urlscan.io logo urlscan.io
SecurityTrails logo

pay.gptblox.com Open in urlscan Pro
137.66.37.136  Public Scan

Go To Rescan Add Verdict Report
URL: https://pay.gptblox.com/
Submission Tags: phishingrod
Submission: On June 16 via api from DE — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 9 HTTP transactions. The main IP is 137.66.37.136, located in United States and belongs to FLY, US. The main domain is pay.gptblox.com.
TLS certificate: Issued by E5 on June 16th 2024. Valid for: 3 months.
This is the only time pay.gptblox.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 137.66.37.136 40509 (FLY)
4 2600:9000:236... 16509 (AMAZON-02)
2 2400:52e0:1e0... 60068 (CDN77 _)
2 2a04:4e42::720 54113 (FASTLY)
9 4
Apex Domain
Subdomains		 Transfer
4 cloudfront.net
d29lra7z8g0m3a.cloudfront.net
275 KB
2 imgix.net
lemonsqueezy.imgix.net
247 KB
2 usefathom.com
cdn.usefathom.com — Cisco Umbrella Rank: 22147
3 KB
1 gptblox.com
pay.gptblox.com
3 KB
9 4
Domain Requested by
4 d29lra7z8g0m3a.cloudfront.net pay.gptblox.com
d29lra7z8g0m3a.cloudfront.net
2 lemonsqueezy.imgix.net pay.gptblox.com
2 cdn.usefathom.com pay.gptblox.com
1 pay.gptblox.com
9 4

This site contains links to these domains. Also see Links.

Domain
www.lemonsqueezy.com
Subject Issuer Validity Valid
pay.gptblox.com
E5		 2024-06-16 -
2024-09-14		 3 months crt.sh
*.cloudfront.net
Amazon RSA 2048 M01		 2023-10-10 -
2024-09-19		 a year crt.sh
cdn.usefathom.com
R3		 2024-05-22 -
2024-08-20		 3 months crt.sh
*.imgix.com
GlobalSign Atlas R3 DV TLS CA 2023 Q4		 2023-12-07 -
2025-01-07		 a year crt.sh

This page contains 1 frames:

Primary Page: https://pay.gptblox.com/
Frame ID: 48EE0C5088E58973B530940F9195FF14
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

GPTBLOX

Detected technologies

Overall confidence: 100%
Detected patterns

Page Statistics

9
Requests

100 %
HTTPS

75 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

528 kB
Transfer

917 kB
Size

2
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
pay.gptblox.com/ 		6 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://pay.gptblox.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
137.66.37.136 , United States, ASN40509 (FLY, US),
Reverse DNS
Software
Caddy cloudflare /
Resource Hash
6423284fd12786cbe5054608256e2a1edb441dd7c666218e272d548ca5b6a1f8

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

alt-svc
h3=":443"; ma=2592000
apigw-requestid
ZdZp2gyqCYcEJqQ=
apx-hit
true
cache-control
no-cache, private
cf-cache-status
DYNAMIC
cf-ray
894ab2a7fef4392c-IAD
content-encoding
br
content-type
text/html; charset=UTF-8
date
Sun, 16 Jun 2024 12:10:39 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sImNuEU30k4rYyLDifAySJYoNKJ%2FCCiTCcVI4gSGoyOULOGkBXrHCNzUKRhT3uOhX9F7%2FlraGAPTA9Hn%2Bma%2F1yXGpyUfTdvV9I6UXzfG9pPsyaqaQGloVzk%2FxUTomvzuEF30eyNWqVeq%2FjgQnKhwYhsXFZVCh9w%3D"}],"group":"cf-nel","max_age":604800}
server
Caddy cloudflare
vary
X-Inertia
store-DbthBrMF.css
d29lra7z8g0m3a.cloudfront.net/213cdacd-83cd-4731-ade4-f81921239444/build/assets/ 		92 KB
14 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://d29lra7z8g0m3a.cloudfront.net/213cdacd-83cd-4731-ade4-f81921239444/build/assets/store-DbthBrMF.css
Requested by
Host: pay.gptblox.com
URL: https://pay.gptblox.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:236e:ce00:1b:e223:f580:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
1bca33d175d2cd4685372205eb39c7fdb1d8317ee85b0edc262e7af15462d697

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://pay.gptblox.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 14 Jun 2024 22:40:36 GMT
content-encoding
br
via
1.1 0dec5f752f0f332c449471a83f050dd2.cloudfront.net (CloudFront)
last-modified
Fri, 14 Jun 2024 22:35:50 GMT
server
AmazonS3
x-amz-cf-pop
FRA60-P1
age
135004
etag
W/"b8397b76f42616e9fe1d97a27012230c"
x-amz-server-side-encryption
AES256
vary
Accept-Encoding, Origin
x-cache
Hit from cloudfront
content-type
text/css
cache-control
public, max-age=31536000
x-amz-cf-id
IVmIpOIKNC9nhIhkrvDK2EHLN1-atL4gP15ymosWKXWwxcYTq1tevg==
expires
Mon, 24 Jun 2024 09:17:00 GMT
script.js
cdn.usefathom.com/ 		6 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.usefathom.com/script.js
Requested by
Host: pay.gptblox.com
URL: https://pay.gptblox.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1079:1 , Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software
BunnyCDN-DE1-1079 /
Resource Hash
19ddbd3f35a8f49ec6c6b5074c782c5b9324b8fda7859ee5f632d10e95c02e81

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://pay.gptblox.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sun, 16 Jun 2024 12:10:39 GMT
content-encoding
br
cdn-edgestorageid
1080
x-vapor-base64-encode
True
cdn-cachedat
06/03/2024 13:51:53
cdn-pullzone
506217
last-modified
Thu, 11 Apr 2024 02:47:00 GMT
server
BunnyCDN-DE1-1079
cdn-proxyver
1.04
cdn-requestpullcode
200
etag
W/"d41d8cd98f00b204e9800998ecf8427e"
vary
Accept-Encoding, Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cdn-cache
HIT
cdn-uid
aa90c48b-f401-4fa1-aac1-c94c8f3ae560
cache-control
public, max-age=0
cdn-requestid
5816bf4c65eb85de7cb47151013bd323
cdn-requestcountrycode
DE
cdn-status
200
cdn-requestpullsuccess
True
srvwHPjCc0pRjp6Q08kGXF4kF2ufdy7rb9Tl2tTX.png
lemonsqueezy.imgix.net/avatars/stores/48819/ 		5 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lemonsqueezy.imgix.net/avatars/stores/48819/srvwHPjCc0pRjp6Q08kGXF4kF2ufdy7rb9Tl2tTX.png?fit=clip&h=100&ixlib=php-3.3.1&w=100&s=261a99ba4a5ee6577e9044c31a35dff6
Requested by
Host: pay.gptblox.com
URL: https://pay.gptblox.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42::720 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
imgix /
Resource Hash
2965de342eedd0015997425bca0a6244075b9fa00096dc2c12bf39b6031477d8
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://pay.gptblox.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sun, 16 Jun 2024 12:10:39 GMT
x-content-type-options
nosniff
last-modified
Sun, 16 Jun 2024 12:10:39 GMT
server
imgix
age
0
x-cache
MISS, MISS, MISS
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-imgix-id
5bec253b7f86a53890cafae61bffb694e88f22b7
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
timing-allow-origin
*
content-length
4660
x-served-by
cache-sjc10048-SJC, cache-fra-etou8220064-FRA, cache-mxp6971-MXP
Inter-Medium-COKxvYe5.ttf
d29lra7z8g0m3a.cloudfront.net/213cdacd-83cd-4731-ade4-f81921239444/build/assets/ 		285 KB
134 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://d29lra7z8g0m3a.cloudfront.net/213cdacd-83cd-4731-ade4-f81921239444/build/assets/Inter-Medium-COKxvYe5.ttf
Requested by
Host: d29lra7z8g0m3a.cloudfront.net
URL: https://d29lra7z8g0m3a.cloudfront.net/213cdacd-83cd-4731-ade4-f81921239444/build/assets/store-DbthBrMF.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:236e:ce00:1b:e223:f580:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
5249ae5f8ddfded34c98c6e3cf09e08f178f234e1bfa28a68f98f6f957628418

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://d29lra7z8g0m3a.cloudfront.net/213cdacd-83cd-4731-ade4-f81921239444/build/assets/store-DbthBrMF.css
Origin
https://pay.gptblox.com
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 14 Jun 2024 22:38:33 GMT
content-encoding
br
via
1.1 36cd2d0f34e25c2dc5099656a60bedac.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA60-P1
age
135127
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Fri, 14 Jun 2024 22:35:19 GMT
server
AmazonS3
etag
W/"5ff1f2a9a78730d7d0c309320ff3c9c7"
vary
Accept-Encoding
content-type
font/ttf
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=31536000
x-amz-cf-id
rMGquUQAbwEUZIuXAVlX4RxlP1ql0_YKreCA-upgoLGOIvGuwV0emQ==
expires
Sun, 12 May 2024 12:48:38 GMT
Inter-Regular-aSe4hpkI.ttf
d29lra7z8g0m3a.cloudfront.net/213cdacd-83cd-4731-ade4-f81921239444/build/assets/ 		281 KB
125 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://d29lra7z8g0m3a.cloudfront.net/213cdacd-83cd-4731-ade4-f81921239444/build/assets/Inter-Regular-aSe4hpkI.ttf
Requested by
Host: d29lra7z8g0m3a.cloudfront.net
URL: https://d29lra7z8g0m3a.cloudfront.net/213cdacd-83cd-4731-ade4-f81921239444/build/assets/store-DbthBrMF.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:236e:ce00:1b:e223:f580:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
1041a8cf17dab7579acef0cc46b21f6497ec1ae01918ddc3495416efb81a4780

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://d29lra7z8g0m3a.cloudfront.net/213cdacd-83cd-4731-ade4-f81921239444/build/assets/store-DbthBrMF.css
Origin
https://pay.gptblox.com
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 14 Jun 2024 22:38:33 GMT
content-encoding
br
via
1.1 36cd2d0f34e25c2dc5099656a60bedac.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA60-P1
age
135127
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Fri, 14 Jun 2024 22:35:19 GMT
server
AmazonS3
etag
W/"515cae74eee4925d56e6ac70c25fc0f6"
vary
Accept-Encoding
content-type
font/ttf
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=31536000
x-amz-cf-id
ySwYSymNGfIbNXEX5bbk1Owqlloc08G7K_m8UGDnoyFztHTrIWduIQ==
expires
Sun, 12 May 2024 12:48:38 GMT
cbb80beb-12d1-44b3-9c9f-c45ec4ee3390.jpg
lemonsqueezy.imgix.net/media/48819/ 		242 KB
242 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://lemonsqueezy.imgix.net/media/48819/cbb80beb-12d1-44b3-9c9f-c45ec4ee3390.jpg?fit=clip&h=1000&ixlib=php-3.3.1&w=1000&s=7bb5a30787c6e475ec0d942f30ef2edb
Requested by
Host: pay.gptblox.com
URL: https://pay.gptblox.com/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42::720 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
imgix /
Resource Hash
fba71df10f40afe71fed5edd9df797a8127bd4bcb0a994be7d92921c4de5e409
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://pay.gptblox.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sun, 16 Jun 2024 12:10:39 GMT
x-content-type-options
nosniff
last-modified
Sun, 16 Jun 2024 12:10:39 GMT
server
imgix
age
0
x-cache
MISS, MISS, MISS
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
x-imgix-id
81beedec05f99fe71ce27fe67486518b37a518c9
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
timing-allow-origin
*
content-length
247709
x-served-by
cache-sjc10055-SJC, cache-fra-etou8220103-FRA, cache-mxp6971-MXP
/
cdn.usefathom.com/ 		43 B
427 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn.usefathom.com/?h=https%3A%2F%2Fpay.gptblox.com&p=%2F&r=&sid=CDEHFFIM&qs=%7B%7D&cid=65486729
Requested by
Host: pay.gptblox.com
URL: https://pay.gptblox.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::1079:1 , Germany, ASN60068 (CDN77 _, GB),
Reverse DNS
Software
BunnyCDN-DE1-1079 /
Resource Hash
aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://pay.gptblox.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sun, 16 Jun 2024 12:10:39 GMT
cdn-edgestorageid
1082
cdn-cachedat
06/16/2024 12:10:39
cdn-pullzone
506217
content-length
43
pragma
no-cache
server
BunnyCDN-DE1-1079
cdn-proxyver
1.04
cdn-requestpullcode
200
tk
N
content-type
text/plain; charset=utf-8, image/gif
cdn-cache
MISS
cdn-uid
aa90c48b-f401-4fa1-aac1-c94c8f3ae560
cache-control
public, max-age=0
cdn-requestid
f308b768bc12e2cb9279b772f0e81517
cdn-requestcountrycode
DE
cdn-status
200
cdn-requestpullsuccess
True
favicon.png
d29lra7z8g0m3a.cloudfront.net/213cdacd-83cd-4731-ade4-f81921239444/img/ 		1 KB
2 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://d29lra7z8g0m3a.cloudfront.net/213cdacd-83cd-4731-ade4-f81921239444/img/favicon.png
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:236e:ce00:1b:e223:f580:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
89ccfa3db5c4db99c305c8aaa50255045d92bb729f6579849c7b8ae177bcf272

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://pay.gptblox.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 14 Jun 2024 22:39:43 GMT
via
1.1 0dec5f752f0f332c449471a83f050dd2.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA60-P1
age
135057
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-length
1341
last-modified
Fri, 14 Jun 2024 22:35:53 GMT
server
AmazonS3
etag
"9d0ce7dfbdda7f801e8959e512178959"
vary
Origin
content-type
image/png
cache-control
public, max-age=31536000
accept-ranges
bytes
x-amz-cf-id
e_KMbcNRzt1V2wGzeRuDoL5ezfwBvPChD5lxTFB5_kMkZyDN86plMQ==
expires
Sun, 12 May 2024 12:49:41 GMT

Verdicts & Comments Add Verdict or Comment

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

undefined| event object| fence object| sharedStorage object| fathom

2 Cookies

Domain/Path Name / Value
.pay.gptblox.com/ Name: XSRF-TOKEN
Value: eyJpdiI6InUzSzgvZFF2RDU2dXJuamY3RXpQcFE9PSIsInZhbHVlIjoiWFFoQTRPZXJHNTE0T3VDSDFoSFJmQ3hNUzBGY0g1bE1iWDI4aWJZNlJRZVloSnZGTC9tSFY2TGhiUEpWNGJEZVdRTks4elAxS3FwYzF3NFZDTjFYNkp1WDR3VzZVMFJ3Q01jWlpEV0pzbCthWDVYbHJkZTd4dUdBd1pIVjNmWVoiLCJtYWMiOiI0ODY1NjljOTc2OGRlNGYzNjllZmFhZjc5MjI3ZDA4YmE2Njc0ZTk3ZDM3ZjBiMGY3MDA1NDFmMGFjYTM0NWIyIiwidGFnIjoiIn0%3D
.pay.gptblox.com/ Name: laravel_session
Value: eyJpdiI6IlFBekhrQmlVd1h3VTdpQ2tFN3FqL0E9PSIsInZhbHVlIjoiUHJCUkJkUkp4VkF0WXhWRm5BcHpxN3RTbUxkMkVIVkNGMTl6WlhaTmh6QWg2dEh5N2J6MnRhZWRHRWhmRWV3M2N6WnBiUkdhc0lQV09XTFl0bENUY3kwUENCMzJYYTVVcnRuOWF4NlJlRjdzNDVVR0gwTm4ya084b1BONlJ4K1kiLCJtYWMiOiIyNDQxMmVmNGRhY2ZlMGFlNWFkNzg3YWE1MDAyMzlmNjcwNThhMDYxODJjZTkwNzZlZGUwZTkzYzM5NWVkNjAzIiwidGFnIjoiIn0%3D