gcsllc.us
Open in
urlscan Pro
108.167.140.130
Malicious Activity!
Public Scan
Submission: On June 22 via manual from US
Summary
This is the only time gcsllc.us was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Global Sources (E-commerce)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 | 108.167.140.130 108.167.140.130 | 20013 (CYRUSONE) (CYRUSONE - CyrusOne LLC) | |
7 | 203.92.211.29 203.92.211.29 | 2687 (ATGS-MMD-AS) (ATGS-MMD-AS - AT&T Global Network Services) | |
1 | 2a02:26f0:6c0... 2a02:26f0:6c00:299::25eb | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
1 | 2a05:f500:10:... 2a05:f500:10:101::b93f:9101 | 14413 (LINKEDIN) (LINKEDIN - LinkedIn Corporation) | |
11 | 4 |
ASN2687 (ATGS-MMD-AS - AT&T Global Network Services, LLC, US)
PTR: hkgs29.globalsources.com
login.globalsources.com |
ASN14413 (LINKEDIN - LinkedIn Corporation, US)
www.linkedin.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
globalsources.com
login.globalsources.com |
62 KB |
2 |
linkedin.com
platform.linkedin.com www.linkedin.com |
4 KB |
2 |
gcsllc.us
gcsllc.us |
6 KB |
11 | 3 |
Domain | Requested by | |
---|---|---|
7 | login.globalsources.com |
gcsllc.us
|
2 | gcsllc.us |
gcsllc.us
|
1 | www.linkedin.com |
platform.linkedin.com
|
1 | platform.linkedin.com |
gcsllc.us
|
11 | 4 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.globalsources.com |
login.globalsources.com |
Subject Issuer | Validity | Valid |
---|
This page contains 1 frames:
Primary Page:
http://gcsllc.us/wp-content/Global.htm?sid=8849739365&pi_lang=ENG&date=20141124
Frame ID: 32A4080B7822CFF32BD3E66B0D824B8A
Requests: 11 HTTP requests in this frame
Screenshot
Detected technologies
Nginx (Web Servers) ExpandDetected patterns
- headers server /nginx(?:\/([\d.]+))?/i
Linkedin (Widgets) Expand
Detected patterns
- script /\/\/platform\.linkedin\.com\/in\.js/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /jquery.*\.js/i
- env /^jQuery$/i
Page Statistics
6 Outgoing links
These are links going to different origins than the main page.
Title:
Search URL Search Domain Scan URL
Title: Register now
Search URL Search Domain Scan URL
Title: Terms of Use
Search URL Search Domain Scan URL
Title: Privacy Policy
Search URL Search Domain Scan URL
Title: Security Measures
Search URL Search Domain Scan URL
Title: IP Policy
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
11 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
Global.htm
gcsllc.us/wp-content/ |
15 KB 6 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
BASE.CSS
login.globalsources.com/sso/gsol/pex/en/balat/includes/ |
4 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
SSO.CSS
login.globalsources.com/sso/gsol/pex/en/balat/includes/ |
32 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jqueryandplugins.js
login.globalsources.com/sso/gsol/pex/en/balat/includes/ |
99 KB 35 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ssoscripts.js
login.globalsources.com/sso/gsol/pex/en/common/includes/ |
37 KB 10 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
GS_LOGO.PNG
login.globalsources.com/sso/gsol/pex/en/balat/images/ |
4 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
IN_ICO.PNG
login.globalsources.com/sso/gsol/pex/en/balat/images/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
in.js
platform.linkedin.com/ |
4 KB 2 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
BLANK.GIF
login.globalsources.com/sso/gsol/pex/en/balat/images/ |
43 B 476 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
webtrends-prod.js
gcsllc.us/sso/gsol/pex/en/balat/includes/ |
4 B 225 B |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
userspace
www.linkedin.com/uas/js/ |
941 B 1 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Global Sources (E-commerce)152 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| sldpnl function| $ function| jQuery object| Color number| DELAY_SHOW_HIDE string| RFI_MINILOGIN string| RFI_MINIREG string| RFI_MINIREG_PALITE string| USER_REGISTRATION string| PALITE_UPGRADE string| USER_PROFILE string| RFQ_REG string| M_REG string| M_RFI_REG string| EMAGLITE_REG string| LOGIN_LINKEDIN string| BUYER_REGISTRATION_LINKEDIN string| LINKEDIN_EXISTING string| LINKEDIN_NEWREG string| LINKEDIN_EXISTING_NOAPP object| WTSI_P_PREFIX function| winPop function| winPop2 function| winPop3 function| sortThis function| toggleDefValue function| syncCheckboxToHidden function| checkValidID function| getRandom boolean| isMSIE3 string| path number| expDays object| exp string| value function| GetCookie function| SetCookie function| DeleteCookie function| setUniqCookie function| showBox function| hideBox function| delayShowBox function| delayHideBox function| delayShowBox2 function| delayHideBox2 function| toggleHiddenByCheckbox function| checkKeyword function| LTrim function| RTrim function| Trim function| checkIsFilledMandatory function| checkForEmailError function| validateEmailValue function| trimFieldValue function| checkforEmail function| checkEmailFieldNoTrack function| checkEmailIsNotInError function| checkEmailField function| showEmailTipWithError function| showEmailTipWithErrorEmag function| showEmailTipWithErrorEmagCheck function| showErrorEmagLoginCheck function| hasSpecialChars function| hasSpaceChars function| checkUidChar function| showUidTipWithError function| checkPwdChar function| checkValuesMatch function| isNum function| isNumWithSpace function| isPhone function| extendisPhone function| checkNameBg function| changeNameBg function| checkFieldIsNotInError function| changePhoneBg function| toggleLabelColor function| checkEmailBg function| checkPhoneBg function| validatePhoneForEmag function| validatePhoneNumberForEmag function| validatePhoneForOTP function| validateOTPInput function| hideErrorBoxForOTP function| checkPhoneBgEmag function| changeCompanyNameBg function| checkCompanyNameBgEmag function| checkNameBgEmagLiteForm function| checkEmagSelected function| validateCompanyNameForEmag function| checkCombineNameEmag function| checkNameBgEmagLiteFormNew function| checkCompanyURL function| checkCompanyURLFieldError function| checkCompanyURLField function| checkCompanyDescriptionField function| WTFieldErrorTag function| WTFieldPWLengthErrorTag function| WTFieldTag function| WTNumFieldTag string| msg_invalidemailchar string| msg_invalidemail string| invalidemailchar string| invalidemail string| iChar string| iEmail boolean| goWT_Track function| getEvent function| automailKeydown function| automail function| fillinmaill function| hideAutomailBox undefined| req undefined| ctyflag function| checkCountryFieldMobile function| validatingCountryMobile boolean| first_load function| processCountryMobile function| checkUid function| requestReminder function| removeSpaceTelFax function| removeSpaceTelMobile function| removeSpaces function| checkIMoption function| checkEMoption function| isEmpty function| validatePAKW function| toggleCheckBox undefined| compurl function| appendSuggestedCompUrl object| today number| timetoday number| randm string| timenow boolean| nets boolean| nseven number| bVer function| displayFocus function| login_decodeappURL function| login_decodeRegAppURL function| login_decodeSubAppURL function| displayAlert object| snooky function| showMsg object| IN object| statsQueue function| linkedinLogin function| setValue string| linkedinUserId string| emailaddr function| linkedinDoOnUserLogin function| ajaxCheckGSOLUser undefined| _tag0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
gcsllc.us
login.globalsources.com
platform.linkedin.com
www.linkedin.com
108.167.140.130
203.92.211.29
2a02:26f0:6c00:299::25eb
2a05:f500:10:101::b93f:9101
12d0b3d1eb808300056ecc2688881370eeaf198e9be0629a398e0d3d35f39605
14efac6d0b6b202539b6925d00f07ac134ae965aa4feda15bd7a34a5d0aeebe3
1af0a8fc73fd350ea301a7ac920cc1cbab7f910a68b306cbc0b46c73ddcf31b0
21839e0eb260dda7a564eef13fa1ae94970a32834064cfc8437e636cfe7533fb
27dd4c4ecfe38fec71e2253eaf341ff66e6473219c1bf2af7b8cea3f365cbe16
4355af8246305c73f5d0110f808893709ac1c7dc99b6c1f76a3157e91e242107
4546b606dbc8ceabc3f7834ed492d9182f21e03392010a74a77e39146e3771af
9ec0e499f3c48bcb3347efe99d695288da5b2da94fe3333ca52b7bd7f0a075a1
a0ff7bd26675d0bd632c14628c1dbf2dd81ff6f092575f1616551d2eca4700b3
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e
fa0bd1ce06d32006463030997238d6478a7418895c5e0d2af77bcf9b977c4d5d