secured-login.net Open in urlscan Pro
35.172.241.209 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://34.75.2o2.lol/XYWNg0aW9uPWyNsaWNrJntVybD1ourdHRwbczovL3NltY3jVyZWQtbG9naW4ubmV0nL3BhZ2VzL2M4MTdkNjlmNjY0NSZyZW...
Effective URL:
https://secured-login.net/pages/c817d69f6645/XYWNg0aW9uPWyNsaWNrJntVybD1ourdHRwbczovL3NltY3jVyZWQtbG9naW4ubmV0nL3BhZ2VzL2M...
Submission: On October 02 via manual (October 2nd 2020, 3:02:10 am UTC) from NZ

Summary HTTP 12 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 4 IPs in 1 countries across 4 domains to perform 12 HTTP transactions. The main IP is 35.172.241.209, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is secured-login.net.
TLS certificate: Issued by Amazon on November 22nd 2019. Valid for: a year.

This is the only time secured-login.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Phishing Simulation (Internet)

Domain & IP information

	IP Address	AS Autonomous System
1 2	52.3.61.86 52.3.61.86	14618 (AMAZON-AES) (AMAZON-AES)
9	35.172.241.209 35.172.241.209	14618 (AMAZON-AES) (AMAZON-AES)
1	2606:4700::68... 2606:4700::6811:f1cc	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6811:7bb4	13335 (CLOUDFLAR...) (CLOUDFLARENET)
12	4

2 52.3.61.86 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-3-61-86.compute-1.amazonaws.com

34.75.2o2.lol	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 35.172.241.209 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-35-172-241-209.compute-1.amazonaws.com

secured-login.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:f1cc (United States)

ASN13335 (CLOUDFLARENET, US)

cdn2.hubspot.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:7bb4 (United States)

ASN13335 (CLOUDFLARENET, US)

www.viima.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	secured-login.net secured-login.net	1 MB
2	2o2.lol 1 redirects 34.75.2o2.lol	1 KB
1	viima.com www.viima.com	23 KB
1	hubspot.net cdn2.hubspot.net	5 KB
12	4

	Domain	Requested by
9	secured-login.net	34.75.2o2.lol secured-login.net
2	34.75.2o2.lol	1 redirects
1	www.viima.com	secured-login.net
1	cdn2.hubspot.net	secured-login.net
12	4

This site contains links to these domains. Also see Links.

Domain
preview.training.knowbe4.com

Subject Issuer	Validity	Valid
authentlcation.com Amazon	`2020-07-07` - `2021-08-07`	a year	crt.sh
secured-login.net Amazon	`2019-11-22` - `2020-12-22`	a year	crt.sh
hubspot.net Cloudflare Inc ECC CA-3	`2020-07-03` - `2021-07-03`	a year	crt.sh
www.viima.com Cloudflare Inc ECC CA-3	`2020-08-16` - `2021-08-16`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://secured-login.net/pages/c817d69f6645/XYWNg0aW9uPWyNsaWNrJntVybD1ourdHRwbczovL3NltY3jVyZWQtbG9naW4ubmV0nL3BhZ2VzL2M4MTdkNjlmNjY0NSZyZWNpcGllbnRfaWQ9NjgzMTg4MzcyJmNhbXBhaWduX3J1bl9pZD0zNTc3NTI4
Frame ID: BD4C580BA4794BA03300C599579F76D7
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://34.75.2o2.lol/XYWNg0aW9uPWyNsaWNrJntVybD1ourdHRwbczovL3NltY3jVyZWQtbG9naW4ubmV0nL3BhZ2VzL2... HTTP 301
https://34.75.2o2.lol/XYWNg0aW9uPWyNsaWNrJntVybD1ourdHRwbczovL3NltY3jVyZWQtbG9naW4ubmV0nL3BhZ2VzL2... Page URL
https://secured-login.net/pages/c817d69f6645/XYWNg0aW9uPWyNsaWNrJntVybD1ourdHRwbczovL3NltY3jVyZWQtbG9n... Page URL

Page Statistics

12
Requests

100 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

4
IPs

1
Countries

1163 kB
Transfer

4564 kB
Size

0
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: http://preview.training.knowbe4.com/XdXJesPWh0dHoA6Ly8zNCo43NS4ykrTzIucbE9sL1hLnQjqRtVk1qYVhCcFpXTzUwlWDJsa1BUS0U0TkRreFB1T1RRbVVZMkZ0Y0dGcGdaMnQ1ZmNuVnVYMmxrUFRFeU1URTRYSm1GamRHbHZiajFqYkdsamF5WjFjbXc5YUhSMGNITTZMeTkwY21GcGJtbHVaeTF6ZEdGbmFXNW5MbXR1YjNkaVpUUXVZMjl0TDNCaFoyVnpMMlkyTURZNU5UVTJNRFZpJmVtYWlsX3RlbXBsYXRlX2lkPTU5NDA4NiZhY3Rpb249cHJldmlldyZ1c2VyX2lkPTE2Mjc5NzMx
Title: VIEW POLICY_ANNUAL-LEAVE.PDF

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://34.75.2o2.lol/XYWNg0aW9uPWyNsaWNrJntVybD1ourdHRwbczovL3NltY3jVyZWQtbG9naW4ubmV0nL3BhZ2VzL2M4MTdkNjlmNjY0NSZyZWNpcGllbnRfaWQ9NjgzMTg4MzcyJmNhbXBhaWduX3J1bl9pZD0zNTc3NTI4 HTTP 301
https://34.75.2o2.lol/XYWNg0aW9uPWyNsaWNrJntVybD1ourdHRwbczovL3NltY3jVyZWQtbG9naW4ubmV0nL3BhZ2VzL2M4MTdkNjlmNjY0NSZyZWNpcGllbnRfaWQ9NjgzMTg4MzcyJmNhbXBhaWduX3J1bl9pZD0zNTc3NTI4 Page URL
https://secured-login.net/pages/c817d69f6645/XYWNg0aW9uPWyNsaWNrJntVybD1ourdHRwbczovL3NltY3jVyZWQtbG9naW4ubmV0nL3BhZ2VzL2M4MTdkNjlmNjY0NSZyZWNpcGllbnRfaWQ9NjgzMTg4MzcyJmNhbXBhaWduX3J1bl9pZD0zNTc3NTI4 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://34.75.2o2.lol/XYWNg0aW9uPWyNsaWNrJntVybD1ourdHRwbczovL3NltY3jVyZWQtbG9naW4ubmV0nL3BhZ2VzL2M4MTdkNjlmNjY0NSZyZWNpcGllbnRfaWQ9NjgzMTg4MzcyJmNhbXBhaWduX3J1bl9pZD0zNTc3NTI4 HTTP 301
https://34.75.2o2.lol/XYWNg0aW9uPWyNsaWNrJntVybD1ourdHRwbczovL3NltY3jVyZWQtbG9naW4ubmV0nL3BhZ2VzL2M4MTdkNjlmNjY0NSZyZWNpcGllbnRfaWQ9NjgzMTg4MzcyJmNhbXBhaWduX3J1bl9pZD0zNTc3NTI4

12 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

XYWNg0aW9uPWyNsaWNrJntVybD1ourdHRwbczovL3NltY3jVyZWQtbG9naW4ubmV0nL3BhZ2VzL2M4MTdkNjlmNjY0NSZyZWNpcGllbnRfaWQ9NjgzMTg4MzcyJmNhbXBhaWduX3J1bl9pZD0zNTc3NTI4 Show response
34.75.2o2.lol/
Redirect Chain

http://34.75.2o2.lol/XYWNg0aW9uPWyNsaWNrJntVybD1ourdHRwbczovL3NltY3jVyZWQtbG9naW4ubmV0nL3BhZ2VzL2M4MTdkNjlmNjY0NSZyZWNpcGllbnRfaWQ9NjgzMTg4MzcyJmNhbXBhaWduX3J1bl9pZD0zNTc3NTI4
https://34.75.2o2.lol/XYWNg0aW9uPWyNsaWNrJntVybD1ourdHRwbczovL3NltY3jVyZWQtbG9naW4ubmV0nL3BhZ2VzL2M4MTdkNjlmNjY0NSZyZWNpcGllbnRfaWQ9NjgzMTg4MzcyJmNhbXBhaWduX3J1bl9pZD0zNTc3NTI4

302 B
726 B

445ms
174ms

Document
text/html

52.3.61.86
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://34.75.2o2.lol/XYWNg0aW9uPWyNsaWNrJntVybD1ourdHRwbczovL3NltY3jVyZWQtbG9naW4ubmV0nL3BhZ2VzL2M4MTdkNjlmNjY0NSZyZWNpcGllbnRfaWQ9NjgzMTg4MzcyJmNhbXBhaWduX3J1bl9pZD0zNTc3NTI4

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.3.61.86 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-3-61-86.compute-1.amazonaws.com

Software

Resource Hash

d825f0ad629ec032bd805cfb30f4d41d8be4521885c42e29f427a0afc3728b74

Security Headers

Name	Value
Content-Security-Policy
Strict-Transport-Security	max-age=63113904; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: 34.75.2o2.lol
:scheme: https
:path: /XYWNg0aW9uPWyNsaWNrJntVybD1ourdHRwbczovL3NltY3jVyZWQtbG9naW4ubmV0nL3BhZ2VzL2M4MTdkNjlmNjY0NSZyZWNpcGllbnRfaWQ9NjgzMTg4MzcyJmNhbXBhaWduX3J1bl9pZD0zNTc3NTI4
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
date: Fri, 02 Oct 2020 03:01:52 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-download-options: noopen
x-permitted-cross-domain-policies: none
referrer-policy: no-referrer-when-downgrade
etag: W/"d825f0ad629ec032bd805cfb30f4d41d"
cache-control: max-age=0, private, must-revalidate
content-security-policy
x-request-id: 5f378f6d-2652-4742-b98d-dc6fe6d0a328
x-runtime: 0.036692
strict-transport-security: max-age=63113904; includeSubDomains; preload

Redirect headers

Date: Fri, 02 Oct 2020 03:01:51 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Location: https://34.75.2o2.lol/XYWNg0aW9uPWyNsaWNrJntVybD1ourdHRwbczovL3NltY3jVyZWQtbG9naW4ubmV0nL3BhZ2VzL2M4MTdkNjlmNjY0NSZyZWNpcGllbnRfaWQ9NjgzMTg4MzcyJmNhbXBhaWduX3J1bl9pZD0zNTc3NTI4

GET
H2 200 Primary Request XYWNg0aW9uPWyNsaWNrJntVybD1ourdHRwbczovL3NltY3jVyZWQtbG9naW4ubmV0nL3BhZ2VzL2M4MTdkNjlmNjY0NSZyZWNpcGllbnRfaWQ9NjgzMTg4MzcyJmNhbXBhaWduX3J1bl9pZD0zNTc3NTI4 Show response
secured-login.net/pages/c817d69f6645/ 9 KB
9 KB 452ms
162ms Document
text/html 35.172.241.209
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://secured-login.net/pages/c817d69f6645/XYWNg0aW9uPWyNsaWNrJntVybD1ourdHRwbczovL3NltY3jVyZWQtbG9naW4ubmV0nL3BhZ2VzL2M4MTdkNjlmNjY0NSZyZWNpcGllbnRfaWQ9NjgzMTg4MzcyJmNhbXBhaWduX3J1bl9pZD0zNTc3NTI4

Requested by

Host: 34.75.2o2.lol
URL: https://34.75.2o2.lol/XYWNg0aW9uPWyNsaWNrJntVybD1ourdHRwbczovL3NltY3jVyZWQtbG9naW4ubmV0nL3BhZ2VzL2M4MTdkNjlmNjY0NSZyZWNpcGllbnRfaWQ9NjgzMTg4MzcyJmNhbXBhaWduX3J1bl9pZD0zNTc3NTI4

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.172.241.209 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-35-172-241-209.compute-1.amazonaws.com

Software

Resource Hash

87c0b8441c4e198bf1b40736ef11cdb5b039e48a39bfa7dce55d95301584b8d3

Security Headers

Name	Value
Content-Security-Policy
Strict-Transport-Security	max-age=63113904; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: secured-login.net
:scheme: https
:path: /pages/c817d69f6645/XYWNg0aW9uPWyNsaWNrJntVybD1ourdHRwbczovL3NltY3jVyZWQtbG9naW4ubmV0nL3BhZ2VzL2M4MTdkNjlmNjY0NSZyZWNpcGllbnRfaWQ9NjgzMTg4MzcyJmNhbXBhaWduX3J1bl9pZD0zNTc3NTI4
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: document
referer: https://34.75.2o2.lol/XYWNg0aW9uPWyNsaWNrJntVybD1ourdHRwbczovL3NltY3jVyZWQtbG9naW4ubmV0nL3BhZ2VzL2M4MTdkNjlmNjY0NSZyZWNpcGllbnRfaWQ9NjgzMTg4MzcyJmNhbXBhaWduX3J1bl9pZD0zNTc3NTI4
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://34.75.2o2.lol/XYWNg0aW9uPWyNsaWNrJntVybD1ourdHRwbczovL3NltY3jVyZWQtbG9naW4ubmV0nL3BhZ2VzL2M4MTdkNjlmNjY0NSZyZWNpcGllbnRfaWQ9NjgzMTg4MzcyJmNhbXBhaWduX3J1bl9pZD0zNTc3NTI4

Response headers

status: 200
date: Fri, 02 Oct 2020 03:01:52 GMT
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-download-options: noopen
x-permitted-cross-domain-policies: none
referrer-policy: no-referrer-when-downgrade
etag: W/"87c0b8441c4e198bf1b40736ef11cdb5"
cache-control: max-age=0, private, must-revalidate
content-security-policy
x-request-id: 60b41e49-2177-47f5-9a38-1699b4ff06df
x-runtime: 0.026383
strict-transport-security: max-age=63113904; includeSubDomains; preload

GET
H2 200 application-34731a53f70a45d7089db428445ef7a75bdd37c0ba8badff907af1fa563ac830.js Show response
secured-login.net/assets/ 4 MB
979 KB 249ms
246ms Script
application/javascript 35.172.241.209
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://secured-login.net/assets/application-34731a53f70a45d7089db428445ef7a75bdd37c0ba8badff907af1fa563ac830.js

Requested by

Host: secured-login.net
URL: https://secured-login.net/pages/c817d69f6645/XYWNg0aW9uPWyNsaWNrJntVybD1ourdHRwbczovL3NltY3jVyZWQtbG9naW4ubmV0nL3BhZ2VzL2M4MTdkNjlmNjY0NSZyZWNpcGllbnRfaWQ9NjgzMTg4MzcyJmNhbXBhaWduX3J1bl9pZD0zNTc3NTI4

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.172.241.209 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-35-172-241-209.compute-1.amazonaws.com

Software

Resource Hash

34731a53f70a45d7089db428445ef7a75bdd37c0ba8badff907af1fa563ac830

Security Headers

Name	Value
Strict-Transport-Security	max-age=63113904; includeSubDomains; preload

Request headers

Referer: https://secured-login.net/pages/c817d69f6645/XYWNg0aW9uPWyNsaWNrJntVybD1ourdHRwbczovL3NltY3jVyZWQtbG9naW4ubmV0nL3BhZ2VzL2M4MTdkNjlmNjY0NSZyZWNpcGllbnRfaWQ9NjgzMTg4MzcyJmNhbXBhaWduX3J1bl9pZD0zNTc3NTI4
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 02 Oct 2020 03:01:52 GMT
content-encoding: gzip
last-modified: Thu, 01 Oct 2020 18:59:42 GMT
vary: Accept-Encoding
content-type: application/javascript
status: 200
strict-transport-security: max-age=63113904; includeSubDomains; preload
content-length: 1001349

GET
H2 200 vendor-ee83571705825ef2d116.js Show response
secured-login.net/packs/js/ 364 KB
124 KB 254ms
252ms Script
application/javascript 35.172.241.209
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://secured-login.net/packs/js/vendor-ee83571705825ef2d116.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.172.241.209 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-35-172-241-209.compute-1.amazonaws.com

Software

Resource Hash

c354a486a95ab627afd4a080422f81a16828942f5f21e2b24ef8148a522e15d6

Security Headers

Name	Value
Strict-Transport-Security	max-age=63113904; includeSubDomains; preload

Request headers

Referer: https://secured-login.net/pages/c817d69f6645/XYWNg0aW9uPWyNsaWNrJntVybD1ourdHRwbczovL3NltY3jVyZWQtbG9naW4ubmV0nL3BhZ2VzL2M4MTdkNjlmNjY0NSZyZWNpcGllbnRfaWQ9NjgzMTg4MzcyJmNhbXBhaWduX3J1bl9pZD0zNTc3NTI4
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 02 Oct 2020 03:01:52 GMT
content-encoding: gzip
last-modified: Thu, 01 Oct 2020 19:04:40 GMT
vary: Accept-Encoding
content-type: application/javascript
status: 200
strict-transport-security: max-age=63113904; includeSubDomains; preload
content-length: 126920

GET
H2 200 modernizr-654222debe8018b12f1993ceddff30dc163a7d5008d79869c399d6d167321f97.js Show response
secured-login.net/assets/ 50 KB
16 KB 144ms
142ms Script
application/javascript 35.172.241.209
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://secured-login.net/assets/modernizr-654222debe8018b12f1993ceddff30dc163a7d5008d79869c399d6d167321f97.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.172.241.209 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-35-172-241-209.compute-1.amazonaws.com

Software

Resource Hash

654222debe8018b12f1993ceddff30dc163a7d5008d79869c399d6d167321f97

Security Headers

Name	Value
Strict-Transport-Security	max-age=63113904; includeSubDomains; preload

Request headers

Referer: https://secured-login.net/pages/c817d69f6645/XYWNg0aW9uPWyNsaWNrJntVybD1ourdHRwbczovL3NltY3jVyZWQtbG9naW4ubmV0nL3BhZ2VzL2M4MTdkNjlmNjY0NSZyZWNpcGllbnRfaWQ9NjgzMTg4MzcyJmNhbXBhaWduX3J1bl9pZD0zNTc3NTI4
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 02 Oct 2020 03:01:52 GMT
content-encoding: gzip
last-modified: Thu, 01 Oct 2020 18:55:58 GMT
vary: Accept-Encoding
content-type: application/javascript
status: 200
strict-transport-security: max-age=63113904; includeSubDomains; preload
content-length: 15721

GET
H2 200 landing-watermark-16f13e16a7ef02fb6f94250aa1931ded83dbee5d9fad278e33dd5792d085194f.css
secured-login.net/assets/ 1 KB
601 B 255ms
253ms Stylesheet
text/css 35.172.241.209
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://secured-login.net/assets/landing-watermark-16f13e16a7ef02fb6f94250aa1931ded83dbee5d9fad278e33dd5792d085194f.css

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.172.241.209 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-35-172-241-209.compute-1.amazonaws.com

Software

Resource Hash

16f13e16a7ef02fb6f94250aa1931ded83dbee5d9fad278e33dd5792d085194f

Security Headers

Name	Value
Strict-Transport-Security	max-age=63113904; includeSubDomains; preload

Request headers

Referer: https://secured-login.net/pages/c817d69f6645/XYWNg0aW9uPWyNsaWNrJntVybD1ourdHRwbczovL3NltY3jVyZWQtbG9naW4ubmV0nL3BhZ2VzL2M4MTdkNjlmNjY0NSZyZWNpcGllbnRfaWQ9NjgzMTg4MzcyJmNhbXBhaWduX3J1bl9pZD0zNTc3NTI4
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 02 Oct 2020 03:01:52 GMT
content-encoding: gzip
last-modified: Thu, 01 Oct 2020 13:48:35 GMT
vary: Accept-Encoding
content-type: text/css
status: 200
strict-transport-security: max-age=63113904; includeSubDomains; preload
content-length: 415

GET
H2 200 sei-modal-24152d098d5744697d79f0a2a169038a204eb8c53a3f6e23b227b178712b53c1.css
secured-login.net/assets/ 1 KB
630 B 135ms
134ms Stylesheet
text/css 35.172.241.209
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://secured-login.net/assets/sei-modal-24152d098d5744697d79f0a2a169038a204eb8c53a3f6e23b227b178712b53c1.css

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.172.241.209 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-35-172-241-209.compute-1.amazonaws.com

Software

Resource Hash

24152d098d5744697d79f0a2a169038a204eb8c53a3f6e23b227b178712b53c1

Security Headers

Name	Value
Strict-Transport-Security	max-age=63113904; includeSubDomains; preload

Request headers

Referer: https://secured-login.net/pages/c817d69f6645/XYWNg0aW9uPWyNsaWNrJntVybD1ourdHRwbczovL3NltY3jVyZWQtbG9naW4ubmV0nL3BhZ2VzL2M4MTdkNjlmNjY0NSZyZWNpcGllbnRfaWQ9NjgzMTg4MzcyJmNhbXBhaWduX3J1bl9pZD0zNTc3NTI4
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 02 Oct 2020 03:01:52 GMT
content-encoding: gzip
last-modified: Thu, 01 Oct 2020 13:48:35 GMT
vary: Accept-Encoding
content-type: text/css
status: 200
strict-transport-security: max-age=63113904; includeSubDomains; preload
content-length: 444

GET
H2 200 sei-tooltip-15c00abdc9e9462d2538982039515c2ee3a056dfaef70b944c0b234c1dda1270.css
secured-login.net/assets/ 3 KB
867 B 136ms
134ms Stylesheet
text/css 35.172.241.209
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://secured-login.net/assets/sei-tooltip-15c00abdc9e9462d2538982039515c2ee3a056dfaef70b944c0b234c1dda1270.css

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.172.241.209 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-35-172-241-209.compute-1.amazonaws.com

Software

Resource Hash

15c00abdc9e9462d2538982039515c2ee3a056dfaef70b944c0b234c1dda1270

Security Headers

Name	Value
Strict-Transport-Security	max-age=63113904; includeSubDomains; preload

Request headers

Referer: https://secured-login.net/pages/c817d69f6645/XYWNg0aW9uPWyNsaWNrJntVybD1ourdHRwbczovL3NltY3jVyZWQtbG9naW4ubmV0nL3BhZ2VzL2M4MTdkNjlmNjY0NSZyZWNpcGllbnRfaWQ9NjgzMTg4MzcyJmNhbXBhaWduX3J1bl9pZD0zNTc3NTI4
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 02 Oct 2020 03:01:52 GMT
content-encoding: gzip
last-modified: Thu, 01 Oct 2020 13:48:35 GMT
vary: Accept-Encoding
content-type: text/css
status: 200
strict-transport-security: max-age=63113904; includeSubDomains; preload
content-length: 681

GET
H2 200 sei-flag-590a28b756e2e8a0661ceca1971920bd1a0c3579252c8f51c98af4cc357b6e8b.css
secured-login.net/assets/ 2 KB
800 B 136ms
135ms Stylesheet
text/css 35.172.241.209
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://secured-login.net/assets/sei-flag-590a28b756e2e8a0661ceca1971920bd1a0c3579252c8f51c98af4cc357b6e8b.css

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.172.241.209 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-35-172-241-209.compute-1.amazonaws.com

Software

Resource Hash

590a28b756e2e8a0661ceca1971920bd1a0c3579252c8f51c98af4cc357b6e8b

Security Headers

Name	Value
Strict-Transport-Security	max-age=63113904; includeSubDomains; preload

Request headers

Referer: https://secured-login.net/pages/c817d69f6645/XYWNg0aW9uPWyNsaWNrJntVybD1ourdHRwbczovL3NltY3jVyZWQtbG9naW4ubmV0nL3BhZ2VzL2M4MTdkNjlmNjY0NSZyZWNpcGllbnRfaWQ9NjgzMTg4MzcyJmNhbXBhaWduX3J1bl9pZD0zNTc3NTI4
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 02 Oct 2020 03:01:52 GMT
content-encoding: gzip
last-modified: Thu, 01 Oct 2020 13:48:35 GMT
vary: Accept-Encoding
content-type: text/css
status: 200
strict-transport-security: max-age=63113904; includeSubDomains; preload
content-length: 614

GET
H2 200 KB4-logo.png
cdn2.hubspot.net/hubfs/241394/html_file/files/img/ 4 KB
5 KB 58ms
30ms Image
image/webp 2606:4700::6811:f1cc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn2.hubspot.net/hubfs/241394/html_file/files/img/KB4-logo.png
Requested by: Host: secured-login.net
URL: https://secured-login.net/pages/c817d69f6645/XYWNg0aW9uPWyNsaWNrJntVybD1ourdHRwbczovL3NltY3jVyZWQtbG9naW4ubmV0nL3BhZ2VzL2M4MTdkNjlmNjY0NSZyZWNpcGllbnRfaWQ9NjgzMTg4MzcyJmNhbXBhaWduX3J1bl9pZD0zNTc3NTI4
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:f1cc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 271b8163a3ccda0ea83d4a13814a97d1fc2797c57fb363ca7d0e95e5e0df8a7c

Request headers

Referer: https://secured-login.net/pages/c817d69f6645/XYWNg0aW9uPWyNsaWNrJntVybD1ourdHRwbczovL3NltY3jVyZWQtbG9naW4ubmV0nL3BhZ2VzL2M4MTdkNjlmNjY0NSZyZWNpcGllbnRfaWQ9NjgzMTg4MzcyJmNhbXBhaWduX3J1bl9pZD0zNTc3NTI4
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 02 Oct 2020 03:01:53 GMT
via: 1.1 7c17b3af9cda4d5f0ff45961b7be9fdc.cloudfront.net (CloudFront)
cf-cache-status: HIT
x-amz-meta-cache-tag: F-3711502880,P-241394,FLS-ALL
age: 592179
cf-polished: origFmt=png, origSize=5864
edge-cache-tag: F-3711502880,P-241394,FLS-ALL
status: 200
content-disposition: inline; filename="KB4-logo.webp"
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 11
x-amz-request-id: 46BD7E01A721CD43
cf-request-id: 0588db5a7700000f8eaf2ce200000001
x-cache: RefreshHit from cloudfront
accept-ranges: bytes
last-modified: Fri, 06 Oct 2017 17:40:18 GMT
server: cloudflare
etag: "20f88cb052864ef047cbf095e46a23b0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept, Accept-Encoding
content-type: image/webp
x-amz-id-2: QiVZtgB2oC+3h5I0ZgGKkhKmyJ788j+J8BZFV4Opuc9/Xti+TaOQvwJ86F2F3TPq4b4ZXnGDGQs=
cf-bgj: imgq:85,h2pri
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
x-amz-version-id: g7nBhtlZ35jy1YqAk.ii5vduFHLTKp1W
x-amz-cf-pop: VIE50-C1
content-length: 4156
cf-ray: 5dbb2e70b9620f8e-VIE
x-amz-cf-id: tX2371TZ4dIxjURQBHj1KZAB2yK5IraHBmFM5yrE4GUnGfZGWErahg==
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 11

GET
H2 200 SharePoint.png
www.viima.com/hs-fs/hubfs/Landing%20pages/ 22 KB
23 KB 362ms
295ms Image
image/png 2606:4700::6811:7bb4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.viima.com/hs-fs/hubfs/Landing%20pages/SharePoint.png
Requested by: Host: secured-login.net
URL: https://secured-login.net/pages/c817d69f6645/XYWNg0aW9uPWyNsaWNrJntVybD1ourdHRwbczovL3NltY3jVyZWQtbG9naW4ubmV0nL3BhZ2VzL2M4MTdkNjlmNjY0NSZyZWNpcGllbnRfaWQ9NjgzMTg4MzcyJmNhbXBhaWduX3J1bl9pZD0zNTc3NTI4
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:7bb4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1ba44357f6c9c659d558198026635fa6c5c96aa3b3376f0756ceed496356172

Request headers

Referer: https://secured-login.net/pages/c817d69f6645/XYWNg0aW9uPWyNsaWNrJntVybD1ourdHRwbczovL3NltY3jVyZWQtbG9naW4ubmV0nL3BhZ2VzL2M4MTdkNjlmNjY0NSZyZWNpcGllbnRfaWQ9NjgzMTg4MzcyJmNhbXBhaWduX3J1bl9pZD0zNTc3NTI4
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 02 Oct 2020 03:01:53 GMT
via: 1.1 547c5e28f010be7961f641c3903c0954.cloudfront.net (CloudFront)
cf-cache-status: MISS
x-amz-cf-pop: IAD89-C1
edge-cache-tag: F-5700272594,FD-5191365654,P2AME,FLS
status: 200
x-cache: RefreshHit from cloudfront
x-hs-cf-lambda: us-east-1.enforceAclForReadsProd 11
content-length: 22928
cf-request-id: 0588db5ad900000d5a0031b200000001
last-modified: Fri, 13 Apr 2018 11:22:34 GMT
server: cloudflare
etag: "1e339342d6cf6a43ce0d846ca462d4a6"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/png
cache-control: s-maxage=1814400, max-age=1209600, stale-while-revalidate=900
access-control-allow-credentials: false
accept-ranges: bytes
cf-ray: 5dbb2e71598a0d5a-VIE
x-amz-cf-id: F14WrRKfQmsVpo4-Y99dKomHJ3Hwa6W0srsGxwSitxjCW5aYbe3gIA==
x-hs-cf-lambda-enforce: us-east-1.enforceAclForReadsProd 11

GET
H2 200 sei-flag-fc5e7621ba0e98c5c6728e3b2bdf802311c0a0953a05e60a7551cb0c7bed00a9.png
secured-login.net/assets/ 3 KB
3 KB 138ms
137ms Image
image/png 35.172.241.209
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secured-login.net/assets/sei-flag-fc5e7621ba0e98c5c6728e3b2bdf802311c0a0953a05e60a7551cb0c7bed00a9.png

Requested by

Host: secured-login.net
URL: https://secured-login.net/assets/sei-flag-590a28b756e2e8a0661ceca1971920bd1a0c3579252c8f51c98af4cc357b6e8b.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.172.241.209 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-35-172-241-209.compute-1.amazonaws.com

Software

Resource Hash

fc5e7621ba0e98c5c6728e3b2bdf802311c0a0953a05e60a7551cb0c7bed00a9

Security Headers

Name	Value
Strict-Transport-Security	max-age=63113904; includeSubDomains; preload

Request headers

Referer: https://secured-login.net/assets/sei-flag-590a28b756e2e8a0661ceca1971920bd1a0c3579252c8f51c98af4cc357b6e8b.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
date: Fri, 02 Oct 2020 03:01:54 GMT
last-modified: Thu, 01 Oct 2020 13:48:35 GMT
content-length: 3168
strict-transport-security: max-age=63113904; includeSubDomains; preload
content-type: image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Phishing Simulation (Internet)

46 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	warning	URL: https://secured-login.net/assets/application-34731a53f70a45d7089db428445ef7a75bdd37c0ba8badff907af1fa563ac830.js(Line 73581) Message: bootstrap-slider.js - WARNING: $.fn.slider namespace is already bound. Use the $.fn.bootstrapSlider namespace instead.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy
Strict-Transport-Security	max-age=63113904; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

34.75.2o2.lol
cdn2.hubspot.net
secured-login.net
www.viima.com
2606:4700::6811:7bb4
2606:4700::6811:f1cc
35.172.241.209
52.3.61.86
15c00abdc9e9462d2538982039515c2ee3a056dfaef70b944c0b234c1dda1270
16f13e16a7ef02fb6f94250aa1931ded83dbee5d9fad278e33dd5792d085194f
24152d098d5744697d79f0a2a169038a204eb8c53a3f6e23b227b178712b53c1
271b8163a3ccda0ea83d4a13814a97d1fc2797c57fb363ca7d0e95e5e0df8a7c
34731a53f70a45d7089db428445ef7a75bdd37c0ba8badff907af1fa563ac830
590a28b756e2e8a0661ceca1971920bd1a0c3579252c8f51c98af4cc357b6e8b
654222debe8018b12f1993ceddff30dc163a7d5008d79869c399d6d167321f97
87c0b8441c4e198bf1b40736ef11cdb5b039e48a39bfa7dce55d95301584b8d3
b1ba44357f6c9c659d558198026635fa6c5c96aa3b3376f0756ceed496356172
c354a486a95ab627afd4a080422f81a16828942f5f21e2b24ef8148a522e15d6
d825f0ad629ec032bd805cfb30f4d41d8be4521885c42e29f427a0afc3728b74
fc5e7621ba0e98c5c6728e3b2bdf802311c0a0953a05e60a7551cb0c7bed00a9

secured-login.net Open in urlscan Pro 35.172.241.209 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Page Statistics

12 Requests

100 %HTTPS

50 %IPv6

4 Domains

4 Subdomains

4 IPs

1 Countries

1163 kBTransfer

4564 kBSize

0 Cookies

1 Outgoing links

Page URL History

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

46 JavaScript Global Variables

0 Cookies

1 Console Messages

Security Headers

Indicators

secured-login.net Open in urlscan Pro
35.172.241.209 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

100 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

4
IPs

1
Countries

1163 kB
Transfer

4564 kB
Size

0
Cookies

12 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!