Submitted URL: http://chse-authverfy0.from-sd.com/
Effective URL: https://securechase-auth0.info/?token
Submission Tags: @ecarlesi possiblethreat phishing Search All
Submission: On January 04 via api from IT — Scanned from IT

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 8 HTTP transactions. The main IP is 2606:4700:3031::6815:d27, located in United States and belongs to CLOUDFLARENET, US. The main domain is securechase-auth0.info.
TLS certificate: Issued by GTS CA 1P5 on January 3rd 2024. Valid for: 3 months.
This is the only time securechase-auth0.info was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 159.100.9.23 44066 (DE-FIRSTC...)
2 9 2606:4700:303... 13335 (CLOUDFLAR...)
8 2
Apex Domain
Subdomains
Transfer
9 securechase-auth0.info
securechase-auth0.info
19 KB
1 from-sd.com
chse-authverfy0.from-sd.com
2 KB
8 2
Domain Requested by
9 securechase-auth0.info 2 redirects chse-authverfy0.from-sd.com
securechase-auth0.info
1 chse-authverfy0.from-sd.com
8 2

This site contains no links.

Subject Issuer Validity Valid
securechase-auth0.info
GTS CA 1P5
2024-01-03 -
2024-04-02
3 months crt.sh

This page contains 3 frames:

Primary Page: https://securechase-auth0.info/?token
Frame ID: 6F6F80969BCBCA1918D8A67913F6B905
Requests: 4 HTTP requests in this frame

Frame: https://securechase-auth0.info/cdn-cgi/challenge-platform/h/g/scripts/jsd/74bd6362/main.js
Frame ID: EBBA34797817744139FB7B06D523BD1A
Requests: 2 HTTP requests in this frame

Frame: https://securechase-auth0.info/cdn-cgi/challenge-platform/h/g/scripts/jsd/74bd6362/main.js
Frame ID: D3E6B5741593DBC288567147B2D9F0FA
Requests: 2 HTTP requests in this frame

Screenshot

Page Title

403 Forbidden

Page URL History Show full URLs

  1. http://chse-authverfy0.from-sd.com/ Page URL
  2. https://securechase-auth0.info/?token Page URL
  3. https://securechase-auth0.info/?token Page URL

Page Statistics

8
Requests

63 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

20 kB
Transfer

28 kB
Size

11
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://chse-authverfy0.from-sd.com/ Page URL
  2. https://securechase-auth0.info/?token Page URL
  3. https://securechase-auth0.info/?token Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 3
  • https://securechase-auth0.info/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
  • https://securechase-auth0.info/cdn-cgi/challenge-platform/h/g/scripts/jsd/74bd6362/main.js
Request Chain 5
  • https://securechase-auth0.info/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
  • https://securechase-auth0.info/cdn-cgi/challenge-platform/h/g/scripts/jsd/74bd6362/main.js

8 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
/
chse-authverfy0.from-sd.com/
4 KB
2 KB
Document
General
Full URL
http://chse-authverfy0.from-sd.com/
Protocol
HTTP/1.1
Server
159.100.9.23 , Germany, ASN44066 (DE-FIRSTCOLO www.first-colo.net, DE),
Reverse DNS
Software
LiteSpeed /
Resource Hash
1c8fe502bbcc4444ad33f8c1e3eba0dbc80d11192b25cfafb37f00f9e7ce5965

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
accept-language
it-IT,it;q=0.9

Response headers

accept-ranges
bytes
connection
Keep-Alive
content-encoding
gzip
content-length
1317
content-type
text/html
date
Thu, 04 Jan 2024 10:27:46 GMT
etag
"1179-659678a3-1446dd;gz"
last-modified
Thu, 04 Jan 2024 09:21:39 GMT
server
LiteSpeed
vary
Accept-Encoding
/
securechase-auth0.info/
7 KB
8 KB
Document
General
Full URL
https://securechase-auth0.info/?token
Requested by
Host: chse-authverfy0.from-sd.com
URL: http://chse-authverfy0.from-sd.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3031::6815:d27 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ed76f6e210781796b032a30e3c943defc19260874ff42a09b31a50061cd29fdf
Security Headers
Name Value
X-Content-Type-Options nosniff nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block 1; mode=block

Request headers

Referer
http://chse-authverfy0.from-sd.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
accept-language
it-IT,it;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
public, max-age=0 no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-cache-status
DYNAMIC
cf-ray
8402ca8888bf0e4e-MXP
content-type
text/html; charset=utf-8
date
Thu, 04 Jan 2024 10:27:49 GMT
expires
0
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma
no-cache
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pxR%2B%2BJqktKDeG5LRK35M5XBzSWej6ZdgCJNuu73Pmxkhj6wiWmNxAnnnFPNhIjMA42VtWCgrtVV1kPZjXrflcScPeuScGlMyYvQ2nhrLVKbEPJaamjTz2IbRakjcZ%2B%2BfT07EnCZFn9Ojtdt%2F5u%2F%2B7o9afe5x"}],"group":"cf-nel","max_age":604800}
server
cloudflare
x-content-type-options
nosniff nosniff
x-frame-options
SAMEORIGIN
x-xss-protection
1; mode=block 1; mode=block
/
securechase-auth0.info/
0
734 B
XHR
General
Full URL
https://securechase-auth0.info/?token
Requested by
Host: chse-authverfy0.from-sd.com
URL: http://chse-authverfy0.from-sd.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3031::6815:d27 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff, nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block, 1; mode=block

Request headers

X-Requested-TimeStamp-Expire
accept-language
it-IT,it;q=0.9
X-Requested-TimeStamp-Combination
X-Requested-Type-Combination
GET
Content-type
application/x-www-form-urlencoded
X-Requested-Type
GET
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
Referer
https://securechase-auth0.info/?token
lt-PMvXizZCWoLDS-Dacb3vTOb4
WQZb3aZ5T20L94okQ5oXERn-nA
X-Requested-with
XMLHttpRequest
X-Requested-TimeStamp
2p-lsVvcy1kaV0lrv3WZM5gCQis
23252127

Response headers

pragma
no-cache
date
Thu, 04 Jan 2024 10:27:49 GMT
x-server-powered-by
Engintron
x-content-type-options
nosniff, nosniff
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
x-frame-options
SAMEORIGIN
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Kr2LH1qqXW%2BqVF8Q5rkCm3d8uIBWFZO1XQ%2B2y%2BziGhC5%2Bbq%2BT7j6O0ye92H2Kg3nc2VX9%2FZ6%2Bg699WsUe9p6mO0TRidjRGzpddVR28%2F6Xs%2BgrWe5gCZTtIU08Y2YWiNAhsaiCoC3rNL%2BfMHThpu0FqNJAjT3"}],"group":"cf-nel","max_age":604800}
cache-control
public, max-age=0 no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-ray
8402ca896a0d0e4e-MXP
alt-svc
h3=":443"; ma=86400
x-xss-protection
1; mode=block, 1; mode=block
expires
0
main.js
securechase-auth0.info/cdn-cgi/challenge-platform/h/g/scripts/jsd/74bd6362/ Frame EBBA
Redirect Chain
  • https://securechase-auth0.info/cdn-cgi/challenge-platform/scripts/jsd/main.js
  • https://securechase-auth0.info/cdn-cgi/challenge-platform/h/g/scripts/jsd/74bd6362/main.js
7 KB
4 KB
Script
General
Full URL
https://securechase-auth0.info/cdn-cgi/challenge-platform/h/g/scripts/jsd/74bd6362/main.js
Protocol
H2
Server
2606:4700:3031::6815:d27 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0438e51327207e3ba1f549db4b395b51e5c72f67055ff007957071ad3afb0da8
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
it-IT,it;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date
Thu, 04 Jan 2024 10:27:49 GMT
content-encoding
br
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
accept-encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ouIOlMX%2FY%2BDGZstdWEGSIuU5wzQujxU0XYaiDDu%2B4fbja6FXAukraYdeqaBz8e1o2pteXvQIZzyST6D0UnHw%2BF8o%2FLN1WNUny3SQbMuXkL1rfvSJDnx%2BM63d0%2FZgvaReYKm07ng20aM%2Bnyqq%2FEWTbrw%2BrCH1"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=UTF-8
cache-control
max-age=14400, public
cf-ray
8402ca899a650e4e-MXP
alt-svc
h3=":443"; ma=86400

Redirect headers

date
Thu, 04 Jan 2024 10:27:49 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
accept-encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2NPtFh6ND3GkrtnnCUvoB0FjTxXasBR%2FupR1IkNJBjpV8D7ETIt09bdtiZSBYU2137ZOBl2M4hqSCw2q8KlVCEng0LOfZgDSkacaGUwGtTSDBtLBKOmpHmHOnrWujmUdt5iS9PrI7hZLg6wHLC0fuh6viKNM"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
location
/cdn-cgi/challenge-platform/h/g/scripts/jsd/74bd6362/main.js
cache-control
max-age=300, public
cf-ray
8402ca896a1c0e4e-MXP
alt-svc
h3=":443"; ma=86400
8402ca8888bf0e4e
securechase-auth0.info/cdn-cgi/challenge-platform/h/g/jsd/r/ Frame EBBA
0
604 B
XHR
General
Full URL
https://securechase-auth0.info/cdn-cgi/challenge-platform/h/g/jsd/r/8402ca8888bf0e4e
Requested by
Host: securechase-auth0.info
URL: https://securechase-auth0.info/cdn-cgi/challenge-platform/scripts/jsd/main.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::6815:d27 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Referer
accept-language
it-IT,it;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
Content-Type
application/json

Response headers

date
Thu, 04 Jan 2024 10:27:49 GMT
content-encoding
br
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mj68XhZIu1K9bm3Wj5DiKjzGBjfoeGYVNj74Q4NU7VL80SpHrTjrZsXmhZnwU5zXFsq78bIKJiYIClRUIMJlpNRWp0NO%2BkWttFJK64OpTzXwoqvH%2BpuNn7OmpUq2MgTRjDbHZEpXMvwGcRlRXMcYy7Scjims"}],"group":"cf-nel","max_age":604800}
content-type
text/plain; charset=UTF-8
cf-ray
8402ca8a2b54bb14-MXP
alt-svc
h3=":443"; ma=86400
Primary Request /
securechase-auth0.info/
2 KB
1011 B
Document
General
Full URL
https://securechase-auth0.info/?token
Requested by
Host: chse-authverfy0.from-sd.com
URL: http://chse-authverfy0.from-sd.com/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::6815:d27 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
51204cd16060000666d535f400f8dc184cd11f5476e97d5db123bbc07c28e6b3
Security Headers
Name Value
X-Content-Type-Options nosniff nosniff
X-Xss-Protection 1; mode=block 1; mode=block

Request headers

Referer
https://securechase-auth0.info/?token
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
accept-language
it-IT,it;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
8402ca8a2b58bb14-MXP
content-encoding
br
content-type
text/html
date
Thu, 04 Jan 2024 10:27:49 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pAyEn05btdt9wWpeU2x0%2Bt8JWRdNhxi9XaWNRlfZaxnK6OZs%2B6ras2MAg3N5ZAumIiq0mXsBDH%2BfP29gPepLNsxrguHrbvYhB8Z%2B4IZT7QWUeE8fIwb6N3zoBeOYftUAaEefpBCBpmbcJtHhiLNcD3Sln1Mh"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
x-content-type-options
nosniff nosniff
x-xss-protection
1; mode=block 1; mode=block
main.js
securechase-auth0.info/cdn-cgi/challenge-platform/h/g/scripts/jsd/74bd6362/ Frame D3E6
Redirect Chain
  • https://securechase-auth0.info/cdn-cgi/challenge-platform/scripts/jsd/main.js
  • https://securechase-auth0.info/cdn-cgi/challenge-platform/h/g/scripts/jsd/74bd6362/main.js
7 KB
4 KB
Script
General
Full URL
https://securechase-auth0.info/cdn-cgi/challenge-platform/h/g/scripts/jsd/74bd6362/main.js
Protocol
H3
Server
2606:4700:3031::6815:d27 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
945ff3edae579f597185f7f33ec87532622fb006aceab809ccbda32c6eddedc3
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
it-IT,it;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date
Thu, 04 Jan 2024 10:27:49 GMT
content-encoding
br
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
accept-encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kuDrqsMvEQKS53sd%2Fx8tHKjFkRF%2BcT7NGqqgfr1d7pzmaOKJrQsAT2jnhf%2FAr8xgKu3UbQVUwJaqtXCu3iOU0bLN1EQS7rmFyKhh%2F4U04ZlE%2F8IvoFblsj8Y%2Fs%2Bz7uHXTrOgOgqW%2FKOeVdCK5p5omcgjgOgr"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=UTF-8
cache-control
max-age=14400, public
cf-ray
8402ca8b2d03bb14-MXP
alt-svc
h3=":443"; ma=86400

Redirect headers

date
Thu, 04 Jan 2024 10:27:49 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
accept-encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7tQNEorEhq7v5n48qaY2kqI3P5UYtHPeFIN0AUOrtCc9celYn6CJg0dEs%2BHkqPztgDd7lXRWpF5SBsrS7arAlIHH5zAwW%2Fzh4Qm7OQQee7cJY9SrJdl7%2BDrmPNTLOMcACKCbsp6fxpVYpqkE2r0vdoedJLNF"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin
*
location
/cdn-cgi/challenge-platform/h/g/scripts/jsd/74bd6362/main.js
cache-control
max-age=300, public
cf-ray
8402ca8b0ccabb14-MXP
alt-svc
h3=":443"; ma=86400
8402ca8a2b58bb14
securechase-auth0.info/cdn-cgi/challenge-platform/h/g/jsd/r/ Frame D3E6
0
569 B
XHR
General
Full URL
https://securechase-auth0.info/cdn-cgi/challenge-platform/h/g/jsd/r/8402ca8a2b58bb14
Requested by
Host: securechase-auth0.info
URL: https://securechase-auth0.info/cdn-cgi/challenge-platform/scripts/jsd/main.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::6815:d27 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
accept-language
it-IT,it;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
Content-Type
application/json

Response headers

date
Thu, 04 Jan 2024 10:27:49 GMT
content-encoding
br
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2cHVGIA6r9v3uUpumKZBFl2o79KTI3oHO1glWtpNBnE%2FuorOCwgYjkx26qQymDpl4%2Bf8aA79ROUetdiViSjqVQGhY9wbao2gFamepGuve%2BUKC7xfGtlaEQ%2BWzPfYSOj1CDCRLJV%2BoXTAea4mk77nMdgMZRzD"}],"group":"cf-nel","max_age":604800}
content-type
text/plain; charset=UTF-8
cf-ray
8402ca8c1e6bbb14-MXP
alt-svc
h3=":443"; ma=86400

Verdicts & Comments Add Verdict or Comment

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| documentPictureInPicture

11 Cookies

Domain/Path Name / Value
securechase-auth0.info/ Name: fV8v0GLj6A1MX1Wbq78SLJo0qiw
Value: v1OiWKeL0UQ7sX0py4_29eodKms
securechase-auth0.info/ Name: uIY6G4v2V73GjUm2pGRpzGGfQFI
Value: 1704364067
securechase-auth0.info/ Name: 08f2Xd6R8d_l3bAgiBhSl1U164E
Value: 1704450467
securechase-auth0.info/ Name: cRL2zwD62q93IV1vHt6MO1n7ZHw
Value: _bzB1IHU1MXnd_-K7nx85kKpvN8
securechase-auth0.info/ Name: hpPg85HwsVc0RKef6nHkQ2taBCY
Value: fmC0OvRs9pex3qCYtnJLxo5Z9hk
securechase-auth0.info/ Name: ZY_9KxQ3foeb8T4c6UrKCq5hDM8
Value: nnmiDvuag25wgIz_lr35H6tgKa8
securechase-auth0.info/ Name: GZH22g_kfKVeh4k-DN4ws6FN7IM
Value: 1704364069
securechase-auth0.info/ Name: NkI8OgTf8gIY6aoDrnsQdjFAl9c
Value: 1704450469
securechase-auth0.info/ Name: jnuf0jYNhP6dVUm4LHFRrA-1q2A
Value: DX4Spo7kDQ0UCuI3Fc4b0Zf9F5c
securechase-auth0.info/ Name: tt1Zf3IP1qO8J56RztLGTda9_XU
Value: NftvFXOCAMam4kvno5jZtCl63E4
.securechase-auth0.info/ Name: cf_clearance
Value: Zmocxc9bn5M6HWqcYf5hQ_qluejkBswk2DqW8.mDeyY-1704364069-0-2-4321c7bf.409340d1.173883b0-0.2.1704364069

2 Console Messages

Source Level URL
Text
network error URL: https://securechase-auth0.info/?token
Message:
Failed to load resource: the server responded with a status of 503 ()
network error URL: https://securechase-auth0.info/?token
Message:
Failed to load resource: the server responded with a status of 403 ()