login.current-newsalerts.com Open in urlscan Pro
18.156.26.130  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request 3425a616-df29-48fe-932d-29a79179abe2 Show response login.current-newsalerts.com/dc67b9/	8 KB 3 KB	533ms 195ms	Document text/html	18.156.26.130 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://login.current-newsalerts.com/dc67b9/3425a616-df29-48fe-932d-29a79179abe2 Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 18.156.26.130 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-26-130.eu-central-1.compute.amazonaws.com Software Apache / Resource Hash 9583a81b67db7046fa7f5d09292af8f5ddad9dbb46524b3831bcaaa7913f4384 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 1; mode=block Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers access-control-allow-origin http://landing.phishme.co.uk cache-control no-store content-encoding gzip content-length 2691 content-type text/html; charset=utf-8 date Mon, 09 Dec 2024 06:28:48 GMT etag W/"9583a81b67db7046fa7f5d09292af8f5-gzip" expires Mon, 01 Jan 1990 00:00:00 GMT pragma no-cache referrer-policy strict-origin-when-cross-origin server Apache vary Accept-Encoding x-content-type-options nosniff x-download-options noopen x-frame-options DENY x-permitted-cross-domain-policies none x-request-id 7abd408d-130a-4c21-a48d-2823a0b8af78 x-runtime 0.027097 x-xss-protection 1; mode=block
GET H2	200	css fonts.googleapis.com/	11 KB 2 KB	17ms 6ms	Stylesheet text/css	172.217.194.95 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Open+Sans:300,400 Requested by Host: login.current-newsalerts.com URL: https://login.current-newsalerts.com/dc67b9/3425a616-df29-48fe-932d-29a79179abe2 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.217.194.95 , United States, ASN15169 (GOOGLE, US), Reverse DNS si-in-f95.1e100.net Software ESF / Resource Hash cb65047a753e2686044f6886b8ad1c7c1bbfc089be5575984a88ef5d58ba72d3 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://login.current-newsalerts.com/ Response headers content-encoding gzip x-content-type-options nosniff expires Mon, 09 Dec 2024 06:28:48 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Mon, 09 Dec 2024 06:28:48 GMT content-type text/css; charset=utf-8 vary Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site last-modified Mon, 09 Dec 2024 04:35:15 GMT x-frame-options SAMEORIGIN strict-transport-security max-age=31536000 link <https://fonts.gstatic.com>; rel=preconnect; crossorigin cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * cross-origin-opener-policy same-origin-allow-popups cross-origin-resource-policy cross-origin access-control-allow-origin * x-xss-protection 0 server ESF
GET H2	200	jquery-latest.min.js Show response login.current-newsalerts.com/system/content_files/uploads/5b8/ee7/1e-/original/	85 KB 30 KB	170ms 170ms	Script application/javascript	18.156.26.130 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://login.current-newsalerts.com/system/content_files/uploads/5b8/ee7/1e-/original/jquery-latest.min.js Requested by Host: login.current-newsalerts.com URL: https://login.current-newsalerts.com/dc67b9/3425a616-df29-48fe-932d-29a79179abe2 Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 18.156.26.130 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-26-130.eu-central-1.compute.amazonaws.com Software Apache / Resource Hash fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://login.current-newsalerts.com/dc67b9/3425a616-df29-48fe-932d-29a79179abe2 Response headers cache-control max-age=0 content-encoding gzip etag "155ed-617dd9a86ca00-gzip" x-download-options noopen expires Mon, 09 Dec 2024 06:28:48 GMT accept-ranges bytes access-control-allow-origin http://landing.phishme.co.uk content-length 30362 date Mon, 09 Dec 2024 06:28:48 GMT content-type application/javascript last-modified Tue, 07 May 2024 14:00:08 GMT server Apache vary Accept-Encoding
GET H2	200	bg-image-6798d20b.jpg images.pmeimg.co.uk/public/user_assets/27c79e69-4671-4c2a-9e51-90523a737760/	291 KB 292 KB	32ms 5ms	Image image/jpeg	13.225.4.34 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://images.pmeimg.co.uk/public/user_assets/27c79e69-4671-4c2a-9e51-90523a737760/bg-image-6798d20b.jpg Requested by Host: login.current-newsalerts.com URL: https://login.current-newsalerts.com/dc67b9/3425a616-df29-48fe-932d-29a79179abe2 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.225.4.34 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-225-4-34.sin52.r.cloudfront.net Software AmazonS3 / Resource Hash 62faab60433070e2ea52c235f0f18db228759f2a08bb6f9e5711630df8321214 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://login.current-newsalerts.com/ Response headers etag "f5a9a9531b8f4bcc86eabb19472d15d5" age 31156 via 1.1 81ed70dd2a5a6558bf4a599e654fd8e0.cloudfront.net (CloudFront) accept-ranges bytes x-cache Hit from cloudfront content-length 298105 x-amz-cf-id bYhamGtErDxZkKLuJzwD-TUlpk0xRAKFa_3_BHY7un48UMSt00LKxA== date Sun, 08 Dec 2024 21:49:33 GMT last-modified Tue, 14 Sep 2021 12:57:41 GMT x-amz-cf-pop SIN52-C2 server AmazonS3
GET H3	200	memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2 fonts.gstatic.com/s/opensans/v40/	47 KB 47 KB	16ms 3ms	Font font/woff2	172.217.194.94 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Open+Sans:300,400 Protocol H3 Security QUIC, , AES_128_GCM Server 172.217.194.94 , United States, ASN15169 (GOOGLE, US), Reverse DNS si-in-f94.1e100.net Software sffe / Resource Hash 3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Origin https://login.current-newsalerts.com Referer https://fonts.googleapis.com/ Response headers age 215808 report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} x-content-type-options nosniff expires Sat, 06 Dec 2025 18:32:00 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Fri, 06 Dec 2024 18:32:00 GMT last-modified Thu, 14 Dec 2023 02:08:40 GMT content-type font/woff2 cache-control public, max-age=31536000 timing-allow-origin * cross-origin-opener-policy same-origin; report-to="apps-themes" cross-origin-resource-policy cross-origin content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes accept-ranges bytes access-control-allow-origin * content-length 48236 x-xss-protection 0 server sffe
GET H2	404	favicon.ico login.current-newsalerts.com/	0 216 B	167ms 167ms	Other image/vnd.microsoft.icon	18.156.26.130 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://login.current-newsalerts.com/favicon.ico Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 18.156.26.130 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-156-26-130.eu-central-1.compute.amazonaws.com Software Apache / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://login.current-newsalerts.com/dc67b9/3425a616-df29-48fe-932d-29a79179abe2 Response headers x-request-id 63616e89-a5bb-41b2-9a88-1da10bff97b4 cache-control no-cache x-download-options noopen access-control-allow-origin http://landing.phishme.co.uk content-length 0 date Mon, 09 Dec 2024 06:28:48 GMT content-type image/vnd.microsoft.icon server Apache x-runtime 0.000327

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| username_handler function| password_handler function| $ function| jQuery function| showInput

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			login.current-newsalerts.com/	1969-12-31 23:59:59	Name: _phishme.com_session_id Value: b916ec3b16d043f05084c5514384ef12

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	verbose	URL: https://login.current-newsalerts.com/dc67b9/3425a616-df29-48fe-932d-29a79179abe2 Message: [DOM] Password field is not contained in a form: (More info: https://goo.gl/9p2vKq) %o
network	error	URL: https://login.current-newsalerts.com/favicon.ico Message: Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.googleapis.com
fonts.gstatic.com
images.pmeimg.co.uk
login.current-newsalerts.com
13.225.4.34
172.217.194.94
172.217.194.95
18.156.26.130
3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa
62faab60433070e2ea52c235f0f18db228759f2a08bb6f9e5711630df8321214
9583a81b67db7046fa7f5d09292af8f5ddad9dbb46524b3831bcaaa7913f4384
cb65047a753e2686044f6886b8ad1c7c1bbfc089be5575984a88ef5d58ba72d3
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a