![](/screenshots/f51ba928-014c-4c5c-96d2-6e99baf1b131.png)
faceit-5rg.pages.dev
Open in
urlscan Pro
2a06:98c1:3120::3
Malicious Activity!
Public Scan
Effective URL: https://faceit-5rg.pages.dev/
Submission: On July 22 via api from US — Scanned from NL
Summary
TLS certificate: Issued by WE1 on June 9th 2024. Valid for: 3 months.
This is the only time faceit-5rg.pages.dev was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Cloudflare (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 6 | 2a06:98c1:312... 2a06:98c1:3120::3 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
9 | 199.232.192.193 199.232.192.193 | 54113 (FASTLY) (FASTLY) | |
8 | 162.19.58.159 162.19.58.159 | 16276 (OVH) (OVH) | |
3 | 2a00:1450:400... 2a00:1450:4001:827::2003 | 15169 (GOOGLE) (GOOGLE) | |
1 | 104.19.156.82 104.19.156.82 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 188.114.97.3 188.114.97.3 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
27 | 6 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
9 |
imgur.com
i.imgur.com — Cisco Umbrella Rank: 7108 |
36 KB |
8 |
ibb.co
i.ibb.co — Cisco Umbrella Rank: 9712 |
1 MB |
6 |
pages.dev
1 redirects
faceit-5rg.pages.dev |
45 KB |
3 |
gstatic.com
fonts.gstatic.com |
43 KB |
1 |
cdnstat.net
cdnstat.net — Cisco Umbrella Rank: 293359 |
704 B |
1 |
faceit.com
www.faceit.com — Cisco Umbrella Rank: 53051 |
2 KB |
27 | 6 |
Domain | Requested by | |
---|---|---|
9 | i.imgur.com |
faceit-5rg.pages.dev
|
8 | i.ibb.co |
faceit-5rg.pages.dev
|
6 | faceit-5rg.pages.dev |
1 redirects
faceit-5rg.pages.dev
|
3 | fonts.gstatic.com |
faceit-5rg.pages.dev
|
1 | cdnstat.net |
faceit-5rg.pages.dev
|
1 | www.faceit.com | |
27 | 6 |
This site contains links to these domains. Also see Links.
Domain |
---|
support.faceit.com |
cs.money |
www.twitch.tv |
buff.market |
dmarket.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
faceit-5rg.pages.dev WE1 |
2024-06-09 - 2024-09-07 |
3 months | crt.sh |
*.imgur.com Sectigo RSA Domain Validation Secure Server CA |
2024-02-15 - 2025-02-14 |
a year | crt.sh |
ibb.co R10 |
2024-06-21 - 2024-09-19 |
3 months | crt.sh |
*.gstatic.com WR2 |
2024-06-24 - 2024-09-16 |
3 months | crt.sh |
faceit.com E5 |
2024-06-09 - 2024-09-07 |
3 months | crt.sh |
cdnstat.net WE1 |
2024-07-09 - 2024-10-07 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://faceit-5rg.pages.dev/
Frame ID: 680463C566FD1AB359D44896503C4583
Requests: 27 HTTP requests in this frame
Screenshot
![](/screenshots/f51ba928-014c-4c5c-96d2-6e99baf1b131.png)
Page Title
FACEITPage URL History Show full URLs
-
http://faceit-5rg.pages.dev/
HTTP 307
https://faceit-5rg.pages.dev/ Page URL
-
https://faceit-5rg.pages.dev/cdn-cgi/phish-bypass?atok=53KSlRGjCxzttKYdXku9TD2WMnqpB9_mf.25GXmmd6s-172163...
HTTP 301
https://faceit-5rg.pages.dev/ Page URL
Page Statistics
5 Outgoing links
These are links going to different origins than the main page.
Title: Contact FACEIT Support
Search URL Search Domain Scan URL
Title: GO
Search URL Search Domain Scan URL
Title: GO
Search URL Search Domain Scan URL
Title: GO
Search URL Search Domain Scan URL
Title: GO
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://faceit-5rg.pages.dev/
HTTP 307
https://faceit-5rg.pages.dev/ Page URL
-
https://faceit-5rg.pages.dev/cdn-cgi/phish-bypass?atok=53KSlRGjCxzttKYdXku9TD2WMnqpB9_mf.25GXmmd6s-1721636866-0.0.1.1-%2F
HTTP 301
https://faceit-5rg.pages.dev/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://faceit-5rg.pages.dev/ HTTP 307
- https://faceit-5rg.pages.dev/
27 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
/
faceit-5rg.pages.dev/ Redirect Chain
|
4 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cf.errors.css
faceit-5rg.pages.dev/cdn-cgi/styles/ |
23 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icon-exclamation.png
faceit-5rg.pages.dev/cdn-cgi/images/ |
452 B 540 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
favicon.ico
faceit-5rg.pages.dev/ |
46 KB 19 KB |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
/
faceit-5rg.pages.dev/ Redirect Chain
|
46 KB 18 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
7XbnZSg.png
i.imgur.com/ |
852 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
P60LEWb.png
i.imgur.com/ |
484 B 937 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
L35PCVr.png
i.imgur.com/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
X0NEpA4.png
i.imgur.com/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
J4MMOE4.png
i.imgur.com/ |
2 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
J7K00Tx.png
i.imgur.com/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ez63twu.png
i.imgur.com/ |
8 KB 8 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
WEy45I9.png
i.imgur.com/ |
7 KB 7 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
QkI8KaV.png
i.imgur.com/ |
8 KB 9 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1.png
i.ibb.co/ssFs2Pd/ |
168 KB 168 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
2.png
i.ibb.co/5j9WsfF/ |
21 KB 21 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
3.png
i.ibb.co/WDpW4Fy/ |
6 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
4.png
i.ibb.co/zm8PW4c/ |
17 KB 17 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ready-background.jpg
i.ibb.co/SNFX15n/ |
212 KB 212 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
world-map-min.jpg
i.ibb.co/5LP9h5k/ |
69 KB 70 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1v1.jpg
i.ibb.co/yB2QhjH/ |
340 KB 340 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
2v2.jpg
i.ibb.co/XJ0NYTz/ |
361 KB 361 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
6ae84K2oVqwItm4TCpAy2g.woff2
fonts.gstatic.com/s/play/v17/ |
17 KB 17 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
6aez4K2oVqwIvtU2Hw.woff2
fonts.gstatic.com/s/play/v17/ |
17 KB 17 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
6aez4K2oVqwIvtE2H68T.woff2
fonts.gstatic.com/s/play/v17/ |
9 KB 9 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
favicon.ico
www.faceit.com/ |
5 KB 2 KB |
Other
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
script.js
cdnstat.net/get/ |
129 B 704 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Cloudflare (Online)16 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| _QT9 string| _2C3X string| _L75 string| _K5g string| _004 string| _J0W string| _OW2p string| _5q string| _N6xp string| _9Q number| _jT2a string| _5e3 number| _S5 function| openConnectPopup function| openTermsPopup function| disableBtn4 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.faceit-5rg.pages.dev/ | Name: __cf_mw_byp Value: 53KSlRGjCxzttKYdXku9TD2WMnqpB9_mf.25GXmmd6s-1721636866-0.0.1.1-/ |
|
faceit-5rg.pages.dev/ | Name: PHPREFS Value: full |
|
.faceit.com/ | Name: __cf_bm Value: WC_Y8iDJnCqxbi3W2EC96yFHiJMBTGFQ6.PNBv4cLWk-1721636871-1.0.1.1-laDV8gQGZHhfWDOPMqSerkLzuxNZ.CeyGiLl_HrqFLJDGNb_c33fZABhUEjXVLhuJ1ipdHmF2SV4gsw3WndeLQvWvDSdoyqAdQx5VEqyU_c |
|
.faceit.com/ | Name: _cfuvid Value: VsNuTI6YMgBTYlPIvcqQZ13CO0W7A45blyI7eL7JpGc-1721636871679-0.0.1.1-604800000 |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Frame-Options | SAMEORIGIN |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdnstat.net
faceit-5rg.pages.dev
fonts.gstatic.com
i.ibb.co
i.imgur.com
www.faceit.com
104.19.156.82
162.19.58.159
188.114.97.3
199.232.192.193
2a00:1450:4001:827::2003
2a06:98c1:3120::3
0764669b525cb81e15ec2b2010188ccbd1d5eb2627fcf7a0ce8b70049f43840f
0a0b2e06aca410dbbce8efab8761241f7f7efe1f96bd0c13dff002586a9d4d9a
18cb0e1c7d39ece838a160f7782155630bd43e571abd996ef3727f6f42281630
1a7b07970a0697effb73e93505dc56b2efbbdb1cee798a55a79db5bd157e00ab
35823a6b96d1200ea297d4e0f860fed749dde7e4cac0e120b8a769af64f26c2f
5e7226dfd40e6fefdc31db3d066808d9a6d707fff90fe4984a5f201a2a0eeec0
62f05b1aea9b70ecbcdb250b2b42d67540599b54d6063f8d83e3d8294bbdf976
669ad8e27574eb5e9fcf9af7c0e103081d7e5be1ac28cd7c3d110591a8dfab88
6a5148df7cbd1ecbadc60edacc05cc2d6e494bb44eb371964dd10c3019f79afd
6cdceb438e41ee07d58b7214785e14651205d8cc4b158a9a3ab988515f66c1cc
7165d445288030439c1c40a6d41200abec951e1bf311057701b3e4b1d0a43e41
747bc5a390ea7d554ef9e178106aa4f901079fd903d2e94bf8273c1d97fdf12b
75c7f83cb19b60e80c7e7f0bae3ef22e0d815506a4b7c0a6fbf36ff89cf6d6f9
7af5bee9a5a771db6f21d19f7cb902d3cf5edea845237a68992ad37aefdc0c84
7b9f5bf189b2e828b2d2c7abc618d09d42e90011a163ee6ed211be5857c8dbaf
84e3c77025ace5af143972b4a40fc834dcdfd4e449d4b36a57e62326f16b3091
8f752b81dc0a3aa29edaa55262ebc397a6c947b15c1965698656f6f94162a787
943539bb6240b231bdcb25603fde021415d23af32f970ba3b3a89ee8e08a2ade
a7ff7a75bb91407c0f8e1ec5d3b690cbd056b62707a41eee841d2af7d5c25aca
bd8196812eb8c3ec8a7d3917325ee18aaff5b00f37f95a98f90063f2dea05ef9
c34584c7592e33b263d36a92bee9c2a15e2e83546f4382e63b9bd2d2327e5db7
c59a3960888d96b3748601b9b77df171bafa3d53289ec4b8b6db3d474e9a39e1
d41724ee7d55f9ff344cc8ea78f375e39d0f841cd256a3f657fb0c1585aa3925
f0345403114c1ac3c1873aaa9798edcb80ff5ccd33ea0d40a97f1cd2572a2771
f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016
f906de1efcc91a26b620b98bc2fb3459a1164eed6cd6a1981a0332c55e87d48f