www.ffgarena.com-0ffer.com
Open in
urlscan Pro
198.54.116.175
Malicious Activity!
Public Scan
Submission: On December 15 via automatic, source certstream-suspicious
Summary
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on December 15th 2019. Valid for: a year.
This is the only time www.ffgarena.com-0ffer.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Garena Free Fire (Gaming)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 198.54.116.175 198.54.116.175 | 22612 (NAMECHEAP...) (NAMECHEAP-NET - Namecheap) | |
3 | 35.244.137.202 35.244.137.202 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
1 | 2a00:1450:400... 2a00:1450:4001:825::200a | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
4 | 192.229.133.208 192.229.133.208 | 15133 (EDGECAST) (EDGECAST - MCI Communications Services) | |
2 | 130.211.30.60 130.211.30.60 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
4 | 2606:4700:20:... 2606:4700:20::681a:fb7 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
2 | 2a00:1450:400... 2a00:1450:4001:806::2003 | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
17 | 7 |
ASN22612 (NAMECHEAP-NET - Namecheap, Inc., US)
PTR: server226-5.web-hosting.com
www.ffgarena.com-0ffer.com |
ASN15169 (GOOGLE - Google LLC, US)
PTR: 202.137.244.35.bc.googleusercontent.com
g.fastcdn.co |
ASN15169 (GOOGLE - Google LLC, US)
fonts.googleapis.com |
ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US)
v.fastcdn.co |
ASN15169 (GOOGLE - Google LLC, US)
PTR: 60.30.211.130.bc.googleusercontent.com
heatmap.services |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
popupmaker.com |
ASN15169 (GOOGLE - Google LLC, US)
fonts.gstatic.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
fastcdn.co
g.fastcdn.co v.fastcdn.co |
105 KB |
4 |
popupmaker.com
popupmaker.com |
50 KB |
2 |
gstatic.com
fonts.gstatic.com |
18 KB |
2 |
heatmap.services
heatmap.services |
4 KB |
1 |
googleapis.com
fonts.googleapis.com |
1 KB |
1 |
com-0ffer.com
www.ffgarena.com-0ffer.com |
4 KB |
17 | 6 |
Domain | Requested by | |
---|---|---|
4 | popupmaker.com |
www.ffgarena.com-0ffer.com
popupmaker.com |
4 | v.fastcdn.co |
www.ffgarena.com-0ffer.com
|
3 | g.fastcdn.co |
www.ffgarena.com-0ffer.com
|
2 | fonts.gstatic.com |
www.ffgarena.com-0ffer.com
|
2 | heatmap.services |
www.ffgarena.com-0ffer.com
heatmap.services |
1 | fonts.googleapis.com |
www.ffgarena.com-0ffer.com
|
1 | www.ffgarena.com-0ffer.com | |
17 | 7 |
This site contains links to these domains. Also see Links.
Domain |
---|
popupmaker.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
ffgarena.com-0ffer.com Sectigo RSA Domain Validation Secure Server CA |
2019-12-15 - 2020-12-14 |
a year | crt.sh |
g.fastcdn.co Let's Encrypt Authority X3 |
2019-11-15 - 2020-02-13 |
3 months | crt.sh |
*.storage.googleapis.com GTS CA 1O1 |
2019-11-13 - 2020-02-05 |
3 months | crt.sh |
v.fastcdn.co DigiCert SHA2 Secure Server CA |
2017-10-24 - 2020-06-09 |
3 years | crt.sh |
heatmap.services COMODO RSA Domain Validation Secure Server CA |
2018-04-20 - 2020-04-19 |
2 years | crt.sh |
sni.cloudflaressl.com CloudFlare Inc ECC CA-2 |
2019-11-11 - 2020-10-09 |
a year | crt.sh |
*.google.com GTS CA 1O1 |
2019-11-13 - 2020-02-05 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://www.ffgarena.com-0ffer.com/
Frame ID: 4B22673173A8E8815389F5CCA7574CBD
Requests: 17 HTTP requests in this frame
Screenshot
Detected technologies
Apache (Web Servers) ExpandDetected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i
Google Font API (Font Scripts) Expand
Detected patterns
- html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
17 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
www.ffgarena.com-0ffer.com/ |
15 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
utils.630d7336ed6c460057fd.js
g.fastcdn.co/js/ |
33 KB 11 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Cradle.7d48307fa97b2c79dd9e.js
g.fastcdn.co/js/ |
16 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
LazyImage.11f65ec56b7eb117e504.js
g.fastcdn.co/js/ |
3 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
24 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
48099904-0-logo-small.png
v.fastcdn.co/u/702881f0/ |
6 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
48099916-0-menu.PNG
v.fastcdn.co/u/702881f0/ |
326 B 975 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
48099952-0-floating-reward.png
v.fastcdn.co/u/702881f0/ |
42 KB 42 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
lib.js
heatmap.services/static/ |
10 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
SGPMPopup.min.js
popupmaker.com/assets/lib/ |
162 KB 39 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
48099932-0-Fotoram.io.jpg
v.fastcdn.co/u/702881f0/ |
38 KB 38 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mem5YaGs126MiZpBA-UN7rgOUuhpKKSTjw.woff2
fonts.gstatic.com/s/opensans/v17/ |
9 KB 9 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
fonts.gstatic.com/s/opensans/v17/ |
9 KB 9 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
SGPMPopup.css
popupmaker.com/public/assets/lib/ |
36 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
popupmaker.com/api/popups/58189317/ |
11 KB 5 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
popup-maker-icon-brand.png
popupmaker.com/public/assets/media/images/ |
1 KB 1 KB |
Image
image/webp |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
raw-data
heatmap.services/api/ |
33 B 396 B |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Garena Free Fire (Gaming)80 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate object| SGPMPopupLoader function| sgp object| __variantsData number| __page_id number| __default_experience_id number| __version string| __variant string| __variant_custom_name boolean| __preview number| __page_type string| __variant_hash string| __page_domain number| __predator_throttle object| __predator_blacklist boolean| __page_generator object| _Translate object| webpackJsonp object| core object| __core-js_shared__ object| __eventBus object| __config number| __workspaceWidth string| SGPM_APP_URL string| SGPM_STATS_URL string| SGPM_WEBPUSH_URL string| SGPM_POPUP_ID string| SGPM_MAIN_DIV object| SGPM_MAIN_DIV_DEFAULT_CONTENT object| SGPM_MAIN_DIV_OBJ object| SGPM_POPUP_STATISTICS boolean| SGPM_HAS_SEND_DATA string| SGPM_USER_PAGE_BODY_STYLES number| SGPM_DISABLE_PAGE_SCROLLING_POPUP_COUNT number| PUSH_AUTORESPONDER_IS_NOT_DRAFT function| SGPMPopup function| SGP function| sgpmPreventDefault function| sgpmPreventDefaultForScrollKeys function| SGStatistics function| SGIntegrations function| SGGoogleAnalytics function| sgpSpinToWin function| Pin function| Animation function| Segment function| PointerGuide function| sgpSpinToWinPercentToDegrees function| sgpSpinToWinAnimationLoop function| sgpSpinToWinStopAnimation function| sgpSpinToWinLoadedImage object| sgpSpinToWinToDrawDuringAnimation boolean| winhweelAlreadyDrawn object| _gsScope function| SGPMSpinner function| SGPMFacebook function| SGPMFloatingButton object| _gsQueue object| GreenSockGlobals object| com function| _gsDefine function| Ease function| Power4 function| Strong function| Quint function| Power3 function| Quart function| Power2 function| Cubic function| Power1 function| Quad function| Power0 function| Linear function| sgpHelperFree function| sgpmTweenPlugin function| sgpHelper object| SGPMSpinnerObjects object| _htmp string| SGPM_USER_PAGE_HTML_STYLES0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
fonts.googleapis.com
fonts.gstatic.com
g.fastcdn.co
heatmap.services
popupmaker.com
v.fastcdn.co
www.ffgarena.com-0ffer.com
130.211.30.60
192.229.133.208
198.54.116.175
2606:4700:20::681a:fb7
2a00:1450:4001:806::2003
2a00:1450:4001:825::200a
35.244.137.202
0a4a071ed2723e65a2526afb6d604e8176707567272d577e7ed7d6c3da8e50fd
0a733c9a259685cf9a9816145434c0087227f35400e16208e7e63e58ccd44538
10738357753c861b8a7d36ba5f11516994ecf54797a58f45d9ee8c267dd42d79
1b2b8285d6a8fd0d46225d08b96b01ec76639f4d46d4559fb8143de2c4525e59
1b90cf4d5783a7e2406add11bdc55333d82ce25523ca561a502e802a972d0ef1
2956908d3187f7509fdaba91a14ad1a5d2c591cd25cac5b5ad6e44b69f52fa9d
3cc1125c735264f13b78e7fd74f8abb302bd4d2b76bf1aa36dbb6ad70aa7ca98
433508e4927849dff0b4a2850de3eb6a99e94140220715432911c48de77a6fd8
54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775
77187de7f83031f12fd13c8fc56b656549eeffa84477ca44bff95153c224b646
7d423a9febe15a0966afa958512506768c74f4fda6d04098e8a7a3a27ef3fdb9
a48a6e4b14fe55f750c0a3dfb5a6f4941bdc06af0aa542b90de25c30c2b4625c
a61931a55615c95d6cbffdeb1efa0f25f2a64ab8db2f13536d651df782bbeeb2
aeae628bb5c58695aeeb38d775b0d3e58f0d3448679f5f2a1c9038cc63ae2156
b12d7390660c8371a63995931b44499f66a60811e89ff701355e99aa6e682a85
bb2255aa2f6ae692672c7e6703b9c91d14c6e741f6c89ba6dfc46cab34d32904
c21305dcdd5cb1227ffc14b837757c09741cec5026d6bd5634337f839ca8c64a