Submitted URL: https://pub-d6daa71278e94e378a1675d602286e39.r2.dev/direct.html
Effective URL: https://gamesalimta77.site/id?register=show&referral=akungacor500
Submission Tags: @phish_report
Submission: On November 09 via api from FI — Scanned from FI

Summary

This website contacted 3 IPs in 1 countries across 2 domains to perform 9 HTTP transactions. The main IP is 2606:4700:20::681a:2c2, located in United States and belongs to CLOUDFLARENET, US. The main domain is gamesalimta77.site.
TLS certificate: Issued by WE1 on October 28th 2024. Valid for: 3 months.
This is the only time gamesalimta77.site was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 2a06:98c1:58::eb 13335 (CLOUDFLAR...)
1 8 2606:4700:20:... 13335 (CLOUDFLAR...)
9 3
Apex Domain
Subdomains
Transfer
8 gamesalimta77.site
gamesalimta77.site
19 KB
1 r2.dev
pub-d6daa71278e94e378a1675d602286e39.r2.dev
461 B
9 2
Domain Requested by
8 gamesalimta77.site 1 redirects gamesalimta77.site
1 pub-d6daa71278e94e378a1675d602286e39.r2.dev
9 2

This site contains links to these domains. Also see Links.

Domain
www.cloudflare.com
Subject Issuer Validity Valid
*.r2.dev
E5
2024-09-29 -
2024-12-28
3 months crt.sh
gamesalimta77.site
WE1
2024-10-28 -
2025-01-26
3 months crt.sh

This page contains 2 frames:

Primary Page: https://gamesalimta77.site/id?register=show&referral=akungacor500
Frame ID: 50FBADA142D4A30EB50F617163793861
Requests: 7 HTTP requests in this frame

Frame: https://gamesalimta77.site/cdn-cgi/challenge-platform/h/b/scripts/jsd/22755d9a86c9/main.js
Frame ID: 9CA6544C661986C71803BA6C483DDD31
Requests: 2 HTTP requests in this frame

Screenshot

Page Title

Attention Required! | Cloudflare

Page URL History Show full URLs

  1. https://pub-d6daa71278e94e378a1675d602286e39.r2.dev/direct.html Page URL
  2. https://gamesalimta77.site/id?register=show&referral=akungacor500 Page URL

Page Statistics

9
Requests

78 %
HTTPS

100 %
IPv6

2
Domains

2
Subdomains

3
IPs

1
Countries

19 kB
Transfer

45 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://pub-d6daa71278e94e378a1675d602286e39.r2.dev/direct.html Page URL
  2. https://gamesalimta77.site/id?register=show&referral=akungacor500 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 5
  • https://gamesalimta77.site/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
  • https://gamesalimta77.site/cdn-cgi/challenge-platform/h/b/scripts/jsd/22755d9a86c9/main.js

9 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
direct.html
pub-d6daa71278e94e378a1675d602286e39.r2.dev/
152 B
461 B
Document
General
Full URL
https://pub-d6daa71278e94e378a1675d602286e39.r2.dev/direct.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:58::eb , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1438d182a095dbaf96045e7e48650960ff8a671b751af611d8d4e31a01cfa94c

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

Accept-Ranges
bytes
CF-RAY
8df9a5434c898d86-HEL
Connection
keep-alive
Content-Length
152
Content-Type
text/html
Date
Sat, 09 Nov 2024 00:21:56 GMT
ETag
"50da2aae6e063d6d3f28e0a01515abec"
Last-Modified
Thu, 07 Nov 2024 14:34:35 GMT
Server
cloudflare
Vary
Accept-Encoding
Primary Request id
gamesalimta77.site/
5 KB
2 KB
Document
General
Full URL
https://gamesalimta77.site/id?register=show&referral=akungacor500
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:2c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
04be613847d4f63d892eec35e718a8c4e0d1ad7b4343711009b43000696e3d6b
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://pub-d6daa71278e94e378a1675d602286e39.r2.dev/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

cache-control
max-age=15
cf-ray
8df9a5464dbe8d8e-HEL
content-encoding
br
content-type
text/html; charset=UTF-8
date
Sat, 09 Nov 2024 00:21:56 GMT
expires
Sat, 09 Nov 2024 00:22:11 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy
same-origin
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wCL%2Bc5uStoYIxTHvRXFEFwsYFOxn35jaSz%2B%2F3AsXRFWZo8ZBALmuSM59%2FHuUP2p4MmsZaL95gcDZGskUXEV8%2BBPp%2FapxgbOCn6j5h62pwXRdOA982qMXeMj6HiI1uUp%2F7SHZOJM8SsiUkYFuTtvCBg%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
server-timing
cfL4;desc="?proto=TCP&rtt=30896&sent=6&recv=10&lost=0&retrans=0&sent_bytes=4007&recv_bytes=2376&delivery_rate=130886&cwnd=252&unsent_bytes=0&cid=4b3a654cc1d48a27&ts=44&x=0"
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
favicon.ico
pub-d6daa71278e94e378a1675d602286e39.r2.dev/
0
0

cf.errors.css
gamesalimta77.site/cdn-cgi/styles/
23 KB
5 KB
Stylesheet
General
Full URL
https://gamesalimta77.site/cdn-cgi/styles/cf.errors.css
Requested by
Host: gamesalimta77.site
URL: https://gamesalimta77.site/id?register=show&referral=akungacor500
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:2c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
84e3c77025ace5af143972b4a40fc834dcdfd4e449d4b36a57e62326f16b3091
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
Referer
https://gamesalimta77.site/id?register=show&referral=akungacor500

Response headers

vary
Accept-Encoding
cache-control
max-age=7200, public
content-encoding
gzip
etag
W/"672b8dd6-5df3"
x-content-type-options
nosniff
cf-ray
8df9a5468de78d8e-HEL
expires
Sat, 09 Nov 2024 02:21:56 GMT
date
Sat, 09 Nov 2024 00:21:56 GMT
content-type
text/css
last-modified
Wed, 06 Nov 2024 15:40:06 GMT
server
cloudflare
x-frame-options
DENY
browser-bar.png
gamesalimta77.site/cdn-cgi/images/
715 B
804 B
Image
General
Full URL
https://gamesalimta77.site/cdn-cgi/images/browser-bar.png?1376755637
Requested by
Host: gamesalimta77.site
URL: https://gamesalimta77.site/cdn-cgi/styles/cf.errors.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:2c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8c873472f4925d5d47521db4d52532d2983e9cb1bde8b43143a6cc6db56c35db
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
Referer
https://gamesalimta77.site/cdn-cgi/styles/cf.errors.css

Response headers

vary
Accept-Encoding
cache-control
max-age=7200, public
etag
"672b8dd6-2cb"
x-content-type-options
nosniff
cf-ray
8df9a546ee188d8e-HEL
expires
Sat, 09 Nov 2024 02:21:56 GMT
accept-ranges
bytes
content-length
715
date
Sat, 09 Nov 2024 00:21:56 GMT
content-type
image/png
last-modified
Wed, 06 Nov 2024 15:40:06 GMT
server
cloudflare
x-frame-options
DENY
cf-no-screenshot-error.png
gamesalimta77.site/cdn-cgi/images/
3 KB
3 KB
Image
General
Full URL
https://gamesalimta77.site/cdn-cgi/images/cf-no-screenshot-error.png
Requested by
Host: gamesalimta77.site
URL: https://gamesalimta77.site/cdn-cgi/styles/cf.errors.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:2c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1c53772285052e52bb7c12ad46a85a55747ed7bf66963fe1993fcef91ff5b0d0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
Referer
https://gamesalimta77.site/cdn-cgi/styles/cf.errors.css

Response headers

vary
Accept-Encoding
cache-control
max-age=7200, public
etag
"672b8dd6-c8d"
x-content-type-options
nosniff
cf-ray
8df9a546ee1a8d8e-HEL
expires
Sat, 09 Nov 2024 02:21:56 GMT
accept-ranges
bytes
content-length
3213
date
Sat, 09 Nov 2024 00:21:56 GMT
content-type
image/png
last-modified
Wed, 06 Nov 2024 15:40:06 GMT
server
cloudflare
x-frame-options
DENY
main.js
gamesalimta77.site/cdn-cgi/challenge-platform/h/b/scripts/jsd/22755d9a86c9/ Frame 9CA6
Redirect Chain
  • https://gamesalimta77.site/cdn-cgi/challenge-platform/scripts/jsd/main.js
  • https://gamesalimta77.site/cdn-cgi/challenge-platform/h/b/scripts/jsd/22755d9a86c9/main.js?
8 KB
4 KB
Script
General
Full URL
https://gamesalimta77.site/cdn-cgi/challenge-platform/h/b/scripts/jsd/22755d9a86c9/main.js?
Protocol
H2
Server
2606:4700:20::681a:2c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
803c34b03f22b92e0208a44de74cc90facb17b332f0ce85fbc308ea3c4a4f525
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
Referer

Response headers

cache-control
max-age=14400, stale-if-error=10800, stale-while-revalidate=10800, public
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
br
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dqVx0wixvi2m1CG9qAWNVpSbPKTucYs526uYmT0svSZ6fQecU%2BFojXpxPqNJknaigcMqAOFMn3XM1wFUZb4VofAh72m6UsOaCkvlaiLJL0UdhtnQE0WcS5hPIW3LBW6JgQehvp468yj19bMAuHiUAA%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
cf-ray
8df9a5474e428d8e-HEL
server-timing
cfL4;desc="?proto=TCP&rtt=33383&sent=36&recv=32&lost=0&retrans=0&sent_bytes=18361&recv_bytes=3116&delivery_rate=344261&cwnd=257&unsent_bytes=0&cid=4b3a654cc1d48a27&ts=208&x=0"
date
Sat, 09 Nov 2024 00:21:57 GMT
content-type
application/javascript; charset=UTF-8
vary
Accept-Encoding
server
cloudflare

Redirect headers

cache-control
max-age=300, stale-if-error=10800, stale-while-revalidate=10800, public
location
/cdn-cgi/challenge-platform/h/b/scripts/jsd/22755d9a86c9/main.js?
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Aj4J5Hn8wf%2BGt0AGRqD2iWg0L8wJHUUNZcs2Et1lPNrVJax0oQa9ioyRKwYJdkXba%2FZhQ2ZK7du2UPo1fw%2FNDmeaWvVa6l%2B3hG1mMoXkOiDBBHxRRSR9P39AYzlisflsssvkEJxEkzvdWs4%2Bk1LQxg%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
8df9a5470e248d8e-HEL
access-control-allow-origin
*
server-timing
cfL4;desc="?proto=TCP&rtt=33922&sent=30&recv=26&lost=0&retrans=0&sent_bytes=15745&recv_bytes=2955&delivery_rate=261527&cwnd=257&unsent_bytes=0&cid=4b3a654cc1d48a27&ts=167&x=0"
content-length
0
date
Sat, 09 Nov 2024 00:21:56 GMT
vary
Accept-Encoding
server
cloudflare
favicon.ico
gamesalimta77.site/
4 KB
2 KB
Other
General
Full URL
https://gamesalimta77.site/favicon.ico
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:2c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4e4794fac25422cbb1ba8029ae58d15b2be9d86aa0df90ce812aadbb155dbb29
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
Referer
https://gamesalimta77.site/id?register=show&referral=akungacor500

Response headers

cache-control
max-age=15
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
br
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DA%2BgyJIwmAd3WWO87N7nFDP6rRjKDnBva%2FqDbUZeGgdF0p9PH0DdIcBT27VswvdbHeyndNJmb1daB41RSnG2vicaly4jK2tbVX2G3fo%2B2gQDk%2FCuF5zdxKlkrTMRL0vmd2pMlWi3cXgRFet8%2BShP8Q%3D%3D"}],"group":"cf-nel","max_age":604800}
referrer-policy
same-origin
cf-ray
8df9a5472e318d8e-HEL
expires
Sat, 09 Nov 2024 00:22:11 GMT
server-timing
cfL4;desc="?proto=TCP&rtt=33303&sent=31&recv=31&lost=0&retrans=0&sent_bytes=16275&recv_bytes=3021&delivery_rate=344261&cwnd=257&unsent_bytes=0&cid=4b3a654cc1d48a27&ts=187&x=0"
date
Sat, 09 Nov 2024 00:21:56 GMT
content-type
text/html; charset=UTF-8
vary
Accept-Encoding
server
cloudflare
x-frame-options
SAMEORIGIN
8df9a5464dbe8d8e
gamesalimta77.site/cdn-cgi/challenge-platform/h/b/jsd/r/ Frame 9CA6
0
1 KB
XHR
General
Full URL
https://gamesalimta77.site/cdn-cgi/challenge-platform/h/b/jsd/r/8df9a5464dbe8d8e
Requested by
Host: gamesalimta77.site
URL: https://gamesalimta77.site/cdn-cgi/challenge-platform/scripts/jsd/main.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:2c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
Content-Type
application/json
Referer

Response headers

nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vvL5Gm167%2Bd%2B3Plh%2F3KUumycp6kusgTqnpgBnDhq2BlZwqRcHJvoyp%2BkNUFYR%2BkUpAgXPdKo95%2F4AX7ItwAE6XF01NfuKskYguMrlAaWfZmiF44MAiVUQqSFeJLSYs%2FO8BHumFRDD%2B5EEGlQWJO3tw%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
8df9a5484ee48d8e-HEL
server-timing
cfL4;desc="?proto=TCP&rtt=32927&sent=48&recv=50&lost=0&retrans=0&sent_bytes=22770&recv_bytes=19595&delivery_rate=357154&cwnd=257&unsent_bytes=0&cid=4b3a654cc1d48a27&ts=405&x=0"
content-length
0
date
Sat, 09 Nov 2024 00:21:57 GMT
content-type
text/plain; charset=UTF-8
server
cloudflare

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
pub-d6daa71278e94e378a1675d602286e39.r2.dev
URL
https://pub-d6daa71278e94e378a1675d602286e39.r2.dev/favicon.ico

Verdicts & Comments Add Verdict or Comment

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| _cf_translation

1 Cookies

Domain/Path Name / Value
.gamesalimta77.site/ Name: cf_clearance
Value: B4KNHLcpOd4MClCjj2io5qNXACZgJ74bmCIV9ETAsyY-1731111717-1.2.1.1-ck0CG7W9Jf6yGKrQiw0YmfOvcAAOeYWarQ1IXAa7ZhtDqIt33xukcte0DPrt03vIz8hZ6boyuYz4DRNRT4RSqEh.uBRiBHb9Abl9oVjZO3jmBIGPgU2WFck_l3sf3S.9ow76CPxZlfUkfGGZ.THKOVf0dMt1oygQlVWq1bnuNIh0_P6IOrPcGG5ZPTJtxoPxifjj5DOdqUDoej1ixWWUOZFVKddfBCqGyDzNQt3_4dbI3xJMExf3BvkxFIW1DW6lu.Bupaa.VwrHkV65F1F.9MUNuWxtHfKbUBU4IbQSNd9czrCOJYtekE85tT62QtDh.zSy6I4wZToTFCeL7heS8FXWRf733HRvBZgu9gGKRhLcN9xomuRuPIu9cjPpQ9oevp0OjsIPi_QMhARitdkfn47BXLmr0K7nrAH7zk2dTY5FS5NT8JQDSzXey.9QvRgA

2 Console Messages

Source Level URL
Text
network error URL: https://gamesalimta77.site/id?register=show&referral=akungacor500
Message:
Failed to load resource: the server responded with a status of 403 ()
network error URL: https://gamesalimta77.site/favicon.ico
Message:
Failed to load resource: the server responded with a status of 403 ()