ucxpubgm4.com
Open in
urlscan Pro
2606:4700:3031::ac43:9bdd
Malicious Activity!
Public Scan
Submission: On June 22 via automatic, source openphish
Summary
This is the only time ucxpubgm4.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Gaming (Entertainment)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 | 2606:4700:303... 2606:4700:3031::ac43:9bdd | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
12 | 101.33.10.108 101.33.10.108 | 132203 (TENCENT-N...) (TENCENT-NET-AP-CN Tencent Building) | |
3 | 203.205.224.42 203.205.224.42 | 132203 (TENCENT-N...) (TENCENT-NET-AP-CN Tencent Building) | |
1 | 104.111.239.81 104.111.239.81 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
3 | 101.33.10.52 101.33.10.52 | 132203 (TENCENT-N...) (TENCENT-NET-AP-CN Tencent Building) | |
5 | 240e:ff:f101:... 240e:ff:f101:10::1a0 | 4816 (CHINANET-...) (CHINANET-IDC-GD China Telecom (Group)) | |
1 | 203.205.137.29 203.205.137.29 | 132203 (TENCENT-N...) (TENCENT-NET-AP-CN Tencent Building) | |
2 | 129.226.107.210 129.226.107.210 | 132203 (TENCENT-N...) (TENCENT-NET-AP-CN Tencent Building) | |
1 | 203.205.235.145 203.205.235.145 | 132203 (TENCENT-N...) (TENCENT-NET-AP-CN Tencent Building) | |
30 | 9 |
ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN)
cdn.midasbuy.com |
ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN)
www.midasbuy.com |
ASN16625 (AKAMAI-AS, US)
PTR: a104-111-239-81.deploy.static.akamaitechnologies.com
midas.gtimg.cn |
ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN)
report1.midasbuy.com |
ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN)
3gimg.qq.com |
ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN)
kepler.captcha.qcloud.com |
ASN132203 (TENCENT-NET-AP-CN Tencent Building, Kejizhongyi Avenue, CN)
dp.telesafe.qq.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
18 |
midasbuy.com
cdn.midasbuy.com www.midasbuy.com report1.midasbuy.com |
4 MB |
7 |
qq.com
aegis.qq.com 3gimg.qq.com dp.telesafe.qq.com |
64 KB |
2 |
qcloud.com
kepler.captcha.qcloud.com |
108 KB |
2 |
ucxpubgm4.com
ucxpubgm4.com |
38 KB |
1 |
gtimg.cn
midas.gtimg.cn |
21 KB |
30 | 5 |
Domain | Requested by | |
---|---|---|
12 | cdn.midasbuy.com |
ucxpubgm4.com
cdn.midasbuy.com |
5 | aegis.qq.com |
ucxpubgm4.com
|
3 | report1.midasbuy.com |
ucxpubgm4.com
|
3 | www.midasbuy.com |
ucxpubgm4.com
|
2 | kepler.captcha.qcloud.com |
ucxpubgm4.com
|
2 | ucxpubgm4.com |
ucxpubgm4.com
|
1 | dp.telesafe.qq.com |
ucxpubgm4.com
|
1 | 3gimg.qq.com |
ucxpubgm4.com
|
1 | midas.gtimg.cn |
ucxpubgm4.com
|
30 | 9 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.midasbuy.com DigiCert Secure Site CN CA G3 |
2021-04-21 - 2022-05-22 |
a year | crt.sh |
qs.888.qq.com DigiCert SHA2 Secure Server CA |
2021-06-16 - 2022-06-21 |
a year | crt.sh |
aegis.qq.com DigiCert Secure Site CN CA G3 |
2021-03-04 - 2022-04-04 |
a year | crt.sh |
*.cdnsource.sparta.3g.qq.com GlobalSign Organization Validation CA - SHA256 - G2 |
2020-07-31 - 2021-08-01 |
a year | crt.sh |
*.captcha.qcloud.com Secure Site CA G2 |
2020-07-24 - 2021-07-29 |
a year | crt.sh |
*.aug02.sparta.3g.qq.com GlobalSign Organization Validation CA - SHA256 - G2 |
2020-08-20 - 2021-08-21 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
http://ucxpubgm4.com/
Frame ID: 991654EDF12CBAB6B6048BC9DA3380BF
Requests: 30 HTTP requests in this frame
Screenshot
Detected technologies
CloudFlare (CDN) ExpandDetected patterns
- headers server /^cloudflare$/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
30 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
ucxpubgm4.com/ |
185 KB 36 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
vendor-87839280b2.html.css
cdn.midasbuy.com/oversea_web/static/css/ |
236 KB 36 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
game_recharge_ticket_new-c9585b8432.html.css
cdn.midasbuy.com/oversea_web/static/css/ |
18 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
media-f6bc833bbb.html.css
cdn.midasbuy.com/oversea_web/static/css/ |
122 KB 20 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
midas-oversea-h5page.js
cdn.midasbuy.com/h5/overseah5/js/ |
58 KB 9 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
production.midas.runtime.js
cdn.midasbuy.com/oversea_web/static/js/ |
282 KB 91 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
foXpt24MxhVpLTWmFsULBWJ0hD79nV7v9xWmNlTyU3Bqe4AEdEhMwu9wQOZRznaiasaltyxZa4hdYZdpZTVP_4fNAGKEXIYBcBqHZ0gpIMU~.js
www.midasbuy.com/oversea_web/static/js/x-midas/ |
55 KB 20 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
world.2556fe97306bdec1268d8b8a935b56c5.jpg
midas.gtimg.cn/oversea_web/static/images/flag/ |
21 KB 21 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pc-logo.png
www.midasbuy.com/oversea_web/static/images/ |
5 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
big-new-close-icon.png
www.midasbuy.com/oversea_web/static/images/ |
373 B 649 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
header.bbcf2110.js
cdn.midasbuy.com/oversea_web/static/js/ |
55 KB 18 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
guide001.png
cdn.midasbuy.com/images/apps/pubgm/ |
2 MB 2 MB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
guide002.png
cdn.midasbuy.com/images/apps/pubgm/ |
2 MB 2 MB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
email-decode.min.js
ucxpubgm4.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/ |
1 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
buypage.052bbaf6.js
cdn.midasbuy.com/oversea_web/static/js/ |
152 KB 47 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
log_data.fcg
report1.midasbuy.com/cgi-bin/ |
0 0 |
Image
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pc-logo-5f404ea479.png
cdn.midasbuy.com/oversea_web/static/images/ |
5 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
arrow-icon-54d438045f.png
cdn.midasbuy.com/oversea_web/static/images/ |
360 B 588 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pc-fb-eade39686c.png
cdn.midasbuy.com/oversea_web/static/images/ |
2 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
whitelist
aegis.qq.com/aegis/ |
58 B 214 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
tfg.v1.0.18.js
3gimg.qq.com/tele_safe/static/tfg/pc/ |
214 KB 63 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
tencent-kepler.js
kepler.captcha.qcloud.com/ |
107 KB 108 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
log_data.fcg
report1.midasbuy.com/cgi-bin/ |
0 0 |
Image
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
performance
aegis.qq.com/speed/ |
0 83 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
speed
aegis.qq.com/ |
0 83 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
getwt
kepler.captcha.qcloud.com/ |
370 B 618 B |
XHR
text/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
f4
dp.telesafe.qq.com/ |
137 B 238 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
log_data.fcg
report1.midasbuy.com/cgi-bin/ |
0 0 |
Image
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
speed
aegis.qq.com/ |
0 83 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
speed
aegis.qq.com/ |
0 83 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Gaming (Entertainment)92 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated function| assetsRetry object| assetsRetryRule object| assetsRetryStatistics object| __PAY_INFO object| __Report_INFO object| defaultDisableGaCountryList boolean| __RTL string| _SHOPCODE object| __showErrorDetail boolean| enable_nopay_contract object| aegis function| Aegis object| midas function| $ function| jQuery function| Swiper function| Vue object| __core-js_shared__ object| core object| report object| fbReport object| _0x3d88 function| _0x306c function| don string| goServerUrl string| goPublicKey object| langResource object| footerLan number| showWelcomeBack object| redPointConfigs object| user string| fbPixelId boolean| jumpHomePage object| bubblePopConfig object| vipcenterConfig object| sdk_rules function| loadJS function| scrollFun function| toggleGa function| gaKey object| __TENCENT_CHAOS_STACK function| xMidas object| WebsiteHosts function| throttle object| GAME_INFO object| MP_INFO object| CHANNEL_INFO object| noComplianceCountryList object| complianceWithBirthCountryList object| complianceWithDataCountryList object| buylimits number| needActiveData number| defaultShowNum boolean| showRedeemChannel boolean| needSupplementaryTerms object| agreementArray object| reglimits object| channelRestore object| images function| setNavPosition function| hideHomeBtn function| tfp number| scrollT1 number| scrollT2 object| scrollTimer function| setPosition function| isScrollEnd function| showClauseBg function| hideClauseBg function| hideTaxPop function| showBirthBox function| hideBirthBox boolean| ga-disable-UA-21773189-2 object| jQuery1124004512181726721365 object| TencentKepler object| fpApp object| global object| System function| asap function| Observable function| setImmediate function| clearImmediate object| regeneratorRuntime boolean| _babelPolyfill string| ___Kepler_WebTicket0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
3gimg.qq.com
aegis.qq.com
cdn.midasbuy.com
dp.telesafe.qq.com
kepler.captcha.qcloud.com
midas.gtimg.cn
report1.midasbuy.com
ucxpubgm4.com
www.midasbuy.com
101.33.10.108
101.33.10.52
104.111.239.81
129.226.107.210
203.205.137.29
203.205.224.42
203.205.235.145
240e:ff:f101:10::1a0
2606:4700:3031::ac43:9bdd
089878c4af2ccaaa206b2fff070dc068a4f0acdd17ff2de1432bb6463446d8ce
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
277355ba4d493c5279f147c81cdc1b7f2c0978e29d65b7d0573859140041a417
28b3485fc5c3353c25431fa1fef14fdcef2907bd200c4d96f64b3eabeeaa0699
3558f7989f99ee18b24351b0cc217e61d690a384076d2a9b61607c0de34a93ef
3dd04893dcf4fb0b4eabdc3a2d5bec009f6a81d3ee066501ed1cdda9705c9cd8
4bcb452bf07df52c2fbd3f0a65263cd81e544cdc7d19cef7908ecb9428df15fd
528ec4ee6f56ace1dd9c394fa067175b7192828bc3b68e264e7494448f31b27e
5b9430319d55d405995d9bd1178ae5afcde94ce80942886cb56d85a907c5eba1
607b00f0fd839eb7f8250d7c4d0c0b4a31a08b32b2b8b5cbdd9fe3125b2eb985
6a5fcf92b4c112813ed0cbb4696880e98ad29e02228ed822b73a8b864820e815
7bd044dde50ca2da8c2950983cabfa6d1e7f695330ee884b05f340351f116c18
a406545520016ebc8913e102352c7d11b54e1f543f19c965a943ead3035a5b78
a521b418fd37d48c7a770e7c9438bf56c8a564df2ae8a77c60865f0614361ec7
ad7e01a58105e8ee445f7e2be6d77d2c7403fcfe58991726cfb38e35b48ec77d
b35045677941134c95267b374b2a153f9843260b4768a7472a995566e6d21508
bb221a7e60f804731d8965873f7826f750f4def4abbe5b3bf132a9ce4b5e636e
c922214dd2b6560e226d0a36ee21c474d3d4184c7599d1baba67c4c8287af4ef
dc283fe48becaf7a1374e8dc0784dd43d0025c7cac35516b416d6347454d56ec
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
fb29d9ce7243bd6b0f2e4cb8666f831285696ee23b70de68a72f1c8d73844ef0
fcb4576438361d09632849295af08f3cc448b8e104902ac1303df41a91dd4af1
fea99403dd834e7b61ee51fd481e0d4fcbca047aadd57c15d405513e0b7e8a99