urlscan.io logo urlscan.io
SecurityTrails logo

mobile-spotify.com Open in urlscan Pro
104.31.86.124  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://mobile-spotify.com/
Submission: On May 24 via automatic, source certstream-suspicious
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 1 countries across 2 domains to perform 4 HTTP transactions. The main IP is 104.31.86.124, located in San Francisco, United States and belongs to CLOUDFLARENET - Cloudflare, Inc., US. The main domain is mobile-spotify.com.
TLS certificate: Issued by COMODO ECC Domain Validation Secure S... on May 24th 2018. Valid for: 6 months.
This is the only time mobile-spotify.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Spotify (Online)

Domain & IP information

IP Address AS Autonomous System
2 104.31.86.124 13335 (CLOUDFLAR...)
2 151.101.13.194 54113 (FASTLY)
4 3
Apex Domain
Subdomains		 Transfer
2 fastly.net
sp-bootstrap.global.ssl.fastly.net
132 KB
2 mobile-spotify.com
mobile-spotify.com
57 KB
4 2
Domain Requested by
2 sp-bootstrap.global.ssl.fastly.net
2 mobile-spotify.com mobile-spotify.com
4 2

This site contains no links.

Subject Issuer Validity Valid
sni157354.cloudflaressl.com
COMODO ECC Domain Validation Secure Server CA 2		 2018-05-24 -
2018-11-30		 6 months crt.sh

This page contains 1 frames:

Primary Page: https://mobile-spotify.com/
Frame ID: BBF7EBD05FE2BC6FF824C431D37BD03D
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /cloudflare/i

Page Statistics

4
Requests

50 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

1
Countries

189 kB
Transfer

410 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
mobile-spotify.com/ 		7 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://mobile-spotify.com/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.31.86.124 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
3d07a68be2f66c7bcfa7f3004791dc952598b24474c6f8f7492b0dcefbd6eb4f

Request headers

:method
GET
:authority
mobile-spotify.com
:scheme
https
:path
/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
accept-encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
X-DevTools-Emulate-Network-Conditions-Client-Id
BBF7EBD05FE2BC6FF824C431D37BD03D

Response headers

status
200
date
Thu, 24 May 2018 08:25:13 GMT
content-type
text/html
set-cookie
__cfduid=d96e09256961da7f4044a07a521083e591527150313; expires=Fri, 24-May-19 08:25:13 GMT; path=/; domain=.mobile-spotify.com; HttpOnly
last-modified
Tue, 08 May 2018 01:27:42 GMT
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
41fe5ed2ba1097a4-FRA
content-encoding
gzip
1a.css
mobile-spotify.com/mx/purchase/panel/css/ 		268 KB
55 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://mobile-spotify.com/mx/purchase/panel/css/1a.css
Requested by
Host: mobile-spotify.com
URL: https://mobile-spotify.com/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.31.86.124 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
b202235c2efed5e6e366bd3e013f796bdf6c5ce275d2d4fb708b36bb2aea3750

Request headers

:path
/mx/purchase/panel/css/1a.css
pragma
no-cache
cookie
__cfduid=d96e09256961da7f4044a07a521083e591527150313
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
accept
text/css,*/*;q=0.1
cache-control
no-cache
:authority
mobile-spotify.com
referer
https://mobile-spotify.com/
:scheme
https
:method
GET
Referer
https://mobile-spotify.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36

Response headers

date
Thu, 24 May 2018 08:25:14 GMT
content-encoding
gzip
cf-cache-status
MISS
last-modified
Mon, 23 Oct 2017 02:51:28 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css
status
200
cache-control
public, max-age=14400
cf-ray
41fe5ed59c3e97a4-FRA
expires
Thu, 24 May 2018 12:25:14 GMT
circular-book.woff2
sp-bootstrap.global.ssl.fastly.net/8.2.0/fonts/ 		63 KB
64 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://sp-bootstrap.global.ssl.fastly.net/8.2.0/fonts/circular-book.woff2
Protocol
HTTP/1.1
Server
151.101.13.194 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
16f860a080d405f412750f83c4ee2168302cd1f3347416b5b3ae50bae3571b28

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Referer
https://mobile-spotify.com/mx/purchase/panel/css/1a.css
Origin
https://mobile-spotify.com

Response headers

x-amz-version-id
uk_BB9oobL1KrkS6Nqt6_9wKZXILdN7q
Via
1.1 varnish, 1.1 varnish
ETag
"0c0dfc4df72c07c84b15651ab6f951a6"
Age
14159920
X-Cache
HIT, HIT
Connection
keep-alive
Content-Length
64512
x-amz-id-2
ugEJLdrSetdDwLrP6GDa3+dh4JRmglaUtBzDgabuCNtKaI9Of7VeZT4LNsTD/c4jKclshAcS1pA=
X-Served-By
cache-iad2129-IAD, cache-fra19132-FRA
Last-Modified
Thu, 07 Sep 2017 19:31:01 GMT
Server
AmazonS3
X-Timer
S1527150315.583426,VS0,VE0
Date
Thu, 24 May 2018 08:25:14 GMT
x-amz-request-id
EC56DFE35C7CF886
Access-Control-Allow-Origin
*
Expires
Fri, 07 Sep 2018 19:30:57 GMT
Cache-Control
max-age=31536000
Accept-Ranges
bytes
Content-Type
application/font-woff
X-Cache-Hits
12409, 2342
truncated
/ 		4 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
7cd549fde0242f32cac05b1f4b9f2abd3d8a585bb71c8a4cade6bbb09c792333

Request headers

Response headers

Access-Control-Allow-Origin
*
Content-Type
image/svg+xml;charset=utf-8
circular-bold.woff2
sp-bootstrap.global.ssl.fastly.net/8.2.0/fonts/ 		68 KB
68 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://sp-bootstrap.global.ssl.fastly.net/8.2.0/fonts/circular-bold.woff2
Protocol
HTTP/1.1
Server
151.101.13.194 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
0e1e4f36fc8076dd1b5f30ac8aeaeed4b5927e475d0d4e7b8d63a33beb2fd0b5

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/66.0.3359.139 Safari/537.36
Referer
https://mobile-spotify.com/mx/purchase/panel/css/1a.css
Origin
https://mobile-spotify.com

Response headers

x-amz-version-id
lv2cUiXWh9.bj.nXkNtlic0Fy4DS6vib
Via
1.1 varnish, 1.1 varnish
ETag
"14bfce9501e5a5dc0adbe559dd630bc6"
Age
21167999
X-Cache
HIT, HIT
Connection
keep-alive
Content-Length
69140
x-amz-id-2
rNce7dCOO32hyrQXyH2FCzeWwtDg5CSctxL2gbijGW288PoyKXDlSdaCgsAFUUFZr0jDnfiu6Ug=
X-Served-By
cache-iad2139-IAD, cache-fra19141-FRA
Last-Modified
Thu, 07 Sep 2017 19:31:01 GMT
Server
AmazonS3
X-Timer
S1527150315.583375,VS0,VE0
Date
Thu, 24 May 2018 08:25:14 GMT
x-amz-request-id
78244A3519109E01
Access-Control-Allow-Origin
*
Expires
Fri, 07 Sep 2018 19:30:57 GMT
Cache-Control
max-age=31536000
Accept-Ranges
bytes
Content-Type
application/font-woff
X-Cache-Hits
4709, 40

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Spotify (Online)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Domain/Path Name / Value
.mobile-spotify.com/ Name: __cfduid
Value: d96e09256961da7f4044a07a521083e591527150313