secured-login.net
Open in
urlscan Pro
52.7.149.57
Malicious Activity!
Public Scan
Effective URL: https://secured-login.net/pages/750058e9b744/XcmVAjaXBpZWP50X2lkPTPM3ODM0boNjU4YNCZjYW1wXYWNlnbl9ydW5faWQ9MTQ1FMzgwNSZhY3R...
Submission: On November 03 via manual from IN
Summary
TLS certificate: Issued by Go Daddy Secure Certificate Authority... on March 31st 2016. Valid for: 3 years.
This is the only time secured-login.net was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Phishing Simulation (Internet)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 52.72.175.22 52.72.175.22 | 14618 (AMAZON-AES) (AMAZON-AES - Amazon.com) | |
10 | 52.7.149.57 52.7.149.57 | 14618 (AMAZON-AES) (AMAZON-AES - Amazon.com) | |
4 | 54.231.88.2 54.231.88.2 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
1 | 52.5.161.22 52.5.161.22 | 14618 (AMAZON-AES) (AMAZON-AES - Amazon.com) | |
1 | 23.210.249.165 23.210.249.165 | 16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies) | |
17 | 5 |
ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-52-72-175-22.compute-1.amazonaws.com
bofa.com-onlinebanking.com |
ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-52-7-149-57.compute-1.amazonaws.com
secured-login.net |
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: s3-1.amazonaws.com
s3.amazonaws.com |
ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-52-5-161-22.compute-1.amazonaws.com
www.hfflp.com |
ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a23-210-249-165.deploy.static.akamaitechnologies.com
www.ups.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
10 |
secured-login.net
secured-login.net |
893 KB |
4 |
amazonaws.com
s3.amazonaws.com |
86 KB |
1 |
ups.com
www.ups.com |
5 KB |
1 |
hfflp.com
www.hfflp.com |
5 KB |
1 |
com-onlinebanking.com
bofa.com-onlinebanking.com |
679 B |
17 | 5 |
Domain | Requested by | |
---|---|---|
10 | secured-login.net |
bofa.com-onlinebanking.com
secured-login.net |
4 | s3.amazonaws.com |
secured-login.net
|
1 | www.ups.com |
secured-login.net
|
1 | www.hfflp.com |
secured-login.net
|
1 | bofa.com-onlinebanking.com | |
17 | 5 |
This site contains links to these domains. Also see Links.
Domain |
---|
34.75.2o2.lol |
Subject Issuer | Validity | Valid | |
---|---|---|---|
knowbe4.com Go Daddy Secure Certificate Authority - G2 |
2016-03-31 - 2019-02-25 |
3 years | crt.sh |
s3.amazonaws.com DigiCert Baltimore CA-2 G2 |
2018-08-02 - 2019-10-25 |
a year | crt.sh |
*.hfflp.com COMODO RSA Organization Validation Secure Server CA |
2018-02-02 - 2020-12-27 |
3 years | crt.sh |
www.ups.com COMODO RSA Organization Validation Secure Server CA |
2018-04-24 - 2020-04-23 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
https://secured-login.net/pages/750058e9b744/XcmVAjaXBpZWP50X2lkPTPM3ODM0boNjU4YNCZjYW1wXYWNlnbl9ydW5faWQ9MTQ1FMzgwNSZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vc2VjdXJlZC1sb2dpbi5uZXQvcGFnZXMvNzUwMDU4ZTliNzQ0
Frame ID: 97F71D5E94707C5333569E4306D50F8A
Requests: 17 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
- http://bofa.com-onlinebanking.com/XcmVAjaXBpZWP50X2lkPTPM3ODM0boNjU4YNCZjYW1wXYWNlnbl9ydW5faWQ9MTQ1FMzgwNSZhY3... Page URL
- https://secured-login.net/pages/750058e9b744/XcmVAjaXBpZWP50X2lkPTPM3ODM0boNjU4YNCZjYW1wXYWNlnbl9ydW5f... Page URL
Detected technologies
Ubuntu (Operating Systems) ExpandDetected patterns
- headers server /Ubuntu/i
Nginx (Web Servers) Expand
Detected patterns
- headers server /nginx(?:\/([\d.]+))?/i
Modernizr (JavaScript Libraries) Expand
Detected patterns
- script /modernizr(?:-([\d.]*[\d]))?.*\.js/i
- env /^Modernizr$/i
Moment.js (JavaScript Libraries) Expand
Detected patterns
- env /^moment$/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- env /^jQuery$/i
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: CLICK HERE
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- http://bofa.com-onlinebanking.com/XcmVAjaXBpZWP50X2lkPTPM3ODM0boNjU4YNCZjYW1wXYWNlnbl9ydW5faWQ9MTQ1FMzgwNSZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vc2VjdXJlZC1sb2dpbi5uZXQvcGFnZXMvNzUwMDU4ZTliNzQ0 Page URL
- https://secured-login.net/pages/750058e9b744/XcmVAjaXBpZWP50X2lkPTPM3ODM0boNjU4YNCZjYW1wXYWNlnbl9ydW5faWQ9MTQ1FMzgwNSZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vc2VjdXJlZC1sb2dpbi5uZXQvcGFnZXMvNzUwMDU4ZTliNzQ0 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
17 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
XcmVAjaXBpZWP50X2lkPTPM3ODM0boNjU4YNCZjYW1wXYWNlnbl9ydW5faWQ9MTQ1FMzgwNSZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vc2VjdXJlZC1sb2dpbi5uZXQvcGFnZXMvNzUwMDU4ZTliNzQ0
bofa.com-onlinebanking.com/ |
334 B 679 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
XcmVAjaXBpZWP50X2lkPTPM3ODM0boNjU4YNCZjYW1wXYWNlnbl9ydW5faWQ9MTQ1FMzgwNSZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vc2VjdXJlZC1sb2dpbi5uZXQvcGFnZXMvNzUwMDU4ZTliNzQ0
secured-login.net/pages/750058e9b744/ |
63 KB 25 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
application-18d04b9ea240d1dd98b3bec5ea105e9c97ee8647b26328034d2aa62fd65ac03b.js
secured-login.net/assets/ |
3 MB 846 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
modernizr-654222debe8018b12f1993ceddff30dc163a7d5008d79869c399d6d167321f97.js
secured-login.net/assets/ |
50 KB 16 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
landing-watermark-b0b90df080d521e4c17ef323d0af819c49f1337c52ae3df28f861dcead05bb1c.css
secured-login.net/assets/ |
606 B 531 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sei-modal-18bd5ec103f064289d063ed0d12338765b0e2721fb4e99e6ea0b6d59d7a1344c.css
secured-login.net/assets/ |
624 B 602 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sei-tooltip-765b79bc8e03650717748466e848ae546208dafc86bc4903d33d56badb3f67b1.css
secured-login.net/assets/ |
2 KB 802 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sei-flag-5d737a9fc0b8eb1f5c0718dc7e6c9d994112556b34c564b7ababf85152ebe82d.css
secured-login.net/assets/ |
1 KB 771 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
application-87635df3acecc18d2e03f0e9c45206250468da3458c8aff6a8e911914c19b267.js
secured-login.net/assets/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
dd.css
s3.amazonaws.com/helpimg/landing_pages/css/ |
4 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
flags.css
s3.amazonaws.com/helpimg/landing_pages/css/ |
10 KB 10 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
HFF.png
www.hfflp.com/App_Common/143/139/Library/39/ |
3 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
email_header_blue.gif
www.ups.com/img/en/ |
4 KB 5 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
application-87635df3acecc18d2e03f0e9c45206250468da3458c8aff6a8e911914c19b267.js
secured-login.net/assets/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sei-flag-fc5e7621ba0e98c5c6728e3b2bdf802311c0a0953a05e60a7551cb0c7bed00a9.png
secured-login.net/assets/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
flagssprite_small.png
s3.amazonaws.com/helpimg/landing_pages/images/ |
70 KB 71 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
blank.gif
s3.amazonaws.com/helpimg/landing_pages/images/ |
53 B 432 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Phishing Simulation (Internet)60 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| _typeof boolean| windowIsDefined function| _extends function| FlatpickrInstance function| _flatpickr function| flatpickr function| updateQueryStringParameter function| getParam function| colSort function| ES6Promise function| $ function| jQuery object| jQuery112409428927813464492 function| Retina function| RetinaImagePath function| RetinaImage function| Color function| Chart object| Chartkick function| proj4 function| AjaxBootstrapSelect function| AjaxBootstrapSelectList function| AjaxBootstrapSelectRequest function| Slider object| Utils object| asap_questionaire function| AsapStoreViewer object| Routes function| moment object| FullCalendar function| _ object| ProgressBar object| html5 object| Modernizr object| msBeautify object| translations string| en_lang string| sa_lang string| cn_lang string| cz_lang string| nl_lang string| fr_lang string| ca_lang string| de_lang string| in_lang string| hu_lang string| it_lang string| jp_lang string| kr_lang string| no_lang string| pl_lang string| pt_lang string| ru_lang string| es_lang string| mx_lang string| se_lang function| translate object| select object| asap object| kb40 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
bofa.com-onlinebanking.com
s3.amazonaws.com
secured-login.net
www.hfflp.com
www.ups.com
23.210.249.165
52.5.161.22
52.7.149.57
52.72.175.22
54.231.88.2
18bd5ec103f064289d063ed0d12338765b0e2721fb4e99e6ea0b6d59d7a1344c
18d04b9ea240d1dd98b3bec5ea105e9c97ee8647b26328034d2aa62fd65ac03b
1c30c890a5c8f5bdc113bd2dc5446fc2c54abb8f0c88998f23d000c399450f1b
23714601639230b9ad2bc2728040a5e760fa5b0500dfb76e552bcb29fcbb7a62
5d737a9fc0b8eb1f5c0718dc7e6c9d994112556b34c564b7ababf85152ebe82d
617f793d125f780ab7bb7c9e92ab427d9e757083e7368e241e8e8fa69f013e4f
654222debe8018b12f1993ceddff30dc163a7d5008d79869c399d6d167321f97
765b79bc8e03650717748466e848ae546208dafc86bc4903d33d56badb3f67b1
b0b90df080d521e4c17ef323d0af819c49f1337c52ae3df28f861dcead05bb1c
be3a32c7f4a31d20ca24bbf29e61a01ef4e11a8136985cdf6c147afe93bb9ba1
c143c50e0e8955a0cac5a3ad8574a16d82f14dbbbd19ced4184fc1f0db220638
c5caf05fd34feb73da330706bf2d1d955a4e79ba12e4298893df6d8d07dd6078
c846698cc448da3901ed709b89a3a0e103b90c500d8ac60d210865616057059d
dce421fd2d46420ba92a98f38ff090b664bc3225bf68dbf0ae89139ec0e640d7
fc5e7621ba0e98c5c6728e3b2bdf802311c0a0953a05e60a7551cb0c7bed00a9