secured-login.net Open in urlscan Pro
52.3.198.50 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://messaging-security.comano.us/XcmVkjaXBpZWS50X2lkPTXQwMzIzbxOTM1ONyZjYW1wjYWllnbl9ydW5faWQ9MTY0bMDI5OCZhY3Rpb249Y2xpY2smdXJsPW...
Effective URL:
https://secured-login.net/pages/5800d6a290ca/XcmVkjaXBpZWS50X2lkPTXQwMzIzbxOTM1ONyZjYW1wjYWllnbl9ydW5faWQ9MTY0bMDI5OCZhY3R...
Submission: On December 03 via manual (December 3rd 2018, 4:18:36 pm UTC) from US

Summary HTTP 11 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 4 IPs in 1 countries across 4 domains to perform 11 HTTP transactions. The main IP is 52.3.198.50, located in Ashburn, United States and belongs to AMAZON-AES - Amazon.com, Inc., US. The main domain is secured-login.net.
TLS certificate: Issued by Amazon on November 26th 2018. Valid for: a year.

This is the only time secured-login.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Phishing Simulation (Internet)

Domain & IP information

	IP Address	AS Autonomous System
1	52.45.19.240 52.45.19.240	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
8	52.3.198.50 52.3.198.50	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
1	169.53.40.173 169.53.40.173	36351 (SOFTLAYER) (SOFTLAYER - SoftLayer Technologies Inc.)
1	54.231.120.234 54.231.120.234	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
11	4

1 52.45.19.240 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-52-45-19-240.compute-1.amazonaws.com

messaging-security.comano.us	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 52.3.198.50 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-52-3-198-50.compute-1.amazonaws.com

secured-login.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 169.53.40.173 (Dallas, United States)

ASN36351 (SOFTLAYER - SoftLayer Technologies Inc., US)
PTR: ad.28.35a9.ip4.static.sl-reverse.com

www.oge.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.231.120.234 (Ashburn, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: s3-1.amazonaws.com

s3.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	secured-login.net secured-login.net	875 KB
1	amazonaws.com s3.amazonaws.com	26 KB
1	oge.com www.oge.com	9 KB
1	comano.us messaging-security.comano.us	737 B
11	4

	Domain	Requested by
8	secured-login.net	messaging-security.comano.us secured-login.net
1	s3.amazonaws.com	secured-login.net
1	www.oge.com	secured-login.net
1	messaging-security.comano.us
11	4

This site contains links to these domains. Also see Links.

Domain
34.75.2o2.lol

Subject Issuer	Validity	Valid
strongencryption.org Amazon	`2018-11-26` - `2019-12-26`	a year	crt.sh
*.oge.com DigiCert SHA2 High Assurance Server CA	`2016-12-01` - `2019-12-06`	3 years	crt.sh
s3.amazonaws.com DigiCert Baltimore CA-2 G2	`2018-08-02` - `2019-10-25`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://secured-login.net/pages/5800d6a290ca/XcmVkjaXBpZWS50X2lkPTXQwMzIzbxOTM1ONyZjYW1wjYWllnbl9ydW5faWQ9MTY0bMDI5OCZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vc2VjdXJlZC1sb2dpbi5uZXQvcGFnZXMvNTgwMGQ2YTI5MGNh
Frame ID: 210914AE82E715CBDECC9D30B8AAA20F
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://messaging-security.comano.us/XcmVkjaXBpZWS50X2lkPTXQwMzIzbxOTM1ONyZjYW1wjYWllnbl9ydW5faWQ9MTY0bMDI5OCZhY3... Page URL
https://secured-login.net/pages/5800d6a290ca/XcmVkjaXBpZWS50X2lkPTXQwMzIzbxOTM1ONyZjYW1wjYWllnbl9ydW5f... Page URL

Detected technologies

Modernizr (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /modernizr(?:-([\d.]*[\d]))?.*\.js/i
env /^Modernizr$/i

Moment.js (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

env /^moment$/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

env /^jQuery$/i

Page Statistics

11
Requests

91 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

4
IPs

1
Countries

911 kB
Transfer

3679 kB
Size

0
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: http://34.75.2o2.lol/XdXJcsPWh0dHsA6Ly9tZXoNzYWdphebmctkc2VjdXJptdHykuY29tYW5vLnVzL1hLcQjRtVk1qYVhCcFpXTzUwWDJsa1BUS0U0TkRreFB1T1RRbVVZMkZ0Y0dGcGdaMnQ1ZmNuVnVYMmxrUFRFeU1URTRYSm1GamRHbHZiajFqYkdsamF5WjFjbXc5YUhSMGNITTZMeTkwY21GcGJtbHVaeTF6ZEdGbmFXNW5MbXR1YjNkaVpUUXVZMjl0TDNCaFoyVnpMMlkyTURZNU5UVTJNRFZpJmVtYWlsX3RlbXBsYXRlX2lkPTcyMzIwNyZhY3Rpb249cHJldmlldyZ1c2VyX2lkPTEzOTMxNDY0
Title: visit here to complete a one-time verification process

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://messaging-security.comano.us/XcmVkjaXBpZWS50X2lkPTXQwMzIzbxOTM1ONyZjYW1wjYWllnbl9ydW5faWQ9MTY0bMDI5OCZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vc2VjdXJlZC1sb2dpbi5uZXQvcGFnZXMvNTgwMGQ2YTI5MGNh Page URL
https://secured-login.net/pages/5800d6a290ca/XcmVkjaXBpZWS50X2lkPTXQwMzIzbxOTM1ONyZjYW1wjYWllnbl9ydW5faWQ9MTY0bMDI5OCZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vc2VjdXJlZC1sb2dpbi5uZXQvcGFnZXMvNTgwMGQ2YTI5MGNh Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK XcmVkjaXBpZWS50X2lkPTXQwMzIzbxOTM1ONyZjYW1wjYWllnbl9ydW5faWQ9MTY0bMDI5OCZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vc2VjdXJlZC1sb2dpbi5uZXQvcGFnZXMvNTgwMGQ2YTI5MGNh Show response
messaging-security.comano.us/ 334 B
737 B 348ms
194ms Document
text/html 52.45.19.240
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

http://messaging-security.comano.us/XcmVkjaXBpZWS50X2lkPTXQwMzIzbxOTM1ONyZjYW1wjYWllnbl9ydW5faWQ9MTY0bMDI5OCZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vc2VjdXJlZC1sb2dpbi5uZXQvcGFnZXMvNTgwMGQ2YTI5MGNh

Protocol

HTTP/1.1

Server

52.45.19.240 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-52-45-19-240.compute-1.amazonaws.com

Software

Resource Hash

a1d22e5121f902e8165b5c615ac58781b93a79bb6b3cca776b9ce5cc18a02368

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Host: messaging-security.comano.us
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 03 Dec 2018 16:18:19 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Referrer-Policy: no-referrer-when-downgrade
X-Frame-Options: SAMEORIGIN
ETag: W/"a1d22e5121f902e8165b5c615ac58781"
Cache-Control: max-age=0, private, must-revalidate
X-Request-Id: 9685d62d-a0f5-4fbe-99d1-9c427f7a8001
X-Runtime: 0.097670

GET
H2 200 Primary Request XcmVkjaXBpZWS50X2lkPTXQwMzIzbxOTM1ONyZjYW1wjYWllnbl9ydW5faWQ9MTY0bMDI5OCZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vc2VjdXJlZC1sb2dpbi5uZXQvcGFnZXMvNTgwMGQ2YTI5MGNh Show response
secured-login.net/pages/5800d6a290ca/ 7 KB
8 KB 373ms
146ms Document
text/html 52.3.198.50
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://secured-login.net/pages/5800d6a290ca/XcmVkjaXBpZWS50X2lkPTXQwMzIzbxOTM1ONyZjYW1wjYWllnbl9ydW5faWQ9MTY0bMDI5OCZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vc2VjdXJlZC1sb2dpbi5uZXQvcGFnZXMvNTgwMGQ2YTI5MGNh

Requested by

Host: messaging-security.comano.us
URL: http://messaging-security.comano.us/XcmVkjaXBpZWS50X2lkPTXQwMzIzbxOTM1ONyZjYW1wjYWllnbl9ydW5faWQ9MTY0bMDI5OCZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vc2VjdXJlZC1sb2dpbi5uZXQvcGFnZXMvNTgwMGQ2YTI5MGNh

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.3.198.50 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-52-3-198-50.compute-1.amazonaws.com

Software

Resource Hash

eb778d6cfedef1699a077e3b9cf449773f84b2bbb50f35a8137ee074117b6fb4

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

:method: GET
:authority: secured-login.net
:scheme: https
:path: /pages/5800d6a290ca/XcmVkjaXBpZWS50X2lkPTXQwMzIzbxOTM1ONyZjYW1wjYWllnbl9ydW5faWQ9MTY0bMDI5OCZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vc2VjdXJlZC1sb2dpbi5uZXQvcGFnZXMvNTgwMGQ2YTI5MGNh
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer: http://messaging-security.comano.us/XcmVkjaXBpZWS50X2lkPTXQwMzIzbxOTM1ONyZjYW1wjYWllnbl9ydW5faWQ9MTY0bMDI5OCZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vc2VjdXJlZC1sb2dpbi5uZXQvcGFnZXMvNTgwMGQ2YTI5MGNh
accept-encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: http://messaging-security.comano.us/XcmVkjaXBpZWS50X2lkPTXQwMzIzbxOTM1ONyZjYW1wjYWllnbl9ydW5faWQ9MTY0bMDI5OCZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vc2VjdXJlZC1sb2dpbi5uZXQvcGFnZXMvNTgwMGQ2YTI5MGNh

Response headers

status: 200
date: Mon, 03 Dec 2018 16:18:20 GMT
content-type: text/html; charset=utf-8
referrer-policy: no-referrer-when-downgrade
x-frame-options: SAMEORIGIN
etag: W/"eb778d6cfedef1699a077e3b9cf44977"
cache-control: max-age=0, private, must-revalidate
x-request-id: 23a81c88-78e5-42e2-b472-097899c41909
x-runtime: 0.054088

GET
H2 200 application-18d04b9ea240d1dd98b3bec5ea105e9c97ee8647b26328034d2aa62fd65ac03b.js Show response
secured-login.net/assets/ 3 MB
846 KB 183ms
182ms Script
application/javascript 52.3.198.50
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://secured-login.net/assets/application-18d04b9ea240d1dd98b3bec5ea105e9c97ee8647b26328034d2aa62fd65ac03b.js
Requested by: Host: secured-login.net
URL: https://secured-login.net/pages/5800d6a290ca/XcmVkjaXBpZWS50X2lkPTXQwMzIzbxOTM1ONyZjYW1wjYWllnbl9ydW5faWQ9MTY0bMDI5OCZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vc2VjdXJlZC1sb2dpbi5uZXQvcGFnZXMvNTgwMGQ2YTI5MGNh
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.3.198.50 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-52-3-198-50.compute-1.amazonaws.com
Software: /
Resource Hash: 18d04b9ea240d1dd98b3bec5ea105e9c97ee8647b26328034d2aa62fd65ac03b

Request headers

:path: /assets/application-18d04b9ea240d1dd98b3bec5ea105e9c97ee8647b26328034d2aa62fd65ac03b.js
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: */*
cache-control: no-cache
:authority: secured-login.net
referer: https://secured-login.net/pages/5800d6a290ca/XcmVkjaXBpZWS50X2lkPTXQwMzIzbxOTM1ONyZjYW1wjYWllnbl9ydW5faWQ9MTY0bMDI5OCZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vc2VjdXJlZC1sb2dpbi5uZXQvcGFnZXMvNTgwMGQ2YTI5MGNh
:scheme: https
:method: GET
Referer: https://secured-login.net/pages/5800d6a290ca/XcmVkjaXBpZWS50X2lkPTXQwMzIzbxOTM1ONyZjYW1wjYWllnbl9ydW5faWQ9MTY0bMDI5OCZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vc2VjdXJlZC1sb2dpbi5uZXQvcGFnZXMvNTgwMGQ2YTI5MGNh
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status: 200
date: Mon, 03 Dec 2018 16:18:20 GMT
content-encoding: gzip
last-modified: Fri, 30 Nov 2018 20:37:27 GMT
content-length: 864852
vary: Accept-Encoding
content-type: application/javascript

GET
H2 200 modernizr-654222debe8018b12f1993ceddff30dc163a7d5008d79869c399d6d167321f97.js Show response
secured-login.net/assets/ 50 KB
16 KB 95ms
94ms Script
application/javascript 52.3.198.50
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://secured-login.net/assets/modernizr-654222debe8018b12f1993ceddff30dc163a7d5008d79869c399d6d167321f97.js
Requested by: Host: secured-login.net
URL: https://secured-login.net/pages/5800d6a290ca/XcmVkjaXBpZWS50X2lkPTXQwMzIzbxOTM1ONyZjYW1wjYWllnbl9ydW5faWQ9MTY0bMDI5OCZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vc2VjdXJlZC1sb2dpbi5uZXQvcGFnZXMvNTgwMGQ2YTI5MGNh
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.3.198.50 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-52-3-198-50.compute-1.amazonaws.com
Software: /
Resource Hash: 654222debe8018b12f1993ceddff30dc163a7d5008d79869c399d6d167321f97

Request headers

:path: /assets/modernizr-654222debe8018b12f1993ceddff30dc163a7d5008d79869c399d6d167321f97.js
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: */*
cache-control: no-cache
:authority: secured-login.net
referer: https://secured-login.net/pages/5800d6a290ca/XcmVkjaXBpZWS50X2lkPTXQwMzIzbxOTM1ONyZjYW1wjYWllnbl9ydW5faWQ9MTY0bMDI5OCZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vc2VjdXJlZC1sb2dpbi5uZXQvcGFnZXMvNTgwMGQ2YTI5MGNh
:scheme: https
:method: GET
Referer: https://secured-login.net/pages/5800d6a290ca/XcmVkjaXBpZWS50X2lkPTXQwMzIzbxOTM1ONyZjYW1wjYWllnbl9ydW5faWQ9MTY0bMDI5OCZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vc2VjdXJlZC1sb2dpbi5uZXQvcGFnZXMvNTgwMGQ2YTI5MGNh
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status: 200
date: Mon, 03 Dec 2018 16:18:20 GMT
content-encoding: gzip
last-modified: Fri, 30 Nov 2018 08:07:25 GMT
content-length: 15721
vary: Accept-Encoding
content-type: application/javascript

GET
H2 200 landing-watermark-954845d2889439a8f0ddae5758808b628cb050e703ba3fad73b44bb1f02144fe.css
secured-login.net/assets/ 1 KB
529 B 93ms
92ms Stylesheet
text/css 52.3.198.50
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://secured-login.net/assets/landing-watermark-954845d2889439a8f0ddae5758808b628cb050e703ba3fad73b44bb1f02144fe.css
Requested by: Host: secured-login.net
URL: https://secured-login.net/pages/5800d6a290ca/XcmVkjaXBpZWS50X2lkPTXQwMzIzbxOTM1ONyZjYW1wjYWllnbl9ydW5faWQ9MTY0bMDI5OCZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vc2VjdXJlZC1sb2dpbi5uZXQvcGFnZXMvNTgwMGQ2YTI5MGNh
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.3.198.50 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-52-3-198-50.compute-1.amazonaws.com
Software: /
Resource Hash: 954845d2889439a8f0ddae5758808b628cb050e703ba3fad73b44bb1f02144fe

Request headers

:path: /assets/landing-watermark-954845d2889439a8f0ddae5758808b628cb050e703ba3fad73b44bb1f02144fe.css
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: text/css,*/*;q=0.1
cache-control: no-cache
:authority: secured-login.net
referer: https://secured-login.net/pages/5800d6a290ca/XcmVkjaXBpZWS50X2lkPTXQwMzIzbxOTM1ONyZjYW1wjYWllnbl9ydW5faWQ9MTY0bMDI5OCZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vc2VjdXJlZC1sb2dpbi5uZXQvcGFnZXMvNTgwMGQ2YTI5MGNh
:scheme: https
:method: GET
Referer: https://secured-login.net/pages/5800d6a290ca/XcmVkjaXBpZWS50X2lkPTXQwMzIzbxOTM1ONyZjYW1wjYWllnbl9ydW5faWQ9MTY0bMDI5OCZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vc2VjdXJlZC1sb2dpbi5uZXQvcGFnZXMvNTgwMGQ2YTI5MGNh
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status: 200
date: Mon, 03 Dec 2018 16:18:20 GMT
content-encoding: gzip
last-modified: Fri, 30 Nov 2018 20:36:33 GMT
content-length: 395
vary: Accept-Encoding
content-type: text/css

GET
H2 200 sei-modal-a6d84b066349e3eb9d99b22aae73e800857d90e306ca08507e949d66162f12e5.css
secured-login.net/assets/ 1 KB
579 B 92ms
92ms Stylesheet
text/css 52.3.198.50
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://secured-login.net/assets/sei-modal-a6d84b066349e3eb9d99b22aae73e800857d90e306ca08507e949d66162f12e5.css
Requested by: Host: secured-login.net
URL: https://secured-login.net/pages/5800d6a290ca/XcmVkjaXBpZWS50X2lkPTXQwMzIzbxOTM1ONyZjYW1wjYWllnbl9ydW5faWQ9MTY0bMDI5OCZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vc2VjdXJlZC1sb2dpbi5uZXQvcGFnZXMvNTgwMGQ2YTI5MGNh
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.3.198.50 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-52-3-198-50.compute-1.amazonaws.com
Software: /
Resource Hash: a6d84b066349e3eb9d99b22aae73e800857d90e306ca08507e949d66162f12e5

Request headers

:path: /assets/sei-modal-a6d84b066349e3eb9d99b22aae73e800857d90e306ca08507e949d66162f12e5.css
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: text/css,*/*;q=0.1
cache-control: no-cache
:authority: secured-login.net
referer: https://secured-login.net/pages/5800d6a290ca/XcmVkjaXBpZWS50X2lkPTXQwMzIzbxOTM1ONyZjYW1wjYWllnbl9ydW5faWQ9MTY0bMDI5OCZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vc2VjdXJlZC1sb2dpbi5uZXQvcGFnZXMvNTgwMGQ2YTI5MGNh
:scheme: https
:method: GET
Referer: https://secured-login.net/pages/5800d6a290ca/XcmVkjaXBpZWS50X2lkPTXQwMzIzbxOTM1ONyZjYW1wjYWllnbl9ydW5faWQ9MTY0bMDI5OCZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vc2VjdXJlZC1sb2dpbi5uZXQvcGFnZXMvNTgwMGQ2YTI5MGNh
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status: 200
date: Mon, 03 Dec 2018 16:18:20 GMT
content-encoding: gzip
last-modified: Fri, 30 Nov 2018 20:36:33 GMT
content-length: 445
vary: Accept-Encoding
content-type: text/css

GET
H2 200 sei-tooltip-44046ca646f13b6e77f78fb2a676dd177bfe770d7c715b0ba5bb56d8d7663bd4.css
secured-login.net/assets/ 3 KB
820 B 93ms
92ms Stylesheet
text/css 52.3.198.50
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://secured-login.net/assets/sei-tooltip-44046ca646f13b6e77f78fb2a676dd177bfe770d7c715b0ba5bb56d8d7663bd4.css
Requested by: Host: secured-login.net
URL: https://secured-login.net/pages/5800d6a290ca/XcmVkjaXBpZWS50X2lkPTXQwMzIzbxOTM1ONyZjYW1wjYWllnbl9ydW5faWQ9MTY0bMDI5OCZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vc2VjdXJlZC1sb2dpbi5uZXQvcGFnZXMvNTgwMGQ2YTI5MGNh
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.3.198.50 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-52-3-198-50.compute-1.amazonaws.com
Software: /
Resource Hash: 44046ca646f13b6e77f78fb2a676dd177bfe770d7c715b0ba5bb56d8d7663bd4

Request headers

:path: /assets/sei-tooltip-44046ca646f13b6e77f78fb2a676dd177bfe770d7c715b0ba5bb56d8d7663bd4.css
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: text/css,*/*;q=0.1
cache-control: no-cache
:authority: secured-login.net
referer: https://secured-login.net/pages/5800d6a290ca/XcmVkjaXBpZWS50X2lkPTXQwMzIzbxOTM1ONyZjYW1wjYWllnbl9ydW5faWQ9MTY0bMDI5OCZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vc2VjdXJlZC1sb2dpbi5uZXQvcGFnZXMvNTgwMGQ2YTI5MGNh
:scheme: https
:method: GET
Referer: https://secured-login.net/pages/5800d6a290ca/XcmVkjaXBpZWS50X2lkPTXQwMzIzbxOTM1ONyZjYW1wjYWllnbl9ydW5faWQ9MTY0bMDI5OCZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vc2VjdXJlZC1sb2dpbi5uZXQvcGFnZXMvNTgwMGQ2YTI5MGNh
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status: 200
date: Mon, 03 Dec 2018 16:18:20 GMT
content-encoding: gzip
last-modified: Fri, 30 Nov 2018 20:36:33 GMT
content-length: 686
vary: Accept-Encoding
content-type: text/css

GET
H2 200 sei-flag-55c15d8d7a286d55ebb6ed788bc8f0164756751b9423684fab0d627cc5234591.css
secured-login.net/assets/ 2 KB
753 B 93ms
92ms Stylesheet
text/css 52.3.198.50
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://secured-login.net/assets/sei-flag-55c15d8d7a286d55ebb6ed788bc8f0164756751b9423684fab0d627cc5234591.css
Requested by: Host: secured-login.net
URL: https://secured-login.net/pages/5800d6a290ca/XcmVkjaXBpZWS50X2lkPTXQwMzIzbxOTM1ONyZjYW1wjYWllnbl9ydW5faWQ9MTY0bMDI5OCZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vc2VjdXJlZC1sb2dpbi5uZXQvcGFnZXMvNTgwMGQ2YTI5MGNh
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.3.198.50 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-52-3-198-50.compute-1.amazonaws.com
Software: /
Resource Hash: 55c15d8d7a286d55ebb6ed788bc8f0164756751b9423684fab0d627cc5234591

Request headers

:path: /assets/sei-flag-55c15d8d7a286d55ebb6ed788bc8f0164756751b9423684fab0d627cc5234591.css
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: text/css,*/*;q=0.1
cache-control: no-cache
:authority: secured-login.net
referer: https://secured-login.net/pages/5800d6a290ca/XcmVkjaXBpZWS50X2lkPTXQwMzIzbxOTM1ONyZjYW1wjYWllnbl9ydW5faWQ9MTY0bMDI5OCZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vc2VjdXJlZC1sb2dpbi5uZXQvcGFnZXMvNTgwMGQ2YTI5MGNh
:scheme: https
:method: GET
Referer: https://secured-login.net/pages/5800d6a290ca/XcmVkjaXBpZWS50X2lkPTXQwMzIzbxOTM1ONyZjYW1wjYWllnbl9ydW5faWQ9MTY0bMDI5OCZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vc2VjdXJlZC1sb2dpbi5uZXQvcGFnZXMvNTgwMGQ2YTI5MGNh
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status: 200
date: Mon, 03 Dec 2018 16:18:20 GMT
content-encoding: gzip
last-modified: Fri, 30 Nov 2018 20:36:33 GMT
content-length: 619
vary: Accept-Encoding
content-type: text/css

GET
H/1.1 200
OK oge_securetogether_405X161.png
www.oge.com/images/ 9 KB
9 KB 596ms
127ms Image
image/png 169.53.40.173
SoftLayer Technol...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.oge.com/images/oge_securetogether_405X161.png
Requested by: Host: secured-login.net
URL: https://secured-login.net/pages/5800d6a290ca/XcmVkjaXBpZWS50X2lkPTXQwMzIzbxOTM1ONyZjYW1wjYWllnbl9ydW5faWQ9MTY0bMDI5OCZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vc2VjdXJlZC1sb2dpbi5uZXQvcGFnZXMvNTgwMGQ2YTI5MGNh
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, 3DES_EDE_CBC
Server: 169.53.40.173 Dallas, United States, ASN36351 (SOFTLAYER - SoftLayer Technologies Inc., US),
Reverse DNS: ad.28.35a9.ip4.static.sl-reverse.com
Software: /
Resource Hash: c61cab3835443831cea75c73164ecc7793e5d3ddba006b29eb3005729de73a9a

Request headers

Referer: https://secured-login.net/pages/5800d6a290ca/XcmVkjaXBpZWS50X2lkPTXQwMzIzbxOTM1ONyZjYW1wjYWllnbl9ydW5faWQ9MTY0bMDI5OCZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vc2VjdXJlZC1sb2dpbi5uZXQvcGFnZXMvNTgwMGQ2YTI5MGNh
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 03 Dec 2018 16:18:20 GMT
Last-Modified: Wed, 22 Aug 2018 14:44:28 GMT
ETag: "234c-574072df24b00"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=70
Content-Length: 9036

GET
H/1.1 200
OK Hand.png
s3.amazonaws.com/knowbe4-images/ 25 KB
26 KB 382ms
99ms Image
image/png 54.231.120.234
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3.amazonaws.com/knowbe4-images/Hand.png
Requested by: Host: secured-login.net
URL: https://secured-login.net/pages/5800d6a290ca/XcmVkjaXBpZWS50X2lkPTXQwMzIzbxOTM1ONyZjYW1wjYWllnbl9ydW5faWQ9MTY0bMDI5OCZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vc2VjdXJlZC1sb2dpbi5uZXQvcGFnZXMvNTgwMGQ2YTI5MGNh
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.231.120.234 Ashburn, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: s3-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: b02cffc112737ba0eb6659534f4d2ef29dd2bdf135b2ee71eddb278dc16a3158

Request headers

Referer: https://secured-login.net/pages/5800d6a290ca/XcmVkjaXBpZWS50X2lkPTXQwMzIzbxOTM1ONyZjYW1wjYWllnbl9ydW5faWQ9MTY0bMDI5OCZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vc2VjdXJlZC1sb2dpbi5uZXQvcGFnZXMvNTgwMGQ2YTI5MGNh
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Mon, 03 Dec 2018 16:18:21 GMT
Last-Modified: Wed, 10 Aug 2016 15:36:43 GMT
Server: AmazonS3
x-amz-request-id: 1C1389D78FBEA879
ETag: "0b1166f8fa511aef34710b419eef22fc"
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 26101
x-amz-id-2: JJ3Hw0Cc5BdIpfhMcjYQiuB3KfRcofOPXpG+1mFZsDRC7ixfgnrGePwo0Yq8djwM2Gq9v//Cddk=

GET
H2 200 sei-flag-fc5e7621ba0e98c5c6728e3b2bdf802311c0a0953a05e60a7551cb0c7bed00a9.png
secured-login.net/assets/ 3 KB
3 KB 92ms
92ms Image
image/png 52.3.198.50
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secured-login.net/assets/sei-flag-fc5e7621ba0e98c5c6728e3b2bdf802311c0a0953a05e60a7551cb0c7bed00a9.png
Requested by: Host: secured-login.net
URL: https://secured-login.net/pages/5800d6a290ca/XcmVkjaXBpZWS50X2lkPTXQwMzIzbxOTM1ONyZjYW1wjYWllnbl9ydW5faWQ9MTY0bMDI5OCZhY3Rpb249Y2xpY2smdXJsPWh0dHBzOi8vc2VjdXJlZC1sb2dpbi5uZXQvcGFnZXMvNTgwMGQ2YTI5MGNh
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.3.198.50 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-52-3-198-50.compute-1.amazonaws.com
Software: /
Resource Hash: fc5e7621ba0e98c5c6728e3b2bdf802311c0a0953a05e60a7551cb0c7bed00a9

Request headers

:path: /assets/sei-flag-fc5e7621ba0e98c5c6728e3b2bdf802311c0a0953a05e60a7551cb0c7bed00a9.png
pragma: no-cache
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: secured-login.net
referer: https://secured-login.net/assets/sei-flag-55c15d8d7a286d55ebb6ed788bc8f0164756751b9423684fab0d627cc5234591.css
:scheme: https
:method: GET
Referer: https://secured-login.net/assets/sei-flag-55c15d8d7a286d55ebb6ed788bc8f0164756751b9423684fab0d627cc5234591.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status: 200
date: Mon, 03 Dec 2018 16:18:21 GMT
last-modified: Fri, 30 Nov 2018 20:36:33 GMT
content-length: 3168
content-type: image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Phishing Simulation (Internet)

36 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	warning	URL: https://secured-login.net/assets/application-18d04b9ea240d1dd98b3bec5ea105e9c97ee8647b26328034d2aa62fd65ac03b.js(Line 85364) Message: bootstrap-slider.js - WARNING: $.fn.slider namespace is already bound. Use the $.fn.bootstrapSlider namespace instead.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

messaging-security.comano.us
s3.amazonaws.com
secured-login.net
www.oge.com
169.53.40.173
52.3.198.50
52.45.19.240
54.231.120.234
18d04b9ea240d1dd98b3bec5ea105e9c97ee8647b26328034d2aa62fd65ac03b
44046ca646f13b6e77f78fb2a676dd177bfe770d7c715b0ba5bb56d8d7663bd4
55c15d8d7a286d55ebb6ed788bc8f0164756751b9423684fab0d627cc5234591
654222debe8018b12f1993ceddff30dc163a7d5008d79869c399d6d167321f97
954845d2889439a8f0ddae5758808b628cb050e703ba3fad73b44bb1f02144fe
a1d22e5121f902e8165b5c615ac58781b93a79bb6b3cca776b9ce5cc18a02368
a6d84b066349e3eb9d99b22aae73e800857d90e306ca08507e949d66162f12e5
b02cffc112737ba0eb6659534f4d2ef29dd2bdf135b2ee71eddb278dc16a3158
c61cab3835443831cea75c73164ecc7793e5d3ddba006b29eb3005729de73a9a
eb778d6cfedef1699a077e3b9cf449773f84b2bbb50f35a8137ee074117b6fb4
fc5e7621ba0e98c5c6728e3b2bdf802311c0a0953a05e60a7551cb0c7bed00a9

secured-login.net Open in urlscan Pro 52.3.198.50 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

11 Requests

91 %HTTPS

0 %IPv6

4 Domains

4 Subdomains

4 IPs

1 Countries

911 kBTransfer

3679 kBSize

0 Cookies

1 Outgoing links

Page URL History

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

36 JavaScript Global Variables

0 Cookies

1 Console Messages

Security Headers

Indicators

secured-login.net Open in urlscan Pro
52.3.198.50 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

91 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

4
IPs

1
Countries

911 kB
Transfer

3679 kB
Size

0
Cookies

11 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!