secur6iogin6.securemygateway.com Open in urlscan Pro
2a06:98c1:3121::3 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://secur6iogin6.securemygateway.com/profile.html?ref=nUFyTBBBFAWV
Submission: On April 14 via automatic, source openphish (April 14th 2023, 1:12:46 pm UTC) — Scanned from NL

Summary HTTP 2 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 2 HTTP transactions. The main IP is 2a06:98c1:3121::3, located in United States and belongs to CLOUDFLARENET, US. The main domain is secur6iogin6.securemygateway.com.

This is the only time secur6iogin6.securemygateway.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
1	2a06:98c1:312... 2a06:98c1:3121::3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	162.19.58.156 162.19.58.156	16276 (OVH) (OVH)
2	3

1 2a06:98c1:3121::3 (United States)

ASN13335 (CLOUDFLARENET, US)

secur6iogin6.securemygateway.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 162.19.58.156 (France)

ASN16276 (OVH, FR)
PTR: ns3096358.ip-162-19-58.eu

i.ibb.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
1	ibb.co i.ibb.co — Cisco Umbrella Rank: 12230	300 KB
1	securemygateway.com secur6iogin6.securemygateway.com	67 KB
2	2

	Domain	Requested by
1	i.ibb.co	secur6iogin6.securemygateway.com
1	secur6iogin6.securemygateway.com
2	2

This site contains links to these domains. Also see Links.

Domain
signup.live.com

Subject Issuer	Validity	Valid
i.ibb.co R3	`2023-04-11` - `2023-07-10`	3 months	crt.sh

This page contains 1 frames:

Primary Page: http://secur6iogin6.securemygateway.com/profile.html?ref=nUFyTBBBFAWV
Frame ID: 0DAF299937AE29B5D7BBC8EBFAA89060
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Sign in to your Microsoft account

Page Statistics

2
Requests

50 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

367 kB
Transfer

503 kB
Size

0
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://signup.live.com/signup?wa=wsignin1.0&rpsnv=13&ct=1664795419&rver=7.0.6737.0&wp=MBI_SSL&wreply=https%3a%2f%2foutlook.live.com%2fowa%2f%3fnlp%3d1%26RpsCsrfState%3d80a5e1a2-f951-df5f-546b-fb65407f9cb6&id=292841&aadredir=1&CBCXT=out&lw=1&fl=dob%2cflname%2cwld&cobrandid=90015&contextid=60A28D13D66D6541&bk=1664795419&uiflavor=web&lic=1&mkt=EN-GB&lc=2057&uaid=29250024cc9345fc927bcf6c49c4f4d6
Title: Create one!

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

2 HTTP transactions
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request profile.html Show response secur6iogin6.securemygateway.com/	148 KB 67 KB	1011ms 756ms	Document text/html	2a06:98c1:3121::3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL http://secur6iogin6.securemygateway.com/profile.html?ref=nUFyTBBBFAWV Protocol HTTP/1.1 Server 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / ASP.NET Resource Hash `2f951322a13c260697048a4723ac6c735ef3ec22b46f91705aea0b815087204f` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36 accept-language nl-NL,nl;q=0.9 Response headers CF-Cache-Status DYNAMIC CF-RAY 7b7c339f0a1e06ca-AMS Connection keep-alive Content-Encoding gzip Content-Type text/html; charset=utf-8 Date Fri, 14 Apr 2023 13:12:40 GMT NEL {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Report-To {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XtQWNFbJfWyZoFJtyv5VkIXFeAk7PCr55gyxdsQfLtkSUz6MS0HRx06BRYn0EI1BRVc%2BR8nmPtwNcE2eGVHQNJjYY%2B7ScosrrUWOdtYF3JXwebKcah6g%2Fv%2BXMxXSyZm8CoMxnzX%2Fq%2BEPCr2jvwzAni5E6625w07ky2riEcU1Hw%3D%3D"}],"group":"cf-nel","max_age":604800} Server cloudflare Transfer-Encoding chunked X-Powered-By ASP.NET alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET DATA	200 OK	truncated /	55 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `e5ead2061c86490f605358f85c768fd57e2dfcfb326c7c6696bf89d5bc0f6688` Request headers accept-language nl-NL,nl;q=0.9 Referer http://secur6iogin6.securemygateway.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36 Response headers Content-Type image/png
GET H2	200	back.png i.ibb.co/QfLRbGT/	299 KB 300 KB	129ms 38ms	Image image/png	162.19.58.156 OVH
General Check archive.org Show headers Download Go to Show image Full URL https://i.ibb.co/QfLRbGT/back.png Requested by Host: secur6iogin6.securemygateway.com URL: http://secur6iogin6.securemygateway.com/profile.html?ref=nUFyTBBBFAWV Protocol H2 Security TLS 1.3, , AES_128_GCM Server 162.19.58.156 , France, ASN16276 (OVH, FR), Reverse DNS ns3096358.ip-162-19-58.eu Software nginx / Resource Hash `345f500582fb5cfc20df5426c6b54bb0bcaa62eb0249a4a661dc9716a9edc006` Request headers accept-language nl-NL,nl;q=0.9 Referer http://secur6iogin6.securemygateway.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36 Response headers date Fri, 14 Apr 2023 13:12:40 GMT last-modified Thu, 18 Aug 2022 10:24:45 GMT server nginx access-control-allow-methods GET, OPTIONS content-type image/png access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 306493 expires Thu, 31 Dec 2037 23:55:55 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

17 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	URL: http://secur6iogin6.securemygateway.com/profile.html?ref=nUFyTBBBFAWV Message: The Content Security Policy 'upgrade-insecure-requests' was delivered via a <meta> element outside the document's <head>, which is disallowed. The policy has been ignored.
security	error	URL: http://secur6iogin6.securemygateway.com/profile.html?ref=nUFyTBBBFAWV Message: The Content Security Policy 'upgrade-insecure-requests' was delivered via a <meta> element outside the document's <head>, which is disallowed. The policy has been ignored.
security	error	URL: http://secur6iogin6.securemygateway.com/profile.html?ref=nUFyTBBBFAWV Message: The Content Security Policy 'upgrade-insecure-requests' was delivered via a <meta> element outside the document's <head>, which is disallowed. The policy has been ignored.
security	error	URL: http://secur6iogin6.securemygateway.com/profile.html?ref=nUFyTBBBFAWV Message: The Content Security Policy 'upgrade-insecure-requests' was delivered via a <meta> element outside the document's <head>, which is disallowed. The policy has been ignored.
security	error	URL: http://secur6iogin6.securemygateway.com/profile.html?ref=nUFyTBBBFAWV Message: The Content Security Policy 'upgrade-insecure-requests' was delivered via a <meta> element outside the document's <head>, which is disallowed. The policy has been ignored.
security	error	URL: http://secur6iogin6.securemygateway.com/profile.html?ref=nUFyTBBBFAWV Message: The Content Security Policy 'upgrade-insecure-requests' was delivered via a <meta> element outside the document's <head>, which is disallowed. The policy has been ignored.
security	error	URL: http://secur6iogin6.securemygateway.com/profile.html?ref=nUFyTBBBFAWV Message: The Content Security Policy 'upgrade-insecure-requests' was delivered via a <meta> element outside the document's <head>, which is disallowed. The policy has been ignored.
security	error	URL: http://secur6iogin6.securemygateway.com/profile.html?ref=nUFyTBBBFAWV Message: The Content Security Policy 'upgrade-insecure-requests' was delivered via a <meta> element outside the document's <head>, which is disallowed. The policy has been ignored.
security	error	URL: http://secur6iogin6.securemygateway.com/profile.html?ref=nUFyTBBBFAWV Message: The Content Security Policy 'upgrade-insecure-requests' was delivered via a <meta> element outside the document's <head>, which is disallowed. The policy has been ignored.
security	error	URL: http://secur6iogin6.securemygateway.com/profile.html?ref=nUFyTBBBFAWV Message: The Content Security Policy 'upgrade-insecure-requests' was delivered via a <meta> element outside the document's <head>, which is disallowed. The policy has been ignored.
security	error	URL: http://secur6iogin6.securemygateway.com/profile.html?ref=nUFyTBBBFAWV Message: The Content Security Policy 'upgrade-insecure-requests' was delivered via a <meta> element outside the document's <head>, which is disallowed. The policy has been ignored.
security	error	URL: http://secur6iogin6.securemygateway.com/profile.html?ref=nUFyTBBBFAWV Message: The Content Security Policy 'upgrade-insecure-requests' was delivered via a <meta> element outside the document's <head>, which is disallowed. The policy has been ignored.
security	error	URL: http://secur6iogin6.securemygateway.com/profile.html?ref=nUFyTBBBFAWV Message: The Content Security Policy 'upgrade-insecure-requests' was delivered via a <meta> element outside the document's <head>, which is disallowed. The policy has been ignored.
security	error	URL: http://secur6iogin6.securemygateway.com/profile.html?ref=nUFyTBBBFAWV Message: The Content Security Policy 'upgrade-insecure-requests' was delivered via a <meta> element outside the document's <head>, which is disallowed. The policy has been ignored.
security	error	URL: http://secur6iogin6.securemygateway.com/profile.html?ref=nUFyTBBBFAWV Message: The Content Security Policy 'upgrade-insecure-requests' was delivered via a <meta> element outside the document's <head>, which is disallowed. The policy has been ignored.
security	error	URL: http://secur6iogin6.securemygateway.com/profile.html?ref=nUFyTBBBFAWV Message: The Content Security Policy 'upgrade-insecure-requests' was delivered via a <meta> element outside the document's <head>, which is disallowed. The policy has been ignored.
security	error	URL: http://secur6iogin6.securemygateway.com/profile.html?ref=nUFyTBBBFAWV Message: The Content Security Policy 'upgrade-insecure-requests' was delivered via a <meta> element outside the document's <head>, which is disallowed. The policy has been ignored.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

i.ibb.co
secur6iogin6.securemygateway.com
162.19.58.156
2a06:98c1:3121::3
2f951322a13c260697048a4723ac6c735ef3ec22b46f91705aea0b815087204f
345f500582fb5cfc20df5426c6b54bb0bcaa62eb0249a4a661dc9716a9edc006
e5ead2061c86490f605358f85c768fd57e2dfcfb326c7c6696bf89d5bc0f6688

secur6iogin6.securemygateway.com Open in urlscan Pro 2a06:98c1:3121::3 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

2 Requests

50 %HTTPS

50 %IPv6

2 Domains

2 Subdomains

3 IPs

2 Countries

367 kBTransfer

503 kBSize

0 Cookies

1 Outgoing links

Redirected requests

2 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

0 Cookies

17 Console Messages

Indicators

secur6iogin6.securemygateway.com Open in urlscan Pro
2a06:98c1:3121::3 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

2
Requests

50 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

367 kB
Transfer

503 kB
Size

0
Cookies

2 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!