office-365-security-notifications.com

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 5 HTTP transactions. The main IP is 3.225.85.9, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is office-365-security-notifications.com.

This is the only time office-365-security-notifications.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Office 365 (Online)

Domain & IP information

	IP Address	AS Autonomous System
2	3.225.85.9 3.225.85.9	14618 (AMAZON-AES) (AMAZON-AES)
3	52.216.242.62 52.216.242.62	16509 (AMAZON-02) (AMAZON-02)
5	2

2 3.225.85.9 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-225-85-9.compute-1.amazonaws.com

office-365-security-notifications.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 52.216.242.62 (Ashburn, United States)

ASN16509 (AMAZON-02, US)
PTR: s3-1.amazonaws.com

s3.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	amazonaws.com s3.amazonaws.com	205 KB
2	office-365-security-notifications.com office-365-security-notifications.com	5 KB
5	2

	Domain	Requested by
3	s3.amazonaws.com	office-365-security-notifications.com
2	office-365-security-notifications.com	office-365-security-notifications.com
5	2

This site contains no links.

Subject Issuer	Validity	Valid
s3.amazonaws.com DigiCert Baltimore CA-2 G2	`2021-06-23` - `2022-07-24`	a year	crt.sh

This page contains 1 frames:

Primary Page: http://office-365-security-notifications.com/landing/form/c16a40c8-13fe-4c45-9801-6b42923e22e9
Frame ID: 81E06EAD1D492E8A49DBE799AD198D79
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Outlook 365 Login

Page Statistics

5
Requests

60 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

210 kB
Transfer

210 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request c16a40c8-13fe-4c45-9801-6b42923e22e9 Show response
office-365-security-notifications.com/landing/form/ 3 KB
2 KB 467ms
462ms Document
text/html 3.225.85.9
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

http://office-365-security-notifications.com/landing/form/c16a40c8-13fe-4c45-9801-6b42923e22e9

Protocol

HTTP/1.1

Server

3.225.85.9 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-225-85-9.compute-1.amazonaws.com

Software

nginx /

Resource Hash

137911b7906599b683eb6e68a4e102620bbfa7e973e3dbea8b2ecec469333515

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: jp-JP,jp;q=0.9

Response headers

Date: Fri, 26 Nov 2021 21:27:57 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx
X-Frame-Options: SAMEORIGIN
Referrer-Policy: unsafe-url
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=63072000; includeSubDomains
Content-Encoding: gzip

GET
H/1.1 200
OK data-entry.28fd3fcdd108af61.css
office-365-security-notifications.com/css/ 3 KB
4 KB 167ms
167ms Stylesheet
text/css 3.225.85.9
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

http://office-365-security-notifications.com/css/data-entry.28fd3fcdd108af61.css

Requested by

Host: office-365-security-notifications.com
URL: http://office-365-security-notifications.com/landing/form/c16a40c8-13fe-4c45-9801-6b42923e22e9

Protocol

HTTP/1.1

Server

3.225.85.9 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-225-85-9.compute-1.amazonaws.com

Software

nginx /

Resource Hash

118f737bd7e1c92f1ced69e9e628f2e4728094d02e7c225089a7e7bdeabd76cc

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: http://office-365-security-notifications.com/landing/form/c16a40c8-13fe-4c45-9801-6b42923e22e9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date: Fri, 26 Nov 2021 21:27:57 GMT
X-Content-Type-Options: nosniff
Last-Modified: Wed, 24 Nov 2021 21:06:27 GMT
Server: nginx
ETag: "619ea953-db8"
Strict-Transport-Security: max-age=63072000; includeSubDomains
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3512
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK logo-outlook365.png
s3.amazonaws.com/securityiq/phishing-templates/Outlook+365/ 4 KB
5 KB 730ms
223ms Image
image/png 52.216.242.62
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3.amazonaws.com/securityiq/phishing-templates/Outlook+365/logo-outlook365.png
Requested by: Host: office-365-security-notifications.com
URL: http://office-365-security-notifications.com/landing/form/c16a40c8-13fe-4c45-9801-6b42923e22e9
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.216.242.62 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: fc5c3d7d2b298a42ec44dad2d8cd227b734db966b4afa68c0254a497e805f603

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: http://office-365-security-notifications.com/landing/form/c16a40c8-13fe-4c45-9801-6b42923e22e9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date: Fri, 26 Nov 2021 21:27:59 GMT
Last-Modified: Tue, 21 Feb 2017 14:16:38 GMT
Server: AmazonS3
x-amz-request-id: X81CR7HYXQKSRD5E
ETag: "9f09a27d4f69b3557c7433574a29d726"
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 4585
x-amz-id-2: iRxjeEpld8hOkVXwhynUgPm+jd4ze/MbyFDVksGGuxRrgiECA+kfNYp9NQHwiFkIJ10x9q+EC3s=

GET
H/1.1 200
OK logo-microsoft.png
s3.amazonaws.com/securityiq/phishing-templates/Outlook+365/ 1 KB
1 KB 732ms
217ms Image
image/png 52.216.242.62
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3.amazonaws.com/securityiq/phishing-templates/Outlook+365/logo-microsoft.png
Requested by: Host: office-365-security-notifications.com
URL: http://office-365-security-notifications.com/landing/form/c16a40c8-13fe-4c45-9801-6b42923e22e9
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.216.242.62 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: 988e349f2bf4e87154738c7b2c1fa86618713a8cfa0cef60a046f5add89bd9de

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: http://office-365-security-notifications.com/landing/form/c16a40c8-13fe-4c45-9801-6b42923e22e9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date: Fri, 26 Nov 2021 21:27:59 GMT
Last-Modified: Tue, 21 Feb 2017 14:16:38 GMT
Server: AmazonS3
x-amz-request-id: X814BKJB4F8VEZA4
ETag: "e4b675007dc6492ee590131d1f7dfbb3"
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 1040
x-amz-id-2: B6ClimF8/w+UgX4ZpmVSXBGZEq50m07S/psA8ywubLsu9wm6F8XeFCtEZyiGYyPzT2aVRnItXwQ=

GET
H/1.1 200
OK background.jpg
s3.amazonaws.com/securityiq/phishing-templates/Outlook+365/ 199 KB
199 KB 756ms
228ms Image
image/jpeg 52.216.242.62
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3.amazonaws.com/securityiq/phishing-templates/Outlook+365/background.jpg
Requested by: Host: office-365-security-notifications.com
URL: http://office-365-security-notifications.com/landing/form/c16a40c8-13fe-4c45-9801-6b42923e22e9
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.216.242.62 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: 7e50e406688bd898803f653058d14ca384734cb9b39ba900bc5e2734b59c073b

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: http://office-365-security-notifications.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date: Fri, 26 Nov 2021 21:27:59 GMT
Last-Modified: Tue, 21 Feb 2017 14:16:38 GMT
Server: AmazonS3
x-amz-request-id: X819YQ9H4ZEJBSCF
ETag: "65283b123eb235e6176ae98c02ac5b1c"
Content-Type: image/jpeg
Accept-Ranges: bytes
Content-Length: 203294
x-amz-id-2: bvniYyct8DfqhcETGQK6QYuBmguBgB5A2S43IEnnoOz1dcPvdPieHJwna7u650W5PXTOkqGvhIA=

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Office 365 (Online)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

office-365-security-notifications.com
s3.amazonaws.com
3.225.85.9
52.216.242.62
118f737bd7e1c92f1ced69e9e628f2e4728094d02e7c225089a7e7bdeabd76cc
137911b7906599b683eb6e68a4e102620bbfa7e973e3dbea8b2ecec469333515
7e50e406688bd898803f653058d14ca384734cb9b39ba900bc5e2734b59c073b
988e349f2bf4e87154738c7b2c1fa86618713a8cfa0cef60a046f5add89bd9de
fc5c3d7d2b298a42ec44dad2d8cd227b734db966b4afa68c0254a497e805f603

office-365-security-notifications.com Open in urlscan Pro 3.225.85.9 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

5 Requests

60 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

1 Countries

210 kBTransfer

210 kBSize

0 Cookies

0 Outgoing links

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

0 Cookies

Security Headers

Indicators

office-365-security-notifications.com Open in urlscan Pro
3.225.85.9 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

60 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

210 kB
Transfer

210 kB
Size

0
Cookies

5 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!