urlscan.io logo urlscan.io
SecurityTrails logo

membersrepview.z13.web.core.windows.net Open in urlscan Pro
20.60.220.33  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://www.signlink.co.uk/ACL.aspx?t=3&i=511&l=https%3A%2F%2Fdata.rou-batik.com%2Fnu#biddept%40lakeshorelearning.com
Effective URL: https://membersrepview.z13.web.core.windows.net/
Submission Tags: falconsandbox
Submission: On July 03 via api from US — Scanned from GB
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 5 IPs in 5 countries across 6 domains to perform 5 HTTP transactions. The main IP is 20.60.220.33, located in Washington, United States and belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US. The main domain is membersrepview.z13.web.core.windows.net.
TLS certificate: Issued by Microsoft RSA TLS CA 01 on September 27th 2023. Valid for: a year.
This is the only time membersrepview.z13.web.core.windows.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: AOL (Online)

Domain & IP information

IP Address AS Autonomous System
1 1 185.7.189.69 29297 (LINKCONNE...)
2 2 178.128.58.49 14061 (DIGITALOC...)
2 20.60.220.33 8075 (MICROSOFT...)
1 2a00:1288:80:... 203220 (YAHOO-DEB)
1 2a02:6ea0:c70... 60068 (CDN77 _)
1 104.26.13.205 13335 (CLOUDFLAR...)
5 5
1    185.7.189.69 (Denbighshire, United Kingdom)

ASN29297 (LINKCONNECT-AS Linkconnect services Ltd, UK Business to business ISP, GB)
www.signlink.co.uk
2    178.128.58.49 (Singapore, Singapore)

ASN14061 (DIGITALOCEAN-ASN, US)
PTR: yourou.id
data.rou-batik.com
2    20.60.220.33 (Washington, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
membersrepview.z13.web.core.windows.net
1    2a00:1288:80:807::2 (United Kingdom)

ASN203220 (YAHOO-DEB, GB)
s.yimg.com
1    2a02:6ea0:c700::101 (Frankfurt am Main, Germany)

ASN60068 (CDN77 _, GB)
img.icons8.com
1    104.26.13.205 (None, )

ASN13335 (CLOUDFLARENET, US)
api.ipify.org
Apex Domain
Subdomains		 Transfer
2 windows.net
membersrepview.z13.web.core.windows.net
150 KB
2 rou-batik.com
data.rou-batik.com
618 B
1 ipify.org
api.ipify.org — Cisco Umbrella Rank: 2418
155 B
1 icons8.com
img.icons8.com — Cisco Umbrella Rank: 41515
2 KB
1 yimg.com
s.yimg.com — Cisco Umbrella Rank: 707
7 KB
1 signlink.co.uk
www.signlink.co.uk
150 B
5 6
Domain Requested by
2 membersrepview.z13.web.core.windows.net
2 data.rou-batik.com 2 redirects
1 api.ipify.org membersrepview.z13.web.core.windows.net
1 img.icons8.com membersrepview.z13.web.core.windows.net
1 s.yimg.com membersrepview.z13.web.core.windows.net
1 www.signlink.co.uk 1 redirects
5 6

This site contains links to these domains. Also see Links.

Domain
aol.com
Subject Issuer Validity Valid
*.web.core.windows.net
Microsoft RSA TLS CA 01		 2023-09-27 -
2024-09-27		 a year crt.sh
*.fantasysports.yahoo.com
DigiCert SHA2 High Assurance Server CA		 2024-05-30 -
2024-07-17		 2 months crt.sh
1004834818.rsc.cdn77.org
E6		 2024-06-23 -
2024-09-21		 3 months crt.sh
ipify.org
GTS CA 1P5		 2024-05-19 -
2024-08-17		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://membersrepview.z13.web.core.windows.net/
Frame ID: 0629EEB297346AF18ECB9A3A3633F219
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

AOL

Page URL History Show full URLs

  1. https://www.signlink.co.uk/ACL.aspx?t=3&i=511&l=https%3A%2F%2Fdata.rou-batik.com%2Fnu HTTP 302
    https://data.rou-batik.com/nu HTTP 301
    https://data.rou-batik.com/nu/ HTTP 302
    https://membersrepview.z13.web.core.windows.net/ Page URL

Page Statistics

5
Requests

100 %
HTTPS

33 %
IPv6

6
Domains

6
Subdomains

5
IPs

5
Countries

159 kB
Transfer

188 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://www.signlink.co.uk/ACL.aspx?t=3&i=511&l=https%3A%2F%2Fdata.rou-batik.com%2Fnu HTTP 302
    https://data.rou-batik.com/nu HTTP 301
    https://data.rou-batik.com/nu/ HTTP 302
    https://membersrepview.z13.web.core.windows.net/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
membersrepview.z13.web.core.windows.net/
Redirect Chain
  • https://www.signlink.co.uk/ACL.aspx?t=3&i=511&l=https%3A%2F%2Fdata.rou-batik.com%2Fnu
  • https://data.rou-batik.com/nu
  • https://data.rou-batik.com/nu/
  • https://membersrepview.z13.web.core.windows.net/
149 KB
149 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://membersrepview.z13.web.core.windows.net/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
20.60.220.33 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
031ac0abe20a3b1d00d94f304ab395d3de2912c36fee0f40b505326e1b4514b1

Request headers

Accept-Language
en-GB,en;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

Accept-Ranges
bytes
Content-Length
152329
Content-MD5
jKzHHqio4XJgqrTvCksSPQ==
Content-Type
text/html
Date
Wed, 03 Jul 2024 14:23:01 GMT
ETag
"0x8DC9AC64001521B"
Last-Modified
Tue, 02 Jul 2024 18:39:04 GMT
Server
Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
x-ms-request-id
f2c021e4-601e-0065-0f54-cdec49000000
x-ms-version
2018-03-28

Redirect headers

Connection
Keep-Alive
Content-Length
0
Content-Type
text/html; charset=UTF-8
Date
Wed, 03 Jul 2024 14:23:01 GMT
Keep-Alive
timeout=5, max=99
Location
https://membersrepview.z13.web.core.windows.net/
Server
Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.6.40
X-Powered-By
PHP/5.6.40
truncated
/ 		16 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
f3e22262b472ee52e51e9f053856daf9a3f7ce59dd66d51f201f1ee7faaf5690

Request headers

Accept-Language
en-GB,en;q=0.9;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type
image/png
phone-otp-v0.0.1.svg
s.yimg.com/wm/mbr/images/aol/ 		21 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.yimg.com/wm/mbr/images/aol/phone-otp-v0.0.1.svg
Requested by
Host: membersrepview.z13.web.core.windows.net
URL: https://membersrepview.z13.web.core.windows.net/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1288:80:807::2 , United Kingdom, ASN203220 (YAHOO-DEB, GB),
Reverse DNS
Software
ATS /
Resource Hash
4900f95fd2ed1914fd183f8e18304e1234f95d90d571354f03de8825e28b6356
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://membersrepview.z13.web.core.windows.net/
Accept-Language
en-GB,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

ats-carp-promotion
1, 1
date
Sat, 01 Jun 2024 14:46:30 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000
x-amz-request-id
NR9Q2YXBBCPW03KF
age
2763394
x-amz-server-side-encryption
AES256
content-length
6975
x-amz-id-2
CJJ6RaiXgdsfAJSsibdXsBAuDLFSqNPQxj3Y2wPfd0quDr3n4tCnic4cjpwTG7NqoEX/z2F9FTk=
x-xss-protection
1; mode=block
referrer-policy
no-referrer-when-downgrade
last-modified
Tue, 25 Jun 2019 21:20:34 GMT
server
ATS
etag
"f3e6e0904624d0f9b192421b0e071fa8-df"
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
vary
Origin, Accept-Encoding
content-type
image/svg+xml
cache-control
public,max-age=315360000
accept-ranges
bytes
external-Done-accept-others-inmotus-design-2.png
img.icons8.com/external-others-inmotus-design/67/000000/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://img.icons8.com/external-others-inmotus-design/67/000000/external-Done-accept-others-inmotus-design-2.png
Requested by
Host: membersrepview.z13.web.core.windows.net
URL: https://membersrepview.z13.web.core.windows.net/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6ea0:c700::101 Frankfurt am Main, Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software
CDN77-Turbo /
Resource Hash
bc3de87ccd7fa7e23262031035ea889801fddffe5285ecb8534d8cb3a0da27c0
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://membersrepview.z13.web.core.windows.net/
Accept-Language
en-GB,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-77-pop
frankfurtDE
date
Wed, 03 Jul 2024 14:23:02 GMT
strict-transport-security
max-age=15724800; includeSubDomains
version
0.0.29
icon-format
png
x-77-cache
HIT
x-cache
MISS
x-accel-date
1720013754
content-length
1665
x-77-nzt
EggBnJIhDQFBDAElE8I0AfcMCwAA
x-accel-expires
@1720316154
x-77-age
2828
not-found-platform
false
icon-size
67
last-modified
Sun, 16 Jun 2024 19:34:46
from-mongo-cache
true
server
CDN77-Turbo
x-77-nzt-ray
0d1fa518acce6686c65e8566c94a3e2b
from-redis-cache
false
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=302400
accept-ranges
bytes
icon-id
7ajr2aviJxVP
/
api.ipify.org/ 		21 B
155 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://api.ipify.org/?format=json
Requested by
Host: membersrepview.z13.web.core.windows.net
URL: https://membersrepview.z13.web.core.windows.net/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.205 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4338e1bf45e818d56720ed52adb93f96adc0778865618be6c9addae89706c166

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://membersrepview.z13.web.core.windows.net/
Accept-Language
en-GB,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Wed, 03 Jul 2024 14:23:02 GMT
cf-cache-status
DYNAMIC
server
cloudflare
vary
Origin
content-type
application/json
access-control-allow-origin
*
cf-ray
89d787f9d86776c0-LHR
content-length
21
favicon.ico
membersrepview.z13.web.core.windows.net/ 		321 B
629 B 		Other
General
Check archive.org
Download Go to
Full URL
https://membersrepview.z13.web.core.windows.net/favicon.ico
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
20.60.220.33 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
7128dc8441ae15e54c414909798d6386a656b94b45750441f614f0336f2d220d

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://membersrepview.z13.web.core.windows.net/
Accept-Language
en-GB,en;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-ms-request-id
f2c024b7-601e-0065-1854-cdec49000000
Date
Wed, 03 Jul 2024 14:23:02 GMT
x-ms-version
2018-03-28
Server
Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
x-ms-error-code
WebContentNotFound
Content-Length
321
Content-Type
text/html

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: AOL (Online)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

undefined| event object| fence object| sharedStorage object| _$_183b

0 Cookies

4 Console Messages

Source Level URL
Text
recommendation warning URL: https://membersrepview.z13.web.core.windows.net/#biddept%40lakeshorelearning.com
Message:
[DOM] Found 4 elements with non-unique id #subb: (More info: https://goo.gl/9p2vKq) %o %o %o %o
recommendation warning URL: https://membersrepview.z13.web.core.windows.net/#biddept%40lakeshorelearning.com
Message:
[DOM] Found 5 elements with non-unique id #suber: (More info: https://goo.gl/9p2vKq) %o %o %o %o %o
recommendation verbose URL: https://membersrepview.z13.web.core.windows.net/#biddept%40lakeshorelearning.com
Message:
[DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o
network error URL: https://membersrepview.z13.web.core.windows.net/favicon.ico
Message:
Failed to load resource: the server responded with a status of 404 (The requested content does not exist.)