mass.report
Scan Intelligence Report0/100
low Risk
gsx.uk.com
https://gsx.uk.com
IP
172.67.207.80 · Cloudflare, Inc.
Location
Toronto, Canada
Domain Age
10973 days
HTTP
200 · 22.1s
SSL
Valid· E7, Let's Encrypt, US
Status
COMPLETED
Registered-domain escalation
Submit uk.com as the primary IOC, enriched with evidence from hostile subdomains like gsx.uk.com.
KB/IOK Matches (0)—
No KB/IOK detections were recorded for this scan.
FB88
Unknowngambling | technology | finance · 6/3/2026
Summary
The page branding centers on FB88, with logos and content describing an online gambling site. Domain is gsx.uk.com, not the official FB88 domain, raising impersonation concerns. Page title and metadata promote FB88 and include Vietnamese gambling content; however, credential collection interfaces are not evident in static HTML, and there is a strong indication of brand cloning visuals (logo assets and banner imagery) appearing to impersonate FB88. Given the domain mismatch and visual branding, this appears to be an impersonation/brand-clone page rather than a confirmed first-party FB88 page.
Evidence Summary
▸Observed 2 capture stage(s); canonical stage is settled_render.
▸POST targets observed during capture: https://gsx.uk.com/cdn-cgi/rum?.
▸Distinctive asset clues: jquery.min.js, email-decode.min.js, slider.css, flatsome.css, fb88-uu-dai-vo-tan-hoan-tra-hap-dan.webp, logo-fb88.webp.
Capture
Stages: 2
Canonical: Settled Render
Changed: No
Credential Signals
Forms: 1
Password fields: 0
Late-stage login UI: No
Resource Signals
Resources: 87
Hosts: 5
Domains: 5
Suspicious Endpoints
hxxps://gsx[.]uk[.]com/
Attack Techniques (1)
Brand impersonation via visuals and metadata (FB88 branding on gsx.uk.com).
Indicators of Compromise (1)
▸POST to /cdn-cgi/rum? observed (potential anti-bot/analytics beacon) and unusual POST, indicating possible script-based exfiltration or WAF interaction.
Risk AssessmentUsed in abuse reports
The site appears to clone FB88 branding on a non-official domain (gsx.uk.com), using FB88 logos and promotional content. While there is no clear credential collection form on static HTML, the strong impersonation signals (page title, OG metadata, and visible branding) elevate risk of credential-phishing if forms enable login elsewhere or via SPA scripts. The presence of a POST to a Rum endpoint and anti-bot traffic patterns could indicate attempts to elude scanners. Recommend monitoring and further investigation; consider blocking URL or suspending hosting if more evidence confirms credential harvesting or misrepresentation.
Recommended Action
Monitor
Cross-Reference8
URL Intelligence
Domain Intelligence
IP Intelligence
Public threat feed available — JSON API