www.pubgmena.com Open in urlscan Pro
2a00:1450:4001:810::2013 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://pubgmena.com/
Effective URL:
https://www.pubgmena.com/
Submission: On August 28 via api (August 28th 2022, 2:41:00 pm UTC) from US — Scanned from DE

Summary HTTP 17 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 7 IPs in 3 countries across 6 domains to perform 17 HTTP transactions. The main IP is 2a00:1450:4001:810::2013, located in Frankfurt am Main, Germany and belongs to GOOGLE, US. The main domain is www.pubgmena.com.
TLS certificate: Issued by GTS CA 1D4 on June 30th 2022. Valid for: 3 months.

This is the only time www.pubgmena.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Scam (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 1	216.239.38.21 216.239.38.21	15169 (GOOGLE) (GOOGLE)
1 3	2a00:1450:400... 2a00:1450:4001:810::2013	15169 (GOOGLE) (GOOGLE)
1	2600:9000:223... 2600:9000:223d:f200:3:b5aa:ad80:21	16509 (AMAZON-02) (AMAZON-02)
2	2a00:1450:400... 2a00:1450:4001:812::200a	15169 (GOOGLE) (GOOGLE)
2	217.182.228.53 217.182.228.53	16276 (OVH) (OVH)
5	2600:9000:225... 2600:9000:225e:2600:12:a4d0:1300:21	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700::68... 2606:4700::6812:39d	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2a00:1450:400... 2a00:1450:4001:82a::2003	15169 (GOOGLE) (GOOGLE)
17	7

1 216.239.38.21 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: any-in-2615.1e100.net

pubgmena.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:810::2013 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.pubgmena.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:223d:f200:3:b5aa:ad80:21 (United States)

ASN16509 (AMAZON-02, US)

d13nu0oomnx5ti.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:812::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 217.182.228.53 (France)

ASN16276 (OVH, FR)
PTR: ip53.ip-217-182-228.eu

i.ibb.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2600:9000:225e:2600:12:a4d0:1300:21 (United States)

ASN16509 (AMAZON-02, US)

d35kbxc0t24sp8.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:39d (United States)

ASN13335 (CLOUDFLARENET, US)

png.pngtree.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:82a::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	cloudfront.net d13nu0oomnx5ti.cloudfront.net d35kbxc0t24sp8.cloudfront.net	44 KB
4	gstatic.com fonts.gstatic.com	37 KB
4	pubgmena.com 2 redirects pubgmena.com www.pubgmena.com	7 KB
2	ibb.co i.ibb.co — Cisco Umbrella Rank: 12331	305 KB
2	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 54	1 KB
1	pngtree.com png.pngtree.com — Cisco Umbrella Rank: 43868	889 B
17	6

	Domain	Requested by
5	d35kbxc0t24sp8.cloudfront.net	d13nu0oomnx5ti.cloudfront.net
4	fonts.gstatic.com	fonts.googleapis.com
3	www.pubgmena.com	1 redirects www.pubgmena.com
2	i.ibb.co	www.pubgmena.com
2	fonts.googleapis.com	www.pubgmena.com
1	png.pngtree.com	www.pubgmena.com
1	d13nu0oomnx5ti.cloudfront.net	www.pubgmena.com
1	pubgmena.com	1 redirects
17	8

This site contains links to these domains. Also see Links.

Domain
www.blogger.com

Subject Issuer	Validity	Valid
www.pubgmena.com GTS CA 1D4	`2022-06-30` - `2022-09-28`	3 months	crt.sh
*.cloudfront.net Amazon	`2022-02-01` - `2023-01-31`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2022-08-08` - `2022-10-31`	3 months	crt.sh
ibb.co R3	`2022-08-07` - `2022-11-05`	3 months	crt.sh
*.pngtree.com GeoTrust RSA CN CA G2	`2022-04-03` - `2023-04-29`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2022-08-08` - `2022-10-31`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://www.pubgmena.com/
Frame ID: ED2DD493BE9DCD445D688C0B3D95A97D
Requests: 17 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

شحن شدات ببجي مجانا 2022

Page URL History Show full URLs

http://pubgmena.com/ HTTP 301
http://www.pubgmena.com/ HTTP 301
https://www.pubgmena.com/ Page URL

Detected technologies

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Page Statistics

17
Requests

100 %
HTTPS

75 %
IPv6

6
Domains

8
Subdomains

7
IPs

3
Countries

395 kB
Transfer

407 kB
Size

1
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://www.blogger.com/go/blogspot-cookies
Title: Weitere Informationen

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://pubgmena.com/ HTTP 301
http://www.pubgmena.com/ HTTP 301
https://www.pubgmena.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

17 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
www.pubgmena.com/
Redirect Chain

http://pubgmena.com/
http://www.pubgmena.com/
https://www.pubgmena.com/

16 KB
4 KB

551ms
255ms

Document
text/html

2a00:1450:4001:810::2013
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.pubgmena.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2013 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

12c32710ab4457cb48913fab79b3bb5ce7b979e423ca3d63ee755aa622e3a894

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: private, max-age=0
content-encoding: gzip
content-length: 4106
content-type: text/html; charset=UTF-8
date: Sun, 28 Aug 2022 14:40:54 GMT
etag: W/"168f528e4f12367eeb535f5f27047c2f4acbd2bcacb37ed69445028d7fe89df3"
expires: Sun, 28 Aug 2022 14:40:54 GMT
last-modified: Sat, 09 Jul 2022 00:49:01 GMT
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

Redirect headers

Cache-Control: private, max-age=0
Content-Encoding: gzip
Content-Length: 173
Content-Security-Policy: frame-ancestors 'self'
Content-Type: text/html; charset=UTF-8
Date: Sun, 28 Aug 2022 14:40:53 GMT
Expires: Sun, 28 Aug 2022 14:40:53 GMT
Location: https://www.pubgmena.com/
Server: GSE
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block

GET
H2 200 e25423c.js Show response
d13nu0oomnx5ti.cloudfront.net/ 23 KB
23 KB 800ms
514ms Script
application/javascript 2600:9000:223d:f200:3:b5aa:ad80:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d13nu0oomnx5ti.cloudfront.net/e25423c.js
Requested by: Host: www.pubgmena.com
URL: https://www.pubgmena.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223d:f200:3:b5aa:ad80:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: f0f2a573c8865ae8576b67d2a40ab1077a9e068c038447391d28db9ea98af931

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.pubgmena.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sun, 28 Aug 2022 00:57:53 GMT
via: 1.1 eaedf92fd05c53aa96f20b6322b473e6.cloudfront.net (CloudFront)
last-modified: Sat, 06 Aug 2022 10:17:17 GMT
server: AmazonS3
age: 49415
etag: "f35b39586568ca1063fc72edc92467c3"
x-cache: Error from cloudfront
content-type: application/javascript
x-amz-cf-pop: FRA56-P3
content-length: 23439
x-amz-cf-id: EHMIRcEXKSTkrJaSIQVTm0_ZzWe0z02IwPKWsdJXvwHNrV4F6vZGdQ==

GET
H2 200 css2
fonts.googleapis.com/ 1 KB
941 B 572ms
308ms Stylesheet
text/css 2a00:1450:4001:812::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Changa:wght@500&display=swap

Requested by

Host: www.pubgmena.com
URL: https://www.pubgmena.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

369e45eeb5d56be7e9a28d3d15b5f533c031d82142ba631d0fbf2d4b9a975307

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.pubgmena.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Sun, 28 Aug 2022 14:40:54 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Sun, 28 Aug 2022 14:40:54 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sun, 28 Aug 2022 14:40:54 GMT

GET
H2 200 css2
fonts.googleapis.com/ 710 B
418 B 573ms
310ms Stylesheet
text/css 2a00:1450:4001:812::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Tajawal:wght@500&display=swap

Requested by

Host: www.pubgmena.com
URL: https://www.pubgmena.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

c8e4ef68af331b484059d3ad0325bf402274a69d8e219b446b43f412defec050

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.pubgmena.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Sun, 28 Aug 2022 14:40:54 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Sun, 28 Aug 2022 14:40:54 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sun, 28 Aug 2022 14:40:54 GMT

GET
H2 200 pngwing-com.png
i.ibb.co/3YLT2gC/ 210 KB
211 KB 412ms
133ms Image
image/png 217.182.228.53
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.ibb.co/3YLT2gC/pngwing-com.png
Requested by: Host: www.pubgmena.com
URL: https://www.pubgmena.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 217.182.228.53 , France, ASN16276 (OVH, FR),
Reverse DNS: ip53.ip-217-182-228.eu
Software: nginx /
Resource Hash: 47c9d9a95e53a49a9559ca4cc53d05ff571a0d42b76bf21209d63547f4f51c91

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.pubgmena.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sun, 28 Aug 2022 14:40:55 GMT
last-modified: Fri, 15 Apr 2022 09:38:41 GMT
server: nginx
access-control-allow-methods: GET, OPTIONS
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 215443
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 15.png
i.ibb.co/q0mjzXM/ 94 KB
94 KB 174ms
133ms Image
image/png 217.182.228.53
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.ibb.co/q0mjzXM/15.png
Requested by: Host: www.pubgmena.com
URL: https://www.pubgmena.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 217.182.228.53 , France, ASN16276 (OVH, FR),
Reverse DNS: ip53.ip-217-182-228.eu
Software: nginx /
Resource Hash: 192ad33d0227363fc49b1a4f4eb349c0c680859a69bea3a8de5698698d619ed3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.pubgmena.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sun, 28 Aug 2022 14:40:55 GMT
last-modified: Sat, 05 Mar 2022 04:23:17 GMT
server: nginx
access-control-allow-methods: GET, OPTIONS
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 96115
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 cookienotice.js Show response
www.pubgmena.com/js/ 6 KB
2 KB 144ms
144ms Script
text/javascript 2a00:1450:4001:810::2013
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.pubgmena.com/js/cookienotice.js

Requested by

Host: www.pubgmena.com
URL: https://www.pubgmena.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2013 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

068ffe90977f2b5b2dc2ef18572166e85281bd0ecb31c4902464b23db54d2568

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.pubgmena.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sun, 28 Aug 2022 14:40:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Sun, 28 Aug 2022 13:59:39 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"blogger-tech","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/blogger-tech"}]}
content-type: text/javascript
cache-control: public, max-age=604800
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 2026
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="blogger-tech"
expires: Sun, 04 Sep 2022 14:40:55 GMT

GET
H2 200 html.1126244.2267e.0.js Show response
d35kbxc0t24sp8.cloudfront.net/public/external/v2/ 12 KB
12 KB 559ms
293ms Script
application/javascript 2600:9000:225e:2600:12:a4d0:1300:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d35kbxc0t24sp8.cloudfront.net/public/external/v2/html.1126244.2267e.0.js
Requested by: Host: d13nu0oomnx5ti.cloudfront.net
URL: https://d13nu0oomnx5ti.cloudfront.net/e25423c.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:225e:2600:12:a4d0:1300:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Apache/2.4.51 () OpenSSL/1.0.2k-fips PHP/7.4.11 / PHP/7.4.11
Resource Hash: 118fc8165fe595b85ed58723f3873e9caa96dec42ae2a0f30675766b5e1b9921

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.pubgmena.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sun, 28 Aug 2022 14:40:55 GMT
via: 1.1 21369bf2bfeb79adaa5bef1cb96f8540.cloudfront.net (CloudFront)
server: Apache/2.4.51 () OpenSSL/1.0.2k-fips PHP/7.4.11
x-amz-cf-pop: FRA60-P4
x-powered-by: PHP/7.4.11
x-cache: Miss from cloudfront
content-type: application/javascript
x-amz-cf-id: NyiMYKH0t5nJB-OkfPygGyUdPntsElzrufJaI0ruNHZeXHY7U2cdeg==

GET
H2 200 css_front.css
d35kbxc0t24sp8.cloudfront.net/public/external/ 6 KB
7 KB 549ms
281ms Stylesheet
text/css 2600:9000:225e:2600:12:a4d0:1300:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d35kbxc0t24sp8.cloudfront.net/public/external/css_front.css
Requested by: Host: d13nu0oomnx5ti.cloudfront.net
URL: https://d13nu0oomnx5ti.cloudfront.net/e25423c.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:225e:2600:12:a4d0:1300:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Apache/2.4.46 () OpenSSL/1.0.2k-fips PHP/7.4.11 /
Resource Hash: a7bd79b6fba60944ee3a9c153108ff0819d2db57850116ac7065a86db08af4ec

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.pubgmena.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sun, 28 Aug 2022 14:40:55 GMT
via: 1.1 21369bf2bfeb79adaa5bef1cb96f8540.cloudfront.net (CloudFront)
last-modified: Tue, 23 Jun 2020 20:06:47 GMT
server: Apache/2.4.46 () OpenSSL/1.0.2k-fips PHP/7.4.11
x-amz-cf-pop: FRA60-P4
etag: "19c4-5a8c5e62e9d0a"
x-cache: Miss from cloudfront
content-type: text/css
accept-ranges: bytes
content-length: 6596
x-amz-cf-id: xChhu3tANQpUAuZHUnBGLK6W2z2oSkQ_SHE9g0pZioqrVkXkkbtEJw==

GET
H2 200 pngtree-pure-white-minimalist-background-wallpaper-image_396581.jpg
png.pngtree.com/thumb_back/fh260/background/20200821/ 461 B
889 B 1246ms
569ms Image
image/jpeg 2606:4700::6812:39d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://png.pngtree.com/thumb_back/fh260/background/20200821/pngtree-pure-white-minimalist-background-wallpaper-image_396581.jpg
Requested by: Host: www.pubgmena.com
URL: https://www.pubgmena.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:39d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9fa5ad13760f36ab58bc43320bfb286f45c3105c802a15d4f43539d1dead2c4a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.pubgmena.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sun, 28 Aug 2022 14:40:56 GMT
cf-cache-status: HIT
x-amz-request-id: N5J2PGN346QFZMZD
last-modified: Fri, 21 Aug 2020 11:02:32 GMT
content-length: 461
x-amz-id-2: TLcUtZT0890I02u73hQpEQknSwC1OUktDCd2ZWF8or7K4ZjW6SxzD+Ni4C6A1iG9zund1Q1t1kQ=
cf-bgj: h2pri
server: cloudflare
etag: "a559c89cc0a7354db930b927e888d642"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: public, max-age=16070400
accept-ranges: bytes
cf-ray: 741dce0e597d01eb-ZRH
expires: Thu, 02 Mar 2023 14:40:56 GMT

GET
H2 200 Iurf6YBj_oCad4k1l8KiHrFpiQ.woff2
fonts.gstatic.com/s/tajawal/v9/ 10 KB
10 KB 391ms
128ms Font
font/woff2 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/tajawal/v9/Iurf6YBj_oCad4k1l8KiHrFpiQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Tajawal:wght@500&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9986de5db80ec050300f1cea25d651a5779ae62b91a39b5667ac23d0c7668cbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.pubgmena.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 20:22:18 GMT
x-content-type-options: nosniff
age: 325117
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9900
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 16:01:40 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 24 Aug 2023 20:22:18 GMT

GET
H2 200 2-c79JNi2YuVOUcOarRPgnNGooxCZ5-xcjLj9ytf.woff2
fonts.gstatic.com/s/changa/v20/ 9 KB
9 KB 408ms
147ms Font
font/woff2 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/changa/v20/2-c79JNi2YuVOUcOarRPgnNGooxCZ5-xcjLj9ytf.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Changa:wght@500&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7951c8c6ca67cc958dd230ece3be4bf8b0825e828b119e0da0ad5c40a666202b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.pubgmena.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 19:16:07 GMT
x-content-type-options: nosniff
age: 329088
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8944
x-xss-protection: 0
last-modified: Fri, 24 Jun 2022 18:40:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 24 Aug 2023 19:16:07 GMT

GET
H2 200 2-c79JNi2YuVOUcOarRPgnNGooxCZ5-xcjfj9w.woff2
fonts.gstatic.com/s/changa/v20/ 9 KB
9 KB 526ms
266ms Font
font/woff2 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/changa/v20/2-c79JNi2YuVOUcOarRPgnNGooxCZ5-xcjfj9w.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Changa:wght@500&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d5bb2eb70b3c9b5b1b81d6d275a05ac440cffc5c539a989f67dc257b3ba8d3ab

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.pubgmena.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sun, 21 Aug 2022 15:33:18 GMT
x-content-type-options: nosniff
age: 601657
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9348
x-xss-protection: 0
last-modified: Fri, 24 Jun 2022 18:40:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 21 Aug 2023 15:33:18 GMT

GET
H2 200 Iurf6YBj_oCad4k1l8KiHrRpiYlJ.woff2
fonts.gstatic.com/s/tajawal/v9/ 8 KB
8 KB 432ms
172ms Font
font/woff2 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/tajawal/v9/Iurf6YBj_oCad4k1l8KiHrRpiYlJ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Tajawal:wght@500&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ff5afc2fb4dbd2ecb286ee9b121154abaa9709ae3d710d730a57702725bc28e4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.pubgmena.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Wed, 24 Aug 2022 20:22:58 GMT
x-content-type-options: nosniff
age: 325077
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8524
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 16:00:33 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 24 Aug 2023 20:22:58 GMT

GET
H2 200 css.css
d35kbxc0t24sp8.cloudfront.net/public/clockers/PrimeApps/ 1010 B
1 KB 275ms
275ms Stylesheet
text/css 2600:9000:225e:2600:12:a4d0:1300:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d35kbxc0t24sp8.cloudfront.net/public/clockers/PrimeApps/css.css
Requested by: Host: d13nu0oomnx5ti.cloudfront.net
URL: https://d13nu0oomnx5ti.cloudfront.net/e25423c.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:225e:2600:12:a4d0:1300:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Apache/2.4.51 () OpenSSL/1.0.2k-fips PHP/7.4.11 /
Resource Hash: a7081a117335212b9e7f2e348f7369a64423d51db1666310b3451e7375f0b7de

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.pubgmena.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sun, 28 Aug 2022 14:40:55 GMT
via: 1.1 21369bf2bfeb79adaa5bef1cb96f8540.cloudfront.net (CloudFront)
last-modified: Fri, 10 Apr 2020 22:29:00 GMT
server: Apache/2.4.51 () OpenSSL/1.0.2k-fips PHP/7.4.11
x-amz-cf-pop: FRA60-P4
etag: "3f2-5a2f7428ae907"
x-cache: Miss from cloudfront
content-type: text/css
accept-ranges: bytes
content-length: 1010
x-amz-cf-id: V-b5IKRmj59SR77Mbpj4vZLY1hV93TBYARQ3dUcryCsB9djDi96eKg==

GET
H2 200 guid Show response
d35kbxc0t24sp8.cloudfront.net/public/ 0
286 B 281ms
280ms Script
text/html 2600:9000:225e:2600:12:a4d0:1300:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d35kbxc0t24sp8.cloudfront.net/public/guid?cpguid=fnfmz1q9f&e=ll&t=1661697656059
Requested by: Host: d13nu0oomnx5ti.cloudfront.net
URL: https://d13nu0oomnx5ti.cloudfront.net/e25423c.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:225e:2600:12:a4d0:1300:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Apache/2.4.51 () OpenSSL/1.0.2k-fips PHP/7.4.11 / PHP/7.4.11
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.pubgmena.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sun, 28 Aug 2022 14:40:56 GMT
via: 1.1 21369bf2bfeb79adaa5bef1cb96f8540.cloudfront.net (CloudFront)
server: Apache/2.4.51 () OpenSSL/1.0.2k-fips PHP/7.4.11
x-amz-cf-pop: FRA60-P4
x-powered-by: PHP/7.4.11
x-cache: Miss from cloudfront
content-type: text/html; charset=UTF-8
content-length: 0
x-amz-cf-id: IIBmDUClTy6nGdav8BLhwDu0U08J-M7nzbvPoqNAkLu_gR527XycUw==

GET
H2 200 check.php Show response
d35kbxc0t24sp8.cloudfront.net/public/external/ 78 B
372 B 283ms
283ms Script
application/javascript 2600:9000:225e:2600:12:a4d0:1300:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d35kbxc0t24sp8.cloudfront.net/public/external/check.php?it=1126244&time=1661697657645
Requested by: Host: d13nu0oomnx5ti.cloudfront.net
URL: https://d13nu0oomnx5ti.cloudfront.net/e25423c.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:225e:2600:12:a4d0:1300:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Apache/2.4.51 () OpenSSL/1.0.2k-fips PHP/7.4.11 / PHP/7.4.11
Resource Hash: 9ef4a63fc5e0a14a7301d693d65d6acfc44cdf14853c4a20890198f2d5e52e3b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.pubgmena.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Sun, 28 Aug 2022 14:40:57 GMT
via: 1.1 21369bf2bfeb79adaa5bef1cb96f8540.cloudfront.net (CloudFront)
server: Apache/2.4.51 () OpenSSL/1.0.2k-fips PHP/7.4.11
x-amz-cf-pop: FRA60-P4
x-powered-by: PHP/7.4.11
x-cache: Miss from cloudfront
content-type: application/javascript
content-length: 78
x-amz-cf-id: EuvHp-Vj8BbaXd8hrJbYqHlVxwHcypf_s0IkeY6h8Idb4HcPwjmSDw==

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Scam (Online)

36 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.pubgmena.com/	1970-01-20 05:49:21	Name: _cpguid Value: fnfmz1q9f

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

d13nu0oomnx5ti.cloudfront.net
d35kbxc0t24sp8.cloudfront.net
fonts.googleapis.com
fonts.gstatic.com
i.ibb.co
png.pngtree.com
pubgmena.com
www.pubgmena.com
216.239.38.21
217.182.228.53
2600:9000:223d:f200:3:b5aa:ad80:21
2600:9000:225e:2600:12:a4d0:1300:21
2606:4700::6812:39d
2a00:1450:4001:810::2013
2a00:1450:4001:812::200a
2a00:1450:4001:82a::2003
068ffe90977f2b5b2dc2ef18572166e85281bd0ecb31c4902464b23db54d2568
118fc8165fe595b85ed58723f3873e9caa96dec42ae2a0f30675766b5e1b9921
12c32710ab4457cb48913fab79b3bb5ce7b979e423ca3d63ee755aa622e3a894
192ad33d0227363fc49b1a4f4eb349c0c680859a69bea3a8de5698698d619ed3
369e45eeb5d56be7e9a28d3d15b5f533c031d82142ba631d0fbf2d4b9a975307
47c9d9a95e53a49a9559ca4cc53d05ff571a0d42b76bf21209d63547f4f51c91
7951c8c6ca67cc958dd230ece3be4bf8b0825e828b119e0da0ad5c40a666202b
9986de5db80ec050300f1cea25d651a5779ae62b91a39b5667ac23d0c7668cbb
9ef4a63fc5e0a14a7301d693d65d6acfc44cdf14853c4a20890198f2d5e52e3b
9fa5ad13760f36ab58bc43320bfb286f45c3105c802a15d4f43539d1dead2c4a
a7081a117335212b9e7f2e348f7369a64423d51db1666310b3451e7375f0b7de
a7bd79b6fba60944ee3a9c153108ff0819d2db57850116ac7065a86db08af4ec
c8e4ef68af331b484059d3ad0325bf402274a69d8e219b446b43f412defec050
d5bb2eb70b3c9b5b1b81d6d275a05ac440cffc5c539a989f67dc257b3ba8d3ab
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f0f2a573c8865ae8576b67d2a40ab1077a9e068c038447391d28db9ea98af931
ff5afc2fb4dbd2ecb286ee9b121154abaa9709ae3d710d730a57702725bc28e4

www.pubgmena.com Open in urlscan Pro 2a00:1450:4001:810::2013 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

17 Requests

100 %HTTPS

75 %IPv6

6 Domains

8 Subdomains

7 IPs

3 Countries

395 kBTransfer

407 kBSize

1 Cookies

1 Outgoing links

Page URL History

Redirected requests

17 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

36 JavaScript Global Variables

1 Cookies

Security Headers

Indicators

www.pubgmena.com Open in urlscan Pro
2a00:1450:4001:810::2013 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

17
Requests

100 %
HTTPS

75 %
IPv6

6
Domains

8
Subdomains

7
IPs

3
Countries

395 kB
Transfer

407 kB
Size

1
Cookies

17 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!