%22l%22:1364,%22le%22:1368%7D,%22navigation%22:%7B%7D%7D&fp=1037&fcp=1037

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| NREUM object| webpackChunk:NRBA-1.250.0.PROD object| newrelic

0 Cookies

2 Console Messages

Source Level URL
Text
javascript error URL: https://securitynotifications.org/?u=24862-984b98dd260836cfef84208cf131689b8f37f1680ee146e19d720e859f716732
Message:
Access to XMLHttpRequest at 'https://bam.nr-data.net/1/undefined?a=undefined&v=1.250.0&t=Unnamed%20Transaction&rst=1878&ck=0&s=6d33091dfb9bc5d2&ref=https://securitynotifications.org/&hr=0&af=err,xhr,stn,ins,spa&be=694&fe=674&dc=104&fsh=1&perf=%7B%22timing%22:%7B%22of%22:1705787368781,%22n%22:0,%22f%22:150,%22dn%22:152,%22dne%22:152,%22c%22:152,%22s%22:215,%22ce%22:283,%22rq%22:284,%22rp%22:694,%22rpe%22:755,%22di%22:798,%22ds%22:798,%22de%22:798,%22dc%22:1364,%22l%22:1364,%22le%22:1368%7D,%22navigation%22:%7B%7D%7D&fp=1037&fcp=1037' from origin 'https://securitynotifications.org' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://bam.nr-data.net/1/undefined?a=undefined&v=1.250.0&t=Unnamed%20Transaction&rst=1878&ck=0&s=6d33091dfb9bc5d2&ref=https://securitynotifications.org/&hr=0&af=err,xhr,stn,ins,spa&be=694&fe=674&dc=104&fsh=1&perf=%7B%22timing%22:%7B%22of%22:1705787368781,%22n%22:0,%22f%22:150,%22dn%22:152,%22dne%22:152,%22c%22:152,%22s%22:215,%22ce%22:283,%22rq%22:284,%22rp%22:694,%22rpe%22:755,%22di%22:798,%22ds%22:798,%22de%22:798,%22dc%22:1364,%22l%22:1364,%22le%22:1368%7D,%22navigation%22:%7B%7D%7D&fp=1037&fcp=1037
Message:
Failed to load resource: net::ERR_FAILED