www.freefire.com-0ffer.com Open in urlscan Pro
198.54.116.175  Malicious Activity! Public Scan

1 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

17 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response www.freefire.com-0ffer.com/	15 KB 4 KB	498ms 161ms	Document text/html	198.54.116.175 Namecheap
General Check archive.org Show headers Download Go to Full URL https://www.freefire.com-0ffer.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 198.54.116.175 Los Angeles, United States, ASN22612 (NAMECHEAP-NET - Namecheap, Inc., US), Reverse DNS server226-5.web-hosting.com Software Apache / Resource Hash 7d423a9febe15a0966afa958512506768c74f4fda6d04098e8a7a3a27ef3fdb9 Request headers :method GET :authority www.freefire.com-0ffer.com :scheme https :path / pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-user ?1 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3 sec-fetch-site none sec-fetch-mode navigate accept-encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-User ?1 Response headers status 200 date Sun, 15 Dec 2019 17:14:47 GMT server Apache last-modified Sun, 15 Dec 2019 16:20:05 GMT accept-ranges bytes vary Accept-Encoding content-encoding gzip content-length 4434 content-type text/html
GET H2	200	utils.630d7336ed6c460057fd.js Show response g.fastcdn.co/js/	33 KB 11 KB	56ms 7ms	Script application/javascript	35.244.137.202 Google LLC
General Check archive.org Show headers Download Go to Full URL https://g.fastcdn.co/js/utils.630d7336ed6c460057fd.js Requested by Host: www.freefire.com-0ffer.com URL: https://www.freefire.com-0ffer.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.244.137.202 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS 202.137.244.35.bc.googleusercontent.com Software UploadServer / Resource Hash 433508e4927849dff0b4a2850de3eb6a99e94140220715432911c48de77a6fd8 Request headers Referer https://www.freefire.com-0ffer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Thu, 12 Dec 2019 11:39:32 GMT content-encoding gzip age 279315 status 200 x-guploader-uploadid AEnB2UoCq85I_Xi92LCiDV7b6KrJrdy1D_YvuT5fhZL4m0VkcbzsB6waE-SqvlXVYGtQmfGBjFYsD6wOPgFGbUhE6-2tkWqPmw x-goog-storage-class MULTI_REGIONAL x-goog-metageneration 1 x-goog-stored-content-encoding gzip alt-svc clear content-length 10750 last-modified Wed, 11 Dec 2019 11:53:33 GMT server UploadServer etag "d5a254e263cf27a6c8b76c8a64857a75" vary Accept-Encoding x-goog-hash crc32c=6F8xcg==, md5=1aJU4mPPJ6bIt2yKZIV6dQ== x-goog-generation 1576065213377831 cache-control public, max-age=31536000 x-goog-stored-content-length 10750 accept-ranges bytes content-type application/javascript expires Fri, 11 Dec 2020 11:39:32 GMT
GET H2	200	Cradle.7d48307fa97b2c79dd9e.js Show response g.fastcdn.co/js/	16 KB 5 KB	56ms 8ms	Script application/javascript	35.244.137.202 Google LLC
General Check archive.org Show headers Download Go to Full URL https://g.fastcdn.co/js/Cradle.7d48307fa97b2c79dd9e.js Requested by Host: www.freefire.com-0ffer.com URL: https://www.freefire.com-0ffer.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.244.137.202 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS 202.137.244.35.bc.googleusercontent.com Software UploadServer / Resource Hash a61931a55615c95d6cbffdeb1efa0f25f2a64ab8db2f13536d651df782bbeeb2 Request headers Referer https://www.freefire.com-0ffer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Sat, 14 Dec 2019 07:26:52 GMT content-encoding gzip age 121675 status 200 x-guploader-uploadid AEnB2Up8nql_9xLFbCO8YBMcSzJJSV1EacwaK36CeVUfxYqI-EsajCqlod__dqETLRZXiZIu5q1HTDTdZh667PefR2ZeMqzIuplK-ZlZNSI_jN86BghtkDc x-goog-storage-class MULTI_REGIONAL x-goog-metageneration 1 x-goog-stored-content-encoding gzip alt-svc clear content-length 4679 last-modified Wed, 11 Dec 2019 11:53:30 GMT server UploadServer etag "d7553bcc80472b939678b94dc72df723" vary Accept-Encoding x-goog-hash crc32c=Xjjw+Q==, md5=11U7zIBHK5OWeLlNxy33Iw== x-goog-generation 1573553849766590 cache-control public, max-age=31536000 x-goog-stored-content-length 4679 accept-ranges bytes content-type application/javascript expires Sun, 13 Dec 2020 07:26:52 GMT
GET H2	200	LazyImage.11f65ec56b7eb117e504.js Show response g.fastcdn.co/js/	3 KB 2 KB	55ms 7ms	Script application/javascript	35.244.137.202 Google LLC
General Check archive.org Show headers Download Go to Full URL https://g.fastcdn.co/js/LazyImage.11f65ec56b7eb117e504.js Requested by Host: www.freefire.com-0ffer.com URL: https://www.freefire.com-0ffer.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.244.137.202 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS 202.137.244.35.bc.googleusercontent.com Software UploadServer / Resource Hash 77187de7f83031f12fd13c8fc56b656549eeffa84477ca44bff95153c224b646 Request headers Referer https://www.freefire.com-0ffer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Sun, 24 Nov 2019 10:58:05 GMT content-encoding gzip age 1837002 status 200 x-guploader-uploadid AEnB2UqkaIz9ZXHSvytBTFiQBu9t41G2IMo1RCesnHVyGQxU0NobpaBFyuv45Uuil2_h5sQlLfbHGhY2nDFdQB0jEzgeUupdfA x-goog-storage-class MULTI_REGIONAL x-goog-metageneration 1 x-goog-stored-content-encoding gzip alt-svc clear content-length 1304 last-modified Tue, 19 Nov 2019 11:54:42 GMT server UploadServer etag "987bb9339f550adf4b2e6e13e8971acd" vary Accept-Encoding x-goog-hash crc32c=X14lSg==, md5=mHu5M59VCt9LLm4T6JcazQ== x-goog-generation 1574164482142567 cache-control public, max-age=31536000 x-goog-stored-content-length 1304 accept-ranges bytes content-type application/javascript expires Mon, 23 Nov 2020 10:58:05 GMT
GET H2	200	css fonts.googleapis.com/	24 KB 1 KB	18ms 16ms	Stylesheet text/css	2a00:1450:4001:819::200a Google LLC
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Open+Sans:300italic,400italic,600italic,700italic,800italic,400,300,600,700,800 Requested by Host: www.freefire.com-0ffer.com URL: https://www.freefire.com-0ffer.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:819::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software ESF / Resource Hash 0a733c9a259685cf9a9816145434c0087227f35400e16208e7e63e58ccd44538 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://www.freefire.com-0ffer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding br last-modified Sun, 15 Dec 2019 17:14:47 GMT server ESF access-control-allow-origin * date Sun, 15 Dec 2019 17:14:47 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin x-xss-protection 0 expires Sun, 15 Dec 2019 17:14:47 GMT
GET H2	200	48099904-0-logo-small.png v.fastcdn.co/u/702881f0/	6 KB 6 KB	55ms 20ms	Image image/png	192.229.133.208 MCI Communication...
General Check archive.org Show headers Download Go to Show image Full URL https://v.fastcdn.co/u/702881f0/48099904-0-logo-small.png Requested by Host: www.freefire.com-0ffer.com URL: https://www.freefire.com-0ffer.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.229.133.208 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US), Reverse DNS Software UploadServer / Resource Hash 3cc1125c735264f13b78e7fd74f8abb302bd4d2b76bf1aa36dbb6ad70aa7ca98 Request headers Referer https://www.freefire.com-0ffer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Sun, 15 Dec 2019 16:28:14 GMT x-goog-stored-content-length 5959 age 2793 x-guploader-uploadid AEnB2UqbGbnAe43p1ef4FQImz4tbeqaBIvSQaWc28z1ZICa8xQ72uBOKFi8mzuQN530xBdR3-jl6TUvP3RWjek3jxakyDnfU-A x-goog-storage-class STANDARD status 200 x-goog-metageneration 2 x-goog-stored-content-encoding identity x-goog-meta-expires Thu, 04 Feb 2021 06:36:09 GMT alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 5959 last-modified Sun, 15 Dec 2019 14:36:09 GMT server UploadServer etag "5c3ddfe45ad5f5276fb50ede60dfa08b" x-goog-hash crc32c=pbkS8g==, md5=XD3f5FrV9SdvtQ7eYN+giw== x-goog-generation 1576420569313444 cache-control max-age=315360000, public x-goog-meta-content-length 0 accept-ranges bytes content-type image/png expires Mon, 14 Dec 2020 16:28:14 GMT
GET H2	200	48099916-0-menu.PNG v.fastcdn.co/u/702881f0/	326 B 625 B	454ms 421ms	Image image/png	192.229.133.208 MCI Communication...
General Check archive.org Show headers Download Go to Show image Full URL https://v.fastcdn.co/u/702881f0/48099916-0-menu.PNG Requested by Host: www.freefire.com-0ffer.com URL: https://www.freefire.com-0ffer.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.229.133.208 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US), Reverse DNS Software UploadServer / Resource Hash bb2255aa2f6ae692672c7e6703b9c91d14c6e741f6c89ba6dfc46cab34d32904 Request headers Referer https://www.freefire.com-0ffer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Sun, 15 Dec 2019 17:14:47 GMT x-goog-stored-content-length 326 status 200 x-guploader-uploadid AEnB2UqHQcUJdAyRl3Vx6f8xhD15TJLS2SpabOq0uDh2imxHzlcQiaY6MeP3818KwbXb2NXY3svfdzqvUcuh2-RtnV9Ci80LzA x-goog-storage-class STANDARD x-goog-metageneration 2 x-goog-stored-content-encoding identity x-goog-meta-expires Thu, 04 Feb 2021 06:38:12 GMT alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 326 last-modified Sun, 15 Dec 2019 14:38:12 GMT server UploadServer etag "7f9dae49958ebbab0f6c1538e6a3ebb2" x-goog-hash crc32c=izZMDg==, md5=f52uSZWOu6sPbBU45qPrsg== x-goog-generation 1576420692111830 cache-control max-age=315360000, public x-goog-meta-content-length 0 accept-ranges bytes content-type image/png expires Mon, 14 Dec 2020 17:14:47 GMT
GET H2	200	48099952-0-floating-reward.png v.fastcdn.co/u/702881f0/	42 KB 42 KB	459ms 448ms	Image image/png	192.229.133.208 MCI Communication...
General Check archive.org Show headers Download Go to Show image Full URL https://v.fastcdn.co/u/702881f0/48099952-0-floating-reward.png Requested by Host: www.freefire.com-0ffer.com URL: https://www.freefire.com-0ffer.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.229.133.208 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US), Reverse DNS Software UploadServer / Resource Hash b12d7390660c8371a63995931b44499f66a60811e89ff701355e99aa6e682a85 Request headers Referer https://www.freefire.com-0ffer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Sun, 15 Dec 2019 17:14:47 GMT x-goog-stored-content-length 42993 status 200 x-guploader-uploadid AEnB2UrQsRbcHAk2IK_5yQIGY9OpVBqPDOUI24M_pzb2nX2S2OhNmvzig12Z5vooud7KP9M2P0XTzAsLitLUrXaTyg7R_znj7w x-goog-storage-class STANDARD x-goog-metageneration 2 x-goog-stored-content-encoding identity x-goog-meta-expires Thu, 04 Feb 2021 06:56:01 GMT alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 42993 last-modified Sun, 15 Dec 2019 14:56:02 GMT server UploadServer etag "72f506dcb6777976abcdcc46f51d6e37" x-goog-hash crc32c=GV+lqw==, md5=cvUG3LZ3eXarzcxG9R1uNw== x-goog-generation 1576421762035216 cache-control max-age=315360000, public x-goog-meta-content-length 0 accept-ranges bytes content-type image/png expires Mon, 14 Dec 2020 17:14:47 GMT
GET H2	200	lib.js Show response heatmap.services/static/	10 KB 4 KB	162ms 116ms	Script application/javascript	130.211.30.60 Google LLC
General Check archive.org Show headers Download Go to Full URL https://heatmap.services/static/lib.js Requested by Host: www.freefire.com-0ffer.com URL: https://www.freefire.com-0ffer.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 130.211.30.60 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS 60.30.211.130.bc.googleusercontent.com Software / Resource Hash c21305dcdd5cb1227ffc14b837757c09741cec5026d6bd5634337f839ca8c64a Security Headers Name Value Strict-Transport-Security max-age=15552000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.freefire.com-0ffer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers strict-transport-security max-age=15552000; includeSubDomains content-encoding gzip x-content-type-options nosniff x-dns-prefetch-control off status 200 alt-svc clear x-xss-protection 1; mode=block last-modified Wed, 27 Nov 2019 14:45:11 GMT date Sun, 15 Dec 2019 17:14:47 GMT x-download-options noopen x-frame-options SAMEORIGIN content-type application/javascript; charset=UTF-8 via 1.1 google vary Accept-Encoding cache-control public, must-revalidate, public access-control-allow-credentials true accept-ranges bytes expires Sun, 15 Dec 2019 17:19:47 GMT
GET H2	200	SGPMPopup.min.js Show response popupmaker.com/assets/lib/	162 KB 39 KB	166ms 101ms	Script application/javascript	2606:4700:20::681a:fb7 Cloudflare
General Check archive.org Show headers Download Go to Full URL https://popupmaker.com/assets/lib/SGPMPopup.min.js Requested by Host: www.freefire.com-0ffer.com URL: https://www.freefire.com-0ffer.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::681a:fb7 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 10738357753c861b8a7d36ba5f11516994ecf54797a58f45d9ee8c267dd42d79 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubdomains; X-Frame-Options SAMEORIGIN Request headers Referer https://www.freefire.com-0ffer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Sun, 15 Dec 2019 17:14:47 GMT content-encoding br vary Accept-Encoding cf-cache-status BYPASS status 200 alt-svc h3-24=":443"; ma=86400, h3-23=":443"; ma=86400 last-modified Sun, 15 Dec 2019 11:35:04 GMT server cloudflare x-frame-options SAMEORIGIN etag W/"286ea-599bc7c6e876c-gzip" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=63072000; includeSubdomains; content-type application/javascript access-control-allow-origin * cache-control max-age=2678400, private cf-ray 545a0e4e3ef88cb6-VIE
GET H2	200	48099932-0-Fotoram.io.jpg v.fastcdn.co/u/702881f0/	38 KB 38 KB	617ms 614ms	Image image/jpeg	192.229.133.208 MCI Communication...
General Check archive.org Show headers Download Go to Show image Full URL https://v.fastcdn.co/u/702881f0/48099932-0-Fotoram.io.jpg Requested by Host: www.freefire.com-0ffer.com URL: https://www.freefire.com-0ffer.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.229.133.208 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US), Reverse DNS Software UploadServer / Resource Hash 1b2b8285d6a8fd0d46225d08b96b01ec76639f4d46d4559fb8143de2c4525e59 Request headers Referer https://www.freefire.com-0ffer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Sun, 15 Dec 2019 17:14:47 GMT x-goog-stored-content-length 38490 status 200 x-guploader-uploadid AEnB2Urfp8FpwncYA3Xjc5uU16gQiFzlvrfI2CiWMCR3PXBKHittP-EeWceAZYYnvbyH6HH8TLEEMOIdkHCjEXhWxr-ej30cnQ x-goog-storage-class STANDARD x-goog-metageneration 2 x-goog-stored-content-encoding identity x-goog-meta-expires Thu, 04 Feb 2021 06:51:40 GMT alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 38490 last-modified Sun, 15 Dec 2019 14:51:40 GMT server UploadServer etag "98e4f7c3f8fea1d95010b2c17056ed26" x-goog-hash crc32c=6bWTWA==, md5=mOT3w/j+odlQELLBcFbtJg== x-goog-generation 1576421500656706 cache-control max-age=315360000, public x-goog-meta-content-length 0 accept-ranges bytes content-type image/jpeg expires Mon, 14 Dec 2020 17:14:47 GMT
GET H2	200	mem5YaGs126MiZpBA-UN7rgOUuhpKKSTjw.woff2 fonts.gstatic.com/s/opensans/v17/	9 KB 9 KB	6ms 5ms	Font font/woff2	2a00:1450:4001:809::2003 Google LLC
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/opensans/v17/mem5YaGs126MiZpBA-UN7rgOUuhpKKSTjw.woff2 Requested by Host: www.freefire.com-0ffer.com URL: https://www.freefire.com-0ffer.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software sffe / Resource Hash a48a6e4b14fe55f750c0a3dfb5a6f4941bdc06af0aa542b90de25c30c2b4625c Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer https://fonts.googleapis.com/css?family=Open+Sans:300italic,400italic,600italic,700italic,800italic,400,300,600,700,800 Origin https://www.freefire.com-0ffer.com Response headers date Thu, 21 Nov 2019 07:12:32 GMT x-content-type-options nosniff last-modified Tue, 23 Jul 2019 19:31:11 GMT server sffe age 2109735 content-type font/woff2 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * access-control-allow-origin * content-length 9080 x-xss-protection 0 expires Fri, 20 Nov 2020 07:12:32 GMT
GET H2	200	mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2 fonts.gstatic.com/s/opensans/v17/	9 KB 9 KB	6ms 6ms	Font font/woff2	2a00:1450:4001:809::2003 Google LLC
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/opensans/v17/mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2 Requested by Host: www.freefire.com-0ffer.com URL: https://www.freefire.com-0ffer.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software sffe / Resource Hash 54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer https://fonts.googleapis.com/css?family=Open+Sans:300italic,400italic,600italic,700italic,800italic,400,300,600,700,800 Origin https://www.freefire.com-0ffer.com Response headers date Thu, 21 Nov 2019 17:13:27 GMT x-content-type-options nosniff last-modified Tue, 23 Jul 2019 19:30:49 GMT server sffe age 2073680 content-type font/woff2 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * access-control-allow-origin * content-length 9132 x-xss-protection 0 expires Fri, 20 Nov 2020 17:13:27 GMT
GET H2	200	SGPMPopup.css popupmaker.com/public/assets/lib/	36 KB 5 KB	23ms 23ms	Stylesheet text/css	2606:4700:20::681a:fb7 Cloudflare
General Check archive.org Show headers Download Go to Full URL https://popupmaker.com/public/assets/lib/SGPMPopup.css Requested by Host: popupmaker.com URL: https://popupmaker.com/assets/lib/SGPMPopup.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::681a:fb7 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 1b90cf4d5783a7e2406add11bdc55333d82ce25523ca561a502e802a972d0ef1 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubdomains; X-Frame-Options SAMEORIGIN Request headers Referer https://www.freefire.com-0ffer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Sun, 15 Dec 2019 17:14:47 GMT content-encoding br cf-cache-status HIT age 13469 cf-polished origSize=41057 status 200 strict-transport-security max-age=63072000; includeSubdomains; alt-svc h3-24=":443"; ma=86400, h3-23=":443"; ma=86400 last-modified Tue, 08 Oct 2019 08:50:32 GMT server cloudflare x-frame-options SAMEORIGIN etag W/"a061-5946242db5f47-gzip" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/css access-control-allow-origin * cache-control public, max-age=2678400 cf-ray 545a0e4eff938cb6-VIE cf-bgj minify
GET H2	200	/ Show response popupmaker.com/api/popups/58189317/	11 KB 5 KB	102ms 74ms	XHR text/html	2606:4700:20::681a:fb7 Cloudflare
General Check archive.org Show headers Download Go to Full URL https://popupmaker.com/api/popups/58189317/ Requested by Host: popupmaker.com URL: https://popupmaker.com/assets/lib/SGPMPopup.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::681a:fb7 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 01cfcee4e1150976147d5de0a0daf39f60f33dbc5891eb9c1cb64934b86393d4 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubdomains; X-Frame-Options SAMEORIGIN Request headers Referer https://www.freefire.com-0ffer.com/ Origin https://www.freefire.com-0ffer.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type application/x-www-form-urlencoded Response headers date Sun, 15 Dec 2019 17:14:47 GMT content-encoding br cf-cache-status DYNAMIC status 200 strict-transport-security max-age=63072000; includeSubdomains; alt-svc h3-24=":443"; ma=86400, h3-23=":443"; ma=86400 pragma no-cache server cloudflare x-frame-options SAMEORIGIN expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/html; charset=UTF-8 access-control-allow-origin * cache-control no-store, no-cache, must-revalidate cf-ray 545a0e4f2a7acbc4-VIE expires Thu, 19 Nov 1981 08:52:00 GMT
GET H2	200	popup-maker-icon-brand.png popupmaker.com/public/assets/media/images/	1 KB 1 KB	18ms 18ms	Image image/webp	2606:4700:20::681a:fb7 Cloudflare
General Check archive.org Show headers Download Go to Show image Full URL https://popupmaker.com/public/assets/media/images/popup-maker-icon-brand.png Requested by Host: www.freefire.com-0ffer.com URL: https://www.freefire.com-0ffer.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::681a:fb7 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 2956908d3187f7509fdaba91a14ad1a5d2c591cd25cac5b5ad6e44b69f52fa9d Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubdomains; X-Frame-Options SAMEORIGIN Request headers Referer https://www.freefire.com-0ffer.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Sun, 15 Dec 2019 17:14:47 GMT vary Accept cf-cache-status HIT age 2144824 cf-polished origFmt=png, origSize=2697 status 200 content-disposition inline; filename="popup-maker-icon-brand.webp" alt-svc h3-24=":443"; ma=86400, h3-23=":443"; ma=86400 content-length 1078 last-modified Tue, 20 Feb 2018 17:03:37 GMT server cloudflare x-frame-options SAMEORIGIN etag "a89-565a7caa97f1f" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=63072000; includeSubdomains; content-type image/webp access-control-allow-origin * cache-control public, max-age=2678400 accept-ranges bytes cf-ray 545a0e4fa82f8cb6-VIE cf-bgj imgq:85
POST H2	201	raw-data Show response heatmap.services/api/	33 B 396 B	250ms 236ms	Fetch application/json	130.211.30.60 Google LLC
General Check archive.org Show headers Download Go to Full URL https://heatmap.services/api/raw-data Requested by Host: heatmap.services URL: https://heatmap.services/static/lib.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 130.211.30.60 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS 60.30.211.130.bc.googleusercontent.com Software / Resource Hash aeae628bb5c58695aeeb38d775b0d3e58f0d3448679f5f2a1c9038cc63ae2156 Security Headers Name Value Strict-Transport-Security max-age=15552000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://www.freefire.com-0ffer.com/ Origin https://www.freefire.com-0ffer.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers strict-transport-security max-age=15552000; includeSubDomains via 1.1 google x-content-type-options nosniff x-dns-prefetch-control off status 201 date Sun, 15 Dec 2019 17:14:55 GMT alt-svc clear content-length 33 x-xss-protection 1; mode=block etag W/"21-OGHiFV/OrNujBxibS2uM6bqKAHs" x-download-options noopen x-frame-options SAMEORIGIN content-type application/json; charset=utf-8 access-control-allow-origin https://www.freefire.com-0ffer.com vary Origin, Accept-Encoding access-control-allow-credentials true

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Garena Free Fire (Gaming)

80 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate object| SGPMPopupLoader function| sgp object| __variantsData number| __page_id number| __default_experience_id number| __version string| __variant string| __variant_custom_name boolean| __preview number| __page_type string| __variant_hash string| __page_domain number| __predator_throttle object| __predator_blacklist boolean| __page_generator object| _Translate object| webpackJsonp object| core object| __core-js_shared__ object| __eventBus object| __config number| __workspaceWidth string| SGPM_APP_URL string| SGPM_STATS_URL string| SGPM_WEBPUSH_URL string| SGPM_POPUP_ID string| SGPM_MAIN_DIV object| SGPM_MAIN_DIV_DEFAULT_CONTENT object| SGPM_MAIN_DIV_OBJ object| SGPM_POPUP_STATISTICS boolean| SGPM_HAS_SEND_DATA string| SGPM_USER_PAGE_BODY_STYLES number| SGPM_DISABLE_PAGE_SCROLLING_POPUP_COUNT number| PUSH_AUTORESPONDER_IS_NOT_DRAFT function| SGPMPopup function| SGP function| sgpmPreventDefault function| sgpmPreventDefaultForScrollKeys function| SGStatistics function| SGIntegrations function| SGGoogleAnalytics function| sgpSpinToWin function| Pin function| Animation function| Segment function| PointerGuide function| sgpSpinToWinPercentToDegrees function| sgpSpinToWinAnimationLoop function| sgpSpinToWinStopAnimation function| sgpSpinToWinLoadedImage object| sgpSpinToWinToDrawDuringAnimation boolean| winhweelAlreadyDrawn object| _gsScope function| SGPMSpinner function| SGPMFacebook function| SGPMFloatingButton object| _gsQueue object| GreenSockGlobals object| com function| _gsDefine function| Ease function| Power4 function| Strong function| Quint function| Power3 function| Quart function| Power2 function| Cubic function| Power1 function| Quad function| Power0 function| Linear function| sgpHelperFree function| sgpmTweenPlugin function| sgpHelper object| SGPMSpinnerObjects object| _htmp string| SGPM_USER_PAGE_HTML_STYLES

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://heatmap.services/static/lib.js(Line 1) Message: HEATMAP EVENTS COLLECTING BLOCKED

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.googleapis.com
fonts.gstatic.com
g.fastcdn.co
heatmap.services
popupmaker.com
v.fastcdn.co
www.freefire.com-0ffer.com
130.211.30.60
192.229.133.208
198.54.116.175
2606:4700:20::681a:fb7
2a00:1450:4001:809::2003
2a00:1450:4001:819::200a
35.244.137.202
01cfcee4e1150976147d5de0a0daf39f60f33dbc5891eb9c1cb64934b86393d4
0a733c9a259685cf9a9816145434c0087227f35400e16208e7e63e58ccd44538
10738357753c861b8a7d36ba5f11516994ecf54797a58f45d9ee8c267dd42d79
1b2b8285d6a8fd0d46225d08b96b01ec76639f4d46d4559fb8143de2c4525e59
1b90cf4d5783a7e2406add11bdc55333d82ce25523ca561a502e802a972d0ef1
2956908d3187f7509fdaba91a14ad1a5d2c591cd25cac5b5ad6e44b69f52fa9d
3cc1125c735264f13b78e7fd74f8abb302bd4d2b76bf1aa36dbb6ad70aa7ca98
433508e4927849dff0b4a2850de3eb6a99e94140220715432911c48de77a6fd8
54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775
77187de7f83031f12fd13c8fc56b656549eeffa84477ca44bff95153c224b646
7d423a9febe15a0966afa958512506768c74f4fda6d04098e8a7a3a27ef3fdb9
a48a6e4b14fe55f750c0a3dfb5a6f4941bdc06af0aa542b90de25c30c2b4625c
a61931a55615c95d6cbffdeb1efa0f25f2a64ab8db2f13536d651df782bbeeb2
aeae628bb5c58695aeeb38d775b0d3e58f0d3448679f5f2a1c9038cc63ae2156
b12d7390660c8371a63995931b44499f66a60811e89ff701355e99aa6e682a85
bb2255aa2f6ae692672c7e6703b9c91d14c6e741f6c89ba6dfc46cab34d32904
c21305dcdd5cb1227ffc14b837757c09741cec5026d6bd5634337f839ca8c64a