auth0.fenix.group
Open in
urlscan Pro
2606:4700::6811:eb58
Public Scan
Effective URL: https://auth0.fenix.group/login?state=hKFo2SBvZG5MYXZWLXlmdnJiX042d2Y0cExhODdhbnJkUC1FeaFupWxvZ2luo3RpZNkgelZielJIdVJMeWY5...
Submission Tags: phishingrod
Submission: On April 02 via api from DE — Scanned from DE
Summary
TLS certificate: Issued by R3 on March 1st 2023. Valid for: 3 months.
This is the only time auth0.fenix.group was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 2 | 35.230.172.51 35.230.172.51 | 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM) | |
1 5 | 2606:4700::68... 2606:4700::6811:eb58 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
3 | 35.245.88.43 35.245.88.43 | 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM) | |
1 | 2600:9000:224... 2600:9000:2240:7200:10:474e:104a:2961 | 16509 (AMAZON-02) (AMAZON-02) | |
2 | 2a00:1450:400... 2a00:1450:4001:812::200a | 15169 (GOOGLE) (GOOGLE) | |
4 | 2a00:1450:400... 2a00:1450:4001:806::2003 | 15169 (GOOGLE) (GOOGLE) | |
14 | 5 |
ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 51.172.230.35.bc.googleusercontent.com
monitoring.fenix.group |
ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 43.88.245.35.bc.googleusercontent.com
marketplace.fenix.group |
Apex Domain Subdomains |
Transfer | |
---|---|---|
10 |
fenix.group
3 redirects
monitoring.fenix.group auth0.fenix.group marketplace.fenix.group |
20 KB |
4 |
gstatic.com
fonts.gstatic.com |
64 KB |
2 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 47 |
2 KB |
1 |
auth0.com
cdn.auth0.com — Cisco Umbrella Rank: 8332 |
216 KB |
14 | 4 |
Domain | Requested by | |
---|---|---|
5 | auth0.fenix.group |
1 redirects
cdn.auth0.com
|
4 | fonts.gstatic.com |
fonts.googleapis.com
|
3 | marketplace.fenix.group |
auth0.fenix.group
marketplace.fenix.group |
2 | fonts.googleapis.com |
marketplace.fenix.group
|
2 | monitoring.fenix.group | 2 redirects |
1 | cdn.auth0.com |
auth0.fenix.group
|
14 | 6 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
auth0.fenix.group R3 |
2023-03-01 - 2023-05-30 |
3 months | crt.sh |
marketplace.fenix.group R3 |
2023-02-28 - 2023-05-29 |
3 months | crt.sh |
*.auth0.com Amazon RSA 2048 M01 |
2023-02-24 - 2024-03-24 |
a year | crt.sh |
upload.video.google.com GTS CA 1C3 |
2023-03-13 - 2023-06-05 |
3 months | crt.sh |
*.gstatic.com GTS CA 1C3 |
2023-03-13 - 2023-06-05 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://auth0.fenix.group/login?state=hKFo2SBvZG5MYXZWLXlmdnJiX042d2Y0cExhODdhbnJkUC1FeaFupWxvZ2luo3RpZNkgelZielJIdVJMeWY5S0FYMzB3Y2wzWVlSTTJoaUYyMnWjY2lk2SBlNzNQNmhLNGRuYmVnNnBjZUtXaHJOajViako5WVNQQg&client=e73P6hK4dnbeg6pceKWhrNj5bjJ9YSPB&protocol=oauth2&scope=openid%20email%20profile&nonce=eb1480594854f646f3925aa94de5e94ef92c3c3881597a02389d9b786779a7f3&response_type=code&response_mode=query&redirect_uri=https%3A%2F%2Fmonitoring.fenix.group%2Findex.php%3Fauth0%3D1
Frame ID: 26B51FCFC064DFA23A057D67EA19647E
Requests: 14 HTTP requests in this frame
Screenshot
Page Title
Marketplace - Sign InPage URL History Show full URLs
-
https://monitoring.fenix.group/
HTTP 302
https://monitoring.fenix.group/wp-login.php?redirect_to=https%3A%2F%2Fmonitoring.fenix.group%2F HTTP 302
https://auth0.fenix.group/authorize?client_id=e73P6hK4dnbeg6pceKWhrNj5bjJ9YSPB&scope=openid%20email%20... HTTP 302
https://auth0.fenix.group/login?state=hKFo2SBvZG5MYXZWLXlmdnJiX042d2Y0cExhODdhbnJkUC1FeaFupWxvZ2luo3Rp... Page URL
Detected technologies
WordPress (CMS) ExpandDetected patterns
- <link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
- /wp-(?:content|includes)/
Auth0 Lock (Miscellaneous) Expand
Detected patterns
- /lock/([\d.]+)/lock(?:.min)?\.js
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://monitoring.fenix.group/
HTTP 302
https://monitoring.fenix.group/wp-login.php?redirect_to=https%3A%2F%2Fmonitoring.fenix.group%2F HTTP 302
https://auth0.fenix.group/authorize?client_id=e73P6hK4dnbeg6pceKWhrNj5bjJ9YSPB&scope=openid%20email%20profile&nonce=eb1480594854f646f3925aa94de5e94ef92c3c3881597a02389d9b786779a7f3&response_type=code&response_mode=query&redirect_uri=https%3A%2F%2Fmonitoring.fenix.group%2Findex.php%3Fauth0%3D1&state=eyJpbnRlcmltIjpmYWxzZSwibm9uY2UiOiJhYzNjMjQ1YjUxYTMwZTZmMjFiN2U2OTlhN2NmOGRiZmZlMTAyN2IzNjQ1MzZjMzMwZmYzMDEwY2YxYjhlOWI5IiwicmVkaXJlY3RfdG8iOiJodHRwczpcL1wvbW9uaXRvcmluZy5mZW5peC5ncm91cFwvIn0%3D HTTP 302
https://auth0.fenix.group/login?state=hKFo2SBvZG5MYXZWLXlmdnJiX042d2Y0cExhODdhbnJkUC1FeaFupWxvZ2luo3RpZNkgelZielJIdVJMeWY5S0FYMzB3Y2wzWVlSTTJoaUYyMnWjY2lk2SBlNzNQNmhLNGRuYmVnNnBjZUtXaHJOajViako5WVNQQg&client=e73P6hK4dnbeg6pceKWhrNj5bjJ9YSPB&protocol=oauth2&scope=openid%20email%20profile&nonce=eb1480594854f646f3925aa94de5e94ef92c3c3881597a02389d9b786779a7f3&response_type=code&response_mode=query&redirect_uri=https%3A%2F%2Fmonitoring.fenix.group%2Findex.php%3Fauth0%3D1 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
14 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
login
auth0.fenix.group/ Redirect Chain
|
5 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
auth0.css
marketplace.fenix.group/wp-content/themes/fenix/css/ |
3 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
lock.min.js
cdn.auth0.com/js/lock/11.15/ |
778 KB 216 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
7 KB 716 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
9 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
fenixlogo168favicon.png
marketplace.fenix.group/wp-content/uploads/2019/08/ |
6 KB 7 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
e73P6hK4dnbeg6pceKWhrNj5bjJ9YSPB.js
auth0.fenix.group/client/ |
572 B 784 B |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
country
auth0.fenix.group/user/geoloc/ |
21 B 600 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
ssodata
auth0.fenix.group/user/ |
0 424 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
o-0IIpQlx3QUlC5A4PNr5TRA.woff2
fonts.gstatic.com/s/notosans/v27/ |
13 KB 13 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
o-0OIpQlx3QUlC5A4PNr4ARCQ_k.woff2
fonts.gstatic.com/s/notosans/v27/ |
11 KB 12 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
HTxwL3I-JCGChYJ8VI-L6OO_au7B47rxz3bWuQ.woff2
fonts.gstatic.com/s/barlowcondensed/v12/ |
20 KB 20 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
white-arrow.png
marketplace.fenix.group/wp-content/uploads/2019/03/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
HTx3L3I-JCGChYJ8VI-L6OO_au7B6xHT2g.woff2
fonts.gstatic.com/s/barlowcondensed/v12/ |
20 KB 20 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
10 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless object| Auth0 function| Auth0Lock function| Auth0LockPasswordless object| config undefined| connection object| languageDictionary undefined| language undefined| loginHint object| lock11 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
auth0.fenix.group/usernamepassword/login | Name: _csrf Value: BzTvGYgjJiu3gHhnK7zUrXsX |
|
monitoring.fenix.group/ | Name: PHPSESSID Value: 4scupf7kh6pfbj28m2jc0avs5s |
|
monitoring.fenix.group/ | Name: pmpro_visit Value: 1 |
|
monitoring.fenix.group/ | Name: wordpress_test_cookie Value: WP+Cookie+check |
|
monitoring.fenix.group/ | Name: auth0_state Value: eyJpbnRlcmltIjpmYWxzZSwibm9uY2UiOiJhYzNjMjQ1YjUxYTMwZTZmMjFiN2U2OTlhN2NmOGRiZmZlMTAyN2IzNjQ1MzZjMzMwZmYzMDEwY2YxYjhlOWI5IiwicmVkaXJlY3RfdG8iOiJodHRwczpcL1wvbW9uaXRvcmluZy5mZW5peC5ncm91cFwvIn0%3D |
|
monitoring.fenix.group/ | Name: auth0_nonce Value: eb1480594854f646f3925aa94de5e94ef92c3c3881597a02389d9b786779a7f3 |
|
auth0.fenix.group/ | Name: did Value: s%3Av0%3A5dddb270-d181-11ed-aaba-d76e86309be6.Alf3C%2B7hgokOQpJrpfTpXlHasMcuob2ATpvrDn4m0oU |
|
auth0.fenix.group/ | Name: auth0 Value: s%3Av1.gadzZXNzaW9ugqZoYW5kbGXEQAxHOBtxxGNJjuHOJ4hQipC4J_7xmZsMkNLwNCsrW0HWpPJONP7693nGKPrLa2X95yLSF-G6KDF51Uvqu48vQUimY29va2llg6dleHBpcmVz1_9wDoYAZC25G65vcmlnaW5hbE1heEFnZc4PcxQAqHNhbWVTaXRlpG5vbmU.wfvdY5Y%2F%2FWSB3n9NYPwRYW9huJCnk4aBGWyV%2B8fat3g |
|
auth0.fenix.group/ | Name: did_compat Value: s%3Av0%3A5dddb270-d181-11ed-aaba-d76e86309be6.Alf3C%2B7hgokOQpJrpfTpXlHasMcuob2ATpvrDn4m0oU |
|
auth0.fenix.group/ | Name: auth0_compat Value: s%3Av1.gadzZXNzaW9ugqZoYW5kbGXEQAxHOBtxxGNJjuHOJ4hQipC4J_7xmZsMkNLwNCsrW0HWpPJONP7693nGKPrLa2X95yLSF-G6KDF51Uvqu48vQUimY29va2llg6dleHBpcmVz1_9wDoYAZC25G65vcmlnaW5hbE1heEFnZc4PcxQAqHNhbWVTaXRlpG5vbmU.wfvdY5Y%2F%2FWSB3n9NYPwRYW9huJCnk4aBGWyV%2B8fat3g |
|
.auth0.fenix.group/ | Name: __cf_bm Value: aSzlbayDRS6r9k2lPi.6mv_VVgagVwXhcXxSBv.r2cA-1680458907-0-Aexbw7GaXg0ogYJMoe8/hJC4ecv/sXLpwFahrtbEuPSd/afi9Z3q1rmTnVEDi+8JrZoVhQuDif4GFriOHLfh6YY= |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=31536000 |
X-Content-Type-Options | nosniff |
X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
auth0.fenix.group
cdn.auth0.com
fonts.googleapis.com
fonts.gstatic.com
marketplace.fenix.group
monitoring.fenix.group
2600:9000:2240:7200:10:474e:104a:2961
2606:4700::6811:eb58
2a00:1450:4001:806::2003
2a00:1450:4001:812::200a
35.230.172.51
35.245.88.43
256e44c8bcbc22c00d17e2201460aaf6249e3707a65a2aaced66452c3c617a4e
29625905da158c5cc29141d828ed7777ebd0b4263fffd2cdfa04f84cd48eac73
420f8e3b772990108a7a5e260b53420123a1bd22a82848984595452c9355ab1f
4481b06d0295247eff850f169e403f67be002fd75b6cbb62f2d135b7f5dc4966
67c482243f604951ac751908daddf1a2b1b3f3cf9923d9526c2e2b25e909176d
7a27721446b3145b0c86b51ec410e2557ba8313a98750d03fa24f0d8eca605be
87f491a66048647e1d92f5b0a3337a504a194188d7d66d520f9c29215ad08c28
88f00438d26021a325247c4427898f7c778a22976df9f1a9d9876429778bf265
a878ec53f90025eee613817c8ff709fd9f7416d76cdd6bb1360939baa8dd811b
aa1895205efb0ef0fa4232b6289c46a12bf07b9493598c2d50d3afe6d9ce9d9d
af91213cd670d6270b32ebdeb00a09625f6b74ccd780d12ff6724a14ea1efaff
afb614c9f9d4acade7f25b853cbd5b96617ba8240e22bbacceb828469f3f47a2
cc6015086481a4825c05232eaa219593eba4aab46044fa4e8b98fb4dd8f0bdc6
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855