g0cer.com Open in urlscan Pro
91.109.6.212 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://fklri9875yfjkdsnmwsdewer.azureedge.net/
Effective URL:
https://g0cer.com/tdars/shopify.com/login?content=true&form=AccountVerification&sessionid=dc68c69daa70f723b0f3e442...
Submission Tags: https://phish.report @phish_report Search All
Submission: On August 10 via api (August 10th 2022, 11:24:17 am UTC) from FI — Scanned from FI

Summary HTTP 5 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 5 HTTP transactions. The main IP is 91.109.6.212, located in Leeds, United Kingdom and belongs to GD-EMEA-DC-LD5, DE. The main domain is g0cer.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on July 18th 2022. Valid for: 3 months.

This is the only time g0cer.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Shopify (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 1	2620:1ec:40::44 2620:1ec:40::44	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
3	91.109.6.212 91.109.6.212	20738 (GD-EMEA-D...) (GD-EMEA-DC-LD5)
5	2

1 2620:1ec:40::44 (United States) 1 redirects

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

fklri9875yfjkdsnmwsdewer.azureedge.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 91.109.6.212 (Leeds, United Kingdom)

ASN20738 (GD-EMEA-DC-LD5, DE)
PTR: ultra10.extendnet.co.uk

g0cer.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	g0cer.com g0cer.com	1 MB
1	azureedge.net 1 redirects fklri9875yfjkdsnmwsdewer.azureedge.net	173 B
5	2

	Domain	Requested by
3	g0cer.com	g0cer.com
1	fklri9875yfjkdsnmwsdewer.azureedge.net	1 redirects
5	2

This site contains links to these domains. Also see Links.

Domain
shopify.com

Subject Issuer	Validity	Valid
exae.net cPanel, Inc. Certification Authority	`2022-07-18` - `2022-10-16`	3 months	crt.sh

This page contains 2 frames:

Primary Page: https://g0cer.com/tdars/shopify.com/login?content=true&form=AccountVerification&sessionid=dc68c69daa70f723b0f3e4424c95cecedc68c69daa70f723b0f3e4424c95cece&amp=&idd=dc68c69daa70f723b0f3e4424c95ceceJagHzzyveFKRUq1AtNAbIqbaTEHqCbkDQirgdRhtVh9jbZMPHeeqnOY5NWOfoWvhCoY0olArEfGHSJvb
Frame ID: 311C05EAE7AE9AAA42F7F635468B9816
Requests: 4 HTTP requests in this frame

Frame: data://truncated
Frame ID: AFD5367C7EAF51B70861FAAFD88B1886
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Log in - Shopify

Page URL History Show full URLs

https://fklri9875yfjkdsnmwsdewer.azureedge.net/ HTTP 308
https://g0cer.com/tdars/shopify.com/ Page URL
https://g0cer.com/tdars/shopify.com/login?content=true&form=AccountVerification&sessionid=dc68... Page URL

Page Statistics

5
Requests

60 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

1121 kB
Transfer

1122 kB
Size

1
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://shopify.com/

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://fklri9875yfjkdsnmwsdewer.azureedge.net/ HTTP 308
https://g0cer.com/tdars/shopify.com/ Page URL
https://g0cer.com/tdars/shopify.com/login?content=true&form=AccountVerification&sessionid=dc68c69daa70f723b0f3e4424c95cecedc68c69daa70f723b0f3e4424c95cece&amp=&idd=dc68c69daa70f723b0f3e4424c95ceceJagHzzyveFKRUq1AtNAbIqbaTEHqCbkDQirgdRhtVh9jbZMPHeeqnOY5NWOfoWvhCoY0olArEfGHSJvb Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://fklri9875yfjkdsnmwsdewer.azureedge.net/ HTTP 308
https://g0cer.com/tdars/shopify.com/

5 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	/ g0cer.com/tdars/shopify.com/ Redirect Chain https://fklri9875yfjkdsnmwsdewer.azureedge.net/ https://g0cer.com/tdars/shopify.com/	328 B 763 B	690ms 377ms	Document text/html	91.109.6.212 GD-EMEA-DC-LD5
General Check archive.org Show headers Download Go to Full URL https://g0cer.com/tdars/shopify.com/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 91.109.6.212 Leeds, United Kingdom, ASN20738 (GD-EMEA-DC-LD5, DE), Reverse DNS ultra10.extendnet.co.uk Software Apache / PHP/5.6.40 Resource Hash Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36 accept-language fi-FI,fi;q=0.9 Response headers Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Connection Keep-Alive Content-Type text/html; charset=UTF-8 Date Wed, 10 Aug 2022 11:24:11 GMT Expires Thu, 19 Nov 1981 08:52:00 GMT Keep-Alive timeout=5, max=100 Pragma no-cache Server Apache Transfer-Encoding chunked X-Powered-By PHP/5.6.40 Redirect headers content-length 0 date Wed, 10 Aug 2022 11:24:12 GMT location https://g0cer.com/tdars/shopify.com/ x-azure-ref 0XJXzYgAAAADoyYdzn2+7Rb+EYHeiE8WTRlJBMjMxMDUwNDE4MDM1AGRjMmRiNTU2LTA5N2QtNDM4NC1iNGNkLWFmZDFkN2E2ZDQ2MQ==
GET H/1.1	200 OK	Primary Request login Show response g0cer.com/tdars/shopify.com/	523 KB 523 KB	127ms 127ms	Document text/html	91.109.6.212 GD-EMEA-DC-LD5
General Check archive.org Show headers Download Go to Full URL https://g0cer.com/tdars/shopify.com/login?content=true&form=AccountVerification&sessionid=dc68c69daa70f723b0f3e4424c95cecedc68c69daa70f723b0f3e4424c95cece&amp=&idd=dc68c69daa70f723b0f3e4424c95ceceJagHzzyveFKRUq1AtNAbIqbaTEHqCbkDQirgdRhtVh9jbZMPHeeqnOY5NWOfoWvhCoY0olArEfGHSJvb Requested by Host: g0cer.com URL: https://g0cer.com/tdars/shopify.com/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 91.109.6.212 Leeds, United Kingdom, ASN20738 (GD-EMEA-DC-LD5, DE), Reverse DNS ultra10.extendnet.co.uk Software Apache / PHP/5.6.40 Resource Hash `e2fc0114349773d162236bff9bd63f7b4764019b50674b8db15cab794eb0e555` Request headers Referer https://g0cer.com/tdars/shopify.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36 accept-language fi-FI,fi;q=0.9 Response headers Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Connection Keep-Alive Content-Type text/html; charset=UTF-8 Date Wed, 10 Aug 2022 11:24:11 GMT Expires Thu, 19 Nov 1981 08:52:00 GMT Keep-Alive timeout=5, max=99 Pragma no-cache Server Apache Transfer-Encoding chunked X-Powered-By PHP/5.6.40
GET DATA	200 OK	truncated /	3 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `31218e858c0c19e74e2c504640631d96bdc143a47314a39c2e9e20cc908f00b8` Request headers accept-language fi-FI,fi;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36 Response headers Content-Type image/svg+xml
GET H/1.1	200 OK	login g0cer.com/tdars/shopify.com/	523 KB 523 KB	128ms 128ms	Font text/html	91.109.6.212 GD-EMEA-DC-LD5
General Check archive.org Show headers Download Go to Full URL https://g0cer.com/tdars/shopify.com/login?content=true&form=AccountVerification&sessionid=dc68c69daa70f723b0f3e4424c95cecedc68c69daa70f723b0f3e4424c95cece&amp=&idd=dc68c69daa70f723b0f3e4424c95ceceJagHzzyveFKRUq1AtNAbIqbaTEHqCbkDQirgdRhtVh9jbZMPHeeqnOY5NWOfoWvhCoY0olArEfGHSJvb Requested by Host: g0cer.com URL: https://g0cer.com/tdars/shopify.com/login?content=true&form=AccountVerification&sessionid=dc68c69daa70f723b0f3e4424c95cecedc68c69daa70f723b0f3e4424c95cece&amp=&idd=dc68c69daa70f723b0f3e4424c95ceceJagHzzyveFKRUq1AtNAbIqbaTEHqCbkDQirgdRhtVh9jbZMPHeeqnOY5NWOfoWvhCoY0olArEfGHSJvb Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 91.109.6.212 Leeds, United Kingdom, ASN20738 (GD-EMEA-DC-LD5, DE), Reverse DNS ultra10.extendnet.co.uk Software Apache / PHP/5.6.40 Resource Hash `e2fc0114349773d162236bff9bd63f7b4764019b50674b8db15cab794eb0e555` Request headers Referer https://g0cer.com/tdars/shopify.com/login?content=true&form=AccountVerification&sessionid=dc68c69daa70f723b0f3e4424c95cecedc68c69daa70f723b0f3e4424c95cece&amp=&idd=dc68c69daa70f723b0f3e4424c95ceceJagHzzyveFKRUq1AtNAbIqbaTEHqCbkDQirgdRhtVh9jbZMPHeeqnOY5NWOfoWvhCoY0olArEfGHSJvb Origin https://g0cer.com accept-language fi-FI,fi;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36 Response headers Pragma no-cache Date Wed, 10 Aug 2022 11:24:12 GMT Server Apache X-Powered-By PHP/5.6.40 Transfer-Encoding chunked Content-Type text/html; charset=UTF-8 Cache-Control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Connection Keep-Alive Keep-Alive timeout=5, max=98 Expires Thu, 19 Nov 1981 08:52:00 GMT
GET DATA	200 OK	truncated / Frame AFD5	798 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `57cafa49fb677c3f09d6e90b051917d10e7bb54e83102a25f3d32b06e8fa59a7` Request headers accept-language fi-FI,fi;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Safari/537.36 Response headers Content-Type image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Shopify (Online)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			g0cer.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 3c4b60ad0e856f1a744f63fff4a9be33

10 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	URL: https://g0cer.com/tdars/shopify.com/login?content=true&form=AccountVerification&sessionid=dc68c69daa70f723b0f3e4424c95cecedc68c69daa70f723b0f3e4424c95cece&amp=&idd=dc68c69daa70f723b0f3e4424c95ceceJagHzzyveFKRUq1AtNAbIqbaTEHqCbkDQirgdRhtVh9jbZMPHeeqnOY5NWOfoWvhCoY0olArEfGHSJvb Message: Failed to decode downloaded font: https://g0cer.com/tdars/shopify.com/login?content=true&form=AccountVerification&sessionid=dc68c69daa70f723b0f3e4424c95cecedc68c69daa70f723b0f3e4424c95cece&amp=&idd=dc68c69daa70f723b0f3e4424c95ceceJagHzzyveFKRUq1AtNAbIqbaTEHqCbkDQirgdRhtVh9jbZMPHeeqnOY5NWOfoWvhCoY0olArEfGHSJvb
other	warning	URL: https://g0cer.com/tdars/shopify.com/login?content=true&form=AccountVerification&sessionid=dc68c69daa70f723b0f3e4424c95cecedc68c69daa70f723b0f3e4424c95cece&amp=&idd=dc68c69daa70f723b0f3e4424c95ceceJagHzzyveFKRUq1AtNAbIqbaTEHqCbkDQirgdRhtVh9jbZMPHeeqnOY5NWOfoWvhCoY0olArEfGHSJvb Message: OTS parsing error: invalid sfntVersion: 1008813135
other	warning	URL: https://g0cer.com/tdars/shopify.com/login?content=true&form=AccountVerification&sessionid=dc68c69daa70f723b0f3e4424c95cecedc68c69daa70f723b0f3e4424c95cece&amp=&idd=dc68c69daa70f723b0f3e4424c95ceceJagHzzyveFKRUq1AtNAbIqbaTEHqCbkDQirgdRhtVh9jbZMPHeeqnOY5NWOfoWvhCoY0olArEfGHSJvb Message: Failed to decode downloaded font: https://g0cer.com/tdars/shopify.com/login?content=true&form=AccountVerification&sessionid=dc68c69daa70f723b0f3e4424c95cecedc68c69daa70f723b0f3e4424c95cece&amp=&idd=dc68c69daa70f723b0f3e4424c95ceceJagHzzyveFKRUq1AtNAbIqbaTEHqCbkDQirgdRhtVh9jbZMPHeeqnOY5NWOfoWvhCoY0olArEfGHSJvb
other	warning	URL: https://g0cer.com/tdars/shopify.com/login?content=true&form=AccountVerification&sessionid=dc68c69daa70f723b0f3e4424c95cecedc68c69daa70f723b0f3e4424c95cece&amp=&idd=dc68c69daa70f723b0f3e4424c95ceceJagHzzyveFKRUq1AtNAbIqbaTEHqCbkDQirgdRhtVh9jbZMPHeeqnOY5NWOfoWvhCoY0olArEfGHSJvb Message: OTS parsing error: invalid sfntVersion: 1008813135
other	warning	URL: https://g0cer.com/tdars/shopify.com/login?content=true&form=AccountVerification&sessionid=dc68c69daa70f723b0f3e4424c95cecedc68c69daa70f723b0f3e4424c95cece&amp=&idd=dc68c69daa70f723b0f3e4424c95ceceJagHzzyveFKRUq1AtNAbIqbaTEHqCbkDQirgdRhtVh9jbZMPHeeqnOY5NWOfoWvhCoY0olArEfGHSJvb Message: Failed to decode downloaded font: https://g0cer.com/tdars/shopify.com/login?content=true&form=AccountVerification&sessionid=dc68c69daa70f723b0f3e4424c95cecedc68c69daa70f723b0f3e4424c95cece&amp=&idd=dc68c69daa70f723b0f3e4424c95ceceJagHzzyveFKRUq1AtNAbIqbaTEHqCbkDQirgdRhtVh9jbZMPHeeqnOY5NWOfoWvhCoY0olArEfGHSJvb
other	warning	URL: https://g0cer.com/tdars/shopify.com/login?content=true&form=AccountVerification&sessionid=dc68c69daa70f723b0f3e4424c95cecedc68c69daa70f723b0f3e4424c95cece&amp=&idd=dc68c69daa70f723b0f3e4424c95ceceJagHzzyveFKRUq1AtNAbIqbaTEHqCbkDQirgdRhtVh9jbZMPHeeqnOY5NWOfoWvhCoY0olArEfGHSJvb Message: OTS parsing error: invalid sfntVersion: 1008813135
other	warning	URL: https://g0cer.com/tdars/shopify.com/login?content=true&form=AccountVerification&sessionid=dc68c69daa70f723b0f3e4424c95cecedc68c69daa70f723b0f3e4424c95cece&amp=&idd=dc68c69daa70f723b0f3e4424c95ceceJagHzzyveFKRUq1AtNAbIqbaTEHqCbkDQirgdRhtVh9jbZMPHeeqnOY5NWOfoWvhCoY0olArEfGHSJvb Message: Failed to decode downloaded font: https://g0cer.com/tdars/shopify.com/login?content=true&form=AccountVerification&sessionid=dc68c69daa70f723b0f3e4424c95cecedc68c69daa70f723b0f3e4424c95cece&amp=&idd=dc68c69daa70f723b0f3e4424c95ceceJagHzzyveFKRUq1AtNAbIqbaTEHqCbkDQirgdRhtVh9jbZMPHeeqnOY5NWOfoWvhCoY0olArEfGHSJvb
other	warning	URL: https://g0cer.com/tdars/shopify.com/login?content=true&form=AccountVerification&sessionid=dc68c69daa70f723b0f3e4424c95cecedc68c69daa70f723b0f3e4424c95cece&amp=&idd=dc68c69daa70f723b0f3e4424c95ceceJagHzzyveFKRUq1AtNAbIqbaTEHqCbkDQirgdRhtVh9jbZMPHeeqnOY5NWOfoWvhCoY0olArEfGHSJvb Message: OTS parsing error: invalid sfntVersion: 1008813135
other	warning	URL: https://g0cer.com/tdars/shopify.com/login?content=true&form=AccountVerification&sessionid=dc68c69daa70f723b0f3e4424c95cecedc68c69daa70f723b0f3e4424c95cece&amp=&idd=dc68c69daa70f723b0f3e4424c95ceceJagHzzyveFKRUq1AtNAbIqbaTEHqCbkDQirgdRhtVh9jbZMPHeeqnOY5NWOfoWvhCoY0olArEfGHSJvb Message: Failed to decode downloaded font: https://g0cer.com/tdars/shopify.com/login?content=true&form=AccountVerification&sessionid=dc68c69daa70f723b0f3e4424c95cecedc68c69daa70f723b0f3e4424c95cece&amp=&idd=dc68c69daa70f723b0f3e4424c95ceceJagHzzyveFKRUq1AtNAbIqbaTEHqCbkDQirgdRhtVh9jbZMPHeeqnOY5NWOfoWvhCoY0olArEfGHSJvb
other	warning	URL: https://g0cer.com/tdars/shopify.com/login?content=true&form=AccountVerification&sessionid=dc68c69daa70f723b0f3e4424c95cecedc68c69daa70f723b0f3e4424c95cece&amp=&idd=dc68c69daa70f723b0f3e4424c95ceceJagHzzyveFKRUq1AtNAbIqbaTEHqCbkDQirgdRhtVh9jbZMPHeeqnOY5NWOfoWvhCoY0olArEfGHSJvb Message: OTS parsing error: invalid sfntVersion: 1008813135

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fklri9875yfjkdsnmwsdewer.azureedge.net
g0cer.com
2620:1ec:40::44
91.109.6.212
31218e858c0c19e74e2c504640631d96bdc143a47314a39c2e9e20cc908f00b8
54711b11bf7c2b91e94c05b9c7f6046c13a3146b7fda9fe24d35e43f86025396
57cafa49fb677c3f09d6e90b051917d10e7bb54e83102a25f3d32b06e8fa59a7
dc2c62d69073ffb5e127a06aaaa31e3cae110a60c970eea2a4d1116ba0a69cee
e2fc0114349773d162236bff9bd63f7b4764019b50674b8db15cab794eb0e555

g0cer.com Open in urlscan Pro 91.109.6.212 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

5 Requests

60 %HTTPS

50 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

1121 kBTransfer

1122 kBSize

1 Cookies

1 Outgoing links

Page URL History

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

11 JavaScript Global Variables

1 Cookies

10 Console Messages

Indicators

g0cer.com Open in urlscan Pro
91.109.6.212 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

60 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

1121 kB
Transfer

1122 kB
Size

1
Cookies

5 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!