urlscan.io logo urlscan.io
SecurityTrails logo

stayreview.com Open in urlscan Pro
108.167.140.134  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://stayreview.com/edrt-zwwsa/Looginnspotify-noway/webapp/login.php
Submission: On March 28 via automatic, source openphish — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 11 HTTP transactions. The main IP is 108.167.140.134, located in United States and belongs to UNIFIEDLAYER-AS-1, US. The main domain is stayreview.com.
TLS certificate: Issued by R3 on March 21st 2023. Valid for: 3 months.
This is the only time stayreview.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Spotify (Online)

Domain & IP information

IP Address AS Autonomous System
8 108.167.140.134 46606 (UNIFIEDLA...)
3 151.101.129.194 54113 (FASTLY)
11 2
Apex Domain
Subdomains		 Transfer
8 stayreview.com
stayreview.com
199 KB
3 fastly.net
sp-bootstrap.global.ssl.fastly.net — Cisco Umbrella Rank: 512248
216 KB
11 2
Domain Requested by
8 stayreview.com stayreview.com
3 sp-bootstrap.global.ssl.fastly.net stayreview.com
11 2

This site contains no links.

Subject Issuer Validity Valid
www.wallets4u.stayreview.com
R3		 2023-03-21 -
2023-06-19		 3 months crt.sh
*.freetls.fastly.net
GlobalSign Atlas R3 DV TLS CA 2023 Q1		 2023-02-05 -
2024-03-08		 a year crt.sh

This page contains 1 frames:

Primary Page: https://stayreview.com/edrt-zwwsa/Looginnspotify-noway/webapp/login.php
Frame ID: D5A611B4F92EC31248AD7E24FAE9A1DA
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Login - Spotify

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)
Overall confidence: 100%
Detected patterns
  • \bangular.{0,32}\.js
Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

11
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

415 kB
Transfer

816 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request login.php
stayreview.com/edrt-zwwsa/Looginnspotify-noway/webapp/ 		7 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://stayreview.com/edrt-zwwsa/Looginnspotify-noway/webapp/login.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
108.167.140.134 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
quinoacotopaxi.com
Software
Apache /
Resource Hash
1ebe60f82025e74000f53b43918c4235d0cb76dca40e65354e54a253d6b701c7

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

content-encoding
gzip
content-length
2510
content-type
text/html; charset=UTF-8
date
Tue, 28 Mar 2023 02:15:21 GMT
server
Apache
vary
Accept-Encoding
stylecss.css
stayreview.com/edrt-zwwsa/Looginnspotify-noway/webapp/style/ 		289 KB
66 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://stayreview.com/edrt-zwwsa/Looginnspotify-noway/webapp/style/stylecss.css
Requested by
Host: stayreview.com
URL: https://stayreview.com/edrt-zwwsa/Looginnspotify-noway/webapp/login.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
108.167.140.134 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
quinoacotopaxi.com
Software
Apache /
Resource Hash
592ecdf44cc618653bda5ba4ad8f87ede7d5e9f93d40f3883d52d2cb2bbbbe66

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://stayreview.com/edrt-zwwsa/Looginnspotify-noway/webapp/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date
Tue, 28 Mar 2023 02:15:21 GMT
content-encoding
gzip
last-modified
Wed, 14 Jul 2021 04:36:06 GMT
server
Apache
accept-ranges
bytes
vary
Accept-Encoding
content-type
text/css
angular.min.js
stayreview.com/edrt-zwwsa/Looginnspotify-noway/webapp/style/js/ 		163 KB
69 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://stayreview.com/edrt-zwwsa/Looginnspotify-noway/webapp/style/js/angular.min.js
Requested by
Host: stayreview.com
URL: https://stayreview.com/edrt-zwwsa/Looginnspotify-noway/webapp/login.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
108.167.140.134 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
quinoacotopaxi.com
Software
Apache /
Resource Hash
8c50aa8567731858e81bcfd2027718d9a7c8fd7bf54cf496499adbf5da5741b9

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://stayreview.com/edrt-zwwsa/Looginnspotify-noway/webapp/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date
Tue, 28 Mar 2023 02:15:21 GMT
content-encoding
gzip
last-modified
Wed, 14 Jul 2021 04:36:08 GMT
server
Apache
accept-ranges
bytes
vary
Accept-Encoding
content-type
application/javascript
jquery.min.js
stayreview.com/edrt-zwwsa/Looginnspotify-noway/webapp/style/js/ 		95 KB
42 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://stayreview.com/edrt-zwwsa/Looginnspotify-noway/webapp/style/js/jquery.min.js
Requested by
Host: stayreview.com
URL: https://stayreview.com/edrt-zwwsa/Looginnspotify-noway/webapp/login.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
108.167.140.134 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
quinoacotopaxi.com
Software
Apache /
Resource Hash
668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://stayreview.com/edrt-zwwsa/Looginnspotify-noway/webapp/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date
Tue, 28 Mar 2023 02:15:21 GMT
content-encoding
gzip
last-modified
Wed, 14 Jul 2021 04:36:08 GMT
server
Apache
accept-ranges
bytes
vary
Accept-Encoding
content-type
application/javascript
jquery.mask.js
stayreview.com/edrt-zwwsa/Looginnspotify-noway/webapp/style/js/ 		18 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://stayreview.com/edrt-zwwsa/Looginnspotify-noway/webapp/style/js/jquery.mask.js
Requested by
Host: stayreview.com
URL: https://stayreview.com/edrt-zwwsa/Looginnspotify-noway/webapp/login.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
108.167.140.134 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
quinoacotopaxi.com
Software
Apache /
Resource Hash
cf1f0d954cbbbcb32d170b1ff68c5b082a1086f34f2bbee825ca88b7c9fb213a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://stayreview.com/edrt-zwwsa/Looginnspotify-noway/webapp/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date
Tue, 28 Mar 2023 02:15:21 GMT
content-encoding
gzip
last-modified
Wed, 14 Jul 2021 04:36:08 GMT
server
Apache
vary
Accept-Encoding
content-type
application/javascript
accept-ranges
bytes
content-length
5606
jquery.validate.min.js
stayreview.com/edrt-zwwsa/Looginnspotify-noway/webapp/style/js/ 		23 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://stayreview.com/edrt-zwwsa/Looginnspotify-noway/webapp/style/js/jquery.validate.min.js
Requested by
Host: stayreview.com
URL: https://stayreview.com/edrt-zwwsa/Looginnspotify-noway/webapp/login.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
108.167.140.134 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
quinoacotopaxi.com
Software
Apache /
Resource Hash
94d965af65067015be6bf62d7daeca80be9deddc851a6ed0c653318e62a7b4d5

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://stayreview.com/edrt-zwwsa/Looginnspotify-noway/webapp/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date
Tue, 28 Mar 2023 02:15:21 GMT
content-encoding
gzip
last-modified
Wed, 14 Jul 2021 04:36:08 GMT
server
Apache
vary
Accept-Encoding
content-type
application/javascript
accept-ranges
bytes
content-length
9167
style.js
stayreview.com/edrt-zwwsa/Looginnspotify-noway/webapp/style/js/ 		2 KB
925 B 		Script
General
Check archive.org
Download Go to
Full URL
https://stayreview.com/edrt-zwwsa/Looginnspotify-noway/webapp/style/js/style.js
Requested by
Host: stayreview.com
URL: https://stayreview.com/edrt-zwwsa/Looginnspotify-noway/webapp/login.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
108.167.140.134 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
quinoacotopaxi.com
Software
Apache /
Resource Hash
f050012b033cb391112b37757113c73ff09884815ff73ce45592ee309ce87b3f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://stayreview.com/edrt-zwwsa/Looginnspotify-noway/webapp/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date
Tue, 28 Mar 2023 02:15:21 GMT
content-encoding
gzip
last-modified
Wed, 14 Jul 2021 04:36:08 GMT
server
Apache
vary
Accept-Encoding
content-type
application/javascript
accept-ranges
bytes
content-length
848
imgs.svg
stayreview.com/edrt-zwwsa/Looginnspotify-noway/webapp/style/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://stayreview.com/edrt-zwwsa/Looginnspotify-noway/webapp/style/imgs.svg
Requested by
Host: stayreview.com
URL: https://stayreview.com/edrt-zwwsa/Looginnspotify-noway/webapp/style/stylecss.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
108.167.140.134 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
quinoacotopaxi.com
Software
Apache /
Resource Hash
f771fe217119432dbcdb59fe3d3ac37547eadd1a118d1646011d1d7ba7e053bf

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://stayreview.com/edrt-zwwsa/Looginnspotify-noway/webapp/style/stylecss.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

date
Tue, 28 Mar 2023 02:15:22 GMT
last-modified
Wed, 14 Jul 2021 04:36:06 GMT
server
Apache
accept-ranges
bytes
content-length
4207
content-type
image/svg+xml
circular-black.woff2
sp-bootstrap.global.ssl.fastly.net/8.7.0/fonts/ 		72 KB
73 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://sp-bootstrap.global.ssl.fastly.net/8.7.0/fonts/circular-black.woff2
Requested by
Host: stayreview.com
URL: https://stayreview.com/edrt-zwwsa/Looginnspotify-noway/webapp/style/stylecss.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.129.194 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
d77456e48416e475066a580b2050cee4f86a3819556d0ddf90d81250f3af9de2

Request headers

Referer
https://stayreview.com/
Origin
https://stayreview.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

Date
Tue, 28 Mar 2023 02:15:22 GMT
Age
2387140
x-amz-meta-goog-reserved-file-mtime
1550690582
X-Cache
HIT, HIT
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
Connection
keep-alive
Content-Length
73892
X-Served-By
cache-chi-kigq8000086-CHI, cache-fra-eddf8230103-FRA
Last-Modified
Mon, 21 Mar 2022 12:56:44 GMT
ETag
"56b510f616f840ffde8f3955349a6c5a"
x-goog-generation
1647867404954983
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Cache-Control
max-age=86400
x-goog-stored-content-length
73892
Accept-Ranges
bytes
X-Cache-Hits
18, 1
circular-bold.woff2
sp-bootstrap.global.ssl.fastly.net/8.7.0/fonts/ 		74 KB
74 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://sp-bootstrap.global.ssl.fastly.net/8.7.0/fonts/circular-bold.woff2
Requested by
Host: stayreview.com
URL: https://stayreview.com/edrt-zwwsa/Looginnspotify-noway/webapp/style/stylecss.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.129.194 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
fdf0e3938479eb6e108e7869436051b7072b9a18ecb98b3c6b49d1b29d8bc758

Request headers

Referer
https://stayreview.com/
Origin
https://stayreview.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

Date
Tue, 28 Mar 2023 02:15:22 GMT
Age
2296475
x-amz-meta-goog-reserved-file-mtime
1550690582
X-Cache
HIT, HIT
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
Connection
keep-alive
Content-Length
75488
X-Served-By
cache-chi-klot8100026-CHI, cache-fra-eddf8230051-FRA
Last-Modified
Mon, 21 Mar 2022 12:56:44 GMT
ETag
"c094813cfe6be5d188f4e506b6ffca1b"
x-goog-generation
1647867404953751
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Cache-Control
max-age=86400
x-goog-stored-content-length
75488
Accept-Ranges
bytes
X-Cache-Hits
121, 1
circular-book.woff2
sp-bootstrap.global.ssl.fastly.net/8.7.0/fonts/ 		68 KB
69 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://sp-bootstrap.global.ssl.fastly.net/8.7.0/fonts/circular-book.woff2
Requested by
Host: stayreview.com
URL: https://stayreview.com/edrt-zwwsa/Looginnspotify-noway/webapp/style/stylecss.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.129.194 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
6384070e855e2ec15caefb6334ab2c4b1b9e798ce2e369cc00f0d47a41138e0d

Request headers

Referer
https://stayreview.com/
Origin
https://stayreview.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.110 Safari/537.36

Response headers

Date
Tue, 28 Mar 2023 02:15:22 GMT
Age
1789724
x-amz-meta-goog-reserved-file-mtime
1550690582
X-Cache
HIT, HIT
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
Connection
keep-alive
Content-Length
70092
X-Served-By
cache-chi-kigq8000052-CHI, cache-fra-eddf8230106-FRA
Last-Modified
Mon, 21 Mar 2022 12:56:45 GMT
ETag
"c4f753e765823b94234e7f5ccd733f44"
x-goog-generation
1647867405030797
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Cache-Control
max-age=86400
x-goog-stored-content-length
70092
Accept-Ranges
bytes
X-Cache-Hits
1, 1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Spotify (Online)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| angular function| $ function| jQuery function| preventBack

0 Cookies