urlscan.io logo urlscan.io
SecurityTrails logo

pay.gptblox.com Open in urlscan Pro
137.66.37.136  Public Scan

Go To Rescan Add Verdict Report
URL: https://pay.gptblox.com/
Submission Tags: phishingrod
Submission: On December 19 via api from DE — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 8 HTTP transactions. The main IP is 137.66.37.136, located in United States and belongs to FLY, US. The main domain is pay.gptblox.com.
TLS certificate: Issued by R3 on October 20th 2023. Valid for: 3 months.
This is the only time pay.gptblox.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 137.66.37.136 40509 (FLY)
3 2600:9000:236... 16509 (AMAZON-02)
2 2400:52e0:1e0... 200325 (BUNNYCDN)
2 2a04:4e42:8e:... 54113 (FASTLY)
8 4
Apex Domain
Subdomains		 Transfer
3 cloudfront.net
d29lra7z8g0m3a.cloudfront.net
273 KB
2 imgix.net
lemonsqueezy.imgix.net
272 KB
2 usefathom.com
cdn.usefathom.com — Cisco Umbrella Rank: 18178
3 KB
1 gptblox.com
pay.gptblox.com
3 KB
8 4
Domain Requested by
3 d29lra7z8g0m3a.cloudfront.net pay.gptblox.com
d29lra7z8g0m3a.cloudfront.net
2 lemonsqueezy.imgix.net pay.gptblox.com
2 cdn.usefathom.com pay.gptblox.com
1 pay.gptblox.com
8 4

This site contains links to these domains. Also see Links.

Domain
www.lemonsqueezy.com
Subject Issuer Validity Valid
pay.gptblox.com
R3		 2023-10-20 -
2024-01-18		 3 months crt.sh
*.cloudfront.net
Amazon RSA 2048 M01		 2023-10-10 -
2024-09-19		 a year crt.sh
cdn.usefathom.com
R3		 2023-11-28 -
2024-02-26		 3 months crt.sh
*.imgix.com
GlobalSign Atlas R3 DV TLS CA 2023 Q4		 2023-12-07 -
2025-01-07		 a year crt.sh

This page contains 1 frames:

Primary Page: https://pay.gptblox.com/
Frame ID: 65249E5E013C5562619B87A2BBEDE271
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

GPTBLOX

Detected technologies

Overall confidence: 100%
Detected patterns
  • <a[^>]*href=[^>]*/Checkout
Overall confidence: 100%
Detected patterns

Page Statistics

8
Requests

100 %
HTTPS

75 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

551 kB
Transfer

937 kB
Size

2
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
pay.gptblox.com/ 		6 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://pay.gptblox.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
137.66.37.136 , United States, ASN40509 (FLY, US),
Reverse DNS
Software
Caddy cloudflare /
Resource Hash
e899a5f87315396e45bbaa6afded3127c9a6502d2bba99ffe20a8c7882f56105

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000
apigw-requestid
QMP5MhLfCYcEPVQ=
apx-hit
true
cache-control
no-cache, private
cf-cache-status
DYNAMIC
cf-ray
837fd10e0dc5209a-IAD
content-encoding
br
content-type
text/html; charset=UTF-8
date
Tue, 19 Dec 2023 12:58:22 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iA6gItm0wOyRhes%2BQnqH%2FoG9y8mcKVAJHAA39Fo9AzZ%2BGvLLlX6u%2Ft8pTx3cQOR01nikc5j9xBw80pgycJ%2BbRCDOTw7ojgrsTUlsFFd%2FnDJRoPZHaYioXSwbWSxyTOV%2F3xz6S%2FjyeRDZZ8R%2F1Di1bwov0Eb3Pgk%3D"}],"group":"cf-nel","max_age":604800}
server
Caddy cloudflare
store-aad834d9.css
d29lra7z8g0m3a.cloudfront.net/c72968db-74c3-4996-8733-3d1982cf20c4/build/assets/ 		87 KB
13 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://d29lra7z8g0m3a.cloudfront.net/c72968db-74c3-4996-8733-3d1982cf20c4/build/assets/store-aad834d9.css
Requested by
Host: pay.gptblox.com
URL: https://pay.gptblox.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:236e:9e00:1b:e223:f580:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
aad834d90f6ce3d32ff482346acdf44691c81e9fb3a4aae371a693252d75d2a1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pay.gptblox.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Mon, 18 Dec 2023 11:13:07 GMT
content-encoding
br
via
1.1 23e8ec14db0917c91c2c733b45578890.cloudfront.net (CloudFront)
last-modified
Mon, 18 Dec 2023 11:10:58 GMT
server
AmazonS3
x-amz-cf-pop
FRA60-P1
age
92716
etag
W/"5881d3d82fc29e27f63f51dcc3efae56"
x-amz-server-side-encryption
AES256
vary
Accept-Encoding, Origin
x-cache
Hit from cloudfront
content-type
text/css
cache-control
public, max-age=31536000
x-amz-cf-id
f1hFC77xgGxNF_4pyfxjhrp8AXn76YTJmzgdnpkxTd4KvdqZyFmp3Q==
expires
Mon, 15 Jan 2024 10:38:39 GMT
script.js
cdn.usefathom.com/ 		6 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.usefathom.com/script.js
Requested by
Host: pay.gptblox.com
URL: https://pay.gptblox.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1080:1 , Germany, ASN200325 (BUNNYCDN, SI),
Reverse DNS
Software
BunnyCDN-DE1-1080 /
Resource Hash
19ddbd3f35a8f49ec6c6b5074c782c5b9324b8fda7859ee5f632d10e95c02e81

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pay.gptblox.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Tue, 19 Dec 2023 12:58:22 GMT
content-encoding
br
cdn-edgestorageid
1081
x-vapor-base64-encode
True
cdn-cachedat
12/19/2023 12:48:03
cdn-pullzone
506217
last-modified
Mon, 18 Dec 2023 22:32:01 GMT
server
BunnyCDN-DE1-1080
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
W/"d41d8cd98f00b204e9800998ecf8427e"
vary
Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cdn-cache
HIT
cdn-uid
aa90c48b-f401-4fa1-aac1-c94c8f3ae560
cache-control
public, max-age=0
cdn-requestid
2bb1c6da92bf2961d93b9e976abd50d8
cdn-requestcountrycode
DE
cdn-status
200
cdn-requestpullsuccess
True
srvwHPjCc0pRjp6Q08kGXF4kF2ufdy7rb9Tl2tTX.png
lemonsqueezy.imgix.net/avatars/stores/48819/ 		6 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lemonsqueezy.imgix.net/avatars/stores/48819/srvwHPjCc0pRjp6Q08kGXF4kF2ufdy7rb9Tl2tTX.png?fit=clip&h=100&ixlib=php-3.3.1&w=100&s=261a99ba4a5ee6577e9044c31a35dff6
Requested by
Host: pay.gptblox.com
URL: https://pay.gptblox.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:8e::720 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
imgix /
Resource Hash
3408590f6ea3b7ec20d42f9f1eb416c1bc78cb354417fbaed23632cd7c121d38
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pay.gptblox.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Tue, 19 Dec 2023 12:58:22 GMT
x-content-type-options
nosniff
age
203403
x-cache
HIT, MISS
x-imgix-id
f0460a6a3b64e4f074465f3cf949052f12ed773b
cross-origin-resource-policy
cross-origin
content-length
5756
x-served-by
cache-sjc10050-SJC, cache-fra-etou8220085-FRA
x-imgix-render-farm
01.140328
last-modified
Sun, 17 Dec 2023 04:28:19 GMT
server
imgix
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
Inter-Medium-5249ae5f.ttf
d29lra7z8g0m3a.cloudfront.net/c72968db-74c3-4996-8733-3d1982cf20c4/build/assets/ 		285 KB
134 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://d29lra7z8g0m3a.cloudfront.net/c72968db-74c3-4996-8733-3d1982cf20c4/build/assets/Inter-Medium-5249ae5f.ttf
Requested by
Host: d29lra7z8g0m3a.cloudfront.net
URL: https://d29lra7z8g0m3a.cloudfront.net/c72968db-74c3-4996-8733-3d1982cf20c4/build/assets/store-aad834d9.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:236e:9e00:1b:e223:f580:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
5249ae5f8ddfded34c98c6e3cf09e08f178f234e1bfa28a68f98f6f957628418

Request headers

Referer
https://d29lra7z8g0m3a.cloudfront.net/c72968db-74c3-4996-8733-3d1982cf20c4/build/assets/store-aad834d9.css
Origin
https://pay.gptblox.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Mon, 18 Dec 2023 11:12:22 GMT
content-encoding
br
via
1.1 06a27d66e25d02ebcfb014b9d194016a.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA60-P1
age
92761
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Mon, 18 Dec 2023 11:08:29 GMT
server
AmazonS3
etag
W/"5ff1f2a9a78730d7d0c309320ff3c9c7"
vary
Accept-Encoding
content-type
font/ttf
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=31536000
x-amz-cf-id
lzFoMRR6_LYqVfqCCkT1cG8z-ytlnSVD_vH4qbxFto2-7FcMpoX21g==
expires
Mon, 01 Jan 2024 11:40:21 GMT
Inter-Regular-1041a8cf.ttf
d29lra7z8g0m3a.cloudfront.net/c72968db-74c3-4996-8733-3d1982cf20c4/build/assets/ 		281 KB
125 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://d29lra7z8g0m3a.cloudfront.net/c72968db-74c3-4996-8733-3d1982cf20c4/build/assets/Inter-Regular-1041a8cf.ttf
Requested by
Host: d29lra7z8g0m3a.cloudfront.net
URL: https://d29lra7z8g0m3a.cloudfront.net/c72968db-74c3-4996-8733-3d1982cf20c4/build/assets/store-aad834d9.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:236e:9e00:1b:e223:f580:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
1041a8cf17dab7579acef0cc46b21f6497ec1ae01918ddc3495416efb81a4780

Request headers

Referer
https://d29lra7z8g0m3a.cloudfront.net/c72968db-74c3-4996-8733-3d1982cf20c4/build/assets/store-aad834d9.css
Origin
https://pay.gptblox.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Mon, 18 Dec 2023 11:12:22 GMT
content-encoding
br
via
1.1 06a27d66e25d02ebcfb014b9d194016a.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA60-P1
age
92761
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Mon, 18 Dec 2023 11:08:29 GMT
server
AmazonS3
etag
W/"515cae74eee4925d56e6ac70c25fc0f6"
vary
Accept-Encoding
content-type
font/ttf
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=31536000
x-amz-cf-id
2a3RFrzD3kGaLCL4KMRp5s_PFRny5mxcQU_r-neeqv0UFMls50oufQ==
expires
Mon, 01 Jan 2024 11:40:21 GMT
cbb80beb-12d1-44b3-9c9f-c45ec4ee3390.jpg
lemonsqueezy.imgix.net/media/48819/ 		266 KB
266 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lemonsqueezy.imgix.net/media/48819/cbb80beb-12d1-44b3-9c9f-c45ec4ee3390.jpg?fit=clip&h=1000&ixlib=php-3.3.1&w=1000&s=7bb5a30787c6e475ec0d942f30ef2edb
Requested by
Host: pay.gptblox.com
URL: https://pay.gptblox.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:8e::720 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
imgix /
Resource Hash
e54f1e23455cfef40b1421732ca22db9cdf0c820a6d5f0f18cf09cdc66ee347d
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pay.gptblox.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Tue, 19 Dec 2023 12:58:22 GMT
x-content-type-options
nosniff
age
763876
x-cache
HIT, MISS
x-imgix-id
278ae46eaa6a4ffe048e4c0cbe597e2c3ae09a41
cross-origin-resource-policy
cross-origin
content-length
272427
x-served-by
cache-sjc10056-SJC, cache-fra-etou8220085-FRA
x-imgix-render-farm
01.140328
last-modified
Sun, 10 Dec 2023 16:47:05 GMT
server
imgix
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
/
cdn.usefathom.com/ 		43 B
427 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn.usefathom.com/?h=https%3A%2F%2Fpay.gptblox.com&p=%2F&r=&sid=CDEHFFIM&qs=%7B%7D&cid=99937814
Requested by
Host: pay.gptblox.com
URL: https://pay.gptblox.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1080:1 , Germany, ASN200325 (BUNNYCDN, SI),
Reverse DNS
Software
BunnyCDN-DE1-1080 /
Resource Hash
aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pay.gptblox.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Tue, 19 Dec 2023 12:58:22 GMT
cdn-edgestorageid
1082
cdn-cachedat
12/19/2023 12:58:22
cdn-pullzone
506217
content-length
43
pragma
no-cache
server
BunnyCDN-DE1-1080
cdn-proxyver
1.04
cdn-requestpullcode
200
tk
N
content-type
text/plain; charset=utf-8, image/gif
cdn-cache
MISS
cdn-uid
aa90c48b-f401-4fa1-aac1-c94c8f3ae560
cache-control
public, max-age=0
cdn-requestid
5d341ac5a4dd663c932d8dbd3997cfb2
cdn-requestcountrycode
DE
cdn-status
200
cdn-requestpullsuccess
True

Verdicts & Comments Add Verdict or Comment

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture object| fathom

2 Cookies

Domain/Path Name / Value
.pay.gptblox.com/ Name: XSRF-TOKEN
Value: eyJpdiI6InJrWWc4OFozRUIzUFByTDNxbUkwSHc9PSIsInZhbHVlIjoiNG95WngwR3NqcmcwbTlIN0xDZUZBaXZvcWNQYlZ4L24xNlltc2p6UlF5eGgxdkhEd2hOY3BLQm5NQVNFSFpYOXk0OW1rUjdUS2lxS2NYclZPc2szZlh0ZlgxTWdONHdwcVBhT3JHWS84YzA4alVweXRTNmFjbmI4S0xnRkUwRWwiLCJtYWMiOiIyMGU2OTRlOTA1YzFkZjRmZDViZTMyOGQ0MDVlOThmM2MzNTMyNDYxMjMxNDgyZWQ1YzI4ZWUxNjAwZGVlOTczIiwidGFnIjoiIn0%3D
.pay.gptblox.com/ Name: laravel_session
Value: eyJpdiI6IlVYcTZucldkcVpvYkJzRTc2RkJyaVE9PSIsInZhbHVlIjoiV3dVR1hxMjN6ZzBnNmZrMEhUSVRtUDFET3JmcGs2V2RnMXBZOWZJRWlpNkNra2lLOWROVDd4cWIzWjZsclptWCtlbFZDVXMzN1lWN1dHYldCZlNnQTcyd2FYV01ibHVGVmlRTGowWnpiWG0rQWRlSGhDaXBKV3diREovWlJ6TEMiLCJtYWMiOiJiNDIyZjIyYmExMzNlMWIyMjA3ODgzZTA0NGJjMWJiNDdmMmRkY2M4MDFjMTY3Yjg4Zjc1NWViZTc1ZDJkZTQ3IiwidGFnIjoiIn0%3D