auth.com-web.net Open in urlscan Pro
52.28.160.134 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://auth.com-web.net/?code=73d96804dcb25682d123b9419a2980dc
Submission: On October 11 via api (October 11th 2024, 2:12:01 pm UTC) from NL — Scanned from NL

Summary HTTP 15 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 1 countries across 2 domains to perform 15 HTTP transactions. The main IP is 52.28.160.134, located in Frankfurt am Main, Germany and belongs to AMAZON-02, US. The main domain is auth.com-web.net.
TLS certificate: Issued by Amazon RSA 2048 M02 on January 30th 2024. Valid for: a year.

This is the only time auth.com-web.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Google (Online)

Domain & IP information

	IP Address	AS Autonomous System
11	52.28.160.134 52.28.160.134	16509 (AMAZON-02) (AMAZON-02)
3	52.28.27.33 52.28.27.33	16509 (AMAZON-02) (AMAZON-02)
1	3.124.147.10 3.124.147.10	16509 (AMAZON-02) (AMAZON-02)
15	3

11 52.28.160.134 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-28-160-134.eu-central-1.compute.amazonaws.com

auth.com-web.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 52.28.27.33 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-28-27-33.eu-central-1.compute.amazonaws.com

api.sosafe.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.124.147.10 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-124-147-10.eu-central-1.compute.amazonaws.com

sentry.sosafe.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	com-web.net auth.com-web.net	611 KB
4	sosafe.de api.sosafe.de — Cisco Umbrella Rank: 293631 sentry.sosafe.de — Cisco Umbrella Rank: 400754	29 KB
15	2

	Domain	Requested by
11	auth.com-web.net	auth.com-web.net
3	api.sosafe.de	auth.com-web.net
1	sentry.sosafe.de	auth.com-web.net
15	3

This site contains no links.

Subject Issuer	Validity	Valid
no-repiy.com Amazon RSA 2048 M02	`2024-01-30` - `2025-02-28`	a year	crt.sh
*.sosafe.de Amazon RSA 2048 M03	`2024-02-25` - `2025-03-26`	a year	crt.sh
sentry.sosafe.de Amazon RSA 2048 M03	`2024-04-10` - `2025-05-09`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://auth.com-web.net/?code=73d96804dcb25682d123b9419a2980dc
Frame ID: 817A4609D7ACAB8EEAA44B76EDD0356D
Requests: 15 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Sign in to your account

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

15
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

3
Subdomains

3
IPs

1
Countries

640 kB
Transfer

636 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

15 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
auth.com-web.net/ 8 KB
8 KB 208ms
51ms Document
text/html 52.28.160.134
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.com-web.net/?code=73d96804dcb25682d123b9419a2980dc

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.28.160.134 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-28-160-134.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

fb9dff5a7a8fb8e687e72175650c383ddb139238fc26dec9fef6ced165a8e94a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
content-length: 7788
content-type: text/html
date: Fri, 11 Oct 2024 14:11:56 GMT
etag: "6671610f-1e6c"
last-modified: Tue, 18 Jun 2024 10:27:27 GMT
referrer-policy: strict-origin
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff

GET
H2 200 bootstrap.min.css
auth.com-web.net/assets/bootstrap/css/ 138 KB
138 KB 58ms
56ms Stylesheet
text/css 52.28.160.134
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.com-web.net/assets/bootstrap/css/bootstrap.min.css?ver=1718706431906

Requested by

Host: auth.com-web.net
URL: https://auth.com-web.net/?code=73d96804dcb25682d123b9419a2980dc

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.28.160.134 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-28-160-134.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

46b4721c80749cc5e1ec6cf4c5fec78a2c51fdfc4ee9c94f2223cdaf4fbd8ced

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://auth.com-web.net/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
etag: "667160ff-22646"
x-content-type-options: nosniff
referrer-policy: strict-origin
accept-ranges: bytes
content-length: 140870
date: Fri, 11 Oct 2024 14:11:56 GMT
content-type: text/css
last-modified: Tue, 18 Jun 2024 10:27:11 GMT
server: nginx

GET
H2 200 fontawesome-all.min.css
auth.com-web.net/assets/fonts/ 40 KB
40 KB 167ms
166ms Stylesheet
text/css 52.28.160.134
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.com-web.net/assets/fonts/fontawesome-all.min.css?ver=1718706431906

Requested by

Host: auth.com-web.net
URL: https://auth.com-web.net/?code=73d96804dcb25682d123b9419a2980dc

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.28.160.134 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-28-160-134.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

fd702d8d6882cc47c74308ec46b1476035492c3d887741b279bb830c49b9b2bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://auth.com-web.net/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
etag: "667160ff-a033"
x-content-type-options: nosniff
referrer-policy: strict-origin
accept-ranges: bytes
content-length: 41011
date: Fri, 11 Oct 2024 14:11:56 GMT
content-type: text/css
last-modified: Tue, 18 Jun 2024 10:27:11 GMT
server: nginx

GET
H2 200 material-icons.min.css
auth.com-web.net/assets/fonts/ 671 B
909 B 57ms
55ms Stylesheet
text/css 52.28.160.134
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.com-web.net/assets/fonts/material-icons.min.css?ver=1718706431906

Requested by

Host: auth.com-web.net
URL: https://auth.com-web.net/?code=73d96804dcb25682d123b9419a2980dc

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.28.160.134 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-28-160-134.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

e8e23ea893b24b7b7cfef869d747e400f8f9b0f8c5580a59ce729665daec03fc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://auth.com-web.net/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
etag: "667160ff-29f"
x-content-type-options: nosniff
referrer-policy: strict-origin
accept-ranges: bytes
content-length: 671
date: Fri, 11 Oct 2024 14:11:56 GMT
content-type: text/css
last-modified: Tue, 18 Jun 2024 10:27:11 GMT
server: nginx

GET
H2 200 typicons.min.css
auth.com-web.net/assets/fonts/ 15 KB
15 KB 166ms
165ms Stylesheet
text/css 52.28.160.134
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.com-web.net/assets/fonts/typicons.min.css?ver=1718706431906

Requested by

Host: auth.com-web.net
URL: https://auth.com-web.net/?code=73d96804dcb25682d123b9419a2980dc

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.28.160.134 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-28-160-134.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

8660ed12799916f277ccbb1fa1ba74dc2483dffa91089998ddfed5a9feb32200

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://auth.com-web.net/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
etag: "667160ff-3a89"
x-content-type-options: nosniff
referrer-policy: strict-origin
accept-ranges: bytes
content-length: 14985
date: Fri, 11 Oct 2024 14:11:56 GMT
content-type: text/css
last-modified: Tue, 18 Jun 2024 10:27:11 GMT
server: nginx

GET
H2 200 styles.css
auth.com-web.net/assets/css/ 3 KB
4 KB 167ms
166ms Stylesheet
text/css 52.28.160.134
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.com-web.net/assets/css/styles.css?ver=1718706431906

Requested by

Host: auth.com-web.net
URL: https://auth.com-web.net/?code=73d96804dcb25682d123b9419a2980dc

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.28.160.134 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-28-160-134.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

94f3e8424046d560d0aada125cab7d5dab2046c61f074387637d563b49020d5a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://auth.com-web.net/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
etag: "667160ff-dd7"
x-content-type-options: nosniff
referrer-policy: strict-origin
accept-ranges: bytes
content-length: 3543
date: Fri, 11 Oct 2024 14:11:56 GMT
content-type: text/css
last-modified: Tue, 18 Jun 2024 10:27:11 GMT
server: nginx

GET
H2 200 version.js Show response
auth.com-web.net/assets/js/ 80 B
326 B 167ms
166ms Script
application/javascript 52.28.160.134
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.com-web.net/assets/js/version.js?ver=1718706431906

Requested by

Host: auth.com-web.net
URL: https://auth.com-web.net/?code=73d96804dcb25682d123b9419a2980dc

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.28.160.134 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-28-160-134.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

ca5f74dac1a1b2794db43e57147ab60a7ee4a1f59bd544550b5f471ef64043c4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://auth.com-web.net/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
etag: "667160ff-50"
x-content-type-options: nosniff
referrer-policy: strict-origin
accept-ranges: bytes
content-length: 80
date: Fri, 11 Oct 2024 14:11:56 GMT
content-type: application/javascript
last-modified: Tue, 18 Jun 2024 10:27:11 GMT
server: nginx

GET
H2 200 jquery.min.js Show response
auth.com-web.net/assets/js/ 87 KB
88 KB 167ms
167ms Script
application/javascript 52.28.160.134
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.com-web.net/assets/js/jquery.min.js

Requested by

Host: auth.com-web.net
URL: https://auth.com-web.net/?code=73d96804dcb25682d123b9419a2980dc

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.28.160.134 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-28-160-134.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://auth.com-web.net/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
etag: "667160ff-15d9d"
x-content-type-options: nosniff
referrer-policy: strict-origin
accept-ranges: bytes
content-length: 89501
date: Fri, 11 Oct 2024 14:11:56 GMT
content-type: application/javascript
last-modified: Tue, 18 Jun 2024 10:27:11 GMT
server: nginx

GET
H2 200 bundle.min.js Show response
auth.com-web.net/assets/js/ 315 KB
315 KB 166ms
166ms Script
application/javascript 52.28.160.134
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.com-web.net/assets/js/bundle.min.js?ver=1718706431906

Requested by

Host: auth.com-web.net
URL: https://auth.com-web.net/?code=73d96804dcb25682d123b9419a2980dc

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.28.160.134 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-28-160-134.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

653283eafebacb2b4c4f9917a6eed3bda5f1f74b7158d643fa9222bdfb9fd38a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://auth.com-web.net/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
etag: "667160ff-4eb2d"
x-content-type-options: nosniff
referrer-policy: strict-origin
accept-ranges: bytes
content-length: 322349
date: Fri, 11 Oct 2024 14:11:56 GMT
content-type: application/javascript
last-modified: Tue, 18 Jun 2024 10:27:11 GMT
server: nginx

GET
H2 200 inputs.css
auth.com-web.net/assets/css/ 2 KB
2 KB 103ms
103ms Stylesheet
text/css 52.28.160.134
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.com-web.net/assets/css/inputs.css

Requested by

Host: auth.com-web.net
URL: https://auth.com-web.net/assets/css/styles.css?ver=1718706431906

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.28.160.134 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-28-160-134.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

cebea43a98719e150b12c298fe1a570ec50f6286787174bdd314354ca3077484

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://auth.com-web.net/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
etag: "667160ff-72a"
x-content-type-options: nosniff
referrer-policy: strict-origin
accept-ranges: bytes
content-length: 1834
date: Fri, 11 Oct 2024 14:11:56 GMT
content-type: text/css
last-modified: Tue, 18 Jun 2024 10:27:11 GMT
server: nginx

GET
H2 200 ip Show response
api.sosafe.de/v1/user/ 77 B
463 B 241ms
82ms XHR
application/json 52.28.27.33
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.sosafe.de/v1/user/ip

Requested by

Host: auth.com-web.net
URL: https://auth.com-web.net/assets/js/bundle.min.js?ver=1718706431906

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.28.27.33 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-28-27-33.eu-central-1.compute.amazonaws.com

Software

Resource Hash

386f6f8e7893f89ae1d55afeb6cef88827460dc49c018ccbcee00a6780576580

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://auth.com-web.net/

Response headers

strict-transport-security: max-age=15552000; includeSubDomains
x-dns-prefetch-control: off
etag: W/"4d-7UfKP2UK5Rf2n/gwMiShxO4AXQE"
expect-ct: max-age=0
x-permitted-cross-domain-policies: none
access-control-allow-credentials: true
x-content-type-options: nosniff
x-download-options: noopen
referrer-policy: no-referrer
access-control-allow-origin: *
content-length: 77
date: Fri, 11 Oct 2024 14:11:57 GMT
x-xss-protection: 0
content-type: application/json; charset=utf-8
x-frame-options: SAMEORIGIN

GET
H2 204 favicon.ico
auth.com-web.net/ 0
139 B 75ms
74ms Other
text/plain 52.28.160.134
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.com-web.net/favicon.ico

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.28.160.134 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-28-160-134.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://auth.com-web.net/

Response headers

referrer-policy: strict-origin
strict-transport-security: max-age=31536000; includeSubDomains
date: Fri, 11 Oct 2024 14:11:57 GMT
server: nginx
x-content-type-options: nosniff

POST
H2 200 / Show response
sentry.sosafe.de/api/25/envelope/ 2 B
193 B 250ms
66ms Fetch
application/json 3.124.147.10
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sentry.sosafe.de/api/25/envelope/?sentry_key=f4fcbdbd596c4b2cb672b939a7ee93c6&sentry_version=7
Requested by: Host: auth.com-web.net
URL: https://auth.com-web.net/assets/js/bundle.min.js?ver=1718706431906
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.124.147.10 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-147-10.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://auth.com-web.net/

Response headers

access-control-allow-origin: https://auth.com-web.net
access-control-expose-headers: x-sentry-rate-limits, retry-after, x-sentry-error
content-length: 2
date: Fri, 11 Oct 2024 14:11:57 GMT
content-type: application/json
vary: Origin
server: nginx

GET
H2 200 info Show response
api.sosafe.de/v1/report/ 770 B
1 KB 94ms
93ms XHR
application/json 52.28.27.33
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.sosafe.de/v1/report/info?code=73d96804dcb25682d123b9419a2980dc

Requested by

Host: auth.com-web.net
URL: https://auth.com-web.net/assets/js/bundle.min.js?ver=1718706431906

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.28.27.33 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-28-27-33.eu-central-1.compute.amazonaws.com

Software

Resource Hash

00a18b711398d284d888c2e9f8f731b87f35843e41b44ef49d70c5006ccf4d3b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://auth.com-web.net/

Response headers

strict-transport-security: max-age=15552000; includeSubDomains
x-dns-prefetch-control: off
etag: W/"302-qspw/9nMubjI3kkdi2Fy/8sk66U"
expect-ct: max-age=0
x-permitted-cross-domain-policies: none
access-control-allow-credentials: true
x-content-type-options: nosniff
x-download-options: noopen
referrer-policy: no-referrer
access-control-allow-origin: *
content-length: 770
date: Fri, 11 Oct 2024 14:11:57 GMT
x-xss-protection: 0
content-type: application/json; charset=utf-8
x-frame-options: SAMEORIGIN

GET
H2 200 report Show response
api.sosafe.de/v1/ 27 KB
27 KB 234ms
234ms XHR
application/json 52.28.27.33
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.sosafe.de/v1/report?code=73d96804dcb25682d123b9419a2980dc&type=2

Requested by

Host: auth.com-web.net
URL: https://auth.com-web.net/assets/js/bundle.min.js?ver=1718706431906

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.28.27.33 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-28-27-33.eu-central-1.compute.amazonaws.com

Software

Resource Hash

4ef28ac80ad227e3cfdb4917cfa8a8924bb132a5f539863c7a35b28074cdd117

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://auth.com-web.net/

Response headers

strict-transport-security: max-age=15552000; includeSubDomains
x-dns-prefetch-control: off
etag: W/"6b8c-UNvH9j6NfNDewVQsypqmKQXGDvk"
expect-ct: max-age=0
x-permitted-cross-domain-policies: none
access-control-allow-credentials: true
x-content-type-options: nosniff
x-download-options: noopen
referrer-policy: no-referrer
access-control-allow-origin: *
content-length: 27532
date: Fri, 11 Oct 2024 14:11:57 GMT
x-xss-protection: 0
content-type: application/json; charset=utf-8
x-frame-options: SAMEORIGIN

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Google (Online)

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	verbose	URL: https://auth.com-web.net/?code=73d96804dcb25682d123b9419a2980dc Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api.sosafe.de
auth.com-web.net
sentry.sosafe.de
3.124.147.10
52.28.160.134
52.28.27.33
00a18b711398d284d888c2e9f8f731b87f35843e41b44ef49d70c5006ccf4d3b
386f6f8e7893f89ae1d55afeb6cef88827460dc49c018ccbcee00a6780576580
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
46b4721c80749cc5e1ec6cf4c5fec78a2c51fdfc4ee9c94f2223cdaf4fbd8ced
4ef28ac80ad227e3cfdb4917cfa8a8924bb132a5f539863c7a35b28074cdd117
653283eafebacb2b4c4f9917a6eed3bda5f1f74b7158d643fa9222bdfb9fd38a
8660ed12799916f277ccbb1fa1ba74dc2483dffa91089998ddfed5a9feb32200
94f3e8424046d560d0aada125cab7d5dab2046c61f074387637d563b49020d5a
ca5f74dac1a1b2794db43e57147ab60a7ee4a1f59bd544550b5f471ef64043c4
cebea43a98719e150b12c298fe1a570ec50f6286787174bdd314354ca3077484
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e8e23ea893b24b7b7cfef869d747e400f8f9b0f8c5580a59ce729665daec03fc
fb9dff5a7a8fb8e687e72175650c383ddb139238fc26dec9fef6ced165a8e94a
fd702d8d6882cc47c74308ec46b1476035492c3d887741b279bb830c49b9b2bf
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

auth.com-web.net Open in urlscan Pro 52.28.160.134 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

15 Requests

100 %HTTPS

0 %IPv6

2 Domains

3 Subdomains

3 IPs

1 Countries

640 kBTransfer

636 kBSize

0 Cookies

0 Outgoing links

Redirected requests

15 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

13 JavaScript Global Variables

0 Cookies

1 Console Messages

Security Headers

Indicators

auth.com-web.net Open in urlscan Pro
52.28.160.134 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

15
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

3
Subdomains

3
IPs

1
Countries

640 kB
Transfer

636 kB
Size

0
Cookies

15 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!