seagamelienquan-garena-vnn.gq

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 5 HTTP transactions. The main IP is 103.130.216.181, located in Viet Nam and belongs to WEBICO-AS-VN Webico Company Limited, VN. The main domain is seagamelienquan-garena-vnn.gq.

This is the only time seagamelienquan-garena-vnn.gq was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Garena Free Fire (Gaming)

Domain & IP information

	IP Address	AS Autonomous System
1 2	103.130.216.181 103.130.216.181	135951 (WEBICO-AS...) (WEBICO-AS-VN Webico Company Limited)
1 5	202.81.112.197 202.81.112.197	58521 (GARENA-SG...) (GARENA-SG Garena Online Pte Ltd)
5	2

2 103.130.216.181 (Viet Nam) 1 redirects

ASN135951 (WEBICO-AS-VN Webico Company Limited, VN)
PTR: rdns.tino.org

seagamelienquan-garena-vnn.gq	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 202.81.112.197 (Singapore) 1 redirects

ASN58521 (GARENA-SG Garena Online Pte Ltd, SG)

auth.garena.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	garena.com 1 redirects auth.garena.com — Cisco Umbrella Rank: 322648	25 KB
2	seagamelienquan-garena-vnn.gq 1 redirects seagamelienquan-garena-vnn.gq	2 KB
5	2

	Domain	Requested by
5	auth.garena.com	1 redirects seagamelienquan-garena-vnn.gq auth.garena.com
2	seagamelienquan-garena-vnn.gq	1 redirects
5	2

This site contains no links.

Subject Issuer	Validity	Valid
auth.garena.com SSL.com RSA SSL subCA	`2020-04-29` - `2022-07-28`	2 years	crt.sh

This page contains 1 frames:

Primary Page: http://seagamelienquan-garena-vnn.gq/ui/login/
Frame ID: 9E882B4F2C768A33C16A8DF59BE0D305
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Garena

Page URL History Show full URLs

http://seagamelienquan-garena-vnn.gq/ui/login HTTP 301
http://seagamelienquan-garena-vnn.gq/ui/login/ Page URL

Page Statistics

5
Requests

60 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

26 kB
Transfer

49 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://seagamelienquan-garena-vnn.gq/ui/login HTTP 301
http://seagamelienquan-garena-vnn.gq/ui/login/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://auth.garena.com/css/sso.css?v=0.54 HTTP 301
https://auth.garena.com/css/sso.css?v=0.54

5 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request / Show response
seagamelienquan-garena-vnn.gq/ui/login/
Redirect Chain

http://seagamelienquan-garena-vnn.gq/ui/login
http://seagamelienquan-garena-vnn.gq/ui/login/

2 KB
1 KB

218ms
217ms

Document
text/html

103.130.216.181
WEBICO-AS-VN Webi...

General

Check archive.org

Show headers Download Go to

Full URL

http://seagamelienquan-garena-vnn.gq/ui/login/

Protocol

HTTP/1.1

Server

103.130.216.181 , Viet Nam, ASN135951 (WEBICO-AS-VN Webico Company Limited, VN),

Reverse DNS

rdns.tino.org

Software

LiteSpeed / PHP/7.4.29

Resource Hash

b2c86bb5830e8d04e822146ed6c7e834b797e1c2992fbb08b43d6a166ea72cf2

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
cache-control: no-store, no-cache, must-revalidate
content-encoding: gzip
content-length: 973
content-type: text/html; charset=UTF-8
date: Sat, 14 May 2022 01:28:15 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: LiteSpeed
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
x-powered-by: PHP/7.4.29

Redirect headers

Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
content-length: 707
content-type: text/html
date: Sat, 14 May 2022 01:28:15 GMT
location: http://seagamelienquan-garena-vnn.gq/ui/login/
server: LiteSpeed
x-frame-options: SAMEORIGIN

GET
H/1.1

200
OK

sso.css
auth.garena.com/css/
Redirect Chain

http://auth.garena.com/css/sso.css?v=0.54
https://auth.garena.com/css/sso.css?v=0.54

30 KB
7 KB

181ms
178ms

Stylesheet
text/css

202.81.112.197
GARENA-SG Garena ...

General

Check archive.org

Show headers Download Go to

Full URL: https://auth.garena.com/css/sso.css?v=0.54
Requested by: Host: seagamelienquan-garena-vnn.gq
URL: http://seagamelienquan-garena-vnn.gq/ui/login/
Protocol: HTTP/1.1
Server: 202.81.112.197 , Singapore, ASN58521 (GARENA-SG Garena Online Pte Ltd, SG),
Reverse DNS
Software: /
Resource Hash: 7c113741e6f628540370bec76930b1e9454d93f2db0ad5a63b6879438b9247bb

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://seagamelienquan-garena-vnn.gq/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date: Sat, 14 May 2022 01:28:15 GMT
Content-Encoding: gzip
Last-Modified: Wed, 16 Mar 2022 08:54:22 GMT
ETag: W/"6231a5be-77c0"
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: max-age=2592000
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Mon, 13 Jun 2022 01:28:15 GMT

Redirect headers

Location: https://auth.garena.com/css/sso.css?v=0.54
Date: Sat, 14 May 2022 01:28:15 GMT
Connection: keep-alive
Content-Length: 162
Content-Type: text/html

GET
H/1.1 200
OK img_garena_logo.png
auth.garena.com/images/ 6 KB
6 KB 733ms
178ms Image
image/png 202.81.112.197
GARENA-SG Garena ...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://auth.garena.com/images/img_garena_logo.png
Requested by: Host: seagamelienquan-garena-vnn.gq
URL: http://seagamelienquan-garena-vnn.gq/ui/login/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 202.81.112.197 , Singapore, ASN58521 (GARENA-SG Garena Online Pte Ltd, SG),
Reverse DNS
Software: /
Resource Hash: 1052ac0fe02e8c3300c458dc1a059335150c1e46d0476a5d0fb5a809af3ef263

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://seagamelienquan-garena-vnn.gq/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date: Sat, 14 May 2022 01:28:16 GMT
Last-Modified: Wed, 29 Sep 2021 10:41:52 GMT
ETag: "615442f0-17e2"
Content-Type: image/png
Cache-Control: max-age=2592000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 6114
Expires: Mon, 13 Jun 2022 01:28:16 GMT

GET
H/1.1 200
OK bg.png
auth.garena.com/images/ 2 KB
2 KB 359ms
181ms Image
image/png 202.81.112.197
GARENA-SG Garena ...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://auth.garena.com/images/bg.png
Requested by: Host: auth.garena.com
URL: https://auth.garena.com/css/sso.css?v=0.54
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 202.81.112.197 , Singapore, ASN58521 (GARENA-SG Garena Online Pte Ltd, SG),
Reverse DNS
Software: /
Resource Hash: 55ff8578db3a7e8d57214fb961b4c908ce5fd4bf66a53be77d989b1b16d82410

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.garena.com/css/sso.css?v=0.54
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date: Sat, 14 May 2022 01:28:16 GMT
Last-Modified: Wed, 29 Sep 2021 10:41:52 GMT
ETag: "615442f0-60e"
Content-Type: image/png
Cache-Control: max-age=2592000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1550
Expires: Mon, 13 Jun 2022 01:28:16 GMT

GET
H/1.1 200
OK logo-facebook.png
auth.garena.com/images/ 9 KB
9 KB 365ms
182ms Image
image/png 202.81.112.197
GARENA-SG Garena ...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://auth.garena.com/images/logo-facebook.png
Requested by: Host: auth.garena.com
URL: https://auth.garena.com/css/sso.css?v=0.54
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 202.81.112.197 , Singapore, ASN58521 (GARENA-SG Garena Online Pte Ltd, SG),
Reverse DNS
Software: /
Resource Hash: 94f92c2fa2a770888470701e4e9c0063d11bd846b52739d8b12a06b2dabd3be2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://auth.garena.com/css/sso.css?v=0.54
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date: Sat, 14 May 2022 01:28:16 GMT
Last-Modified: Fri, 15 Oct 2021 07:16:04 GMT
ETag: "61692ab4-23d7"
Content-Type: image/png
Cache-Control: max-age=2592000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 9175
Expires: Mon, 13 Jun 2022 01:28:16 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Garena Free Fire (Gaming)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontextlost object| oncontextrestored function| structuredClone

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			seagamelienquan-garena-vnn.gq/	1969-12-31 23:59:59	Name: PHPSESSID Value: 7d85d904ad0dc70a7416e93c675daa2d

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

auth.garena.com
seagamelienquan-garena-vnn.gq
103.130.216.181
202.81.112.197
1052ac0fe02e8c3300c458dc1a059335150c1e46d0476a5d0fb5a809af3ef263
55ff8578db3a7e8d57214fb961b4c908ce5fd4bf66a53be77d989b1b16d82410
7c113741e6f628540370bec76930b1e9454d93f2db0ad5a63b6879438b9247bb
94f92c2fa2a770888470701e4e9c0063d11bd846b52739d8b12a06b2dabd3be2
b2c86bb5830e8d04e822146ed6c7e834b797e1c2992fbb08b43d6a166ea72cf2

seagamelienquan-garena-vnn.gq Open in urlscan Pro 103.130.216.181 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

5 Requests

60 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

26 kBTransfer

49 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

1 Cookies

Security Headers

Indicators

seagamelienquan-garena-vnn.gq Open in urlscan Pro
103.130.216.181 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

60 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

26 kB
Transfer

49 kB
Size

1
Cookies

5 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!