1yurakqghu4dgdyazjlosg-on.drv.tw Open in urlscan Pro
47.89.250.243  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

19 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request Ucfre21.html Show response 1yurakqghu4dgdyazjlosg-on.drv.tw/Pubg/	6 KB 2 KB	2839ms 2432ms	Document text/html	47.89.250.243 CNNIC-ALIBABA-US-...
General Check archive.org Show headers Download Go to Full URL https://1yurakqghu4dgdyazjlosg-on.drv.tw/Pubg/Ucfre21.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 47.89.250.243 , United States, ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba US Technology Co., Ltd., CN), Reverse DNS Software nginx/1.14.0 (Ubuntu) / Resource Hash 977356a6e9a974c6545fdaa4ed7adeccdafd38f98acc80d437a7a1f38888cb8d Request headers :method GET :authority 1yurakqghu4dgdyazjlosg-on.drv.tw :scheme https :path /Pubg/Ucfre21.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 accept-language de-DE,de;q=0.9 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers server nginx/1.14.0 (Ubuntu) date Thu, 23 Sep 2021 15:05:16 GMT content-type text/html last-modified Tue, 07 Sep 2021 13:20:41 GMT cache-control public, max-age=604800 vary Accept-Encoding content-encoding gzip x-cache BYPASS set-cookie uid=rBEO6WFMl6xBTQKquKa4Ag==; domain=.drv.tw; path=/
GET H2	200	b4abe97.js Show response d13nu0oomnx5ti.cloudfront.net/	23 KB 23 KB	224ms 190ms	Script application/javascript	13.224.194.163 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://d13nu0oomnx5ti.cloudfront.net/b4abe97.js Requested by Host: 1yurakqghu4dgdyazjlosg-on.drv.tw URL: https://1yurakqghu4dgdyazjlosg-on.drv.tw/Pubg/Ucfre21.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.224.194.163 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-224-194-163.fra2.r.cloudfront.net Software AmazonS3 / Resource Hash d71b75f37cbaa198fcac72013ceb2a2fe5b68c89902dbcf4b52ae28812cb9268 Request headers Accept-Language de-DE,de;q=0.9 Referer https://1yurakqghu4dgdyazjlosg-on.drv.tw/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Wed, 22 Sep 2021 20:18:28 GMT via 1.1 430fc75cac3bdd04869a39405c45fba2.cloudfront.net (CloudFront) last-modified Mon, 03 May 2021 01:43:32 GMT server AmazonS3 age 86563 etag "6863f6e390060c097da580136d1dcaf2" x-cache Error from cloudfront content-type application/javascript x-amz-cf-pop FRA2-C1 content-length 23438 x-amz-cf-id SdDJDGWevmevSbFz5AyLevG1g8eIZBAkDYyewwCtwh1JDw5tCXy0Ng==
GET H2	200	main.css 1yurakqghu4dgdyazjlosg-on.drv.tw/Pubg/css/	5 KB 2 KB	2561ms 2561ms	Stylesheet text/css	47.89.250.243 CNNIC-ALIBABA-US-...
General Check archive.org Show headers Download Go to Full URL https://1yurakqghu4dgdyazjlosg-on.drv.tw/Pubg/css/main.css Requested by Host: 1yurakqghu4dgdyazjlosg-on.drv.tw URL: https://1yurakqghu4dgdyazjlosg-on.drv.tw/Pubg/Ucfre21.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 47.89.250.243 , United States, ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba US Technology Co., Ltd., CN), Reverse DNS Software nginx/1.14.0 (Ubuntu) / Resource Hash 23a7c9a1990e73ea473e533c1ad2136d4b37711c87b2812f413527bc9f08ed16 Request headers :path /Pubg/css/main.css pragma no-cache cookie uid=rBEO6WFMl6xBTQKquKa4Ag== accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept text/css,*/*;q=0.1 cache-control no-cache sec-fetch-dest style :authority 1yurakqghu4dgdyazjlosg-on.drv.tw referer https://1yurakqghu4dgdyazjlosg-on.drv.tw/Pubg/Ucfre21.html :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://1yurakqghu4dgdyazjlosg-on.drv.tw/Pubg/Ucfre21.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Thu, 23 Sep 2021 15:05:19 GMT content-encoding gzip last-modified Mon, 01 Feb 2021 03:33:26 GMT server nginx/1.14.0 (Ubuntu) vary Accept-Encoding x-cache BYPASS content-type text/css cache-control public, max-age=604800
GET H2	200	file_2021-02-17_043708.jpeg upload-files.cc/uploads/	14 KB 13 KB	165ms 60ms	Image image/jpeg	46.30.215.8 ONECOM
General Check archive.org Show headers Download Go to Show image Full URL https://upload-files.cc/uploads/file_2021-02-17_043708.jpeg Requested by Host: 1yurakqghu4dgdyazjlosg-on.drv.tw URL: https://1yurakqghu4dgdyazjlosg-on.drv.tw/Pubg/Ucfre21.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 46.30.215.8 , Denmark, ASN51468 (ONECOM, DK), Reverse DNS webcluster1.webpod5-cph3.one.com Software Apache / Resource Hash a0ad815d715278feecc668e4c71f17efa8f86455d007b46ed2f56fc268468ff3 Request headers Accept-Language de-DE,de;q=0.9 Referer https://1yurakqghu4dgdyazjlosg-on.drv.tw/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Thu, 23 Sep 2021 14:28:28 GMT content-encoding gzip last-modified Wed, 17 Feb 2021 07:37:08 GMT server Apache age 2208 etag "37fb-5bb8349553782-gzip" vary Accept-Encoding content-type image/jpeg via 1.1 varnish (Varnish/7.0) x-varnish 399868956 333975756 accept-ranges bytes content-length 13081
GET H2	200	progress_1.png 1yurakqghu4dgdyazjlosg-on.drv.tw/Pubg/img/	56 KB 56 KB	2234ms 2233ms	Image image/png	47.89.250.243 CNNIC-ALIBABA-US-...
General Check archive.org Show headers Download Go to Show image Full URL https://1yurakqghu4dgdyazjlosg-on.drv.tw/Pubg/img/progress_1.png Requested by Host: 1yurakqghu4dgdyazjlosg-on.drv.tw URL: https://1yurakqghu4dgdyazjlosg-on.drv.tw/Pubg/Ucfre21.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 47.89.250.243 , United States, ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba US Technology Co., Ltd., CN), Reverse DNS Software nginx/1.14.0 (Ubuntu) / Resource Hash 6757052cb3dadd3da19557326e3b7d469d8b551f873dbdeacc13b821c798c364 Request headers :path /Pubg/img/progress_1.png pragma no-cache cookie uid=rBEO6WFMl6xBTQKquKa4Ag==; _cpguid=f40hvv0zk accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority 1yurakqghu4dgdyazjlosg-on.drv.tw referer https://1yurakqghu4dgdyazjlosg-on.drv.tw/Pubg/Ucfre21.html :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://1yurakqghu4dgdyazjlosg-on.drv.tw/Pubg/Ucfre21.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Thu, 23 Sep 2021 15:05:19 GMT last-modified Mon, 01 Feb 2021 03:33:29 GMT server nginx/1.14.0 (Ubuntu) etag 0B5Fi2ZclgsNBakhtdURKckZaMGNvRmY4cWNuSEp4YWI0SllzPQ vary Accept-Encoding x-cache BYPASS content-type image/png cache-control public, max-age=604800 accept-ranges bytes content-length 56928
GET H2	200	verify.gif 1yurakqghu4dgdyazjlosg-on.drv.tw/Pubg/img/	16 KB 16 KB	2082ms 2081ms	Image image/gif	47.89.250.243 CNNIC-ALIBABA-US-...
General Check archive.org Show headers Download Go to Show image Full URL https://1yurakqghu4dgdyazjlosg-on.drv.tw/Pubg/img/verify.gif Requested by Host: 1yurakqghu4dgdyazjlosg-on.drv.tw URL: https://1yurakqghu4dgdyazjlosg-on.drv.tw/Pubg/Ucfre21.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 47.89.250.243 , United States, ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba US Technology Co., Ltd., CN), Reverse DNS Software nginx/1.14.0 (Ubuntu) / Resource Hash 78628d72ccb37293f8a988242e37a3c590cfe0c3a085286ad55f5c567367d9b4 Request headers :path /Pubg/img/verify.gif pragma no-cache cookie uid=rBEO6WFMl6xBTQKquKa4Ag==; _cpguid=f40hvv0zk accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority 1yurakqghu4dgdyazjlosg-on.drv.tw referer https://1yurakqghu4dgdyazjlosg-on.drv.tw/Pubg/Ucfre21.html :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://1yurakqghu4dgdyazjlosg-on.drv.tw/Pubg/Ucfre21.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Thu, 23 Sep 2021 15:05:18 GMT last-modified Mon, 01 Feb 2021 03:33:32 GMT server nginx/1.14.0 (Ubuntu) etag 0B5Fi2ZclgsNBbXFBbE1pWDdLUHUzdytaeWtOVCtzSTV2djI4PQ vary Accept-Encoding x-cache BYPASS content-type image/gif cache-control public, max-age=604800 accept-ranges bytes content-length 15899
GET H2	200	done.png 1yurakqghu4dgdyazjlosg-on.drv.tw/Pubg/img/	4 KB 4 KB	2083ms 2082ms	Image image/png	47.89.250.243 CNNIC-ALIBABA-US-...
General Check archive.org Show headers Download Go to Show image Full URL https://1yurakqghu4dgdyazjlosg-on.drv.tw/Pubg/img/done.png Requested by Host: 1yurakqghu4dgdyazjlosg-on.drv.tw URL: https://1yurakqghu4dgdyazjlosg-on.drv.tw/Pubg/Ucfre21.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 47.89.250.243 , United States, ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba US Technology Co., Ltd., CN), Reverse DNS Software nginx/1.14.0 (Ubuntu) / Resource Hash 318641a875e84108f5d8b55d52e2a0dbb08e7bb44a09a73658c9726960ced756 Request headers :path /Pubg/img/done.png pragma no-cache cookie uid=rBEO6WFMl6xBTQKquKa4Ag==; _cpguid=f40hvv0zk accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority 1yurakqghu4dgdyazjlosg-on.drv.tw referer https://1yurakqghu4dgdyazjlosg-on.drv.tw/Pubg/Ucfre21.html :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://1yurakqghu4dgdyazjlosg-on.drv.tw/Pubg/Ucfre21.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Thu, 23 Sep 2021 15:05:19 GMT last-modified Mon, 01 Feb 2021 03:33:27 GMT server nginx/1.14.0 (Ubuntu) etag 0B5Fi2ZclgsNBLzlSLzl3eTZwYXEyRm5QVjI0dWVsZ0FkdTNzPQ vary Accept-Encoding x-cache BYPASS content-type image/png cache-control public, max-age=604800 accept-ranges bytes content-length 4170
GET H2	200	main.js Show response 1yurakqghu4dgdyazjlosg-on.drv.tw/Pubg/js/	3 KB 1 KB	2088ms 2088ms	Script text/javascript	47.89.250.243 CNNIC-ALIBABA-US-...
General Check archive.org Show headers Download Go to Full URL https://1yurakqghu4dgdyazjlosg-on.drv.tw/Pubg/js/main.js Requested by Host: 1yurakqghu4dgdyazjlosg-on.drv.tw URL: https://1yurakqghu4dgdyazjlosg-on.drv.tw/Pubg/Ucfre21.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 47.89.250.243 , United States, ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba US Technology Co., Ltd., CN), Reverse DNS Software nginx/1.14.0 (Ubuntu) / Resource Hash ca76c6681fd5870f22fb04561d78e5215a10f1d5f90bc29dea3c33d186d398c9 Request headers :path /Pubg/js/main.js pragma no-cache cookie uid=rBEO6WFMl6xBTQKquKa4Ag== accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 sec-fetch-mode no-cors accept */* cache-control no-cache sec-fetch-dest script :authority 1yurakqghu4dgdyazjlosg-on.drv.tw referer https://1yurakqghu4dgdyazjlosg-on.drv.tw/Pubg/Ucfre21.html :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://1yurakqghu4dgdyazjlosg-on.drv.tw/Pubg/Ucfre21.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Thu, 23 Sep 2021 15:05:19 GMT content-encoding gzip last-modified Mon, 01 Feb 2021 03:33:34 GMT server nginx/1.14.0 (Ubuntu) vary Accept-Encoding x-cache BYPASS content-type text/javascript cache-control public, max-age=604800
GET H2	200	wd.js Show response drv.tw/inc/	365 B 592 B	265ms 148ms	Script application/javascript	47.89.250.243 CNNIC-ALIBABA-US-...
General Check archive.org Show headers Download Go to Full URL https://drv.tw/inc/wd.js Requested by Host: 1yurakqghu4dgdyazjlosg-on.drv.tw URL: https://1yurakqghu4dgdyazjlosg-on.drv.tw/Pubg/Ucfre21.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 47.89.250.243 , United States, ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba US Technology Co., Ltd., CN), Reverse DNS Software nginx/1.14.0 (Ubuntu) / Resource Hash 621f59e87c01610c253ac2f9c3f8f7df5f6492c1d2f804088948278849124b33 Request headers Accept-Language de-DE,de;q=0.9 Referer https://1yurakqghu4dgdyazjlosg-on.drv.tw/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Thu, 23 Sep 2021 15:05:17 GMT last-modified Mon, 28 Dec 2020 05:44:07 GMT server nginx/1.14.0 (Ubuntu) etag "5fe970a7-16d" x-cache BYPASS content-type application/javascript cache-control max-age=86400 accept-ranges bytes content-length 365 expires Fri, 24 Sep 2021 15:05:17 GMT
GET H2	200	html.1791701.31c36.0.js Show response dgu9g3a2kzqx2.cloudfront.net/public/external/v2/	11 KB 12 KB	358ms 318ms	Script application/javascript	13.225.84.33 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://dgu9g3a2kzqx2.cloudfront.net/public/external/v2/html.1791701.31c36.0.js Requested by Host: d13nu0oomnx5ti.cloudfront.net URL: https://d13nu0oomnx5ti.cloudfront.net/b4abe97.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.225.84.33 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-225-84-33.fra2.r.cloudfront.net Software Apache/2.4.46 () OpenSSL/1.0.2k-fips PHP/7.4.11 / PHP/7.4.11 Resource Hash 4622aa3e100b1569415704bd084f11ea8fdd24cd7a13a95834a9609ecb26c62d Request headers Accept-Language de-DE,de;q=0.9 Referer https://1yurakqghu4dgdyazjlosg-on.drv.tw/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Thu, 23 Sep 2021 15:05:17 GMT via 1.1 ac0e9b19969df989a920e6d1b834d009.cloudfront.net (CloudFront) server Apache/2.4.46 () OpenSSL/1.0.2k-fips PHP/7.4.11 x-amz-cf-pop FRA2-C2 x-powered-by PHP/7.4.11 x-cache Miss from cloudfront content-type application/javascript x-amz-cf-id 0kEbGpb3DvI6rs8NnxBZkiOTW8pkprv0twmshSEzS36SzCMDTWXTVw==
GET H2	200	css_front.css dgu9g3a2kzqx2.cloudfront.net/public/external/	6 KB 7 KB	199ms 158ms	Stylesheet text/css	13.225.84.33 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://dgu9g3a2kzqx2.cloudfront.net/public/external/css_front.css Requested by Host: d13nu0oomnx5ti.cloudfront.net URL: https://d13nu0oomnx5ti.cloudfront.net/b4abe97.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.225.84.33 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-225-84-33.fra2.r.cloudfront.net Software Apache/2.4.41 () OpenSSL/1.0.2k-fips PHP/7.4.11 / Resource Hash a7bd79b6fba60944ee3a9c153108ff0819d2db57850116ac7065a86db08af4ec Request headers Accept-Language de-DE,de;q=0.9 Referer https://1yurakqghu4dgdyazjlosg-on.drv.tw/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Thu, 23 Sep 2021 15:05:17 GMT via 1.1 ac0e9b19969df989a920e6d1b834d009.cloudfront.net (CloudFront) last-modified Tue, 23 Jun 2020 20:06:47 GMT server Apache/2.4.41 () OpenSSL/1.0.2k-fips PHP/7.4.11 x-amz-cf-pop FRA2-C2 etag "19c4-5a8c5e62e9d0a" x-cache Miss from cloudfront content-type text/css accept-ranges bytes content-length 6596 x-amz-cf-id kdA-4NQa5HnR9DfmlsHHQaPq0Uh3F_UQhPRUj75twa_bm-KSreevDg==
GET H2	200	css.css dgu9g3a2kzqx2.cloudfront.net/public/clockers/PrimeApps/	1010 B 1 KB	159ms 158ms	Stylesheet text/css	13.225.84.33 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://dgu9g3a2kzqx2.cloudfront.net/public/clockers/PrimeApps/css.css Requested by Host: d13nu0oomnx5ti.cloudfront.net URL: https://d13nu0oomnx5ti.cloudfront.net/b4abe97.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.225.84.33 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-225-84-33.fra2.r.cloudfront.net Software Apache/2.4.46 () OpenSSL/1.0.2k-fips PHP/7.4.11 / Resource Hash a7081a117335212b9e7f2e348f7369a64423d51db1666310b3451e7375f0b7de Request headers Accept-Language de-DE,de;q=0.9 Referer https://1yurakqghu4dgdyazjlosg-on.drv.tw/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Thu, 23 Sep 2021 15:05:17 GMT via 1.1 ac0e9b19969df989a920e6d1b834d009.cloudfront.net (CloudFront) last-modified Fri, 10 Apr 2020 22:29:00 GMT server Apache/2.4.46 () OpenSSL/1.0.2k-fips PHP/7.4.11 x-amz-cf-pop FRA2-C2 etag "3f2-5a2f7428ae907" x-cache Miss from cloudfront content-type text/css accept-ranges bytes content-length 1010 x-amz-cf-id EbzOmnEmoksga2549GzoZ_vEThpansLynch67g2vow4PfkGUgYygDg==
GET H2	200	guid Show response dgu9g3a2kzqx2.cloudfront.net/public/	0 286 B	310ms 310ms	Script text/html	13.225.84.33 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://dgu9g3a2kzqx2.cloudfront.net/public/guid?cpguid=f40hvv0zk&e=ll&t=1632409518085 Requested by Host: d13nu0oomnx5ti.cloudfront.net URL: https://d13nu0oomnx5ti.cloudfront.net/b4abe97.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.225.84.33 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-225-84-33.fra2.r.cloudfront.net Software Apache/2.4.46 () OpenSSL/1.0.2k-fips PHP/7.4.11 / PHP/7.4.11 Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language de-DE,de;q=0.9 Referer https://1yurakqghu4dgdyazjlosg-on.drv.tw/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Thu, 23 Sep 2021 15:05:18 GMT via 1.1 ac0e9b19969df989a920e6d1b834d009.cloudfront.net (CloudFront) server Apache/2.4.46 () OpenSSL/1.0.2k-fips PHP/7.4.11 x-amz-cf-pop FRA2-C2 x-powered-by PHP/7.4.11 x-cache Miss from cloudfront content-type text/html; charset=UTF-8 content-length 0 x-amz-cf-id HA-Qfsk7SknLhRmIMvTjr0GUR7vNcCVx-HO9Dh8GpQ7urT59BWVhnQ==
GET H2	200	Cairo-Bold.ttf 1yurakqghu4dgdyazjlosg-on.drv.tw/Pubg/fonts/	151 KB 151 KB	2148ms 2148ms	Font application/x-font-ttf	47.89.250.243 CNNIC-ALIBABA-US-...
General Check archive.org Show headers Download Go to Full URL https://1yurakqghu4dgdyazjlosg-on.drv.tw/Pubg/fonts/Cairo-Bold.ttf Requested by Host: 1yurakqghu4dgdyazjlosg-on.drv.tw URL: https://1yurakqghu4dgdyazjlosg-on.drv.tw/Pubg/css/main.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 47.89.250.243 , United States, ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba US Technology Co., Ltd., CN), Reverse DNS Software nginx/1.14.0 (Ubuntu) / Resource Hash 0541ca7041c78b43d5dcf5c20d5ef505fb38b813dd668cead755b9b59ed9ae46 Request headers sec-fetch-mode cors origin https://1yurakqghu4dgdyazjlosg-on.drv.tw accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 sec-fetch-dest font cookie uid=rBEO6WFMl6xBTQKquKa4Ag==; _cpguid=f40hvv0zk :path /Pubg/fonts/Cairo-Bold.ttf pragma no-cache user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 accept */* cache-control no-cache :authority 1yurakqghu4dgdyazjlosg-on.drv.tw referer https://1yurakqghu4dgdyazjlosg-on.drv.tw/Pubg/css/main.css :scheme https sec-fetch-site same-origin :method GET Referer https://1yurakqghu4dgdyazjlosg-on.drv.tw/Pubg/css/main.css Origin https://1yurakqghu4dgdyazjlosg-on.drv.tw Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Thu, 23 Sep 2021 15:05:21 GMT last-modified Mon, 01 Feb 2021 03:33:34 GMT server nginx/1.14.0 (Ubuntu) etag 0B5Fi2ZclgsNBMFZtOTgycTR2THIzdUJUSWdKb3NFY2VTZ1A4PQ vary Origin Accept-Encoding x-cache BYPASS content-type application/x-font-ttf access-control-allow-origin https://1yurakqghu4dgdyazjlosg-on.drv.tw cache-control public, max-age=604800 accept-ranges bytes content-length 154184
GET H2	200	js Show response www.googletagmanager.com/gtag/	97 KB 39 KB	255ms 23ms	Script application/javascript	142.250.184.232 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=UA-85417367-1 Requested by Host: drv.tw URL: https://drv.tw/inc/wd.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.184.232 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s12-in-f8.1e100.net Software Google Tag Manager / Resource Hash 744795ef017cf278772046a7def2914b39fceaa63673ceccda164c4f7f78f2eb Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://1yurakqghu4dgdyazjlosg-on.drv.tw/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Thu, 23 Sep 2021 15:05:19 GMT content-encoding br server Google Tag Manager access-control-allow-headers Cache-Control vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true cross-origin-resource-policy cross-origin strict-transport-security max-age=31536000; includeSubDomains alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 39282 x-xss-protection 0 expires Thu, 23 Sep 2021 15:05:19 GMT
GET H2	200	check.php Show response dgu9g3a2kzqx2.cloudfront.net/public/external/	78 B 371 B	164ms 164ms	Script application/javascript	13.225.84.33 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://dgu9g3a2kzqx2.cloudfront.net/public/external/check.php?it=1791701&time=1632409519637 Requested by Host: d13nu0oomnx5ti.cloudfront.net URL: https://d13nu0oomnx5ti.cloudfront.net/b4abe97.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.225.84.33 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-225-84-33.fra2.r.cloudfront.net Software Apache/2.4.46 () OpenSSL/1.0.2k-fips PHP/7.4.11 / PHP/7.4.11 Resource Hash 9ef4a63fc5e0a14a7301d693d65d6acfc44cdf14853c4a20890198f2d5e52e3b Request headers Accept-Language de-DE,de;q=0.9 Referer https://1yurakqghu4dgdyazjlosg-on.drv.tw/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers date Thu, 23 Sep 2021 15:05:19 GMT via 1.1 ac0e9b19969df989a920e6d1b834d009.cloudfront.net (CloudFront) server Apache/2.4.46 () OpenSSL/1.0.2k-fips PHP/7.4.11 x-amz-cf-pop FRA2-C2 x-powered-by PHP/7.4.11 x-cache Miss from cloudfront content-type application/javascript content-length 78 x-amz-cf-id kyksUZFEXUNYbbzbf-4Db0nUs8K7UGVJdP8qGcRanuzG-lGb4c5H4w==
GET H2	200	analytics.js Show response www.google-analytics.com/	48 KB 20 KB	50ms 13ms	Script text/javascript	142.250.186.78 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=UA-85417367-1 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.186.78 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s05-in-f14.1e100.net Software Golfe2 / Resource Hash fd222137f245c06ddb4c4d44db41f12138dad6cf8ef5d4d4a5e500f38f0c8c62 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://1yurakqghu4dgdyazjlosg-on.drv.tw/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff last-modified Wed, 11 Aug 2021 00:32:57 GMT server Golfe2 age 799 date Thu, 23 Sep 2021 14:52:00 GMT vary Accept-Encoding content-type text/javascript cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 19747 expires Thu, 23 Sep 2021 16:52:00 GMT
POST H2	200	collect Show response www.google-analytics.com/j/	2 B 220 B	26ms 25ms	XHR text/plain	142.250.186.78 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/j/collect?v=1&_v=j93&a=1995523869&t=pageview&_s=1&dl=https%3A%2F%2F1yurakqghu4dgdyazjlosg-on.drv.tw%2FPubg%2FUcfre21.html&ul=en-us&de=UTF-8&dt=%D8%B4%D8%AD%D9%86%20%D8%B4%D8%AF%D8%A7%D8%AA%20%D8%A8%D8%A8%D8%AC%D9%8A%20%D9%85%D8%AC%D8%A7%D9%86%D8%A7%202021&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAUABAAAAAC~&jid=789872911&gjid=1890999634&cid=675260574.1632409520&tid=UA-85417367-1&_gid=1350163077.1632409520&_r=1&gtm=2ou9m0&z=2105032208 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.186.78 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s05-in-f14.1e100.net Software Golfe2 / Resource Hash de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://1yurakqghu4dgdyazjlosg-on.drv.tw/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Thu, 23 Sep 2021 15:05:19 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://1yurakqghu4dgdyazjlosg-on.drv.tw cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 2 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H2	200	collect Show response stats.g.doubleclick.net/j/	1 B 473 B	73ms 25ms	XHR text/plain	142.251.5.156 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j93&tid=UA-85417367-1&cid=675260574.1632409520&jid=789872911&gjid=1890999634&_gid=1350163077.1632409520&_u=YEBAAUAAAAAAAC~&z=1050238914 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.251.5.156 , United States, ASN15169 (GOOGLE, US), Reverse DNS wg-in-f156.1e100.net Software Golfe2 / Resource Hash 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://1yurakqghu4dgdyazjlosg-on.drv.tw/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Content-Type text/plain Response headers pragma no-cache strict-transport-security max-age=10886400; includeSubDomains; preload x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 date Thu, 23 Sep 2021 15:05:20 GMT content-type text/plain access-control-allow-origin https://1yurakqghu4dgdyazjlosg-on.drv.tw cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1 expires Fri, 01 Jan 1990 00:00:00 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Scam (Online)

38 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| onbeforexrselect boolean| originAgentCluster object| CPABUILDSETTINGS object| CPABUILDContentLocker number| __cfRLUnblockHandlers function| CPBContentLocker function| CPABuildLock function| CPABuildGetFeedURL function| CPABuildGetIframeURL function| CPABuildGetIframeHTML function| CPABuildUnlock function| CPABuildOfferComplete function| CPABuildOffersComplete function| CPABuildCheckForLead function| og_load function| CPABuildComplete function| call_locker function| nextPage function| loadQuestions function| Question object| questions function| Quiz object| quiz function| populate function| guess function| showProgress function| hideProgress function| showLastSteps function| gtag object| dataLayer object| google_tag_manager object| google_tag_data string| GoogleAnalyticsObject function| ga object| gaplugins object| gaGlobal object| gaData

5 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.drv.tw/	1969-12-31 23:59:59	Name: uid Value: rBEO6WFMl6xBTQKquKa4Ag==
			1yurakqghu4dgdyazjlosg-on.drv.tw/	1970-01-19 21:41:13	Name: _cpguid Value: f40hvv0zk
			.drv.tw/	1970-01-20 14:58:01	Name: _ga Value: GA1.2.675260574.1632409520
			.drv.tw/	1970-01-19 21:28:15	Name: _gid Value: GA1.2.1350163077.1632409520
			.drv.tw/	1970-01-19 21:26:49	Name: _gat_gtag_UA_85417367_1 Value: 1

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

1yurakqghu4dgdyazjlosg-on.drv.tw
d13nu0oomnx5ti.cloudfront.net
dgu9g3a2kzqx2.cloudfront.net
drv.tw
stats.g.doubleclick.net
upload-files.cc
www.google-analytics.com
www.googletagmanager.com
13.224.194.163
13.225.84.33
142.250.184.232
142.250.186.78
142.251.5.156
46.30.215.8
47.89.250.243
0541ca7041c78b43d5dcf5c20d5ef505fb38b813dd668cead755b9b59ed9ae46
23a7c9a1990e73ea473e533c1ad2136d4b37711c87b2812f413527bc9f08ed16
318641a875e84108f5d8b55d52e2a0dbb08e7bb44a09a73658c9726960ced756
4622aa3e100b1569415704bd084f11ea8fdd24cd7a13a95834a9609ecb26c62d
621f59e87c01610c253ac2f9c3f8f7df5f6492c1d2f804088948278849124b33
6757052cb3dadd3da19557326e3b7d469d8b551f873dbdeacc13b821c798c364
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
744795ef017cf278772046a7def2914b39fceaa63673ceccda164c4f7f78f2eb
78628d72ccb37293f8a988242e37a3c590cfe0c3a085286ad55f5c567367d9b4
977356a6e9a974c6545fdaa4ed7adeccdafd38f98acc80d437a7a1f38888cb8d
9ef4a63fc5e0a14a7301d693d65d6acfc44cdf14853c4a20890198f2d5e52e3b
a0ad815d715278feecc668e4c71f17efa8f86455d007b46ed2f56fc268468ff3
a7081a117335212b9e7f2e348f7369a64423d51db1666310b3451e7375f0b7de
a7bd79b6fba60944ee3a9c153108ff0819d2db57850116ac7065a86db08af4ec
ca76c6681fd5870f22fb04561d78e5215a10f1d5f90bc29dea3c33d186d398c9
d71b75f37cbaa198fcac72013ceb2a2fe5b68c89902dbcf4b52ae28812cb9268
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
fd222137f245c06ddb4c4d44db41f12138dad6cf8ef5d4d4a5e500f38f0c8c62