auth-legacy.monzo-prod.com Open in urlscan Pro
52.85.151.79 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://auth-legacy.monzo-prod.com/
Submission: On October 17 via api (October 17th 2024, 12:40:50 am UTC) from CA — Scanned from CA

Summary HTTP 16 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 1 countries across 4 domains to perform 16 HTTP transactions. The main IP is 52.85.151.79, located in United States and belongs to AMAZON-02, US. The main domain is auth-legacy.monzo-prod.com.
TLS certificate: Issued by Amazon RSA 2048 M02 on October 16th 2024. Valid for: a year.

This is the only time auth-legacy.monzo-prod.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Monzo (Banking)

Domain & IP information

	IP Address	AS Autonomous System
8	52.85.151.79 52.85.151.79	16509 (AMAZON-02) (AMAZON-02)
4	13.248.178.82 13.248.178.82	16509 (AMAZON-02) (AMAZON-02)
2	2607:f8b0:400... 2607:f8b0:400d:c0c::5f	15169 (GOOGLE) (GOOGLE)
2	2607:f8b0:400... 2607:f8b0:4004:c1b::5e	15169 (GOOGLE) (GOOGLE)
16	4

8 52.85.151.79 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-85-151-79.iad89.r.cloudfront.net

auth-legacy.monzo-prod.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 13.248.178.82 (United States)

ASN16509 (AMAZON-02, US)
PTR: a0e88012cb437ad49.awsglobalaccelerator.com

internal-api.monzo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:400d:c0c::5f (Morganton, United States)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4004:c1b::5e (Washington, United States)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	monzo-prod.com auth-legacy.monzo-prod.com	2 MB
4	monzo.com internal-api.monzo.com — Cisco Umbrella Rank: 49072	948 B
2	gstatic.com fonts.gstatic.com	37 KB
2	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 30	2 KB
16	4

	Domain	Requested by
8	auth-legacy.monzo-prod.com	auth-legacy.monzo-prod.com
4	internal-api.monzo.com	auth-legacy.monzo-prod.com
2	fonts.gstatic.com	fonts.googleapis.com
2	fonts.googleapis.com	auth-legacy.monzo-prod.com
16	4

This site contains no links.

Subject Issuer	Validity	Valid
auth-legacy.monzo-prod.com Amazon RSA 2048 M02	`2024-10-16` - `2025-11-14`	a year	crt.sh
internal-api.monzo.com DigiCert Global G3 TLS ECC SHA384 2020 CA1	`2024-06-11` - `2025-06-10`	a year	crt.sh
upload.video.google.com WR2	`2024-09-24` - `2024-12-17`	3 months	crt.sh
*.gstatic.com WR2	`2024-09-24` - `2024-12-17`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://auth-legacy.monzo-prod.com/
Frame ID: BFE892A92F4F2FDF3332F6AD116CAE09
Requests: 16 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Monzo Security

Page Statistics

16
Requests

100 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

4
IPs

1
Countries

1950 kB
Transfer

1972 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

16 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
auth-legacy.monzo-prod.com/ 640 B
987 B 539ms
232ms Document
text/html 52.85.151.79
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://auth-legacy.monzo-prod.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.85.151.79 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-85-151-79.iad89.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 9179b25d7233a8827661db71b4ba1b529ecd1034132dd97f34ec6c7f4d594a42

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

content-length: 640
content-type: text/html
date: Thu, 17 Oct 2024 00:40:45 GMT
etag: "66cebade31714cd5315f4406e32751ca"
last-modified: Mon, 07 Oct 2024 08:58:40 GMT
server: AmazonS3
via: 1.1 0712e4ad4264127dfcb76a114b130494.cloudfront.net (CloudFront)
x-amz-cf-id: WJcVCNqj3pegZbXU21xA5TdJxO3bJotxmG21vqkae-I_QZ5kqouNPA==
x-amz-cf-pop: IAD89-C3
x-amz-version-id: zgzBnHgibPNSlPKHoq4zpisgMUeq4ZN.
x-cache: RefreshHit from cloudfront

GET
H2 200 env.js Show response
auth-legacy.monzo-prod.com/ 281 B
632 B 260ms
256ms Script
text/javascript 52.85.151.79
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://auth-legacy.monzo-prod.com/env.js
Requested by: Host: auth-legacy.monzo-prod.com
URL: https://auth-legacy.monzo-prod.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.85.151.79 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-85-151-79.iad89.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: d99af6f325deb783c6c2ee2e50483b82225126e81c428050d084e67ceed866c9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://auth-legacy.monzo-prod.com/

Response headers

x-amz-version-id: QFf2kS1xHrjDB4ikYTaDWL1O6PIhwDHM
etag: "63bffd752247db1a3a921fcbffe169cf"
via: 1.1 0712e4ad4264127dfcb76a114b130494.cloudfront.net (CloudFront)
x-cache: RefreshHit from cloudfront
content-length: 281
x-amz-cf-id: u6A2Ymf2ivJKxJ2rrJhTX51JgAC_cH0pQo4wo_6MtOf7oOlYMdUtkA==
date: Thu, 17 Oct 2024 00:40:45 GMT
content-type: text/javascript
last-modified: Mon, 07 Oct 2024 08:58:40 GMT
server: AmazonS3
x-amz-cf-pop: IAD89-C3

GET
H2 200 main-8bc64b79646d49ee3032.css
auth-legacy.monzo-prod.com/static/css/ 191 KB
191 KB 735ms
732ms Stylesheet
text/css 52.85.151.79
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://auth-legacy.monzo-prod.com/static/css/main-8bc64b79646d49ee3032.css
Requested by: Host: auth-legacy.monzo-prod.com
URL: https://auth-legacy.monzo-prod.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.85.151.79 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-85-151-79.iad89.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0f13c79e3c204f5e537929e16411646a67fa3391ce650c73a7998de5cc0cdb0d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://auth-legacy.monzo-prod.com/

Response headers

x-amz-version-id: z5GXQTSIqKm1OEtFoFM9R6FQBSbfYPbX
etag: "6ad1524c7526abdbfaa1d60d16cae2a9"
via: 1.1 0712e4ad4264127dfcb76a114b130494.cloudfront.net (CloudFront)
x-cache: RefreshHit from cloudfront
content-length: 195180
x-amz-cf-id: -NK1XzIgPOOksZxi254S0dEXFafp0AWac3AnCKMJPsddF2pQt-Ueyw==
date: Thu, 17 Oct 2024 00:40:45 GMT
content-type: text/css
last-modified: Mon, 07 Oct 2024 08:58:40 GMT
server: AmazonS3
x-amz-cf-pop: IAD89-C3

GET
H2 200 runtime-09db8cf929cccb175639.js Show response
auth-legacy.monzo-prod.com/static/js/ 2 KB
2 KB 732ms
730ms Script
text/javascript 52.85.151.79
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://auth-legacy.monzo-prod.com/static/js/runtime-09db8cf929cccb175639.js
Requested by: Host: auth-legacy.monzo-prod.com
URL: https://auth-legacy.monzo-prod.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.85.151.79 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-85-151-79.iad89.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: f25bca684aa78ba136f9482b07718b54cc3dfd038f3c418d58229d606f11c802

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://auth-legacy.monzo-prod.com/

Response headers

x-amz-version-id: YzBRqiIsQsWj2tALL7wA65gStMp4wPrK
etag: "c87aa260e22227218951ca673b2c7eac"
via: 1.1 0712e4ad4264127dfcb76a114b130494.cloudfront.net (CloudFront)
x-cache: RefreshHit from cloudfront
content-length: 1546
x-amz-cf-id: lyfCTqS147ZZ4-DJPXrt52pKZe52CRta6yYyOzVNHw1Q0XG5iwh5tw==
date: Thu, 17 Oct 2024 00:40:45 GMT
content-type: text/javascript
last-modified: Mon, 07 Oct 2024 08:58:40 GMT
server: AmazonS3
x-amz-cf-pop: IAD89-C3

GET
H2 200 vendors~main-e1afca02e5c39c273323.chunk.js Show response
auth-legacy.monzo-prod.com/static/js/ 635 KB
636 KB 264ms
261ms Script
text/javascript 52.85.151.79
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://auth-legacy.monzo-prod.com/static/js/vendors~main-e1afca02e5c39c273323.chunk.js
Requested by: Host: auth-legacy.monzo-prod.com
URL: https://auth-legacy.monzo-prod.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.85.151.79 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-85-151-79.iad89.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 881f21a7f9ebf9c95ec75576a7ced69965d1aa4d23f2b19f2112fa1613741a49

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://auth-legacy.monzo-prod.com/

Response headers

x-amz-version-id: RtXczk7qpiXDWdtDRY9fkPw5_AbA.z9O
etag: "385ea87cfb5dafbc246c809c34f83460"
via: 1.1 0712e4ad4264127dfcb76a114b130494.cloudfront.net (CloudFront)
x-cache: RefreshHit from cloudfront
content-length: 650491
x-amz-cf-id: K-NHu3gR6PXKMTJznG62LTHRoHOmysVD15y4yGQij_uBcF7P6tboqw==
date: Thu, 17 Oct 2024 00:40:45 GMT
content-type: text/javascript
last-modified: Mon, 07 Oct 2024 08:58:40 GMT
server: AmazonS3
x-amz-cf-pop: IAD89-C3

GET
H2 200 main-053df5a78026a23f3384.chunk.js Show response
auth-legacy.monzo-prod.com/static/js/ 1009 KB
1010 KB 677ms
675ms Script
text/javascript 52.85.151.79
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://auth-legacy.monzo-prod.com/static/js/main-053df5a78026a23f3384.chunk.js
Requested by: Host: auth-legacy.monzo-prod.com
URL: https://auth-legacy.monzo-prod.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.85.151.79 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-85-151-79.iad89.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5b471a6a3a1533d0c032744b43404583968a9779cfbc5699eaeeb40864ca0e0e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://auth-legacy.monzo-prod.com/

Response headers

x-amz-version-id: cvgOziY6Fk5D_AvnVaOn6Q.hkGV8KR9m
etag: "e1b28c8e5ea54860a1ddc1135f73b95e"
via: 1.1 0712e4ad4264127dfcb76a114b130494.cloudfront.net (CloudFront)
x-cache: RefreshHit from cloudfront
content-length: 1033228
x-amz-cf-id: BFqH9f0vKtIhhpUrfrHb7h-pGDSqqp0xT01xkjSr32Sujbr1BABk9Q==
date: Thu, 17 Oct 2024 00:40:45 GMT
content-type: text/javascript
last-modified: Mon, 07 Oct 2024 08:58:40 GMT
server: AmazonS3
x-amz-cf-pop: IAD89-C3

GET
H2 200 auth_util.js Show response
internal-api.monzo.com/static/ 0
180 B 1118ms
519ms Script
text/javascript 13.248.178.82
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://internal-api.monzo.com/static/auth_util.js

Requested by

Host: auth-legacy.monzo-prod.com
URL: https://auth-legacy.monzo-prod.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.248.178.82 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

a0e88012cb437ad49.awsglobalaccelerator.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://auth-legacy.monzo-prod.com/

Response headers

opentracing-id: c074e576880ddb3ba96042c13a0fc331
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Thu, 17 Oct 2024 00:40:45 GMT
content-type: text/javascript
trace-id: 2b4d02f4-1253-4bc1-5426-383a386718ea

GET
H2 200 css
fonts.googleapis.com/ 26 KB
2 KB 293ms
101ms Stylesheet
text/css 2607:f8b0:400d:c0c::5f
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:100,100i,300,300i,400,400i,500,500i,700,700i,900,900i

Requested by

Host: auth-legacy.monzo-prod.com
URL: https://auth-legacy.monzo-prod.com/static/css/main-8bc64b79646d49ee3032.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c0c::5f Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

9640a181d883267880a1ddf61e50e83a2a2a064b061952b4b541928242ae9b82

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://auth-legacy.monzo-prod.com/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Thu, 17 Oct 2024 00:40:45 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Oct 2024 00:40:45 GMT
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified: Wed, 16 Oct 2024 23:43:28 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H2 200 css
fonts.googleapis.com/ 3 KB
676 B 343ms
153ms Stylesheet
text/css 2607:f8b0:400d:c0c::5f
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Montserrat:500,600;700;800&subset=cyrillic,cyrillic-ext,latin-ext,vietnamese

Requested by

Host: auth-legacy.monzo-prod.com
URL: https://auth-legacy.monzo-prod.com/static/css/main-8bc64b79646d49ee3032.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c0c::5f Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

db2c667ce618f8951159c118c8e8273c30e417bfb8a619b43b87e15c847d88f0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://auth-legacy.monzo-prod.com/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Thu, 17 Oct 2024 00:40:45 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Oct 2024 00:40:45 GMT
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified: Thu, 17 Oct 2024 00:40:45 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H2 200 auth_background.png
internal-api.monzo.com/static/ 68 B
256 B 610ms
610ms Image
image/png 13.248.178.82
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://internal-api.monzo.com/static/auth_background.png

Requested by

Host: auth-legacy.monzo-prod.com
URL: https://auth-legacy.monzo-prod.com/static/css/main-8bc64b79646d49ee3032.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.248.178.82 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

a0e88012cb437ad49.awsglobalaccelerator.com

Software

Resource Hash

63ef318d96b5d0d0ceba6e04a4e622b1158335cdc67c49e27839132c6f655058

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://auth-legacy.monzo-prod.com/

Response headers

opentracing-id: e0dd117230cf2acd45077682bafb32dc
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 68
date: Thu, 17 Oct 2024 00:40:45 GMT
content-type: image/png
trace-id: 5cd0a866-903e-43fe-759a-743b2f0b378e

GET
H2 200 logo.1d0dc3bca65d6f7a054c666cf28e214f.svg
auth-legacy.monzo-prod.com/static/media/ 2 KB
2 KB 294ms
293ms Image
image/svg+xml 52.85.151.79
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://auth-legacy.monzo-prod.com/static/media/logo.1d0dc3bca65d6f7a054c666cf28e214f.svg
Requested by: Host: auth-legacy.monzo-prod.com
URL: https://auth-legacy.monzo-prod.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.85.151.79 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-85-151-79.iad89.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06c85d48c1e92e1b2e9420305cc5428191c0ee14a440a3a697220406846b0200

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://auth-legacy.monzo-prod.com/

Response headers

x-amz-version-id: OGd6i5ol4AVmO2WAwMacE8KSYT2kKc1x
etag: "887d61caf92d43df510f9a0dd77c544f"
via: 1.1 0712e4ad4264127dfcb76a114b130494.cloudfront.net (CloudFront)
x-cache: RefreshHit from cloudfront
content-length: 2182
x-amz-cf-id: hBIMGs2pFyNhHRe0HNIu_gOc5hDxxenCtLo34Y8JJcP7DOjculSvZA==
date: Thu, 17 Oct 2024 00:40:46 GMT
content-type: image/svg+xml
last-modified: Mon, 07 Oct 2024 08:58:42 GMT
server: AmazonS3
x-amz-cf-pop: IAD89-C3

GET
H2 200 auth_header.png
internal-api.monzo.com/static/ 68 B
256 B 521ms
521ms Image
image/png 13.248.178.82
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://internal-api.monzo.com/static/auth_header.png

Requested by

Host: auth-legacy.monzo-prod.com
URL: https://auth-legacy.monzo-prod.com/static/css/main-8bc64b79646d49ee3032.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.248.178.82 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

a0e88012cb437ad49.awsglobalaccelerator.com

Software

Resource Hash

63ef318d96b5d0d0ceba6e04a4e622b1158335cdc67c49e27839132c6f655058

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://auth-legacy.monzo-prod.com/

Response headers

opentracing-id: dd53ba5b176a6b8c2c9cc007effd81f0
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 68
date: Thu, 17 Oct 2024 00:40:45 GMT
content-type: image/png
trace-id: 3adbd480-1579-418a-7d82-0d1ff21ef335

GET
H2 200 auth_footer.png
internal-api.monzo.com/static/ 68 B
256 B 556ms
555ms Image
image/png 13.248.178.82
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://internal-api.monzo.com/static/auth_footer.png

Requested by

Host: auth-legacy.monzo-prod.com
URL: https://auth-legacy.monzo-prod.com/static/css/main-8bc64b79646d49ee3032.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.248.178.82 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

a0e88012cb437ad49.awsglobalaccelerator.com

Software

Resource Hash

63ef318d96b5d0d0ceba6e04a4e622b1158335cdc67c49e27839132c6f655058

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://auth-legacy.monzo-prod.com/

Response headers

opentracing-id: 7da3b7951978c4dae8156e1bdceeaf7e
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 68
date: Thu, 17 Oct 2024 00:40:45 GMT
content-type: image/png
trace-id: 3312315c-ba44-4b2c-7fb5-20fe80608bb8

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v32/ 18 KB
19 KB 339ms
130ms Font
font/woff2 2607:f8b0:4004:c1b::5e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v32/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:100,100i,300,300i,400,400i,500,500i,700,700i,900,900i

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1b::5e Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

89978e658e840b927dddb5cb3a835c7d8526ece79933bd9f3096b301fe1a8571

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://auth-legacy.monzo-prod.com
Referer: https://fonts.googleapis.com/

Response headers

age: 72755
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Thu, 16 Oct 2025 04:28:10 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 16 Oct 2024 04:28:10 GMT
last-modified: Thu, 01 Aug 2024 20:41:24 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 18536
x-xss-protection: 0
server: sffe

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v32/ 18 KB
18 KB 412ms
204ms Font
font/woff2 2607:f8b0:4004:c1b::5e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v32/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:100,100i,300,300i,400,400i,500,500i,700,700i,900,900i

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1b::5e Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d9bada3a44bb2ffa66dec5cc781cafc9ef17ed876cd9b0c5f7ef18228b63cebb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://auth-legacy.monzo-prod.com
Referer: https://fonts.googleapis.com/

Response headers

age: 60547
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Thu, 16 Oct 2025 07:51:38 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 16 Oct 2024 07:51:38 GMT
last-modified: Thu, 01 Aug 2024 20:41:21 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 18596
x-xss-protection: 0
server: sffe

GET
H2 200 favicon.ico
auth-legacy.monzo-prod.com/ 66 KB
66 KB 238ms
238ms Other
image/x-icon 52.85.151.79
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://auth-legacy.monzo-prod.com/favicon.ico
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.85.151.79 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-85-151-79.iad89.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5a4e00e495dda53eb0669807696d58537ff0f14412dd2c7141735044f0f7d12a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://auth-legacy.monzo-prod.com/

Response headers

x-amz-version-id: TuJMN4OEwqHC2kF5BQw0IMFSvZyqLfOa
etag: "ef0b3bea11a4a8e855cff90d19078dea"
via: 1.1 0712e4ad4264127dfcb76a114b130494.cloudfront.net (CloudFront)
x-cache: RefreshHit from cloudfront
content-length: 67646
x-amz-cf-id: jpYVb3HT2Ki5jDTkdDJdKjQSuLpk53vyn_WvQyfJWgpEzOEa8iHHVw==
date: Thu, 17 Oct 2024 00:40:47 GMT
content-type: image/x-icon
last-modified: Mon, 07 Oct 2024 08:58:40 GMT
server: AmazonS3
x-amz-cf-pop: IAD89-C3

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Monzo (Banking)

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

auth-legacy.monzo-prod.com
fonts.googleapis.com
fonts.gstatic.com
internal-api.monzo.com
13.248.178.82
2607:f8b0:4004:c1b::5e
2607:f8b0:400d:c0c::5f
52.85.151.79
06c85d48c1e92e1b2e9420305cc5428191c0ee14a440a3a697220406846b0200
0f13c79e3c204f5e537929e16411646a67fa3391ce650c73a7998de5cc0cdb0d
5a4e00e495dda53eb0669807696d58537ff0f14412dd2c7141735044f0f7d12a
5b471a6a3a1533d0c032744b43404583968a9779cfbc5699eaeeb40864ca0e0e
63ef318d96b5d0d0ceba6e04a4e622b1158335cdc67c49e27839132c6f655058
881f21a7f9ebf9c95ec75576a7ced69965d1aa4d23f2b19f2112fa1613741a49
89978e658e840b927dddb5cb3a835c7d8526ece79933bd9f3096b301fe1a8571
9179b25d7233a8827661db71b4ba1b529ecd1034132dd97f34ec6c7f4d594a42
9640a181d883267880a1ddf61e50e83a2a2a064b061952b4b541928242ae9b82
d99af6f325deb783c6c2ee2e50483b82225126e81c428050d084e67ceed866c9
d9bada3a44bb2ffa66dec5cc781cafc9ef17ed876cd9b0c5f7ef18228b63cebb
db2c667ce618f8951159c118c8e8273c30e417bfb8a619b43b87e15c847d88f0
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f25bca684aa78ba136f9482b07718b54cc3dfd038f3c418d58229d606f11c802

auth-legacy.monzo-prod.com Open in urlscan Pro 52.85.151.79 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

16 Requests

100 %HTTPS

50 %IPv6

4 Domains

4 Subdomains

4 IPs

1 Countries

1950 kBTransfer

1972 kBSize

0 Cookies

0 Outgoing links

Redirected requests

16 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

10 JavaScript Global Variables

0 Cookies

Indicators

auth-legacy.monzo-prod.com Open in urlscan Pro
52.85.151.79 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

16
Requests

100 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

4
IPs

1
Countries

1950 kB
Transfer

1972 kB
Size

0
Cookies

16 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!