gpginternational.com Open in urlscan Pro
198.57.164.52 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://gpginternational.com/ol/index.php
Effective URL:
https://gpginternational.com/ol/login.php?cmd=login_submit&id=9b3c404d3f1da4bde89224f254602fed9b3c404d3f1da4bde89224f254602fe...
Submission: On November 03 via automatic, source openphish (November 3rd 2018, 3:09:29 am UTC)

Summary HTTP 3 Redirects Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 3 HTTP transactions. The main IP is 198.57.164.52, located in Provo, United States and belongs to UNIFIEDLAYER-AS-1 - Unified Layer, US. The main domain is gpginternational.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on November 1st 2018. Valid for: 3 months.

This is the only time gpginternational.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Dropbox (Consumer)

Domain & IP information

	IP Address		AS Autonomous System
1 3	198.57.164.52 198.57.164.52		46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1 - Unified Layer)
3	2

3 198.57.164.52 (Provo, United States) 1 redirects

ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US)
PTR: gpg.gpgindustries.com

gpginternational.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	gpginternational.com 1 redirects gpginternational.com	1 MB
0	uzone.id Failed cfs.uzone.id Failed
3	2

	Domain	Requested by
3	gpginternational.com	1 redirects gpginternational.com
0	cfs.uzone.id Failed	gpginternational.com
3	2

This site contains no links.

Subject Issuer	Validity	Valid
gpginternational.com cPanel, Inc. Certification Authority	`2018-11-01` - `2019-01-30`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://gpginternational.com/ol/login.php?cmd=login_submit&id=9b3c404d3f1da4bde89224f254602fed9b3c404d3f1da4bde89224f254602fed&session=9b3c404d3f1da4bde89224f254602fed9b3c404d3f1da4bde89224f254602fed
Frame ID: 5C0841D72671F9533623959591006FA4
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://gpginternational.com/ol/index.php HTTP 302
https://gpginternational.com/ol/login.php?cmd=login_submit&id=9b3c404d3f1da4bde89224f254602fed9b3c404d3f1... Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

UNIX (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /Unix/i

OpenSSL (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i

mod_ssl (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /mod_ssl(?:\/([\d.]+))?/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
headers server /mod_ssl(?:\/([\d.]+))?/i

Page Statistics

3
Requests

67 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

1369 kB
Transfer

2304 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://gpginternational.com/ol/index.php HTTP 302
https://gpginternational.com/ol/login.php?cmd=login_submit&id=9b3c404d3f1da4bde89224f254602fed9b3c404d3f1da4bde89224f254602fed&session=9b3c404d3f1da4bde89224f254602fed9b3c404d3f1da4bde89224f254602fed Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions
3 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request login.php Show response gpginternational.com/ol/ Redirect Chain https://gpginternational.com/ol/index.php https://gpginternational.com/ol/login.php?cmd=login_submit&id=9b3c404d3f1da4bde89224f254602fed9b3c404d3f1da4bde89224f254602fed&session=9b3c404d3f1da4bde89224f254602fed9b3c404d3f1da4bde89224f254602fed	1 MB 1 MB	227ms 227ms	Document text/html	198.57.164.52 Unified Layer
General Check archive.org Show headers Download Go to Full URL https://gpginternational.com/ol/login.php?cmd=login_submit&id=9b3c404d3f1da4bde89224f254602fed9b3c404d3f1da4bde89224f254602fed&session=9b3c404d3f1da4bde89224f254602fed9b3c404d3f1da4bde89224f254602fed Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 198.57.164.52 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US), Reverse DNS gpg.gpgindustries.com Software Apache/2.2.34 (Unix) mod_ssl/2.2.34 OpenSSL/1.0.1e-fips DAV/2 mod_bwlimited/1.4 / PHP/5.6.37 Resource Hash `a4c7bffa57dee4264b9dd52f1635a6c9f3da29fca1d523748ed9fba0125226a4` Request headers Host gpginternational.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8 Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Sat, 03 Nov 2018 03:09:14 GMT Server Apache/2.2.34 (Unix) mod_ssl/2.2.34 OpenSSL/1.0.1e-fips DAV/2 mod_bwlimited/1.4 X-Powered-By PHP/5.6.37 Keep-Alive timeout=5, max=99 Connection Keep-Alive Transfer-Encoding chunked Content-Type text/html; charset=UTF-8 Redirect headers Date Sat, 03 Nov 2018 03:09:14 GMT Server Apache/2.2.34 (Unix) mod_ssl/2.2.34 OpenSSL/1.0.1e-fips DAV/2 mod_bwlimited/1.4 X-Powered-By PHP/5.6.37 location login.php?cmd=login_submit&id=9b3c404d3f1da4bde89224f254602fed9b3c404d3f1da4bde89224f254602fed&session=9b3c404d3f1da4bde89224f254602fed9b3c404d3f1da4bde89224f254602fed Content-Length 0 Keep-Alive timeout=5, max=100 Connection Keep-Alive Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	default.css gpginternational.com/ol/jk/	23 KB 23 KB	372ms 180ms	Stylesheet text/css	198.57.164.52 Unified Layer
General Check archive.org Show headers Download Go to Full URL https://gpginternational.com/ol/jk/default.css Requested by Host: gpginternational.com URL: https://gpginternational.com/ol/login.php?cmd=login_submit&id=9b3c404d3f1da4bde89224f254602fed9b3c404d3f1da4bde89224f254602fed&session=9b3c404d3f1da4bde89224f254602fed9b3c404d3f1da4bde89224f254602fed Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 198.57.164.52 Provo, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US), Reverse DNS gpg.gpgindustries.com Software Apache/2.2.34 (Unix) mod_ssl/2.2.34 OpenSSL/1.0.1e-fips DAV/2 mod_bwlimited/1.4 / Resource Hash `c6fd1e1fe5693af23aee9d3ac556f5945e2e5a5c6bd5b2546772c2a45d402b11` Request headers Pragma no-cache Accept-Encoding gzip, deflate Host gpginternational.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Accept text/css,/;q=0.1 Referer https://gpginternational.com/ol/login.php?cmd=login_submit&id=9b3c404d3f1da4bde89224f254602fed9b3c404d3f1da4bde89224f254602fed&session=9b3c404d3f1da4bde89224f254602fed9b3c404d3f1da4bde89224f254602fed Connection keep-alive Cache-Control no-cache Referer https://gpginternational.com/ol/login.php?cmd=login_submit&id=9b3c404d3f1da4bde89224f254602fed9b3c404d3f1da4bde89224f254602fed&session=9b3c404d3f1da4bde89224f254602fed9b3c404d3f1da4bde89224f254602fed User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 Response headers Date Sat, 03 Nov 2018 03:09:15 GMT Last-Modified Sat, 19 May 2018 03:35:34 GMT Server Apache/2.2.34 (Unix) mod_ssl/2.2.34 OpenSSL/1.0.1e-fips DAV/2 mod_bwlimited/1.4 ETag "9a0174-5a83-56c86c2d96d80" Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 23171
GET DATA	200 OK	truncated /	866 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `af2f21e45d03ba202dfe5265fe9ef4d1219e9f0528a131b8ccab835475bb2121` Request headers Response headers Access-Control-Allow-Origin * Content-Type image/png
GET DATA	200 OK	truncated /	69 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `6236cf0cc3cf6981172f22942dad3001ebf7906e8e0740447c360d2d94db0799` Request headers Response headers Access-Control-Allow-Origin * Content-Type image/png
GET DATA	200 OK	truncated /	1 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `65a5e27b5bc2dea7a5015391f91a811ac67bf343fc0b5606b376fcc989511414` Request headers Response headers Access-Control-Allow-Origin * Content-Type image/png
GET		request cfs.uzone.id/2fn7a2/	0 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: cfs.uzone.id
URL: https://cfs.uzone.id/2fn7a2/request?id=1&enc=9UwkxLgY9&params=4TtHaUQnUEiP6K%2fc5C582CL4NjpNgssK2EKU7fejxSXf3Xvq50rclpTIwX%2f4%2bYrGlJZeXb29uUCg1x468a9tav470n5BU2%2fb6ruJuHP%2bAcGBtbaf76F12k6L4x5lhTULs65Jdfi8lTRHvur7niiopaHJ2h72wZGWyQLTahEs4iOk7%2fpTPbgTkOdm%2fri8V8qAiC095brQDrrutGy4RRVYKCBv8P0ELCDv4AeziGI3m5J%2bI5MInDvAbK3f0PX5ygibuSZ9d%2bGHQACT03UlOSE4cwLJWcc7%2fSzAxwmGaQ4KKzUs%2fWjFoeYjGRtS2ALXUj6MW0HwvLTCr0ioY%2b%2bUHOdCgLLHC%2b2rJJ5OwmmOBdv%2bMVjncSelfJmecy916nJ%2fq51QhhXLpZnw38rNU2zPQN23gjSIrbWi2SPvTr2ctKeuzCCGgsp8W4obJcaYh77UmD3fAVowhiqWh%2b3lFY9RU%2btvTcRU9osltXZBmTLohPyOqX2TtT2C8GJ%2buheVvuNU78tHO3tHtD5doRl8ptw%2bhuHM6r1D0gcYbdw2vPlYSB8HU9o%3d&idc_r=21015969214&domain=gpginternational.com&sw=1600&sh=1200

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Dropbox (Consumer)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| getParm function| validateForm function| netbro_cache_analytics function| sync function| requestCfs object| EmailField

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cfs.uzone.id
gpginternational.com
cfs.uzone.id
198.57.164.52
6236cf0cc3cf6981172f22942dad3001ebf7906e8e0740447c360d2d94db0799
65a5e27b5bc2dea7a5015391f91a811ac67bf343fc0b5606b376fcc989511414
a4c7bffa57dee4264b9dd52f1635a6c9f3da29fca1d523748ed9fba0125226a4
af2f21e45d03ba202dfe5265fe9ef4d1219e9f0528a131b8ccab835475bb2121
c6fd1e1fe5693af23aee9d3ac556f5945e2e5a5c6bd5b2546772c2a45d402b11