helpcenter.d19p1wdn50p92l.amplifyapp.com Open in urlscan Pro
108.138.128.94 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://helpcenter.d19p1wdn50p92l.amplifyapp.com/#/
Effective URL:
https://helpcenter.d19p1wdn50p92l.amplifyapp.com/
Submission: On March 20 via manual (March 20th 2024, 11:31:45 am UTC) from US — Scanned from US

Summary HTTP 16 Redirects Behaviour Indicators

Summary

This website contacted 6 IPs in 2 countries across 5 domains to perform 16 HTTP transactions. The main IP is 108.138.128.94, located in United States and belongs to AMAZON-02, US. The main domain is helpcenter.d19p1wdn50p92l.amplifyapp.com.
TLS certificate: Issued by Amazon RSA 2048 M03 on March 19th 2024. Valid for: a year.

This is the only time helpcenter.d19p1wdn50p92l.amplifyapp.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

	IP Address	AS Autonomous System
7	108.138.128.94 108.138.128.94	16509 (AMAZON-02) (AMAZON-02)
2	2606:4700:303... 2606:4700:3036::ac43:b89e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2607:f8b0:400... 2607:f8b0:4006:820::200a	15169 (GOOGLE) (GOOGLE)
4	198.54.126.115 198.54.126.115	22612 (NAMECHEAP...) (NAMECHEAP-NET)
2	104.26.13.205 104.26.13.205	13335 (CLOUDFLAR...) (CLOUDFLARENET)
16	6

7 108.138.128.94 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-138-128-94.jfk50.r.cloudfront.net

helpcenter.d19p1wdn50p92l.amplifyapp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:3036::ac43:b89e (United States)

ASN13335 (CLOUDFLARENET, US)

fonts.cdnfonts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:820::200a (United States)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 198.54.126.115 (United States)

ASN22612 (NAMECHEAP-NET, US)
PTR: server53-5.web-hosting.com

disenx.online	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.26.13.205 (None, )

ASN13335 (CLOUDFLARENET, US)

api.ipify.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	amplifyapp.com helpcenter.d19p1wdn50p92l.amplifyapp.com	424 KB
4	disenx.online disenx.online	412 B
2	ipify.org api.ipify.org — Cisco Umbrella Rank: 2857	229 B
2	cdnfonts.com fonts.cdnfonts.com — Cisco Umbrella Rank: 12889	110 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 110
16	5

	Domain	Requested by
7	helpcenter.d19p1wdn50p92l.amplifyapp.com	helpcenter.d19p1wdn50p92l.amplifyapp.com
4	disenx.online	helpcenter.d19p1wdn50p92l.amplifyapp.com
2	api.ipify.org	helpcenter.d19p1wdn50p92l.amplifyapp.com
2	fonts.cdnfonts.com	helpcenter.d19p1wdn50p92l.amplifyapp.com fonts.cdnfonts.com
1	fonts.googleapis.com	helpcenter.d19p1wdn50p92l.amplifyapp.com
16	5

This site contains no links.

Subject Issuer	Validity	Valid
*.d19p1wdn50p92l.amplifyapp.com Amazon RSA 2048 M03	`2024-03-19` - `2025-04-17`	a year	crt.sh
cdnfonts.com GTS CA 1P5	`2024-01-28` - `2024-04-27`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2024-02-19` - `2024-05-13`	3 months	crt.sh
disenx.online Sectigo RSA Domain Validation Secure Server CA	`2024-03-11` - `2025-03-11`	a year	crt.sh
ipify.org GTS CA 1P5	`2024-01-22` - `2024-04-21`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://helpcenter.d19p1wdn50p92l.amplifyapp.com/
Frame ID: C92B4F0BAAAAFFFED523E9128B272AD9
Requests: 15 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

My Personal Account Was Restricted | Facebook

Detected technologies

Vue.js (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

<[^>]+\sdata-v(?:ue)?-

Page Statistics

16
Requests

100 %
HTTPS

40 %
IPv6

5
Domains

5
Subdomains

6
IPs

2
Countries

535 kB
Transfer

1142 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

16 HTTP transactions
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response helpcenter.d19p1wdn50p92l.amplifyapp.com/	590 B 761 B	609ms 368ms	Document text/html	108.138.128.94 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://helpcenter.d19p1wdn50p92l.amplifyapp.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 108.138.128.94 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-108-138-128-94.jfk50.r.cloudfront.net Software AmazonS3 / Resource Hash `79d18b5bcd26c8146182295d5f35c3bc7c54395f4f699d31655550e59ba01d7d` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 accept-language en-US,en;q=0.9 Response headers accept-ranges bytes alt-svc h3=":443"; ma=86400 cache-control public, max-age=0, s-maxage=2 content-encoding gzip content-type text/html date Wed, 20 Mar 2024 11:31:39 GMT etag "c696ca191ca68bdedf863d677141b501" last-modified Tue, 19 Mar 2024 22:42:56 GMT server AmazonS3 via 1.1 aca1d51e5686fc1a0d5fa390744b2014.cloudfront.net (CloudFront) x-amz-cf-id P4Acr9qSbwQzhh95vb1fi8HqndxwTF1Q7WX99WITkZ__gjEKxxdgZw== x-amz-cf-pop JFK50-P4 x-cache Miss from cloudfront
GET H2	200	chunk-vendors.401e5810.js Show response helpcenter.d19p1wdn50p92l.amplifyapp.com/js/	238 KB 79 KB	374ms 373ms	Script application/javascript	108.138.128.94 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://helpcenter.d19p1wdn50p92l.amplifyapp.com/js/chunk-vendors.401e5810.js Requested by Host: helpcenter.d19p1wdn50p92l.amplifyapp.com URL: https://helpcenter.d19p1wdn50p92l.amplifyapp.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 108.138.128.94 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-108-138-128-94.jfk50.r.cloudfront.net Software AmazonS3 / Resource Hash `0dd609e0b3285f291364591e091f11dd27e1363701ff402cb1b63e0e47aaa3e5` Request headers accept-language en-US,en;q=0.9 Referer https://helpcenter.d19p1wdn50p92l.amplifyapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 Response headers date Wed, 20 Mar 2024 11:31:39 GMT content-encoding gzip via 1.1 aca1d51e5686fc1a0d5fa390744b2014.cloudfront.net (CloudFront) last-modified Tue, 19 Mar 2024 22:42:56 GMT server AmazonS3 x-amz-cf-pop JFK50-P4 etag "fa7113cd4ab13fd9f1d38264a5ae965d" x-cache Miss from cloudfront content-type application/javascript cache-control public, max-age=0, s-maxage=2 accept-ranges bytes alt-svc h3=":443"; ma=86400 x-amz-cf-id eK18YnKFWdkOCNBcOBtKSgtqNDb8mXzLL0AheZIFsC3QkzLfOZnuDw==
GET H2	200	app.94aec170.js Show response helpcenter.d19p1wdn50p92l.amplifyapp.com/js/	38 KB 16 KB	352ms 351ms	Script application/javascript	108.138.128.94 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://helpcenter.d19p1wdn50p92l.amplifyapp.com/js/app.94aec170.js Requested by Host: helpcenter.d19p1wdn50p92l.amplifyapp.com URL: https://helpcenter.d19p1wdn50p92l.amplifyapp.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 108.138.128.94 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-108-138-128-94.jfk50.r.cloudfront.net Software AmazonS3 / Resource Hash `cfe82838378df0540c9af7f42272c09b6a95f054cfa026b21eab29470b8ec74e` Request headers accept-language en-US,en;q=0.9 Referer https://helpcenter.d19p1wdn50p92l.amplifyapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 Response headers date Wed, 20 Mar 2024 11:31:39 GMT content-encoding gzip via 1.1 aca1d51e5686fc1a0d5fa390744b2014.cloudfront.net (CloudFront) last-modified Tue, 19 Mar 2024 22:42:56 GMT server AmazonS3 x-amz-cf-pop JFK50-P4 etag "7ac94a567416ab851772f556df3ac9f9" x-cache Miss from cloudfront content-type application/javascript cache-control public, max-age=0, s-maxage=2 accept-ranges bytes alt-svc h3=":443"; ma=86400 x-amz-cf-id UE0BY6Ab3ErhRO6MWqYwafOhCl3khBhVIbtIaeGSt93c3wDxXZESTw==
GET H2	200	app.1aceff02.css helpcenter.d19p1wdn50p92l.amplifyapp.com/css/	506 KB 84 KB	363ms 363ms	Stylesheet text/css	108.138.128.94 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://helpcenter.d19p1wdn50p92l.amplifyapp.com/css/app.1aceff02.css Requested by Host: helpcenter.d19p1wdn50p92l.amplifyapp.com URL: https://helpcenter.d19p1wdn50p92l.amplifyapp.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 108.138.128.94 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-108-138-128-94.jfk50.r.cloudfront.net Software AmazonS3 / Resource Hash `40c58e722eb7415e9cf526f8ed631a7ac61bf0ed9458f2c78024ffbf5a979407` Request headers accept-language en-US,en;q=0.9 Referer https://helpcenter.d19p1wdn50p92l.amplifyapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 Response headers date Wed, 20 Mar 2024 11:31:39 GMT content-encoding gzip via 1.1 aca1d51e5686fc1a0d5fa390744b2014.cloudfront.net (CloudFront) last-modified Tue, 19 Mar 2024 22:42:56 GMT server AmazonS3 x-amz-cf-pop JFK50-P4 etag "29ddcb6f79b8cc5bfe4dc44283336026" x-cache Miss from cloudfront content-type text/css cache-control public, max-age=0, s-maxage=2 accept-ranges bytes alt-svc h3=":443"; ma=86400 x-amz-cf-id e8En9s1tvimBuBNBhnVDM5w7AB-1CIxT-yCnP1uRIL2kEoCWyh5fmQ==
GET H2	200	montserrat fonts.cdnfonts.com/css/	171 B 664 B	127ms 44ms	Stylesheet text/css	2606:4700:3036::ac43:b89e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://fonts.cdnfonts.com/css/montserrat?styles=17402 Requested by Host: helpcenter.d19p1wdn50p92l.amplifyapp.com URL: https://helpcenter.d19p1wdn50p92l.amplifyapp.com/css/app.1aceff02.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3036::ac43:b89e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `ab49cd1175438a92235cea10761e382da5c34a0f167beefbcd30283df19bdbf0` Request headers accept-language en-US,en;q=0.9 Referer https://helpcenter.d19p1wdn50p92l.amplifyapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 Response headers date Wed, 20 Mar 2024 11:31:40 GMT content-encoding br cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 1866789 cf-polished origSize=206 alt-svc h3=":443"; ma=86400 cf-bgj minify last-modified Tue, 27 Feb 2024 20:58:31 GMT server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7FxIKLEszTATGkHZLsYjaffwsVRcLj2vBNlQbx%2BdH1ubVEyUWlXYQs06VO0ucrOK%2FXjzWqkjhEJJk1Trvdg6tjlmqtj7ousg7AL02Ng%2B6T3TIEOfjzj%2BO471CbWqtJU9Z6696CrVJh3sZX0L9CgOSDQ%3D"}],"group":"cf-nel","max_age":604800} content-type text/css;charset=UTF-8 access-control-allow-origin * cache-control max-age=2678400 cf-ray 86756090d8324c08-MIA
GET H2	400	css2 fonts.googleapis.com/	0 0	221ms 87ms	Stylesheet text/html	2607:f8b0:4006:820::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css2?family=Montserrat:ital,wght@0,100;0&display=swap Requested by Host: helpcenter.d19p1wdn50p92l.amplifyapp.com URL: https://helpcenter.d19p1wdn50p92l.amplifyapp.com/css/app.1aceff02.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2607:f8b0:4006:820::200a , United States, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash Request headers accept-language en-US,en;q=0.9 Referer https://helpcenter.d19p1wdn50p92l.amplifyapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 Response headers
OPTIONS H2	204	ban disenx.online/api/fetch/	0 0	354ms 134ms	Preflight text/html	198.54.126.115 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://disenx.online/api/fetch/ban Protocol H2 Security TLS 1.3, , AES_256_GCM Server 198.54.126.115 , United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server53-5.web-hosting.com Software LiteSpeed / PHP/8.0.30 Resource Hash Request headers Accept / Access-Control-Request-Headers content-type Access-Control-Request-Method POST Origin https://helpcenter.d19p1wdn50p92l.amplifyapp.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 Response headers access-control-allow-headers content-type access-control-allow-methods POST access-control-allow-origin * access-control-max-age 0 cache-control no-cache, private content-type text/html; charset=UTF-8 date Wed, 20 Mar 2024 11:31:40 GMT server LiteSpeed vary Access-Control-Request-Method, Access-Control-Request-Headers x-powered-by PHP/8.0.30 x-turbo-charged-by LiteSpeed
GET DATA	200 OK	truncated /	8 KB 0		Image image/jpeg
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `0c865955063fd1f865128672d6b8f896678b5b4a095b17b3bea8367fb0d94c92` Request headers accept-language en-US,en;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 Response headers Content-Type image/jpeg
GET H3	200	metaTextLogo.e8c807fc3bccff5a9b1f.7b511c1b.png helpcenter.d19p1wdn50p92l.amplifyapp.com/img/	72 KB 72 KB	427ms 426ms	Image image/png	108.138.128.94 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://helpcenter.d19p1wdn50p92l.amplifyapp.com/img/metaTextLogo.e8c807fc3bccff5a9b1f.7b511c1b.png Requested by Host: helpcenter.d19p1wdn50p92l.amplifyapp.com URL: https://helpcenter.d19p1wdn50p92l.amplifyapp.com/ Protocol H3 Security QUIC, , AES_128_GCM Server 108.138.128.94 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-108-138-128-94.jfk50.r.cloudfront.net Software AmazonS3 / Resource Hash `9f08f9aa36ea4ff172df15351dcc20bbb604c75ec2ae868203eae517005c82c6` Request headers accept-language en-US,en;q=0.9 Referer https://helpcenter.d19p1wdn50p92l.amplifyapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 Response headers date Wed, 20 Mar 2024 11:31:40 GMT via 1.1 cd958e502c6aea704f0f824e60431e72.cloudfront.net (CloudFront) last-modified Tue, 19 Mar 2024 22:42:56 GMT server AmazonS3 x-amz-cf-pop JFK50-P4 etag "7fe0c84197452b900619714dd637e85c" x-cache Miss from cloudfront content-type image/png cache-control public, max-age=0, s-maxage=2 accept-ranges bytes alt-svc h3=":443"; ma=86400 content-length 73614 x-amz-cf-id EaT7N87Oo_9-GRB8WYftIF4Xm4D0TraOHKfbChy7G4OCG0ro_1Qe8A==
GET H2	200	/ Show response api.ipify.org/	22 B 74 B	191ms 110ms	XHR application/json	104.26.13.205 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://api.ipify.org/?format=json Requested by Host: helpcenter.d19p1wdn50p92l.amplifyapp.com URL: https://helpcenter.d19p1wdn50p92l.amplifyapp.com/js/chunk-vendors.401e5810.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.13.205 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `5e46da006dd5e19c781e5daf765dadca02037e9fd13ee3a9c302cee627c06771` Request headers Accept application/json, text/plain, / Referer https://helpcenter.d19p1wdn50p92l.amplifyapp.com/ accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 Response headers date Wed, 20 Mar 2024 11:31:40 GMT cf-cache-status DYNAMIC server cloudflare vary Origin content-type application/json access-control-allow-origin * cf-ray 867560927b397445-MIA content-length 22
GET H2	200	/ Show response api.ipify.org/	22 B 155 B	183ms 102ms	XHR application/json	104.26.13.205 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://api.ipify.org/?format=json Requested by Host: helpcenter.d19p1wdn50p92l.amplifyapp.com URL: https://helpcenter.d19p1wdn50p92l.amplifyapp.com/js/chunk-vendors.401e5810.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.13.205 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `5e46da006dd5e19c781e5daf765dadca02037e9fd13ee3a9c302cee627c06771` Request headers Accept application/json, text/plain, / Referer https://helpcenter.d19p1wdn50p92l.amplifyapp.com/ accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 Response headers date Wed, 20 Mar 2024 11:31:40 GMT cf-cache-status DYNAMIC server cloudflare vary Origin content-type application/json access-control-allow-origin * cf-ray 867560927b3b7445-MIA content-length 22
POST H2	200	ban Show response disenx.online/api/fetch/	0 206 B	122ms 121ms	XHR text/html	198.54.126.115 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://disenx.online/api/fetch/ban Requested by Host: helpcenter.d19p1wdn50p92l.amplifyapp.com URL: https://helpcenter.d19p1wdn50p92l.amplifyapp.com/js/chunk-vendors.401e5810.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 198.54.126.115 , United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server53-5.web-hosting.com Software LiteSpeed / PHP/8.0.30 Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Accept application/json, text/plain, / Referer https://helpcenter.d19p1wdn50p92l.amplifyapp.com/ accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 Content-Type application/json Response headers date Wed, 20 Mar 2024 11:31:40 GMT server LiteSpeed x-powered-by PHP/8.0.30 x-ratelimit-remaining 59 content-type text/html; charset=UTF-8 access-control-allow-origin * cache-control no-cache, private x-turbo-charged-by LiteSpeed x-ratelimit-limit 60 content-length 0
GET H3	200	Montserrat-Regular.woff fonts.cdnfonts.com/s/14883/	109 KB 110 KB	112ms 43ms	Font font/woff	2606:4700:3036::ac43:b89e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://fonts.cdnfonts.com/s/14883/Montserrat-Regular.woff Requested by Host: fonts.cdnfonts.com URL: https://fonts.cdnfonts.com/css/montserrat?styles=17402 Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3036::ac43:b89e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `f1a79919a98c308a9e69e9774bbd7da02c1f8a5083e527d16acd5bb56079fbe4` Request headers Referer https://fonts.cdnfonts.com/css/montserrat?styles=17402 Origin https://helpcenter.d19p1wdn50p92l.amplifyapp.com accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 Response headers date Wed, 20 Mar 2024 11:31:40 GMT cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 39180 alt-svc h3=":443"; ma=86400 content-length 111676 last-modified Sat, 05 Feb 2022 02:00:37 GMT server cloudflare etag "1b43c-5d73bbbd1bfb5" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=65A0lYszyNGJK1ciFSPxDKe49fC3AYPEysdoJAde%2Bf3OdVMeqh9yGiCOmi43z7fmMyQeQ6CD43t%2BkG8tom9quHn3qLcYzGpfJzzaCC401vzlpY%2F1K2nYST0ptZ%2FhoYdiF2TR1wnI%2FRYWk3fUchCsXwg%3D"}],"group":"cf-nel","max_age":604800} content-type font/woff access-control-allow-origin * cache-control max-age=2678400 accept-ranges bytes cf-ray 8675609278deda27-MIA
GET H3	200	fa-regular-400.b041b1fa4fe241b23445.3580b4a9.woff2 helpcenter.d19p1wdn50p92l.amplifyapp.com/fonts/	24 KB 24 KB	347ms 347ms	Font font/woff2	108.138.128.94 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://helpcenter.d19p1wdn50p92l.amplifyapp.com/fonts/fa-regular-400.b041b1fa4fe241b23445.3580b4a9.woff2 Requested by Host: helpcenter.d19p1wdn50p92l.amplifyapp.com URL: https://helpcenter.d19p1wdn50p92l.amplifyapp.com/css/app.1aceff02.css Protocol H3 Security QUIC, , AES_128_GCM Server 108.138.128.94 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-108-138-128-94.jfk50.r.cloudfront.net Software AmazonS3 / Resource Hash `9169d8be7a8177e5a92a4d04b6de7f6504b938573bf4da5889871c4f376d3849` Request headers Referer https://helpcenter.d19p1wdn50p92l.amplifyapp.com/css/app.1aceff02.css Origin https://helpcenter.d19p1wdn50p92l.amplifyapp.com accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 Response headers date Wed, 20 Mar 2024 11:31:40 GMT content-encoding gzip via 1.1 cd958e502c6aea704f0f824e60431e72.cloudfront.net (CloudFront) last-modified Tue, 19 Mar 2024 22:42:56 GMT server AmazonS3 x-amz-cf-pop JFK50-P4 etag "747442fa76f1d9a31f9a54a2e8a4b448" x-cache Miss from cloudfront content-type font/woff2 cache-control public, max-age=0, s-maxage=2 accept-ranges bytes alt-svc h3=":443"; ma=86400 x-amz-cf-id Q_gmptIqPJew9OrsklFhya2nuw_vnnoXwbj2eGrQDiQ0SiArVrOmzg==
GET H3	200	fa-solid-900.b6879d41b0852f01ed5b.fd0b155c.woff2 helpcenter.d19p1wdn50p92l.amplifyapp.com/fonts/	147 KB 147 KB	368ms 367ms	Font font/woff2	108.138.128.94 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://helpcenter.d19p1wdn50p92l.amplifyapp.com/fonts/fa-solid-900.b6879d41b0852f01ed5b.fd0b155c.woff2 Requested by Host: helpcenter.d19p1wdn50p92l.amplifyapp.com URL: https://helpcenter.d19p1wdn50p92l.amplifyapp.com/css/app.1aceff02.css Protocol H3 Security QUIC, , AES_128_GCM Server 108.138.128.94 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-108-138-128-94.jfk50.r.cloudfront.net Software AmazonS3 / Resource Hash `886c86112a804ef1ddd1cb206af4c8c40e34b73c26652ca231404aa35a6b30d9` Request headers Referer https://helpcenter.d19p1wdn50p92l.amplifyapp.com/css/app.1aceff02.css Origin https://helpcenter.d19p1wdn50p92l.amplifyapp.com accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 Response headers date Wed, 20 Mar 2024 11:31:40 GMT content-encoding gzip via 1.1 cd958e502c6aea704f0f824e60431e72.cloudfront.net (CloudFront) last-modified Tue, 19 Mar 2024 22:42:56 GMT server AmazonS3 x-amz-cf-pop JFK50-P4 etag "d5e647388e2415268b700d3df2e30a0d" x-cache Miss from cloudfront content-type font/woff2 cache-control public, max-age=0, s-maxage=2 accept-ranges bytes alt-svc h3=":443"; ma=86400 x-amz-cf-id w-BIlCSWHAikMUM2qaom-rdSjGxy1wt0-_pnyxKxDZ_W2FAChGe7oA==
POST H2	200	ban Show response disenx.online/api/fetch/	0 206 B	127ms 126ms	XHR text/html	198.54.126.115 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://disenx.online/api/fetch/ban Requested by Host: helpcenter.d19p1wdn50p92l.amplifyapp.com URL: https://helpcenter.d19p1wdn50p92l.amplifyapp.com/js/chunk-vendors.401e5810.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 198.54.126.115 , United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server53-5.web-hosting.com Software LiteSpeed / PHP/8.0.30 Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Accept application/json, text/plain, / Referer https://helpcenter.d19p1wdn50p92l.amplifyapp.com/ accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 Content-Type application/json Response headers date Wed, 20 Mar 2024 11:31:40 GMT server LiteSpeed x-powered-by PHP/8.0.30 x-ratelimit-remaining 58 content-type text/html; charset=UTF-8 access-control-allow-origin * cache-control no-cache, private x-turbo-charged-by LiteSpeed x-ratelimit-limit 60 content-length 0
OPTIONS H2	204	ban disenx.online/api/fetch/	0 0	168ms 134ms	Preflight text/html	198.54.126.115 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://disenx.online/api/fetch/ban Protocol H2 Security TLS 1.3, , AES_256_GCM Server 198.54.126.115 , United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server53-5.web-hosting.com Software LiteSpeed / PHP/8.0.30 Resource Hash Request headers Accept / Access-Control-Request-Headers content-type Access-Control-Request-Method POST Origin https://helpcenter.d19p1wdn50p92l.amplifyapp.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 Response headers access-control-allow-headers content-type access-control-allow-methods POST access-control-allow-origin * access-control-max-age 0 cache-control no-cache, private content-type text/html; charset=UTF-8 date Wed, 20 Mar 2024 11:31:40 GMT server LiteSpeed vary Access-Control-Request-Method, Access-Control-Request-Headers x-powered-by PHP/8.0.30 x-turbo-charged-by LiteSpeed

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| webpackChunkfb function| Pusher boolean| __VUE__

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://fonts.googleapis.com/css2?family=Montserrat:ital,wght@0,100;0&display=swap Message: Failed to load resource: the server responded with a status of 400 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api.ipify.org
disenx.online
fonts.cdnfonts.com
fonts.googleapis.com
helpcenter.d19p1wdn50p92l.amplifyapp.com
104.26.13.205
108.138.128.94
198.54.126.115
2606:4700:3036::ac43:b89e
2607:f8b0:4006:820::200a
0c865955063fd1f865128672d6b8f896678b5b4a095b17b3bea8367fb0d94c92
0dd609e0b3285f291364591e091f11dd27e1363701ff402cb1b63e0e47aaa3e5
40c58e722eb7415e9cf526f8ed631a7ac61bf0ed9458f2c78024ffbf5a979407
5e46da006dd5e19c781e5daf765dadca02037e9fd13ee3a9c302cee627c06771
79d18b5bcd26c8146182295d5f35c3bc7c54395f4f699d31655550e59ba01d7d
886c86112a804ef1ddd1cb206af4c8c40e34b73c26652ca231404aa35a6b30d9
9169d8be7a8177e5a92a4d04b6de7f6504b938573bf4da5889871c4f376d3849
9f08f9aa36ea4ff172df15351dcc20bbb604c75ec2ae868203eae517005c82c6
ab49cd1175438a92235cea10761e382da5c34a0f167beefbcd30283df19bdbf0
cfe82838378df0540c9af7f42272c09b6a95f054cfa026b21eab29470b8ec74e
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f1a79919a98c308a9e69e9774bbd7da02c1f8a5083e527d16acd5bb56079fbe4

helpcenter.d19p1wdn50p92l.amplifyapp.com Open in urlscan Pro 108.138.128.94 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

16 Requests

100 %HTTPS

40 %IPv6

5 Domains

5 Subdomains

6 IPs

2 Countries

535 kBTransfer

1142 kBSize

0 Cookies

0 Outgoing links

Redirected requests

16 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

helpcenter.d19p1wdn50p92l.amplifyapp.com Open in urlscan Pro
108.138.128.94 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

16
Requests

100 %
HTTPS

40 %
IPv6

5
Domains

5
Subdomains

6
IPs

2
Countries

535 kB
Transfer

1142 kB
Size

0
Cookies

16 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!