gamestop.servicenow.okta.popsypop.es Open in urlscan Pro
198.20.102.213 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://gamestop.servicenow.okta.popsypop.es/home.portal
Effective URL:
https://gamestop.servicenow.okta.popsypop.es/home.portal/oauth2/index.html
Submission: On August 11 via api (August 11th 2023, 7:08:24 pm UTC) from US — Scanned from ES

Summary HTTP 11 Redirects Links 2 Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 11 HTTP transactions. The main IP is 198.20.102.213, located in North Holland, Netherlands and belongs to SINGLEHOP-LLC, US. The main domain is gamestop.servicenow.okta.popsypop.es.
TLS certificate: Issued by cPanel, Inc. Certification Authority on August 11th 2023. Valid for: 3 months.

This is the only time gamestop.servicenow.okta.popsypop.es was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Nordstrom (Fashion)

Domain & IP information

	IP Address	AS Autonomous System
2 11	198.20.102.213 198.20.102.213	32475 (SINGLEHOP...) (SINGLEHOP-LLC)
2	108.157.194.105 108.157.194.105	16509 (AMAZON-02) (AMAZON-02)
11	2

11 198.20.102.213 (North Holland, Netherlands) 2 redirects

ASN32475 (SINGLEHOP-LLC, US)
PTR: europe1510.banahosting.com

gamestop.servicenow.okta.popsypop.es	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 108.157.194.105 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-157-194-105.mxp53.r.cloudfront.net

ok6static.oktacdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	popsypop.es 2 redirects gamestop.servicenow.okta.popsypop.es	101 KB
2	oktacdn.com ok6static.oktacdn.com — Cisco Umbrella Rank: 15844	111 KB
11	2

	Domain	Requested by
11	gamestop.servicenow.okta.popsypop.es	2 redirects gamestop.servicenow.okta.popsypop.es
2	ok6static.oktacdn.com	gamestop.servicenow.okta.popsypop.es
11	2

This site contains links to these domains. Also see Links.

Domain
www.okta.com
nordstrom.okta.com

Subject Issuer	Validity	Valid
popsyshops.com cPanel, Inc. Certification Authority	`2023-08-11` - `2023-11-09`	3 months	crt.sh
*.oktacdn.com DigiCert TLS RSA SHA256 2020 CA1	`2023-01-03` - `2024-01-02`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://gamestop.servicenow.okta.popsypop.es/home.portal/oauth2/index.html
Frame ID: 5BF7519D83BC02C32B381248ACB786FC
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Nordstrom - Sign In

Page URL History Show full URLs

https://gamestop.servicenow.okta.popsypop.es/home.portal HTTP 301
https://gamestop.servicenow.okta.popsypop.es/home.portal/ HTTP 302
https://gamestop.servicenow.okta.popsypop.es/home.portal/oauth2/index.html Page URL

Page Statistics

11
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

212 kB
Transfer

406 kB
Size

0
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: http://www.okta.com/
Title: Okta

Search URL Search Domain Scan URL

URL: https://nordstrom.okta.com/privacy
Title: Privacy Policy

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://gamestop.servicenow.okta.popsypop.es/home.portal HTTP 301
https://gamestop.servicenow.okta.popsypop.es/home.portal/ HTTP 302
https://gamestop.servicenow.okta.popsypop.es/home.portal/oauth2/index.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3

200

Primary Request index.html Show response
gamestop.servicenow.okta.popsypop.es/home.portal/oauth2/
Redirect Chain

https://gamestop.servicenow.okta.popsypop.es/home.portal
https://gamestop.servicenow.okta.popsypop.es/home.portal/
https://gamestop.servicenow.okta.popsypop.es/home.portal/oauth2/index.html

8 KB
3 KB

57ms
57ms

Document
text/html

198.20.102.213
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://gamestop.servicenow.okta.popsypop.es/home.portal/oauth2/index.html
Protocol: H3
Security: QUIC, , CHACHA20_POLY1305
Server: 198.20.102.213 North Holland, Netherlands, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS: europe1510.banahosting.com
Software: /
Resource Hash: b98a73724b310ee49dda52d0c4019f5267906e8926579b09fee82d5602a30acc

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36
accept-language: es-ES,es;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-encoding: br
content-length: 2394
content-type: text/html
date: Fri, 11 Aug 2023 19:08:19 GMT
last-modified: Fri, 11 Aug 2023 23:59:08 GMT
vary: Accept-Encoding

Redirect headers

cache-control: no-cache, no-store, must-revalidate, max-age=0
content-length: 0
content-type: text/html; charset=UTF-8
date: Fri, 11 Aug 2023 19:08:19 GMT
location: oauth2/index.html

GET
H3 200 okta-sign-in.min.css
gamestop.servicenow.okta.popsypop.es/home.portal/oauth2/files/ 215 KB
28 KB 61ms
61ms Stylesheet
text/css 198.20.102.213
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://gamestop.servicenow.okta.popsypop.es/home.portal/oauth2/files/okta-sign-in.min.css
Requested by: Host: gamestop.servicenow.okta.popsypop.es
URL: https://gamestop.servicenow.okta.popsypop.es/home.portal/oauth2/index.html
Protocol: H3
Security: QUIC, , CHACHA20_POLY1305
Server: 198.20.102.213 North Holland, Netherlands, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS: europe1510.banahosting.com
Software: /
Resource Hash: ea8d801deb6776d5aaf273dfbc42d503fdaaa6f51c8934d0961e3f2a1ba13ceb

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://gamestop.servicenow.okta.popsypop.es/home.portal/oauth2/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Fri, 11 Aug 2023 19:08:19 GMT
content-encoding: br
last-modified: Fri, 11 Aug 2023 00:43:48 GMT
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 28424
expires: Fri, 18 Aug 2023 19:08:19 GMT

GET
H3 200 loginpage-theme.c1227d73b70be13e51aae80fe238b0ae.css
gamestop.servicenow.okta.popsypop.es/home.portal/oauth2/files/ 3 KB
1 KB 70ms
70ms Stylesheet
text/css 198.20.102.213
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://gamestop.servicenow.okta.popsypop.es/home.portal/oauth2/files/loginpage-theme.c1227d73b70be13e51aae80fe238b0ae.css
Requested by: Host: gamestop.servicenow.okta.popsypop.es
URL: https://gamestop.servicenow.okta.popsypop.es/home.portal/oauth2/index.html
Protocol: H3
Security: QUIC, , CHACHA20_POLY1305
Server: 198.20.102.213 North Holland, Netherlands, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS: europe1510.banahosting.com
Software: /
Resource Hash: e1e44d4c36b5065da95f5c9fba78d36deb4a28e09751ae05aa1675121041af51

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://gamestop.servicenow.okta.popsypop.es/home.portal/oauth2/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Fri, 11 Aug 2023 19:08:19 GMT
content-encoding: br
last-modified: Fri, 11 Aug 2023 00:43:50 GMT
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 1045
expires: Fri, 18 Aug 2023 19:08:19 GMT

GET
H3 200 style-sheet
gamestop.servicenow.okta.popsypop.es/home.portal/oauth2/files/ 556 B
595 B 69ms
69ms Stylesheet
text/plain 198.20.102.213
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://gamestop.servicenow.okta.popsypop.es/home.portal/oauth2/files/style-sheet
Requested by: Host: gamestop.servicenow.okta.popsypop.es
URL: https://gamestop.servicenow.okta.popsypop.es/home.portal/oauth2/index.html
Protocol: H3
Security: QUIC, , CHACHA20_POLY1305
Server: 198.20.102.213 North Holland, Netherlands, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS: europe1510.banahosting.com
Software: /
Resource Hash: 9af30b5e4695010f9be253f861784e638c81274ca0390214629886029ca9b509

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://gamestop.servicenow.okta.popsypop.es/home.portal/oauth2/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Fri, 11 Aug 2023 19:08:19 GMT
last-modified: Fri, 11 Aug 2023 00:43:50 GMT
accept-ranges: bytes
content-length: 556

GET
H3 200 okta-logo-end-user-dashboard.fc6d8fdbcb8cb4c933d009e71456cec6.svg
gamestop.servicenow.okta.popsypop.es/home.portal/oauth2/files/ 958 B
282 B 64ms
63ms Image
image/svg+xml 198.20.102.213
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gamestop.servicenow.okta.popsypop.es/home.portal/oauth2/files/okta-logo-end-user-dashboard.fc6d8fdbcb8cb4c933d009e71456cec6.svg
Requested by: Host: gamestop.servicenow.okta.popsypop.es
URL: https://gamestop.servicenow.okta.popsypop.es/home.portal/oauth2/index.html
Protocol: H3
Security: QUIC, , CHACHA20_POLY1305
Server: 198.20.102.213 North Holland, Netherlands, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS: europe1510.banahosting.com
Software: /
Resource Hash: 3f3891aeaf25fec84fcdd3bb35e1c7900df90bd81262bddfe5b7519accfb3a97

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://gamestop.servicenow.okta.popsypop.es/home.portal/oauth2/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Fri, 11 Aug 2023 19:08:19 GMT
content-encoding: br
last-modified: Fri, 11 Aug 2023 00:43:50 GMT
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 248
expires: Fri, 18 Aug 2023 19:08:19 GMT

GET
H2 200 fs01fzuica2jvgnTX0x7
ok6static.oktacdn.com/fs/bco/1/ 6 KB
7 KB 163ms
54ms Image
image/png 108.157.194.105
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ok6static.oktacdn.com/fs/bco/1/fs01fzuica2jvgnTX0x7

Requested by

Host: gamestop.servicenow.okta.popsypop.es
URL: https://gamestop.servicenow.okta.popsypop.es/home.portal/oauth2/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

108.157.194.105 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-108-157-194-105.mxp53.r.cloudfront.net

Software

nginx /

Resource Hash

32dcb653c56905464ea8b0844490bf85ad56343c665d3e5d0d8e00142897ff9b

Security Headers

Name	Value
Strict-Transport-Security	max-age=315360000; includeSubDomains

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://gamestop.servicenow.okta.popsypop.es/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Sun, 23 Jul 2023 13:56:39 GMT
strict-transport-security: max-age=315360000; includeSubDomains
via: 1.1 8cb7965839bd69a62e95873e40c54db4.cloudfront.net (CloudFront)
x-amz-cf-pop: MXP53-P2
age: 1660299
x-cache: Hit from cloudfront
content-length: 6083
last-modified: Wed, 07 Aug 2019 20:01:47 GMT
server: nginx
etag: "5ff3a7e014ffad4e6fe9e90d129b57f1"
public-key-pins-report-only: pin-sha256="r5EfzZxQVvQpKo3AgYRaT7X2bDO/kj3ACwmxfdT2zt8="; pin-sha256="MaqlcUgk2mvY/RFSGeSwBRkI+rZ6/dxe/DuQfBT/vnQ="; pin-sha256="72G5IEvDEWn+EThf3qjR7/bQSWaS2ZSLqolhnO6iyJI="; pin-sha256="rrV6CLCCvqnk89gWibYT0JO6fNQ8cCit7GGoiVTjCOg="; max-age=60; report-uri="https://okta.report-uri.com/r/default/hpkp/reportOnly"
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=31536000, public,max-age=31536000,s-maxage=1814400
accept-ranges: bytes
x-amz-cf-id: EspVd9DqEznW9eHd1CaDmaPOXpC8dTQs8zVL8JwoJMNh-41nrUVoVA==
expires: Mon, 22 Jul 2024 13:56:39 GMT

GET
H3 200 fs057b5c9yZyDY3N32p7
gamestop.servicenow.okta.popsypop.es/home.portal/oauth2/files/ 5 KB
5 KB 60ms
59ms Image
image/png 198.20.102.213
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gamestop.servicenow.okta.popsypop.es/home.portal/oauth2/files/fs057b5c9yZyDY3N32p7
Requested by: Host: gamestop.servicenow.okta.popsypop.es
URL: https://gamestop.servicenow.okta.popsypop.es/home.portal/oauth2/index.html
Protocol: H3
Security: QUIC, , CHACHA20_POLY1305
Server: 198.20.102.213 North Holland, Netherlands, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS: europe1510.banahosting.com
Software: /
Resource Hash: 19d20c363953ec52f2a0fa995bf5ae3451cff3f2048931cee8be86dec8d6fed0

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://gamestop.servicenow.okta.popsypop.es/home.portal/oauth2/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

date: Fri, 11 Aug 2023 19:08:19 GMT
last-modified: Fri, 11 Aug 2023 00:43:50 GMT
accept-ranges: bytes
content-length: 5493

GET
H2 200 fs0ib8oitwYFqLdNZ2p6
ok6static.oktacdn.com/fs/bco/7/ 104 KB
105 KB 114ms
62ms Image
image/jpeg 108.157.194.105
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ok6static.oktacdn.com/fs/bco/7/fs0ib8oitwYFqLdNZ2p6

Requested by

Host: gamestop.servicenow.okta.popsypop.es
URL: https://gamestop.servicenow.okta.popsypop.es/home.portal/oauth2/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

108.157.194.105 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-108-157-194-105.mxp53.r.cloudfront.net

Software

nginx /

Resource Hash

9b7bb3dd9f98a308db3a6d44c46327a96bf2bbf0d2e13ca1c4926e747d976f92

Security Headers

Name	Value
Strict-Transport-Security	max-age=315360000; includeSubDomains

Request headers

accept-language: es-ES,es;q=0.9
Referer: https://gamestop.servicenow.okta.popsypop.es/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

strict-transport-security: max-age=315360000; includeSubDomains
date: Wed, 09 Aug 2023 09:15:51 GMT
via: 1.1 8cb7965839bd69a62e95873e40c54db4.cloudfront.net (CloudFront)
x-amz-cf-pop: MXP53-P2
age: 980834
x-cache: Hit from cloudfront
content-length: 106182
last-modified: Wed, 07 Aug 2019 20:19:29 GMT
server: nginx
etag: "82cda7027bfcc4e0b32586792bf520dd"
content-type: image/jpeg
access-control-allow-origin: *
public-key-pins-report-only: pin-sha256="r5EfzZxQVvQpKo3AgYRaT7X2bDO/kj3ACwmxfdT2zt8="; pin-sha256="MaqlcUgk2mvY/RFSGeSwBRkI+rZ6/dxe/DuQfBT/vnQ="; pin-sha256="72G5IEvDEWn+EThf3qjR7/bQSWaS2ZSLqolhnO6iyJI="; pin-sha256="rrV6CLCCvqnk89gWibYT0JO6fNQ8cCit7GGoiVTjCOg="; max-age=60; report-uri="https://okta.report-uri.com/r/default/hpkp/reportOnly"
cache-control: max-age=31536000, public,max-age=31536000,s-maxage=1814400
accept-ranges: bytes
x-amz-cf-id: YGkJzKn3q7kqDGLCxFYC37ZXwMMh514zDVjyaHzErpvNCbU6NFQBaA==
expires: Tue, 30 Jul 2024 10:41:04 GMT

GET
H3 200 okticon.woff
gamestop.servicenow.okta.popsypop.es/home.portal/oauth2/font/ 20 KB
20 KB 59ms
58ms Font
font/woff 198.20.102.213
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://gamestop.servicenow.okta.popsypop.es/home.portal/oauth2/font/okticon.woff
Requested by: Host: gamestop.servicenow.okta.popsypop.es
URL: https://gamestop.servicenow.okta.popsypop.es/home.portal/oauth2/files/okta-sign-in.min.css
Protocol: H3
Security: QUIC, , CHACHA20_POLY1305
Server: 198.20.102.213 North Holland, Netherlands, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS: europe1510.banahosting.com
Software: /
Resource Hash: 7eccbb3b4b68f9f24a3b826f2eea4a1bbb48196cb734afc1b62c3d045cb680e1

Request headers

Referer: https://gamestop.servicenow.okta.popsypop.es/home.portal/oauth2/files/okta-sign-in.min.css
Origin: https://gamestop.servicenow.okta.popsypop.es
accept-language: es-ES,es;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-type: font/woff
date: Fri, 11 Aug 2023 19:08:19 GMT
cache-control: public, max-age=604800
last-modified: Fri, 11 Aug 2023 00:48:34 GMT
accept-ranges: bytes
content-length: 20600
expires: Fri, 18 Aug 2023 19:08:19 GMT

GET
H3 200 montserrat-okta-regular-webfont.woff
gamestop.servicenow.okta.popsypop.es/home.portal/oauth2/font/ 21 KB
22 KB 74ms
74ms Font
font/woff 198.20.102.213
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://gamestop.servicenow.okta.popsypop.es/home.portal/oauth2/font/montserrat-okta-regular-webfont.woff
Requested by: Host: gamestop.servicenow.okta.popsypop.es
URL: https://gamestop.servicenow.okta.popsypop.es/home.portal/oauth2/files/okta-sign-in.min.css
Protocol: H3
Security: QUIC, , CHACHA20_POLY1305
Server: 198.20.102.213 North Holland, Netherlands, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS: europe1510.banahosting.com
Software: /
Resource Hash: 1d5325892ecf2dc3abd0caf2a1ef4eabf2477e2937c9a372760fd2acae8fddf3

Request headers

Referer: https://gamestop.servicenow.okta.popsypop.es/home.portal/oauth2/files/okta-sign-in.min.css
Origin: https://gamestop.servicenow.okta.popsypop.es
accept-language: es-ES,es;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-type: font/woff
date: Fri, 11 Aug 2023 19:08:19 GMT
cache-control: public, max-age=604800
last-modified: Fri, 11 Aug 2023 00:48:42 GMT
accept-ranges: bytes
content-length: 21980
expires: Fri, 18 Aug 2023 19:08:19 GMT

GET
H3 200 montserrat-okta-light-webfont.woff
gamestop.servicenow.okta.popsypop.es/home.portal/oauth2/font/ 22 KB
22 KB 89ms
89ms Font
font/woff 198.20.102.213
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://gamestop.servicenow.okta.popsypop.es/home.portal/oauth2/font/montserrat-okta-light-webfont.woff
Requested by: Host: gamestop.servicenow.okta.popsypop.es
URL: https://gamestop.servicenow.okta.popsypop.es/home.portal/oauth2/files/okta-sign-in.min.css
Protocol: H3
Security: QUIC, , CHACHA20_POLY1305
Server: 198.20.102.213 North Holland, Netherlands, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS: europe1510.banahosting.com
Software: /
Resource Hash: feb177fb563f478cb8ecade71caea5df5ad318ca161c71875114e504ce304ace

Request headers

Referer: https://gamestop.servicenow.okta.popsypop.es/home.portal/oauth2/files/okta-sign-in.min.css
Origin: https://gamestop.servicenow.okta.popsypop.es
accept-language: es-ES,es;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36

Response headers

content-type: font/woff
date: Fri, 11 Aug 2023 19:08:19 GMT
cache-control: public, max-age=604800
last-modified: Fri, 11 Aug 2023 00:48:48 GMT
accept-ranges: bytes
content-length: 22112
expires: Fri, 18 Aug 2023 19:08:19 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Nordstrom (Fashion)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

gamestop.servicenow.okta.popsypop.es
ok6static.oktacdn.com
108.157.194.105
198.20.102.213
19d20c363953ec52f2a0fa995bf5ae3451cff3f2048931cee8be86dec8d6fed0
1d5325892ecf2dc3abd0caf2a1ef4eabf2477e2937c9a372760fd2acae8fddf3
32dcb653c56905464ea8b0844490bf85ad56343c665d3e5d0d8e00142897ff9b
3f3891aeaf25fec84fcdd3bb35e1c7900df90bd81262bddfe5b7519accfb3a97
7eccbb3b4b68f9f24a3b826f2eea4a1bbb48196cb734afc1b62c3d045cb680e1
9af30b5e4695010f9be253f861784e638c81274ca0390214629886029ca9b509
9b7bb3dd9f98a308db3a6d44c46327a96bf2bbf0d2e13ca1c4926e747d976f92
b98a73724b310ee49dda52d0c4019f5267906e8926579b09fee82d5602a30acc
e1e44d4c36b5065da95f5c9fba78d36deb4a28e09751ae05aa1675121041af51
ea8d801deb6776d5aaf273dfbc42d503fdaaa6f51c8934d0961e3f2a1ba13ceb
feb177fb563f478cb8ecade71caea5df5ad318ca161c71875114e504ce304ace

gamestop.servicenow.okta.popsypop.es Open in urlscan Pro 198.20.102.213 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

11 Requests

100 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

212 kBTransfer

406 kBSize

0 Cookies

2 Outgoing links

Page URL History

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

Indicators

gamestop.servicenow.okta.popsypop.es Open in urlscan Pro
198.20.102.213 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

212 kB
Transfer

406 kB
Size

0
Cookies

11 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!