csgofast.pro Open in urlscan Pro
2606:4700:3032::681b:a2df Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://csgofast.pro/
Submission: On April 28 via automatic, source phishtank (April 28th 2020, 3:41:52 pm UTC)

Summary HTTP 24 Redirects Behaviour Indicators

Summary

This website contacted 7 IPs in 3 countries across 6 domains to perform 24 HTTP transactions. The main IP is 2606:4700:3032::681b:a2df, located in United States and belongs to CLOUDFLARENET, US. The main domain is csgofast.pro.
TLS certificate: Issued by CloudFlare Inc ECC CA-2 on April 28th 2020. Valid for: 5 months.

This is the only time csgofast.pro was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: CSGOEmpire (Gaming)

Domain & IP information

	IP Address	AS Autonomous System
4	2606:4700:303... 2606:4700:3032::681b:a2df	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6810:84e5	13335 (CLOUDFLAR...) (CLOUDFLARENET)
14	2a00:f940:2:2... 2a00:f940:2:2:1:1:0:89	197695 (AS-REG) (AS-REG)
2	2606:4700:10:... 2606:4700:10::6816:706	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	151.101.12.193 151.101.12.193	54113 (FASTLY) (FASTLY)
1	194.58.56.190 194.58.56.190	197695 (AS-REG) (AS-REG)
24	7

4 2606:4700:3032::681b:a2df (United States)

ASN13335 (CLOUDFLARENET, US)

csgofast.pro	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:84e5 (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 2a00:f940:2:2:1:1:0:89 (Russian Federation)

ASN197695 (AS-REG, RU)

dallowin.fun	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:10::6816:706 (United States)

ASN13335 (CLOUDFLARENET, US)

csgoempire.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.12.193 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

i.imgur.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 194.58.56.190 (Russian Federation)

ASN197695 (AS-REG, RU)

dallowin.site	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
14	dallowin.fun dallowin.fun	503 KB
4	csgofast.pro csgofast.pro	224 KB
2	imgur.com i.imgur.com	32 KB
2	csgoempire.com csgoempire.com
1	dallowin.site dallowin.site
1	cloudflare.com cdnjs.cloudflare.com	30 KB
24	6

	Domain	Requested by
14	dallowin.fun	csgofast.pro
4	csgofast.pro	csgofast.pro
2	i.imgur.com	csgofast.pro
2	csgoempire.com	csgofast.pro
1	dallowin.site	csgofast.pro
1	cdnjs.cloudflare.com	csgofast.pro
24	6

This site contains no links.

Subject Issuer	Validity	Valid
sni.cloudflaressl.com CloudFlare Inc ECC CA-2	`2020-04-28` - `2020-10-09`	5 months	crt.sh
cloudflare.com CloudFlare Inc ECC CA-2	`2020-01-07` - `2020-10-09`	9 months	crt.sh
dallowin.fun Let's Encrypt Authority X3	`2020-04-26` - `2020-07-25`	3 months	crt.sh
csgoempire.com CloudFlare Inc ECC CA-2	`2020-03-26` - `2020-10-09`	6 months	crt.sh
*.imgur.com DigiCert SHA2 Secure Server CA	`2020-01-15` - `2022-03-16`	2 years	crt.sh
*.reg.ru AlphaSSL CA - SHA256 - G2	`2020-02-12` - `2021-02-12`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://csgofast.pro/
Frame ID: 2928C96A3EEAF380F46E1C26A8BF0B2E
Requests: 26 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery[.-]([\d.]*\d)[^/]*\.js/i
script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

24
Requests

96 %
HTTPS

67 %
IPv6

6
Domains

6
Subdomains

7
IPs

3
Countries

789 kB
Transfer

2075 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

24 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
csgofast.pro/ 659 KB
91 KB 372ms
185ms Document
text/html 2606:4700:3032::681b:a2df
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://csgofast.pro/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3032::681b:a2df , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: de7ec5b6e98c09013776d4bf6938020d6e8ab5de79a94fe8f490c8b3faae0eaf

Request headers

:method: GET
:authority: csgofast.pro
:scheme: https
:path: /
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 200
date: Tue, 28 Apr 2020 15:41:29 GMT
content-type: text/html; charset=UTF-8
set-cookie: __cfduid=d79d7f61dcb0647cd6b39f0201b17e08e1588088489; expires=Thu, 28-May-20 15:41:29 GMT; path=/; domain=.csgofast.pro; HttpOnly; SameSite=Lax; Secure
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 58b1e341ee4bd721-FRA
content-encoding: br
cf-request-id: 02630c5d2d0000d721c09e3200000001

GET
H2 200 jquery.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/ 86 KB
30 KB 33ms
30ms Script
application/javascript 2606:4700::6810:84e5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/jquery.min.js

Requested by

Host: csgofast.pro
URL: https://csgofast.pro/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:84e5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000; includeSubDomains

Request headers

Referer: https://csgofast.pro/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 28 Apr 2020 15:41:29 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
age: 24047624
status: 200
alt-svc: h3-27=":443"; ma=86400, h3-25=":443"; ma=86400, h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
cf-request-id: 02630c5df4000097f6d5376200000001
served-in-seconds: 0.003
timing-allow-origin: *
last-modified: Wed, 01 May 2019 21:45:59 GMT
server: cloudflare
etag: W/"5cca1397-15851"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000; includeSubDomains
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
cf-ray: 58b1e3432cb197f6-FRA
expires: Sun, 18 Apr 2021 15:41:29 GMT

GET
H2 200 main.js Show response
dallowin.fun/csgoempire/js/ 10 KB
3 KB 348ms
40ms Script
application/javascript 2a00:f940:2:2:1:1:0:89
AS-REG

General

Check archive.org

Show headers Download Go to

Full URL: https://dallowin.fun/csgoempire/js/main.js
Requested by: Host: csgofast.pro
URL: https://csgofast.pro/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a00:f940:2:2:1:1:0:89 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS
Software: nginx /
Resource Hash: f8db1f81e843910fe0962c4a11ee5fab8833e9fc3da86002e376c47eee656571

Request headers

Referer: https://csgofast.pro/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 28 Apr 2020 15:41:29 GMT
content-encoding: gzip
last-modified: Mon, 27 Apr 2020 14:18:53 GMT
server: nginx
etag: W/"5ea6e9cd-260c"
vary: Accept-Encoding
content-type: application/javascript
status: 200

GET
H2 200 users_list.js Show response
dallowin.fun/csgoempire/js/ 19 KB
4 KB 349ms
41ms Script
application/javascript 2a00:f940:2:2:1:1:0:89
AS-REG

General

Check archive.org

Show headers Download Go to

Full URL: https://dallowin.fun/csgoempire/js/users_list.js
Requested by: Host: csgofast.pro
URL: https://csgofast.pro/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a00:f940:2:2:1:1:0:89 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS
Software: nginx /
Resource Hash: 741bde3fac0805829ecd0259029d4d05b6b19a0290f7754cbaeb3ed0e0205e34

Request headers

Referer: https://csgofast.pro/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 28 Apr 2020 15:41:29 GMT
content-encoding: gzip
last-modified: Mon, 27 Apr 2020 14:18:53 GMT
server: nginx
etag: W/"5ea6e9cd-4a2d"
vary: Accept-Encoding
content-type: application/javascript
status: 200

GET
H2 200 chat.js Show response
dallowin.fun/csgoempire/js/ 42 KB
2 KB 385ms
78ms Script
application/javascript 2a00:f940:2:2:1:1:0:89
AS-REG

General

Check archive.org

Show headers Download Go to

Full URL: https://dallowin.fun/csgoempire/js/chat.js
Requested by: Host: csgofast.pro
URL: https://csgofast.pro/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a00:f940:2:2:1:1:0:89 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS
Software: nginx /
Resource Hash: bbded234c3a842951ab210f33368ab859f2ea3e404e0d45ae2df45fc81387721

Request headers

Referer: https://csgofast.pro/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 28 Apr 2020 15:41:29 GMT
content-encoding: gzip
last-modified: Mon, 27 Apr 2020 14:18:53 GMT
server: nginx
etag: W/"5ea6e9cd-a7d5"
vary: Accept-Encoding
content-type: application/javascript
status: 200

GET
H2 200 demo.js Show response
dallowin.fun/csgoempire/js/ 3 KB
1 KB 386ms
78ms Script
application/javascript 2a00:f940:2:2:1:1:0:89
AS-REG

General

Check archive.org

Show headers Download Go to

Full URL: https://dallowin.fun/csgoempire/js/demo.js
Requested by: Host: csgofast.pro
URL: https://csgofast.pro/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a00:f940:2:2:1:1:0:89 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS
Software: nginx /
Resource Hash: cdf54fdf9c0ee0b9d09e77ab0cb2c9bea0dfd6d7df0b3d989595f94b4c30238d

Request headers

Referer: https://csgofast.pro/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 28 Apr 2020 15:41:29 GMT
content-encoding: gzip
last-modified: Mon, 27 Apr 2020 14:18:53 GMT
server: nginx
etag: W/"5ea6e9cd-da3"
vary: Accept-Encoding
content-type: application/javascript
status: 200

GET
H2 404 app.86c2dce2.css
csgoempire.com/css/ 0
0 77ms
39ms Stylesheet
text/html 2606:4700:10::6816:706
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://csgoempire.com/css/app.86c2dce2.css
Requested by: Host: csgofast.pro
URL: https://csgofast.pro/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:706 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://csgofast.pro/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

GET
H2 200 jquery-1.12.4.min.js Show response
csgofast.pro/Content/js/ 153 KB
45 KB 20ms
18ms Script
application/javascript 2606:4700:3032::681b:a2df
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://csgofast.pro/Content/js/jquery-1.12.4.min.js
Requested by: Host: csgofast.pro
URL: https://csgofast.pro/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3032::681b:a2df , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 22b0cbc665aa368c6c638453d06b414e0f2541f1bf2b328eef42d788375d6dc0

Request headers

Referer: https://csgofast.pro/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 28 Apr 2020 15:41:29 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 20 Apr 2020 08:51:42 GMT
server: cloudflare
age: 4180
etag: W/"5e9d629e-26441"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
status: 200
cache-control: max-age=14400
cf-ray: 58b1e34329d4d721-FRA
cf-request-id: 02630c5df60000d721c09f1200000001

GET
H2 200 / Show response
csgofast.pro/Content/js/main.js/ 162 KB
24 KB 193ms
192ms Script
text/javascript 2606:4700:3032::681b:a2df
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://csgofast.pro/Content/js/main.js/
Requested by: Host: csgofast.pro
URL: https://csgofast.pro/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3032::681b:a2df , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b39c7c327d0e87976a5b0a93dcf01e401e30c380060bc7408eabb697e16bffc3

Request headers

Referer: https://csgofast.pro/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Apr 2020 15:41:29 GMT
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type: text/javascript;charset=UTF-8
status: 200
cache-control: no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0
cf-ray: 58b1e34329d5d721-FRA
cf-request-id: 02630c5df60000d721c09f2200000001

GET
H2 206 rollStart.mp3
dallowin.fun/csgoempire/sounds/ 36 KB
36 KB 52ms
51ms Media
audio/mpeg 2a00:f940:2:2:1:1:0:89
AS-REG

General

Check archive.org

Show headers Download Go to

Full URL: https://dallowin.fun/csgoempire/sounds/rollStart.mp3
Requested by: Host: csgofast.pro
URL: https://csgofast.pro/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a00:f940:2:2:1:1:0:89 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS
Software: nginx /
Resource Hash: df773574d4aa5a044fc3110db001c5817e727db82b3d2b19c89dbb9ca7b9306f

Request headers

Referer: https://csgofast.pro/
Accept-Encoding: identity;q=1, *;q=0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Range: bytes=0-

Response headers

date: Tue, 28 Apr 2020 15:41:29 GMT
last-modified: Mon, 27 Apr 2020 14:18:55 GMT
server: nginx
etag: "5ea6e9cf-8e80"
status: 206
content-type: audio/mpeg
Content-Range: bytes 0-36479/36480
Content-Length: 36480

GET
H2 206 rollEnd.mp3
dallowin.fun/csgoempire/sounds/ 4 KB
4 KB 82ms
82ms Media
audio/mpeg 2a00:f940:2:2:1:1:0:89
AS-REG

General

Check archive.org

Show headers Download Go to

Full URL: https://dallowin.fun/csgoempire/sounds/rollEnd.mp3
Requested by: Host: csgofast.pro
URL: https://csgofast.pro/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a00:f940:2:2:1:1:0:89 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS
Software: nginx /
Resource Hash: 6de86f3ce5c7a981d9b6d106986517159cb1a9f81bc9c2facde0ac3a009d67cf

Request headers

Referer: https://csgofast.pro/
Accept-Encoding: identity;q=1, *;q=0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Range: bytes=0-

Response headers

date: Tue, 28 Apr 2020 15:41:29 GMT
last-modified: Mon, 27 Apr 2020 14:18:54 GMT
server: nginx
etag: "5ea6e9ce-e80"
status: 206
content-type: audio/mpeg
Content-Range: bytes 0-3711/3712
Content-Length: 3712

GET
H2 200 banner-mobile.b04cae76.png
dallowin.fun/csgoempire/img// 54 KB
54 KB 100ms
99ms Image
image/png 2a00:f940:2:2:1:1:0:89
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dallowin.fun/csgoempire/img//banner-mobile.b04cae76.png
Requested by: Host: csgofast.pro
URL: https://csgofast.pro/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a00:f940:2:2:1:1:0:89 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS
Software: nginx /
Resource Hash: 9a081c56cc0f14e537d9658921b503a17a093d2243bc998aa18e6259d1886337

Request headers

Referer: https://csgofast.pro/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 28 Apr 2020 15:41:29 GMT
last-modified: Mon, 27 Apr 2020 14:18:47 GMT
server: nginx
etag: "5ea6e9c7-d728"
content-type: image/png
status: 200
accept-ranges: bytes
content-length: 55080

GET
H2 200 banner.934d5f5b.png
dallowin.fun/csgoempire/img// 49 KB
50 KB 99ms
99ms Image
image/png 2a00:f940:2:2:1:1:0:89
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dallowin.fun/csgoempire/img//banner.934d5f5b.png
Requested by: Host: csgofast.pro
URL: https://csgofast.pro/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a00:f940:2:2:1:1:0:89 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS
Software: nginx /
Resource Hash: 9e39788ca7e399a0d5819ab30e68a750daab73e719fc059e3291ce822666d5ef

Request headers

Referer: https://csgofast.pro/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 28 Apr 2020 15:41:29 GMT
last-modified: Mon, 27 Apr 2020 14:18:51 GMT
server: nginx
etag: "5ea6e9cb-c588"
content-type: image/png
status: 200
accept-ranges: bytes
content-length: 50568

GET
H2 200 coin-ct.ebf8a58b.png
dallowin.fun/csgoempire/img// 30 KB
30 KB 41ms
41ms Image
image/png 2a00:f940:2:2:1:1:0:89
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dallowin.fun/csgoempire/img//coin-ct.ebf8a58b.png
Requested by: Host: csgofast.pro
URL: https://csgofast.pro/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a00:f940:2:2:1:1:0:89 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS
Software: nginx /
Resource Hash: 3a1a52e3e4e6efa470f0d7ef308e38307b2b52e9cc4e53c0038295bb123f1e5a

Request headers

Referer: https://csgofast.pro/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 28 Apr 2020 15:41:30 GMT
last-modified: Mon, 27 Apr 2020 14:18:49 GMT
server: nginx
etag: "5ea6e9c9-7716"
content-type: image/png
status: 200
accept-ranges: bytes
content-length: 30486

GET
H2 200 coin-bonus.2acb02bd.png
dallowin.fun/csgoempire/img// 40 KB
40 KB 80ms
79ms Image
image/png 2a00:f940:2:2:1:1:0:89
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dallowin.fun/csgoempire/img//coin-bonus.2acb02bd.png
Requested by: Host: csgofast.pro
URL: https://csgofast.pro/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a00:f940:2:2:1:1:0:89 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS
Software: nginx /
Resource Hash: 1343a51a22cbcb53dbc78797ad32cfb5ff5aed7bac6f2d54171bfdcd864394ce

Request headers

Referer: https://csgofast.pro/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 28 Apr 2020 15:41:30 GMT
last-modified: Mon, 27 Apr 2020 14:18:49 GMT
server: nginx
etag: "5ea6e9c9-a036"
content-type: image/png
status: 200
accept-ranges: bytes
content-length: 41014

GET
H2 200 coin-t.5b1061aa.png
dallowin.fun/csgoempire/img// 73 KB
73 KB 119ms
118ms Image
image/png 2a00:f940:2:2:1:1:0:89
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dallowin.fun/csgoempire/img//coin-t.5b1061aa.png
Requested by: Host: csgofast.pro
URL: https://csgofast.pro/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a00:f940:2:2:1:1:0:89 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS
Software: nginx /
Resource Hash: 79bf43488f3c3d97f9233404f895843fa4bf1e89e7a46cd14204ba7e49c0fa9e

Request headers

Referer: https://csgofast.pro/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 28 Apr 2020 15:41:30 GMT
last-modified: Mon, 27 Apr 2020 14:18:48 GMT
server: nginx
etag: "5ea6e9c8-12354"
content-type: image/png
status: 200
accept-ranges: bytes
content-length: 74580

GET
H2 200 logo.png
dallowin.fun/csgoempire/img/ 50 KB
50 KB 164ms
163ms Image
image/png 2a00:f940:2:2:1:1:0:89
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dallowin.fun/csgoempire/img/logo.png
Requested by: Host: csgofast.pro
URL: https://csgofast.pro/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a00:f940:2:2:1:1:0:89 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS
Software: nginx /
Resource Hash: 6a5310d254d1244f7f4e2f5ff75a2fce78078611a18101b17ccc432ee3ba132f

Request headers

Referer: https://csgofast.pro/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 28 Apr 2020 15:41:30 GMT
last-modified: Mon, 27 Apr 2020 14:18:49 GMT
server: nginx
etag: "5ea6e9c9-c8fd"
content-type: image/png
status: 200
accept-ranges: bytes
content-length: 51453

GET
H2 200 validate.png
dallowin.fun/csgoempire/img/ 50 KB
50 KB 155ms
155ms Image
image/png 2a00:f940:2:2:1:1:0:89
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dallowin.fun/csgoempire/img/validate.png
Requested by: Host: csgofast.pro
URL: https://csgofast.pro/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a00:f940:2:2:1:1:0:89 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS
Software: nginx /
Resource Hash: 85cb45b47e2459d9910bac93e2e738545e7a16e9cd47b5a615579a9696108bb3

Request headers

Referer: https://csgofast.pro/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 28 Apr 2020 15:41:30 GMT
last-modified: Mon, 27 Apr 2020 14:18:49 GMT
server: nginx
etag: "5ea6e9c9-c7b4"
content-type: image/png
status: 200
accept-ranges: bytes
content-length: 51124

GET
H2 404 app.86c2dce2.css
csgoempire.com/css/ 0
0 45ms
22ms Stylesheet
text/html 2606:4700:10::6816:706
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://csgoempire.com/css/app.86c2dce2.css
Requested by: Host: csgofast.pro
URL: https://csgofast.pro/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:706 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://csgofast.pro/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

GET
H2 200 Yv3BGXV.png
i.imgur.com/ 10 KB
10 KB 184ms
59ms Image
image/png 151.101.12.193
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.imgur.com/Yv3BGXV.png
Requested by: Host: csgofast.pro
URL: https://csgofast.pro/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.12.193 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: cat factory 1.0 /
Resource Hash: e65fa1996d070ad33c9ba79b585477094009ca5cdcf88f1af5f4dd816759b850

Request headers

Referer: https://csgofast.pro/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 28 Apr 2020 15:41:30 GMT
age: 15387482
x-cache: HIT, HIT
status: 200
content-length: 10407
x-served-by: cache-bwi5131-BWI, cache-fra19127-FRA
last-modified: Sat, 02 Nov 2019 13:23:29 GMT
server: cat factory 1.0
x-timer: S1588088490.416372,VS0,VE1
etag: "66a65e05b85bc260e177e540f4387426"
access-control-allow-methods: GET, OPTIONS
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-cache-hits: 4, 1

GET
H2 200 PR9i0Gw.png
i.imgur.com/ 21 KB
21 KB 226ms
103ms Image
image/png 151.101.12.193
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.imgur.com/PR9i0Gw.png
Requested by: Host: csgofast.pro
URL: https://csgofast.pro/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.12.193 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: cat factory 1.0 /
Resource Hash: 0f743574331c5d9ada82ef58c068b6df2c57ca17f335b9389cd4d2db69ad03a3

Request headers

Referer: https://csgofast.pro/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 28 Apr 2020 15:41:30 GMT
age: 2586987
x-cache: HIT, HIT
status: 200
content-length: 21617
x-served-by: cache-bwi5144-BWI, cache-fra19127-FRA
last-modified: Sat, 02 Nov 2019 13:23:29 GMT
server: cat factory 1.0
x-timer: S1588088490.416328,VS0,VE1
etag: "9fcac6e2e8800e96c8bf6928699fea00"
access-control-allow-methods: GET, OPTIONS
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-cache-hits: 1, 1

GET
H2 200 wdftyw8 Show response
csgofast.pro/u9eqiuxjwd/ 414 KB
64 KB 190ms
190ms Script
text/javascript 2606:4700:3032::681b:a2df
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://csgofast.pro/u9eqiuxjwd/wdftyw8
Requested by: Host: csgofast.pro
URL: https://csgofast.pro/Content/js/main.js/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3032::681b:a2df , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 634b94c802eeef1b2620bf36fc9e856fbbf373670bb77cd6e7994ebf174352ef

Request headers

Referer: https://csgofast.pro/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Apr 2020 15:41:30 GMT
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type: text/javascript;charset=UTF-8
status: 200
cache-control: no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0
cf-ray: 58b1e3482fd3d721-FRA
cf-request-id: 02630c61150000d721c0a4e200000001

GET
DATA 200
OK truncated
/ 4 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f2fb1ca1804390a6b6f41a676aeb89c1da568a5474f777122bb866012173bfc4

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 502
Bad Gateway bg.gif
dallowin.site/adarkempire/ 0
0 375ms
59ms Image
text/html 194.58.56.190
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dallowin.site/adarkempire/bg.gif
Requested by: Host: csgofast.pro
URL: https://csgofast.pro/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 194.58.56.190 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://csgofast.pro/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e1c9a80121a3e9e9471ee03df18987bb3476f1ff3ee1a271f340b09a18962cd3

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 coins.png
dallowin.fun/csgoempire/img/ 106 KB
106 KB 117ms
111ms Image
image/png 2a00:f940:2:2:1:1:0:89
AS-REG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dallowin.fun/csgoempire/img/coins.png
Requested by: Host: csgofast.pro
URL: https://csgofast.pro/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a00:f940:2:2:1:1:0:89 , Russian Federation, ASN197695 (AS-REG, RU),
Reverse DNS
Software: nginx /
Resource Hash: 416c8fbff3a30754f0b5878d7ad9303ee3abf5d06032b691938e6254a535101e

Request headers

Referer: https://csgofast.pro/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 28 Apr 2020 15:41:30 GMT
last-modified: Mon, 27 Apr 2020 14:18:51 GMT
server: nginx
etag: "5ea6e9cb-1a63a"
content-type: image/png
status: 200
accept-ranges: bytes
content-length: 108090

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: CSGOEmpire (Gaming)

91 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	warning	URL: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/jquery.min.js(Line 2) Message: jQuery.Deferred exception: Cannot read property 'getItem' of null TypeError: Cannot read property 'getItem' of null at HTMLDocument.<anonymous> (https://dallowin.fun/csgoempire/js/main.js:92:30) at e (https://cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/jquery.min.js:2:29453) at t (https://cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/jquery.min.js:2:29755) undefined
console-api	warning	URL: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/jquery.min.js(Line 2) Message: jQuery.Deferred exception: Cannot read property 'getItem' of null TypeError: Cannot read property 'getItem' of null at HTMLDocument.<anonymous> (https://dallowin.fun/csgoempire/js/demo.js:11:30) at e (https://cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/jquery.min.js:2:29453) at t (https://cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/jquery.min.js:2:29755) undefined

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdnjs.cloudflare.com
csgoempire.com
csgofast.pro
dallowin.fun
dallowin.site
i.imgur.com
151.101.12.193
194.58.56.190
2606:4700:10::6816:706
2606:4700:3032::681b:a2df
2606:4700::6810:84e5
2a00:f940:2:2:1:1:0:89
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
0f743574331c5d9ada82ef58c068b6df2c57ca17f335b9389cd4d2db69ad03a3
1343a51a22cbcb53dbc78797ad32cfb5ff5aed7bac6f2d54171bfdcd864394ce
22b0cbc665aa368c6c638453d06b414e0f2541f1bf2b328eef42d788375d6dc0
3a1a52e3e4e6efa470f0d7ef308e38307b2b52e9cc4e53c0038295bb123f1e5a
416c8fbff3a30754f0b5878d7ad9303ee3abf5d06032b691938e6254a535101e
634b94c802eeef1b2620bf36fc9e856fbbf373670bb77cd6e7994ebf174352ef
6a5310d254d1244f7f4e2f5ff75a2fce78078611a18101b17ccc432ee3ba132f
6de86f3ce5c7a981d9b6d106986517159cb1a9f81bc9c2facde0ac3a009d67cf
741bde3fac0805829ecd0259029d4d05b6b19a0290f7754cbaeb3ed0e0205e34
79bf43488f3c3d97f9233404f895843fa4bf1e89e7a46cd14204ba7e49c0fa9e
85cb45b47e2459d9910bac93e2e738545e7a16e9cd47b5a615579a9696108bb3
9a081c56cc0f14e537d9658921b503a17a093d2243bc998aa18e6259d1886337
9e39788ca7e399a0d5819ab30e68a750daab73e719fc059e3291ce822666d5ef
b39c7c327d0e87976a5b0a93dcf01e401e30c380060bc7408eabb697e16bffc3
bbded234c3a842951ab210f33368ab859f2ea3e404e0d45ae2df45fc81387721
cdf54fdf9c0ee0b9d09e77ab0cb2c9bea0dfd6d7df0b3d989595f94b4c30238d
de7ec5b6e98c09013776d4bf6938020d6e8ab5de79a94fe8f490c8b3faae0eaf
df773574d4aa5a044fc3110db001c5817e727db82b3d2b19c89dbb9ca7b9306f
e1c9a80121a3e9e9471ee03df18987bb3476f1ff3ee1a271f340b09a18962cd3
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e65fa1996d070ad33c9ba79b585477094009ca5cdcf88f1af5f4dd816759b850
f2fb1ca1804390a6b6f41a676aeb89c1da568a5474f777122bb866012173bfc4
f8db1f81e843910fe0962c4a11ee5fab8833e9fc3da86002e376c47eee656571

csgofast.pro Open in urlscan Pro 2606:4700:3032::681b:a2df Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

24 Requests

96 %HTTPS

67 %IPv6

6 Domains

6 Subdomains

7 IPs

3 Countries

789 kBTransfer

2075 kBSize

0 Cookies

0 Outgoing links

Redirected requests

24 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

91 JavaScript Global Variables

0 Cookies

2 Console Messages

Indicators

csgofast.pro Open in urlscan Pro
2606:4700:3032::681b:a2df Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

24
Requests

96 %
HTTPS

67 %
IPv6

6
Domains

6
Subdomains

7
IPs

3
Countries

789 kB
Transfer

2075 kB
Size

0
Cookies

24 HTTP transactions
2 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!