helpcenter.d3dyikh4vfauih.amplifyapp.com Open in urlscan Pro
143.204.98.22 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://helpcenter.d3dyikh4vfauih.amplifyapp.com/#/
Effective URL:
https://helpcenter.d3dyikh4vfauih.amplifyapp.com/
Submission: On March 22 via manual (March 22nd 2024, 4:58:03 pm UTC) from US — Scanned from DE

Summary HTTP 16 Redirects Behaviour Indicators

Summary

This website contacted 6 IPs in 3 countries across 5 domains to perform 16 HTTP transactions. The main IP is 143.204.98.22, located in United States and belongs to AMAZON-02, US. The main domain is helpcenter.d3dyikh4vfauih.amplifyapp.com.
TLS certificate: Issued by Amazon RSA 2048 M02 on March 22nd 2024. Valid for: a year.

This is the only time helpcenter.d3dyikh4vfauih.amplifyapp.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

	IP Address	AS Autonomous System
7	143.204.98.22 143.204.98.22	16509 (AMAZON-02) (AMAZON-02)
2	2606:4700:e4:... 2606:4700:e4::ac40:a31d	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:806::200a	15169 (GOOGLE) (GOOGLE)
2	104.26.12.205 104.26.12.205	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	198.54.126.115 198.54.126.115	22612 (NAMECHEAP...) (NAMECHEAP-NET)
16	6

7 143.204.98.22 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-98-22.fra50.r.cloudfront.net

helpcenter.d3dyikh4vfauih.amplifyapp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:e4::ac40:a31d (United States)

ASN13335 (CLOUDFLARENET, US)

fonts.cdnfonts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:806::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.26.12.205 (None, )

ASN13335 (CLOUDFLARENET, US)

api.ipify.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 198.54.126.115 (United States)

ASN22612 (NAMECHEAP-NET, US)
PTR: server53-5.web-hosting.com

disenx.online	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	amplifyapp.com helpcenter.d3dyikh4vfauih.amplifyapp.com	424 KB
4	disenx.online disenx.online	412 B
2	ipify.org api.ipify.org — Cisco Umbrella Rank: 2857	227 B
2	cdnfonts.com fonts.cdnfonts.com — Cisco Umbrella Rank: 12889	110 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 110
16	5

	Domain	Requested by
7	helpcenter.d3dyikh4vfauih.amplifyapp.com	helpcenter.d3dyikh4vfauih.amplifyapp.com
4	disenx.online	helpcenter.d3dyikh4vfauih.amplifyapp.com
2	api.ipify.org	helpcenter.d3dyikh4vfauih.amplifyapp.com
2	fonts.cdnfonts.com	helpcenter.d3dyikh4vfauih.amplifyapp.com fonts.cdnfonts.com
1	fonts.googleapis.com	helpcenter.d3dyikh4vfauih.amplifyapp.com
16	5

This site contains no links.

Subject Issuer	Validity	Valid
*.d3dyikh4vfauih.amplifyapp.com Amazon RSA 2048 M02	`2024-03-22` - `2025-04-21`	a year	crt.sh
cdnfonts.com GTS CA 1P5	`2024-01-28` - `2024-04-27`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2024-02-26` - `2024-05-20`	3 months	crt.sh
ipify.org GTS CA 1P5	`2024-03-21` - `2024-06-19`	3 months	crt.sh
disenx.online Sectigo RSA Domain Validation Secure Server CA	`2024-03-11` - `2025-03-11`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://helpcenter.d3dyikh4vfauih.amplifyapp.com/
Frame ID: 7F811817888D719A6A7C1F5AF77C2E3A
Requests: 15 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

My Personal Account Was Restricted | Facebook

Detected technologies

Vue.js (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

<[^>]+\sdata-v(?:ue)?-

Page Statistics

16
Requests

100 %
HTTPS

40 %
IPv6

5
Domains

5
Subdomains

6
IPs

3
Countries

535 kB
Transfer

1142 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

16 HTTP transactions
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response helpcenter.d3dyikh4vfauih.amplifyapp.com/	590 B 761 B	338ms 185ms	Document text/html	143.204.98.22 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://helpcenter.d3dyikh4vfauih.amplifyapp.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.22 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-22.fra50.r.cloudfront.net Software AmazonS3 / Resource Hash `79d18b5bcd26c8146182295d5f35c3bc7c54395f4f699d31655550e59ba01d7d` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers accept-ranges bytes alt-svc h3=":443"; ma=86400 cache-control public, max-age=0, s-maxage=2 content-encoding gzip content-type text/html date Fri, 22 Mar 2024 16:57:58 GMT etag "c696ca191ca68bdedf863d677141b501" last-modified Fri, 22 Mar 2024 01:11:19 GMT server AmazonS3 via 1.1 32e4d419823b7f8df8417a8b18c9602c.cloudfront.net (CloudFront) x-amz-cf-id zflnjxvRLw-HP60yJn7hRcWO9LgKnJxh9jJgNSQ9eorIcgLM4eivIw== x-amz-cf-pop FRA50-C1 x-cache Miss from cloudfront
GET H2	200	chunk-vendors.401e5810.js Show response helpcenter.d3dyikh4vfauih.amplifyapp.com/js/	238 KB 79 KB	354ms 352ms	Script application/javascript	143.204.98.22 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://helpcenter.d3dyikh4vfauih.amplifyapp.com/js/chunk-vendors.401e5810.js Requested by Host: helpcenter.d3dyikh4vfauih.amplifyapp.com URL: https://helpcenter.d3dyikh4vfauih.amplifyapp.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.22 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-22.fra50.r.cloudfront.net Software AmazonS3 / Resource Hash `0dd609e0b3285f291364591e091f11dd27e1363701ff402cb1b63e0e47aaa3e5` Request headers accept-language de-DE,de;q=0.9 Referer https://helpcenter.d3dyikh4vfauih.amplifyapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 Response headers date Fri, 22 Mar 2024 16:57:58 GMT content-encoding gzip via 1.1 32e4d419823b7f8df8417a8b18c9602c.cloudfront.net (CloudFront) last-modified Fri, 22 Mar 2024 01:11:19 GMT server AmazonS3 x-amz-cf-pop FRA50-C1 etag "fa7113cd4ab13fd9f1d38264a5ae965d" x-cache Miss from cloudfront content-type application/javascript cache-control public, max-age=0, s-maxage=2 accept-ranges bytes alt-svc h3=":443"; ma=86400 x-amz-cf-id ZJ7x6XAm2tFawsG8p1L5RsTAeHxpv__olNM3KNU7sEZaAlVaNYcDoA==
GET H2	200	app.94aec170.js Show response helpcenter.d3dyikh4vfauih.amplifyapp.com/js/	38 KB 16 KB	197ms 197ms	Script application/javascript	143.204.98.22 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://helpcenter.d3dyikh4vfauih.amplifyapp.com/js/app.94aec170.js Requested by Host: helpcenter.d3dyikh4vfauih.amplifyapp.com URL: https://helpcenter.d3dyikh4vfauih.amplifyapp.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.22 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-22.fra50.r.cloudfront.net Software AmazonS3 / Resource Hash `cfe82838378df0540c9af7f42272c09b6a95f054cfa026b21eab29470b8ec74e` Request headers accept-language de-DE,de;q=0.9 Referer https://helpcenter.d3dyikh4vfauih.amplifyapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 Response headers date Fri, 22 Mar 2024 16:57:58 GMT content-encoding gzip via 1.1 32e4d419823b7f8df8417a8b18c9602c.cloudfront.net (CloudFront) last-modified Fri, 22 Mar 2024 01:11:19 GMT server AmazonS3 x-amz-cf-pop FRA50-C1 etag "7ac94a567416ab851772f556df3ac9f9" x-cache Miss from cloudfront content-type application/javascript cache-control public, max-age=0, s-maxage=2 accept-ranges bytes alt-svc h3=":443"; ma=86400 x-amz-cf-id v47Wc0JyKLtLd9_HEX1SP8Dq0Jg8KDZROJWDsnq8244-6RvX3JH4lg==
GET H2	200	app.1aceff02.css helpcenter.d3dyikh4vfauih.amplifyapp.com/css/	506 KB 84 KB	351ms 351ms	Stylesheet text/css	143.204.98.22 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://helpcenter.d3dyikh4vfauih.amplifyapp.com/css/app.1aceff02.css Requested by Host: helpcenter.d3dyikh4vfauih.amplifyapp.com URL: https://helpcenter.d3dyikh4vfauih.amplifyapp.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 143.204.98.22 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-22.fra50.r.cloudfront.net Software AmazonS3 / Resource Hash `40c58e722eb7415e9cf526f8ed631a7ac61bf0ed9458f2c78024ffbf5a979407` Request headers accept-language de-DE,de;q=0.9 Referer https://helpcenter.d3dyikh4vfauih.amplifyapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 Response headers date Fri, 22 Mar 2024 16:57:58 GMT content-encoding gzip via 1.1 32e4d419823b7f8df8417a8b18c9602c.cloudfront.net (CloudFront) last-modified Fri, 22 Mar 2024 01:11:19 GMT server AmazonS3 x-amz-cf-pop FRA50-C1 etag "29ddcb6f79b8cc5bfe4dc44283336026" x-cache Miss from cloudfront content-type text/css cache-control public, max-age=0, s-maxage=2 accept-ranges bytes alt-svc h3=":443"; ma=86400 x-amz-cf-id 8iXZjq4hh1DdFEigHSWYqw0c-3WWZLLjByTla8G0RmhchPrBZafjAw==
GET H2	200	montserrat fonts.cdnfonts.com/css/	171 B 667 B	158ms 53ms	Stylesheet text/css	2606:4700:e4::ac40:a31d CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://fonts.cdnfonts.com/css/montserrat?styles=17402 Requested by Host: helpcenter.d3dyikh4vfauih.amplifyapp.com URL: https://helpcenter.d3dyikh4vfauih.amplifyapp.com/css/app.1aceff02.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:e4::ac40:a31d , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `ab49cd1175438a92235cea10761e382da5c34a0f167beefbcd30283df19bdbf0` Request headers accept-language de-DE,de;q=0.9 Referer https://helpcenter.d3dyikh4vfauih.amplifyapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 Response headers date Fri, 22 Mar 2024 16:57:59 GMT content-encoding br cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 768346 cf-polished origSize=206 alt-svc h3=":443"; ma=86400 cf-bgj minify last-modified Wed, 13 Mar 2024 19:32:13 GMT server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uKE4WD1KR2w2X5wq5ELLF44%2F%2FwTWnamOPzJzeeEja%2FWsPtCVPs8XrYefxWj%2BXFy6FeWVb%2BSIdI3Gu%2Fg2AbZtX01cvyORMg3XjQtE9TfZ0j9JlCGxOCUNiGkipPX54o%2BTsaaX5Yk4qwpuqSEGogNdU74%3D"}],"group":"cf-nel","max_age":604800} content-type text/css;charset=UTF-8 access-control-allow-origin * cache-control max-age=2678400 cf-ray 8687b94fcfc39737-FRA
GET H2	400	css2 fonts.googleapis.com/	0 0	137ms 48ms	Stylesheet text/html	2a00:1450:4001:806::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css2?family=Montserrat:ital,wght@0,100;0&display=swap Requested by Host: helpcenter.d3dyikh4vfauih.amplifyapp.com URL: https://helpcenter.d3dyikh4vfauih.amplifyapp.com/css/app.1aceff02.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:806::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash Request headers accept-language de-DE,de;q=0.9 Referer https://helpcenter.d3dyikh4vfauih.amplifyapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 Response headers
GET DATA	200 OK	truncated /	8 KB 0		Image image/jpeg
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `0c865955063fd1f865128672d6b8f896678b5b4a095b17b3bea8367fb0d94c92` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 Response headers Content-Type image/jpeg
GET H3	200	metaTextLogo.e8c807fc3bccff5a9b1f.7b511c1b.png helpcenter.d3dyikh4vfauih.amplifyapp.com/img/	72 KB 72 KB	219ms 217ms	Image image/png	143.204.98.22 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://helpcenter.d3dyikh4vfauih.amplifyapp.com/img/metaTextLogo.e8c807fc3bccff5a9b1f.7b511c1b.png Requested by Host: helpcenter.d3dyikh4vfauih.amplifyapp.com URL: https://helpcenter.d3dyikh4vfauih.amplifyapp.com/ Protocol H3 Security QUIC, , AES_128_GCM Server 143.204.98.22 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-22.fra50.r.cloudfront.net Software AmazonS3 / Resource Hash `9f08f9aa36ea4ff172df15351dcc20bbb604c75ec2ae868203eae517005c82c6` Request headers accept-language de-DE,de;q=0.9 Referer https://helpcenter.d3dyikh4vfauih.amplifyapp.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 Response headers date Fri, 22 Mar 2024 16:57:59 GMT via 1.1 ba77f90aac0ddbc2c4c2c02062fac762.cloudfront.net (CloudFront) last-modified Fri, 22 Mar 2024 01:11:19 GMT server AmazonS3 x-amz-cf-pop FRA50-C1 etag "7fe0c84197452b900619714dd637e85c" x-cache Miss from cloudfront content-type image/png cache-control public, max-age=0, s-maxage=2 accept-ranges bytes alt-svc h3=":443"; ma=86400 content-length 73614 x-amz-cf-id FWOVA4JnF77or9KxkBSAm-bOZyhOdwiqXjCHOJJwYEk4ZJHom7xEwg==
GET H2	200	/ Show response api.ipify.org/	21 B 73 B	395ms 179ms	XHR application/json	104.26.12.205 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://api.ipify.org/?format=json Requested by Host: helpcenter.d3dyikh4vfauih.amplifyapp.com URL: https://helpcenter.d3dyikh4vfauih.amplifyapp.com/js/chunk-vendors.401e5810.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.205 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `c8569d70e399e53a5390312dc85f31c52866df7209e3bc1415b3166395358b6f` Request headers Accept application/json, text/plain, / Referer https://helpcenter.d3dyikh4vfauih.amplifyapp.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 Response headers date Fri, 22 Mar 2024 16:57:59 GMT cf-cache-status DYNAMIC server cloudflare vary Origin content-type application/json access-control-allow-origin * cf-ray 8687b951c93a380f-FRA content-length 21
GET H2	200	/ Show response api.ipify.org/	21 B 154 B	392ms 176ms	XHR application/json	104.26.12.205 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://api.ipify.org/?format=json Requested by Host: helpcenter.d3dyikh4vfauih.amplifyapp.com URL: https://helpcenter.d3dyikh4vfauih.amplifyapp.com/js/chunk-vendors.401e5810.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.26.12.205 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `c8569d70e399e53a5390312dc85f31c52866df7209e3bc1415b3166395358b6f` Request headers Accept application/json, text/plain, / Referer https://helpcenter.d3dyikh4vfauih.amplifyapp.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 Response headers date Fri, 22 Mar 2024 16:57:59 GMT cf-cache-status DYNAMIC server cloudflare vary Origin content-type application/json access-control-allow-origin * cf-ray 8687b951c93e380f-FRA content-length 21
POST H2	200	ban Show response disenx.online/api/fetch/	0 206 B	284ms 284ms	XHR text/html	198.54.126.115 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://disenx.online/api/fetch/ban Requested by Host: helpcenter.d3dyikh4vfauih.amplifyapp.com URL: https://helpcenter.d3dyikh4vfauih.amplifyapp.com/js/chunk-vendors.401e5810.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 198.54.126.115 , United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server53-5.web-hosting.com Software LiteSpeed / PHP/8.0.30 Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Accept application/json, text/plain, / Referer https://helpcenter.d3dyikh4vfauih.amplifyapp.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 Content-Type application/json Response headers date Fri, 22 Mar 2024 16:58:00 GMT server LiteSpeed x-powered-by PHP/8.0.30 x-ratelimit-remaining 58 content-type text/html; charset=UTF-8 access-control-allow-origin * cache-control no-cache, private x-turbo-charged-by LiteSpeed x-ratelimit-limit 60 content-length 0
GET H3	200	Montserrat-Regular.woff fonts.cdnfonts.com/s/14883/	109 KB 110 KB	257ms 51ms	Font font/woff	2606:4700:e4::ac40:a31d CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://fonts.cdnfonts.com/s/14883/Montserrat-Regular.woff Requested by Host: fonts.cdnfonts.com URL: https://fonts.cdnfonts.com/css/montserrat?styles=17402 Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:e4::ac40:a31d , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `f1a79919a98c308a9e69e9774bbd7da02c1f8a5083e527d16acd5bb56079fbe4` Request headers Referer https://fonts.cdnfonts.com/css/montserrat?styles=17402 Origin https://helpcenter.d3dyikh4vfauih.amplifyapp.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 Response headers date Fri, 22 Mar 2024 16:57:59 GMT cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 56165 alt-svc h3=":443"; ma=86400 content-length 111676 last-modified Sat, 05 Feb 2022 02:00:37 GMT server cloudflare etag "1b43c-5d73bbbd1bfb5" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9kSmWg12RzRlrWpsbgJA89Vehxn78dnSX1PeV7MO5kgs%2Fj5AQHwMiM0cSHTXuVadI2r%2BV35077FcTp6NcQuqiy25QVWICLsUlZaT0iRQQr2K00HsV9gNV3Gmwad%2F%2BerbEtNIjVk%2B6a9fsOz%2FcYcn18M%3D"}],"group":"cf-nel","max_age":604800} content-type font/woff access-control-allow-origin * cache-control max-age=2678400 accept-ranges bytes cf-ray 8687b951cf688fe3-FRA
GET H3	200	fa-regular-400.b041b1fa4fe241b23445.3580b4a9.woff2 helpcenter.d3dyikh4vfauih.amplifyapp.com/fonts/	24 KB 24 KB	208ms 207ms	Font font/woff2	143.204.98.22 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://helpcenter.d3dyikh4vfauih.amplifyapp.com/fonts/fa-regular-400.b041b1fa4fe241b23445.3580b4a9.woff2 Requested by Host: helpcenter.d3dyikh4vfauih.amplifyapp.com URL: https://helpcenter.d3dyikh4vfauih.amplifyapp.com/css/app.1aceff02.css Protocol H3 Security QUIC, , AES_128_GCM Server 143.204.98.22 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-22.fra50.r.cloudfront.net Software AmazonS3 / Resource Hash `9169d8be7a8177e5a92a4d04b6de7f6504b938573bf4da5889871c4f376d3849` Request headers Referer https://helpcenter.d3dyikh4vfauih.amplifyapp.com/css/app.1aceff02.css Origin https://helpcenter.d3dyikh4vfauih.amplifyapp.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 Response headers date Fri, 22 Mar 2024 16:57:59 GMT content-encoding gzip via 1.1 ba77f90aac0ddbc2c4c2c02062fac762.cloudfront.net (CloudFront) last-modified Fri, 22 Mar 2024 01:11:19 GMT server AmazonS3 x-amz-cf-pop FRA50-C1 etag "747442fa76f1d9a31f9a54a2e8a4b448" x-cache Miss from cloudfront content-type font/woff2 cache-control public, max-age=0, s-maxage=2 accept-ranges bytes alt-svc h3=":443"; ma=86400 x-amz-cf-id uXZv8Fp3elPnlGFjfMGP8SBRqYMCCKbk2t-p7rA-z4Ui24lG-yxwUw==
GET H3	200	fa-solid-900.b6879d41b0852f01ed5b.fd0b155c.woff2 helpcenter.d3dyikh4vfauih.amplifyapp.com/fonts/	147 KB 147 KB	186ms 186ms	Font font/woff2	143.204.98.22 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://helpcenter.d3dyikh4vfauih.amplifyapp.com/fonts/fa-solid-900.b6879d41b0852f01ed5b.fd0b155c.woff2 Requested by Host: helpcenter.d3dyikh4vfauih.amplifyapp.com URL: https://helpcenter.d3dyikh4vfauih.amplifyapp.com/css/app.1aceff02.css Protocol H3 Security QUIC, , AES_128_GCM Server 143.204.98.22 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-98-22.fra50.r.cloudfront.net Software AmazonS3 / Resource Hash `886c86112a804ef1ddd1cb206af4c8c40e34b73c26652ca231404aa35a6b30d9` Request headers Referer https://helpcenter.d3dyikh4vfauih.amplifyapp.com/css/app.1aceff02.css Origin https://helpcenter.d3dyikh4vfauih.amplifyapp.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 Response headers date Fri, 22 Mar 2024 16:57:59 GMT content-encoding gzip via 1.1 ba77f90aac0ddbc2c4c2c02062fac762.cloudfront.net (CloudFront) last-modified Fri, 22 Mar 2024 01:11:19 GMT server AmazonS3 x-amz-cf-pop FRA50-C1 etag "d5e647388e2415268b700d3df2e30a0d" x-cache Miss from cloudfront content-type font/woff2 cache-control public, max-age=0, s-maxage=2 accept-ranges bytes alt-svc h3=":443"; ma=86400 x-amz-cf-id uWu1rN_vVPAAbRw4LaBNUHWg1bgeYRCZBTW3nAgT-bcRwS2JJFS47w==
OPTIONS H2	204	ban disenx.online/api/fetch/	0 0	1541ms 635ms	Preflight text/html	198.54.126.115 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://disenx.online/api/fetch/ban Protocol H2 Security TLS 1.3, , AES_256_GCM Server 198.54.126.115 , United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server53-5.web-hosting.com Software LiteSpeed / PHP/8.0.30 Resource Hash Request headers Accept / Access-Control-Request-Headers content-type Access-Control-Request-Method POST Origin https://helpcenter.d3dyikh4vfauih.amplifyapp.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 Response headers access-control-allow-headers content-type access-control-allow-methods POST access-control-allow-origin * access-control-max-age 0 cache-control no-cache, private content-type text/html; charset=UTF-8 date Fri, 22 Mar 2024 16:58:00 GMT server LiteSpeed vary Access-Control-Request-Method, Access-Control-Request-Headers x-powered-by PHP/8.0.30 x-turbo-charged-by LiteSpeed
POST H2	200	ban Show response disenx.online/api/fetch/	0 206 B	285ms 284ms	XHR text/html	198.54.126.115 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://disenx.online/api/fetch/ban Requested by Host: helpcenter.d3dyikh4vfauih.amplifyapp.com URL: https://helpcenter.d3dyikh4vfauih.amplifyapp.com/js/chunk-vendors.401e5810.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 198.54.126.115 , United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server53-5.web-hosting.com Software LiteSpeed / PHP/8.0.30 Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Accept application/json, text/plain, / Referer https://helpcenter.d3dyikh4vfauih.amplifyapp.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 Content-Type application/json Response headers date Fri, 22 Mar 2024 16:58:00 GMT server LiteSpeed x-powered-by PHP/8.0.30 x-ratelimit-remaining 58 content-type text/html; charset=UTF-8 access-control-allow-origin * cache-control no-cache, private x-turbo-charged-by LiteSpeed x-ratelimit-limit 60 content-length 0
OPTIONS H2	204	ban disenx.online/api/fetch/	0 0	1146ms 634ms	Preflight text/html	198.54.126.115 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL https://disenx.online/api/fetch/ban Protocol H2 Security TLS 1.3, , AES_256_GCM Server 198.54.126.115 , United States, ASN22612 (NAMECHEAP-NET, US), Reverse DNS server53-5.web-hosting.com Software LiteSpeed / PHP/8.0.30 Resource Hash Request headers Accept / Access-Control-Request-Headers content-type Access-Control-Request-Method POST Origin https://helpcenter.d3dyikh4vfauih.amplifyapp.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36 Response headers access-control-allow-headers content-type access-control-allow-methods POST access-control-allow-origin * access-control-max-age 0 cache-control no-cache, private content-type text/html; charset=UTF-8 date Fri, 22 Mar 2024 16:58:00 GMT server LiteSpeed vary Access-Control-Request-Method, Access-Control-Request-Headers x-powered-by PHP/8.0.30 x-turbo-charged-by LiteSpeed

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| webpackChunkfb function| Pusher boolean| __VUE__

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://fonts.googleapis.com/css2?family=Montserrat:ital,wght@0,100;0&display=swap Message: Failed to load resource: the server responded with a status of 400 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api.ipify.org
disenx.online
fonts.cdnfonts.com
fonts.googleapis.com
helpcenter.d3dyikh4vfauih.amplifyapp.com
104.26.12.205
143.204.98.22
198.54.126.115
2606:4700:e4::ac40:a31d
2a00:1450:4001:806::200a
0c865955063fd1f865128672d6b8f896678b5b4a095b17b3bea8367fb0d94c92
0dd609e0b3285f291364591e091f11dd27e1363701ff402cb1b63e0e47aaa3e5
40c58e722eb7415e9cf526f8ed631a7ac61bf0ed9458f2c78024ffbf5a979407
79d18b5bcd26c8146182295d5f35c3bc7c54395f4f699d31655550e59ba01d7d
886c86112a804ef1ddd1cb206af4c8c40e34b73c26652ca231404aa35a6b30d9
9169d8be7a8177e5a92a4d04b6de7f6504b938573bf4da5889871c4f376d3849
9f08f9aa36ea4ff172df15351dcc20bbb604c75ec2ae868203eae517005c82c6
ab49cd1175438a92235cea10761e382da5c34a0f167beefbcd30283df19bdbf0
c8569d70e399e53a5390312dc85f31c52866df7209e3bc1415b3166395358b6f
cfe82838378df0540c9af7f42272c09b6a95f054cfa026b21eab29470b8ec74e
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f1a79919a98c308a9e69e9774bbd7da02c1f8a5083e527d16acd5bb56079fbe4

helpcenter.d3dyikh4vfauih.amplifyapp.com Open in urlscan Pro 143.204.98.22 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

16 Requests

100 %HTTPS

40 %IPv6

5 Domains

5 Subdomains

6 IPs

3 Countries

535 kBTransfer

1142 kBSize

0 Cookies

0 Outgoing links

Redirected requests

16 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

helpcenter.d3dyikh4vfauih.amplifyapp.com Open in urlscan Pro
143.204.98.22 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

16
Requests

100 %
HTTPS

40 %
IPv6

5
Domains

5
Subdomains

6
IPs

3
Countries

535 kB
Transfer

1142 kB
Size

0
Cookies

16 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!