gcto.com.mx - urlscan.io

Summary

This website contacted 1 IPs in 1 countries across 2 domains to perform 6 HTTP transactions. The main IP is 69.61.0.197, located in Saint Louis, United States and belongs to GLOBALCOMPASS - Cyber Wurx LLC, US. The main domain is gcto.com.mx.
TLS certificate: Issued by cPanel, Inc. Certification Authority on April 13th 2019. Valid for: 3 months.

This is the only time gcto.com.mx was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: OneDrive (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 1	100.25.91.149 100.25.91.149	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
1 7	69.61.0.197 69.61.0.197	22653 (GLOBALCOM...) (GLOBALCOMPASS - Cyber Wurx LLC)
6	1

1 100.25.91.149 (United States) 1 redirects

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-100-25-91-149.compute-1.amazonaws.com

smarturl.it	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 69.61.0.197 (Saint Louis, United States) 1 redirects

ASN22653 (GLOBALCOMPASS - Cyber Wurx LLC, US)
PTR: floyd.serverparlor.net

gcto.com.mx	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	gcto.com.mx 1 redirects gcto.com.mx	98 KB
1	smarturl.it 1 redirects smarturl.it	548 B
6	2

	Domain	Requested by
7	gcto.com.mx	1 redirects gcto.com.mx
1	smarturl.it	1 redirects
6	2

This site contains no links.

Subject Issuer	Validity	Valid
gcto.com.mx cPanel, Inc. Certification Authority	`2019-04-13` - `2019-07-12`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://gcto.com.mx/doc/DocuSign/login.php?cmd=login_submit&id=d52f513755b132c4dbae7fed9c4f2a0ed52f513755b132c4dbae7fed9c4f2a0e&session=d52f513755b132c4dbae7fed9c4f2a0ed52f513755b132c4dbae7fed9c4f2a0e
Frame ID: 16771D82008F3B56B44DA16DA759809B
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://smarturl.it/lhnw11 HTTP 301
https://gcto.com.mx/doc/DocuSign/index.php HTTP 302
https://gcto.com.mx/doc/DocuSign/login.php?cmd=login_submit&id=d52f513755b132c4dbae7fed9c4f2a0ed... Page URL

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

6
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

1
IPs

1
Countries

97 kB
Transfer

97 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://smarturl.it/lhnw11 HTTP 301
https://gcto.com.mx/doc/DocuSign/index.php HTTP 302
https://gcto.com.mx/doc/DocuSign/login.php?cmd=login_submit&id=d52f513755b132c4dbae7fed9c4f2a0ed52f513755b132c4dbae7fed9c4f2a0e&session=d52f513755b132c4dbae7fed9c4f2a0ed52f513755b132c4dbae7fed9c4f2a0e Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request login.php Show response
gcto.com.mx/doc/DocuSign/
Redirect Chain

https://smarturl.it/lhnw11
https://gcto.com.mx/doc/DocuSign/index.php
https://gcto.com.mx/doc/DocuSign/login.php?cmd=login_submit&id=d52f513755b132c4dbae7fed9c4f2a0ed52f513755b132c4dbae7fed9c4f2a0e&session=d52f513755b132c4dbae7fed9c4f2a0ed52f513755b132c4dbae7fed9c4f2a0e

2 KB
790 B

139ms
139ms

Document
text/html

69.61.0.197
Cyber Wurx LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://gcto.com.mx/doc/DocuSign/login.php?cmd=login_submit&id=d52f513755b132c4dbae7fed9c4f2a0ed52f513755b132c4dbae7fed9c4f2a0e&session=d52f513755b132c4dbae7fed9c4f2a0ed52f513755b132c4dbae7fed9c4f2a0e

Protocol

H2

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

69.61.0.197 Saint Louis, United States, ASN22653 (GLOBALCOMPASS - Cyber Wurx LLC, US),

Reverse DNS

floyd.serverparlor.net

Software

nginx /

Resource Hash

51ea865798867016ee6e2d8926cd4e0f81b7b8d74d0a2f269da5d911bb0ef504

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: gcto.com.mx
:scheme: https
:path: /doc/DocuSign/login.php?cmd=login_submit&id=d52f513755b132c4dbae7fed9c4f2a0ed52f513755b132c4dbae7fed9c4f2a0e&session=d52f513755b132c4dbae7fed9c4f2a0ed52f513755b132c4dbae7fed9c4f2a0e
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status: 200
server: nginx
date: Mon, 29 Apr 2019 17:33:52 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-nginx-cache-status: BYPASS
x-server-powered-by: Engintron
content-encoding: gzip

Redirect headers

status: 302
server: nginx
date: Mon, 29 Apr 2019 17:33:52 GMT
content-type: text/html; charset=UTF-8
content-length: 0
location: login.php?cmd=login_submit&id=d52f513755b132c4dbae7fed9c4f2a0ed52f513755b132c4dbae7fed9c4f2a0e&session=d52f513755b132c4dbae7fed9c4f2a0ed52f513755b132c4dbae7fed9c4f2a0e
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-nginx-cache-status: MISS
x-server-powered-by: Engintron

GET
H2 200 ne1.png
gcto.com.mx/doc/DocuSign/images/ 84 KB
84 KB 267ms
265ms Image
image/png 69.61.0.197
Cyber Wurx LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gcto.com.mx/doc/DocuSign/images/ne1.png
Requested by: Host: gcto.com.mx
URL: https://gcto.com.mx/doc/DocuSign/login.php?cmd=login_submit&id=d52f513755b132c4dbae7fed9c4f2a0ed52f513755b132c4dbae7fed9c4f2a0e&session=d52f513755b132c4dbae7fed9c4f2a0ed52f513755b132c4dbae7fed9c4f2a0e
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 69.61.0.197 Saint Louis, United States, ASN22653 (GLOBALCOMPASS - Cyber Wurx LLC, US),
Reverse DNS: floyd.serverparlor.net
Software: nginx /
Resource Hash: 3d15a7b037231f16f34ff1f392b56aa5235d3cffb36076b6c6dbc8f9922ba945

Request headers

Referer: https://gcto.com.mx/doc/DocuSign/login.php?cmd=login_submit&id=d52f513755b132c4dbae7fed9c4f2a0ed52f513755b132c4dbae7fed9c4f2a0e&session=d52f513755b132c4dbae7fed9c4f2a0ed52f513755b132c4dbae7fed9c4f2a0e
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma: public
date: Mon, 29 Apr 2019 17:33:52 GMT
last-modified: Thu, 24 Jan 2019 16:13:52 GMT
server: nginx
content-type: image/png
status: 200
cache-control: max-age=5184000
accept-ranges: bytes
content-length: 86011
expires: Fri, 28 Jun 2019 17:33:52 GMT

GET
H2 200 ne2.png
gcto.com.mx/doc/DocuSign/images/ 3 KB
3 KB 139ms
137ms Image
image/png 69.61.0.197
Cyber Wurx LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gcto.com.mx/doc/DocuSign/images/ne2.png
Requested by: Host: gcto.com.mx
URL: https://gcto.com.mx/doc/DocuSign/login.php?cmd=login_submit&id=d52f513755b132c4dbae7fed9c4f2a0ed52f513755b132c4dbae7fed9c4f2a0e&session=d52f513755b132c4dbae7fed9c4f2a0ed52f513755b132c4dbae7fed9c4f2a0e
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 69.61.0.197 Saint Louis, United States, ASN22653 (GLOBALCOMPASS - Cyber Wurx LLC, US),
Reverse DNS: floyd.serverparlor.net
Software: nginx /
Resource Hash: 3f0aa6677a47483b7067f8501539fba6bec369a55fbb7d1b014c592900e0dbe8

Request headers

Referer: https://gcto.com.mx/doc/DocuSign/login.php?cmd=login_submit&id=d52f513755b132c4dbae7fed9c4f2a0ed52f513755b132c4dbae7fed9c4f2a0e&session=d52f513755b132c4dbae7fed9c4f2a0ed52f513755b132c4dbae7fed9c4f2a0e
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma: public
date: Mon, 29 Apr 2019 17:33:52 GMT
last-modified: Thu, 18 Oct 2018 19:12:22 GMT
server: nginx
content-type: image/png
status: 200
cache-control: max-age=5184000
accept-ranges: bytes
content-length: 3250
expires: Fri, 28 Jun 2019 17:33:52 GMT

GET
H2 200 ne5.png
gcto.com.mx/doc/DocuSign/images/ 2 KB
3 KB 392ms
390ms Image
image/png 69.61.0.197
Cyber Wurx LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gcto.com.mx/doc/DocuSign/images/ne5.png
Requested by: Host: gcto.com.mx
URL: https://gcto.com.mx/doc/DocuSign/login.php?cmd=login_submit&id=d52f513755b132c4dbae7fed9c4f2a0ed52f513755b132c4dbae7fed9c4f2a0e&session=d52f513755b132c4dbae7fed9c4f2a0ed52f513755b132c4dbae7fed9c4f2a0e
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 69.61.0.197 Saint Louis, United States, ASN22653 (GLOBALCOMPASS - Cyber Wurx LLC, US),
Reverse DNS: floyd.serverparlor.net
Software: nginx /
Resource Hash: d8aa1d09232cc67e05f4ab8d51de99791cefb57869855e7fbe864a0023357ce8

Request headers

Referer: https://gcto.com.mx/doc/DocuSign/login.php?cmd=login_submit&id=d52f513755b132c4dbae7fed9c4f2a0ed52f513755b132c4dbae7fed9c4f2a0e&session=d52f513755b132c4dbae7fed9c4f2a0ed52f513755b132c4dbae7fed9c4f2a0e
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma: public
date: Mon, 29 Apr 2019 17:33:52 GMT
last-modified: Thu, 18 Oct 2018 20:43:30 GMT
server: nginx
content-type: image/png
status: 200
cache-control: max-age=5184000
accept-ranges: bytes
content-length: 2466
expires: Fri, 28 Jun 2019 17:33:52 GMT

GET
H2 200 ne6.png
gcto.com.mx/doc/DocuSign/images/ 4 KB
4 KB 392ms
390ms Image
image/png 69.61.0.197
Cyber Wurx LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gcto.com.mx/doc/DocuSign/images/ne6.png
Requested by: Host: gcto.com.mx
URL: https://gcto.com.mx/doc/DocuSign/login.php?cmd=login_submit&id=d52f513755b132c4dbae7fed9c4f2a0ed52f513755b132c4dbae7fed9c4f2a0e&session=d52f513755b132c4dbae7fed9c4f2a0ed52f513755b132c4dbae7fed9c4f2a0e
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 69.61.0.197 Saint Louis, United States, ASN22653 (GLOBALCOMPASS - Cyber Wurx LLC, US),
Reverse DNS: floyd.serverparlor.net
Software: nginx /
Resource Hash: dd052fa1f013c3cde3d5090bb1a13f0ee1f4ab26e134a599c18525065e6d90bf

Request headers

Referer: https://gcto.com.mx/doc/DocuSign/login.php?cmd=login_submit&id=d52f513755b132c4dbae7fed9c4f2a0ed52f513755b132c4dbae7fed9c4f2a0e&session=d52f513755b132c4dbae7fed9c4f2a0ed52f513755b132c4dbae7fed9c4f2a0e
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma: public
date: Mon, 29 Apr 2019 17:33:52 GMT
last-modified: Thu, 18 Oct 2018 19:14:42 GMT
server: nginx
content-type: image/png
status: 200
cache-control: max-age=5184000
accept-ranges: bytes
content-length: 3828
expires: Fri, 28 Jun 2019 17:33:52 GMT

GET
H2 200 ne7.png
gcto.com.mx/doc/DocuSign/images/ 2 KB
3 KB 139ms
138ms Image
image/png 69.61.0.197
Cyber Wurx LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gcto.com.mx/doc/DocuSign/images/ne7.png
Requested by: Host: gcto.com.mx
URL: https://gcto.com.mx/doc/DocuSign/login.php?cmd=login_submit&id=d52f513755b132c4dbae7fed9c4f2a0ed52f513755b132c4dbae7fed9c4f2a0e&session=d52f513755b132c4dbae7fed9c4f2a0ed52f513755b132c4dbae7fed9c4f2a0e
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 69.61.0.197 Saint Louis, United States, ASN22653 (GLOBALCOMPASS - Cyber Wurx LLC, US),
Reverse DNS: floyd.serverparlor.net
Software: nginx /
Resource Hash: 12a2855ca8c2cec112d9f10a342cd6f12a510a5e68080b31b15431111833fb1b

Request headers

Referer: https://gcto.com.mx/doc/DocuSign/login.php?cmd=login_submit&id=d52f513755b132c4dbae7fed9c4f2a0ed52f513755b132c4dbae7fed9c4f2a0e&session=d52f513755b132c4dbae7fed9c4f2a0ed52f513755b132c4dbae7fed9c4f2a0e
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma: public
date: Mon, 29 Apr 2019 17:33:52 GMT
last-modified: Thu, 18 Oct 2018 19:15:04 GMT
server: nginx
content-type: image/png
status: 200
cache-control: max-age=5184000
accept-ranges: bytes
content-length: 2417
expires: Fri, 28 Jun 2019 17:33:52 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: OneDrive (Online)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

gcto.com.mx
smarturl.it
100.25.91.149
69.61.0.197
12a2855ca8c2cec112d9f10a342cd6f12a510a5e68080b31b15431111833fb1b
3d15a7b037231f16f34ff1f392b56aa5235d3cffb36076b6c6dbc8f9922ba945
3f0aa6677a47483b7067f8501539fba6bec369a55fbb7d1b014c592900e0dbe8
51ea865798867016ee6e2d8926cd4e0f81b7b8d74d0a2f269da5d911bb0ef504
d8aa1d09232cc67e05f4ab8d51de99791cefb57869855e7fbe864a0023357ce8
dd052fa1f013c3cde3d5090bb1a13f0ee1f4ab26e134a599c18525065e6d90bf

gcto.com.mx Open in urlscan Pro 69.61.0.197 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

6 Requests

100 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

1 IPs

1 Countries

97 kBTransfer

97 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

0 Cookies

Security Headers

Indicators

gcto.com.mx Open in urlscan Pro
69.61.0.197 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

1
IPs

1
Countries

97 kB
Transfer

97 kB
Size

0
Cookies

6 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!