www.gpt-investor.de
Open in
urlscan Pro
2606:4700:3036::ac43:9b0e
Malicious Activity!
Public Scan
Effective URL: https://www.gpt-investor.de/
Submission: On September 12 via api from NL — Scanned from NL
Summary
TLS certificate: Issued by WE1 on August 20th 2024. Valid for: 3 months.
This is the only time www.gpt-investor.de was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Cloudflare (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 172.67.171.126 172.67.171.126 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 6 | 2606:4700:303... 2606:4700:3036::ac43:9b0e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
4 | 172.67.155.14 172.67.155.14 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 104.18.95.41 104.18.95.41 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
14 | 5 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
10 |
gpt-investor.de
1 redirects
www.gpt-investor.de |
84 KB |
2 |
cloudflare.com
challenges.cloudflare.com — Cisco Umbrella Rank: 3877 |
15 KB |
1 |
swisstrading.info
www.swisstrading.info |
676 B |
14 | 3 |
Domain | Requested by | |
---|---|---|
10 | www.gpt-investor.de |
1 redirects
www.swisstrading.info
www.gpt-investor.de |
2 | challenges.cloudflare.com |
www.gpt-investor.de
challenges.cloudflare.com |
1 | www.swisstrading.info | |
14 | 3 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.cloudflare.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
swisstrading.info WE1 |
2024-09-12 - 2024-12-11 |
3 months | crt.sh |
gpt-investor.de WE1 |
2024-08-20 - 2024-11-18 |
3 months | crt.sh |
challenges.cloudflare.com WE1 |
2024-09-05 - 2024-12-04 |
3 months | crt.sh |
This page contains 2 frames:
Primary Page:
https://www.gpt-investor.de/
Frame ID: 91417B1844C0120D35C76093024B2C1E
Requests: 11 HTTP requests in this frame
Frame:
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/npck4/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/normal/auto/
Frame ID: AC089D09D524854E285981D3989622B2
Requests: 1 HTTP requests in this frame
Screenshot
Page Title
Even geduld...Page URL History Show full URLs
-
http://www.swisstrading.info/
HTTP 307
https://www.swisstrading.info/ Page URL
- https://www.gpt-investor.de/ Page URL
-
https://www.gpt-investor.de/cdn-cgi/phish-bypass?atok=IJNm6p7Bv.X2X.H8xwy_MhIZ.cIwy7GaD.0fEGyA_Ow-172612...
HTTP 301
https://www.gpt-investor.de/ Page URL
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: Cloudflare
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://www.swisstrading.info/
HTTP 307
https://www.swisstrading.info/ Page URL
- https://www.gpt-investor.de/ Page URL
-
https://www.gpt-investor.de/cdn-cgi/phish-bypass?atok=IJNm6p7Bv.X2X.H8xwy_MhIZ.cIwy7GaD.0fEGyA_Ow-1726121030-0.0.1.1-%2F
HTTP 301
https://www.gpt-investor.de/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://www.swisstrading.info/ HTTP 307
- https://www.swisstrading.info/
14 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H3 |
/
www.swisstrading.info/ Redirect Chain
|
356 B 676 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
www.gpt-investor.de/ |
4 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cf.errors.css
www.gpt-investor.de/cdn-cgi/styles/ |
23 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icon-exclamation.png
www.gpt-investor.de/cdn-cgi/images/ |
452 B 540 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
favicon.ico
www.gpt-investor.de/ |
17 KB 9 KB |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
/
www.gpt-investor.de/ Redirect Chain
|
17 KB 8 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
v1
www.gpt-investor.de/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/ |
89 KB 35 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
c2157f24-b38f-4f5d-b431-285147148625
https://www.gpt-investor.de/ Frame |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
api.js
challenges.cloudflare.com/turnstile/v0/g/7cf142fb2c1f/ |
45 KB 15 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
favicon.ico
www.gpt-investor.de/ |
4 KB 4 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
favicon.ico
www.gpt-investor.de/ |
17 KB 9 KB |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
a20b1c491d2e06e
www.gpt-investor.de/cdn-cgi/challenge-platform/h/g/flow/ov1/1433107776:1726118652:rT6_adppZ02O1QQAiNeYWvTpdUwwdq0kMr_7ca47QH0/8c1db278eba4b930/ |
16 KB 13 KB |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
b14552b2-ece4-4fb0-ad89-9e2965431178
https://www.gpt-investor.de/ Frame |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
/
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/npck4/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/normal/auto/ Frame AC08 |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- www.gpt-investor.de
- URL
- blob:https://www.gpt-investor.de/c2157f24-b38f-4f5d-b431-285147148625
- Domain
- www.gpt-investor.de
- URL
- blob:https://www.gpt-investor.de/b14552b2-ece4-4fb0-ad89-9e2965431178
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Cloudflare (Online)18 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| _cf_chl_opt function| sSqh5 function| EIuZ8 object| vGSZ3 object| WhyYO0 function| mjXG8 function| iSaTw8 function| hHxh4 function| rFWx1 boolean| VYLv8 function| lmgV7 object| MDnZa1 number| vORPe8 object| angular object| turnstile boolean| SuywC7 string| LYsf1 boolean| PlmIO41 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.www.gpt-investor.de/ | Name: __cf_mw_byp Value: IJNm6p7Bv.X2X.H8xwy_MhIZ.cIwy7GaD.0fEGyA_Ow-1726121030-0.0.1.1-/ |
4 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
challenges.cloudflare.com
www.gpt-investor.de
www.swisstrading.info
www.gpt-investor.de
104.18.95.41
172.67.155.14
172.67.171.126
2606:4700:3036::ac43:9b0e
0798239198a1107b7c5e1547bc4b921d695b486848f1d07ea919c4f91ddf9985
1de6d7adf01ca7c56e2bc2690ce94f4ff564594a591e6f0e24917eccb59c5a72
35980fde0c25566afc31f64461e742f10c28e71f21e8c6f7d0a72ff7dd9a770d
62c4ea2668c24ca3c6007816c325a94b59e8e3d9467ebaa055ea2b62568afc0f
84e3c77025ace5af143972b4a40fc834dcdfd4e449d4b36a57e62326f16b3091
b7ddf5a006f3e559d5de396a5e6ef34eceb6c731f45a65bd0918ce4b8b6db5b4
c0c5e1eba9704ac51de449df7d21885feb95f39ef39a50ef504192d9f7bed0a6
cc9ca8b79b72a3bde8c8a0d5db84f0570b0a73b1b0e8fce1ae8470829933ae62
ec5756f119f408f8880603d2dc5fa38752091b67894495f65cc6d4f39adf246d
f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016