https://myany.gb.net
172.67.147.15 · Cloudflare, Inc.
Toronto, Canada
10617 days
200 · 25.5s
Valid· E7, Let's Encrypt, US
COMPLETED
Registered-domain escalation
Submit gb.net as the primary IOC, enriched with evidence from hostile subdomains like myany.gb.net.
No KB/IOK detections were recorded for this scan.
happiness | technology | ecommerce · 6/3/2026
The scan shows a redirect from myany.gb.net to web-designer.uk.com, with page content and imagery advertising EE88 (EE88 MYANY) and giftcode offers. The final URL is not the same as the initial domain, and the visible branding on the target page references EE88, suggesting impersonation/brand-cloning rather than legitimate first-party surface. No explicit credential collection form is present in the static HTML, but the page loads numerous external assets and a POST to a Cloudflare URL, consistent with a dynamic landing page potentially used for phishing or advertising abuse. Risk indicators include a new SSL certificate (issued 6 days ago) on a domain involved in a redirect chain, a high external script count, and a final URL different from the submitted URL, all of which warrant heightened scrutiny for impersonation and misuse.
Capture
Stages: 2
Canonical: Settled Render
Changed: No
Credential Signals
Forms: 1
Password fields: 0
Late-stage login UI: No
Resource Signals
Resources: 74
Hosts: 5
Domains: 5
Suspicious Endpoints
hxxps://web-designer[.]uk[.]com/
The domain myany.gb.net redirects to a different domain (creek.ru.com) and ultimately serves a page branded with EE88/EE88 MYANY imagery on web-designer.uk.com. This combination of impersonation signals, a redirect chain to a non-official domain, and a high number of external resources suggests potential brand impersonation or phishing preparations. The absence of a visible login field in the static HTML does not remove concern, as SPAs may render forms client-side. Given the branding alignment with EE88 and the deceptive hosting pattern, this warrants further abuse action and monitoring. The presence of a Let's Encrypt certificate on a short-lived domain together with the WAF/CDN interactions strengthens the suspicion of misuse.
Monitor