auth.com-web.net Open in urlscan Pro
54.93.208.83 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://auth.com-web.net/de?code=6fcb8339def7c025755f8520fccd1c67
Effective URL:
https://auth.com-web.net/de?code=6fcb8339def7c025755f8520fccd1c67
Submission: On August 25 via api (August 25th 2024, 4:05:42 am UTC) from US — Scanned from IT

Summary HTTP 15 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 1 countries across 2 domains to perform 15 HTTP transactions. The main IP is 54.93.208.83, located in Frankfurt am Main, Germany and belongs to AMAZON-02, US. The main domain is auth.com-web.net.
TLS certificate: Issued by Amazon RSA 2048 M02 on January 30th 2024. Valid for: a year.

This is the only time auth.com-web.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Google (Online)

Domain & IP information

	IP Address	AS Autonomous System
11	54.93.208.83 54.93.208.83	16509 (AMAZON-02) (AMAZON-02)
3	52.28.130.210 52.28.130.210	16509 (AMAZON-02) (AMAZON-02)
1	18.158.76.44 18.158.76.44	16509 (AMAZON-02) (AMAZON-02)
15	3

11 54.93.208.83 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-93-208-83.eu-central-1.compute.amazonaws.com

auth.com-web.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 52.28.130.210 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-28-130-210.eu-central-1.compute.amazonaws.com

api.sosafe.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.158.76.44 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-158-76-44.eu-central-1.compute.amazonaws.com

sentry.sosafe.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	com-web.net auth.com-web.net	611 KB
4	sosafe.de api.sosafe.de sentry.sosafe.de	22 KB
15	2

	Domain	Requested by
11	auth.com-web.net	auth.com-web.net
3	api.sosafe.de	auth.com-web.net
1	sentry.sosafe.de	auth.com-web.net
15	3

This site contains no links.

Subject Issuer	Validity	Valid
no-repiy.com Amazon RSA 2048 M02	`2024-01-30` - `2025-02-28`	a year	crt.sh
*.sosafe.de Amazon RSA 2048 M03	`2024-02-25` - `2025-03-26`	a year	crt.sh
sentry.sosafe.de Amazon RSA 2048 M03	`2024-04-10` - `2025-05-09`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://auth.com-web.net/de?code=6fcb8339def7c025755f8520fccd1c67
Frame ID: 6C59BF792D55ECDC0B0BD2EB5FC49566
Requests: 15 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Bei Ihrem Konto anmelden

Page URL History Show full URLs

http://auth.com-web.net/de?code=6fcb8339def7c025755f8520fccd1c67 HTTP 307
https://auth.com-web.net/de?code=6fcb8339def7c025755f8520fccd1c67 Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

15
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

3
Subdomains

3
IPs

1
Countries

633 kB
Transfer

628 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://auth.com-web.net/de?code=6fcb8339def7c025755f8520fccd1c67 HTTP 307
https://auth.com-web.net/de?code=6fcb8339def7c025755f8520fccd1c67 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

15 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request de Show response
auth.com-web.net/
Redirect Chain

http://auth.com-web.net/de?code=6fcb8339def7c025755f8520fccd1c67
https://auth.com-web.net/de?code=6fcb8339def7c025755f8520fccd1c67

8 KB
8 KB

231ms
60ms

Document
text/html

54.93.208.83
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.com-web.net/de?code=6fcb8339def7c025755f8520fccd1c67

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.93.208.83 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-93-208-83.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

fb9dff5a7a8fb8e687e72175650c383ddb139238fc26dec9fef6ced165a8e94a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
content-length: 7788
content-type: text/html
date: Sun, 25 Aug 2024 04:05:36 GMT
etag: "6671610f-1e6c"
last-modified: Tue, 18 Jun 2024 10:27:27 GMT
referrer-policy: strict-origin
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff

Redirect headers

Location: https://auth.com-web.net/de?code=6fcb8339def7c025755f8520fccd1c67
Non-Authoritative-Reason: HttpsUpgrades

GET
H2 200 bootstrap.min.css
auth.com-web.net/assets/bootstrap/css/ 138 KB
138 KB 90ms
88ms Stylesheet
text/css 54.93.208.83
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.com-web.net/assets/bootstrap/css/bootstrap.min.css?ver=1718706431906

Requested by

Host: auth.com-web.net
URL: https://auth.com-web.net/de?code=6fcb8339def7c025755f8520fccd1c67

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.93.208.83 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-93-208-83.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

46b4721c80749cc5e1ec6cf4c5fec78a2c51fdfc4ee9c94f2223cdaf4fbd8ced

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://auth.com-web.net/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 25 Aug 2024 04:05:36 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
referrer-policy: strict-origin
last-modified: Tue, 18 Jun 2024 10:27:11 GMT
server: nginx
etag: "667160ff-22646"
content-type: text/css
accept-ranges: bytes
content-length: 140870

GET
H2 200 fontawesome-all.min.css
auth.com-web.net/assets/fonts/ 40 KB
40 KB 89ms
87ms Stylesheet
text/css 54.93.208.83
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.com-web.net/assets/fonts/fontawesome-all.min.css?ver=1718706431906

Requested by

Host: auth.com-web.net
URL: https://auth.com-web.net/de?code=6fcb8339def7c025755f8520fccd1c67

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.93.208.83 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-93-208-83.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

fd702d8d6882cc47c74308ec46b1476035492c3d887741b279bb830c49b9b2bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://auth.com-web.net/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 25 Aug 2024 04:05:36 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
referrer-policy: strict-origin
last-modified: Tue, 18 Jun 2024 10:27:11 GMT
server: nginx
etag: "667160ff-a033"
content-type: text/css
accept-ranges: bytes
content-length: 41011

GET
H2 200 material-icons.min.css
auth.com-web.net/assets/fonts/ 671 B
909 B 41ms
39ms Stylesheet
text/css 54.93.208.83
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.com-web.net/assets/fonts/material-icons.min.css?ver=1718706431906

Requested by

Host: auth.com-web.net
URL: https://auth.com-web.net/de?code=6fcb8339def7c025755f8520fccd1c67

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.93.208.83 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-93-208-83.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

e8e23ea893b24b7b7cfef869d747e400f8f9b0f8c5580a59ce729665daec03fc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://auth.com-web.net/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 25 Aug 2024 04:05:36 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
referrer-policy: strict-origin
last-modified: Tue, 18 Jun 2024 10:27:11 GMT
server: nginx
etag: "667160ff-29f"
content-type: text/css
accept-ranges: bytes
content-length: 671

GET
H2 200 typicons.min.css
auth.com-web.net/assets/fonts/ 15 KB
15 KB 51ms
50ms Stylesheet
text/css 54.93.208.83
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.com-web.net/assets/fonts/typicons.min.css?ver=1718706431906

Requested by

Host: auth.com-web.net
URL: https://auth.com-web.net/de?code=6fcb8339def7c025755f8520fccd1c67

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.93.208.83 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-93-208-83.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

8660ed12799916f277ccbb1fa1ba74dc2483dffa91089998ddfed5a9feb32200

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://auth.com-web.net/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 25 Aug 2024 04:05:36 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
referrer-policy: strict-origin
last-modified: Tue, 18 Jun 2024 10:27:11 GMT
server: nginx
etag: "667160ff-3a89"
content-type: text/css
accept-ranges: bytes
content-length: 14985

GET
H2 200 styles.css
auth.com-web.net/assets/css/ 3 KB
4 KB 89ms
87ms Stylesheet
text/css 54.93.208.83
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.com-web.net/assets/css/styles.css?ver=1718706431906

Requested by

Host: auth.com-web.net
URL: https://auth.com-web.net/de?code=6fcb8339def7c025755f8520fccd1c67

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.93.208.83 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-93-208-83.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

94f3e8424046d560d0aada125cab7d5dab2046c61f074387637d563b49020d5a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://auth.com-web.net/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 25 Aug 2024 04:05:36 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
referrer-policy: strict-origin
last-modified: Tue, 18 Jun 2024 10:27:11 GMT
server: nginx
etag: "667160ff-dd7"
content-type: text/css
accept-ranges: bytes
content-length: 3543

GET
H2 200 version.js Show response
auth.com-web.net/assets/js/ 80 B
326 B 89ms
88ms Script
application/javascript 54.93.208.83
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.com-web.net/assets/js/version.js?ver=1718706431906

Requested by

Host: auth.com-web.net
URL: https://auth.com-web.net/de?code=6fcb8339def7c025755f8520fccd1c67

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.93.208.83 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-93-208-83.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

ca5f74dac1a1b2794db43e57147ab60a7ee4a1f59bd544550b5f471ef64043c4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://auth.com-web.net/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 25 Aug 2024 04:05:36 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
referrer-policy: strict-origin
last-modified: Tue, 18 Jun 2024 10:27:11 GMT
server: nginx
etag: "667160ff-50"
content-type: application/javascript
accept-ranges: bytes
content-length: 80

GET
H2 200 jquery.min.js Show response
auth.com-web.net/assets/js/ 87 KB
88 KB 88ms
86ms Script
application/javascript 54.93.208.83
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.com-web.net/assets/js/jquery.min.js

Requested by

Host: auth.com-web.net
URL: https://auth.com-web.net/de?code=6fcb8339def7c025755f8520fccd1c67

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.93.208.83 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-93-208-83.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://auth.com-web.net/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 25 Aug 2024 04:05:36 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
referrer-policy: strict-origin
last-modified: Tue, 18 Jun 2024 10:27:11 GMT
server: nginx
etag: "667160ff-15d9d"
content-type: application/javascript
accept-ranges: bytes
content-length: 89501

GET
H2 200 bundle.min.js Show response
auth.com-web.net/assets/js/ 315 KB
315 KB 66ms
64ms Script
application/javascript 54.93.208.83
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.com-web.net/assets/js/bundle.min.js?ver=1718706431906

Requested by

Host: auth.com-web.net
URL: https://auth.com-web.net/de?code=6fcb8339def7c025755f8520fccd1c67

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.93.208.83 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-93-208-83.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

653283eafebacb2b4c4f9917a6eed3bda5f1f74b7158d643fa9222bdfb9fd38a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://auth.com-web.net/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 25 Aug 2024 04:05:36 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
referrer-policy: strict-origin
last-modified: Tue, 18 Jun 2024 10:27:11 GMT
server: nginx
etag: "667160ff-4eb2d"
content-type: application/javascript
accept-ranges: bytes
content-length: 322349

GET
H2 200 inputs.css
auth.com-web.net/assets/css/ 2 KB
2 KB 34ms
33ms Stylesheet
text/css 54.93.208.83
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.com-web.net/assets/css/inputs.css

Requested by

Host: auth.com-web.net
URL: https://auth.com-web.net/assets/css/styles.css?ver=1718706431906

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.93.208.83 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-93-208-83.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

cebea43a98719e150b12c298fe1a570ec50f6286787174bdd314354ca3077484

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://auth.com-web.net/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 25 Aug 2024 04:05:36 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
referrer-policy: strict-origin
last-modified: Tue, 18 Jun 2024 10:27:11 GMT
server: nginx
etag: "667160ff-72a"
content-type: text/css
accept-ranges: bytes
content-length: 1834

GET
H2 200 ip Show response
api.sosafe.de/v1/user/ 77 B
462 B 174ms
49ms XHR
application/json 52.28.130.210
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.sosafe.de/v1/user/ip

Requested by

Host: auth.com-web.net
URL: https://auth.com-web.net/assets/js/bundle.min.js?ver=1718706431906

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.28.130.210 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-28-130-210.eu-central-1.compute.amazonaws.com

Software

Resource Hash

1028a9a08d4fbed157e00e3bf35f14dab0cd477d7297229d7942aafa56896a58

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://auth.com-web.net/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 25 Aug 2024 04:05:37 GMT
strict-transport-security: max-age=15552000; includeSubDomains
x-content-type-options: nosniff
referrer-policy: no-referrer
x-permitted-cross-domain-policies: none
etag: W/"4d-tmG4oF1gwC7hgsn3CNHK9Rg/xPo"
expect-ct: max-age=0
x-download-options: noopen
x-dns-prefetch-control: off
content-type: application/json; charset=utf-8
x-frame-options: SAMEORIGIN
access-control-allow-origin: *
access-control-allow-credentials: true
content-length: 77
x-xss-protection: 0

GET
H2 204 favicon.ico
auth.com-web.net/ 0
139 B 40ms
40ms Other
text/plain 54.93.208.83
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://auth.com-web.net/favicon.ico

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.93.208.83 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-93-208-83.eu-central-1.compute.amazonaws.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://auth.com-web.net/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 25 Aug 2024 04:05:37 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
referrer-policy: strict-origin
server: nginx

POST
H2 200 / Show response
sentry.sosafe.de/api/25/envelope/ 2 B
193 B 177ms
51ms Fetch
application/json 18.158.76.44
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sentry.sosafe.de/api/25/envelope/?sentry_key=f4fcbdbd596c4b2cb672b939a7ee93c6&sentry_version=7
Requested by: Host: auth.com-web.net
URL: https://auth.com-web.net/assets/js/bundle.min.js?ver=1718706431906
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.158.76.44 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-76-44.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

Referer: https://auth.com-web.net/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: https://auth.com-web.net
date: Sun, 25 Aug 2024 04:05:37 GMT
access-control-expose-headers: x-sentry-rate-limits, retry-after, x-sentry-error
server: nginx
content-length: 2
vary: Origin
content-type: application/json

GET
H2 200 info Show response
api.sosafe.de/v1/report/ 770 B
1 KB 43ms
43ms XHR
application/json 52.28.130.210
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.sosafe.de/v1/report/info?code=6fcb8339def7c025755f8520fccd1c67

Requested by

Host: auth.com-web.net
URL: https://auth.com-web.net/assets/js/bundle.min.js?ver=1718706431906

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.28.130.210 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-28-130-210.eu-central-1.compute.amazonaws.com

Software

Resource Hash

94be1766c59443ec62304d6a56299d6d18efa31d9171b73f8398d1a268231a54

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://auth.com-web.net/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 25 Aug 2024 04:05:37 GMT
strict-transport-security: max-age=15552000; includeSubDomains
x-content-type-options: nosniff
referrer-policy: no-referrer
x-permitted-cross-domain-policies: none
etag: W/"302-EYT07kb6UyODamPLFsX3ggw4RnQ"
expect-ct: max-age=0
x-download-options: noopen
x-dns-prefetch-control: off
content-type: application/json; charset=utf-8
x-frame-options: SAMEORIGIN
access-control-allow-origin: *
access-control-allow-credentials: true
content-length: 770
x-xss-protection: 0

GET
H2 200 report Show response
api.sosafe.de/v1/ 19 KB
20 KB 301ms
300ms XHR
application/json 52.28.130.210
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.sosafe.de/v1/report?code=6fcb8339def7c025755f8520fccd1c67&type=2

Requested by

Host: auth.com-web.net
URL: https://auth.com-web.net/assets/js/bundle.min.js?ver=1718706431906

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.28.130.210 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-28-130-210.eu-central-1.compute.amazonaws.com

Software

Resource Hash

813f8747e31192fc24fe1d0e689222a43d868f15fb879fe6b6f9b68679fb091d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://auth.com-web.net/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Sun, 25 Aug 2024 04:05:37 GMT
strict-transport-security: max-age=15552000; includeSubDomains
x-content-type-options: nosniff
referrer-policy: no-referrer
x-permitted-cross-domain-policies: none
etag: W/"4d70-D3hUDL9MwZCv3n9k8lioqTSU7E8"
expect-ct: max-age=0
x-download-options: noopen
x-dns-prefetch-control: off
content-type: application/json; charset=utf-8
x-frame-options: SAMEORIGIN
access-control-allow-origin: *
access-control-allow-credentials: true
content-length: 19824
x-xss-protection: 0

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Google (Online)

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	verbose	URL: https://auth.com-web.net/de?code=6fcb8339def7c025755f8520fccd1c67 Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api.sosafe.de
auth.com-web.net
sentry.sosafe.de
18.158.76.44
52.28.130.210
54.93.208.83
1028a9a08d4fbed157e00e3bf35f14dab0cd477d7297229d7942aafa56896a58
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
46b4721c80749cc5e1ec6cf4c5fec78a2c51fdfc4ee9c94f2223cdaf4fbd8ced
653283eafebacb2b4c4f9917a6eed3bda5f1f74b7158d643fa9222bdfb9fd38a
813f8747e31192fc24fe1d0e689222a43d868f15fb879fe6b6f9b68679fb091d
8660ed12799916f277ccbb1fa1ba74dc2483dffa91089998ddfed5a9feb32200
94be1766c59443ec62304d6a56299d6d18efa31d9171b73f8398d1a268231a54
94f3e8424046d560d0aada125cab7d5dab2046c61f074387637d563b49020d5a
ca5f74dac1a1b2794db43e57147ab60a7ee4a1f59bd544550b5f471ef64043c4
cebea43a98719e150b12c298fe1a570ec50f6286787174bdd314354ca3077484
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e8e23ea893b24b7b7cfef869d747e400f8f9b0f8c5580a59ce729665daec03fc
fb9dff5a7a8fb8e687e72175650c383ddb139238fc26dec9fef6ced165a8e94a
fd702d8d6882cc47c74308ec46b1476035492c3d887741b279bb830c49b9b2bf
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

auth.com-web.net Open in urlscan Pro 54.93.208.83 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

15 Requests

100 %HTTPS

0 %IPv6

2 Domains

3 Subdomains

3 IPs

1 Countries

633 kBTransfer

628 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

15 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

13 JavaScript Global Variables

0 Cookies

1 Console Messages

Security Headers

Indicators

auth.com-web.net Open in urlscan Pro
54.93.208.83 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

15
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

3
Subdomains

3
IPs

1
Countries

633 kB
Transfer

628 kB
Size

0
Cookies

15 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!