urlscan.io logo urlscan.io
SecurityTrails logo

gctechstore.com Open in urlscan Pro
151.106.97.238  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://fdsdiscounts.com/cli/
Effective URL: http://gctechstore.com/cli/
Submission: On August 29 via manual from AU — Scanned from AU
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 5 HTTP transactions. The main IP is 151.106.97.238, located in Germany and belongs to AS-HOSTINGER, CY. The main domain is gctechstore.com.
This is the only time gctechstore.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Spotify (Online)

Domain & IP information

IP Address AS Autonomous System
1 4 151.106.97.238 47583 (AS-HOSTINGER)
2 104.16.88.20 13335 (CLOUDFLAR...)
5 3
Apex Domain
Subdomains		 Transfer
2 jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 422
49 KB
2 gctechstore.com
gctechstore.com
224 KB
2 fdsdiscounts.com
fdsdiscounts.com
732 B
5 3
Domain Requested by
2 cdn.jsdelivr.net gctechstore.com
2 gctechstore.com gctechstore.com
2 fdsdiscounts.com 1 redirects
5 3

This site contains no links.

Subject Issuer Validity Valid
fdsdiscounts.com
R3		 2022-08-07 -
2022-11-05		 3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2022-06-02 -
2023-06-01		 a year crt.sh

This page contains 1 frames:

Primary Page: http://gctechstore.com/cli/
Frame ID: 95985D98EAA16642FBD4548898D0281D
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Login - Spotify

Page URL History Show full URLs

  1. http://fdsdiscounts.com/cli/ HTTP 301
    https://fdsdiscounts.com/cli/ Page URL
  2. http://gctechstore.com/cli/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • <link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
  • //cdn\.jsdelivr\.net/

Page Statistics

5
Requests

60 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

488 kB
Transfer

771 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://fdsdiscounts.com/cli/ HTTP 301
    https://fdsdiscounts.com/cli/ Page URL
  2. http://gctechstore.com/cli/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • http://fdsdiscounts.com/cli/ HTTP 301
  • https://fdsdiscounts.com/cli/

5 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
fdsdiscounts.com/cli/
Redirect Chain
  • http://fdsdiscounts.com/cli/
  • https://fdsdiscounts.com/cli/
148 B
447 B 		Document
General
Check archive.org
Download Go to
Full URL
https://fdsdiscounts.com/cli/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.106.97.238 , Germany, ASN47583 (AS-HOSTINGER, CY),
Reverse DNS
Software
LiteSpeed / PHP/7.4.30
Resource Hash
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language
en-AU,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-encoding
br
content-length
146
content-security-policy
upgrade-insecure-requests
content-type
text/html; charset=UTF-8
date
Mon, 29 Aug 2022 01:18:04 GMT
server
LiteSpeed
vary
Accept-Encoding
x-powered-by
PHP/7.4.30

Redirect headers

Connection
Keep-Alive
Keep-Alive
timeout=5, max=100
content-length
707
content-security-policy
upgrade-insecure-requests
content-type
text/html
date
Mon, 29 Aug 2022 01:18:03 GMT
location
https://fdsdiscounts.com/cli/
server
LiteSpeed
Primary Request /
gctechstore.com/cli/ 		5 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://gctechstore.com/cli/
Protocol
HTTP/1.1
Server
151.106.97.238 , Germany, ASN47583 (AS-HOSTINGER, CY),
Reverse DNS
Software
LiteSpeed /
Resource Hash
1021c474cf539760986e9702992c1476e38129a5f70fd867dd713ece4dff2f71

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language
en-AU,en;q=0.9

Response headers

Connection
Keep-Alive
Keep-Alive
timeout=5, max=100
accept-ranges
bytes
content-encoding
gzip
content-length
1234
content-type
text/html
date
Mon, 29 Aug 2022 01:18:04 GMT
etag
"1488-62970628-2c12ebd63977d4bc;gz"
last-modified
Wed, 01 Jun 2022 06:24:40 GMT
server
LiteSpeed
vary
Accept-Encoding
bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@5.1.3/dist/css/ 		160 KB
25 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdn.jsdelivr.net/npm/bootstrap@5.1.3/dist/css/bootstrap.min.css
Requested by
Host: gctechstore.com
URL: http://gctechstore.com/cli/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.88.20 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
62f74b1cf824a89f03554c638e719594c309b4d8a627a758928c0516fa7890ab
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
en-AU,en;q=0.9
Referer
http://gctechstore.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date
Mon, 29 Aug 2022 01:18:05 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
10537898
x-jsd-version
5.1.3
x-cache
HIT, MISS
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by
cache-fra19134-FRA, cache-itm18849-ITM
timing-allow-origin
*
x-jsd-version-type
version
server
cloudflare
etag
W/"28021-7Ba9Gb9K6bwuIzasQJpQO7varK0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=P3fp1HRTHCwI0%2B7TfhQHUiEES7E2aBp80ov7iN%2FwIZHBPztB4WOlbQUqU%2FXGYc7utJNp%2BMzrQzMgDob4wU0Pw6NtL8hDcuW4m3rY6l2tCpmz7pnLAtruS05%2B2tKDPYmhNJw%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
cf-ray
7421736378aa377a-MEL
access-control-expose-headers
*
bootstrap.bundle.min.js
cdn.jsdelivr.net/npm/bootstrap@5.1.3/dist/js/ 		76 KB
24 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.jsdelivr.net/npm/bootstrap@5.1.3/dist/js/bootstrap.bundle.min.js
Requested by
Host: gctechstore.com
URL: http://gctechstore.com/cli/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.88.20 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f5210fa3e7f0245a4c51eb7f280092c0ef99fdd28c45e17dab8cc5854fdf4fd3
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
en-AU,en;q=0.9
Referer
http://gctechstore.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date
Mon, 29 Aug 2022 01:18:05 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
13881281
x-jsd-version
5.1.3
x-cache
HIT, HIT
cross-origin-resource-policy
cross-origin
strict-transport-security
max-age=31536000; includeSubDomains; preload
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by
cache-fra19128-FRA, cache-mel11220-MEL
timing-allow-origin
*
x-jsd-version-type
version
server
cloudflare
etag
W/"13131-qF5oFiTJGhBqUUwx6s+A3oF7LMM"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lTjVeisDJL%2F2CX%2FfE%2F3G1%2F8D5bpnJ%2B0zrlrbhRIIQLP2lwFMZn8d%2FEzSStF%2Bt3IKBd%2BmHUzqgOYSuTFUmH6lQd%2Bz9yUCRU2FUiAH4eTR55xi63hg%2Fhh8ZIvSZ6kp61finxs%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
cf-ray
7421736378ac377a-MEL
style.css
gctechstore.com/cli/ 		311 KB
222 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://gctechstore.com/cli/style.css
Requested by
Host: gctechstore.com
URL: http://gctechstore.com/cli/
Protocol
HTTP/1.1
Server
151.106.97.238 , Germany, ASN47583 (AS-HOSTINGER, CY),
Reverse DNS
Software
LiteSpeed /
Resource Hash
4500df588714853d601e62b03108a97536cb91a6ea3debaf368ddce956d8656f

Request headers

accept-language
en-AU,en;q=0.9
Referer
http://gctechstore.com/cli/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date
Mon, 29 Aug 2022 01:18:05 GMT
content-encoding
gzip
last-modified
Tue, 31 May 2022 13:48:10 GMT
server
LiteSpeed
etag
"4da8e-62961c9a-ee9d074285148f40;gz"
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=604800
Connection
Keep-Alive
accept-ranges
bytes
Keep-Alive
timeout=5, max=100
content-length
227214
expires
Mon, 05 Sep 2022 01:18:05 GMT
truncated
/ 		4 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
f771fe217119432dbcdb59fe3d3ac37547eadd1a118d1646011d1d7ba7e053bf

Request headers

accept-language
en-AU,en;q=0.9
Referer
http://gctechstore.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf-8
truncated
/ 		353 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
372cd0fe98167ffc57b624aed00ab6f53e89bd8cf5690867c1a786983ceec95b

Request headers

accept-language
en-AU,en;q=0.9
Referer
http://gctechstore.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf-8
truncated
/ 		74 KB
74 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
fdf0e3938479eb6e108e7869436051b7072b9a18ecb98b3c6b49d1b29d8bc758

Request headers

Referer
http://gctechstore.com/
Origin
http://gctechstore.com
accept-language
en-AU,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Content-Type
application/font-woff
truncated
/ 		68 KB
68 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
6384070e855e2ec15caefb6334ab2c4b1b9e798ce2e369cc00f0d47a41138e0d

Request headers

Referer
http://gctechstore.com/
Origin
http://gctechstore.com
accept-language
en-AU,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Content-Type
application/font-woff
truncated
/ 		72 KB
72 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d77456e48416e475066a580b2050cee4f86a3819556d0ddf90d81250f3af9de2

Request headers

Referer
http://gctechstore.com/
Origin
http://gctechstore.com
accept-language
en-AU,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Content-Type
application/font-woff

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Spotify (Online)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch object| navigation number| uidEvent object| bootstrap

0 Cookies

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy upgrade-insecure-requests