urlscan.io logo urlscan.io
SecurityTrails logo

appauth.xyz Open in urlscan Pro
93.123.39.95  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://appauth.xyz/Login/card.php
Submission: On March 20 via api from US — Scanned from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 6 HTTP transactions. The main IP is 93.123.39.95, located in Bulgaria and belongs to JAMIEFREE, AU. The main domain is appauth.xyz.
TLS certificate: Issued by R3 on March 18th 2024. Valid for: 3 months.
This is the only time appauth.xyz was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Amazon (Online)

Domain & IP information

IP Address AS Autonomous System
1 93.123.39.95 215420 (JAMIEFREE)
4 2600:9000:26a... 16509 (AMAZON-02)
1 52.117.233.246 36351 (SOFTLAYER)
6 3
Apex Domain
Subdomains		 Transfer
4 ssl-images-amazon.com
images-na.ssl-images-amazon.com — Cisco Umbrella Rank: 933
119 KB
1 credit-card-logos.com
www.credit-card-logos.com
3 KB
1 appauth.xyz
appauth.xyz
11 KB
6 3
Domain Requested by
4 images-na.ssl-images-amazon.com appauth.xyz
images-na.ssl-images-amazon.com
1 www.credit-card-logos.com appauth.xyz
1 appauth.xyz
6 3

This site contains links to these domains. Also see Links.

Domain
www.credit-card-logos.com
Subject Issuer Validity Valid
appauth.xyz
R3		 2024-03-18 -
2024-06-16		 3 months crt.sh
images-na.ssl-images-amazon.com
DigiCert Global CA G2		 2024-01-05 -
2024-12-08		 a year crt.sh
credit-card-logos.com
cPanel, Inc. Certification Authority		 2024-02-06 -
2024-05-06		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://appauth.xyz/Login/card.php
Frame ID: EF19A425583836CCBCEAB869908F15B8
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Amazon Card Verification

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Page Statistics

6
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

133 kB
Transfer

457 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request card.php
appauth.xyz/Login/ 		39 KB
11 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://appauth.xyz/Login/card.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
93.123.39.95 , Bulgaria, ASN215420 (JAMIEFREE, AU),
Reverse DNS
Software
LiteSpeed /
Resource Hash
3812823ab6eaeb3c993541799b1430892754eedd9f96ad70c5aff3159965f608

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36
accept-language
en-US,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Wed, 20 Mar 2024 14:57:24 GMT
server
LiteSpeed
vary
Accept-Encoding
AmazonUI-af9e9b82cae7003c8a1d2f2e239005b802c674a4._V2_.css
images-na.ssl-images-amazon.com/images/G/01/AUIClients/ 		113 KB
17 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://images-na.ssl-images-amazon.com/images/G/01/AUIClients/AmazonUI-af9e9b82cae7003c8a1d2f2e239005b802c674a4._V2_.css
Requested by
Host: appauth.xyz
URL: https://appauth.xyz/Login/card.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:26a0:fe00:1d:d7f6:39d3:d9e1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
02f9e4f6271092d6fa6ac1854427e1ab744a58b9b7f58a02afe29f81a914baec

Request headers

accept-language
en-US,en;q=0.9
Referer
https://appauth.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date
Fri, 26 Jan 2024 04:21:10 GMT
content-encoding
br
via
1.1 141b2a0bfdcf3225afbe04affb901120.cloudfront.net (CloudFront)
age
475029
x-amz-cf-pop
YUL62-P2
edge-cache-tag
x-cache-538,/images/G/01/AUIClients/AmazonUI-af9e9b82cae7003c8a1d2f2e239005b802c674a4
x-nginx-cache-status
HIT
x-cache
Hit from cloudfront
server-timing
provider;desc="cf"
alt-svc
h3=":443"; ma=86400
surrogate-key
x-cache-538 /images/G/01/AUIClients/AmazonUI-af9e9b82cae7003c8a1d2f2e239005b802c674a4
last-modified
Fri, 05 Feb 2016 03:02:58 GMT
server
Server
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=630720000,public
x-amz-ir-id
46febcb8-8b46-4c4d-9643-85453f7bfd27
timing-allow-origin
https://www.amazon.com
x-amz-cf-id
vKoLhQYxVQAXDz707qmNFGlt5jWcXhv_HKWZIVqf3BTkGxQ2S0XwLw==
expires
Thu, 21 Jan 2044 04:21:10 GMT
credit_card_logos_11.gif
www.credit-card-logos.com/images/multiple_credit-card-logos-1/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.credit-card-logos.com/images/multiple_credit-card-logos-1/credit_card_logos_11.gif
Requested by
Host: appauth.xyz
URL: https://appauth.xyz/Login/card.php
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
52.117.233.246 , United States, ASN36351 (SOFTLAYER, US),
Reverse DNS
f6.e9.7534.ip4.static.sl-reverse.com
Software
Apache /
Resource Hash
03fb26259dcd61a5e4d00198b80d02b930ff17f0f422719a0a0faabc4ff48740

Request headers

accept-language
en-US,en;q=0.9
Referer
https://appauth.xyz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

Date
Wed, 20 Mar 2024 14:57:24 GMT
Last-Modified
Thu, 24 Aug 2006 01:26:26 GMT
Server
Apache
Content-Type
image/gif
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
2616
AmazonUI-fbc03652a849303218c5e12c7c84e74950960736._V2_.js
images-na.ssl-images-amazon.com/images/G/01/AUIClients/ 		256 KB
70 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://images-na.ssl-images-amazon.com/images/G/01/AUIClients/AmazonUI-fbc03652a849303218c5e12c7c84e74950960736._V2_.js
Requested by
Host: appauth.xyz
URL: https://appauth.xyz/Login/card.php
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2600:9000:26a0:fe00:1d:d7f6:39d3:d9e1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
16aecd5524ada4c6ff3326d33ac9e3af9cfa3c1ec117de4e0f19966bf0af4b1a

Request headers

Referer
https://appauth.xyz/
Origin
https://appauth.xyz
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date
Mon, 05 Feb 2024 02:24:11 GMT
content-encoding
br
via
1.1 b9608c5d714fa42feebf61497cac7bd4.cloudfront.net (CloudFront)
x-amz-cf-pop
YUL62-P2
age
3085777
x-cache
Hit from cloudfront
edge-cache-tag
x-cache-928,/images/G/01/AUIClients/AmazonUI-fbc03652a849303218c5e12c7c84e74950960736
x-nginx-cache-status
HIT
server-timing
provider;desc="cf",cdn-rid;desc="c2OrPazdiRWG8bf4i6K3WpXKmSjrUZV-_nQ092cMC098IhPvbHeQIQ==",cdn-downstream-fbl;dur=17
alt-svc
h3=":443"; ma=86400
surrogate-key
x-cache-928 /images/G/01/AUIClients/AmazonUI-fbc03652a849303218c5e12c7c84e74950960736
last-modified
Wed, 03 Feb 2016 20:16:14 GMT
server
Server
content-type
application/x-javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=630720000,public
x-amz-ir-id
615ab2e8-905b-4b71-bdb3-5a25033d12cc
timing-allow-origin
https://www.amazon.com
x-amz-cf-id
c2OrPazdiRWG8bf4i6K3WpXKmSjrUZV-_nQ092cMC098IhPvbHeQIQ==
expires
Sun, 31 Jan 2044 02:24:11 GMT
AuthenticationPortalAssets-00b9c7a662fbe8e0a6628e35ea8e99f8b2b11e9f._V2_.js
images-na.ssl-images-amazon.com/images/G/01/AUIClients/ 		24 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://images-na.ssl-images-amazon.com/images/G/01/AUIClients/AuthenticationPortalAssets-00b9c7a662fbe8e0a6628e35ea8e99f8b2b11e9f._V2_.js
Requested by
Host: appauth.xyz
URL: https://appauth.xyz/Login/card.php
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2600:9000:26a0:fe00:1d:d7f6:39d3:d9e1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
7d7566ca5de5262510d5409e340be9ab6f1e5f9730bda17a2ca1538442c01928

Request headers

Referer
https://appauth.xyz/
Origin
https://appauth.xyz
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date
Sun, 03 Mar 2024 06:31:00 GMT
content-encoding
gzip
via
1.1 b9608c5d714fa42feebf61497cac7bd4.cloudfront.net (CloudFront)
x-amz-cf-pop
YUL62-P2
age
1189636
x-cache
Hit from cloudfront
edge-cache-tag
x-cache-047,/images/G/01/AUIClients/AuthenticationPortalAssets-00b9c7a662fbe8e0a6628e35ea8e99f8b2b11e9f
x-nginx-cache-status
HIT
server-timing
provider;desc="cf",cdn-rid;desc="TLDhm_9OrlL9xLtSLzHa3qZcYl76Ox2DCfpMzLu9b01arHVULAlUxA==",cdn-downstream-fbl;dur=17
alt-svc
h3=":443"; ma=86400
surrogate-key
x-cache-047 /images/G/01/AUIClients/AuthenticationPortalAssets-00b9c7a662fbe8e0a6628e35ea8e99f8b2b11e9f
last-modified
Sat, 26 Mar 2016 01:05:52 GMT
server
Server
content-type
application/x-javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=630720000,public
x-amz-ir-id
6acb6122-abb7-4abf-84f3-277cb72bd45c
timing-allow-origin
https://www.amazon.com
x-amz-cf-id
TLDhm_9OrlL9xLtSLzHa3qZcYl76Ox2DCfpMzLu9b01arHVULAlUxA==
expires
Sat, 27 Feb 2044 06:31:00 GMT
AmazonUIBaseCSS-sprite_1x-8fe8c701c7a6f38368f97a8a3f04d5f25875be4d._V2_.png
images-na.ssl-images-amazon.com/images/G/01/AUIClients/ 		24 KB
25 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images-na.ssl-images-amazon.com/images/G/01/AUIClients/AmazonUIBaseCSS-sprite_1x-8fe8c701c7a6f38368f97a8a3f04d5f25875be4d._V2_.png
Requested by
Host: images-na.ssl-images-amazon.com
URL: https://images-na.ssl-images-amazon.com/images/G/01/AUIClients/AmazonUI-af9e9b82cae7003c8a1d2f2e239005b802c674a4._V2_.css#AUIClients/AmazonUI.fr.rendering_engine-not-trident.secure.min
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:26a0:fe00:1d:d7f6:39d3:d9e1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Server /
Resource Hash
84ea8004fab8c9fd2911393bcc36020df3ba4f83e2762425fbe0e79653a8b3f2

Request headers

accept-language
en-US,en;q=0.9
Referer
https://images-na.ssl-images-amazon.com/images/G/01/AUIClients/AmazonUI-af9e9b82cae7003c8a1d2f2e239005b802c674a4._V2_.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date
Thu, 19 Oct 2023 07:03:23 GMT
via
1.1 141b2a0bfdcf3225afbe04affb901120.cloudfront.net (CloudFront)
age
10448910
x-amz-cf-pop
YUL62-P2
edge-cache-tag
x-cache-266,/images/G/01/AUIClients/AmazonUIBaseCSS-sprite_1x-8fe8c701c7a6f38368f97a8a3f04d5f25875be4d
x-nginx-cache-status
HIT
x-cache
Hit from cloudfront
server-timing
provider;desc="cf"
alt-svc
h3=":443"; ma=86400
content-length
24594
surrogate-key
x-cache-266 /images/G/01/AUIClients/AmazonUIBaseCSS-sprite_1x-8fe8c701c7a6f38368f97a8a3f04d5f25875be4d
last-modified
Tue, 20 Oct 2015 02:26:17 GMT
server
Server
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=630720000,public
x-amz-ir-id
7f9400c8-49a7-46c0-88ad-95311f3aac0e
accept-ranges
bytes
timing-allow-origin
https://www.amazon.com
x-amz-cf-id
-83jq_j4pnunlHT4WXs0-_6XW15FevukEkKwALNOBz5EhKq_ZcBaAw==
expires
Wed, 14 Oct 2043 07:03:23 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Amazon (Online)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

number| ue_t0 undefined| cel_widgets object| amzn function| cf function| validateCardNumber function| validateDOB function| validateSSN object| jQuery16404835349267820077

0 Cookies

2 Console Messages

Source Level URL
Text
security warning URL: https://appauth.xyz/Login/card.php
Message:
Mixed Content: The page at 'https://appauth.xyz/Login/card.php' was loaded over HTTPS, but requested an insecure element 'http://www.credit-card-logos.com/images/multiple_credit-card-logos-1/credit_card_logos_11.gif'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security warning URL: https://appauth.xyz/Login/card.php(Line 1354)
Message:
Mixed Content: The page at 'https://appauth.xyz/Login/card.php' was loaded over HTTPS, but requested an insecure element 'http://www.credit-card-logos.com/images/multiple_credit-card-logos-1/credit_card_logos_11.gif'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html