securitynotifications.org

Summary

This website contacted 4 IPs in 1 countries across 4 domains to perform 6 HTTP transactions. The main IP is 13.225.195.38, located in United States and belongs to AMAZON-02, US. The main domain is securitynotifications.org.
TLS certificate: Issued by Amazon RSA 2048 M03 on January 18th 2024. Valid for: a year.

This is the only time securitynotifications.org was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
1	13.225.195.38 13.225.195.38	16509 (AMAZON-02) (AMAZON-02)
3	52.217.116.168 52.217.116.168	16509 (AMAZON-02) (AMAZON-02)
1	151.101.130.137 151.101.130.137	54113 (FASTLY) (FASTLY)
6	4

1 13.225.195.38 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-195-38.yul62.r.cloudfront.net

securitynotifications.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 52.217.116.168 (Ashburn, United States)

ASN16509 (AMAZON-02, US)
PTR: s3-1.amazonaws.com

s3.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.130.137 (United States)

ASN54113 (FASTLY, US)

js-agent.newrelic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	amazonaws.com s3.amazonaws.com	284 KB
1	newrelic.com js-agent.newrelic.com — Cisco Umbrella Rank: 600	29 KB
1	securitynotifications.org securitynotifications.org	57 KB
0	nr-data.net Failed bam.nr-data.net Failed
6	4

	Domain	Requested by
3	s3.amazonaws.com	securitynotifications.org
1	js-agent.newrelic.com	securitynotifications.org
1	securitynotifications.org
0	bam.nr-data.net Failed	securitynotifications.org
6	4

This site contains no links.

Subject Issuer	Validity	Valid
securitynotifications.org Amazon RSA 2048 M03	`2024-01-18` - `2025-02-15`	a year	crt.sh
s3.amazonaws.com Amazon RSA 2048 M01	`2023-10-10` - `2024-07-10`	9 months	crt.sh
js-agent.newrelic.com GlobalSign Atlas R3 DV TLS CA 2024 Q1	`2024-01-15` - `2025-02-15`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://securitynotifications.org/?u=24508-623ebb0f9adda8565f3c89a5c6c3d02ce13b6abf4e4b4a7a1db2a7d14d4974f2
Frame ID: 456A73A5F9C267539ED5EBDBD66F5B9A
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Sign in to your account

Page Statistics

6
Requests

83 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

4
IPs

1
Countries

369 kB
Transfer

425 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
securitynotifications.org/ 57 KB
57 KB 630ms
411ms Document
text/html 13.225.195.38
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://securitynotifications.org/?u=24508-623ebb0f9adda8565f3c89a5c6c3d02ce13b6abf4e4b4a7a1db2a7d14d4974f2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.195.38 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-195-38.yul62.r.cloudfront.net
Software: /
Resource Hash: d9aa0d4ba01029b822adc643c834ff186fef98d08b39b194e2f1620db3ed5d38

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: no-cache, private
content-length: 58068
content-type: text/html; charset=UTF-8
date: Wed, 24 Jan 2024 15:36:08 GMT
via: 1.1 accde91a69bd802adc7286eb965fb316.cloudfront.net (CloudFront)
x-amz-apigw-id: SDQwUFoRIAMEqAQ=
x-amz-cf-id: 1yc40Iq8aR7OE2tsbwakhu7bwk-ajyplNOEdh_nQ2gVa2MjN2Fuj2g==
x-amz-cf-pop: YUL62-C1
x-amzn-remapped-date: Wed, 24 Jan 2024 15:36:08 GMT
x-amzn-requestid: 6c7a789f-7850-4553-93d5-9a170a2c5fb6
x-amzn-trace-id: Root=1-65b12e68-0cc3eed7149afec979d3763f;Sampled=0;lineage=499f168b:0
x-cache: Miss from cloudfront

GET
H/1.1 200
OK microsoft%2Fhome%2Fstyle.css
s3.amazonaws.com/media.aws-cdn/ 2 KB
3 KB 215ms
78ms Stylesheet
text/css 52.217.116.168
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s3.amazonaws.com/media.aws-cdn/microsoft%2Fhome%2Fstyle.css
Requested by: Host: securitynotifications.org
URL: https://securitynotifications.org/?u=24508-623ebb0f9adda8565f3c89a5c6c3d02ce13b6abf4e4b4a7a1db2a7d14d4974f2
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.217.116.168 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: e07e15a16cc0a9cb1c728d890c3bd082b6a00e31722218dc368d801ca987caf9

Request headers

accept-language: en-US,en;q=0.9
Referer: https://securitynotifications.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date: Wed, 24 Jan 2024 15:36:09 GMT
Last-Modified: Fri, 29 Mar 2019 13:36:56 GMT
Server: AmazonS3
x-amz-request-id: B4XFZF1P7PSK1BXR
ETag: "7a4873a58a76a0e37ddecd2422b330a4"
Content-Type: text/css
Accept-Ranges: bytes
Content-Length: 2311
x-amz-id-2: 6EUiKiMA9v7JS7z6MDKwQ0f2K7biHAJK5EnxZQwdOMNWRnJhif98gYdRIy5Ev7aSJX4D7uT2n9M=

GET
H/1.1 200
OK microsoft%2Fhome%2Flogo.svg
s3.amazonaws.com/media.aws-cdn/ 4 KB
4 KB 211ms
76ms Image
image/svg+xml 52.217.116.168
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3.amazonaws.com/media.aws-cdn/microsoft%2Fhome%2Flogo.svg
Requested by: Host: securitynotifications.org
URL: https://securitynotifications.org/?u=24508-623ebb0f9adda8565f3c89a5c6c3d02ce13b6abf4e4b4a7a1db2a7d14d4974f2
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.217.116.168 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: 04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a

Request headers

accept-language: en-US,en;q=0.9
Referer: https://securitynotifications.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date: Wed, 24 Jan 2024 15:36:09 GMT
Last-Modified: Fri, 29 Mar 2019 13:05:56 GMT
Server: AmazonS3
x-amz-request-id: B4XAEQ94G4RDMDCD
ETag: "ee5c8d9fb6248c938fd0dc19370e90bd"
Content-Type: image/svg+xml
Accept-Ranges: bytes
Content-Length: 3651
x-amz-id-2: kvIzn0r/0Xs9BhWFDmGZdttTJCXy0ZbjUUmMouNWWZav4yjlMIL8L/6Sgp3bnW7MQH4rp4eVLLQ=

GET
H2 200 nr-spa-1.250.0.min.js Show response
js-agent.newrelic.com/ 86 KB
29 KB 129ms
32ms Script
application/javascript 151.101.130.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js-agent.newrelic.com/nr-spa-1.250.0.min.js

Requested by

Host: securitynotifications.org
URL: https://securitynotifications.org/?u=24508-623ebb0f9adda8565f3c89a5c6c3d02ce13b6abf4e4b4a7a1db2a7d14d4974f2

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

151.101.130.137 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

8aaf0af04baf8eaa35b1ac46ed02d131a8d3c44896b92a45fa1555c70ebc94c9

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://securitynotifications.org/
Origin: https://securitynotifications.org
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-amz-version-id: 9CPSHfU_b43id9HPDI1ELov4Sz01U0Ym
content-encoding: br
via: 1.1 varnish
date: Wed, 24 Jan 2024 15:36:09 GMT
strict-transport-security: max-age=300
x-amz-request-id: HST3B0FW3N9P31WB
x-amz-server-side-encryption: AES256
x-cache: HIT
cross-origin-resource-policy: cross-origin
content-length: 28786
x-amz-id-2: HMMTt/D0nZXZLvTJpXJUuRrdZUlE4rr4DZJh1yOBBgmklGzIR5Z0LvRAf0U1kg9TkrrkE5iTrjQ=
x-served-by: cache-mia-kmia1760067-MIA
last-modified: Tue, 09 Jan 2024 19:15:56 GMT
server: AmazonS3
x-timer: S1706110569.012406,VS0,VE0
etag: "6e3b65f7f44fa4b3bf86d1f0187490ce"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=86400, stale-if-error=86400
accept-ranges: bytes
x-cache-hits: 695467

GET
H/1.1 200
OK microsoft%2Fhome%2Fbackground_scene.jpg
s3.amazonaws.com/media.aws-cdn/ 277 KB
277 KB 72ms
72ms Image
image/jpeg 52.217.116.168
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3.amazonaws.com/media.aws-cdn/microsoft%2Fhome%2Fbackground_scene.jpg
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.217.116.168 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: 211a907de2da0ff4a0e90917ac8054e2f35c351180977550c26e51b4909f2beb

Request headers

accept-language: en-US,en;q=0.9
Referer: https://securitynotifications.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date: Wed, 24 Jan 2024 15:36:09 GMT
Last-Modified: Fri, 29 Mar 2019 12:59:37 GMT
Server: AmazonS3
x-amz-request-id: B4XC6DD8XDYGZ4Z1
ETag: "a5dbd4393ff6a725c7e62b61df7e72f0"
Content-Type: image/jpeg
Accept-Ranges: bytes
Content-Length: 283351
x-amz-id-2: 9T5pge7O9n4N+GEieoooUrkCTjiBZD3hsT7zrH7BnshADDSi8aST1qRrBVUrYbj2oCnKo7gFkj4=

POST undefined
bam.nr-data.net/1/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: bam.nr-data.net
URL: https://bam.nr-data.net/1/undefined?a=undefined&v=1.250.0&t=Unnamed%20Transaction&rst=1139&ck=0&s=aff42f0dd966ca5f&ref=https://securitynotifications.org/&hr=0&af=err,xhr,stn,ins,spa&be=631&fe=348&dc=128&fsh=1&perf=%7B%22timing%22:%7B%22of%22:1706110567922,%22n%22:0,%22f%22:0,%22dn%22:39,%22dne%22:39,%22c%22:39,%22s%22:114,%22ce%22:220,%22rq%22:220,%22rp%22:631,%22rpe%22:711,%22di%22:759,%22ds%22:759,%22de%22:759,%22dc%22:976,%22l%22:976,%22le%22:979%7D,%22navigation%22:%7B%7D%7D&fp=994&fcp=994

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| NREUM object| webpackChunk:NRBA-1.250.0.PROD object| newrelic

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	error	URL: https://securitynotifications.org/?u=24508-623ebb0f9adda8565f3c89a5c6c3d02ce13b6abf4e4b4a7a1db2a7d14d4974f2 Message: Access to XMLHttpRequest at 'https://bam.nr-data.net/1/undefined?a=undefined&v=1.250.0&t=Unnamed%20Transaction&rst=1139&ck=0&s=aff42f0dd966ca5f&ref=https://securitynotifications.org/&hr=0&af=err,xhr,stn,ins,spa&be=631&fe=348&dc=128&fsh=1&perf=%7B%22timing%22:%7B%22of%22:1706110567922,%22n%22:0,%22f%22:0,%22dn%22:39,%22dne%22:39,%22c%22:39,%22s%22:114,%22ce%22:220,%22rq%22:220,%22rp%22:631,%22rpe%22:711,%22di%22:759,%22ds%22:759,%22de%22:759,%22dc%22:976,%22l%22:976,%22le%22:979%7D,%22navigation%22:%7B%7D%7D&fp=994&fcp=994' from origin 'https://securitynotifications.org' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://bam.nr-data.net/1/undefined?a=undefined&v=1.250.0&t=Unnamed%20Transaction&rst=1139&ck=0&s=aff42f0dd966ca5f&ref=https://securitynotifications.org/&hr=0&af=err,xhr,stn,ins,spa&be=631&fe=348&dc=128&fsh=1&perf=%7B%22timing%22:%7B%22of%22:1706110567922,%22n%22:0,%22f%22:0,%22dn%22:39,%22dne%22:39,%22c%22:39,%22s%22:114,%22ce%22:220,%22rq%22:220,%22rp%22:631,%22rpe%22:711,%22di%22:759,%22ds%22:759,%22de%22:759,%22dc%22:976,%22l%22:976,%22le%22:979%7D,%22navigation%22:%7B%7D%7D&fp=994&fcp=994 Message: Failed to load resource: net::ERR_FAILED

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bam.nr-data.net
js-agent.newrelic.com
s3.amazonaws.com
securitynotifications.org
bam.nr-data.net
13.225.195.38
151.101.130.137
52.217.116.168
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
211a907de2da0ff4a0e90917ac8054e2f35c351180977550c26e51b4909f2beb
8aaf0af04baf8eaa35b1ac46ed02d131a8d3c44896b92a45fa1555c70ebc94c9
d9aa0d4ba01029b822adc643c834ff186fef98d08b39b194e2f1620db3ed5d38
e07e15a16cc0a9cb1c728d890c3bd082b6a00e31722218dc368d801ca987caf9

securitynotifications.org Open in urlscan Pro 13.225.195.38 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

6 Requests

83 %HTTPS

0 %IPv6

4 Domains

4 Subdomains

4 IPs

1 Countries

369 kBTransfer

425 kBSize

0 Cookies

0 Outgoing links

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

0 Cookies

2 Console Messages

Indicators

securitynotifications.org Open in urlscan Pro
13.225.195.38 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

83 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

4
IPs

1
Countries

369 kB
Transfer

425 kB
Size

0
Cookies

6 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!