gsf-api.simpshopifyapps.com Open in urlscan Pro
199.250.207.25 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://gsf-api.simpshopifyapps.com/ajr/MINNESOTA/login.php
Submission: On September 19 via manual (September 19th 2021, 6:57:40 pm UTC) from US — Scanned from DE

Summary HTTP 10 Redirects Links 8 Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 10 HTTP transactions. The main IP is 199.250.207.25, located in United States and belongs to IMH-IAD, US. The main domain is gsf-api.simpshopifyapps.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on August 11th 2021. Valid for: 3 months.

This is the only time gsf-api.simpshopifyapps.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: US Government (Government)

Domain & IP information

	IP Address		AS Autonomous System
10	199.250.207.25 199.250.207.25		54641 (IMH-IAD) (IMH-IAD)
10	1

10 199.250.207.25 (United States)

ASN54641 (IMH-IAD, US)
PTR: vps71019.inmotionhosting.com

gsf-api.simpshopifyapps.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	simpshopifyapps.com gsf-api.simpshopifyapps.com	326 KB
10	1

	Domain	Requested by
10	gsf-api.simpshopifyapps.com	gsf-api.simpshopifyapps.com
10	1

This site contains links to these domains. Also see Links.

Domain
www.uimn.org
www1.uimn.org

Subject Issuer	Validity	Valid
gsf-api.simpshopifyapps.com cPanel, Inc. Certification Authority	`2021-08-11` - `2021-11-09`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://gsf-api.simpshopifyapps.com/ajr/MINNESOTA/login.php
Frame ID: FBD4E0DC8918980EBA4A5001AADB9210
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Applicant login

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

10
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

326 kB
Transfer

324 kB
Size

6
Cookies

8 Outgoing links

These are links going to different origins than the main page.

URL: http://www.uimn.org/applicants
Title: Information For Applicants

Search URL Search Domain Scan URL

URL: http://www.uimn.org/assets/HowToApplyForUI_tcm1068-193561.pdf
Title: How to Apply

Search URL Search Domain Scan URL

URL: http://www.uimn.org/applicants/help-support/info-handbook/info-handbook-intro.jsp
Title: Information Handbook

Search URL Search Domain Scan URL

URL: http://www.uimn.org/applicants/videos/
Title: Video Library

Search URL Search Domain Scan URL

URL: http://www.uimn.org/applicants/contact-us/
Title: Contact Us

Search URL Search Domain Scan URL

URL: https://www1.uimn.org/ui_applicant/staticcontent/Accessibility_Statement.htm
Title: Accessibility

Search URL Search Domain Scan URL

URL: https://www1.uimn.org/ui_applicant/staticcontent/PrivacyStatement.htm
Title: Privacy and security

Search URL Search Domain Scan URL

URL: https://www1.uimn.org/ui_applicant/staticcontent/prelim_Web_Page_Settings_Generic.html
Title: System requirements

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request login.php Show response gsf-api.simpshopifyapps.com/ajr/MINNESOTA/	20 KB 20 KB	296ms 101ms	Document text/html	199.250.207.25 IMH-IAD
General Check archive.org Show headers Download Go to Full URL https://gsf-api.simpshopifyapps.com/ajr/MINNESOTA/login.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 199.250.207.25 , United States, ASN54641 (IMH-IAD, US), Reverse DNS vps71019.inmotionhosting.com Software Apache / Resource Hash `95f9b38b3c1358ca700aaf103fda1ee4d485ac7a5f29d4b7ddffa8426126b1ba` Request headers Host gsf-api.simpshopifyapps.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Accept-Language de-DE,de;q=0.9 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site none Sec-Fetch-Mode navigate Sec-Fetch-User ?1 Sec-Fetch-Dest document Accept-Encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers Date Sun, 19 Sep 2021 18:57:35 GMT Server Apache Keep-Alive timeout=5, max=100 Connection Keep-Alive Transfer-Encoding chunked Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	ruxitagentjs_ICA27SVdfhjqru_10217210531114014.js.download Show response gsf-api.simpshopifyapps.com/ajr/MINNESOTA/index_files/	206 KB 207 KB	270ms 98ms	Script application/javascript	199.250.207.25 IMH-IAD
General Check archive.org Show headers Download Go to Full URL https://gsf-api.simpshopifyapps.com/ajr/MINNESOTA/index_files/ruxitagentjs_ICA27SVdfhjqru_10217210531114014.js.download Requested by Host: gsf-api.simpshopifyapps.com URL: https://gsf-api.simpshopifyapps.com/ajr/MINNESOTA/login.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 199.250.207.25 , United States, ASN54641 (IMH-IAD, US), Reverse DNS vps71019.inmotionhosting.com Software Apache / Resource Hash `8a25a83ddf46a9940a7210f66d030d2750ef263f89a5da813ecfe6961c69b4e3` Request headers Pragma no-cache Sec-Fetch-Site same-origin Accept-Encoding gzip, deflate, br Host gsf-api.simpshopifyapps.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Sec-Fetch-Mode no-cors Accept / Cache-Control no-cache Sec-Fetch-Dest script Referer https://gsf-api.simpshopifyapps.com/ajr/MINNESOTA/login.php Connection keep-alive Accept-Language de-DE,de;q=0.9 Referer https://gsf-api.simpshopifyapps.com/ajr/MINNESOTA/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers Date Sun, 19 Sep 2021 18:57:35 GMT Last-Modified Sat, 19 Jun 2021 18:33:48 GMT Server Apache Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 211386
GET H/1.1	200 OK	ui.css gsf-api.simpshopifyapps.com/ajr/MINNESOTA/index_files/	13 KB 13 KB	171ms 98ms	Stylesheet text/css	199.250.207.25 IMH-IAD
General Check archive.org Show headers Download Go to Full URL https://gsf-api.simpshopifyapps.com/ajr/MINNESOTA/index_files/ui.css Requested by Host: gsf-api.simpshopifyapps.com URL: https://gsf-api.simpshopifyapps.com/ajr/MINNESOTA/login.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 199.250.207.25 , United States, ASN54641 (IMH-IAD, US), Reverse DNS vps71019.inmotionhosting.com Software Apache / Resource Hash `819c5e6797cca1b144e323a7fbc9131b1896de02c153300bac606cfc8d1ed136` Request headers Pragma no-cache Sec-Fetch-Site same-origin Accept-Encoding gzip, deflate, br Host gsf-api.simpshopifyapps.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Sec-Fetch-Mode no-cors Accept text/css,/;q=0.1 Cache-Control no-cache Sec-Fetch-Dest style Referer https://gsf-api.simpshopifyapps.com/ajr/MINNESOTA/login.php Connection keep-alive Accept-Language de-DE,de;q=0.9 Referer https://gsf-api.simpshopifyapps.com/ajr/MINNESOTA/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers Date Sun, 19 Sep 2021 18:57:35 GMT Last-Modified Sat, 19 Jun 2021 18:33:48 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 12925
GET H/1.1	200 OK	util.js.download Show response gsf-api.simpshopifyapps.com/ajr/MINNESOTA/index_files/	6 KB 6 KB	282ms 95ms	Script application/javascript	199.250.207.25 IMH-IAD
General Check archive.org Show headers Download Go to Full URL https://gsf-api.simpshopifyapps.com/ajr/MINNESOTA/index_files/util.js.download Requested by Host: gsf-api.simpshopifyapps.com URL: https://gsf-api.simpshopifyapps.com/ajr/MINNESOTA/login.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 199.250.207.25 , United States, ASN54641 (IMH-IAD, US), Reverse DNS vps71019.inmotionhosting.com Software Apache / Resource Hash `93e8e837bd1f524a4379996066a315761ed610be5cedbca5cf4ef80696324a84` Request headers Pragma no-cache Sec-Fetch-Site same-origin Accept-Encoding gzip, deflate, br Host gsf-api.simpshopifyapps.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Sec-Fetch-Mode no-cors Accept / Cache-Control no-cache Sec-Fetch-Dest script Referer https://gsf-api.simpshopifyapps.com/ajr/MINNESOTA/login.php Connection keep-alive Accept-Language de-DE,de;q=0.9 Referer https://gsf-api.simpshopifyapps.com/ajr/MINNESOTA/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers Date Sun, 19 Sep 2021 18:57:35 GMT Last-Modified Sat, 19 Jun 2021 18:33:48 GMT Server Apache Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 5697
GET H/1.1	200 OK	spacer.gif gsf-api.simpshopifyapps.com/ajr/MINNESOTA/index_files/	43 B 283 B	95ms 95ms	Image image/gif	199.250.207.25 IMH-IAD
General Check archive.org Show headers Download Go to Show image Full URL https://gsf-api.simpshopifyapps.com/ajr/MINNESOTA/index_files/spacer.gif Requested by Host: gsf-api.simpshopifyapps.com URL: https://gsf-api.simpshopifyapps.com/ajr/MINNESOTA/login.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 199.250.207.25 , United States, ASN54641 (IMH-IAD, US), Reverse DNS vps71019.inmotionhosting.com Software Apache / Resource Hash `89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7` Request headers Pragma no-cache Sec-Fetch-Site same-origin Accept-Encoding gzip, deflate, br Host gsf-api.simpshopifyapps.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Sec-Fetch-Mode no-cors Accept image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 Cache-Control* no-cache Sec-Fetch-Dest image Referer https://gsf-api.simpshopifyapps.com/ajr/MINNESOTA/login.php Connection keep-alive Accept-Language de-DE,de;q=0.9 Referer https://gsf-api.simpshopifyapps.com/ajr/MINNESOTA/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers Date Sun, 19 Sep 2021 18:57:35 GMT Last-Modified Sat, 19 Jun 2021 18:33:48 GMT Server Apache Content-Type image/gif Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 43
GET H/1.1	200 OK	Unemployment%20Insurance%20Logo%20RGB-websites-projects.png gsf-api.simpshopifyapps.com/ajr/MINNESOTA/index_files/	77 KB 77 KB	96ms 96ms	Image image/png	199.250.207.25 IMH-IAD
General Check archive.org Show headers Download Go to Show image Full URL https://gsf-api.simpshopifyapps.com/ajr/MINNESOTA/index_files/Unemployment%20Insurance%20Logo%20RGB-websites-projects.png Requested by Host: gsf-api.simpshopifyapps.com URL: https://gsf-api.simpshopifyapps.com/ajr/MINNESOTA/login.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 199.250.207.25 , United States, ASN54641 (IMH-IAD, US), Reverse DNS vps71019.inmotionhosting.com Software Apache / Resource Hash `402df36267c7dd63cd0180cf618c6002668ff2f2268415fd4195925952d53268` Request headers Pragma no-cache Sec-Fetch-Site same-origin Accept-Encoding gzip, deflate, br Host gsf-api.simpshopifyapps.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Sec-Fetch-Mode no-cors Accept image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 Cache-Control* no-cache Sec-Fetch-Dest image Referer https://gsf-api.simpshopifyapps.com/ajr/MINNESOTA/login.php Connection keep-alive Accept-Language de-DE,de;q=0.9 Referer https://gsf-api.simpshopifyapps.com/ajr/MINNESOTA/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers Date Sun, 19 Sep 2021 18:57:35 GMT Last-Modified Sat, 19 Jun 2021 18:33:48 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 78822
GET H/1.1	200 OK	b_start.gif gsf-api.simpshopifyapps.com/ajr/MINNESOTA/index_files/	856 B 1 KB	97ms 97ms	Image image/gif	199.250.207.25 IMH-IAD
General Check archive.org Show headers Download Go to Show image Full URL https://gsf-api.simpshopifyapps.com/ajr/MINNESOTA/index_files/b_start.gif Requested by Host: gsf-api.simpshopifyapps.com URL: https://gsf-api.simpshopifyapps.com/ajr/MINNESOTA/login.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 199.250.207.25 , United States, ASN54641 (IMH-IAD, US), Reverse DNS vps71019.inmotionhosting.com Software Apache / Resource Hash `f3ca101abe3776929aa7723f2bcb2174c1e3a21d38fd8e3528906ae16161eb43` Request headers Pragma no-cache Sec-Fetch-Site same-origin Accept-Encoding gzip, deflate, br Host gsf-api.simpshopifyapps.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Sec-Fetch-Mode no-cors Accept image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 Cache-Control* no-cache Sec-Fetch-Dest image Referer https://gsf-api.simpshopifyapps.com/ajr/MINNESOTA/login.php Connection keep-alive Accept-Language de-DE,de;q=0.9 Referer https://gsf-api.simpshopifyapps.com/ajr/MINNESOTA/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers Date Sun, 19 Sep 2021 18:57:35 GMT Last-Modified Sat, 19 Jun 2021 18:33:48 GMT Server Apache Content-Type image/gif Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=97 Content-Length 856
GET H/1.1	200 OK	b_login.gif gsf-api.simpshopifyapps.com/ajr/MINNESOTA/index_files/	679 B 921 B	96ms 95ms	Image image/gif	199.250.207.25 IMH-IAD
General Check archive.org Show headers Download Go to Show image Full URL https://gsf-api.simpshopifyapps.com/ajr/MINNESOTA/index_files/b_login.gif Requested by Host: gsf-api.simpshopifyapps.com URL: https://gsf-api.simpshopifyapps.com/ajr/MINNESOTA/login.php Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 199.250.207.25 , United States, ASN54641 (IMH-IAD, US), Reverse DNS vps71019.inmotionhosting.com Software Apache / Resource Hash `d14cc5be04b3ab95d8a382547e988d3536875528a0b195b1dcacc26989d24e46` Request headers Pragma no-cache Sec-Fetch-Site same-origin Accept-Encoding gzip, deflate, br Host gsf-api.simpshopifyapps.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Sec-Fetch-Mode no-cors Accept image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 Cache-Control* no-cache Sec-Fetch-Dest image Referer https://gsf-api.simpshopifyapps.com/ajr/MINNESOTA/login.php Cookie dtCookie=v_4_srv_-2D44_sn_VATQHGM3R2624A8A9L2TIQIFUJ44NVK5; rxVisitor=1632077855675VIC2GNBDJG75KHAAF5UQFOH1BJ0ASMV3; dtSa=-; dtLatC=98; rxvt=1632079655684\|1632077855676; dtPC=-44$77855669_785h1vOLQAMABPACFNEOVRWVGELNVPGRJGCCHQ-0e1 Connection keep-alive Accept-Language de-DE,de;q=0.9 Referer https://gsf-api.simpshopifyapps.com/ajr/MINNESOTA/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Response headers Date Sun, 19 Sep 2021 18:57:35 GMT Last-Modified Sat, 19 Jun 2021 18:33:50 GMT Server Apache Content-Type image/gif Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 679
POST H/1.1	404 Not Found	rb_bf91035bph Show response gsf-api.simpshopifyapps.com/ui_javascripts/	575 B 808 B	95ms 95ms	XHR text/html	199.250.207.25 IMH-IAD
General Check archive.org Show headers Download Go to Full URL https://gsf-api.simpshopifyapps.com/ui_javascripts/rb_bf91035bph?type=js3&sn=v_4_srv_-2D44_sn_VATQHGM3R2624A8A9L2TIQIFUJ44NVK5&svrid=-44&flavor=post&vi=OLQAMABPACFNEOVRWVGELNVPGRJGCCHQ-0&modifiedSince=1623365518865&rf=https%3A%2F%2Fgsf-api.simpshopifyapps.com%2Fajr%2FMINNESOTA%2Flogin.php&bp=3&app=06fe4f82790bea7d&crc=2055386212&en=sstvhqbf&end=1 Requested by Host: gsf-api.simpshopifyapps.com URL: https://gsf-api.simpshopifyapps.com/ajr/MINNESOTA/index_files/ruxitagentjs_ICA27SVdfhjqru_10217210531114014.js.download Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 199.250.207.25 , United States, ASN54641 (IMH-IAD, US), Reverse DNS vps71019.inmotionhosting.com Software Apache / Resource Hash `61b9464bdd42780f0f75278d9832cb2ecfeabb321a80242cc1edfeedd94d42cd` Request headers Sec-Fetch-Mode cors Origin https://gsf-api.simpshopifyapps.com Accept-Encoding gzip, deflate, br Accept-Language de-DE,de;q=0.9 Sec-Fetch-Dest empty Cookie dtCookie=v_4_srv_-2D44_sn_VATQHGM3R2624A8A9L2TIQIFUJ44NVK5; rxVisitor=1632077855675VIC2GNBDJG75KHAAF5UQFOH1BJ0ASMV3; dtSa=-; dtLatC=98; rxvt=1632079655862\|1632077855676; dtPC=-44$77855669_785h-vOLQAMABPACFNEOVRWVGELNVPGRJGCCHQ-0e1 Connection keep-alive Content-Length 1538 Pragma no-cache Host gsf-api.simpshopifyapps.com User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Content-Type text/plain;charset=UTF-8 Accept / Cache-Control no-cache Referer https://gsf-api.simpshopifyapps.com/ajr/MINNESOTA/login.php Sec-Fetch-Site same-origin Referer https://gsf-api.simpshopifyapps.com/ajr/MINNESOTA/login.php Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers Date Sun, 19 Sep 2021 18:57:37 GMT Server Apache Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=97 Transfer-Encoding chunked Content-Type text/html
POST H/1.1	404 Not Found	rb_bf91035bph Show response gsf-api.simpshopifyapps.com/ui_javascripts/	575 B 808 B	95ms 95ms	XHR text/html	199.250.207.25 IMH-IAD
General Check archive.org Show headers Download Go to Full URL https://gsf-api.simpshopifyapps.com/ui_javascripts/rb_bf91035bph?type=js3&sn=v_4_srv_-2D44_sn_VATQHGM3R2624A8A9L2TIQIFUJ44NVK5&svrid=-44&flavor=post&vi=OLQAMABPACFNEOVRWVGELNVPGRJGCCHQ-0&modifiedSince=1623365518865&rf=https%3A%2F%2Fgsf-api.simpshopifyapps.com%2Fajr%2FMINNESOTA%2Flogin.php&bp=3&app=06fe4f82790bea7d&crc=1236291918&en=sstvhqbf&end=1 Requested by Host: gsf-api.simpshopifyapps.com URL: https://gsf-api.simpshopifyapps.com/ajr/MINNESOTA/index_files/ruxitagentjs_ICA27SVdfhjqru_10217210531114014.js.download Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 199.250.207.25 , United States, ASN54641 (IMH-IAD, US), Reverse DNS vps71019.inmotionhosting.com Software Apache / Resource Hash `8e7ee0f386e91a4b17c73c41e8500c3bbbd51bb0a7e3d898b943bb4f304328a5` Request headers Sec-Fetch-Mode cors Origin https://gsf-api.simpshopifyapps.com Accept-Encoding gzip, deflate, br Accept-Language de-DE,de;q=0.9 Sec-Fetch-Dest empty Cookie dtCookie=v_4_srv_-2D44_sn_VATQHGM3R2624A8A9L2TIQIFUJ44NVK5; rxVisitor=1632077855675VIC2GNBDJG75KHAAF5UQFOH1BJ0ASMV3; dtSa=-; dtLatC=98; rxvt=1632079655862\|1632077855676; dtPC=-44$77855669_785h-vOLQAMABPACFNEOVRWVGELNVPGRJGCCHQ-0e1 Connection keep-alive Content-Length 1534 Pragma no-cache Host gsf-api.simpshopifyapps.com User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Content-Type text/plain;charset=UTF-8 Accept / Cache-Control no-cache Referer https://gsf-api.simpshopifyapps.com/ajr/MINNESOTA/login.php Sec-Fetch-Site same-origin Referer https://gsf-api.simpshopifyapps.com/ajr/MINNESOTA/login.php Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers Date Sun, 19 Sep 2021 18:57:39 GMT Server Apache Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=96 Transfer-Encoding chunked Content-Type text/html

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: US Government (Government)

12 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

6 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.simpshopifyapps.com/	1969-12-31 23:59:59	Name: dtCookie Value: v_4_srv_-2D44_sn_VATQHGM3R2624A8A9L2TIQIFUJ44NVK5
.simpshopifyapps.com/	1969-12-31 23:59:59	Name: rxVisitor Value: 1632077855675VIC2GNBDJG75KHAAF5UQFOH1BJ0ASMV3
.simpshopifyapps.com/	1969-12-31 23:59:59	Name: dtSa Value: -
.simpshopifyapps.com/	1969-12-31 23:59:59	Name: dtLatC Value: 98
.simpshopifyapps.com/	1969-12-31 23:59:59	Name: rxvt Value: 1632079655862\|1632077855676
.simpshopifyapps.com/	1969-12-31 23:59:59	Name: dtPC Value: -44$77855669_785h-vOLQAMABPACFNEOVRWVGELNVPGRJGCCHQ-0e1

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://gsf-api.simpshopifyapps.com/ui_javascripts/rb_bf91035bph?type=js3&sn=v_4_srv_-2D44_sn_VATQHGM3R2624A8A9L2TIQIFUJ44NVK5&svrid=-44&flavor=post&vi=OLQAMABPACFNEOVRWVGELNVPGRJGCCHQ-0&modifiedSince=1623365518865&rf=https%3A%2F%2Fgsf-api.simpshopifyapps.com%2Fajr%2FMINNESOTA%2Flogin.php&bp=3&app=06fe4f82790bea7d&crc=2055386212&en=sstvhqbf&end=1 Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://gsf-api.simpshopifyapps.com/ui_javascripts/rb_bf91035bph?type=js3&sn=v_4_srv_-2D44_sn_VATQHGM3R2624A8A9L2TIQIFUJ44NVK5&svrid=-44&flavor=post&vi=OLQAMABPACFNEOVRWVGELNVPGRJGCCHQ-0&modifiedSince=1623365518865&rf=https%3A%2F%2Fgsf-api.simpshopifyapps.com%2Fajr%2FMINNESOTA%2Flogin.php&bp=3&app=06fe4f82790bea7d&crc=1236291918&en=sstvhqbf&end=1 Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

gsf-api.simpshopifyapps.com
199.250.207.25
402df36267c7dd63cd0180cf618c6002668ff2f2268415fd4195925952d53268
61b9464bdd42780f0f75278d9832cb2ecfeabb321a80242cc1edfeedd94d42cd
819c5e6797cca1b144e323a7fbc9131b1896de02c153300bac606cfc8d1ed136
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7
8a25a83ddf46a9940a7210f66d030d2750ef263f89a5da813ecfe6961c69b4e3
8e7ee0f386e91a4b17c73c41e8500c3bbbd51bb0a7e3d898b943bb4f304328a5
93e8e837bd1f524a4379996066a315761ed610be5cedbca5cf4ef80696324a84
95f9b38b3c1358ca700aaf103fda1ee4d485ac7a5f29d4b7ddffa8426126b1ba
d14cc5be04b3ab95d8a382547e988d3536875528a0b195b1dcacc26989d24e46
f3ca101abe3776929aa7723f2bcb2174c1e3a21d38fd8e3528906ae16161eb43

gsf-api.simpshopifyapps.com Open in urlscan Pro 199.250.207.25 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

10 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

326 kBTransfer

324 kBSize

6 Cookies

8 Outgoing links

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

12 JavaScript Global Variables

6 Cookies

2 Console Messages

Indicators

gsf-api.simpshopifyapps.com Open in urlscan Pro
199.250.207.25 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

326 kB
Transfer

324 kB
Size

6
Cookies

10 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!