www.gpt-investor.de Open in urlscan Pro
172.67.155.14  Malicious Activity! Public Scan

Submitted URL: https://swisstrading.info/
Effective URL: https://www.gpt-investor.de/
Submission: On September 12 via automatic, source certstream-suspicious — Scanned from IT

Summary

This website contacted 4 IPs in 2 countries across 3 domains to perform 14 HTTP transactions. The main IP is 172.67.155.14, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.gpt-investor.de.
TLS certificate: Issued by WE1 on August 20th 2024. Valid for: 3 months.
This is the only time www.gpt-investor.de was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Cloudflare (Online)

Domain & IP information

IP Address AS Autonomous System
1 172.67.171.126 13335 (CLOUDFLAR...)
1 10 172.67.155.14 13335 (CLOUDFLAR...)
2 104.18.95.41 13335 (CLOUDFLAR...)
14 4
Apex Domain
Subdomains
Transfer
10 gpt-investor.de
www.gpt-investor.de
96 KB
2 cloudflare.com
challenges.cloudflare.com — Cisco Umbrella Rank: 3877
15 KB
1 swisstrading.info
swisstrading.info
669 B
14 3
Domain Requested by
10 www.gpt-investor.de 1 redirects swisstrading.info
www.gpt-investor.de
2 challenges.cloudflare.com www.gpt-investor.de
challenges.cloudflare.com
1 swisstrading.info
14 3

This site contains links to these domains. Also see Links.

Domain
www.cloudflare.com
Subject Issuer Validity Valid
swisstrading.info
WE1
2024-09-12 -
2024-12-11
3 months crt.sh
gpt-investor.de
WE1
2024-08-20 -
2024-11-18
3 months crt.sh
challenges.cloudflare.com
WE1
2024-09-05 -
2024-12-04
3 months crt.sh

This page contains 2 frames:

Primary Page: https://www.gpt-investor.de/
Frame ID: CDF79EB763BA55B6E7F84A4D6DAC1547
Requests: 11 HTTP requests in this frame

Frame: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/w19tu/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/normal/auto/
Frame ID: A910760CABADC08F4B23E94BE11B29E1
Requests: 1 HTTP requests in this frame

Screenshot

Page Title

Ci siamo quasi…

Page URL History Show full URLs

  1. https://swisstrading.info/ Page URL
  2. https://www.gpt-investor.de/ Page URL
  3. https://www.gpt-investor.de/cdn-cgi/phish-bypass?atok=hj_izrwaLGW4a0fMj3thV9mygD9Aw8COXwm2jMZVkIw-172612... HTTP 301
    https://www.gpt-investor.de/ Page URL

Page Statistics

14
Requests

86 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

4
IPs

2
Countries

112 kB
Transfer

245 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://swisstrading.info/ Page URL
  2. https://www.gpt-investor.de/ Page URL
  3. https://www.gpt-investor.de/cdn-cgi/phish-bypass?atok=hj_izrwaLGW4a0fMj3thV9mygD9Aw8COXwm2jMZVkIw-1726121035-0.0.1.1-%2F HTTP 301
    https://www.gpt-investor.de/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
/
swisstrading.info/
356 B
669 B
Document
General
Full URL
https://swisstrading.info/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.171.126 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
19e1669dd094323c76fd48ac8f004b545b0114051df4870babb0a9928341155d

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
8c1db270dc7a0e07-MXP
content-encoding
br
content-type
text/html; charset=UTF-8
date
Thu, 12 Sep 2024 06:03:54 GMT
last-modified
Tue, 20 Aug 2024 04:54:29 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6hnT407NMLiXQl1kv6wmp1x0ZECMmLz2nJLvm4XFc2pnh5GvCv2So44Bi3zlCm5gVE%2Ba7bBS9d9wsrhgleZkjnmjBTFOVdsLuofhzXME7BlU7tmDq8sW5oKXmh3a7sZH7YL5Yw%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
/
www.gpt-investor.de/
4 KB
2 KB
Document
General
Full URL
https://www.gpt-investor.de/
Requested by
Host: swisstrading.info
URL: https://swisstrading.info/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.155.14 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dfa5905b1566bf87f8cf449b777772be576557a82a09f3314be46cee7b10020b
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://swisstrading.info/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

cf-ray
8c1db2756c080e43-MXP
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Thu, 12 Sep 2024 06:03:55 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=A1UiUfbax3vbBrjlN%2B2tOlJidMvbAJ4owBTFspIUCjCQTfQJWqIMiSClJuiNj5EmQBha1vqYAXxkSuvOmNn7qKWQdk4NvQ%2Fu45oDHXzIMemaTgrPQ7V85UW0tqfLcNbES3v6btOP"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
cf.errors.css
www.gpt-investor.de/cdn-cgi/styles/
23 KB
5 KB
Stylesheet
General
Full URL
https://www.gpt-investor.de/cdn-cgi/styles/cf.errors.css
Requested by
Host: www.gpt-investor.de
URL: https://www.gpt-investor.de/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.155.14 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
84e3c77025ace5af143972b4a40fc834dcdfd4e449d4b36a57e62326f16b3091
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Referer
https://www.gpt-investor.de/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Thu, 12 Sep 2024 06:03:55 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Sun, 08 Sep 2024 16:12:06 GMT
server
cloudflare
etag
W/"66ddccd6-5df3"
x-frame-options
DENY
vary
Accept-Encoding
content-type
text/css
cache-control
max-age=7200, public
cf-ray
8c1db275dcba0e43-MXP
expires
Thu, 12 Sep 2024 08:03:55 GMT
icon-exclamation.png
www.gpt-investor.de/cdn-cgi/images/
452 B
540 B
Image
General
Full URL
https://www.gpt-investor.de/cdn-cgi/images/icon-exclamation.png?1376755637
Requested by
Host: www.gpt-investor.de
URL: https://www.gpt-investor.de/cdn-cgi/styles/cf.errors.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.155.14 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Referer
https://www.gpt-investor.de/cdn-cgi/styles/cf.errors.css
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Thu, 12 Sep 2024 06:03:55 GMT
x-content-type-options
nosniff
last-modified
Sun, 08 Sep 2024 16:12:06 GMT
server
cloudflare
etag
"66ddccd6-1c4"
x-frame-options
DENY
vary
Accept-Encoding
content-type
image/png
cache-control
max-age=7200, public
accept-ranges
bytes
cf-ray
8c1db2764d760e43-MXP
content-length
452
expires
Thu, 12 Sep 2024 08:03:55 GMT
favicon.ico
www.gpt-investor.de/
17 KB
9 KB
Other
General
Full URL
https://www.gpt-investor.de/favicon.ico
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.155.14 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c7a5d52c53ad5e788f76b5b9055e211d4aa748fb7e68f06c69f5ce0ef27ec74e
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www.gpt-investor.de/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Thu, 12 Sep 2024 06:03:55 GMT
content-encoding
br
x-content-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cross-origin-embedder-policy
require-corp
critical-ch
Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cross-origin-resource-policy
same-origin
alt-svc
h3=":443"; ma=86400
cf-chl-out
D+ANqwgio926TJL16shCM/PzAIRAn8AVCOd2rGBDBHB0OrYL63hyMCtJWtGU46jRroOXsNPZYYm3ixFODUPUTskMDG2xkdAJMfVjoQR3boXfyTnUu5++PUUNSGlEQrxJ4axRHczvk3jbGTHwKtyxpw==$E9sfNC9050kcZ0ryUc0M0Q==
referrer-policy
same-origin
accept-ch
Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cross-origin-opener-policy
same-origin
cf-mitigated
challenge
server
cloudflare
x-frame-options
SAMEORIGIN
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0Ab1tq88MjxvBHcR%2FVHY5zb2rRXloyNT7rdnYz8fRZQg%2FLm6kH4iG%2BmJHrdBOJg3W90JhzvE70jZ%2BQyXh76cPkTwapUuon5EnFITJ%2F1zk34I%2ByqIGFIl%2BERuFaBn1gYg5INzacCB"}],"group":"cf-nel","max_age":604800}
content-type
text/html; charset=UTF-8
vary
Accept-Encoding
origin-agent-cluster
?1
cache-control
private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
permissions-policy
accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
cf-ray
8c1db2769e410e43-MXP
expires
Thu, 01 Jan 1970 00:00:01 GMT
Primary Request /
www.gpt-investor.de/
Redirect Chain
  • https://www.gpt-investor.de/cdn-cgi/phish-bypass?atok=hj_izrwaLGW4a0fMj3thV9mygD9Aw8COXwm2jMZVkIw-1726121035-0.0.1.1-%2F
  • https://www.gpt-investor.de/
17 KB
8 KB
Document
General
Full URL
https://www.gpt-investor.de/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.155.14 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
938dcc30e7a1783f984e86648ab8fab660441412180ac3a2f33ad0e47583b1ea
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www.gpt-investor.de/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

accept-ch
Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
alt-svc
h3=":443"; ma=86400
cache-control
private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-chl-out
8DzEDJkPJ4tvGCDPvFvF4hJEBgHiEF7scIf92Ajre5qf39LsTLThyhBOZBW2J6PYgf5o2zSLzp4Sz0w0UiaiefqDgGeIVgOjPV7ZpJBqt5IvKcrZonylfzZG3cD981MQTG29GhQuLNkMRH4fwazUjw==$rdeU6qROr4hP7WLsblvOcQ==
cf-mitigated
challenge
cf-ray
8c1db2959dee0e43-MXP
content-encoding
br
content-type
text/html; charset=UTF-8
critical-ch
Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cross-origin-embedder-policy
require-corp
cross-origin-opener-policy
same-origin
cross-origin-resource-policy
same-origin
date
Thu, 12 Sep 2024 06:04:00 GMT
expires
Thu, 01 Jan 1970 00:00:01 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
origin-agent-cluster
?1
permissions-policy
accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
referrer-policy
same-origin
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=p%2FiztWbAwhV0jrU0G27arRDtgadJELgG2AaV8ySY4EWfF%2Fp8xSBxgv9nhPd%2B6g6lsDo8ouh4Bs5xL093DPICTc%2FykHfTnpGEWH0gAs5q0%2FpTVyFN4pC0FiQDXjxv1B%2FdCEMltwZ9"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
x-content-options
nosniff
x-frame-options
SAMEORIGIN

Redirect headers

cache-control
private, no-cache
cf-ray
8c1db2951d020e43-MXP
content-length
167
content-type
text/html
date
Thu, 12 Sep 2024 06:04:00 GMT
location
https://www.gpt-investor.de/
server
cloudflare
x-content-type-options
nosniff
x-frame-options
DENY
v1
www.gpt-investor.de/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/
88 KB
35 KB
Script
General
Full URL
https://www.gpt-investor.de/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=8c1db2959dee0e43
Requested by
Host: www.gpt-investor.de
URL: https://www.gpt-investor.de/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.155.14 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dea18c960cf269627fac47479e64872f35f0a37e9fc63c8d27123ebd3050318f

Request headers

Referer
https://www.gpt-investor.de/?__cf_chl_rt_tk=T3Gy2YvY_LFOR9.EN..yVY6jSj6yUsqul9bA8lGdSqk-1726121040-0.0.1.1-4607
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Thu, 12 Sep 2024 06:04:00 GMT
content-encoding
br
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dILWZamgUGgfulRlIqmspaZ2t9HMvMJa0VhOXpjmDBk6kriWKwWGhJ8LbxOVlyLrtEwcYhwy9mk2qxgJOLuQSMPDPpC%2F9zlUjq2w7GBDzvjB1uJLJ7dNT9Eyjlxnr8MuRapUHuha"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=UTF-8
cache-control
private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-ray
8c1db2961ed50e43-MXP
alt-svc
h3=":443"; ma=86400
22cc0dd0-3ca5-4c84-a6a4-e7cb5cc3f8ba
https://www.gpt-investor.de/ Frame
0
0

api.js
challenges.cloudflare.com/turnstile/v0/g/7cf142fb2c1f/
45 KB
15 KB
Script
General
Full URL
https://challenges.cloudflare.com/turnstile/v0/g/7cf142fb2c1f/api.js?onload=rFWx1&render=explicit
Requested by
Host: www.gpt-investor.de
URL: https://www.gpt-investor.de/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=8c1db2959dee0e43
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.95.41 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cc9ca8b79b72a3bde8c8a0d5db84f0570b0a73b1b0e8fce1ae8470829933ae62

Request headers

Referer
Origin
https://www.gpt-investor.de
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Thu, 12 Sep 2024 06:04:00 GMT
content-encoding
br
last-modified
Thu, 05 Sep 2024 16:35:58 GMT
server
cloudflare
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
max-age=31536000, stale-if-error=10800, stale-while-revalidate=31536000, public
cross-origin-resource-policy
cross-origin
cf-ray
8c1db2992d580dfa-MXP
alt-svc
h3=":443"; ma=86400
favicon.ico
www.gpt-investor.de/
17 KB
17 KB
Image
General
Full URL
https://www.gpt-investor.de/favicon.ico
Requested by
Host: www.gpt-investor.de
URL: https://www.gpt-investor.de/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.155.14 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c1cde0cc018667c1a697cb1e907f86e7e82f9ffa5aed7720c9c94a316301e785
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www.gpt-investor.de/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Thu, 12 Sep 2024 06:04:00 GMT
content-encoding
br
x-content-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cross-origin-embedder-policy
require-corp
critical-ch
Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cross-origin-resource-policy
same-origin
alt-svc
h3=":443"; ma=86400
cf-chl-out
kUXB4iRVDRSj6/QYZbjB8CK79DNnxQC87vRXOnYjpV7HiQRYf3/nOsKSk+hPFPbj7Rc7mWUbE3HLS4WC/VyV5KLzDg1WsSGP7WsXPKpr5pBQtiFPJ2yv8LdwwkLbr5Ax6SWvIQ70JmctkavXLU7hlA==$zBbuBetEOH30015fAJl0ng==
referrer-policy
same-origin
accept-ch
Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cross-origin-opener-policy
same-origin
cf-mitigated
challenge
server
cloudflare
x-frame-options
SAMEORIGIN
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yKKCGoqjfc1buRnV6h0pHZpAyybqNiV%2Ferd4dHAqD6YbHlrg83aqn7PAqvjZ5tFwZnSJ7z9rRG%2BRFpA%2BGvXwLLr3yhB9ADn1cLILlW0qCexuSN%2FFkkcvHCbDM7%2Bh%2FlBof8U0odOd"}],"group":"cf-nel","max_age":604800}
content-type
text/html; charset=UTF-8
vary
Accept-Encoding
origin-agent-cluster
?1
cache-control
private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
permissions-policy
accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
cf-ray
8c1db296af8f0e43-MXP
expires
Thu, 01 Jan 1970 00:00:01 GMT
c1844018b8cb182
www.gpt-investor.de/cdn-cgi/challenge-platform/h/g/flow/ov1/2090495856:1726118637:kVMlMzRkUPaIU4WPqR5_3dNxgx-IP9ylrLFV8hiC_8M/8c1db2959dee0e43/
16 KB
13 KB
XHR
General
Full URL
https://www.gpt-investor.de/cdn-cgi/challenge-platform/h/g/flow/ov1/2090495856:1726118637:kVMlMzRkUPaIU4WPqR5_3dNxgx-IP9ylrLFV8hiC_8M/8c1db2959dee0e43/c1844018b8cb182
Requested by
Host: www.gpt-investor.de
URL: https://www.gpt-investor.de/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=8c1db2959dee0e43
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.155.14 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d6c6c48a7403475e68938ce0f3d4f23b664d898c5c74a330ce2f3b9fdfa9d39b

Request headers

Referer
https://www.gpt-investor.de/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
CF-Challenge
c1844018b8cb182
Content-type
application/x-www-form-urlencoded

Response headers

date
Thu, 12 Sep 2024 06:04:00 GMT
content-encoding
br
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LRZ07V7CZw1DIMqbhIk7Kn%2FK9teiDeo7WwV4Q2vGYqXCOuwwJ0kIpUIyVxJ2ZDMPmOgxE7Iv8l1TUXiztVPB1OowZGOWe8g5iD9uKACaVZnpkBB1rlg2bUo1lTczVPEaWQmBNRa4"}],"group":"cf-nel","max_age":604800}
content-type
text/plain; charset=UTF-8
cf-ray
8c1db29748910e43-MXP
alt-svc
h3=":443"; ma=86400
cf-chl-gen
C6WmZ3zG9uNMVr23g1MHHLN9y9/vQyh3xVHMIpQgE4+Gr1p2xR5rUdKWfly7sK1/n7UI1/yQFA==$xeyLQ+MWrGyW9as4
36d0d215-5ac1-4473-bb0f-15024505f29a
https://www.gpt-investor.de/ Frame
0
0

/
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/w19tu/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/normal/auto/ Frame A910
0
0
Document
General
Full URL
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/w19tu/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/normal/auto/
Requested by
Host: challenges.cloudflare.com
URL: https://challenges.cloudflare.com/turnstile/v0/g/7cf142fb2c1f/api.js?onload=rFWx1&render=explicit
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.95.41 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
Content-Security-Policy frame-src https://challenges.cloudflare.com/; base-uri 'self'

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

accept-ch
Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
alt-svc
h3=":443"; ma=86400
cache-control
private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-ray
8c1db29c6e4a0f72-MXP
content-encoding
br
content-security-policy
frame-src https://challenges.cloudflare.com/; base-uri 'self'
content-type
text/html; charset=UTF-8
critical-ch
Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cross-origin-embedder-policy
require-corp
cross-origin-opener-policy
same-origin
cross-origin-resource-policy
cross-origin
date
Thu, 12 Sep 2024 06:04:01 GMT
document-policy
js-profiling
origin-agent-cluster
?1
permissions-policy
accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
referrer-policy
same-origin
server
cloudflare
favicon.ico
www.gpt-investor.de/
17 KB
8 KB
Other
General
Full URL
https://www.gpt-investor.de/favicon.ico
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.155.14 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fa259404232a795074153e6ef6b2e6fea29eb26ae3c49ecdb8effe11b545fb4c
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www.gpt-investor.de/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date
Thu, 12 Sep 2024 06:04:01 GMT
content-encoding
br
x-content-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cross-origin-embedder-policy
require-corp
critical-ch
Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cross-origin-resource-policy
same-origin
alt-svc
h3=":443"; ma=86400
cf-chl-out
XAZN7E4TLwed9fF6s7HKCDUgcllKD/WC5YeZUvO5xmPbm0S9DbtCcbUmgGuXN2DoX2ThRLbJdbmTz50Fd2Xn070zqVUYW2SQJSMy30SOFXF34//keoSb5J1zKwa0q1QPGgVaNYpJTT35e0SW7LzGJw==$PSpMtvPSwGSmezdT5lKfTg==
referrer-policy
same-origin
accept-ch
Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cross-origin-opener-policy
same-origin
cf-mitigated
challenge
server
cloudflare
x-frame-options
SAMEORIGIN
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vMLyjcbpZcyIWmX77PxJ14m3rE7CAl7S2%2B30L8iJ8EpxzEFq9yBjefWsDe8CYdlQH87lK8EPkV7QldharNM0Fbqg2hvK2%2BmhaRwKqqjOD3sPQ%2Fwtc6ImtWI2oC3%2FkXMi0W1eIkfg"}],"group":"cf-nel","max_age":604800}
content-type
text/html; charset=UTF-8
vary
Accept-Encoding
origin-agent-cluster
?1
cache-control
private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
permissions-policy
accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
cf-ray
8c1db29eabfd0e43-MXP
expires
Thu, 01 Jan 1970 00:00:01 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
www.gpt-investor.de
URL
blob:https://www.gpt-investor.de/22cc0dd0-3ca5-4c84-a6a4-e7cb5cc3f8ba
Domain
www.gpt-investor.de
URL
blob:https://www.gpt-investor.de/36d0d215-5ac1-4473-bb0f-15024505f29a

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Cloudflare (Online)

18 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| _cf_chl_opt function| sSqh5 function| EIuZ8 object| vGSZ3 object| WhyYO0 function| iSaTw8 function| hHxh4 function| rFWx1 boolean| VYLv8 function| lmgV7 function| mjXG8 object| MDnZa1 number| vORPe8 object| angular string| LYsf1 object| turnstile boolean| SuywC7 boolean| PlmIO4

1 Cookies

Domain/Path Name / Value
.www.gpt-investor.de/ Name: __cf_mw_byp
Value: hj_izrwaLGW4a0fMj3thV9mygD9Aw8COXwm2jMZVkIw-1726121035-0.0.1.1-/

4 Console Messages

Source Level URL
Text
network error URL: https://www.gpt-investor.de/favicon.ico
Message:
Failed to load resource: the server responded with a status of 403 ()
network error URL: https://www.gpt-investor.de/
Message:
Failed to load resource: the server responded with a status of 403 ()
network error URL: https://www.gpt-investor.de/favicon.ico
Message:
Failed to load resource: the server responded with a status of 403 ()
network error URL: https://www.gpt-investor.de/favicon.ico
Message:
Failed to load resource: the server responded with a status of 403 ()