![](/screenshots/cc2a7577-8acf-46e5-a998-d15fe63c9bc4.png)
herucro.grarena.vn
Open in
urlscan Pro
188.114.96.3
Malicious Activity!
Public Scan
Submission: On June 18 via api from US — Scanned from NL
Summary
TLS certificate: Issued by E1 on May 24th 2024. Valid for: 3 months.
This is the only time herucro.grarena.vn was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Facebook (Social Network)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
3 | 188.114.96.3 188.114.96.3 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 125.212.198.71 125.212.198.71 | 7552 (VIETEL-AS...) (VIETEL-AS-AP Viettel Group) | |
5 | 3 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
3 |
grarena.vn
herucro.grarena.vn |
65 KB |
1 |
garena.vn
www.garena.vn |
15 KB |
0 |
fbcdn.net
Failed
static.xx.fbcdn.net Failed |
|
5 | 3 |
Domain | Requested by | |
---|---|---|
3 | herucro.grarena.vn |
herucro.grarena.vn
|
1 | www.garena.vn |
herucro.grarena.vn
|
0 | static.xx.fbcdn.net Failed | |
5 | 3 |
This site contains links to these domains. Also see Links.
Domain |
---|
m.facebook.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
grarena.vn E1 |
2024-05-24 - 2024-08-22 |
3 months | crt.sh |
garena.vn R3 |
2024-04-24 - 2024-07-23 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://herucro.grarena.vn/CWaePt89TU1yQ8qCFv0G53tlqrOchop7lM8NEyCr6FyiZYGoR0Xc3WW9aWcWS6HfLcCRV5vuK8aWpn46jOdRq6pS9seqlvujBznMF
Frame ID: 0BD90E1E78FF83082D176EB461E2D791
Requests: 5 HTTP requests in this frame
2 Outgoing links
These are links going to different origins than the main page.
Title: Tạo tài khoản mới
Search URL Search Domain Scan URL
Title: Quên mật khẩu?
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
5 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H3 |
Primary Request
CWaePt89TU1yQ8qCFv0G53tlqrOchop7lM8NEyCr6FyiZYGoR0Xc3WW9aWcWS6HfLcCRV5vuK8aWpn46jOdRq6pS9seqlvujBznMF
herucro.grarena.vn/ |
10 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
fbs.css
herucro.grarena.vn/asset/css/ |
132 KB 32 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo@2x.c05a558a.png
www.garena.vn/img/ |
15 KB 15 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
jT0UEYSEi4D.png
herucro.grarena.vn/asset/images/ |
30 KB 30 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET |
O2aKM2iSbOw.png
static.xx.fbcdn.net/rsrc.php/v3/ya/r/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- static.xx.fbcdn.net
- URL
- https://static.xx.fbcdn.net/rsrc.php/v3/ya/r/O2aKM2iSbOw.png
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Facebook (Social Network)3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
undefined| event object| fence object| sharedStorage1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
herucro.grarena.vn/ | Name: PHPSESSID Value: 1661b6a63a6fb38a81eddd823903d8ea |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
herucro.grarena.vn
static.xx.fbcdn.net
www.garena.vn
static.xx.fbcdn.net
125.212.198.71
188.114.96.3
1f59a7fab2eb8cb3a0e3ea4f155e248c8c911b1671ea8d1b363dc1dde4954db5
2fdedb01d344ffa48d95b12f38bf848b69b27e9fca1c7da6dc99b55c7483dc5e
55514cd813ae8d7e240c03c86600a8419ec4c5cc1485daadd2c21ae42f579c20
a4ecc72a8b783b91faa49e534658571c18b5fc72a50d0c85c4ae316ca9825b17