urlscan.io logo urlscan.io
SecurityTrails logo

sp0tify-secured2.com Open in urlscan Pro
91.210.107.119  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: http://sp0tify-secured2.com/
Submission: On April 22 via api from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 4 HTTP transactions. The main IP is 91.210.107.119, located in Russian Federation and belongs to NCONNECT-AS, RU. The main domain is sp0tify-secured2.com.
This is the only time sp0tify-secured2.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Spotify (Online)

Domain & IP information

IP Address AS Autonomous System
2 91.210.107.119 49335 (NCONNECT-AS)
2 151.101.13.194 54113 (FASTLY)
4 3
Domain Requested by
2 sp-bootstrap.global.ssl.fastly.net
2 sp0tify-secured2.com sp0tify-secured2.com
4 2

This site contains links to these domains. Also see Links.

Domain
accounts.spotify.com
www.spotify.com
Subject Issuer Validity Valid
*.freetls.global.fastly.net
GlobalSign CloudSSL CA - SHA256 - G3		 2020-04-21 -
2021-04-22		 a year crt.sh

This page contains 1 frames:

Primary Page: http://sp0tify-secured2.com/
Frame ID: 665BC1471E346F1B3FDE853EEDA306BD
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /^LiteSpeed$/i

Page Statistics

4
Requests

50 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

194 kB
Transfer

441 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
sp0tify-secured2.com/ 		6 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://sp0tify-secured2.com/
Protocol
HTTP/1.1
Server
91.210.107.119 , Russian Federation, ASN49335 (NCONNECT-AS, RU),
Reverse DNS
Software
LiteSpeed / PHP/7.3.16
Resource Hash
6c56a4d0a14965f353d8c9a74c20d2811f7ec8c12812ea587c386bed406ccc3d

Request headers

Host
sp0tify-secured2.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding
gzip, deflate
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Connection
Keep-Alive
X-Powered-By
PHP/7.3.16
Content-Type
text/html; charset=UTF-8
Content-Length
2057
Content-Encoding
gzip
Vary
Accept-Encoding
Date
Wed, 22 Apr 2020 11:55:58 GMT
Server
LiteSpeed
index.css
sp0tify-secured2.com/css/ 		289 KB
49 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://sp0tify-secured2.com/css/index.css
Requested by
Host: sp0tify-secured2.com
URL: http://sp0tify-secured2.com/
Protocol
HTTP/1.1
Server
91.210.107.119 , Russian Federation, ASN49335 (NCONNECT-AS, RU),
Reverse DNS
Software
LiteSpeed /
Resource Hash
7ad0874abe3e28a8ecdb0183b9772aff858bdbd8cf30354dfd2f0d62f82da178

Request headers

Referer
http://sp0tify-secured2.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 22 Apr 2020 11:55:58 GMT
Content-Encoding
gzip
Last-Modified
Mon, 29 Jul 2019 22:27:18 GMT
Server
LiteSpeed
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
public, max-age=604800
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
49366
Expires
Wed, 29 Apr 2020 11:55:58 GMT
truncated
/ 		4 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
7cd549fde0242f32cac05b1f4b9f2abd3d8a585bb71c8a4cade6bbb09c792333

Request headers

Referer
http://sp0tify-secured2.com/css/index.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf-8
circular-bold.woff2
sp-bootstrap.global.ssl.fastly.net/8.2.2/fonts/ 		74 KB
74 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://sp-bootstrap.global.ssl.fastly.net/8.2.2/fonts/circular-bold.woff2
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.13.194 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
fdf0e3938479eb6e108e7869436051b7072b9a18ecb98b3c6b49d1b29d8bc758

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
http://sp0tify-secured2.com/css/index.css
Origin
http://sp0tify-secured2.com

Response headers

x-amz-version-id
TDlpjh8XnMfSnl8U7srALu30tKtksNyW
Via
1.1 varnish, 1.1 varnish
ETag
"c094813cfe6be5d188f4e506b6ffca1b"
Age
600834
X-Cache
HIT, HIT
Connection
keep-alive
Content-Length
75488
x-amz-id-2
LIKaDZsqg8DyKsfwJLlFXmKBH39eVUeUTEtj6y4qxp63LWVgladE0IhN66zKJiSIHn4s0D047NI=
X-Served-By
cache-dca17741-DCA, cache-fra19162-FRA
Last-Modified
Tue, 06 Mar 2018 19:26:26 GMT
Server
AmazonS3
X-Timer
S1587556558.391557,VS0,VE2
Date
Wed, 22 Apr 2020 11:55:58 GMT
x-amz-request-id
A13417D8CCB9A8E9
Access-Control-Allow-Origin
*
Expires
Wed, 06 Mar 2019 19:26:24 GMT
Cache-Control
max-age=31536000
Accept-Ranges
bytes
Content-Type
application/font-woff
X-Cache-Hits
1, 1
circular-book.woff2
sp-bootstrap.global.ssl.fastly.net/8.2.2/fonts/ 		68 KB
69 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://sp-bootstrap.global.ssl.fastly.net/8.2.2/fonts/circular-book.woff2
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.13.194 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
6384070e855e2ec15caefb6334ab2c4b1b9e798ce2e369cc00f0d47a41138e0d

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
http://sp0tify-secured2.com/css/index.css
Origin
http://sp0tify-secured2.com

Response headers

x-amz-version-id
kd.JhIt55Js84SKgcOZbomGqUEm372NI
Via
1.1 varnish, 1.1 varnish
ETag
"c4f753e765823b94234e7f5ccd733f44"
Age
2221811
X-Cache
HIT, HIT
Connection
keep-alive
Content-Length
70092
x-amz-id-2
cL7eq9qD0CipELbD/ENKrLJbv6DtpEL0oz72XFh7Bja5C8b04O9l8DEjS5wya/JJWUcSL5qSkGo=
X-Served-By
cache-dca17771-DCA, cache-fra19171-FRA
Last-Modified
Tue, 06 Mar 2018 19:26:26 GMT
Server
AmazonS3
X-Timer
S1587556558.394190,VS0,VE1
Date
Wed, 22 Apr 2020 11:55:58 GMT
x-amz-request-id
04821361E6631C4B
Access-Control-Allow-Origin
*
Expires
Wed, 06 Mar 2019 19:26:24 GMT
Cache-Control
max-age=31536000
Accept-Ranges
bytes
Content-Type
application/font-woff
X-Cache-Hits
1, 1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Spotify (Online)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate

0 Cookies