gbrgbrgb.gb.net Open in urlscan Pro
104.129.25.8 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://gbrgbrgb.gb.net/grtgtgf4/?gtttbbby=557757u77
Effective URL:
https://gbrgbrgb.gb.net/grtgtgf4/5w4iyphdSP39.32.60.2342f0f8977dd3e00cbdf7a9e39beb12a0432e0208b393449b229fd58beb8de7339P...
Submission: On September 04 via manual (September 4th 2020, 8:29:40 am UTC) from US

Summary HTTP 11 Redirects Behaviour Indicators

Summary

This website contacted 7 IPs in 3 countries across 6 domains to perform 11 HTTP transactions. The main IP is 104.129.25.8, located in Atlanta, United States and belongs to ASN-QUADRANET-GLOBAL, US. The main domain is gbrgbrgb.gb.net.
TLS certificate: Issued by cPanel, Inc. Certification Authority on July 22nd 2020. Valid for: 3 months.

This is the only time gbrgbrgb.gb.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 3	104.129.25.8 104.129.25.8	8100 (ASN-QUADR...) (ASN-QUADRANET-GLOBAL)
2	185.199.111.153 185.199.111.153	54113 (FASTLY) (FASTLY)
1	2001:4de0:ac1... 2001:4de0:ac19::1:b:3a	20446 (HIGHWINDS3) (HIGHWINDS3)
3	2606:4700::68... 2606:4700::6811:4f6b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2001:4de0:ac1... 2001:4de0:ac19::1:b:2a	20446 (HIGHWINDS3) (HIGHWINDS3)
1	2a00:1450:400... 2a00:1450:4001:817::200a	15169 (GOOGLE) (GOOGLE)
11	7

3 104.129.25.8 (Atlanta, United States) 1 redirects

ASN8100 (ASN-QUADRANET-GLOBAL, US)

gbrgbrgb.gb.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.199.111.153 (United States)

ASN54113 (FASTLY, US)

lipis.github.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac19::1:b:3a (Netherlands)

ASN20446 (HIGHWINDS3, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700::6811:4f6b (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:4de0:ac19::1:b:2a (Netherlands)

ASN20446 (HIGHWINDS3, US)

maxcdn.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
stackpath.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:817::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	cloudflare.com cdnjs.cloudflare.com	74 KB
3	gb.net 1 redirects gbrgbrgb.gb.net	627 KB
2	bootstrapcdn.com maxcdn.bootstrapcdn.com stackpath.bootstrapcdn.com	27 KB
2	github.io lipis.github.io	78 KB
1	googleapis.com ajax.googleapis.com	30 KB
1	jquery.com code.jquery.com	24 KB
11	6

	Domain	Requested by
3	cdnjs.cloudflare.com	gbrgbrgb.gb.net
3	gbrgbrgb.gb.net	1 redirects gbrgbrgb.gb.net
2	lipis.github.io	gbrgbrgb.gb.net lipis.github.io
1	stackpath.bootstrapcdn.com	gbrgbrgb.gb.net
1	ajax.googleapis.com	gbrgbrgb.gb.net
1	maxcdn.bootstrapcdn.com	gbrgbrgb.gb.net
1	code.jquery.com	gbrgbrgb.gb.net
11	7

This site contains no links.

Subject Issuer	Validity	Valid
gbrgbrgb.gb.net cPanel, Inc. Certification Authority	`2020-07-22` - `2020-10-20`	3 months	crt.sh
www.github.com DigiCert SHA2 High Assurance Server CA	`2020-05-06` - `2022-04-14`	2 years	crt.sh
jquery.org COMODO RSA Domain Validation Secure Server CA	`2018-10-17` - `2020-10-16`	2 years	crt.sh
cdnjs.cloudflare.com DigiCert ECC Secure Server CA	`2020-08-12` - `2022-08-17`	2 years	crt.sh
*.bootstrapcdn.com Sectigo RSA Domain Validation Secure Server CA	`2019-09-14` - `2020-10-13`	a year	crt.sh
upload.video.google.com GTS CA 1O1	`2020-08-19` - `2020-11-11`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://gbrgbrgb.gb.net/grtgtgf4/5w4iyphdSP39.32.60.2342f0f8977dd3e00cbdf7a9e39beb12a0432e0208b393449b229fd58beb8de7339PakistanAsiaPKAS04-09-202008-29-22am/?Key=5w4iyphdSP39.32.60.2342f0f8977dd3e00cbdf7a9e39beb12a0432e0208b393449b229fd58beb8de7339PakistanAsiaPKAS04-09-202008-29-22am&rand=13InboxLightaspxn_5w4iyphdSP39.32.60.2342f0f8977dd3e00cbdf7a9e39beb12a0432e0208b393449b229fd58beb8de7339PakistanAsiaPKAS04-09-202008-29-22am_NXc0aXlwaGRTUA==-&2f0f8977dd3e00cbdf7a9e39beb12a0432e0208b393449b229fd58beb8de7339
Frame ID: 6258B8357FECAFCCCC04A79A6F0D187C
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://gbrgbrgb.gb.net/grtgtgf4/?gtttbbby=557757u77 Page URL
https://gbrgbrgb.gb.net/grtgtgf4/5w4iyphdSP39.32.60.2342f0f8977dd3e00cbdf7a9e39beb12a0432e0208b39344... HTTP 301
https://gbrgbrgb.gb.net/grtgtgf4/5w4iyphdSP39.32.60.2342f0f8977dd3e00cbdf7a9e39beb12a0432e0208b39344... Page URL

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

11
Requests

100 %
HTTPS

67 %
IPv6

6
Domains

7
Subdomains

7
IPs

3
Countries

859 kB
Transfer

1563 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://gbrgbrgb.gb.net/grtgtgf4/?gtttbbby=557757u77 Page URL
https://gbrgbrgb.gb.net/grtgtgf4/5w4iyphdSP39.32.60.2342f0f8977dd3e00cbdf7a9e39beb12a0432e0208b393449b229fd58beb8de7339PakistanAsiaPKAS04-09-202008-29-22am?Key=5w4iyphdSP39.32.60.2342f0f8977dd3e00cbdf7a9e39beb12a0432e0208b393449b229fd58beb8de7339PakistanAsiaPKAS04-09-202008-29-22am&rand=13InboxLightaspxn_5w4iyphdSP39.32.60.2342f0f8977dd3e00cbdf7a9e39beb12a0432e0208b393449b229fd58beb8de7339PakistanAsiaPKAS04-09-202008-29-22am_NXc0aXlwaGRTUA==-&2f0f8977dd3e00cbdf7a9e39beb12a0432e0208b393449b229fd58beb8de7339 HTTP 301
https://gbrgbrgb.gb.net/grtgtgf4/5w4iyphdSP39.32.60.2342f0f8977dd3e00cbdf7a9e39beb12a0432e0208b393449b229fd58beb8de7339PakistanAsiaPKAS04-09-202008-29-22am/?Key=5w4iyphdSP39.32.60.2342f0f8977dd3e00cbdf7a9e39beb12a0432e0208b393449b229fd58beb8de7339PakistanAsiaPKAS04-09-202008-29-22am&rand=13InboxLightaspxn_5w4iyphdSP39.32.60.2342f0f8977dd3e00cbdf7a9e39beb12a0432e0208b393449b229fd58beb8de7339PakistanAsiaPKAS04-09-202008-29-22am_NXc0aXlwaGRTUA==-&2f0f8977dd3e00cbdf7a9e39beb12a0432e0208b393449b229fd58beb8de7339 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions
3 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Cookie set / Show response
gbrgbrgb.gb.net/grtgtgf4/ 1 KB
1 KB 1109ms
793ms Document
text/html 104.129.25.8
ASN-QUADRANET-GLOBAL

General

Check archive.org

Show headers Download Go to

Full URL: https://gbrgbrgb.gb.net/grtgtgf4/?gtttbbby=557757u77
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 104.129.25.8 Atlanta, United States, ASN8100 (ASN-QUADRANET-GLOBAL, US),
Reverse DNS
Software: Apache /
Resource Hash: e4bccea6ee8cfc15b2be9535ea987191f9c8ce6943050476af377d070e6bff49

Request headers

Host: gbrgbrgb.gb.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 04 Sep 2020 08:29:22 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Set-Cookie: PHPSESSID=ebf06c1d67e086a0098d578676eff84d; path=/
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H/1.1

200
OK

Primary Request / Show response
gbrgbrgb.gb.net/grtgtgf4/5w4iyphdSP39.32.60.2342f0f8977dd3e00cbdf7a9e39beb12a0432e0208b393449b229fd58beb8de7339PakistanAsiaPKAS04-09-202008-29-22am/
Redirect Chain

https://gbrgbrgb.gb.net/grtgtgf4/5w4iyphdSP39.32.60.2342f0f8977dd3e00cbdf7a9e39beb12a0432e0208b393449b229fd58beb8de7339PakistanAsiaPKAS04-09-202008-29-22am?Key=5w4iyphdSP39.32.60.2342f0f8977dd3e00c...
https://gbrgbrgb.gb.net/grtgtgf4/5w4iyphdSP39.32.60.2342f0f8977dd3e00cbdf7a9e39beb12a0432e0208b393449b229fd58beb8de7339PakistanAsiaPKAS04-09-202008-29-22am/?Key=5w4iyphdSP39.32.60.2342f0f8977dd3e00...

624 KB
625 KB

167ms
166ms

Document
text/html

104.129.25.8
ASN-QUADRANET-GLOBAL

General

Check archive.org

Show headers Download Go to

Full URL: https://gbrgbrgb.gb.net/grtgtgf4/5w4iyphdSP39.32.60.2342f0f8977dd3e00cbdf7a9e39beb12a0432e0208b393449b229fd58beb8de7339PakistanAsiaPKAS04-09-202008-29-22am/?Key=5w4iyphdSP39.32.60.2342f0f8977dd3e00cbdf7a9e39beb12a0432e0208b393449b229fd58beb8de7339PakistanAsiaPKAS04-09-202008-29-22am&rand=13InboxLightaspxn_5w4iyphdSP39.32.60.2342f0f8977dd3e00cbdf7a9e39beb12a0432e0208b393449b229fd58beb8de7339PakistanAsiaPKAS04-09-202008-29-22am_NXc0aXlwaGRTUA==-&2f0f8977dd3e00cbdf7a9e39beb12a0432e0208b393449b229fd58beb8de7339
Requested by: Host: gbrgbrgb.gb.net
URL: https://gbrgbrgb.gb.net/grtgtgf4/?gtttbbby=557757u77
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 104.129.25.8 Atlanta, United States, ASN8100 (ASN-QUADRANET-GLOBAL, US),
Reverse DNS
Software: Apache /
Resource Hash: a6e05f70d58c26e19491c23887d32609a985e9f245d03fb38edcee5b409315b5

Request headers

Host: gbrgbrgb.gb.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: document
Referer: https://gbrgbrgb.gb.net/grtgtgf4/?gtttbbby=557757u77
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: PHPSESSID=ebf06c1d67e086a0098d578676eff84d
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://gbrgbrgb.gb.net/grtgtgf4/?gtttbbby=557757u77

Response headers

Date: Fri, 04 Sep 2020 08:29:23 GMT
Server: Apache
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

Redirect headers

Date: Fri, 04 Sep 2020 08:29:23 GMT
Server: Apache
Location: https://gbrgbrgb.gb.net/grtgtgf4/5w4iyphdSP39.32.60.2342f0f8977dd3e00cbdf7a9e39beb12a0432e0208b393449b229fd58beb8de7339PakistanAsiaPKAS04-09-202008-29-22am/?Key=5w4iyphdSP39.32.60.2342f0f8977dd3e00cbdf7a9e39beb12a0432e0208b393449b229fd58beb8de7339PakistanAsiaPKAS04-09-202008-29-22am&rand=13InboxLightaspxn_5w4iyphdSP39.32.60.2342f0f8977dd3e00cbdf7a9e39beb12a0432e0208b393449b229fd58beb8de7339PakistanAsiaPKAS04-09-202008-29-22am_NXc0aXlwaGRTUA==-&2f0f8977dd3e00cbdf7a9e39beb12a0432e0208b393449b229fd58beb8de7339
Content-Length: 728
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1

GET
H2 200 font-awesome.css
lipis.github.io/bootstrap-social/assets/css/ 34 KB
7 KB 162ms
54ms Stylesheet
text/css 185.199.111.153
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://lipis.github.io/bootstrap-social/assets/css/font-awesome.css
Requested by: Host: gbrgbrgb.gb.net
URL: https://gbrgbrgb.gb.net/grtgtgf4/5w4iyphdSP39.32.60.2342f0f8977dd3e00cbdf7a9e39beb12a0432e0208b393449b229fd58beb8de7339PakistanAsiaPKAS04-09-202008-29-22am/?Key=5w4iyphdSP39.32.60.2342f0f8977dd3e00cbdf7a9e39beb12a0432e0208b393449b229fd58beb8de7339PakistanAsiaPKAS04-09-202008-29-22am&rand=13InboxLightaspxn_5w4iyphdSP39.32.60.2342f0f8977dd3e00cbdf7a9e39beb12a0432e0208b393449b229fd58beb8de7339PakistanAsiaPKAS04-09-202008-29-22am_NXc0aXlwaGRTUA==-&2f0f8977dd3e00cbdf7a9e39beb12a0432e0208b393449b229fd58beb8de7339
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.199.111.153 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: GitHub.com /
Resource Hash: 34f195f17d62b4789625aa8cb3535024a72d40fc4d88ee1383154688b9bfaa27

Request headers

Referer: https://gbrgbrgb.gb.net/grtgtgf4/5w4iyphdSP39.32.60.2342f0f8977dd3e00cbdf7a9e39beb12a0432e0208b393449b229fd58beb8de7339PakistanAsiaPKAS04-09-202008-29-22am/?Key=5w4iyphdSP39.32.60.2342f0f8977dd3e00cbdf7a9e39beb12a0432e0208b393449b229fd58beb8de7339PakistanAsiaPKAS04-09-202008-29-22am&rand=13InboxLightaspxn_5w4iyphdSP39.32.60.2342f0f8977dd3e00cbdf7a9e39beb12a0432e0208b393449b229fd58beb8de7339PakistanAsiaPKAS04-09-202008-29-22am_NXc0aXlwaGRTUA==-&2f0f8977dd3e00cbdf7a9e39beb12a0432e0208b393449b229fd58beb8de7339
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-fastly-request-id: 2ad705edf0972085906365c35dbabf348d4ccc90
date: Fri, 04 Sep 2020 08:29:23 GMT
content-encoding: gzip
age: 256
x-cache: HIT
status: 200
content-length: 7075
x-served-by: cache-hhn4049-HHN
access-control-allow-origin: *
last-modified: Sun, 19 Feb 2017 02:54:15 GMT
server: GitHub.com
x-github-request-id: 2F34:B35C:24D137B:2799EBC:5F5173BD
x-timer: S1599208164.592349,VS0,VE0
etag: W/"58a908d7-8938"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
via: 1.1 varnish
expires: Thu, 03 Sep 2020 23:02:45 GMT
cache-control: max-age=600
accept-ranges: bytes
x-proxy-cache: MISS
x-cache-hits: 1

GET
DATA 200
OK truncated
/ 263 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 46ca51fa88bcacd0a640d4411aabf06b8a6fe90980868d29431864168f9af03a

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 10 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 578a6224479b87c84e4fd4d0f34105ff4c860f19765a6539d34fc987db7c1eb4

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 334 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: dea34f261a8f1665528217ef9040fc6e4ed0517be859fe25c8e440f02c10ac0a

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 fontawesome-webfont.woff2
lipis.github.io/bootstrap-social/assets/fonts/ 70 KB
71 KB 224ms
133ms Font
font/woff2 185.199.111.153
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://lipis.github.io/bootstrap-social/assets/fonts/fontawesome-webfont.woff2?v=4.6.3
Requested by: Host: lipis.github.io
URL: https://lipis.github.io/bootstrap-social/assets/css/font-awesome.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.199.111.153 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: GitHub.com /
Resource Hash: 7dacf83f51179de8d7980a513e67ab3a08f2c6272bb5946df8fd77c0d1763b73

Request headers

Origin: https://gbrgbrgb.gb.net
Referer: https://lipis.github.io/bootstrap-social/assets/css/font-awesome.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-fastly-request-id: f4ef3f0f41601f1b94db345dc07363deea370ee4
date: Fri, 04 Sep 2020 08:29:24 GMT
via: 1.1 varnish
age: 0
x-cache: HIT
status: 200
content-length: 71896
x-served-by: cache-hhn4065-HHN
last-modified: Sun, 19 Feb 2017 02:54:15 GMT
server: GitHub.com
x-github-request-id: EC86:B144:89EC01:948EB3:5F51BAEE
x-timer: S1599208164.221250,VS0,VE87
etag: "58a908d7-118d8"
vary: Accept-Encoding
content-type: font/woff2
access-control-allow-origin: *
expires: Fri, 04 Sep 2020 04:04:05 GMT
cache-control: max-age=600
accept-ranges: bytes
x-origin-cache: HIT
x-proxy-cache: HIT
x-cache-hits: 1

GET
H2 200 jquery-3.2.1.slim.min.js Show response
code.jquery.com/ 68 KB
24 KB 24ms
8ms Script
application/javascript 2001:4de0:ac19::1:b:3a
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.2.1.slim.min.js
Requested by: Host: gbrgbrgb.gb.net
URL: https://gbrgbrgb.gb.net/grtgtgf4/5w4iyphdSP39.32.60.2342f0f8977dd3e00cbdf7a9e39beb12a0432e0208b393449b229fd58beb8de7339PakistanAsiaPKAS04-09-202008-29-22am/?Key=5w4iyphdSP39.32.60.2342f0f8977dd3e00cbdf7a9e39beb12a0432e0208b393449b229fd58beb8de7339PakistanAsiaPKAS04-09-202008-29-22am&rand=13InboxLightaspxn_5w4iyphdSP39.32.60.2342f0f8977dd3e00cbdf7a9e39beb12a0432e0208b393449b229fd58beb8de7339PakistanAsiaPKAS04-09-202008-29-22am_NXc0aXlwaGRTUA==-&2f0f8977dd3e00cbdf7a9e39beb12a0432e0208b393449b229fd58beb8de7339
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac19::1:b:3a , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: 9365920887b11b33a3dc4ba28a0f93951f200341263e3b9cefd384798e4be398

Request headers

Origin: https://gbrgbrgb.gb.net
Referer: https://gbrgbrgb.gb.net/grtgtgf4/5w4iyphdSP39.32.60.2342f0f8977dd3e00cbdf7a9e39beb12a0432e0208b393449b229fd58beb8de7339PakistanAsiaPKAS04-09-202008-29-22am/?Key=5w4iyphdSP39.32.60.2342f0f8977dd3e00cbdf7a9e39beb12a0432e0208b393449b229fd58beb8de7339PakistanAsiaPKAS04-09-202008-29-22am&rand=13InboxLightaspxn_5w4iyphdSP39.32.60.2342f0f8977dd3e00cbdf7a9e39beb12a0432e0208b393449b229fd58beb8de7339PakistanAsiaPKAS04-09-202008-29-22am_NXc0aXlwaGRTUA==-&2f0f8977dd3e00cbdf7a9e39beb12a0432e0208b393449b229fd58beb8de7339
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 04 Sep 2020 08:29:24 GMT
content-encoding: gzip
last-modified: Mon, 20 Mar 2017 19:01:15 GMT
server: nginx
status: 200
etag: W/"58d026fb-10fdd"
vary: Accept-Encoding
x-hw: 1599208164.dop109.fr8.t,1599208164.cds228.fr8.hn,1599208164.cds257.fr8.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 23856

GET
H2 200 popper.min.js Show response
cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/ 19 KB
6 KB 30ms
16ms Script
application/javascript 2606:4700::6811:4f6b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js

Requested by

Host: gbrgbrgb.gb.net
URL: https://gbrgbrgb.gb.net/grtgtgf4/5w4iyphdSP39.32.60.2342f0f8977dd3e00cbdf7a9e39beb12a0432e0208b393449b229fd58beb8de7339PakistanAsiaPKAS04-09-202008-29-22am/?Key=5w4iyphdSP39.32.60.2342f0f8977dd3e00cbdf7a9e39beb12a0432e0208b393449b229fd58beb8de7339PakistanAsiaPKAS04-09-202008-29-22am&rand=13InboxLightaspxn_5w4iyphdSP39.32.60.2342f0f8977dd3e00cbdf7a9e39beb12a0432e0208b393449b229fd58beb8de7339PakistanAsiaPKAS04-09-202008-29-22am_NXc0aXlwaGRTUA==-&2f0f8977dd3e00cbdf7a9e39beb12a0432e0208b393449b229fd58beb8de7339

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:4f6b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000; includeSubDomains

Request headers

Origin: https://gbrgbrgb.gb.net
Referer: https://gbrgbrgb.gb.net/grtgtgf4/5w4iyphdSP39.32.60.2342f0f8977dd3e00cbdf7a9e39beb12a0432e0208b393449b229fd58beb8de7339PakistanAsiaPKAS04-09-202008-29-22am/?Key=5w4iyphdSP39.32.60.2342f0f8977dd3e00cbdf7a9e39beb12a0432e0208b393449b229fd58beb8de7339PakistanAsiaPKAS04-09-202008-29-22am&rand=13InboxLightaspxn_5w4iyphdSP39.32.60.2342f0f8977dd3e00cbdf7a9e39beb12a0432e0208b393449b229fd58beb8de7339PakistanAsiaPKAS04-09-202008-29-22am_NXc0aXlwaGRTUA==-&2f0f8977dd3e00cbdf7a9e39beb12a0432e0208b393449b229fd58beb8de7339
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 04 Sep 2020 08:29:24 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
age: 123528
x-via: cfworker/kv
status: 200
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 6157
cf-request-id: 04f9d5233b0000c28b0c813200000001
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:15:37 GMT
server: cloudflare
etag: "5eb03fa9-4af4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000; includeSubDomains
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 5cd657b1fb38c28b-FRA
expires: Wed, 25 Aug 2021 08:29:24 GMT

GET
H2 200 bootstrap.min.js Show response
maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/ 48 KB
13 KB 27ms
9ms Script
text/javascript 2001:4de0:ac19::1:b:2a
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL

https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4de0:ac19::1:b:2a , Netherlands, ASN20446 (HIGHWINDS3, US),

Reverse DNS

Software

Resource Hash

e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Origin: https://gbrgbrgb.gb.net
Referer: https://gbrgbrgb.gb.net/grtgtgf4/5w4iyphdSP39.32.60.2342f0f8977dd3e00cbdf7a9e39beb12a0432e0208b393449b229fd58beb8de7339PakistanAsiaPKAS04-09-202008-29-22am/?Key=5w4iyphdSP39.32.60.2342f0f8977dd3e00cbdf7a9e39beb12a0432e0208b393449b229fd58beb8de7339PakistanAsiaPKAS04-09-202008-29-22am&rand=13InboxLightaspxn_5w4iyphdSP39.32.60.2342f0f8977dd3e00cbdf7a9e39beb12a0432e0208b393449b229fd58beb8de7339PakistanAsiaPKAS04-09-202008-29-22am_NXc0aXlwaGRTUA==-&2f0f8977dd3e00cbdf7a9e39beb12a0432e0208b393449b229fd58beb8de7339
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 04 Sep 2020 08:29:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 12 Dec 2018 18:33:52 GMT
status: 200
etag: "1544639632"
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 13105

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/2.2.4/ 84 KB
30 KB 26ms
5ms Script
text/javascript 2a00:1450:4001:817::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://gbrgbrgb.gb.net/grtgtgf4/5w4iyphdSP39.32.60.2342f0f8977dd3e00cbdf7a9e39beb12a0432e0208b393449b229fd58beb8de7339PakistanAsiaPKAS04-09-202008-29-22am/?Key=5w4iyphdSP39.32.60.2342f0f8977dd3e00cbdf7a9e39beb12a0432e0208b393449b229fd58beb8de7339PakistanAsiaPKAS04-09-202008-29-22am&rand=13InboxLightaspxn_5w4iyphdSP39.32.60.2342f0f8977dd3e00cbdf7a9e39beb12a0432e0208b393449b229fd58beb8de7339PakistanAsiaPKAS04-09-202008-29-22am_NXc0aXlwaGRTUA==-&2f0f8977dd3e00cbdf7a9e39beb12a0432e0208b393449b229fd58beb8de7339
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 31 Aug 2020 09:03:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 343530
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30028
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 31 Aug 2021 09:03:54 GMT

GET
H2 200 bootstrap.min.js Show response
stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/ 50 KB
14 KB 26ms
8ms Script
text/javascript 2001:4de0:ac19::1:b:2a
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL

https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4de0:ac19::1:b:2a , Netherlands, ASN20446 (HIGHWINDS3, US),

Reverse DNS

Software

Resource Hash

56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://gbrgbrgb.gb.net/grtgtgf4/5w4iyphdSP39.32.60.2342f0f8977dd3e00cbdf7a9e39beb12a0432e0208b393449b229fd58beb8de7339PakistanAsiaPKAS04-09-202008-29-22am/?Key=5w4iyphdSP39.32.60.2342f0f8977dd3e00cbdf7a9e39beb12a0432e0208b393449b229fd58beb8de7339PakistanAsiaPKAS04-09-202008-29-22am&rand=13InboxLightaspxn_5w4iyphdSP39.32.60.2342f0f8977dd3e00cbdf7a9e39beb12a0432e0208b393449b229fd58beb8de7339PakistanAsiaPKAS04-09-202008-29-22am_NXc0aXlwaGRTUA==-&2f0f8977dd3e00cbdf7a9e39beb12a0432e0208b393449b229fd58beb8de7339
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 04 Sep 2020 08:29:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 12 Dec 2018 18:33:54 GMT
status: 200
etag: "1544639634"
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 14090

GET
H2 200 socket.io.js Show response
cdnjs.cloudflare.com/ajax/libs/socket.io/1.7.1/ 207 KB
41 KB 27ms
13ms Script
application/javascript 2606:4700::6811:4f6b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/socket.io/1.7.1/socket.io.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:4f6b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0fbade78bbd7df1292d1ac6595dffb1cd06e05b2429cfd553ef5d79974c0b84d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000; includeSubDomains

Request headers

Referer: https://gbrgbrgb.gb.net/grtgtgf4/5w4iyphdSP39.32.60.2342f0f8977dd3e00cbdf7a9e39beb12a0432e0208b393449b229fd58beb8de7339PakistanAsiaPKAS04-09-202008-29-22am/?Key=5w4iyphdSP39.32.60.2342f0f8977dd3e00cbdf7a9e39beb12a0432e0208b393449b229fd58beb8de7339PakistanAsiaPKAS04-09-202008-29-22am&rand=13InboxLightaspxn_5w4iyphdSP39.32.60.2342f0f8977dd3e00cbdf7a9e39beb12a0432e0208b393449b229fd58beb8de7339PakistanAsiaPKAS04-09-202008-29-22am_NXc0aXlwaGRTUA==-&2f0f8977dd3e00cbdf7a9e39beb12a0432e0208b393449b229fd58beb8de7339
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 04 Sep 2020 08:29:24 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
age: 902068
x-via: cfworker/kv
status: 200
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 41362
cf-request-id: 04f9d524330000d72905150200000001
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:16:21 GMT
server: cloudflare
etag: "5eb03fd5-33bbf"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000; includeSubDomains
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 5cd657b38885d729-FRA
expires: Wed, 25 Aug 2021 08:29:24 GMT

GET
H2 200 jquery.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery/3.1.1/ 85 KB
27 KB 34ms
20ms Script
application/javascript 2606:4700::6811:4f6b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery/3.1.1/jquery.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:4f6b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000; includeSubDomains

Request headers

Referer: https://gbrgbrgb.gb.net/grtgtgf4/5w4iyphdSP39.32.60.2342f0f8977dd3e00cbdf7a9e39beb12a0432e0208b393449b229fd58beb8de7339PakistanAsiaPKAS04-09-202008-29-22am/?Key=5w4iyphdSP39.32.60.2342f0f8977dd3e00cbdf7a9e39beb12a0432e0208b393449b229fd58beb8de7339PakistanAsiaPKAS04-09-202008-29-22am&rand=13InboxLightaspxn_5w4iyphdSP39.32.60.2342f0f8977dd3e00cbdf7a9e39beb12a0432e0208b393449b229fd58beb8de7339PakistanAsiaPKAS04-09-202008-29-22am_NXc0aXlwaGRTUA==-&2f0f8977dd3e00cbdf7a9e39beb12a0432e0208b393449b229fd58beb8de7339
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 04 Sep 2020 08:29:24 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
age: 730649
x-via: cfworker/kv
status: 200
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 27192
cf-request-id: 04f9d524330000d72905151200000001
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:11:48 GMT
server: cloudflare
etag: "5eb03ec4-152b5"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000; includeSubDomains
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 5cd657b38886d729-FRA
expires: Wed, 25 Aug 2021 08:29:24 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic (Online)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			gbrgbrgb.gb.net/	1969-12-31 23:59:59	Name: PHPSESSID Value: ebf06c1d67e086a0098d578676eff84d

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
cdnjs.cloudflare.com
code.jquery.com
gbrgbrgb.gb.net
lipis.github.io
maxcdn.bootstrapcdn.com
stackpath.bootstrapcdn.com
104.129.25.8
185.199.111.153
2001:4de0:ac19::1:b:2a
2001:4de0:ac19::1:b:3a
2606:4700::6811:4f6b
2a00:1450:4001:817::200a
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
0fbade78bbd7df1292d1ac6595dffb1cd06e05b2429cfd553ef5d79974c0b84d
34f195f17d62b4789625aa8cb3535024a72d40fc4d88ee1383154688b9bfaa27
46ca51fa88bcacd0a640d4411aabf06b8a6fe90980868d29431864168f9af03a
56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4
578a6224479b87c84e4fd4d0f34105ff4c860f19765a6539d34fc987db7c1eb4
7dacf83f51179de8d7980a513e67ab3a08f2c6272bb5946df8fd77c0d1763b73
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
9365920887b11b33a3dc4ba28a0f93951f200341263e3b9cefd384798e4be398
a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66
a6e05f70d58c26e19491c23887d32609a985e9f245d03fb38edcee5b409315b5
dea34f261a8f1665528217ef9040fc6e4ed0517be859fe25c8e440f02c10ac0a
e4bccea6ee8cfc15b2be9535ea987191f9c8ce6943050476af377d070e6bff49
e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b

gbrgbrgb.gb.net Open in urlscan Pro 104.129.25.8 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

11 Requests

100 %HTTPS

67 %IPv6

6 Domains

7 Subdomains

7 IPs

3 Countries

859 kBTransfer

1563 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 3 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

6 JavaScript Global Variables

1 Cookies

Indicators

gbrgbrgb.gb.net Open in urlscan Pro
104.129.25.8 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

100 %
HTTPS

67 %
IPv6

6
Domains

7
Subdomains

7
IPs

3
Countries

859 kB
Transfer

1563 kB
Size

1
Cookies

11 HTTP transactions
3 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!