Scan report · about 1 month agoPublic

auth0.com

172.64.150.238AS13335 · US

Submittedhttps://auth0.com/docs/get-started/authentication-and-authorization-flow/device-authorization-flow

Verdict

1 of 7 enginesSuspiciousAutomated

Be careful — warning signs found

Automated

This site shows signs commonly seen in scams or impersonation, but we could not confirm it for certain. It may be a real threat, or it may be a legitimate site that simply looks unusual to our automated checks.

What to do

Avoid entering passwords or payment details until you are sure it is genuine. Open the company directly from its known website or app instead of this link. Check the evidence below and escalate to your analyst if unsure.

"Suspicious" is a caution, not a confirmation — it can be a false alarm. The evidence below explains why it was flagged.

Findings

Strongest first

Suspicious fileSuspicious content in the downloaded file

83391d21-b284-4054-b41d-db91b444ec99.html

Our Content Inspection engine downloaded the file this URL serves and analyzed it. The payload shows traits commonly seen in malware. Treat it as unsafe until verified.

Success

SHA-256 49dda36a00d122e1483503a32e222a4c583d0136bc14fa06e9912393da7c3318

InfoCross-domain scripts injected at runtime

4 script(s)

The page dynamically injected scripts from other domains. This is extremely common on legitimate sites (CDNs, analytics, asset domains) and is shown for context only.

Analyst noteNoisy by itself — a CDN/asset domain (e.g. a brand's own *.githubassets.com) is normal. Only meaningful if the source domain is unrelated/suspicious.

Infrastructure

IP: 172.64.150.238CLOUDFLARENET - Cloudflare, Inc., US · AS13335US
TLS: CN=YE1, O=Let's Encrypt, C=US · expires Nov 20, 2026

WHOIS

Registrar: MarkMonitor Inc.
Created: Oct 18, 2012
Expires: Oct 18, 2027
Nameservers: kolton.ns.cloudflare.commonroe.ns.cloudflare.com

24 malicious9 suspicious

Hashes & fingerprints

Page Hash9090164640d27abbab94700ae3400063183f61eda1d92a012bff048ecdb40eee Favicon Hash454ca8e234fbe44ed092cf63edbb3c8f76ae0b8808462f9a6b0c871f79df9de7 DOM Hash243b53e1c9be94e14fd941f9bd5c221fabdc25c800b19a605dc3a5fd0425bc1e Screenshot pHashb86b9c9c6363c31c JARM27d27d27d00027d00042d43d00041df04c41293ba84f6efe3a613b22f983e6 JA4Xa373a9f83c6b_7022c563de38_2e3757343cb0 Cert ThumbprintC79CE1F3B70874676114073870525A58CB087183 Cert IssuerCN=YE1, O=Let's Encrypt, C=US

Page capture

Live

Title “Device Authorization Flow - Auth0 Docs”

Visit Site

Engines

7 · time to verdict