urlscan.io logo urlscan.io
SecurityTrails logo

reward.ff.theextraevent.com Open in urlscan Pro
202.181.78.145  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://reward.ff.theextraevent.com/?_gl=1*xwz0ms*_ga*MTM4MDYwOTQ5OS4xNjcwMzMxOTEx*_ga_Y1QNJ6ZLV6*MTY3OTEwMTIwMS4xLjEuMTY3OTEwMTIxOS...
Submission: On March 18 via manual from IN — Scanned from SG
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 6 IPs in 1 countries across 7 domains to perform 21 HTTP transactions. The main IP is 202.181.78.145, located in Singapore and belongs to GARENA-SG Garena Online Pte Ltd, SG. The main domain is reward.ff.theextraevent.com.
TLS certificate: Issued by R3 on March 1st 2023. Valid for: 3 months.
This is the only time reward.ff.theextraevent.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Garena Free Fire (Gaming)

Domain & IP information

IP Address AS Autonomous System
5 202.181.78.145 58521 (GARENA-SG...)
1 2404:6800:400... 15169 (GOOGLE)
1 2404:6800:400... 15169 (GOOGLE)
1 2404:6800:400... 15169 (GOOGLE)
11 184.87.193.68 20940 (AKAMAI-ASN1)
2 2600:1413:b00... 20940 (AKAMAI-ASN1)
21 6
5    202.181.78.145 (Singapore)

ASN58521 (GARENA-SG Garena Online Pte Ltd, SG)
reward.ff.theextraevent.com
rosetta.garenanow.com
1    2404:6800:4003:c0f::61 (Singapore)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
1    2404:6800:4003:c03::5f (Singapore)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
1    2404:6800:4003:c03::65 (Singapore)

ASN15169 (GOOGLE, US)
www.google-analytics.com
11    184.87.193.68 (Singapore)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a184-87-193-68.deploy.static.akamaitechnologies.com
dlgarenanow-a.akamaihd.net
2    2600:1413:b000:14::b857:c149 (Singapore)

ASN20940 (AKAMAI-ASN1, NL)
dl.dir.freefiremobile.com
Apex Domain
Subdomains		 Transfer
11 akamaihd.net
dlgarenanow-a.akamaihd.net — Cisco Umbrella Rank: 260285
441 KB
4 theextraevent.com
reward.ff.theextraevent.com
121 KB
2 freefiremobile.com
dl.dir.freefiremobile.com — Cisco Umbrella Rank: 48927
74 KB
1 garenanow.com
rosetta.garenanow.com
8 KB
1 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 25
262 B
1 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 34
33 KB
1 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 42
70 KB
21 7
Domain Requested by
11 dlgarenanow-a.akamaihd.net reward.ff.theextraevent.com
4 reward.ff.theextraevent.com reward.ff.theextraevent.com
2 dl.dir.freefiremobile.com reward.ff.theextraevent.com
1 rosetta.garenanow.com reward.ff.theextraevent.com
1 www.google-analytics.com www.googletagmanager.com
1 fonts.googleapis.com reward.ff.theextraevent.com
1 www.googletagmanager.com reward.ff.theextraevent.com
21 7

This site contains no links.

Subject Issuer Validity Valid
reward.ff.theextraevent.com
R3		 2023-03-01 -
2023-05-30		 3 months crt.sh
*.google-analytics.com
GTS CA 1C3		 2023-03-02 -
2023-05-25		 3 months crt.sh
upload.video.google.com
GTS CA 1C3		 2023-03-02 -
2023-05-25		 3 months crt.sh
rosetta.garenanow.com
R3		 2023-02-20 -
2023-05-21		 3 months crt.sh
a248.e.akamai.net
DigiCert TLS RSA SHA256 2020 CA1		 2022-06-28 -
2023-06-30		 a year crt.sh
dl.kgtw.garenanow.com
DigiCert TLS RSA SHA256 2020 CA1		 2022-04-29 -
2023-05-03		 a year crt.sh

This page contains 1 frames:

Primary Page: https://reward.ff.theextraevent.com/?_gl=1*xwz0ms*_ga*MTM4MDYwOTQ5OS4xNjcwMzMxOTEx*_ga_Y1QNJ6ZLV6*MTY3OTEwMTIwMS4xLjEuMTY3OTEwMTIxOS4wLjAuMA..
Frame ID: 5E8273CD30742B48A2213A03B5BB4038
Requests: 21 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Free Fire

Detected technologies

Overall confidence: 100%
Detected patterns
  • <[^>]+\sdata-v(?:ue)?-
Overall confidence: 100%
Detected patterns
Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtag/js

Page Statistics

21
Requests

100 %
HTTPS

67 %
IPv6

7
Domains

7
Subdomains

6
IPs

1
Countries

747 kB
Transfer

1305 kB
Size

2
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

21 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
reward.ff.theextraevent.com/ 		2 KB
894 B 		Document
General
Check archive.org
Download Go to
Full URL
https://reward.ff.theextraevent.com/?_gl=1*xwz0ms*_ga*MTM4MDYwOTQ5OS4xNjcwMzMxOTEx*_ga_Y1QNJ6ZLV6*MTY3OTEwMTIwMS4xLjEuMTY3OTEwMTIxOS4wLjAuMA..
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
202.181.78.145 , Singapore, ASN58521 (GARENA-SG Garena Online Pte Ltd, SG),
Reverse DNS
Software
openresty /
Resource Hash
4c9dd6498bd9427c25b5ba75cd53e959a803b97d1baf262ae98244b7bf09b3b3

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36
accept-language
zh-SG,zh;q=0.9

Response headers

content-encoding
gzip
content-length
768
content-type
text/html
date
Sat, 18 Mar 2023 05:27:38 GMT
etag
W/"63f596f2-616"
last-modified
Wed, 22 Feb 2023 04:15:46 GMT
server
openresty
vary
Accept-Encoding
js
www.googletagmanager.com/gtag/ 		191 KB
70 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=G-Y1QNJ6ZLV6
Requested by
Host: reward.ff.theextraevent.com
URL: https://reward.ff.theextraevent.com/?_gl=1*xwz0ms*_ga*MTM4MDYwOTQ5OS4xNjcwMzMxOTEx*_ga_Y1QNJ6ZLV6*MTY3OTEwMTIwMS4xLjEuMTY3OTEwMTIxOS4wLjAuMA..
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2404:6800:4003:c0f::61 , Singapore, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
2e5c22d6a60164344c79076e43253b843138cd0bed24426554165769040b577f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
zh-SG,zh;q=0.9
Referer
https://reward.ff.theextraevent.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Sat, 18 Mar 2023 05:27:38 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
70782
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Sat, 18 Mar 2023 05:27:38 GMT
main.222c6cf55c1ef7710e33.css
reward.ff.theextraevent.com/assets/css/ 		68 KB
9 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://reward.ff.theextraevent.com/assets/css/main.222c6cf55c1ef7710e33.css
Requested by
Host: reward.ff.theextraevent.com
URL: https://reward.ff.theextraevent.com/?_gl=1*xwz0ms*_ga*MTM4MDYwOTQ5OS4xNjcwMzMxOTEx*_ga_Y1QNJ6ZLV6*MTY3OTEwMTIwMS4xLjEuMTY3OTEwMTIxOS4wLjAuMA..
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
202.181.78.145 , Singapore, ASN58521 (GARENA-SG Garena Online Pte Ltd, SG),
Reverse DNS
Software
openresty /
Resource Hash
95ba7176653aa8714a63624b858c2d1a89fe9455aede6b8607605d4294030dce

Request headers

accept-language
zh-SG,zh;q=0.9
Referer
https://reward.ff.theextraevent.com/?_gl=1*xwz0ms*_ga*MTM4MDYwOTQ5OS4xNjcwMzMxOTEx*_ga_Y1QNJ6ZLV6*MTY3OTEwMTIwMS4xLjEuMTY3OTEwMTIxOS4wLjAuMA..
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Sat, 18 Mar 2023 05:27:38 GMT
content-encoding
gzip
last-modified
Wed, 22 Feb 2023 04:15:46 GMT
server
openresty
etag
W/"63f596f2-10eef"
vary
Accept-Encoding
content-type
text/css
vendors~main.009ef22ef50c19912fa7.js
reward.ff.theextraevent.com/assets/js/ 		251 KB
80 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://reward.ff.theextraevent.com/assets/js/vendors~main.009ef22ef50c19912fa7.js
Requested by
Host: reward.ff.theextraevent.com
URL: https://reward.ff.theextraevent.com/?_gl=1*xwz0ms*_ga*MTM4MDYwOTQ5OS4xNjcwMzMxOTEx*_ga_Y1QNJ6ZLV6*MTY3OTEwMTIwMS4xLjEuMTY3OTEwMTIxOS4wLjAuMA..
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
202.181.78.145 , Singapore, ASN58521 (GARENA-SG Garena Online Pte Ltd, SG),
Reverse DNS
Software
openresty /
Resource Hash
52bc42c9e6fe93d0622b2bf9ad21f41f6ff4c64e1ea736723efdc2de362151d0

Request headers

accept-language
zh-SG,zh;q=0.9
Referer
https://reward.ff.theextraevent.com/?_gl=1*xwz0ms*_ga*MTM4MDYwOTQ5OS4xNjcwMzMxOTEx*_ga_Y1QNJ6ZLV6*MTY3OTEwMTIwMS4xLjEuMTY3OTEwMTIxOS4wLjAuMA..
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Sat, 18 Mar 2023 05:27:38 GMT
content-encoding
gzip
last-modified
Fri, 17 Feb 2023 11:09:23 GMT
server
openresty
etag
W/"63ef6063-3ed16"
vary
Accept-Encoding
content-type
application/javascript
main.642892803a995b005317.js
reward.ff.theextraevent.com/assets/js/ 		159 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://reward.ff.theextraevent.com/assets/js/main.642892803a995b005317.js
Requested by
Host: reward.ff.theextraevent.com
URL: https://reward.ff.theextraevent.com/?_gl=1*xwz0ms*_ga*MTM4MDYwOTQ5OS4xNjcwMzMxOTEx*_ga_Y1QNJ6ZLV6*MTY3OTEwMTIwMS4xLjEuMTY3OTEwMTIxOS4wLjAuMA..
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
202.181.78.145 , Singapore, ASN58521 (GARENA-SG Garena Online Pte Ltd, SG),
Reverse DNS
Software
openresty /
Resource Hash
dd341e408ad0964044128a3b588abea79badcbfe7b46ccd1bc5d09eab6ad7b5d

Request headers

accept-language
zh-SG,zh;q=0.9
Referer
https://reward.ff.theextraevent.com/?_gl=1*xwz0ms*_ga*MTM4MDYwOTQ5OS4xNjcwMzMxOTEx*_ga_Y1QNJ6ZLV6*MTY3OTEwMTIwMS4xLjEuMTY3OTEwMTIxOS4wLjAuMA..
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

date
Sat, 18 Mar 2023 05:27:38 GMT
content-encoding
gzip
last-modified
Wed, 22 Feb 2023 04:15:46 GMT
server
openresty
etag
W/"63f596f2-27ba1"
vary
Accept-Encoding
content-type
application/javascript
css
fonts.googleapis.com/ 		117 KB
33 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Noto+Sans+TC&display=swap
Requested by
Host: reward.ff.theextraevent.com
URL: https://reward.ff.theextraevent.com/assets/css/main.222c6cf55c1ef7710e33.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2404:6800:4003:c03::5f , Singapore, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
0c9f7cf605fe9b7997cd43da48328bdfc7166b1d3cc48a69fdc120ca09440ccb
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
zh-SG,zh;q=0.9
Referer
https://reward.ff.theextraevent.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Sat, 18 Mar 2023 05:27:38 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Sat, 18 Mar 2023 05:17:19 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Sat, 18 Mar 2023 05:27:38 GMT
collect
www.google-analytics.com/g/ 		0
262 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/g/collect?v=2&tid=G-Y1QNJ6ZLV6&gtm=45je33f0&_p=1802073138&cid=1546433296.1679117259&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1679117258&sct=1&seg=0&dl=https%3A%2F%2Freward.ff.theextraevent.com%2F%3F_gl%3D1*xwz0ms*_ga*MTM4MDYwOTQ5OS4xNjcwMzMxOTEx*_ga_Y1QNJ6ZLV6*MTY3OTEwMTIwMS4xLjEuMTY3OTEwMTIxOS4wLjAuMA..&dt=Free%20Fire&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-Y1QNJ6ZLV6
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2404:6800:4003:c03::65 , Singapore, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
zh-SG,zh;q=0.9
Referer
https://reward.ff.theextraevent.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 18 Mar 2023 05:27:38 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://reward.ff.theextraevent.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
203
rosetta.garenanow.com/transify/ 		8 KB
8 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://rosetta.garenanow.com/transify/203?lang=1
Requested by
Host: reward.ff.theextraevent.com
URL: https://reward.ff.theextraevent.com/assets/js/main.642892803a995b005317.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
202.181.78.145 , Singapore, ASN58521 (GARENA-SG Garena Online Pte Ltd, SG),
Reverse DNS
Software
openresty /
Resource Hash
bc484693a386a755e9e7613fb564ea5082cc81081243d80fc28a9efc9786f3b7

Request headers

accept-language
zh-SG,zh;q=0.9
Referer
https://reward.ff.theextraevent.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

access-control-allow-origin
*
date
Sat, 18 Mar 2023 05:27:38 GMT
server
openresty
content-type
text/plain
facebook.png
dlgarenanow-a.akamaihd.net/mgames/ffmhk/common/web_event/tweb-event/redemption/img/ 		9 KB
9 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dlgarenanow-a.akamaihd.net/mgames/ffmhk/common/web_event/tweb-event/redemption/img/facebook.png
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
184.87.193.68 , Singapore, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a184-87-193-68.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
94f92c2fa2a770888470701e4e9c0063d11bd846b52739d8b12a06b2dabd3be2

Request headers

accept-language
zh-SG,zh;q=0.9
Referer
https://reward.ff.theextraevent.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date
Sat, 18 Mar 2023 05:27:38 GMT
Last-Modified
Mon, 07 Mar 2022 08:28:08 GMT
Server
AkamaiNetStorage
ETag
"e328a85faf3ec595e525860c98e34098:1646641688.184041"
Content-Type
image/png
Access-Control-Allow-Origin
*
Connection
keep-alive
Accept-Ranges
bytes
Alt-Svc
h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"
Content-Length
9175
vk.png
dlgarenanow-a.akamaihd.net/mgames/ffmhk/common/web_event/tweb-event/redemption/img/ 		10 KB
10 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dlgarenanow-a.akamaihd.net/mgames/ffmhk/common/web_event/tweb-event/redemption/img/vk.png
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
184.87.193.68 , Singapore, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a184-87-193-68.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
8ffae0974acd7014b8e30ff2510ff2c8809103dca22a9e9d252cfd525cc7eff9

Request headers

accept-language
zh-SG,zh;q=0.9
Referer
https://reward.ff.theextraevent.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date
Sat, 18 Mar 2023 05:27:38 GMT
Last-Modified
Mon, 07 Mar 2022 08:26:45 GMT
Server
AkamaiNetStorage
ETag
"a53bf2276aa814a0053de1eb24d48b1b:1646641605.329783"
Content-Type
image/png
Access-Control-Allow-Origin
*
Connection
keep-alive
Accept-Ranges
bytes
Alt-Svc
h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"
Content-Length
9846
google.png
dlgarenanow-a.akamaihd.net/mgames/ffmhk/common/web_event/tweb-event/redemption/img/ 		6 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dlgarenanow-a.akamaihd.net/mgames/ffmhk/common/web_event/tweb-event/redemption/img/google.png
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
184.87.193.68 , Singapore, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a184-87-193-68.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
edefde11d13eb274cafd860dd219755352257187b374f313c810cb6a20f0a477

Request headers

accept-language
zh-SG,zh;q=0.9
Referer
https://reward.ff.theextraevent.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date
Sat, 18 Mar 2023 05:27:38 GMT
Last-Modified
Mon, 07 Mar 2022 08:28:07 GMT
Server
AkamaiNetStorage
ETag
"fad350ab1b376d6e63f4e20880b7714d:1646641687.797583"
Content-Type
image/png
Access-Control-Allow-Origin
*
Connection
keep-alive
Accept-Ranges
bytes
Alt-Svc
h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"
Content-Length
6351
huawei.png
dlgarenanow-a.akamaihd.net/mgames/ffmhk/common/web_event/tweb-event/redemption/img/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dlgarenanow-a.akamaihd.net/mgames/ffmhk/common/web_event/tweb-event/redemption/img/huawei.png
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
184.87.193.68 , Singapore, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a184-87-193-68.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
38e377481a3abf35890dbc9abd19fd4657ab4ea449d24299073da019da5b4281

Request headers

accept-language
zh-SG,zh;q=0.9
Referer
https://reward.ff.theextraevent.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date
Sat, 18 Mar 2023 05:27:38 GMT
Last-Modified
Mon, 07 Mar 2022 08:26:48 GMT
Server
AkamaiNetStorage
ETag
"3fb518b7c5881ad6aeb6c6fda87627e9:1646641608.964761"
Content-Type
image/png
Access-Control-Allow-Origin
*
Connection
keep-alive
Accept-Ranges
bytes
Alt-Svc
h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"
Content-Length
3010
apple.png
dlgarenanow-a.akamaihd.net/mgames/ffmhk/common/web_event/tweb-event/redemption/img/ 		9 KB
9 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dlgarenanow-a.akamaihd.net/mgames/ffmhk/common/web_event/tweb-event/redemption/img/apple.png
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
184.87.193.68 , Singapore, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a184-87-193-68.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
ac768dee11c223ac3fba06a7212fd0163c171e7986735b5cd04f9081504126b3

Request headers

accept-language
zh-SG,zh;q=0.9
Referer
https://reward.ff.theextraevent.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date
Sat, 18 Mar 2023 05:27:38 GMT
Last-Modified
Mon, 07 Mar 2022 08:29:14 GMT
Server
AkamaiNetStorage
ETag
"d72825e76a981573e800cb3983bff287:1646641754.910995"
Content-Type
image/png
Access-Control-Allow-Origin
*
Connection
keep-alive
Accept-Ranges
bytes
Alt-Svc
h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"
Content-Length
9069
twitter.png
dlgarenanow-a.akamaihd.net/mgames/ffmhk/common/web_event/tweb-event/redemption/img/ 		10 KB
10 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dlgarenanow-a.akamaihd.net/mgames/ffmhk/common/web_event/tweb-event/redemption/img/twitter.png
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
184.87.193.68 , Singapore, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a184-87-193-68.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
392c6ef45dc72dc2d72c2a2d16ff5fcd5943766e78e14f1f6bb008c59cf80877

Request headers

accept-language
zh-SG,zh;q=0.9
Referer
https://reward.ff.theextraevent.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date
Sat, 18 Mar 2023 05:27:38 GMT
Last-Modified
Mon, 07 Mar 2022 08:28:06 GMT
Server
AkamaiNetStorage
ETag
"fac267d563f943d005abd2a01d207764:1646641686.462893"
Content-Type
image/png
Access-Control-Allow-Origin
*
Connection
keep-alive
Accept-Ranges
bytes
Alt-Svc
h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"
Content-Length
9812
arrow.png
dlgarenanow-a.akamaihd.net/mgames/ffmhk/common/web_event/tweb-event/redemption/img/ 		449 B
829 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dlgarenanow-a.akamaihd.net/mgames/ffmhk/common/web_event/tweb-event/redemption/img/arrow.png
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
184.87.193.68 , Singapore, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a184-87-193-68.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
756734c7de9dd01ffd9c75ccdfc48f08d51d774f75c6c453d9468812c5282861

Request headers

accept-language
zh-SG,zh;q=0.9
Referer
https://reward.ff.theextraevent.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date
Sat, 18 Mar 2023 05:27:38 GMT
Last-Modified
Mon, 07 Mar 2022 08:26:50 GMT
Server
AkamaiNetStorage
ETag
"3303308c2aacb531af045e92a5d7101c:1646641610.663508"
Content-Type
image/png
Access-Control-Allow-Origin
*
Connection
keep-alive
Accept-Ranges
bytes
Alt-Svc
h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"
Content-Length
449
logo_small_foot.jpg
dlgarenanow-a.akamaihd.net/mgames/ffmhk/common/web_event/tweb-event/redemption/img/ 		3 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dlgarenanow-a.akamaihd.net/mgames/ffmhk/common/web_event/tweb-event/redemption/img/logo_small_foot.jpg
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
184.87.193.68 , Singapore, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a184-87-193-68.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
3dec40957ccb5815562b06c0bcb1cb3fc09a5f0738aa0b9ec2d1390e4e30a346

Request headers

accept-language
zh-SG,zh;q=0.9
Referer
https://reward.ff.theextraevent.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date
Sat, 18 Mar 2023 05:27:38 GMT
Last-Modified
Mon, 07 Mar 2022 08:28:07 GMT
Server
AkamaiNetStorage
ETag
"c34038edcf4185b3e75a6b85f1cd3d4f:1646641687.19891"
Content-Type
image/jpeg
Access-Control-Allow-Origin
*
Connection
keep-alive
Accept-Ranges
bytes
Alt-Svc
h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"
Content-Length
3522
bg.jpg
dlgarenanow-a.akamaihd.net/mgames/ffmhk/common/web_event/tweb-event/redemption/img/ 		134 KB
134 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dlgarenanow-a.akamaihd.net/mgames/ffmhk/common/web_event/tweb-event/redemption/img/bg.jpg
Requested by
Host: reward.ff.theextraevent.com
URL: https://reward.ff.theextraevent.com/assets/css/main.222c6cf55c1ef7710e33.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
184.87.193.68 , Singapore, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a184-87-193-68.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
ba96000a92f9d03cce2c34ab48fb9f1e67976be7b4233c1bd607a87e6e9af82d

Request headers

accept-language
zh-SG,zh;q=0.9
Referer
https://reward.ff.theextraevent.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date
Sat, 18 Mar 2023 05:27:38 GMT
Last-Modified
Mon, 07 Mar 2022 08:28:11 GMT
Server
AkamaiNetStorage
ETag
"57fd6fc58a09519be8012650efd9881d:1646641691.083794"
Content-Type
image/jpeg
Access-Control-Allow-Origin
*
Connection
keep-alive
Accept-Ranges
bytes
Alt-Svc
h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"
Content-Length
136773
top_teeth-l.png
dlgarenanow-a.akamaihd.net/mgames/ffmhk/common/web_event/tweb-event/redemption/img/ 		144 B
522 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dlgarenanow-a.akamaihd.net/mgames/ffmhk/common/web_event/tweb-event/redemption/img/top_teeth-l.png
Requested by
Host: reward.ff.theextraevent.com
URL: https://reward.ff.theextraevent.com/assets/css/main.222c6cf55c1ef7710e33.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
184.87.193.68 , Singapore, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a184-87-193-68.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
42fcead125ad8660c031f3b763fd048fd06b4a70a7a48cf17bc03073fb255fae

Request headers

accept-language
zh-SG,zh;q=0.9
Referer
https://reward.ff.theextraevent.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date
Sat, 18 Mar 2023 05:27:38 GMT
Last-Modified
Mon, 07 Mar 2022 08:26:47 GMT
Server
AkamaiNetStorage
ETag
"fe98481dd3ffad514594309ceb2ef4ba:1646641607.0753"
Content-Type
image/png
Access-Control-Allow-Origin
*
Connection
keep-alive
Accept-Ranges
bytes
Alt-Svc
h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"
Content-Length
144
logo-new.png
dlgarenanow-a.akamaihd.net/mgames/ffmhk/common/web_event/tweb-event/redemption/img/ 		253 KB
253 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dlgarenanow-a.akamaihd.net/mgames/ffmhk/common/web_event/tweb-event/redemption/img/logo-new.png
Requested by
Host: reward.ff.theextraevent.com
URL: https://reward.ff.theextraevent.com/assets/css/main.222c6cf55c1ef7710e33.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
184.87.193.68 , Singapore, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a184-87-193-68.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
e5d1ff232a26bd3b8a702a52464d1bdf12992e9f166084da5cfad235d8f7b20e

Request headers

accept-language
zh-SG,zh;q=0.9
Referer
https://reward.ff.theextraevent.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date
Sat, 18 Mar 2023 05:27:38 GMT
Last-Modified
Tue, 19 Jul 2022 08:34:23 GMT
Server
AkamaiNetStorage
ETag
"76697e9220e45c00a5fbaf78cc3d7553:1658219663.088581"
Content-Type
image/png
Access-Control-Allow-Origin
*
Connection
keep-alive
Accept-Ranges
bytes
Alt-Svc
h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"
Content-Length
258949
GFFLatinW05-Bold.woff
dl.dir.freefiremobile.com/common/web_event/common/fonts/website/ 		37 KB
38 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://dl.dir.freefiremobile.com/common/web_event/common/fonts/website/GFFLatinW05-Bold.woff
Requested by
Host: reward.ff.theextraevent.com
URL: https://reward.ff.theextraevent.com/assets/css/main.222c6cf55c1ef7710e33.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2600:1413:b000:14::b857:c149 , Singapore, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
OBS /
Resource Hash
5441944a6ee96a0dc5935f0b4c180045b41c7ef6068bd50c05dade403fbe150e

Request headers

Referer
https://reward.ff.theextraevent.com/
Origin
https://reward.ff.theextraevent.com
accept-language
zh-SG,zh;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date
Sat, 18 Mar 2023 05:27:38 GMT
x-obs-id-2
32AAAQAAEAABAAAQAAEAABAAAQAAEAABCSEcdHzxOnL//+Q9V/VS+QIPfYrcBkDK
Last-Modified
Thu, 04 Aug 2022 12:29:55 GMT
Server
OBS
ETag
"2aea1e812ea22f7bf315a8d9769e1470"
CDN-Origin-Protocol
HTTP
Content-Type
font/woff
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=3600
x-obs-request-id
0000018690FFB6839544E6C6B6473A7D
Connection
keep-alive
Accept-Ranges
bytes
X-Forward-Proto
http
Content-Length
38243
GFFLatinW05-Regular.woff
dl.dir.freefiremobile.com/common/web_event/common/fonts/website/ 		36 KB
36 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://dl.dir.freefiremobile.com/common/web_event/common/fonts/website/GFFLatinW05-Regular.woff
Requested by
Host: reward.ff.theextraevent.com
URL: https://reward.ff.theextraevent.com/assets/css/main.222c6cf55c1ef7710e33.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2600:1413:b000:14::b857:c149 , Singapore, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
OBS /
Resource Hash
475f5b3cb03384633a4e870c3377b992f13ad8246a23173a282be11faf2c85fb

Request headers

Referer
https://reward.ff.theextraevent.com/
Origin
https://reward.ff.theextraevent.com
accept-language
zh-SG,zh;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36

Response headers

Date
Sat, 18 Mar 2023 05:27:38 GMT
x-obs-id-2
32AAAQAAEAABAAAQAAEAABAAAQAAEAABCS7HTB11qaQRMvhgXzSIPqwrbneg9JoR
Last-Modified
Thu, 04 Aug 2022 12:29:55 GMT
Server
OBS
ETag
"79eded60054ec31a810b67864d975a8c"
CDN-Origin-Protocol
HTTP
Content-Type
font/woff
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=3600
x-obs-request-id
00000186910013AE941FF8C50677992C
Connection
keep-alive
Accept-Ranges
bytes
X-Forward-Proto
http
Content-Length
36707

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Garena Free Fire (Gaming)

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless function| gtag object| dataLayer object| google_tag_manager object| google_tag_data object| gaGlobal object| webpackJsonp object| __SENTRY__ object| regeneratorRuntime object| vue

2 Cookies

Domain/Path Name / Value
.theextraevent.com/ Name: _ga_Y1QNJ6ZLV6
Value: GS1.1.1679117258.1.0.1679117258.0.0.0
.theextraevent.com/ Name: _ga
Value: GA1.1.1546433296.1679117259

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

dl.dir.freefiremobile.com
dlgarenanow-a.akamaihd.net
fonts.googleapis.com
reward.ff.theextraevent.com
rosetta.garenanow.com
www.google-analytics.com
www.googletagmanager.com
184.87.193.68
202.181.78.145
2404:6800:4003:c03::5f
2404:6800:4003:c03::65
2404:6800:4003:c0f::61
2600:1413:b000:14::b857:c149
0c9f7cf605fe9b7997cd43da48328bdfc7166b1d3cc48a69fdc120ca09440ccb
2e5c22d6a60164344c79076e43253b843138cd0bed24426554165769040b577f
38e377481a3abf35890dbc9abd19fd4657ab4ea449d24299073da019da5b4281
392c6ef45dc72dc2d72c2a2d16ff5fcd5943766e78e14f1f6bb008c59cf80877
3dec40957ccb5815562b06c0bcb1cb3fc09a5f0738aa0b9ec2d1390e4e30a346
42fcead125ad8660c031f3b763fd048fd06b4a70a7a48cf17bc03073fb255fae
475f5b3cb03384633a4e870c3377b992f13ad8246a23173a282be11faf2c85fb
4c9dd6498bd9427c25b5ba75cd53e959a803b97d1baf262ae98244b7bf09b3b3
52bc42c9e6fe93d0622b2bf9ad21f41f6ff4c64e1ea736723efdc2de362151d0
5441944a6ee96a0dc5935f0b4c180045b41c7ef6068bd50c05dade403fbe150e
756734c7de9dd01ffd9c75ccdfc48f08d51d774f75c6c453d9468812c5282861
8ffae0974acd7014b8e30ff2510ff2c8809103dca22a9e9d252cfd525cc7eff9
94f92c2fa2a770888470701e4e9c0063d11bd846b52739d8b12a06b2dabd3be2
95ba7176653aa8714a63624b858c2d1a89fe9455aede6b8607605d4294030dce
ac768dee11c223ac3fba06a7212fd0163c171e7986735b5cd04f9081504126b3
ba96000a92f9d03cce2c34ab48fb9f1e67976be7b4233c1bd607a87e6e9af82d
bc484693a386a755e9e7613fb564ea5082cc81081243d80fc28a9efc9786f3b7
dd341e408ad0964044128a3b588abea79badcbfe7b46ccd1bc5d09eab6ad7b5d
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e5d1ff232a26bd3b8a702a52464d1bdf12992e9f166084da5cfad235d8f7b20e
edefde11d13eb274cafd860dd219755352257187b374f313c810cb6a20f0a477