www.pubgmena.com Open in urlscan Pro
2a00:1450:4001:830::2013 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://pubgmena.com/
Effective URL:
https://www.pubgmena.com/
Submission: On May 03 via api (May 3rd 2022, 5:00:38 am UTC) from US — Scanned from DE

Summary HTTP 17 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 7 IPs in 3 countries across 6 domains to perform 17 HTTP transactions. The main IP is 2a00:1450:4001:830::2013, located in Frankfurt am Main, Germany and belongs to GOOGLE, US. The main domain is www.pubgmena.com.
TLS certificate: Issued by GTS CA 1D4 on May 2nd 2022. Valid for: 3 months.

This is the only time www.pubgmena.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Scam (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 1	162.255.119.133 162.255.119.133	22612 (NAMECHEAP...) (NAMECHEAP-NET)
2	2a00:1450:400... 2a00:1450:4001:830::2013	15169 (GOOGLE) (GOOGLE)
1	2600:9000:20e... 2600:9000:20eb:6000:3:b5aa:ad80:21	16509 (AMAZON-02) (AMAZON-02)
2	2a00:1450:400... 2a00:1450:4001:82a::200a	15169 (GOOGLE) (GOOGLE)
2	51.210.3.236 51.210.3.236	16276 (OVH) (OVH)
5	2600:9000:21f... 2600:9000:21f3:0:13:652b:c180:21	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700::68... 2606:4700::6812:29d	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2a00:1450:400... 2a00:1450:4001:830::2003	15169 (GOOGLE) (GOOGLE)
17	7

1 162.255.119.133 (United States) 1 redirects

ASN22612 (NAMECHEAP-NET, US)

pubgmena.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:830::2013 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.pubgmena.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:20eb:6000:3:b5aa:ad80:21 (United States)

ASN16509 (AMAZON-02, US)

d13nu0oomnx5ti.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82a::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 51.210.3.236 (France)

ASN16276 (OVH, FR)
PTR: ns3172623.ip-51-210-3.eu

i.ibb.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2600:9000:21f3:0:13:652b:c180:21 (United States)

ASN16509 (AMAZON-02, US)

dgu9g3a2kzqx2.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:29d (United States)

ASN13335 (CLOUDFLARENET, US)

png.pngtree.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:830::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	cloudfront.net d13nu0oomnx5ti.cloudfront.net dgu9g3a2kzqx2.cloudfront.net	44 KB
4	gstatic.com fonts.gstatic.com	37 KB
3	pubgmena.com 1 redirects pubgmena.com www.pubgmena.com	7 KB
2	ibb.co i.ibb.co — Cisco Umbrella Rank: 13451	305 KB
2	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 111	1 KB
1	pngtree.com png.pngtree.com — Cisco Umbrella Rank: 51163	896 B
17	6

	Domain	Requested by
5	dgu9g3a2kzqx2.cloudfront.net	d13nu0oomnx5ti.cloudfront.net
4	fonts.gstatic.com	fonts.googleapis.com
2	i.ibb.co	www.pubgmena.com
2	fonts.googleapis.com	www.pubgmena.com
2	www.pubgmena.com	www.pubgmena.com
1	png.pngtree.com	www.pubgmena.com
1	d13nu0oomnx5ti.cloudfront.net	www.pubgmena.com
1	pubgmena.com	1 redirects
17	8

This site contains links to these domains. Also see Links.

Domain
www.blogger.com

Subject Issuer	Validity	Valid
www.pubgmena.com GTS CA 1D4	`2022-05-02` - `2022-07-31`	3 months	crt.sh
*.cloudfront.net Amazon	`2022-02-01` - `2023-01-31`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2022-04-11` - `2022-07-04`	3 months	crt.sh
ibb.co R3	`2022-04-07` - `2022-07-06`	3 months	crt.sh
*.pngtree.com GeoTrust RSA CN CA G2	`2022-04-03` - `2023-04-29`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2022-04-11` - `2022-07-04`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://www.pubgmena.com/
Frame ID: E6166226B468FB4D4535B0F4CD0CE799
Requests: 17 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

شحن شدات ببجي مجانا 2022

Page URL History Show full URLs

http://pubgmena.com/ HTTP 302
https://www.pubgmena.com/ Page URL

Detected technologies

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Page Statistics

17
Requests

100 %
HTTPS

75 %
IPv6

6
Domains

8
Subdomains

7
IPs

3
Countries

394 kB
Transfer

406 kB
Size

1
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://www.blogger.com/go/blogspot-cookies
Title: Weitere Informationen

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://pubgmena.com/ HTTP 302
https://www.pubgmena.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

17 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
www.pubgmena.com/
Redirect Chain

http://pubgmena.com/
https://www.pubgmena.com/

16 KB
4 KB

184ms
129ms

Document
text/html

2a00:1450:4001:830::2013
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.pubgmena.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2013 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

2ff1d299873307777096898c2c11ed07fd9171471af2797e85ecc5f7d6188400

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: private, max-age=0
content-encoding: gzip
content-length: 4113
content-type: text/html; charset=UTF-8
date: Tue, 03 May 2022 05:00:33 GMT
etag: W/"1469d3b25ea85b6107166a5fa267619729ba79caa84e385428f32310882c7ba8"
expires: Tue, 03 May 2022 05:00:33 GMT
last-modified: Fri, 15 Apr 2022 10:18:44 GMT
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

Redirect headers

Connection: keep-alive
Content-Length: 47
Content-Type: text/html; charset=utf-8
Date: Tue, 03 May 2022 05:00:33 GMT
Location: https://www.pubgmena.com
Server: nginx
X-Served-By: Namecheap URL Forward

GET
H2 200 e25423c.js Show response
d13nu0oomnx5ti.cloudfront.net/ 23 KB
23 KB 364ms
335ms Script
application/javascript 2600:9000:20eb:6000:3:b5aa:ad80:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d13nu0oomnx5ti.cloudfront.net/e25423c.js
Requested by: Host: www.pubgmena.com
URL: https://www.pubgmena.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20eb:6000:3:b5aa:ad80:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: d71b75f37cbaa198fcac72013ceb2a2fe5b68c89902dbcf4b52ae28812cb9268

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.pubgmena.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Tue, 03 May 2022 02:54:47 GMT
via: 1.1 59d92388a3a66e5f245f384a437fa024.cloudfront.net (CloudFront)
last-modified: Mon, 03 May 2021 01:43:32 GMT
server: AmazonS3
age: 25112
etag: "6863f6e390060c097da580136d1dcaf2"
x-cache: Error from cloudfront
content-type: application/javascript
x-amz-cf-pop: FRA2-C1
content-length: 23438
x-amz-cf-id: hoMKNJCxNxvvwcD0WdX5wrVRa7zIo4uespTjHWW0FbvzqGGoeWk13w==

GET
H2 200 css2
fonts.googleapis.com/ 1 KB
938 B 38ms
16ms Stylesheet
text/css 2a00:1450:4001:82a::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Changa:wght@500&display=swap

Requested by

Host: www.pubgmena.com
URL: https://www.pubgmena.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

6e9ace4008267f5573a4a12af78df63bc62401f51fa2b5a3805c7ea708660bd1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.pubgmena.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 03 May 2022 05:00:34 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Tue, 03 May 2022 05:00:34 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 03 May 2022 05:00:34 GMT

GET
H2 200 css2
fonts.googleapis.com/ 710 B
418 B 45ms
24ms Stylesheet
text/css 2a00:1450:4001:82a::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Tajawal:wght@500&display=swap

Requested by

Host: www.pubgmena.com
URL: https://www.pubgmena.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

c8e4ef68af331b484059d3ad0325bf402274a69d8e219b446b43f412defec050

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.pubgmena.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 03 May 2022 05:00:34 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Tue, 03 May 2022 05:00:34 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 03 May 2022 05:00:34 GMT

GET
H2 200 pngwing-com.png
i.ibb.co/3YLT2gC/ 210 KB
211 KB 61ms
14ms Image
image/png 51.210.3.236
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.ibb.co/3YLT2gC/pngwing-com.png
Requested by: Host: www.pubgmena.com
URL: https://www.pubgmena.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 51.210.3.236 , France, ASN16276 (OVH, FR),
Reverse DNS: ns3172623.ip-51-210-3.eu
Software: nginx /
Resource Hash: 47c9d9a95e53a49a9559ca4cc53d05ff571a0d42b76bf21209d63547f4f51c91

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.pubgmena.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Tue, 03 May 2022 05:00:34 GMT
last-modified: Fri, 15 Apr 2022 09:38:41 GMT
server: nginx
access-control-allow-methods: GET, OPTIONS
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 215443
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 15.png
i.ibb.co/q0mjzXM/ 94 KB
94 KB 27ms
27ms Image
image/png 51.210.3.236
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.ibb.co/q0mjzXM/15.png
Requested by: Host: www.pubgmena.com
URL: https://www.pubgmena.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 51.210.3.236 , France, ASN16276 (OVH, FR),
Reverse DNS: ns3172623.ip-51-210-3.eu
Software: nginx /
Resource Hash: 192ad33d0227363fc49b1a4f4eb349c0c680859a69bea3a8de5698698d619ed3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.pubgmena.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Tue, 03 May 2022 05:00:34 GMT
last-modified: Sat, 05 Mar 2022 04:23:17 GMT
server: nginx
access-control-allow-methods: GET, OPTIONS
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 96115
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 cookienotice.js Show response
www.pubgmena.com/js/ 6 KB
2 KB 16ms
16ms Script
text/javascript 2a00:1450:4001:830::2013
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.pubgmena.com/js/cookienotice.js

Requested by

Host: www.pubgmena.com
URL: https://www.pubgmena.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2013 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

068ffe90977f2b5b2dc2ef18572166e85281bd0ecb31c4902464b23db54d2568

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.pubgmena.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Tue, 03 May 2022 05:00:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 03 May 2022 02:52:32 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"blogger-tech","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/blogger-tech"}]}
content-type: text/javascript
cache-control: public, max-age=604800
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 2026
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="blogger-tech"
expires: Tue, 10 May 2022 05:00:34 GMT

GET
H2 200 html.1126244.2267e.0.js Show response
dgu9g3a2kzqx2.cloudfront.net/public/external/v2/ 11 KB
12 KB 353ms
316ms Script
application/javascript 2600:9000:21f3:0:13:652b:c180:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://dgu9g3a2kzqx2.cloudfront.net/public/external/v2/html.1126244.2267e.0.js
Requested by: Host: d13nu0oomnx5ti.cloudfront.net
URL: https://d13nu0oomnx5ti.cloudfront.net/e25423c.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21f3:0:13:652b:c180:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Apache/2.4.51 () OpenSSL/1.0.2k-fips PHP/7.4.11 / PHP/7.4.11
Resource Hash: 0439f51c97db0211db69c3541ae70211fbb2978a8dc8b37027c8c39489b2f08e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.pubgmena.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Tue, 03 May 2022 05:00:34 GMT
via: 1.1 ac0e9b19969df989a920e6d1b834d008.cloudfront.net (CloudFront)
server: Apache/2.4.51 () OpenSSL/1.0.2k-fips PHP/7.4.11
x-amz-cf-pop: FRA2-C2
x-powered-by: PHP/7.4.11
x-cache: Miss from cloudfront
content-type: application/javascript
x-amz-cf-id: zz-GHIO-DoGfNXi9nrtY4WyxiQuHlzJpXkUsJ0_gm0tuOB530ziG2A==

GET
H2 200 css_front.css
dgu9g3a2kzqx2.cloudfront.net/public/external/ 6 KB
7 KB 194ms
158ms Stylesheet
text/css 2600:9000:21f3:0:13:652b:c180:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://dgu9g3a2kzqx2.cloudfront.net/public/external/css_front.css
Requested by: Host: d13nu0oomnx5ti.cloudfront.net
URL: https://d13nu0oomnx5ti.cloudfront.net/e25423c.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21f3:0:13:652b:c180:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Apache/2.4.51 () OpenSSL/1.0.2k-fips PHP/7.4.11 /
Resource Hash: a7bd79b6fba60944ee3a9c153108ff0819d2db57850116ac7065a86db08af4ec

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.pubgmena.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Tue, 03 May 2022 05:00:34 GMT
via: 1.1 ac0e9b19969df989a920e6d1b834d008.cloudfront.net (CloudFront)
last-modified: Tue, 23 Jun 2020 20:06:47 GMT
server: Apache/2.4.51 () OpenSSL/1.0.2k-fips PHP/7.4.11
x-amz-cf-pop: FRA2-C2
etag: "19c4-5a8c5e62e9d0a"
x-cache: Miss from cloudfront
content-type: text/css
accept-ranges: bytes
content-length: 6596
x-amz-cf-id: 7KQkbP7EIPdIbdTYE_khuQ2HkRZ1FOxPogizLFBd3to_qg2LXDPCiA==

GET
H2 200 pngtree-pure-white-minimalist-background-wallpaper-image_396581.jpg
png.pngtree.com/thumb_back/fh260/background/20200821/ 461 B
896 B 59ms
19ms Image
image/jpeg 2606:4700::6812:29d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://png.pngtree.com/thumb_back/fh260/background/20200821/pngtree-pure-white-minimalist-background-wallpaper-image_396581.jpg
Requested by: Host: www.pubgmena.com
URL: https://www.pubgmena.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:29d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9fa5ad13760f36ab58bc43320bfb286f45c3105c802a15d4f43539d1dead2c4a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.pubgmena.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Tue, 03 May 2022 05:00:34 GMT
cf-cache-status: HIT
age: 149713
cf-ray: 70566f0b1efa020d-ZRH
last-modified: Fri, 21 Aug 2020 11:02:32 GMT
content-length: 461
x-amz-id-2: TLcUtZT0890I02u73hQpEQknSwC1OUktDCd2ZWF8or7K4ZjW6SxzD+Ni4C6A1iG9zund1Q1t1kQ=
cf-bgj: h2pri
server: cloudflare
etag: "a559c89cc0a7354db930b927e888d642"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-request-id: N5J2PGN346QFZMZD
cache-control: public, max-age=16070400
accept-ranges: bytes
content-type: image/jpeg
expires: Sat, 05 Nov 2022 05:00:34 GMT

GET
H2 200 Iurf6YBj_oCad4k1l8KiHrFpiQ.woff2
fonts.gstatic.com/s/tajawal/v9/ 10 KB
10 KB 29ms
8ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/tajawal/v9/Iurf6YBj_oCad4k1l8KiHrFpiQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Tajawal:wght@500&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9986de5db80ec050300f1cea25d651a5779ae62b91a39b5667ac23d0c7668cbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.pubgmena.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Wed, 27 Apr 2022 20:21:34 GMT
x-content-type-options: nosniff
age: 463140
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9900
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 16:01:40 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 27 Apr 2023 20:21:34 GMT

GET
H2 200 2-c79JNi2YuVOUcOarRPgnNGooxCZ5-xcjLj9ytf.woff2
fonts.gstatic.com/s/changa/v18/ 9 KB
9 KB 26ms
9ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/changa/v18/2-c79JNi2YuVOUcOarRPgnNGooxCZ5-xcjLj9ytf.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Changa:wght@500&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

14f1c9bd1c6b2b84b4a095ac18435be79cb191733c6348d5ca39ad56dad5c4d5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.pubgmena.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Thu, 28 Apr 2022 23:59:26 GMT
x-content-type-options: nosniff
age: 363668
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8888
x-xss-protection: 0
last-modified: Thu, 21 Apr 2022 17:01:16 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 28 Apr 2023 23:59:26 GMT

GET
H2 200 2-c79JNi2YuVOUcOarRPgnNGooxCZ5-xcjfj9w.woff2
fonts.gstatic.com/s/changa/v18/ 9 KB
9 KB 27ms
12ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/changa/v18/2-c79JNi2YuVOUcOarRPgnNGooxCZ5-xcjfj9w.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Changa:wght@500&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cafe27cbaf043daae161059762d9e7d048fdf7c571ae56b2ba675226d46cd8e6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.pubgmena.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Fri, 29 Apr 2022 00:01:44 GMT
x-content-type-options: nosniff
age: 363530
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9300
x-xss-protection: 0
last-modified: Thu, 21 Apr 2022 17:01:16 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 29 Apr 2023 00:01:44 GMT

GET
H2 200 Iurf6YBj_oCad4k1l8KiHrRpiYlJ.woff2
fonts.gstatic.com/s/tajawal/v9/ 8 KB
8 KB 25ms
14ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/tajawal/v9/Iurf6YBj_oCad4k1l8KiHrRpiYlJ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Tajawal:wght@500&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ff5afc2fb4dbd2ecb286ee9b121154abaa9709ae3d710d730a57702725bc28e4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.pubgmena.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Wed, 27 Apr 2022 20:21:34 GMT
x-content-type-options: nosniff
age: 463140
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8524
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 16:00:33 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 27 Apr 2023 20:21:34 GMT

GET
H2 200 css.css
dgu9g3a2kzqx2.cloudfront.net/public/clockers/PrimeApps/ 1010 B
1 KB 308ms
308ms Stylesheet
text/css 2600:9000:21f3:0:13:652b:c180:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://dgu9g3a2kzqx2.cloudfront.net/public/clockers/PrimeApps/css.css
Requested by: Host: d13nu0oomnx5ti.cloudfront.net
URL: https://d13nu0oomnx5ti.cloudfront.net/e25423c.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21f3:0:13:652b:c180:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Apache/2.4.51 () OpenSSL/1.0.2k-fips PHP/7.4.11 /
Resource Hash: a7081a117335212b9e7f2e348f7369a64423d51db1666310b3451e7375f0b7de

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.pubgmena.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Tue, 03 May 2022 05:00:35 GMT
via: 1.1 ac0e9b19969df989a920e6d1b834d008.cloudfront.net (CloudFront)
last-modified: Fri, 10 Apr 2020 22:29:00 GMT
server: Apache/2.4.51 () OpenSSL/1.0.2k-fips PHP/7.4.11
x-amz-cf-pop: FRA2-C2
etag: "3f2-5a2f7428ae907"
x-cache: Miss from cloudfront
content-type: text/css
accept-ranges: bytes
content-length: 1010
x-amz-cf-id: dp2-X3jIkw6vQJC4oGAarNhMK2CydYFZYE_tdj2mvoR2rRnbh2SU9w==

GET
H2 200 guid Show response
dgu9g3a2kzqx2.cloudfront.net/public/ 0
285 B 304ms
304ms Script
text/html 2600:9000:21f3:0:13:652b:c180:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://dgu9g3a2kzqx2.cloudfront.net/public/guid?cpguid=2j6f5seql&e=ll&t=1651554035365
Requested by: Host: d13nu0oomnx5ti.cloudfront.net
URL: https://d13nu0oomnx5ti.cloudfront.net/e25423c.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21f3:0:13:652b:c180:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Apache/2.4.51 () OpenSSL/1.0.2k-fips PHP/7.4.11 / PHP/7.4.11
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.pubgmena.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Tue, 03 May 2022 05:00:35 GMT
via: 1.1 ac0e9b19969df989a920e6d1b834d008.cloudfront.net (CloudFront)
server: Apache/2.4.51 () OpenSSL/1.0.2k-fips PHP/7.4.11
x-amz-cf-pop: FRA2-C2
x-powered-by: PHP/7.4.11
x-cache: Miss from cloudfront
content-type: text/html; charset=UTF-8
content-length: 0
x-amz-cf-id: m-CzlEyNVzVqKQAT5UzbHmzUCwQmsohCuu2w77hruJ2s7rdEr18afQ==

GET
H2 200 check.php Show response
dgu9g3a2kzqx2.cloudfront.net/public/external/ 78 B
371 B 311ms
311ms Script
application/javascript 2600:9000:21f3:0:13:652b:c180:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://dgu9g3a2kzqx2.cloudfront.net/public/external/check.php?it=1126244&time=1651554036880
Requested by: Host: d13nu0oomnx5ti.cloudfront.net
URL: https://d13nu0oomnx5ti.cloudfront.net/e25423c.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21f3:0:13:652b:c180:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Apache/2.4.41 () OpenSSL/1.0.2k-fips PHP/7.4.11 / PHP/7.4.11
Resource Hash: 9ef4a63fc5e0a14a7301d693d65d6acfc44cdf14853c4a20890198f2d5e52e3b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.pubgmena.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Tue, 03 May 2022 05:00:37 GMT
via: 1.1 ac0e9b19969df989a920e6d1b834d008.cloudfront.net (CloudFront)
server: Apache/2.4.41 () OpenSSL/1.0.2k-fips PHP/7.4.11
x-amz-cf-pop: FRA2-C2
x-powered-by: PHP/7.4.11
x-cache: Miss from cloudfront
content-type: application/javascript
content-length: 78
x-amz-cf-id: BW3x6-bdmnSHcr0YXD3ToaXJQKE4xlfQe8L6F71eWcOQC2B6Lo0hDw==

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Scam (Online)

32 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.pubgmena.com/	1970-01-20 03:00:18	Name: _cpguid Value: 2j6f5seql

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

d13nu0oomnx5ti.cloudfront.net
dgu9g3a2kzqx2.cloudfront.net
fonts.googleapis.com
fonts.gstatic.com
i.ibb.co
png.pngtree.com
pubgmena.com
www.pubgmena.com
162.255.119.133
2600:9000:20eb:6000:3:b5aa:ad80:21
2600:9000:21f3:0:13:652b:c180:21
2606:4700::6812:29d
2a00:1450:4001:82a::200a
2a00:1450:4001:830::2003
2a00:1450:4001:830::2013
51.210.3.236
0439f51c97db0211db69c3541ae70211fbb2978a8dc8b37027c8c39489b2f08e
068ffe90977f2b5b2dc2ef18572166e85281bd0ecb31c4902464b23db54d2568
14f1c9bd1c6b2b84b4a095ac18435be79cb191733c6348d5ca39ad56dad5c4d5
192ad33d0227363fc49b1a4f4eb349c0c680859a69bea3a8de5698698d619ed3
2ff1d299873307777096898c2c11ed07fd9171471af2797e85ecc5f7d6188400
47c9d9a95e53a49a9559ca4cc53d05ff571a0d42b76bf21209d63547f4f51c91
6e9ace4008267f5573a4a12af78df63bc62401f51fa2b5a3805c7ea708660bd1
9986de5db80ec050300f1cea25d651a5779ae62b91a39b5667ac23d0c7668cbb
9ef4a63fc5e0a14a7301d693d65d6acfc44cdf14853c4a20890198f2d5e52e3b
9fa5ad13760f36ab58bc43320bfb286f45c3105c802a15d4f43539d1dead2c4a
a7081a117335212b9e7f2e348f7369a64423d51db1666310b3451e7375f0b7de
a7bd79b6fba60944ee3a9c153108ff0819d2db57850116ac7065a86db08af4ec
c8e4ef68af331b484059d3ad0325bf402274a69d8e219b446b43f412defec050
cafe27cbaf043daae161059762d9e7d048fdf7c571ae56b2ba675226d46cd8e6
d71b75f37cbaa198fcac72013ceb2a2fe5b68c89902dbcf4b52ae28812cb9268
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ff5afc2fb4dbd2ecb286ee9b121154abaa9709ae3d710d730a57702725bc28e4

www.pubgmena.com Open in urlscan Pro 2a00:1450:4001:830::2013 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

17 Requests

100 %HTTPS

75 %IPv6

6 Domains

8 Subdomains

7 IPs

3 Countries

394 kBTransfer

406 kBSize

1 Cookies

1 Outgoing links

Page URL History

Redirected requests

17 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

32 JavaScript Global Variables

1 Cookies

Security Headers

Indicators

www.pubgmena.com Open in urlscan Pro
2a00:1450:4001:830::2013 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

17
Requests

100 %
HTTPS

75 %
IPv6

6
Domains

8
Subdomains

7
IPs

3
Countries

394 kB
Transfer

406 kB
Size

1
Cookies

17 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!