Urlyze
Scan report · about 1 month agoPublic

httpbin.org

44.195.8.204AS16509 · US
Submittedhttps://httpbin.org/base64/PGh0bWw-PGJvZHk-PC9ib2R5PjxzY3JpcHQ-CnZhciBnPU9iamVjdC5nZXRPd25Qcm9wZXJ0eU5hbWVzLFM9SlNPTi5zdHJpbmdpZnk7CmZ1bmN0aW9uIHRzKGYpe3RyeXtyZXR1cm4gRnVuY3Rpb24ucHJvdG90eXBlLnRvU3RyaW5nLmNhbGwoZikuc2xpY2UoMCwyNil9Y2F0Y2goZSl7cmV0dXJuJ0VSUid9fQp2YXIgZT17fTt0cnl7ZG9jdW1lbnQuY3JlYXRlRXZlbnQoIlRvdWNoRXZlbnQiKX1jYXRjaCh4KXtlLnRvdWNoPXgubmFtZX0KdmFyIHdnPW51bGw7dHJ5e3ZhciBjPWRvY3VtZW50LmNyZWF0ZUVsZW1lbnQoJ2NhbnZhcycpLmdldENvbnRleHQoJ3dlYmdsJyksZD1jLmdldEV4dGVuc2lvbignV0VCR0xfZGVidWdfcmVuZGVyZXJfaW5mbycpO3dnPWMuZ2V0UGFyYW1ldGVyKGQuVU5NQVNLRURfVkVORE9SX1dFQkdMKSsnIHwgJytjLmdldFBhcmFtZXRlcihkLlVOTUFTS0VEX1JFTkRFUkVSX1dFQkdMKX1jYXRjaCh4KXtlLndlYmdsPXgubmFtZX0KdmFyIHQxO3RyeXtmdW5jdGlvbiBCKCl7fXZhciBuPTA7Qi50b1N0cmluZz1mdW5jdGlvbigpeysrbjtyZXR1cm4nJ307Y29uc29sZS5sb2coQik7dDE9bn1jYXRjaCh4KXt0MT0nRVJSJ30KdmFyIHc9Zyh3aW5kb3cpOwp2YXIgbz17bmF2OmcobmF2aWdhdG9yKSxkb2M6Zyhkb2N1bWVudCksc2NyOmcoc2NyZWVuKSx3aW5OOncubGVuZ3RoLAp3aW5PZGQ6dy5maWx0ZXIoZnVuY3Rpb24oayl7cmV0dXJuIC9eKF9ffGNkY18pLy50ZXN0KGspfSksCnVhOm5hdmlnYXRvci51c2VyQWdlbnQsYXY6bmF2aWdhdG9yLmFwcFZlcnNpb24scGxhdDpuYXZpZ2F0b3IucGxhdGZvcm0sd2Q6bmF2aWdhdG9yLndlYmRyaXZlciwKbGFuZzpTdHJpbmcobmF2aWdhdG9yLmxhbmd1YWdlcyksaHdjOm5hdmlnYXRvci5oYXJkd2FyZUNvbmN1cnJlbmN5LG1lbTpuYXZpZ2F0b3IuZGV2aWNlTWVtb3J5LApwbHVnOlN0cmluZyhuYXZpZ2F0b3IucGx1Z2lucyksbWltZTpTdHJpbmcobmF2aWdhdG9yLm1pbWVUeXBlcyksY29ubjpTdHJpbmcobmF2aWdhdG9yLmNvbm5lY3Rpb24pLApsb2c6dHMoY29uc29sZS5sb2cpLGNlOnRzKGRvY3VtZW50LmNyZWF0ZUVsZW1lbnQpLHRvc3RyaW5nOnQxLGNsb3N1cmU6KGZ1bmN0aW9uKCl7fSkudG9TdHJpbmcoKSwKZXJyb3JzOmUsd2ViZ2w6d2csdHo6bmV3IERhdGUoKS5nZXRUaW1lem9uZU9mZnNldCgpLApzY3J2OltzY3JlZW4ud2lkdGgsc2NyZWVuLmhlaWdodCxzY3JlZW4uYXZhaWxXaWR0aCxzY3JlZW4uYXZhaWxIZWlnaHQsc2NyZWVuLmNvbG9yRGVwdGgsc2NyZWVuLnBpeGVsRGVwdGhdLApvdXRlcjpbb3V0ZXJXaWR0aCxvdXRlckhlaWdodF0sdmlzOmRvY3VtZW50LnZpc2liaWxpdHlTdGF0ZSxoaWQ6ZG9jdW1lbnQuaGlkZGVufTsKdmFyIHM9UyhvKTtkb2N1bWVudC50aXRsZT1zLnNsaWNlKDAsMzAwKTtkb2N1bWVudC5ib2R5LnRleHRDb250ZW50PXM7Cjwvc2NyaXB0PjwvaHRtbD4=
Verdict
Own this site?

Be careful — warning signs found

Automated

Its page title claims to be Apple, which this address is not associated with. This site shows signs commonly seen in scams or impersonation, but we could not confirm it for certain. It may be a real threat, or it may be a legitimate site that simply looks unusual to our automated checks.

What to do

Avoid entering passwords or payment details until you are sure it is genuine. Open the company directly from its known website or app instead of this link. Check the evidence below and escalate to your analyst if unsure.

"Suspicious" is a caution, not a confirmation — it can be a false alarm. The evidence below explains why it was flagged.

Findings

Strongest first
Suspicious fileSuspicious content in the downloaded file
aef2afe8-4cbd-4ef5-be31-ed2a5f4c03b2.html

Our Content Inspection engine downloaded the file this URL serves and analyzed it. The payload shows traits commonly seen in malware. Treat it as unsafe until verified.

Success

SHA-256 b12c6270ff9e04c19c7d28e26cbb4a65b54b5cf6016aa722ae8e7ec02e728803

InfoBrand impersonation detected
Apple · medium

The page presents itself as a known brand (brand keywords/branding detected).

Analyst noteLow/medium confidence (keyword only) — can be a news article or partner page. Corroborate before acting.

Infrastructure

IP
44.195.8.204AMAZON-02 - Amazon.com, Inc., US · AS16509US
TLS
CN=Amazon RSA 2048 M01, O=Amazon, C=US · expires Jan 2, 2027
1 malicious6 suspicious

Hashes & fingerprints

Page Hash1bb2024feef4c44c2715cef99a67403cad619a273e3c1daf6a0259866b8afb48Screenshot pHash8007ff00ff03ff03JARM29d29d00029d29d21c29d29d29d29d3ffaa8e1bc320d2170056165032c5661JA4Xa373a9f83c6b_7022c563de38_2cdf432ec278Cert ThumbprintBE9290DBBE708216AE8B6BF2FB270A9E28308504Cert IssuerCN=Amazon RSA 2048 M01, O=Amazon, C=US

Page capture

Live

Title “{"nav":[],"doc":["location","execCommand"],"scr":[],"winN":1243,"winOdd":["__stealth_markNative","__urlyze"],"ua":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36","av":"5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like” · brand shown: Apple (medium)

Visit Site

Engines

7 · time to verdict

Page

HTTP
200 · Completed
Title
{"nav":[],"doc":["location","execCommand"],"scr":[],"winN":1243,"winOdd":["__stealth_markNative","__urlyze"],"ua":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36","av":"5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like
Load
0.93 s · 1 requests
Stack · 2gunicornPython