auth.interface-annulation.net Open in urlscan Pro
172.187.216.170 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://auth.interface-annulation.net/
Submission: On November 22 via automatic, source certstream-suspicious (November 22nd 2024, 1:00:13 pm UTC) — Scanned from GB

Summary HTTP 14 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 4 countries across 4 domains to perform 14 HTTP transactions. The main IP is 172.187.216.170, located in London, United Kingdom and belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US. The main domain is auth.interface-annulation.net.
TLS certificate: Issued by R10 on November 22nd 2024. Valid for: 3 months.

This is the only time auth.interface-annulation.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Banque Postale (Banking)

Domain & IP information

	IP Address	AS Autonomous System
8	172.187.216.170 172.187.216.170	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	2a00:1450:400... 2a00:1450:4001:830::200a	15169 (GOOGLE) (GOOGLE)
1	104.17.25.14 104.17.25.14	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:811::200a	15169 (GOOGLE) (GOOGLE)
3	142.250.186.131 142.250.186.131	15169 (GOOGLE) (GOOGLE)
14	5

8 172.187.216.170 (London, United Kingdom)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

auth.interface-annulation.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:830::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.17.25.14 (None, )

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:811::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.186.131 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s07-in-f3.1e100.net

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	interface-annulation.net auth.interface-annulation.net	18 KB
3	gstatic.com fonts.gstatic.com	69 KB
2	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 415 fonts.googleapis.com — Cisco Umbrella Rank: 29	32 KB
1	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 225	4 KB
14	4

	Domain	Requested by
8	auth.interface-annulation.net	auth.interface-annulation.net
3	fonts.gstatic.com	fonts.googleapis.com
1	fonts.googleapis.com	auth.interface-annulation.net
1	cdnjs.cloudflare.com	auth.interface-annulation.net
1	ajax.googleapis.com	auth.interface-annulation.net
14	5

This site contains no links.

Subject Issuer	Validity	Valid
auth.interface-annulation.net R10	`2024-11-22` - `2025-02-20`	3 months	crt.sh
upload.video.google.com WR2	`2024-10-21` - `2025-01-13`	3 months	crt.sh
cdnjs.cloudflare.com WE1	`2024-09-28` - `2024-12-27`	3 months	crt.sh
*.gstatic.com WR2	`2024-10-21` - `2025-01-13`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://auth.interface-annulation.net/
Frame ID: 24D422EB3268449A0F9C09AB3250D23F
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Connexion à l'espace client

Detected technologies

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

14
Requests

100 %
HTTPS

40 %
IPv6

4
Domains

5
Subdomains

5
IPs

4
Countries

123 kB
Transfer

199 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
auth.interface-annulation.net/ 8 KB
3 KB 1573ms
35ms Document
text/html 172.187.216.170
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://auth.interface-annulation.net/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 172.187.216.170 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx / PHP/8.2.25 PleskLin
Resource Hash: aaca7d55e5bc33de4137582af95dbabf1c8d68ff8b0618349cd9045bd3f84b85

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
content-length: 2708
content-type: text/html; charset=UTF-8
date: Fri, 22 Nov 2024 13:00:09 GMT
server: nginx
vary: Accept-Encoding
x-powered-by: PHP/8.2.25 PleskLin

GET
H2 200 index.css
auth.interface-annulation.net/css/ 6 KB
2 KB 36ms
33ms Stylesheet
text/css 172.187.216.170
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://auth.interface-annulation.net/css/index.css
Requested by: Host: auth.interface-annulation.net
URL: https://auth.interface-annulation.net/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 172.187.216.170 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: db54b9716afa9d9c5bb698d24ff79219cefe9fb566a81636bba59bf177c81876

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://auth.interface-annulation.net/

Response headers

content-encoding: br
date: Fri, 22 Nov 2024 13:00:09 GMT
etag: W/"668efa2c-1713"
content-type: text/css
last-modified: Wed, 10 Jul 2024 21:16:28 GMT
server: nginx
x-powered-by: PleskLin

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.5.1/ 87 KB
31 KB 124ms
36ms Script
text/javascript 2a00:1450:4001:830::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js

Requested by

Host: auth.interface-annulation.net
URL: https://auth.interface-annulation.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://auth.interface-annulation.net/

Response headers

content-encoding: gzip
age: 325679
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
x-content-type-options: nosniff
expires: Tue, 18 Nov 2025 18:32:10 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Mon, 18 Nov 2024 18:32:10 GMT
last-modified: Fri, 08 May 2020 07:05:03 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
accept-ranges: bytes
access-control-allow-origin: *
content-length: 31021
x-xss-protection: 0
server: sffe

GET
H3 200 jquery.mask.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery.mask/1.14.16/ 8 KB
4 KB 144ms
115ms Script
application/javascript 104.17.25.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery.mask/1.14.16/jquery.mask.min.js

Requested by

Host: auth.interface-annulation.net
URL: https://auth.interface-annulation.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2a0db34dc14ef4b5ce73b230701c7561e5012667a4c9cb274ecab646e1474995

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://auth.interface-annulation.net/

Response headers

cf-cdnjs-via: cfworker/kv
content-encoding: br
cf-cache-status: HIT
etag: "5eb03ec3-2087"
age: 146946
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BP7D%2FgFAz1WPwwXqtGMu1fCIiSIpHClmU6JOj8idBlabF8asD3wKD5dp1YGtytIX7idBsBpda56FAzQ7hHGH3GAuo8K4ap%2FAVEhZX0ePYsYAq8RvTgbrUiQQMr6yky%2Fpy3RhT6NT"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Wed, 12 Nov 2025 13:00:09 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Fri, 22 Nov 2024 13:00:09 GMT
content-type: application/javascript; charset=utf-8
last-modified: Mon, 04 May 2020 16:11:47 GMT
vary: Accept-Encoding
priority: u=1,i=?0
strict-transport-security: max-age=15780000
cache-control: public, max-age=30672000
timing-allow-origin: *
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy: cross-origin
cf-ray: 8e6919cefd154887-LHR
accept-ranges: bytes
access-control-allow-origin: *
content-length: 3074
server: cloudflare

GET
H2 200 css2
fonts.googleapis.com/ 8 KB
1 KB 148ms
47ms Stylesheet
text/css 2a00:1450:4001:811::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Lato:ital,wght@0,100;0,300;0,400;0,700;0,900;1,100;1,300;1,400;1,700;1,900&display=swap

Requested by

Host: auth.interface-annulation.net
URL: https://auth.interface-annulation.net/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

6b78976e0a15138b3b1bde71abfa5bbb603eff6bdf1fc4d4eaffaeeaab0abc26

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://auth.interface-annulation.net/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Fri, 22 Nov 2024 13:00:09 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 22 Nov 2024 13:00:09 GMT
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified: Fri, 22 Nov 2024 12:12:14 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H2 200 logo.svg
auth.interface-annulation.net/images/ 3 KB
4 KB 35ms
33ms Image
image/svg+xml 172.187.216.170
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://auth.interface-annulation.net/images/logo.svg
Requested by: Host: auth.interface-annulation.net
URL: https://auth.interface-annulation.net/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 172.187.216.170 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: 739104b5349ad414323b0f821b747b55af29af684d47f6c6a189edb08b76b4e3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://auth.interface-annulation.net/

Response headers

etag: "668efa2c-dd1"
accept-ranges: bytes
content-length: 3537
date: Fri, 22 Nov 2024 13:00:09 GMT
content-type: image/svg+xml
last-modified: Wed, 10 Jul 2024 21:16:28 GMT
server: nginx
x-powered-by: PleskLin

GET
H2 200 A.png
auth.interface-annulation.net/images/ 2 KB
2 KB 35ms
34ms Image
image/png 172.187.216.170
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://auth.interface-annulation.net/images/A.png
Requested by: Host: auth.interface-annulation.net
URL: https://auth.interface-annulation.net/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 172.187.216.170 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: 9d81f93b41ea99060bee5f53282f416f3a10e2162e0c07d6429d067d271eb61c

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://auth.interface-annulation.net/

Response headers

etag: "668efa2c-640"
accept-ranges: bytes
content-length: 1600
date: Fri, 22 Nov 2024 13:00:09 GMT
content-type: image/png
last-modified: Wed, 10 Jul 2024 21:16:28 GMT
server: nginx
x-powered-by: PleskLin

GET
H2 200 B.png
auth.interface-annulation.net/images/ 2 KB
2 KB 35ms
35ms Image
image/png 172.187.216.170
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://auth.interface-annulation.net/images/B.png
Requested by: Host: auth.interface-annulation.net
URL: https://auth.interface-annulation.net/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 172.187.216.170 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: 91cdfc6e8f848ff5fe9ad0db745ebf613ef79665c72b1d8b2ef5f58e662ba6a5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://auth.interface-annulation.net/

Response headers

etag: "668efa2c-61d"
accept-ranges: bytes
content-length: 1565
date: Fri, 22 Nov 2024 13:00:09 GMT
content-type: image/png
last-modified: Wed, 10 Jul 2024 21:16:28 GMT
server: nginx
x-powered-by: PleskLin

GET
H2 200 hearth.png
auth.interface-annulation.net/images/ 2 KB
2 KB 36ms
35ms Image
image/png 172.187.216.170
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://auth.interface-annulation.net/images/hearth.png
Requested by: Host: auth.interface-annulation.net
URL: https://auth.interface-annulation.net/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 172.187.216.170 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: cca7923f635038ecadf2498fafae6642a3138b99d1b12917f68af89be9e2448d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://auth.interface-annulation.net/

Response headers

etag: "668efa2c-6fd"
accept-ranges: bytes
content-length: 1789
date: Fri, 22 Nov 2024 13:00:09 GMT
content-type: image/png
last-modified: Wed, 10 Jul 2024 21:16:28 GMT
server: nginx
x-powered-by: PleskLin

GET
H2 200 ask.png
auth.interface-annulation.net/images/ 868 B
1 KB 46ms
45ms Image
image/png 172.187.216.170
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://auth.interface-annulation.net/images/ask.png
Requested by: Host: auth.interface-annulation.net
URL: https://auth.interface-annulation.net/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 172.187.216.170 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: fa5e0e4d163dd8ab8f90ef9da86ea2bbefcf53e5ef4549f60a6e3207ab259f83

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://auth.interface-annulation.net/

Response headers

etag: "364-61ceb28d1e300"
x-accel-version: 0.01
accept-ranges: bytes
content-length: 868
date: Fri, 22 Nov 2024 13:00:09 GMT
content-type: image/png
last-modified: Wed, 10 Jul 2024 21:16:28 GMT
server: nginx
x-powered-by: PleskLin

GET
H3 200 S6u9w4BMUTPHh6UVSwiPGQ.woff2
fonts.gstatic.com/s/lato/v24/ 23 KB
23 KB 111ms
63ms Font
font/woff2 142.250.186.131
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v24/S6u9w4BMUTPHh6UVSwiPGQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Lato:ital,wght@0,100;0,300;0,400;0,700;0,900;1,100;1,300;1,400;1,700;1,900&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.131 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f3.1e100.net

Software

sffe /

Resource Hash

c447dd7677b419db7b21dbdfc6277c7816a913ffda76fd2e52702df538de0e49

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://auth.interface-annulation.net
Referer: https://fonts.googleapis.com/

Response headers

age: 166837
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Thu, 20 Nov 2025 14:39:32 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 20 Nov 2024 14:39:32 GMT
last-modified: Tue, 02 May 2023 15:07:25 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 23040
x-xss-protection: 0
server: sffe

GET
H3 200 S6uyw4BMUTPHjx4wXg.woff2
fonts.gstatic.com/s/lato/v24/ 23 KB
23 KB 80ms
34ms Font
font/woff2 142.250.186.131
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v24/S6uyw4BMUTPHjx4wXg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Lato:ital,wght@0,100;0,300;0,400;0,700;0,900;1,100;1,300;1,400;1,700;1,900&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.131 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f3.1e100.net

Software

sffe /

Resource Hash

918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://auth.interface-annulation.net
Referer: https://fonts.googleapis.com/

Response headers

age: 164155
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Thu, 20 Nov 2025 15:24:14 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 20 Nov 2024 15:24:14 GMT
last-modified: Tue, 02 May 2023 15:17:22 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 23580
x-xss-protection: 0
server: sffe

GET
H3 200 S6u8w4BMUTPHjxsAXC-q.woff2
fonts.gstatic.com/s/lato/v24/ 24 KB
24 KB 95ms
49ms Font
font/woff2 142.250.186.131
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v24/S6u8w4BMUTPHjxsAXC-q.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Lato:ital,wght@0,100;0,300;0,400;0,700;0,900;1,100;1,300;1,400;1,700;1,900&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.131 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f3.1e100.net

Software

sffe /

Resource Hash

bca1d88ada544d9c80872d4da27133fab6d347361fa26e932b47ec9559088fd0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://auth.interface-annulation.net
Referer: https://fonts.googleapis.com/

Response headers

age: 164404
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Thu, 20 Nov 2025 15:20:05 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 20 Nov 2024 15:20:05 GMT
last-modified: Tue, 02 May 2023 15:14:26 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 24408
x-xss-protection: 0
server: sffe

GET
H2 200 logo.png
auth.interface-annulation.net/images/ 3 KB
4 KB 33ms
32ms Other
image/png 172.187.216.170
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://auth.interface-annulation.net/images/logo.png
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 172.187.216.170 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: 739104b5349ad414323b0f821b747b55af29af684d47f6c6a189edb08b76b4e3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://auth.interface-annulation.net/

Response headers

etag: "668efa2c-dd1"
accept-ranges: bytes
content-length: 3537
date: Fri, 22 Nov 2024 13:00:09 GMT
content-type: image/png
last-modified: Wed, 10 Jul 2024 21:16:28 GMT
server: nginx
x-powered-by: PleskLin

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Banque Postale (Banking)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	verbose	URL: https://auth.interface-annulation.net/ Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
auth.interface-annulation.net
cdnjs.cloudflare.com
fonts.googleapis.com
fonts.gstatic.com
104.17.25.14
142.250.186.131
172.187.216.170
2a00:1450:4001:811::200a
2a00:1450:4001:830::200a
2a0db34dc14ef4b5ce73b230701c7561e5012667a4c9cb274ecab646e1474995
6b78976e0a15138b3b1bde71abfa5bbb603eff6bdf1fc4d4eaffaeeaab0abc26
739104b5349ad414323b0f821b747b55af29af684d47f6c6a189edb08b76b4e3
918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537
91cdfc6e8f848ff5fe9ad0db745ebf613ef79665c72b1d8b2ef5f58e662ba6a5
9d81f93b41ea99060bee5f53282f416f3a10e2162e0c07d6429d067d271eb61c
aaca7d55e5bc33de4137582af95dbabf1c8d68ff8b0618349cd9045bd3f84b85
bca1d88ada544d9c80872d4da27133fab6d347361fa26e932b47ec9559088fd0
c447dd7677b419db7b21dbdfc6277c7816a913ffda76fd2e52702df538de0e49
cca7923f635038ecadf2498fafae6642a3138b99d1b12917f68af89be9e2448d
db54b9716afa9d9c5bb698d24ff79219cefe9fb566a81636bba59bf177c81876
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
fa5e0e4d163dd8ab8f90ef9da86ea2bbefcf53e5ef4549f60a6e3207ab259f83

auth.interface-annulation.net Open in urlscan Pro 172.187.216.170 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

14 Requests

100 %HTTPS

40 %IPv6

4 Domains

5 Subdomains

5 IPs

4 Countries

123 kBTransfer

199 kBSize

0 Cookies

0 Outgoing links

Redirected requests

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

7 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

auth.interface-annulation.net Open in urlscan Pro
172.187.216.170 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

14
Requests

100 %
HTTPS

40 %
IPv6

4
Domains

5
Subdomains

5
IPs

4
Countries

123 kB
Transfer

199 kB
Size

0
Cookies

14 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!