urlscan.io logo urlscan.io
SecurityTrails logo

login.burnettspecialists.org Open in urlscan Pro
185.234.72.170  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://atomictransport.msonline.tech/
Effective URL: https://login.burnettspecialists.org/fGefkvRr
Submission: On November 02 via api from US — Scanned from CH
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 5 IPs in 3 countries across 4 domains to perform 5 HTTP transactions. The main IP is 185.234.72.170, located in Frankfurt am Main, Germany and belongs to ITP-SOLUTIONS, DE. The main domain is login.burnettspecialists.org.
TLS certificate: Issued by R10 on October 16th 2024. Valid for: 3 months.
This is the only time login.burnettspecialists.org was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

IP Address AS Autonomous System
1 188.114.96.3 13335 (CLOUDFLAR...)
2 185.234.72.170 213250 (ITP-SOLUT...)
1 1 172.67.74.163 13335 (CLOUDFLAR...)
1 2a04:4e42:600... 54113 (FASTLY)
1 163.181.92.233 24429 (TAOBAO Zh...)
5 5
1    188.114.96.3 (Amsterdam, Netherlands)

ASN13335 (CLOUDFLARENET, US)
atomictransport.msonline.tech
2    185.234.72.170 (Frankfurt am Main, Germany)

ASN213250 (ITP-SOLUTIONS, DE)
login.burnettspecialists.org
1    172.67.74.163 (United States)

ASN13335 (CLOUDFLARENET, US)
picsum.photos
1    2a04:4e42:600::347 (United States)

ASN54113 (FASTLY, US)
fastly.picsum.photos
1    163.181.92.233 (Frankfurt am Main, Germany)

ASN24429 (TAOBAO Zhejiang Taobao Network Co.,Ltd, CN)
cstaticdun.126.net
Apex Domain
Subdomains		 Transfer
2 picsum.photos
picsum.photos — Cisco Umbrella Rank: 73362
fastly.picsum.photos — Cisco Umbrella Rank: 100571
8 KB
2 burnettspecialists.org
login.burnettspecialists.org
11 KB
1 126.net
cstaticdun.126.net — Cisco Umbrella Rank: 135043
12 KB
1 msonline.tech
atomictransport.msonline.tech
2 KB
5 4
Domain Requested by
2 login.burnettspecialists.org atomictransport.msonline.tech
1 cstaticdun.126.net login.burnettspecialists.org
1 fastly.picsum.photos login.burnettspecialists.org
1 picsum.photos 1 redirects
1 atomictransport.msonline.tech
5 5

This site contains no links.

Subject Issuer Validity Valid
msonline.tech
WE1		 2024-10-11 -
2025-01-09		 3 months crt.sh
ufcs.burnettspecialists.org
R10		 2024-10-16 -
2025-01-14		 3 months crt.sh
*.126.net
TrustAsia RSA OV TLS CA G2		 2023-11-15 -
2024-12-08		 a year crt.sh

This page contains 1 frames:

Primary Page: https://login.burnettspecialists.org/fGefkvRr
Frame ID: F4B822355D94241A9849AC3B02B77179
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Just a moment..

Page URL History Show full URLs

  1. https://atomictransport.msonline.tech/ Page URL
  2. https://login.burnettspecialists.org/fGefkvRr Page URL

Page Statistics

5
Requests

80 %
HTTPS

20 %
IPv6

4
Domains

5
Subdomains

5
IPs

3
Countries

32 kB
Transfer

33 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://atomictransport.msonline.tech/ Page URL
  2. https://login.burnettspecialists.org/fGefkvRr Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1
  • https://picsum.photos/300/150/?image=4 HTTP 302
  • https://fastly.picsum.photos/id/4/300/150.jpg?hmac=hYQXHRVyZuPs8bXmx2lhqyx9MkY1x775HBu62Ou5sFk

5 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
atomictransport.msonline.tech/ 		2 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://atomictransport.msonline.tech/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
8dc7caa8185e018c-CDG
content-encoding
br
content-type
text/html
date
Sat, 02 Nov 2024 23:09:20 GMT
last-modified
Thu, 31 Oct 2024 18:07:56 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
priority
u=0,i
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vHM%2BjEXz%2BV3Px9QTsXTutt3BK6eIfHEViT4sTz6wz1TyfEh%2FDodqJGYX6LL0nQXQDrBbeT%2F7WjJnRw2GvlxjYDugXTqdhJjdN7FuTSxG4%2FCEtv6mHBctI%2B54fYZ1qdxtrIvQb9u1MMZkJK51Xoyh6Q%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
server-timing
cfL4;desc="?proto=QUIC&rtt=28029&sent=11&recv=9&lost=0&retrans=0&sent_bytes=4144&recv_bytes=4449&delivery_rate=20318&cwnd=12000&unsent_bytes=0&cid=9248d2f5d23fcd80&ts=103&x=1" cfExtPri cfHdrFlush;dur=0
vary
Accept-Encoding
Primary Request fGefkvRr
login.burnettspecialists.org/ 		11 KB
11 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://login.burnettspecialists.org/fGefkvRr
Requested by
Host: atomictransport.msonline.tech
URL: https://atomictransport.msonline.tech/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
185.234.72.170 Frankfurt am Main, Germany, ASN213250 (ITP-SOLUTIONS, DE),
Reverse DNS
Software
/
Resource Hash
2fe76c2a1eddeedc2773637a7071525016f0d24779967ee36dcce8a0f8aa50f3

Request headers

Referer
https://atomictransport.msonline.tech/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

Connection
close
Content-Type
text/html
Transfer-Encoding
chunked
150.jpg
fastly.picsum.photos/id/4/300/
Redirect Chain
  • https://picsum.photos/300/150/?image=4
  • https://fastly.picsum.photos/id/4/300/150.jpg?hmac=hYQXHRVyZuPs8bXmx2lhqyx9MkY1x775HBu62Ou5sFk
7 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://fastly.picsum.photos/id/4/300/150.jpg?hmac=hYQXHRVyZuPs8bXmx2lhqyx9MkY1x775HBu62Ou5sFk
Requested by
Host: login.burnettspecialists.org
URL: https://login.burnettspecialists.org/fGefkvRr
Protocol
H2
Server
2a04:4e42:600::347 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
69d7cdb7bfee2e08aae30c31f03c64efad5b2f8c6eb633250cb17b4e02b82411

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://login.burnettspecialists.org/

Response headers

access-control-expose-headers
Content-Type, Picsum-Id
age
157402
picsum-id
4
x-cache
HIT
date
Sat, 02 Nov 2024 23:09:20 GMT
content-type
image/jpeg
content-disposition
inline; filename="4-300x150.jpg"
x-cache-hits
0
x-served-by
cache-fra-eddf8230119-FRA
vary
Origin
cache-control
public, max-age=2592000, stale-while-revalidate=60, stale-if-error=43200, immutable
timing-allow-origin
*
x-timer
S1730588961.946560,VS0,VE1
via
1.1 varnish
accept-ranges
bytes
access-control-allow-origin
*
content-length
7224
server
nginx

Redirect headers

cf-cache-status
DYNAMIC
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ea6w%2FyWqQ13VTfYWgecJkocqQPPmY8fqB3ZzsOW84oeRyLhSDjSwnwvmNpl%2FA04yKib0aJqAOoTkkYeB0fv5POzicBvfX7Bvz4QIMkCObinV%2Bh8LMjUX%2B2E2J7Qx7Iw%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=21238&sent=11&recv=10&lost=0&retrans=0&sent_bytes=4233&recv_bytes=4475&delivery_rate=610&cwnd=12000&unsent_bytes=0&cid=3f4450f08bf11f29&ts=104&x=1", cfExtPri, cfHdrFlush;dur=0
date
Sat, 02 Nov 2024 23:09:20 GMT
vary
Origin
priority
u=3,i
strict-transport-security
max-age=15552000
cache-control
private, no-cache, no-store, must-revalidate
location
https://fastly.picsum.photos/id/4/300/150.jpg?hmac=hYQXHRVyZuPs8bXmx2lhqyx9MkY1x775HBu62Ou5sFk
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
8dc7caaccc17dbe3-FRA
access-control-allow-origin
*
content-length
0
server
cloudflare
truncated
/ 		2 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/svg+xml
icon_light.f13cff3.png
cstaticdun.126.net//2.6.3/images/ 		11 KB
12 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cstaticdun.126.net//2.6.3/images/icon_light.f13cff3.png
Requested by
Host: login.burnettspecialists.org
URL: https://login.burnettspecialists.org/fGefkvRr
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
163.181.92.233 Frankfurt am Main, Germany, ASN24429 (TAOBAO Zhejiang Taobao Network Co.,Ltd, CN),
Reverse DNS
Software
Tengine /
Resource Hash
5dc5e0940d0c1e5a92461ca192fd6993bb7d492a04e125d36c7e793c20d1e401

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://login.burnettspecialists.org/

Response headers

Access-Control-Expose-Headers
*
Age
31377
Access-Control-Allow-Methods
GET,POST,OPTIONS,HEAD
Expires
Mon, 28 Oct 2024 14:13:16 GMT
X-Cache
HIT TCP_HIT dirn:12:193865734
Date
Sat, 02 Nov 2024 14:26:24 GMT
Content-Type
image/png
Last-Modified
Mon, 07 Nov 2022 05:53:30 GMT
Access-Control-Allow-Headers
*
Cache-Control
max-age=43200
Timing-Allow-Origin
*
X-Swift-CacheTime
43095
Connection
keep-alive
Via
cache23.l2nu20-8[66,66,304-0,H], cache31.l2nu20-8[68,0], cache26.l2hk3[0,0,304-0,H], cache17.l2hk3[1,0], ens-cache18.l2de3[192,205,304-0,H], ens-cache5.l2de3[207,0], ens-cache3.de5[0,0,200-0,H], ens-cache8.de5[4,0]
Ali-Swift-Global-Savetime
1730557584
X-Swift-SaveTime
Sat, 02 Nov 2024 14:28:09 GMT
Accept-Ranges
bytes
Access-Control-Allow-Origin
*
EagleId
a3b55c9c17305889619505675e
Content-Length
11413
Server
Tengine
favicon.ico
login.burnettspecialists.org/ 		0
158 B 		Other
General
Check archive.org
Download Go to
Full URL
https://login.burnettspecialists.org/favicon.ico
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
185.234.72.170 Frankfurt am Main, Germany, ASN213250 (ITP-SOLUTIONS, DE),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer
https://login.burnettspecialists.org/fGefkvRr

Response headers

Transfer-Encoding
chunked
Ppserver
PPV: 30 H: PH1PEPF00011FC1 V: 0
Date
Sat, 02 Nov 2024 23:09:21 GMT
Connection
close

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| _createClass function| _classCallCheck function| cleanMsg object| jigsaw

1 Cookies

Domain/Path Name / Value
.burnettspecialists.org/ Name: NrvV
Value: f6ee010f7e97b9e4297b8e532f1d4f53da0c6d50da914f1c896f4507307b7a69

1 Console Messages

Source Level URL
Text
network error URL: https://login.burnettspecialists.org/favicon.ico
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)