auth.waawire.com Open in urlscan Pro
38.114.120.28 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://auth.waawire.com/offer/L73Q7gr5Qc/
Submission: On December 02 via api (December 2nd 2024, 10:10:57 am UTC) from NL — Scanned from GB

Summary HTTP 9 Redirects Links 2 Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 9 HTTP transactions. The main IP is 38.114.120.28, located in London, United Kingdom and belongs to AS-GLOBALTELEHOST, US. The main domain is auth.waawire.com.
TLS certificate: Issued by R10 on November 25th 2024. Valid for: 3 months.

This is the only time auth.waawire.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Paxful (Crypto Exchange)

Domain & IP information

	IP Address		AS Autonomous System
9	38.114.120.28 38.114.120.28		63023 (AS-GLOBAL...) (AS-GLOBALTELEHOST)
9	1

9 38.114.120.28 (London, United Kingdom)

ASN63023 (AS-GLOBALTELEHOST, US)
PTR: lon112c.truehost.cloud

auth.waawire.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	waawire.com auth.waawire.com	161 KB
9	1

	Domain	Requested by
9	auth.waawire.com	auth.waawire.com
9	1

This site contains links to these domains. Also see Links.

Domain
accounts.paxful.com

Subject Issuer	Validity	Valid
www.auth.waawire.com R10	`2024-11-25` - `2025-02-23`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://auth.waawire.com/offer/L73Q7gr5Qc/
Frame ID: BBC39739580913A6E266C209F5381B9E
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Login

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

9
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

161 kB
Transfer

703 kB
Size

0
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://accounts.paxful.com/register
Title: Sign up

Search URL Search Domain Scan URL

URL: https://accounts.paxful.com/forgot-password
Title: Forgot password

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response auth.waawire.com/offer/L73Q7gr5Qc/	4 KB 1 KB	103ms 33ms	Document text/html	38.114.120.28 AS-GLOBALTELEHOST
General Check archive.org Show headers Download Go to Full URL https://auth.waawire.com/offer/L73Q7gr5Qc/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 38.114.120.28 London, United Kingdom, ASN63023 (AS-GLOBALTELEHOST, US), Reverse DNS lon112c.truehost.cloud Software / Resource Hash `9d63f3cd4943a707f0c006bc71f2312ef2e7d1e3fe84444adb0aaab3e8202883` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1 Response headers accept-ranges bytes alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" content-encoding br content-length 1147 content-type text/html date Mon, 02 Dec 2024 10:10:53 GMT last-modified Tue, 29 Oct 2024 15:18:46 GMT vary Accept-Encoding
GET H2	200	style.css auth.waawire.com/offer/L73Q7gr5Qc/files/styles/	3 KB 765 B	122ms 121ms	Stylesheet text/css	38.114.120.28 AS-GLOBALTELEHOST
General Check archive.org Show headers Download Go to Full URL https://auth.waawire.com/offer/L73Q7gr5Qc/files/styles/style.css Requested by Host: auth.waawire.com URL: https://auth.waawire.com/offer/L73Q7gr5Qc/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 38.114.120.28 London, United Kingdom, ASN63023 (AS-GLOBALTELEHOST, US), Reverse DNS lon112c.truehost.cloud Software / Resource Hash `86dbd5fbb12fd4ee19905fd34ac522647a906612f671c72c4b298a385f524e8f` Request headers User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1 Referer https://auth.waawire.com/offer/L73Q7gr5Qc/ Response headers cache-control public, max-age=604800 content-encoding br expires Mon, 09 Dec 2024 10:10:53 GMT accept-ranges bytes content-length 663 date Mon, 02 Dec 2024 10:10:53 GMT content-type text/css last-modified Thu, 24 Oct 2024 00:20:50 GMT vary Accept-Encoding
GET H2	200	fa.css auth.waawire.com/offer/L73Q7gr5Qc/files/styles/	500 KB 94 KB	122ms 122ms	Stylesheet text/css	38.114.120.28 AS-GLOBALTELEHOST
General Check archive.org Show headers Download Go to Full URL https://auth.waawire.com/offer/L73Q7gr5Qc/files/styles/fa.css Requested by Host: auth.waawire.com URL: https://auth.waawire.com/offer/L73Q7gr5Qc/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 38.114.120.28 London, United Kingdom, ASN63023 (AS-GLOBALTELEHOST, US), Reverse DNS lon112c.truehost.cloud Software / Resource Hash `f5a2ecb3648bc343267752613d1af3395c979107acd665783ebe6e2bd08cbd82` Request headers User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1 Referer https://auth.waawire.com/offer/L73Q7gr5Qc/ Response headers cache-control public, max-age=604800 content-encoding br expires Mon, 09 Dec 2024 10:10:53 GMT accept-ranges bytes content-length 96074 date Mon, 02 Dec 2024 10:10:53 GMT content-type text/css last-modified Tue, 14 May 2024 09:41:08 GMT vary Accept-Encoding
GET H2	200	logo.PNG auth.waawire.com/offer/L73Q7gr5Qc/files/image/	3 KB 3 KB	182ms 182ms	Image image/png	38.114.120.28 AS-GLOBALTELEHOST
General Check archive.org Show headers Download Go to Show image Full URL https://auth.waawire.com/offer/L73Q7gr5Qc/files/image/logo.PNG Requested by Host: auth.waawire.com URL: https://auth.waawire.com/offer/L73Q7gr5Qc/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 38.114.120.28 London, United Kingdom, ASN63023 (AS-GLOBALTELEHOST, US), Reverse DNS lon112c.truehost.cloud Software / Resource Hash `cd839c2dab86e5a4a527a3278f59d1396bacdf039f662ec777c67916d7750eeb` Request headers User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1 Referer https://auth.waawire.com/offer/L73Q7gr5Qc/ Response headers expires Mon, 09 Dec 2024 10:10:53 GMT accept-ranges bytes cache-control public, max-age=604800 content-length 2727 date Mon, 02 Dec 2024 10:10:53 GMT content-type image/png last-modified Tue, 15 Oct 2024 21:32:20 GMT
GET H2	200	rightlogo.PNG auth.waawire.com/offer/L73Q7gr5Qc/files/image/	20 KB 20 KB	181ms 181ms	Image image/png	38.114.120.28 AS-GLOBALTELEHOST
General Check archive.org Show headers Download Go to Show image Full URL https://auth.waawire.com/offer/L73Q7gr5Qc/files/image/rightlogo.PNG Requested by Host: auth.waawire.com URL: https://auth.waawire.com/offer/L73Q7gr5Qc/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 38.114.120.28 London, United Kingdom, ASN63023 (AS-GLOBALTELEHOST, US), Reverse DNS lon112c.truehost.cloud Software / Resource Hash `3280e554cfeca1db4749046636d7f5bd988d4d9380f2f6aedff8da073136405d` Request headers User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1 Referer https://auth.waawire.com/offer/L73Q7gr5Qc/ Response headers expires Mon, 09 Dec 2024 10:10:53 GMT accept-ranges bytes cache-control public, max-age=604800 content-length 20396 date Mon, 02 Dec 2024 10:10:53 GMT content-type image/png last-modified Tue, 15 Oct 2024 20:55:56 GMT
GET H2	200	jquery.js Show response auth.waawire.com/offer/L73Q7gr5Qc/files/script/	170 KB 39 KB	163ms 163ms	Script text/javascript	38.114.120.28 AS-GLOBALTELEHOST
General Check archive.org Show headers Download Go to Full URL https://auth.waawire.com/offer/L73Q7gr5Qc/files/script/jquery.js Requested by Host: auth.waawire.com URL: https://auth.waawire.com/offer/L73Q7gr5Qc/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 38.114.120.28 London, United Kingdom, ASN63023 (AS-GLOBALTELEHOST, US), Reverse DNS lon112c.truehost.cloud Software / Resource Hash `e1d72e1ae7d1a16e749710228bcb4f259d09b80492547a57b61ea1868f12530f` Request headers User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1 Referer https://auth.waawire.com/offer/L73Q7gr5Qc/ Response headers accept-ranges bytes content-encoding br content-length 39695 date Mon, 02 Dec 2024 10:10:53 GMT content-type text/javascript last-modified Tue, 10 Sep 2024 21:20:44 GMT vary Accept-Encoding
GET H2	404	fa-regular-400.woff2 auth.waawire.com/offer/L73Q7gr5Qc/files/webfonts/	0 0	45ms 44ms	Font text/html	38.114.120.28 AS-GLOBALTELEHOST
General Check archive.org Show headers Download Go to Full URL https://auth.waawire.com/offer/L73Q7gr5Qc/files/webfonts/fa-regular-400.woff2 Requested by Host: auth.waawire.com URL: https://auth.waawire.com/offer/L73Q7gr5Qc/files/styles/fa.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 38.114.120.28 London, United Kingdom, ASN63023 (AS-GLOBALTELEHOST, US), Reverse DNS lon112c.truehost.cloud Software / Resource Hash Request headers User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1 Origin https://auth.waawire.com Referer https://auth.waawire.com/offer/L73Q7gr5Qc/files/styles/fa.css Response headers cache-control private, no-cache, no-store, must-revalidate, max-age=0 content-length 796 pragma no-cache date Mon, 02 Dec 2024 10:10:53 GMT content-type text/html
GET H2	404	fa-regular-400.ttf auth.waawire.com/offer/L73Q7gr5Qc/files/webfonts/	0 0	31ms 31ms	Font text/html	38.114.120.28 AS-GLOBALTELEHOST
General Check archive.org Show headers Download Go to Full URL https://auth.waawire.com/offer/L73Q7gr5Qc/files/webfonts/fa-regular-400.ttf Requested by Host: auth.waawire.com URL: https://auth.waawire.com/offer/L73Q7gr5Qc/files/styles/fa.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 38.114.120.28 London, United Kingdom, ASN63023 (AS-GLOBALTELEHOST, US), Reverse DNS lon112c.truehost.cloud Software / Resource Hash Request headers User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1 Origin https://auth.waawire.com Referer https://auth.waawire.com/offer/L73Q7gr5Qc/files/styles/fa.css Response headers cache-control private, no-cache, no-store, must-revalidate, max-age=0 content-length 796 pragma no-cache date Mon, 02 Dec 2024 10:10:53 GMT content-type text/html
GET H2	200	favicon.ico auth.waawire.com/offer/L73Q7gr5Qc/files/image/	4 KB 4 KB	34ms 34ms	Other image/x-icon	38.114.120.28 AS-GLOBALTELEHOST
General Check archive.org Show headers Download Go to Full URL https://auth.waawire.com/offer/L73Q7gr5Qc/files/image/favicon.ico Protocol H2 Security TLS 1.3, , AES_128_GCM Server 38.114.120.28 London, United Kingdom, ASN63023 (AS-GLOBALTELEHOST, US), Reverse DNS lon112c.truehost.cloud Software / Resource Hash `bc4ac4be2e5c11d1fa585a688e6abe911f8e5bd2396e39215242e6ea02067545` Request headers User-Agent Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1 Referer https://auth.waawire.com/offer/L73Q7gr5Qc/ Response headers cache-control public, max-age=604800 content-encoding br expires Mon, 09 Dec 2024 10:10:53 GMT accept-ranges bytes content-length 3775 date Mon, 02 Dec 2024 10:10:53 GMT content-type image/x-icon last-modified Thu, 24 Oct 2024 13:07:44 GMT vary Accept-Encoding

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Paxful (Crypto Exchange)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	verbose	URL: https://auth.waawire.com/offer/L73Q7gr5Qc/ Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o
network	error	URL: https://auth.waawire.com/offer/L73Q7gr5Qc/files/webfonts/fa-regular-400.woff2 Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://auth.waawire.com/offer/L73Q7gr5Qc/files/webfonts/fa-regular-400.ttf Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

auth.waawire.com
38.114.120.28
3280e554cfeca1db4749046636d7f5bd988d4d9380f2f6aedff8da073136405d
86dbd5fbb12fd4ee19905fd34ac522647a906612f671c72c4b298a385f524e8f
9d63f3cd4943a707f0c006bc71f2312ef2e7d1e3fe84444adb0aaab3e8202883
bc4ac4be2e5c11d1fa585a688e6abe911f8e5bd2396e39215242e6ea02067545
cd839c2dab86e5a4a527a3278f59d1396bacdf039f662ec777c67916d7750eeb
e1d72e1ae7d1a16e749710228bcb4f259d09b80492547a57b61ea1868f12530f
f5a2ecb3648bc343267752613d1af3395c979107acd665783ebe6e2bd08cbd82

auth.waawire.com Open in urlscan Pro 38.114.120.28 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

9 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

161 kBTransfer

703 kBSize

0 Cookies

2 Outgoing links

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

0 Cookies

3 Console Messages

Indicators

auth.waawire.com Open in urlscan Pro
38.114.120.28 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

161 kB
Transfer

703 kB
Size

0
Cookies

9 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!