urlscan.io logo urlscan.io
SecurityTrails logo

ymir-ro.com Open in urlscan Pro
188.114.97.3  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://www.gcash-claim.mzgrupo.com/
Effective URL: https://ymir-ro.com/gcashpartners/claiming.php
Submission: On June 25 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 3 countries across 5 domains to perform 7 HTTP transactions. The main IP is 188.114.97.3, located in Amsterdam, Netherlands and belongs to CLOUDFLARENET, US. The main domain is ymir-ro.com.
TLS certificate: Issued by E1 on May 13th 2024. Valid for: 3 months.
This is the only time ymir-ro.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 75.98.175.85 55293 (A2HOSTING)
2 188.114.97.3 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
3 20.80.63.52 8075 (MICROSOFT...)
1 52.217.225.96 16509 (AMAZON-02)
7 4
1    75.98.175.85 (United States)

ASN55293 (A2HOSTING, US)
PTR: mi3-ss115.a2hosting.com
www.gcash-claim.mzgrupo.com
2    188.114.97.3 (Amsterdam, Netherlands)

ASN13335 (CLOUDFLARENET, US)
ymir-ro.com
1    2a00:1450:4001:830::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
3    20.80.63.52 (Chicago, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
giftaway.ph
1    52.217.225.96 (Ashburn, United States)

ASN16509 (AMAZON-02, US)
PTR: s3-1.amazonaws.com
s3.amazonaws.com
Apex Domain
Subdomains		 Transfer
3 giftaway.ph
giftaway.ph
20 KB
2 ymir-ro.com
ymir-ro.com
4 KB
1 amazonaws.com
s3.amazonaws.com
274 KB
1 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 83
1 KB
1 mzgrupo.com
www.gcash-claim.mzgrupo.com
393 B
7 5
Domain Requested by
3 giftaway.ph ymir-ro.com
2 ymir-ro.com ymir-ro.com
1 s3.amazonaws.com ymir-ro.com
1 fonts.googleapis.com ymir-ro.com
1 www.gcash-claim.mzgrupo.com 1 redirects
7 5

This site contains links to these domains. Also see Links.

Domain
giftaway.ph
Subject Issuer Validity Valid
ymir-ro.com
E1		 2024-05-13 -
2024-08-11		 3 months crt.sh
upload.video.google.com
WR2		 2024-06-03 -
2024-08-26		 3 months crt.sh
*.giftaway.ph
Sectigo RSA Domain Validation Secure Server CA		 2024-01-16 -
2025-02-15		 a year crt.sh
s3.amazonaws.com
Amazon RSA 2048 M01		 2024-05-25 -
2025-05-02		 a year crt.sh

This page contains 1 frames:

Primary Page: https://ymir-ro.com/gcashpartners/claiming.php
Frame ID: 5FC3BBD2EA5A5937013A9A4D748F55B6
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Confirm your GCash details | Giftaway

Page URL History Show full URLs

  1. https://www.gcash-claim.mzgrupo.com/ HTTP 301
    https://ymir-ro.com/gcashpartners/claiming.php Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)
Overall confidence: 100%
Detected patterns
  • <[^>]+\sdata-v(?:ue)?-
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Page Statistics

7
Requests

100 %
HTTPS

20 %
IPv6

5
Domains

5
Subdomains

4
IPs

3
Countries

300 kB
Transfer

428 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://www.gcash-claim.mzgrupo.com/ HTTP 301
    https://ymir-ro.com/gcashpartners/claiming.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request claiming.php
ymir-ro.com/gcashpartners/
Redirect Chain
  • https://www.gcash-claim.mzgrupo.com/
  • https://ymir-ro.com/gcashpartners/claiming.php
6 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ymir-ro.com/gcashpartners/claiming.php
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
29a3cf73378f811026dede46a912449355fcd522952973633fc33699a5771e5a

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
8990b0da9bb4917c-FRA
content-encoding
br
content-type
text/html; charset=UTF-8
date
Tue, 25 Jun 2024 00:02:49 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uRIBRrHVO7Gppagz8H9EP10q4gU2Zk9Vxv0fcC16N3UtjD1SU07BnvI01wW2YqNBTr3q92JLnZsSk%2Fgto01aHLlPF%2Bm2XqYi8Rdazfo6wH6LLZS1UTA12eCS4O0Ldw%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding

Redirect headers

Connection
Keep-Alive
Content-Length
254
Content-Type
text/html; charset=iso-8859-1
Date
Tue, 25 Jun 2024 00:02:47 GMT
Keep-Alive
timeout=3, max=500
Location
https://ymir-ro.com/gcashpartners/claiming.php
Server
Apache
Strict-Transport-Security
max-age=63072000; includeSubDomains
X-Content-Type-Options
nosniff
X-Frame-Options
SAMEORIGIN
css2
fonts.googleapis.com/ 		17 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css2?family=Caveat&family=Inter:wght@400;600;700;900&family=Poppins:wght@700&family=Source+Code+Pro:wght@400;600&display=swap
Requested by
Host: ymir-ro.com
URL: https://ymir-ro.com/gcashpartners/claiming.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
59957a6c2df946a7b969e028b3b278408e90a64c50935b8bf4f001ce550ce290
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://ymir-ro.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=31536000
date
Tue, 25 Jun 2024 00:02:50 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Tue, 25 Jun 2024 00:02:50 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Tue, 25 Jun 2024 00:02:50 GMT
BrandColors-9GOpgxz8.css
giftaway.ph/dist/core/giftaway-site-3/assets/ 		1 KB
947 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://giftaway.ph/dist/core/giftaway-site-3/assets/BrandColors-9GOpgxz8.css
Requested by
Host: ymir-ro.com
URL: https://ymir-ro.com/gcashpartners/claiming.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
20.80.63.52 Chicago, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
442adca4bd406025fe10638de55a08e445944fb7b8b45b687ddd5c664c682036
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://*.facebook.com https://facebook.com https://*.giftaway.ph https://giftaway.ph https://portal.mygowifi.com https://sticky.whitecloak.io https://beta.ayalamalls.com https://www.ayalamalls.com https://ayalamalls.com https://elsa.care https://voucher.elsa.care https://voucher-sandbox.elsa.care https://api.elsa.care https://api.elsa.care:8080
Strict-Transport-Security max-age=0; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options deny

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://ymir-ro.com/
Origin
https://ymir-ro.com
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 25 Jun 2024 00:02:50 GMT
content-encoding
gzip
x-content-type-options
nosniff
referrer-policy
no-referrer, strict-origin-when-cross-origin
last-modified
Fri, 22 Dec 2023 08:21:58 GMT
content-security-policy
frame-ancestors 'self' https://*.facebook.com https://facebook.com https://*.giftaway.ph https://giftaway.ph https://portal.mygowifi.com https://sticky.whitecloak.io https://beta.ayalamalls.com https://www.ayalamalls.com https://ayalamalls.com https://elsa.care https://voucher.elsa.care https://voucher-sandbox.elsa.care https://api.elsa.care https://api.elsa.care:8080
etag
"e18067eeaf34da1:0"
strict-transport-security
max-age=0; includeSubDomains
vary
Accept-Encoding
x-frame-options
deny
content-type
text/css
access-control-allow-origin
*
accept-ranges
bytes
content-length
349
redeem-HzDuLbu6.css
giftaway.ph/dist/core/giftaway-site-3/assets/ 		29 B
742 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://giftaway.ph/dist/core/giftaway-site-3/assets/redeem-HzDuLbu6.css
Requested by
Host: ymir-ro.com
URL: https://ymir-ro.com/gcashpartners/claiming.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
20.80.63.52 Chicago, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
cb0cecc9d0f841a0cc6cbdfa5d72c8d510841af1d8ab0a88abc7a04786f73e31
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://*.facebook.com https://facebook.com https://*.giftaway.ph https://giftaway.ph https://portal.mygowifi.com https://sticky.whitecloak.io https://beta.ayalamalls.com https://www.ayalamalls.com https://ayalamalls.com https://elsa.care https://voucher.elsa.care https://voucher-sandbox.elsa.care https://api.elsa.care https://api.elsa.care:8080
Strict-Transport-Security max-age=0; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options deny

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://ymir-ro.com/
Origin
https://ymir-ro.com
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 25 Jun 2024 00:02:50 GMT
content-encoding
gzip
x-content-type-options
nosniff
referrer-policy
no-referrer, strict-origin-when-cross-origin
last-modified
Fri, 22 Dec 2023 08:22:01 GMT
content-security-policy
frame-ancestors 'self' https://*.facebook.com https://facebook.com https://*.giftaway.ph https://giftaway.ph https://portal.mygowifi.com https://sticky.whitecloak.io https://beta.ayalamalls.com https://www.ayalamalls.com https://ayalamalls.com https://elsa.care https://voucher.elsa.care https://voucher-sandbox.elsa.care https://api.elsa.care https://api.elsa.care:8080
etag
"4fc111f0af34da1:0"
strict-transport-security
max-age=0; includeSubDomains
vary
Accept-Encoding
x-frame-options
deny
content-type
text/css
access-control-allow-origin
*
accept-ranges
bytes
content-length
145
index-bbsI125I.css
giftaway.ph/dist/core/giftaway-site-3/assets/ 		129 KB
19 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://giftaway.ph/dist/core/giftaway-site-3/assets/index-bbsI125I.css
Requested by
Host: ymir-ro.com
URL: https://ymir-ro.com/gcashpartners/claiming.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
20.80.63.52 Chicago, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
5f5548983fbfd09c3543de6e468b28121c1d415b17d9703fdf54c19d3783e204
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://*.facebook.com https://facebook.com https://*.giftaway.ph https://giftaway.ph https://portal.mygowifi.com https://sticky.whitecloak.io https://beta.ayalamalls.com https://www.ayalamalls.com https://ayalamalls.com https://elsa.care https://voucher.elsa.care https://voucher-sandbox.elsa.care https://api.elsa.care https://api.elsa.care:8080
Strict-Transport-Security max-age=0; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options deny

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://ymir-ro.com/
Origin
https://ymir-ro.com
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 25 Jun 2024 00:02:50 GMT
content-encoding
gzip
x-content-type-options
nosniff
referrer-policy
no-referrer, strict-origin-when-cross-origin
last-modified
Thu, 06 Jun 2024 02:43:22 GMT
content-security-policy
frame-ancestors 'self' https://*.facebook.com https://facebook.com https://*.giftaway.ph https://giftaway.ph https://portal.mygowifi.com https://sticky.whitecloak.io https://beta.ayalamalls.com https://www.ayalamalls.com https://ayalamalls.com https://elsa.care https://voucher.elsa.care https://voucher-sandbox.elsa.care https://api.elsa.care https://api.elsa.care:8080
etag
"01d74bbbb7da1:0"
strict-transport-security
max-age=0; includeSubDomains
vary
Accept-Encoding
x-frame-options
deny
content-type
text/css
access-control-allow-origin
*
accept-ranges
bytes
content-length
18377
2c83d4e5-9054-43f4-976c-1747866e8658.jpg
s3.amazonaws.com/images.giftaway.ph/o/ 		274 KB
274 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s3.amazonaws.com/images.giftaway.ph/o/2c83d4e5-9054-43f4-976c-1747866e8658.jpg
Requested by
Host: ymir-ro.com
URL: https://ymir-ro.com/gcashpartners/claiming.php
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
52.217.225.96 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-1.amazonaws.com
Software
AmazonS3 /
Resource Hash
73a6a55cb7a21a76738e6854f518f07a44766b8fc2a058e9dc962e7100295560

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://ymir-ro.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Tue, 25 Jun 2024 00:02:51 GMT
Last-Modified
Fri, 22 Sep 2023 09:50:12 GMT
Server
AmazonS3
x-amz-request-id
AJ37F7GQP5D9FSH4
ETag
"ea3773c0ced95766adf6d37337398111"
x-amz-server-side-encryption
AES256
Content-Type
text/plain
Accept-Ranges
bytes
Content-Length
280124
x-amz-id-2
q270iOOWIA3VJYEXdnk3ZOLf5gMQatcsp1MAdltSimHGCaKRQ10v/k4kP37kWIn90hVlWgZPi0o=
email-decode.min.js
ymir-ro.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ymir-ro.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js
Requested by
Host: ymir-ro.com
URL: https://ymir-ro.com/gcashpartners/claiming.php
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://ymir-ro.com/gcashpartners/claiming.php
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 25 Jun 2024 00:02:49 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 19 Jun 2024 08:39:32 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"66729944-4d7"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PQ%2BVjg6v1rOgCNJxmncbdIbQ%2B6Lv2HnPv10vjioVG5ybsxAL2H9r5dZjVo3%2BqBBv4qTVlLNNXKPHzsv%2FgxTjrNQ%2BkiWbw8ovwLxDkyUxGl1p%2BTzSODBPtKQ5hYH2YQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
x-frame-options
DENY
cache-control
max-age=172800, public
cf-ray
8990b0e64b70917c-FRA
expires
Thu, 27 Jun 2024 00:02:49 GMT

Verdicts & Comments Add Verdict or Comment

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

undefined| event object| fence object| sharedStorage

0 Cookies