now.gg - urlscan.io

Summary

This website contacted 3 IPs in 1 countries across 4 domains to perform 4 HTTP transactions. The main IP is 52.84.251.97, located in United States and belongs to AMAZON-02, US. The main domain is now.gg. The Cisco Umbrella rank of the primary domain is 25188.
TLS certificate: Issued by Amazon RSA 2048 M01 on January 21st 2023. Valid for: a year.

This is the only time now.gg was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	18.155.68.84 18.155.68.84	16509 (AMAZON-02) (AMAZON-02)
2	52.84.251.97 52.84.251.97	16509 (AMAZON-02) (AMAZON-02)
1	64.233.170.95 64.233.170.95	15169 (GOOGLE) (GOOGLE)
1	74.125.24.94 74.125.24.94	15169 (GOOGLE) (GOOGLE)
4	3

1 18.155.68.84 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: server-18-155-68-84.sin52.r.cloudfront.net

3gnl9.app.link	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.84.251.97 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-84-251-97.sin5.r.cloudfront.net

now.gg	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 64.233.170.95 (United States)

ASN15169 (GOOGLE, US)
PTR: sg-in-f95.1e100.net

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 74.125.24.94 (United States)

ASN15169 (GOOGLE, US)
PTR: sf-in-f94.1e100.net

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	now.gg now.gg — Cisco Umbrella Rank: 25188	16 KB
1	gstatic.com fonts.gstatic.com	29 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 73	932 B
1	app.link 1 redirects 3gnl9.app.link	671 B
4	4

	Domain	Requested by
2	now.gg	now.gg
1	fonts.gstatic.com	fonts.googleapis.com
1	fonts.googleapis.com	now.gg
1	3gnl9.app.link	1 redirects
4	4

This site contains no links.

Subject Issuer	Validity	Valid
now.gg Amazon RSA 2048 M01	`2023-01-21` - `2024-02-19`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2023-07-31` - `2023-10-23`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2023-07-31` - `2023-10-23`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://now.gg/play/uncube/7074/now?%24web_only=true&_branch_match_id=1222559598257201765&utm_source=Facebook&utm_campaign=Black%20Friday&utm_medium=marketing&_branch_referrer=H4sIAAAAAAAAA8soKSkottLXN07Py7HUSywo0MvJzMvWT9UPzfWNKrBMLix2TgIAniE7%2FyQAAAA%3D
Frame ID: 8A44CF77A52AB07A16689AABA508AACE
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Proxy

Page URL History Show full URLs

https://3gnl9.app.link/UmMZp9cqsCb HTTP 307
https://now.gg/play/uncube/7074/now?%24web_only=true&_branch_match_id=1222559598257201765&u... Page URL

Detected technologies

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Page Statistics

4
Requests

100 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

3
IPs

1
Countries

46 kB
Transfer

81 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://3gnl9.app.link/UmMZp9cqsCb HTTP 307
https://now.gg/play/uncube/7074/now?%24web_only=true&_branch_match_id=1222559598257201765&utm_source=Facebook&utm_campaign=Black%20Friday&utm_medium=marketing&_branch_referrer=H4sIAAAAAAAAA8soKSkottLXN07Py7HUSywo0MvJzMvWT9UPzfWNKrBMLix2TgIAniE7%2FyQAAAA%3D Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request now Show response
now.gg/play/uncube/7074/
Redirect Chain

https://3gnl9.app.link/UmMZp9cqsCb
https://now.gg/play/uncube/7074/now?%24web_only=true&_branch_match_id=1222559598257201765&utm_source=Facebook&utm_campaign=Black%20Friday&utm_medium=marketing&_branch_referrer=H4sIAAAAAAAAA8soKSkot...

24 KB
8 KB

591ms
193ms

Document
text/html

52.84.251.97
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://now.gg/play/uncube/7074/now?%24web_only=true&_branch_match_id=1222559598257201765&utm_source=Facebook&utm_campaign=Black%20Friday&utm_medium=marketing&_branch_referrer=H4sIAAAAAAAAA8soKSkottLXN07Py7HUSywo0MvJzMvWT9UPzfWNKrBMLix2TgIAniE7%2FyQAAAA%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.84.251.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-84-251-97.sin5.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 1ec60f578cf7018cdb196586ed39ead4f82dbcf3289eea69f3e034d7ef3e59d1

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

age: 2958
content-encoding: br
content-type: text/html
date: Tue, 22 Aug 2023 14:56:32 GMT
etag: W/"210f0bb2096cb9b7918336c464b1d242"
last-modified: Tue, 18 Jul 2023 10:30:05 GMT
server: AmazonS3
vary: Accept-Encoding
via: 1.1 f28347a3148f4f8fa1d930375689073c.cloudfront.net (CloudFront)
x-amz-cf-id: c_-Nq2WxdUZ0--JBMMTxop-OAtMLb8U-yEHfv0twFlR_KesQM0-WUQ==
x-amz-cf-pop: SIN5-C1
x-amz-server-side-encryption: AES256
x-amz-version-id: BbuM23.QBzMfnijcFgbJXNQrpzpND33h
x-cache: Error from cloudfront

Redirect headers

accept-ch: Sec-CH-UA-Platform-Version,Sec-CH-UA-Model
date: Tue, 22 Aug 2023 15:45:48 GMT
last-modified: Tue, 22 Aug 2023 15:45:48 GMT
location: https://now.gg/play/uncube/7074/now?%24web_only=true&_branch_match_id=1222559598257201765&utm_source=Facebook&utm_campaign=Black%20Friday&utm_medium=marketing&_branch_referrer=H4sIAAAAAAAAA8soKSkottLXN07Py7HUSywo0MvJzMvWT9UPzfWNKrBMLix2TgIAniE7%2FyQAAAA%3D
server: openresty
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 574ab88ff85f4ad30dd2d3a36c2bab20.cloudfront.net (CloudFront)
x-amz-cf-id: FT-xhKFzPsLfx7VOfBWH0e53dDmvXKH-CkutOzYPHtyyr-HbvfEgsw==
x-amz-cf-pop: SIN52-P1
x-cache: Miss from cloudfront

GET
H2 200 css2
fonts.googleapis.com/ 5 KB
932 B 660ms
193ms Stylesheet
text/css 64.233.170.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Fredoka:wght@400;500;600;700&display=swap

Requested by

Host: now.gg
URL: https://now.gg/play/uncube/7074/now?%24web_only=true&_branch_match_id=1222559598257201765&utm_source=Facebook&utm_campaign=Black%20Friday&utm_medium=marketing&_branch_referrer=H4sIAAAAAAAAA8soKSkottLXN07Py7HUSywo0MvJzMvWT9UPzfWNKrBMLix2TgIAniE7%2FyQAAAA%3D

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

64.233.170.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sg-in-f95.1e100.net

Software

ESF /

Resource Hash

0a34cd9197ab48301e493dbfa9d0cea7ddee5f89c8a60d6698a32817f191fd0f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://now.gg/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 22 Aug 2023 15:45:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 22 Aug 2023 15:45:50 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 22 Aug 2023 15:45:50 GMT

POST
H2 200 reportEvent Show response
now.gg/api/play/v1/ 24 KB
8 KB 202ms
201ms Fetch
text/html 52.84.251.97
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://now.gg/api/play/v1/reportEvent
Requested by: Host: now.gg
URL: https://now.gg/play/uncube/7074/now?%24web_only=true&_branch_match_id=1222559598257201765&utm_source=Facebook&utm_campaign=Black%20Friday&utm_medium=marketing&_branch_referrer=H4sIAAAAAAAAA8soKSkottLXN07Py7HUSywo0MvJzMvWT9UPzfWNKrBMLix2TgIAniE7%2FyQAAAA%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.84.251.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-84-251-97.sin5.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 1ec60f578cf7018cdb196586ed39ead4f82dbcf3289eea69f3e034d7ef3e59d1

Request headers

Referer: https://now.gg/play/uncube/7074/now?%24web_only=true&_branch_match_id=1222559598257201765&utm_source=Facebook&utm_campaign=Black%20Friday&utm_medium=marketing&_branch_referrer=H4sIAAAAAAAAA8soKSkottLXN07Py7HUSywo0MvJzMvWT9UPzfWNKrBMLix2TgIAniE7%2FyQAAAA%3D
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 22 Aug 2023 14:56:32 GMT
x-amz-version-id: BbuM23.QBzMfnijcFgbJXNQrpzpND33h
content-encoding: br
last-modified: Tue, 18 Jul 2023 10:30:05 GMT
server: AmazonS3
via: 1.1 f28347a3148f4f8fa1d930375689073c.cloudfront.net (CloudFront)
x-amz-cf-pop: SIN5-C1
etag: W/"210f0bb2096cb9b7918336c464b1d242"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: Error from cloudfront
content-type: text/html
age: 2959
x-amz-cf-id: ViydrdZnyEPtXoL3Y24xW7u9fhiscACpBAiRSOj0jII7p5KyG72ouA==

GET
H2 200 X7n64b87HvSqjb_WIi2yDCRwoQ_k7367_DWu89U.woff2
fonts.gstatic.com/s/fredoka/v14/ 28 KB
29 KB 864ms
187ms Font
font/woff2 74.125.24.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/fredoka/v14/X7n64b87HvSqjb_WIi2yDCRwoQ_k7367_DWu89U.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Fredoka:wght@400;500;600;700&display=swap

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

74.125.24.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sf-in-f94.1e100.net

Software

sffe /

Resource Hash

5acd18c3fcaab27993b4702c2631653014bb733877d87f99a0d4a0c9a20606de

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://now.gg
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.96 Safari/537.36

Response headers

date: Sat, 19 Aug 2023 11:04:40 GMT
x-content-type-options: nosniff
age: 276071
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 28976
x-xss-protection: 0
last-modified: Mon, 03 Apr 2023 16:50:32 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 18 Aug 2024 11:04:40 GMT

Verdicts & Comments Add Verdict or Comment

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture boolean| isMobileComputed

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.app.link/	1970-01-20 22:57:35	Name: _s Value: rgd1Za9KfqAOHRsIHGQkPD9a5MarmPdQV2SJ4adICl3C7mgMDdhYcaGTj74X3bjm

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

3gnl9.app.link
fonts.googleapis.com
fonts.gstatic.com
now.gg
18.155.68.84
52.84.251.97
64.233.170.95
74.125.24.94
0a34cd9197ab48301e493dbfa9d0cea7ddee5f89c8a60d6698a32817f191fd0f
1ec60f578cf7018cdb196586ed39ead4f82dbcf3289eea69f3e034d7ef3e59d1
5acd18c3fcaab27993b4702c2631653014bb733877d87f99a0d4a0c9a20606de

now.gg Open in urlscan Pro 52.84.251.97 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

4 Requests

100 %HTTPS

0 %IPv6

4 Domains

4 Subdomains

3 IPs

1 Countries

46 kBTransfer

81 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

2 JavaScript Global Variables

1 Cookies

Indicators

now.gg Open in urlscan Pro
52.84.251.97 Public Scan

Screenshot
Live screenshot

Full Image

4
Requests

100 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

3
IPs

1
Countries

46 kB
Transfer

81 kB
Size

1
Cookies

4 HTTP transactions
0 data transactions