www.spotifysetup-accountsecurity01.com

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 4 HTTP transactions. The main IP is 91.218.247.92, located in Russian Federation and belongs to NCONNECT-AS, RU. The main domain is www.spotifysetup-accountsecurity01.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on November 18th 2019. Valid for: 3 months.

This is the only time www.spotifysetup-accountsecurity01.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Spotify (Online)

Domain & IP information

	IP Address	AS Autonomous System
2	91.218.247.92 91.218.247.92	49335 (NCONNECT-AS) (NCONNECT-AS)
2	151.101.13.194 151.101.13.194	54113 (FASTLY) (FASTLY - Fastly)
4	3

2 91.218.247.92 (Russian Federation)

ASN49335 (NCONNECT-AS, RU)

www.spotifysetup-accountsecurity01.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.13.194 (Frankfurt am Main, Germany)

ASN54113 (FASTLY - Fastly, US)

sp-bootstrap.global.ssl.fastly.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	fastly.net sp-bootstrap.global.ssl.fastly.net	144 KB
2	spotifysetup-accountsecurity01.com www.spotifysetup-accountsecurity01.com	45 KB
4	2

	Domain	Requested by
2	sp-bootstrap.global.ssl.fastly.net
2	www.spotifysetup-accountsecurity01.com	www.spotifysetup-accountsecurity01.com
4	2

This site contains links to these domains. Also see Links.

Domain
accounts.spotify.com
www.spotify.com

Subject Issuer	Validity	Valid
spotifysetup-accountsecurity01.com cPanel, Inc. Certification Authority	`2019-11-18` - `2020-02-16`	3 months	crt.sh
*.freetls.global.fastly.net GlobalSign CloudSSL CA - SHA256 - G3	`2019-01-02` - `2020-01-03`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://www.spotifysetup-accountsecurity01.com/
Frame ID: E8A0719D40B7F0CEB258EFCD8E2BDD6C
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

LiteSpeed (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /^LiteSpeed$/i

Page Statistics

4
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

189 kB
Transfer

441 kB
Size

0
Cookies

5 Outgoing links

These are links going to different origins than the main page.

URL: https://accounts.spotify.com/en

Search URL Search Domain Scan URL

URL: https://www.spotify.com/us/password-reset/
Title: Forgot your username or password?

Search URL Search Domain Scan URL

URL: https://www.spotify.com/us/signup/?forward_url=https%3A%2F%2Fwww.spotify.com%2Fint%2Faccount%2Foverview%2F
Title: Sign Up

Search URL Search Domain Scan URL

URL: https://www.spotify.com/us/legal/end-user-agreement/plain/
Title: Terms & Conditions

Search URL Search Domain Scan URL

URL: https://www.spotify.com/us/legal/privacy-policy/plain/
Title: Privacy Policy

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response www.spotifysetup-accountsecurity01.com/	6 KB 2 KB	788ms 45ms	Document text/html	91.218.247.92 NCONNECT-AS
General Check archive.org Show headers Download Go to Full URL https://www.spotifysetup-accountsecurity01.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 91.218.247.92 , Russian Federation, ASN49335 (NCONNECT-AS, RU), Reverse DNS Software LiteSpeed / PHP/5.6.40 Resource Hash `6c56a4d0a14965f353d8c9a74c20d2811f7ec8c12812ea587c386bed406ccc3d` Request headers :method GET :authority www.spotifysetup-accountsecurity01.com :scheme https :path / pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36 sec-fetch-user ?1 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3 sec-fetch-site none sec-fetch-mode navigate accept-encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36 Sec-Fetch-User ?1 Response headers status 200 x-powered-by PHP/5.6.40 content-type text/html; charset=UTF-8 content-length 1755 content-encoding br vary Accept-Encoding date Mon, 18 Nov 2019 19:30:30 GMT server LiteSpeed alt-svc quic=":443"; ma=2592000; v="35,39,43,44"
GET H2	200	index.css www.spotifysetup-accountsecurity01.com/css/	289 KB 43 KB	44ms 44ms	Stylesheet text/css	91.218.247.92 NCONNECT-AS
General Check archive.org Show headers Download Go to Full URL https://www.spotifysetup-accountsecurity01.com/css/index.css Requested by Host: www.spotifysetup-accountsecurity01.com URL: https://www.spotifysetup-accountsecurity01.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 91.218.247.92 , Russian Federation, ASN49335 (NCONNECT-AS, RU), Reverse DNS Software LiteSpeed / Resource Hash `7ad0874abe3e28a8ecdb0183b9772aff858bdbd8cf30354dfd2f0d62f82da178` Request headers Referer https://www.spotifysetup-accountsecurity01.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36 Response headers date Mon, 18 Nov 2019 19:30:30 GMT content-encoding br last-modified Tue, 30 Jul 2019 10:27:18 GMT server LiteSpeed vary Accept-Encoding content-type text/css status 200 cache-control max-age=604800, public accept-ranges bytes alt-svc quic=":443"; ma=2592000; v="35,39,43,44" content-length 44210
GET DATA	200 OK	truncated /	4 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `7cd549fde0242f32cac05b1f4b9f2abd3d8a585bb71c8a4cade6bbb09c792333` Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36 Response headers Content-Type image/svg+xml;charset=utf-8
GET H/1.1	200 OK	circular-bold.woff2 sp-bootstrap.global.ssl.fastly.net/8.2.2/fonts/	74 KB 74 KB	36ms 8ms	Font application/font-woff	151.101.13.194 Fastly
General Check archive.org Show headers Download Go to Full URL https://sp-bootstrap.global.ssl.fastly.net/8.2.2/fonts/circular-bold.woff2 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.13.194 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US), Reverse DNS Software AmazonS3 / Resource Hash `fdf0e3938479eb6e108e7869436051b7072b9a18ecb98b3c6b49d1b29d8bc758` Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36 Referer https://www.spotifysetup-accountsecurity01.com/css/index.css Origin https://www.spotifysetup-accountsecurity01.com Response headers x-amz-version-id TDlpjh8XnMfSnl8U7srALu30tKtksNyW Via 1.1 varnish, 1.1 varnish Age 1720761 X-Cache HIT, HIT Date Mon, 18 Nov 2019 19:30:32 GMT X-Cache-Hits 67, 1 Connection keep-alive Content-Length 75488 x-amz-id-2 ENfaC3WWydNqTQxxc8zPwNheFFGYbs3FBi6zaMT0Dptg2pyuVsJUPtNeH60uud54FlaPUCmYNmA= X-Served-By cache-iad2151-IAD, cache-fra19123-FRA Last-Modified Tue, 06 Mar 2018 19:26:26 GMT Server AmazonS3 X-Timer S1574105433.774005,VS0,VE2 ETag "c094813cfe6be5d188f4e506b6ffca1b" x-amz-request-id D9C60A2B0D882589 Access-Control-Allow-Origin * Cache-Control max-age=31536000 Accept-Ranges bytes Content-Type application/font-woff Expires Wed, 06 Mar 2019 19:26:24 GMT
GET H/1.1	200 OK	circular-book.woff2 sp-bootstrap.global.ssl.fastly.net/8.2.2/fonts/	68 KB 69 KB	30ms 7ms	Font application/font-woff	151.101.13.194 Fastly
General Check archive.org Show headers Download Go to Full URL https://sp-bootstrap.global.ssl.fastly.net/8.2.2/fonts/circular-book.woff2 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.13.194 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US), Reverse DNS Software AmazonS3 / Resource Hash `6384070e855e2ec15caefb6334ab2c4b1b9e798ce2e369cc00f0d47a41138e0d` Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.97 Safari/537.36 Referer https://www.spotifysetup-accountsecurity01.com/css/index.css Origin https://www.spotifysetup-accountsecurity01.com Response headers x-amz-version-id kd.JhIt55Js84SKgcOZbomGqUEm372NI Via 1.1 varnish, 1.1 varnish Age 1090147 X-Cache HIT, HIT Date Mon, 18 Nov 2019 19:30:32 GMT X-Cache-Hits 1, 1 Connection keep-alive Content-Length 70092 x-amz-id-2 lVZ4KhBVECOUWmSB0xH++SYrprWeICzbxybBblYbGo20q+lmknSRtOcjexY4FCedwX2JSoiNouw= X-Served-By cache-iad2126-IAD, cache-fra19134-FRA Last-Modified Tue, 06 Mar 2018 19:26:26 GMT Server AmazonS3 X-Timer S1574105433.773293,VS0,VE1 ETag "c4f753e765823b94234e7f5ccd733f44" x-amz-request-id A2BE76E9A7E3B2C2 Access-Control-Allow-Origin * Cache-Control max-age=31536000 Accept-Ranges bytes Content-Type application/font-woff Expires Wed, 06 Mar 2019 19:26:24 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Spotify (Online)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

sp-bootstrap.global.ssl.fastly.net
www.spotifysetup-accountsecurity01.com
151.101.13.194
91.218.247.92
6384070e855e2ec15caefb6334ab2c4b1b9e798ce2e369cc00f0d47a41138e0d
6c56a4d0a14965f353d8c9a74c20d2811f7ec8c12812ea587c386bed406ccc3d
7ad0874abe3e28a8ecdb0183b9772aff858bdbd8cf30354dfd2f0d62f82da178
7cd549fde0242f32cac05b1f4b9f2abd3d8a585bb71c8a4cade6bbb09c792333
fdf0e3938479eb6e108e7869436051b7072b9a18ecb98b3c6b49d1b29d8bc758

www.spotifysetup-accountsecurity01.com Open in urlscan Pro 91.218.247.92 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

4 Requests

100 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

3 IPs

2 Countries

189 kBTransfer

441 kBSize

0 Cookies

5 Outgoing links

Redirected requests

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

0 Cookies

Indicators

www.spotifysetup-accountsecurity01.com Open in urlscan Pro
91.218.247.92 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

4
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

189 kB
Transfer

441 kB
Size

0
Cookies

4 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!