urlscan.io logo urlscan.io
SecurityTrails logo

cloud.galaxy-pays.com Open in urlscan Pro
104.18.31.38  Public Scan

Go To Rescan Add Verdict Report
URL: https://cloud.galaxy-pays.com/api/payment_direct/redirect/R20230530051635855
Submission Tags: https://phish.report @phish_report Search All
Submission: On May 30 via api from FI — Scanned from FI
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 10 IPs in 3 countries across 9 domains to perform 18 HTTP transactions. The main IP is 104.18.31.38, located in and belongs to CLOUDFLARENET, US. The main domain is cloud.galaxy-pays.com.
TLS certificate: Issued by GTS CA 1P5 on May 26th 2023. Valid for: 3 months.
This is the only time cloud.galaxy-pays.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

7    104.18.31.38 (None, )

ASN13335 (CLOUDFLARENET, US)
cloud.galaxy-pays.com
1    2a00:1450:4001:806::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
1    2a00:1450:4001:803::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
2    104.102.55.141 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-102-55-141.deploy.static.akamaitechnologies.com
payments.gcash.com
2    2a00:1450:4001:80b::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
2    2a00:1450:4001:828::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google-analytics.com
1    2a00:1450:400c:c08::9c (Brussels, Belgium)

ASN15169 (GOOGLE, US)
stats.g.doubleclick.net
1    2a00:1450:4001:82b::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.com
1    2a00:1450:4001:829::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.no
Apex Domain
Subdomains		 Transfer
7 galaxy-pays.com
cloud.galaxy-pays.com
72 KB
2 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 30
21 KB
2 gstatic.com
fonts.gstatic.com
32 KB
2 gcash.com
payments.gcash.com — Cisco Umbrella Rank: 132310
55 KB
1 google.no
www.google.no — Cisco Umbrella Rank: 30314
408 B
1 google.com
www.google.com — Cisco Umbrella Rank: 2
408 B
1 doubleclick.net
stats.g.doubleclick.net — Cisco Umbrella Rank: 76
353 B
1 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 35
993 B
1 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 40
64 KB
18 9
Domain Requested by
7 cloud.galaxy-pays.com cloud.galaxy-pays.com
2 www.google-analytics.com www.googletagmanager.com
www.google-analytics.com
2 fonts.gstatic.com fonts.googleapis.com
2 payments.gcash.com cloud.galaxy-pays.com
1 www.google.no
1 www.google.com
1 stats.g.doubleclick.net www.google-analytics.com
1 fonts.googleapis.com cloud.galaxy-pays.com
1 www.googletagmanager.com cloud.galaxy-pays.com
18 9

This site contains links to these domains. Also see Links.

Domain
www.pesopeso.ph
Subject Issuer Validity Valid
galaxy-pays.com
GTS CA 1P5		 2023-05-26 -
2023-08-24		 3 months crt.sh
*.google-analytics.com
GTS CA 1C3		 2023-05-08 -
2023-07-31		 3 months crt.sh
upload.video.google.com
GTS CA 1C3		 2023-05-08 -
2023-07-31		 3 months crt.sh
access.mynt.xyz
DigiCert SHA2 Extended Validation Server CA		 2022-11-02 -
2023-10-28		 a year crt.sh
*.gstatic.com
GTS CA 1C3		 2023-05-08 -
2023-07-31		 3 months crt.sh
*.g.doubleclick.net
GTS CA 1C3		 2023-05-19 -
2023-08-11		 3 months crt.sh
www.google.com
GTS CA 1C3		 2023-05-08 -
2023-07-31		 3 months crt.sh
*.google.no
GTS CA 1C3		 2023-05-08 -
2023-07-31		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://cloud.galaxy-pays.com/api/payment_direct/redirect/R20230530051635855
Frame ID: 75533E23654E347223FE951B8252433B
Requests: 21 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Gcash

Detected technologies

Overall confidence: 100%
Detected patterns
  • <[^>]+\sdata-v(?:ue)?-
Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtm\.js
Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

18
Requests

100 %
HTTPS

78 %
IPv6

9
Domains

9
Subdomains

10
IPs

3
Countries

246 kB
Transfer

569 kB
Size

3
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

18 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request R20230530051635855
cloud.galaxy-pays.com/api/payment_direct/redirect/ 		76 KB
17 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://cloud.galaxy-pays.com/api/payment_direct/redirect/R20230530051635855
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.31.38 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
97e28b8cbf0710e37b089ebc81e061e12d813436f25a827599deed439515d980

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language
fi-FI,fi;q=0.9

Response headers

cache-control
no-cache, private
cf-cache-status
DYNAMIC
cf-ray
7cf482271db2df68-HEL
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Tue, 30 May 2023 05:17:02 GMT
server
cloudflare
gtm.js
www.googletagmanager.com/ 		171 KB
64 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-NW4MWX5
Requested by
Host: cloud.galaxy-pays.com
URL: https://cloud.galaxy-pays.com/api/payment_direct/redirect/R20230530051635855
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
0f999f25c20124b0bd008f281c36d3aa0f421e0f4fc2da749f84de589764ea77
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://cloud.galaxy-pays.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date
Tue, 30 May 2023 05:17:02 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
65480
x-xss-protection
0
last-modified
Tue, 30 May 2023 03:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Tue, 30 May 2023 05:17:02 GMT
css
fonts.googleapis.com/ 		4 KB
993 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Karla|Karla:600|Poppins|Poppins:600
Requested by
Host: cloud.galaxy-pays.com
URL: https://cloud.galaxy-pays.com/api/payment_direct/redirect/R20230530051635855
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:803::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
5d03647b4b2b21f69d5d6b67bd300737c1d7bedc8259789f971ad7095640b67c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://cloud.galaxy-pays.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Tue, 30 May 2023 05:17:02 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Tue, 30 May 2023 05:17:02 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Tue, 30 May 2023 05:17:02 GMT
gcash.css
cloud.galaxy-pays.com/css/ 		52 KB
15 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cloud.galaxy-pays.com/css/gcash.css?ver=7
Requested by
Host: cloud.galaxy-pays.com
URL: https://cloud.galaxy-pays.com/api/payment_direct/redirect/R20230530051635855
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.31.38 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b65ea5fac30c49033ad6f8d152a05a2689f945f9fa742744f8d1e3bfa9d9df90

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://cloud.galaxy-pays.com/api/payment_direct/redirect/R20230530051635855
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date
Tue, 30 May 2023 05:17:02 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Tue, 30 May 2023 04:12:36 GMT
server
cloudflare
age
1170
etag
W/"647577b4-d12b"
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=14400
cf-ray
7cf48229ecd8df68-HEL
expires
Tue, 30 May 2023 09:17:02 GMT
gcash_logo.f988652.png
payments.gcash.com/gcash-cashier-web/1.2.1/img/ 		14 KB
15 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://payments.gcash.com/gcash-cashier-web/1.2.1/img/gcash_logo.f988652.png
Requested by
Host: cloud.galaxy-pays.com
URL: https://cloud.galaxy-pays.com/api/payment_direct/redirect/R20230530051635855
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.102.55.141 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-102-55-141.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
9900a243ca83c6a2e761f402775cbb13b6c0706343fefbb7662c519a8d156fb7

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://cloud.galaxy-pays.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date
Tue, 30 May 2023 05:17:02 GMT
content-encoding
gzip
last-modified
Mon, 22 May 2023 14:57:16 GMT
server
AmazonS3
x-amz-request-id
YTZK8F49QF2SS0K1
etag
"f98865265dc9d85aef9de815a942bf21"
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
content-type
image/png
accept-ranges
bytes
content-length
14574
x-amz-id-2
/Nkh0sWug6+dcHy7zHL7pHANggQZTS5xLZ+X6mGAtp8SBiVSaAG3J66LrS0IrZd9D92RyjbKQv4=
GCat_failed.24e3be3.png
payments.gcash.com/gcash-cashier-web/1.2.1/img/ 		40 KB
40 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://payments.gcash.com/gcash-cashier-web/1.2.1/img/GCat_failed.24e3be3.png
Requested by
Host: cloud.galaxy-pays.com
URL: https://cloud.galaxy-pays.com/api/payment_direct/redirect/R20230530051635855
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.102.55.141 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-102-55-141.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
6a5fdc63e774b9b4dfdc3f03b3dc88ec7c3228c5ac7ca3b9802d9596521513d1

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://cloud.galaxy-pays.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date
Tue, 30 May 2023 05:17:02 GMT
content-encoding
gzip
last-modified
Mon, 29 May 2023 14:39:13 GMT
server
AmazonS3
x-amz-request-id
8PTKEK121E1YJTCM
etag
"24e3be3ce9f2942d8c50eaa4f6ee82e2"
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
content-type
image/png
accept-ranges
bytes
content-length
41007
x-amz-id-2
npcAeThQO0rnJebjJsLF02snItG1baVSPmzlCs5QugnycMRHpylmoDa3d6Wm8jrSOzG7u4LvOZE=
jquery.min.js
cloud.galaxy-pays.com/js/ 		91 KB
32 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cloud.galaxy-pays.com/js/jquery.min.js
Requested by
Host: cloud.galaxy-pays.com
URL: https://cloud.galaxy-pays.com/api/payment_direct/redirect/R20230530051635855
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.31.38 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7fa0d5c3f538c76f878e012ac390597faecaabfe6fb9d459b919258e76c5df8e

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://cloud.galaxy-pays.com/api/payment_direct/redirect/R20230530051635855
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date
Tue, 30 May 2023 05:17:02 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Tue, 30 May 2023 04:12:36 GMT
server
cloudflare
age
1170
etag
W/"647577b4-16b8c"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=14400
cf-ray
7cf4822b783fdf68-HEL
expires
Tue, 30 May 2023 09:17:02 GMT
jquery.jcryption.js
cloud.galaxy-pays.com/js/ 		17 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cloud.galaxy-pays.com/js/jquery.jcryption.js
Requested by
Host: cloud.galaxy-pays.com
URL: https://cloud.galaxy-pays.com/api/payment_direct/redirect/R20230530051635855
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.31.38 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6c0faa26c39e0323327ae0a57377dbb93457a01d7f14cb83d882a46001a107fd

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://cloud.galaxy-pays.com/api/payment_direct/redirect/R20230530051635855
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date
Tue, 30 May 2023 05:17:02 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Tue, 30 May 2023 04:12:36 GMT
server
cloudflare
age
1170
etag
W/"647577b4-4428"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=14400
cf-ray
7cf4822b8855df68-HEL
expires
Tue, 30 May 2023 09:17:02 GMT
custom2.js
cloud.galaxy-pays.com/js/ 		6 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cloud.galaxy-pays.com/js/custom2.js
Requested by
Host: cloud.galaxy-pays.com
URL: https://cloud.galaxy-pays.com/api/payment_direct/redirect/R20230530051635855
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.31.38 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
31559bc1b4914bd5c5d7967fcc70eb04ac0f541523ceae85b612164d13d400a0

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://cloud.galaxy-pays.com/api/payment_direct/redirect/R20230530051635855
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date
Tue, 30 May 2023 05:17:02 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Tue, 30 May 2023 04:12:36 GMT
server
cloudflare
age
1170
etag
W/"647577b4-1946"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=14400
cf-ray
7cf4822b8859df68-HEL
expires
Tue, 30 May 2023 09:17:02 GMT
Portalencryption2.js
cloud.galaxy-pays.com/js/ 		9 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cloud.galaxy-pays.com/js/Portalencryption2.js
Requested by
Host: cloud.galaxy-pays.com
URL: https://cloud.galaxy-pays.com/api/payment_direct/redirect/R20230530051635855
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.31.38 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0ac2416cfac9979ef47680e9c57d6f991f1b9a63f0fad19285bc80c77355ccbd

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://cloud.galaxy-pays.com/api/payment_direct/redirect/R20230530051635855
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date
Tue, 30 May 2023 05:17:02 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Tue, 30 May 2023 04:12:36 GMT
server
cloudflare
age
1170
etag
W/"647577b4-222a"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=14400
cf-ray
7cf4822b885bdf68-HEL
expires
Tue, 30 May 2023 09:17:02 GMT
truncated
/ 		1 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
2f2f8cdd9ec58327937597aac2de4e8b213d3f358e4fa57ca5ce544f4f26161a

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		3 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
5e2da14919a1f2311b146c9e4dfc27399b924f0df5b6c5497c948e5fd367406c

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		3 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
51f549b1ed0bf89c7c6fd70f14d87244abad81704808051b1f04bba7702fd531

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Content-Type
image/png
qkB9XvYC6trAT55ZBi1ueQVIjQTD-JrIH2G7nytkHRyQ8p4wUje6bg.woff2
fonts.gstatic.com/s/karla/v30/ 		24 KB
24 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/karla/v30/qkB9XvYC6trAT55ZBi1ueQVIjQTD-JrIH2G7nytkHRyQ8p4wUje6bg.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Karla|Karla:600|Poppins|Poppins:600
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ea534e6a2346477e2d7d449df346a86465908c4469c4447a1db41b64627348c2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://cloud.galaxy-pays.com
accept-language
fi-FI,fi;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date
Wed, 24 May 2023 05:59:54 GMT
x-content-type-options
nosniff
age
515828
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
24276
x-xss-protection
0
last-modified
Mon, 08 May 2023 22:55:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 23 May 2024 05:59:54 GMT
pxiByp8kv8JHgFVrLEj6Z1xlFQ.woff2
fonts.gstatic.com/s/poppins/v20/ 		8 KB
8 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/poppins/v20/pxiByp8kv8JHgFVrLEj6Z1xlFQ.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Karla|Karla:600|Poppins|Poppins:600
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f4e80d9dfd374d02989b87a27b5ed4cb78fbb177c27f1478e9a8b0afb7513149
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://cloud.galaxy-pays.com
accept-language
fi-FI,fi;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date
Sat, 27 May 2023 17:29:29 GMT
x-content-type-options
nosniff
age
215253
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
8000
x-xss-protection
0
last-modified
Wed, 27 Apr 2022 16:59:07 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 26 May 2024 17:29:29 GMT
getGcashStatus
cloud.galaxy-pays.com/api/payment_direct/ 		52 B
136 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://cloud.galaxy-pays.com/api/payment_direct/getGcashStatus
Requested by
Host: cloud.galaxy-pays.com
URL: https://cloud.galaxy-pays.com/js/jquery.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.31.38 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9115036c4b9ec0126a6653f66b509c3abdd8bc9567863b968d39672be20b3716

Request headers

Accept
*/*
Referer
https://cloud.galaxy-pays.com/api/payment_direct/redirect/R20230530051635855
X-Requested-With
XMLHttpRequest
accept-language
fi-FI,fi;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

date
Tue, 30 May 2023 05:17:02 GMT
cache-control
no-cache, private
content-encoding
gzip
cf-cache-status
DYNAMIC
server
cloudflare
cf-ray
7cf4822c0a24df68-HEL
content-type
application/json
analytics.js
www.google-analytics.com/ 		51 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NW4MWX5
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e7b90d32907f89c49e9e2a2ccca95133277f756f13a14187936d9b948ff67b44
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://cloud.galaxy-pays.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Tue, 30 May 2023 05:04:54 GMT
last-modified
Mon, 17 Apr 2023 22:36:01 GMT
server
Golfe2
age
728
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20737
expires
Tue, 30 May 2023 07:04:54 GMT
collect
www.google-analytics.com/j/ 		4 B
213 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j100&a=1767718239&t=pageview&_s=1&dl=https%3A%2F%2Fcloud.galaxy-pays.com%2Fapi%2Fpayment_direct%2Fredirect%2FR20230530051635855&dp=%2Fapi%2Fpayment_direct%2Fredirect%2FR20230530051635855&ul=en-us&de=UTF-8&dt=Gcash&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAEABAAAAACAAI~&jid=702000307&gjid=1361115939&cid=1460207160.1685423823&tid=UA-84395910-9&_gid=296595828.1685423823&_r=1&_slc=1&gtm=45He35o0n81NW4MWX5&z=218899130
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://cloud.galaxy-pays.com/
accept-language
fi-FI,fi;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 30 May 2023 05:17:03 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://cloud.galaxy-pays.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
stats.g.doubleclick.net/j/ 		4 B
353 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j100&tid=UA-84395910-9&cid=1460207160.1685423823&jid=702000307&gjid=1361115939&_gid=296595828.1685423823&_u=YEBAAEAAAAAAACAAI~&z=1404340054
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c08::9c Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
570c4d4674fd20602189c548c145ba1f8ac34bc2e4599a71471969028aa1e25a
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://cloud.galaxy-pays.com/
accept-language
fi-FI,fi;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
date
Tue, 30 May 2023 05:17:03 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://cloud.galaxy-pays.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.com/ads/ 		42 B
408 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j100&tid=UA-84395910-9&cid=1460207160.1685423823&jid=702000307&_u=YEBAAEAAAAAAACAAI~&z=380674344
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://cloud.galaxy-pays.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 May 2023 05:17:03 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.no/ads/ 		42 B
408 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.no/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j100&tid=UA-84395910-9&cid=1460207160.1685423823&jid=702000307&_u=YEBAAEAAAAAAACAAI~&z=380674344
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://cloud.galaxy-pays.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 30 May 2023 05:17:03 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

89 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| BigInt boolean| credentialless object| dataLayer function| $ function| jQuery number| biRadixBase number| biRadixBits number| bitsPerDigit number| biRadix number| biHalfRadix number| biRadixSquared number| maxDigitVal number| maxInteger undefined| maxDigits undefined| ZERO_ARRAY undefined| bigZero undefined| bigOne number| dpl10 object| highBitMasks object| hexatrigesimalToChar object| hexToChar object| lowBitMasks function| setMaxDigits function| biFromDecimal function| biCopy function| biFromNumber function| reverseStr function| biToString function| biToDecimal function| digitToHex function| biToHex function| charToHex function| hexToDigit function| biFromHex function| biFromString function| biDump function| biAdd function| biSubtract function| biHighIndex function| biNumBits function| biMultiply function| biMultiplyDigit function| arrayCopy function| biShiftLeft function| biShiftRight function| biMultiplyByRadixPower function| biDivideByRadixPower function| biModuloByRadixPower function| biCompare function| biDivideModulo function| biDivide function| biModulo function| biMultiplyMod function| biPow function| biPowMod function| BarrettMu function| BarrettMu_modulo function| BarrettMu_multiplyMod function| BarrettMu_powMod function| showHide function| loginTab function| cust_slider function| loadScript function| encryptRetLogin function| encryptDebitCardLogin function| encryptNetsecureRegSMS function| encryptNetsecureNRIRegSMS function| encryptNetsecureRegWEB function| encryptNetsecureRegHW function| encryptNetsecureRegMobi function| encryptNetsecureRegNRIWebMobi function| encryptPasswordExpiry function| encryptForcePasswordChange function| getPublicKeyFromServer undefined| timer boolean| showotp boolean| skip_otp boolean| daifuTrue boolean| linlTrue boolean| StatusTrue number| checkTimer function| checkOrderStatus object| google_tag_manager object| google_tag_data string| GoogleAnalyticsObject function| ga object| gaplugins object| gaGlobal object| gaData

3 Cookies

Domain/Path Name / Value
.galaxy-pays.com/ Name: _ga
Value: GA1.2.1460207160.1685423823
.galaxy-pays.com/ Name: _gid
Value: GA1.2.296595828.1685423823
.galaxy-pays.com/ Name: _gat_UA-84395910-9
Value: 1

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cloud.galaxy-pays.com
fonts.googleapis.com
fonts.gstatic.com
payments.gcash.com
stats.g.doubleclick.net
www.google-analytics.com
www.google.com
www.google.no
www.googletagmanager.com
104.102.55.141
104.18.31.38
2a00:1450:4001:803::200a
2a00:1450:4001:806::2008
2a00:1450:4001:80b::2003
2a00:1450:4001:828::200e
2a00:1450:4001:829::2003
2a00:1450:4001:82b::2004
2a00:1450:400c:c08::9c
0ac2416cfac9979ef47680e9c57d6f991f1b9a63f0fad19285bc80c77355ccbd
0f999f25c20124b0bd008f281c36d3aa0f421e0f4fc2da749f84de589764ea77
2f2f8cdd9ec58327937597aac2de4e8b213d3f358e4fa57ca5ce544f4f26161a
31559bc1b4914bd5c5d7967fcc70eb04ac0f541523ceae85b612164d13d400a0
51f549b1ed0bf89c7c6fd70f14d87244abad81704808051b1f04bba7702fd531
570c4d4674fd20602189c548c145ba1f8ac34bc2e4599a71471969028aa1e25a
5d03647b4b2b21f69d5d6b67bd300737c1d7bedc8259789f971ad7095640b67c
5e2da14919a1f2311b146c9e4dfc27399b924f0df5b6c5497c948e5fd367406c
6a5fdc63e774b9b4dfdc3f03b3dc88ec7c3228c5ac7ca3b9802d9596521513d1
6c0faa26c39e0323327ae0a57377dbb93457a01d7f14cb83d882a46001a107fd
7fa0d5c3f538c76f878e012ac390597faecaabfe6fb9d459b919258e76c5df8e
9115036c4b9ec0126a6653f66b509c3abdd8bc9567863b968d39672be20b3716
97e28b8cbf0710e37b089ebc81e061e12d813436f25a827599deed439515d980
9900a243ca83c6a2e761f402775cbb13b6c0706343fefbb7662c519a8d156fb7
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
b65ea5fac30c49033ad6f8d152a05a2689f945f9fa742744f8d1e3bfa9d9df90
e7b90d32907f89c49e9e2a2ccca95133277f756f13a14187936d9b948ff67b44
ea534e6a2346477e2d7d449df346a86465908c4469c4447a1db41b64627348c2
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f4e80d9dfd374d02989b87a27b5ed4cb78fbb177c27f1478e9a8b0afb7513149