![](/screenshots/c67577da-b79b-48b3-8e5b-f362a0c7b7ed.png)
gtoonly.com
Open in
urlscan Pro
162.241.69.143
Malicious Activity!
Public Scan
Effective URL: https://gtoonly.com/faxdocument/ofc3/s/?signin=d41d8cd98f00b204e9800998ecf8427e&auth=88b374ccef0b9c5b12c44cc9c3d64af...
Submission: On October 29 via manual from IN — Scanned from DE
Summary
TLS certificate: Issued by R3 on October 28th 2021. Valid for: 3 months.
This is the only time gtoonly.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 3 | 162.241.69.143 162.241.69.143 | 46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1) | |
1 | 104.16.19.94 104.16.19.94 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 45.79.77.20 45.79.77.20 | 63949 (LINODE-AP...) (LINODE-AP Linode) | |
4 | 4 |
ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: 162-241-69-143.unifiedlayer.com
gtoonly.com |
ASN63949 (LINODE-AP Linode, LLC, US)
PTR: li1176-20.members.linode.com
jsonip.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
3 |
gtoonly.com
1 redirects
gtoonly.com |
55 KB |
1 |
jsonip.com
jsonip.com |
448 B |
1 |
cloudflare.com
cdnjs.cloudflare.com |
64 KB |
4 | 3 |
Domain | Requested by | |
---|---|---|
3 | gtoonly.com | 1 redirects |
1 | jsonip.com |
cdnjs.cloudflare.com
|
1 | cdnjs.cloudflare.com |
gtoonly.com
|
4 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
gtoonly.com R3 |
2021-10-28 - 2022-01-26 |
3 months | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2021-09-21 - 2022-09-20 |
a year | crt.sh |
jsonip.com R3 |
2021-09-24 - 2021-12-23 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://gtoonly.com/faxdocument/ofc3/s/?signin=d41d8cd98f00b204e9800998ecf8427e&auth=88b374ccef0b9c5b12c44cc9c3d64afbb20cecede8ee864385ac5830c185afc9a507cc73
Frame ID: 2589E800544D83A3C6E2149A411F1150
Requests: 8 HTTP requests in this frame
Screenshot
![](/screenshots/c67577da-b79b-48b3-8e5b-f362a0c7b7ed.png)
Page Title
Sign inPage URL History Show full URLs
-
https://gtoonly.com/faxdocument/ofc3/
HTTP 303
https://gtoonly.com/faxdocument/ofc3/r.php?signin=d41d8cd98f00b204e9800998ecf8427e&auth=88b374cc... Page URL
- https://gtoonly.com/faxdocument/ofc3/s/?signin=d41d8cd98f00b204e9800998ecf8427e&auth=88b374ccef0... Page URL
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://gtoonly.com/faxdocument/ofc3/
HTTP 303
https://gtoonly.com/faxdocument/ofc3/r.php?signin=d41d8cd98f00b204e9800998ecf8427e&auth=88b374ccef0b9c5b12c44cc9c3d64afbb20cecede8ee864385ac5830c185afc9a507cc73 Page URL
- https://gtoonly.com/faxdocument/ofc3/s/?signin=d41d8cd98f00b204e9800998ecf8427e&auth=88b374ccef0b9c5b12c44cc9c3d64afbb20cecede8ee864385ac5830c185afc9a507cc73 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://gtoonly.com/faxdocument/ofc3/ HTTP 303
- https://gtoonly.com/faxdocument/ofc3/r.php?signin=d41d8cd98f00b204e9800998ecf8427e&auth=88b374ccef0b9c5b12c44cc9c3d64afbb20cecede8ee864385ac5830c185afc9a507cc73
4 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
r.php
gtoonly.com/faxdocument/ofc3/ Redirect Chain
|
222 B 538 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
/
gtoonly.com/faxdocument/ofc3/s/ |
54 KB 54 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.js
cdnjs.cloudflare.com/ajax/libs/jquery/3.0.0/ |
257 KB 64 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
17 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
jsonip.com/ |
147 B 448 B |
Script
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
7 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
10 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
3 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)8 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler function| $ function| jQuery function| getIPAddress string| x2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
gtoonly.com/faxdocument/ofc3/s | Name: ip11 Value: 216.131.111.174 |
|
gtoonly.com/ | Name: PHPSESSID Value: d0dbc1b2f746cf4dfede0b7664fc6528 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdnjs.cloudflare.com
gtoonly.com
jsonip.com
104.16.19.94
162.241.69.143
45.79.77.20
36e3b5b21e8814afe7733b7c3c107ddade568a6b345e3833ac1ed528d04e8e13
8eb3cb67ef2f0f1b76167135cef6570a409c79b23f0bc0ede71c9a4018f1408a
9782f1ecb6b550428d8af3893fe2cee9d2006a70afb89242db2a4598a702c301
b480904618bae645dbeef844f16a0cf21ea2cb5d60d6cccdea4d769b546923d2
b96a505dd534df04ccab09917736f38d007fa9e1e0b962b1c634d95ac5649a6e
dd914df3baab24025a92fab436a22dc0bad30fa4811978c291adb397aca6dd55
e44094cb47ef04b5ce46ef29eaf3b79ce1dc01b7afc982e2e7737623db184f79
e5d76d37ee9e79f68d4d7219b98dc6b664539c27ad9e349b8a5649e7ad44ab1b