membership.ff.garenaw.vn
Open in
urlscan Pro
103.195.237.150
Malicious Activity!
Public Scan
Submission: On March 28 via automatic, source openphish — Scanned from DE
Summary
TLS certificate: Issued by R3 on March 23rd 2024. Valid for: 3 months.
This is the only time membership.ff.garenaw.vn was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Garena Free Fire (Gaming)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
22 | 103.195.237.150 103.195.237.150 | 140827 (DULIEUAZ-...) (DULIEUAZ-AS-VN AZ VIET NAM COMMUNICATIONS TECHNOLOGY COMPANY LIMITED) | |
1 | 104.18.11.207 104.18.11.207 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 104.17.24.14 104.17.24.14 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 45.119.240.104 45.119.240.104 | 131418 (VIETNAMES...) (VIETNAMESPORTS-AS-VN Vietnam Esports Development Joint Stock Company) | |
27 | 5 |
ASN140827 (DULIEUAZ-AS-VN AZ VIET NAM COMMUNICATIONS TECHNOLOGY COMPANY LIMITED, VN)
membership.ff.garenaw.vn |
ASN131418 (VIETNAMESPORTS-AS-VN Vietnam Esports Development Joint Stock Company, VN)
cdn.vn.garenanow.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
22 |
garenaw.vn
membership.ff.garenaw.vn |
1 MB |
2 |
garenanow.com
cdn.vn.garenanow.com — Cisco Umbrella Rank: 229610 |
426 KB |
1 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 234 |
3 KB |
1 |
bootstrapcdn.com
stackpath.bootstrapcdn.com — Cisco Umbrella Rank: 2984 |
25 KB |
0 |
google.com
Failed
docs.google.com Failed |
|
27 | 5 |
Domain | Requested by | |
---|---|---|
22 | membership.ff.garenaw.vn |
membership.ff.garenaw.vn
|
2 | cdn.vn.garenanow.com |
membership.ff.garenaw.vn
|
1 | cdnjs.cloudflare.com |
membership.ff.garenaw.vn
|
1 | stackpath.bootstrapcdn.com |
membership.ff.garenaw.vn
|
0 | docs.google.com Failed |
membership.ff.garenaw.vn
|
27 | 5 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
membership.ff.garenaw.vn R3 |
2024-03-23 - 2024-06-21 |
3 months | crt.sh |
bootstrapcdn.com GTS CA 1P5 |
2024-03-27 - 2024-06-25 |
3 months | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2023-07-03 - 2024-07-02 |
a year | crt.sh |
cdn.vn.garenanow.com ZeroSSL RSA Domain Secure Site CA |
2024-03-09 - 2024-06-07 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://membership.ff.garenaw.vn/bdqzncotkNIery439ASsZ26IO9wQ7Jg0UGxBEqg2xHPFep4IduKAJx3IxMGx6eOSgYasCf5qS2X2DPUgtD8vf7wdDywpnI7bpKgfTP7KayUpgmHiSYjbuoKy8gjGhG0mj7vIfytz4QVGi4ibVWOpDnii5RjROboV1HDMjXhQkifabmoZvPN9T4sfzxFlZPiorKmZRbQ7YXZKDkBdmzNvMyC3YpOqYd8dnGD.html
Frame ID: 863C535AEA8A4E93407D3C6C73BF88E9
Requests: 28 HTTP requests in this frame
Screenshot
Page Title
Garena Free Fire MembershipDetected technologies
Bootstrap (Web Frameworks) ExpandDetected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
27 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
bdqzncotkNIery439ASsZ26IO9wQ7Jg0UGxBEqg2xHPFep4IduKAJx3IxMGx6eOSgYasCf5qS2X2DPUgtD8vf7wdDywpnI7bpKgfTP7KayUpgmHiSYjbuoKy8gjGhG0mj7vIfytz4QVGi4ibVWOpDnii5RjROboV1HDMjXhQkifabmoZvPN9T4sfzxFlZPiorKmZR...
membership.ff.garenaw.vn/ |
150 KB 31 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
bootstrap.min.css
stackpath.bootstrapcdn.com/bootstrap/4.1.3/css/ |
138 KB 25 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
jquery.fancybox.min.css
cdnjs.cloudflare.com/ajax/libs/fancybox/3.4.1/ |
14 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
login.css
membership.ff.garenaw.vn/css/ |
171 KB 31 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
app.b1f17912.css
membership.ff.garenaw.vn/css/ |
135 KB 14 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
chunk-vendors.737c64e5.css
membership.ff.garenaw.vn/css/ |
96 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
app.2a0a3444.js
membership.ff.garenaw.vn/js/ |
8 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
chunk-vendors.af4be1be.js
membership.ff.garenaw.vn/js/ |
456 KB 88 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
chunk-ebcca810.fc5c29f8.css
membership.ff.garenaw.vn/css/ |
0 369 B |
Other
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
chunk-10a81ae2.aad79b3d.js
membership.ff.garenaw.vn/js/ |
0 27 KB |
Other
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
chunk-ebcca810.0be768b5.js
membership.ff.garenaw.vn/js/ |
0 12 KB |
Other
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST |
formResponse
docs.google.com/forms/d/e/1FAIpQLSeFA1qo8Qro-R9b_xTBaNbN6Z4QzpOcIBtR5O16bBlqIgnVLA/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
chunk-10a81ae2.ec7605e3.css
membership.ff.garenaw.vn/css/ |
163 B 205 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
chunk-10a81ae2.aad79b3d.js
membership.ff.garenaw.vn/js/ |
145 KB 29 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
dob-bg.png
membership.ff.garenaw.vn/images/ |
64 KB 64 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
spin-bg.png
membership.ff.garenaw.vn/images/ |
584 KB 584 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
red-bg-2.png
membership.ff.garenaw.vn/images/ |
38 KB 39 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
select-arr.png
membership.ff.garenaw.vn/images/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
266 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
yellow-bg.png
membership.ff.garenaw.vn/images/ |
7 KB 7 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
logout.29f7cada.png
membership.ff.garenaw.vn/img/ |
15 KB 15 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Vip-Membership.jpg
cdn.vn.garenanow.com/web/ff/ff_membership/item/ |
415 KB 416 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
spin-title.png
membership.ff.garenaw.vn/images/ |
708 B 708 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
btn_history.c6c98836.png
membership.ff.garenaw.vn/img/ |
19 KB 19 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
dob-title.b8c16371.png
membership.ff.garenaw.vn/img/ |
34 KB 35 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
btn-bod-deactive.5810d0f4.png
membership.ff.garenaw.vn/img/ |
9 KB 10 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
fb_ico.png
membership.ff.garenaw.vn/images/ |
13 KB 13 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
fav.jpg
cdn.vn.garenanow.com/web/ff/ |
10 KB 10 KB |
Other
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- docs.google.com
- URL
- https://docs.google.com/forms/d/e/1FAIpQLSeFA1qo8Qro-R9b_xTBaNbN6Z4QzpOcIBtR5O16bBlqIgnVLA/formResponse
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Garena Free Fire (Gaming)4 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onpagereveal object| webpackJsonp object| $cookies function| $3 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
membership.ff.garenaw.vn/ | Name: PHPSESSID Value: e44e762060aa706f4bbef1de670702f6 |
|
membership.ff.garenaw.vn/ | Name: COCAILON_BUG_NHE_BY_VANHIEN Value: eqstafDTUhCI2k3Kp4y5nY8MFWRlc1Bmg9v7zbO6HoNE |
|
membership.ff.garenaw.vn/ | Name: session Value: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjoxLCJyb2xlIjoiYWRtaW4iLCJleHAiOjE3MTE1ODgyMTF9.IJ5ecuBf39cDEJo1moqP6zbF_cyU4K4Dsx6UXv0eDIo |
3 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn.vn.garenanow.com
cdnjs.cloudflare.com
docs.google.com
membership.ff.garenaw.vn
stackpath.bootstrapcdn.com
docs.google.com
103.195.237.150
104.17.24.14
104.18.11.207
45.119.240.104
060291a83be9a0518f6b89d574c545d48ee6105a78d662e1e2e694d5fccda61c
08b4fd9ad05fda425046b58c390ef38abeb735eeea6fcb9790e146485ff0efd7
168d31d28b3aa31247135234a8adb526f3b7f64cabd3120985b462ca21c58fa9
1cf5f20201731ef6a00203de4229f28a52e9a1c3e978f1cc63fe04876936a62f
24596c64d4d04c684a3c2b4d6d3926d40cd6ee1f27c76a9ceddec6e25454a98a
253b122240afb4194196b937565d72fd65f8c5f92da687b3983f316d2da5d907
28e0bd6ab428b72bf9013b4423ce4fcc42bf4e894f37e1d5bb3f93ec729dbd5c
37a4e56c497e170de6e152bc479624eb8d7ccb35bad5a190f2fdb17ac699cffa
3ae09ef678cacb0fc6be8d17dc403c2b8049ffdb302e591189331ae71307b447
466183461b2bcaa6068e573e538e4159243625a3fd6e59ec1b3b5e3dbbd3e542
4e0582cc334483c80c60f70233200a8c60999b4e9ac30beae05ab46eb49f80b1
54fff3ea08a8e931d301109e72a14b34d633fa9e1de77efd49ab5fc42a2eaebc
662294921ca6240beb0f2aecb7f7ac23dd085b782bbe52a369b20226d26afe33
668531f1515acd2c3e3503a7af0f9e6259ef91aef30c56f2485c0816c5648291
78e2ca75fcafa1dd58eefb124e508648a756f1d3c7a83e42e5d46bf8df06c26c
7928b5ab63c6e89ee0ee26f5ef201a58c72baf91abb688580a1aa26eb57b3c11
93edab30fde28fbcb7cae59fbadc3bc77b9f47c1625a17ecc2f499bbf1f5afc9
a02fd0f27a964a5a756e48b71edf6044259a7b0e67ebf1cd935d074f86845f8c
a229865cad68073c0190603cf6b158fb90822271c33a9ab4634bd0020a46fd7c
cdad3a6bbc25a0e1d4a3f2feaa607377f7eb0fb14f39b12169d66a214155ffea
cddcd8f6c71ce01d19c2e704ebdb5954d9f9ebefb25df5de1eb437b1d09a1c04
d4b543fbd9ec68332b9d3af5f2253e02e7f262c41f87452fea20e4cbfc7e4a68
d9cedaad57e7213133b32c744d209c1e8e55c33357b95e3c0c79487302f6efbe
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e71dfbb5eb4e822877c51d6b9a90610e19045f283ff0dacda0dc5c25ce91d372