urlscan.io logo urlscan.io
SecurityTrails logo

login-accountverify.serveuser.com Open in urlscan Pro
18.216.129.85  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://login-accountverify.serveuser.com/cash.app/login.php
Submission: On October 28 via manual from IT
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 9 HTTP transactions. The main IP is 18.216.129.85, located in Columbus, United States and belongs to AMAZON-02, US. The main domain is login-accountverify.serveuser.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on October 26th 2020. Valid for: 3 months.
This is the only time login-accountverify.serveuser.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Cash App (Banking)

Domain & IP information

IP Address AS Autonomous System
1 18.216.129.85 16509 (AMAZON-02)
8 151.101.193.49 54113 (FASTLY)
9 2
Apex Domain
Subdomains		 Transfer
8 squarecdn.com
cash-f.squarecdn.com
682 KB
1 serveuser.com
login-accountverify.serveuser.com
5 KB
9 2
Domain Requested by
8 cash-f.squarecdn.com login-accountverify.serveuser.com
cash-f.squarecdn.com
1 login-accountverify.serveuser.com
9 2

This site contains no links.

Subject Issuer Validity Valid
login-accountverify.serveuser.com
cPanel, Inc. Certification Authority		 2020-10-26 -
2021-01-24		 3 months crt.sh
*.squarecdn.com
Entrust Certification Authority - L1K		 2020-02-06 -
2021-02-16		 a year crt.sh

This page contains 1 frames:

Primary Page: https://login-accountverify.serveuser.com/cash.app/login.php
Frame ID: 37665F642DFA67DA2A052DAA032545A0
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • url /\.php(?:$|\?)/i
Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

9
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

687 kB
Transfer

2495 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request login.php
login-accountverify.serveuser.com/cash.app/ 		5 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://login-accountverify.serveuser.com/cash.app/login.php
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
18.216.129.85 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-216-129-85.us-east-2.compute.amazonaws.com
Software
Apache /
Resource Hash
1c26acb2b3c796a0af628e7a737c95ef4f01cfd6cd03b3b6f46238e596cee141

Request headers

Host
login-accountverify.serveuser.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
none
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1
Sec-Fetch-Dest
document
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 28 Oct 2020 13:11:36 GMT
Server
Apache
Content-Length
5249
Keep-Alive
timeout=5, max=100
Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8
cash-market-rounded-light.woff2
cash-f.squarecdn.com/assets/fonts/cashmarket/ 		23 KB
23 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://cash-f.squarecdn.com/assets/fonts/cashmarket/cash-market-rounded-light.woff2
Requested by
Host: login-accountverify.serveuser.com
URL: https://login-accountverify.serveuser.com/cash.app/login.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.193.49 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
a1abd94048e822be4d2b551ce86d9250314fb453a2b87092a6bb1138ae167c14

Request headers

Origin
https://login-accountverify.serveuser.com
Referer
https://login-accountverify.serveuser.com/cash.app/login.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id
spuen2ky2CaGXVLTbJwuttFzNjIklr5C
content-encoding
gzip
etag
"26a29dd210767118b79fcee3c990c874"
age
1154333
via
1.1 varnish
x-cache
HIT
status
200
x-amz-request-id
FV7P7N5K1V5SCSBY
x-amz-id-2
I5Ri2BUylqkDo1DA3MiLbPwhi6a4LTxTVvvNY3xbf0rSmwczuKU+a8OHv18+EPFvjr0KyK4Vb2k=
x-served-by
cache-ams21078-AMS
accept-ranges
bytes
last-modified
Thu, 16 Apr 2020 15:32:58 GMT
server
AmazonS3
x-timer
S1603890697.089169,VS0,VE1
date
Wed, 28 Oct 2020 13:11:37 GMT
content-type
application/octet-stream
access-control-allow-origin
*
expires
Sat, 16 Apr 2022 15:32:57 GMT
cache-control
max-age=630720000, public
content-length
23307
x-cache-hits
1
cash-market-rounded-regular.woff2
cash-f.squarecdn.com/assets/fonts/cashmarket/ 		33 KB
33 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://cash-f.squarecdn.com/assets/fonts/cashmarket/cash-market-rounded-regular.woff2
Requested by
Host: login-accountverify.serveuser.com
URL: https://login-accountverify.serveuser.com/cash.app/login.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.193.49 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
de531e5c7be5d41643ca0ca0eda3794751eb52275c95a774da8df60ef8729b3b

Request headers

Origin
https://login-accountverify.serveuser.com
Referer
https://login-accountverify.serveuser.com/cash.app/login.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id
SAj6lFfIsRUTMRa8l2zbWkkzLKmcgHIF
content-encoding
gzip
etag
"438232647d9913a48305142c9fe7721b"
age
2376725
via
1.1 varnish
x-cache
HIT
status
200
x-amz-request-id
BAE244F58B05F784
x-amz-id-2
IBAfHytzeA1OOzY3R4NlZFD3RuPPmLorI7/bMqMVenCEaYbuw+8wiY3FPkchEjMEvZG/aHoBbYM=
x-served-by
cache-ams21078-AMS
accept-ranges
bytes
last-modified
Thu, 16 Apr 2020 15:32:58 GMT
server
AmazonS3
x-timer
S1603890697.089145,VS0,VE1
date
Wed, 28 Oct 2020 13:11:37 GMT
content-type
application/octet-stream
access-control-allow-origin
*
expires
Sat, 16 Apr 2022 15:32:57 GMT
cache-control
max-age=630720000, public
content-length
33725
x-cache-hits
1
cash-market-rounded-medium.woff2
cash-f.squarecdn.com/assets/fonts/cashmarket/ 		35 KB
35 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://cash-f.squarecdn.com/assets/fonts/cashmarket/cash-market-rounded-medium.woff2
Requested by
Host: login-accountverify.serveuser.com
URL: https://login-accountverify.serveuser.com/cash.app/login.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.193.49 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
32ce0116ec544d7c3a3f10163fabb110f4c8e49be67489b60957badd5acc8bc3

Request headers

Origin
https://login-accountverify.serveuser.com
Referer
https://login-accountverify.serveuser.com/cash.app/login.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id
xzsaWqwzUUlks_sBCJYElK62XbDP5QW9
content-encoding
gzip
etag
"bb0a7911452d2d17b9bcf766d63e2602"
age
4066313
via
1.1 varnish
x-cache
HIT
status
200
x-amz-request-id
9R7Z6YDNEW3G1MAG
x-amz-id-2
vP9H549A9vprRavZXGf9U87Hqbdgrs6SXCXy2hbzlQNeJA7xckr0kC48Ixk8OmwziAF+CyjXFXM=
x-served-by
cache-ams21078-AMS
accept-ranges
bytes
last-modified
Thu, 16 Apr 2020 15:32:58 GMT
server
AmazonS3
x-timer
S1603890697.089372,VS0,VE1
date
Wed, 28 Oct 2020 13:11:37 GMT
content-type
application/octet-stream
access-control-allow-origin
*
expires
Sat, 16 Apr 2022 15:32:57 GMT
cache-control
max-age=630720000, public
content-length
36116
x-cache-hits
1
vendor.js
cash-f.squarecdn.com/ember/a548ae1339eed15b0a557cd7cc8ba0b2f9645ac5/assets/ 		1 MB
297 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cash-f.squarecdn.com/ember/a548ae1339eed15b0a557cd7cc8ba0b2f9645ac5/assets/vendor.js
Requested by
Host: login-accountverify.serveuser.com
URL: https://login-accountverify.serveuser.com/cash.app/login.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.193.49 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
f4ab87ede11229a08e5450acd4d6e6e1604fa1cb45da54387b56711f9043fc58

Request headers

Origin
https://login-accountverify.serveuser.com
Referer
https://login-accountverify.serveuser.com/cash.app/login.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id
cW_F8iYmbmbJ1UQHdhVym6_jlEfJjyM2
content-encoding
gzip
etag
"c3595e2384f15bb6c5b808b964a5125b"
age
0
accept-ranges
bytes
x-cache
MISS
status
200
x-amz-request-id
06F365AA83B822F3
x-amz-id-2
AsZ+8M9XMn6GEuTdEBO525GqNnBU6077Avq0W/diqwUguO/Th0AHgA3EhgIK84B71sE3ifObNGc=
x-served-by
cache-ams21078-AMS
access-control-allow-origin
*
last-modified
Mon, 15 Jun 2020 16:15:30 GMT
server
AmazonS3
x-timer
S1603890697.089377,VS0,VE578
date
Wed, 28 Oct 2020 13:11:37 GMT
vary
Origin, Access-Control-Request-Headers, Access-Control-Request-Method
access-control-allow-methods
GET
content-type
application/javascript
via
1.1 varnish
expires
Wed, 15 Jun 2022 16:09:40 GMT
cache-control
max-age=630720000, public
content-length
304067
x-cache-hits
0
cash.js
cash-f.squarecdn.com/ember/a548ae1339eed15b0a557cd7cc8ba0b2f9645ac5/assets/ 		978 KB
188 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cash-f.squarecdn.com/ember/a548ae1339eed15b0a557cd7cc8ba0b2f9645ac5/assets/cash.js
Requested by
Host: login-accountverify.serveuser.com
URL: https://login-accountverify.serveuser.com/cash.app/login.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.193.49 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
66a0e64c291a95a1197f6e2b6a31a0e4dfd0758ae47bdf71581883c7c8c11957

Request headers

Origin
https://login-accountverify.serveuser.com
Referer
https://login-accountverify.serveuser.com/cash.app/login.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id
S3TjYEBP5HNcBBf1k6rOmcNAfiBYUGhG
content-encoding
gzip
etag
"b52a41ede90d2f7dfba0b20cc1717a78"
age
0
accept-ranges
bytes
x-cache
MISS
status
200
x-amz-request-id
9F2F9C216AA4FD6A
x-amz-id-2
MbKWFN/vHu3Q8bxjIHC1kZMRgiXmS8v+oNsJHcTeGsTmAKJLyJ1wKuEy/OSPQBtNUmqRP8z70uw=
x-served-by
cache-ams21078-AMS
access-control-allow-origin
*
last-modified
Mon, 15 Jun 2020 16:15:12 GMT
server
AmazonS3
x-timer
S1603890697.089324,VS0,VE550
date
Wed, 28 Oct 2020 13:11:37 GMT
vary
Origin, Access-Control-Request-Headers, Access-Control-Request-Method
access-control-allow-methods
GET
content-type
application/javascript
via
1.1 varnish
expires
Wed, 15 Jun 2022 16:09:40 GMT
cache-control
max-age=630720000, public
content-length
191890
x-cache-hits
0
cash.css
cash-f.squarecdn.com/ember/a548ae1339eed15b0a557cd7cc8ba0b2f9645ac5/assets/ 		239 KB
36 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cash-f.squarecdn.com/ember/a548ae1339eed15b0a557cd7cc8ba0b2f9645ac5/assets/cash.css
Requested by
Host: login-accountverify.serveuser.com
URL: https://login-accountverify.serveuser.com/cash.app/login.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.193.49 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
0cab6ae142696ceae7265aa7f93941de14df3d4e06ac2487808d4bbf1d8fea0f

Request headers

Origin
https://login-accountverify.serveuser.com
Referer
https://login-accountverify.serveuser.com/cash.app/login.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id
dK2IV6pGFZjDaxsF3EF6wyiVg1lgK63T
content-encoding
gzip
etag
"98a0ce5879cde9e1998fc993ce9ee49a"
age
0
accept-ranges
bytes
x-cache
MISS
status
200
x-amz-request-id
E595FA080D455727
x-amz-id-2
Iq5mi+66w/ZMV6ku13uDP8B4srADIwR4ED3ZhQyOtiBJEgizIrgx+7YDRCfSWFUBNpZAepshxjs=
x-served-by
cache-ams21078-AMS
access-control-allow-origin
*
last-modified
Mon, 15 Jun 2020 16:15:11 GMT
server
AmazonS3
x-timer
S1603890697.089180,VS0,VE308
date
Wed, 28 Oct 2020 13:11:37 GMT
vary
Origin, Access-Control-Request-Headers, Access-Control-Request-Method
access-control-allow-methods
GET
content-type
text/css; charset=UTF-8
via
1.1 varnish
expires
Wed, 15 Jun 2022 16:09:40 GMT
cache-control
max-age=630720000, public
content-length
36429
x-cache-hits
0
cash-market-rounded-medium.woff2
cash-f.squarecdn.com/static/fonts/cashmarket/ 		35 KB
36 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://cash-f.squarecdn.com/static/fonts/cashmarket/cash-market-rounded-medium.woff2
Requested by
Host: cash-f.squarecdn.com
URL: https://cash-f.squarecdn.com/ember/a548ae1339eed15b0a557cd7cc8ba0b2f9645ac5/assets/cash.css
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.193.49 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
32ce0116ec544d7c3a3f10163fabb110f4c8e49be67489b60957badd5acc8bc3

Request headers

Origin
https://login-accountverify.serveuser.com
Referer
https://cash-f.squarecdn.com/ember/a548ae1339eed15b0a557cd7cc8ba0b2f9645ac5/assets/cash.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id
QwN6_sQjcoaVcbAvSytOMCHBm8EkSwWC
content-encoding
gzip
etag
"bb0a7911452d2d17b9bcf766d63e2602"
age
565315
via
1.1 varnish
x-cache
HIT
status
200
x-amz-request-id
BB9D7792A72374E8
x-amz-id-2
+j5yYbANkLoMajkf6rb58AuyNvfJLWZudNw7e36b7LR4bHOqRupF08UIsyo/JqtuW+3GTsvy3vQ=
x-served-by
cache-ams21078-AMS
accept-ranges
bytes
last-modified
Thu, 16 Apr 2020 16:21:46 GMT
server
AmazonS3
x-timer
S1603890698.881999,VS0,VE1
date
Wed, 28 Oct 2020 13:11:37 GMT
content-type
application/octet-stream
access-control-allow-origin
*
expires
Sat, 16 Apr 2022 16:21:45 GMT
cache-control
max-age=630720000, public
content-length
36116
x-cache-hits
1
cash-market-rounded-regular.woff2
cash-f.squarecdn.com/static/fonts/cashmarket/ 		33 KB
33 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://cash-f.squarecdn.com/static/fonts/cashmarket/cash-market-rounded-regular.woff2
Requested by
Host: cash-f.squarecdn.com
URL: https://cash-f.squarecdn.com/ember/a548ae1339eed15b0a557cd7cc8ba0b2f9645ac5/assets/cash.css
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.193.49 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
de531e5c7be5d41643ca0ca0eda3794751eb52275c95a774da8df60ef8729b3b

Request headers

Origin
https://login-accountverify.serveuser.com
Referer
https://cash-f.squarecdn.com/ember/a548ae1339eed15b0a557cd7cc8ba0b2f9645ac5/assets/cash.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id
fr2Z2YmKBOyAxJRH6fj2sFCZPCvGeGJZ
content-encoding
gzip
etag
"438232647d9913a48305142c9fe7721b"
age
1779059
via
1.1 varnish
x-cache
HIT
status
200
x-amz-request-id
F6CFA1992B183EBB
x-amz-id-2
Yqgl+GfdAHYo4qb/alcI0CZFhGbSfm3mz3Zn6yvkmURtC8uyinQuXrBeFcZoat0XhAgVsuJuMnE=
x-served-by
cache-ams21078-AMS
accept-ranges
bytes
last-modified
Thu, 16 Apr 2020 16:21:47 GMT
server
AmazonS3
x-timer
S1603890698.881958,VS0,VE1
date
Wed, 28 Oct 2020 13:11:37 GMT
content-type
application/octet-stream
access-control-allow-origin
*
expires
Sat, 16 Apr 2022 16:21:45 GMT
cache-control
max-age=630720000, public
content-length
33725
x-cache-hits
1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Cash App (Banking)

28 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes function| createDeprecatedModule boolean| runningTests object| loader function| define function| requireModule function| require function| requirejs object| EmberENV function| moment function| $ function| jQuery object| Ember object| Em object| showdown object| Bugsnag object| Placeholders object| FieldKit object| LGTM function| clearAnimationFrame function| Spinner object| cropit function| UAParser function| Fingerprint2 object| CryptoJS

0 Cookies