eventff.vipevent.gq Open in urlscan Pro
80.209.234.118 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://eventff.vipevent.gq/
Submission: On November 26 via manual (November 26th 2020, 4:59:01 pm UTC) from GB

Summary HTTP 21 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 4 countries across 5 domains to perform 21 HTTP transactions. The main IP is 80.209.234.118, located in Lithuania and belongs to RACKRAY UAB Rakrejus, LT. The main domain is eventff.vipevent.gq.

This is the only time eventff.vipevent.gq was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Gaming (Entertainment)

Domain & IP information

	IP Address	AS Autonomous System
15	80.209.234.118 80.209.234.118	62282 (RACKRAY U...) (RACKRAY UAB Rakrejus)
1	92.122.188.17 92.122.188.17	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	51.210.112.130 51.210.112.130	16276 (OVH) (OVH)
2	2a00:1450:400... 2a00:1450:4001:820::200a	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:819::2003	15169 (GOOGLE) (GOOGLE)
21	5

15 80.209.234.118 (Lithuania)

ASN62282 (RACKRAY UAB Rakrejus, LT)
PTR: 311g.c.serverhost.name

eventff.vipevent.gq	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 92.122.188.17 (Ascension Island)

ASN20940 (AKAMAI-ASN1, EU)
PTR: a92-122-188-17.deploy.static.akamaitechnologies.com

cdngarenanow-a.akamaihd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 51.210.112.130 (France)

ASN16276 (OVH, FR)
PTR: i.ibb.co

i.ibb.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:820::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:819::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
15	vipevent.gq eventff.vipevent.gq	1 MB
2	gstatic.com fonts.gstatic.com	28 KB
2	googleapis.com fonts.googleapis.com	2 KB
1	ibb.co i.ibb.co	9 KB
1	akamaihd.net cdngarenanow-a.akamaihd.net	5 KB
21	5

	Domain	Requested by
15	eventff.vipevent.gq	eventff.vipevent.gq
2	fonts.gstatic.com	fonts.googleapis.com
2	fonts.googleapis.com	eventff.vipevent.gq
1	i.ibb.co	eventff.vipevent.gq
1	cdngarenanow-a.akamaihd.net	eventff.vipevent.gq
21	5

This site contains no links.

Subject Issuer	Validity	Valid
a248.e.akamai.net DigiCert Secure Site ECC CA-1	`2020-07-15` - `2021-09-13`	a year	crt.sh
ibb.co Let's Encrypt Authority X3	`2020-10-02` - `2020-12-31`	3 months	crt.sh

This page contains 1 frames:

Primary Page: http://eventff.vipevent.gq/
Frame ID: B18B39CB1A2B5C813A1C7CE4B50C9005
Requests: 21 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

21
Requests

10 %
HTTPS

40 %
IPv6

5
Domains

5
Subdomains

5
IPs

4
Countries

1141 kB
Transfer

1161 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

21 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
eventff.vipevent.gq/ 10 KB
11 KB 1587ms
1521ms Document
text/html 80.209.234.118
RACKRAY UAB Rakrejus

General

Check archive.org

Show headers Download Go to

Full URL: http://eventff.vipevent.gq/
Protocol: HTTP/1.1
Server: 80.209.234.118 , Lithuania, ASN62282 (RACKRAY UAB Rakrejus, LT),
Reverse DNS: 311g.c.serverhost.name
Software: Apache /
Resource Hash: f1c94b08ff08f29b3efe4e2154ccfe19b48c80a7121fb8f6f3d4c195a429cad5

Request headers

Host: eventff.vipevent.gq
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 26 Nov 2020 16:58:39 GMT
Server: Apache
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK style.css
eventff.vipevent.gq/ccss/ 3 KB
3 KB 48ms
48ms Stylesheet
text/css 80.209.234.118
RACKRAY UAB Rakrejus

General

Check archive.org

Show headers Download Go to

Full URL: http://eventff.vipevent.gq/ccss/style.css
Requested by: Host: eventff.vipevent.gq
URL: http://eventff.vipevent.gq/
Protocol: HTTP/1.1
Server: 80.209.234.118 , Lithuania, ASN62282 (RACKRAY UAB Rakrejus, LT),
Reverse DNS: 311g.c.serverhost.name
Software: Apache /
Resource Hash: 5f88f7c773d956e35d2979b1e51f44b72ce7d0293d0e06373554c86efb57e56b

Request headers

Referer: http://eventff.vipevent.gq/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 26 Nov 2020 16:58:39 GMT
Last-Modified: Thu, 11 Jun 2020 00:17:03 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 2816

GET
H2 200 sso.css
cdngarenanow-a.akamaihd.net/gop/sso/theme/dark/css/ 24 KB
5 KB 1000ms
831ms Stylesheet
text/css 92.122.188.17
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdngarenanow-a.akamaihd.net/gop/sso/theme/dark/css/sso.css?v=0.47
Requested by: Host: eventff.vipevent.gq
URL: http://eventff.vipevent.gq/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 92.122.188.17 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS: a92-122-188-17.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 7e05a3b6916243f60f936bac42334654b013204dc0970fdcdba85d398582a5d5

Request headers

Referer: http://eventff.vipevent.gq/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 26 Nov 2020 16:58:40 GMT
content-encoding: gzip
last-modified: Tue, 17 Oct 2017 11:08:05 GMT
server: AkamaiNetStorage
etag: "ba37f1d86a5d1290a7c9bae97d77e628:1508238543"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
accept-ranges: bytes
content-length: 4661

GET
H/1.1 200
OK ff.gif
eventff.vipevent.gq/imgu/ 605 KB
605 KB 3298ms
3265ms Image
image/gif 80.209.234.118
RACKRAY UAB Rakrejus

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://eventff.vipevent.gq/imgu/ff.gif
Requested by: Host: eventff.vipevent.gq
URL: http://eventff.vipevent.gq/
Protocol: HTTP/1.1
Server: 80.209.234.118 , Lithuania, ASN62282 (RACKRAY UAB Rakrejus, LT),
Reverse DNS: 311g.c.serverhost.name
Software: Apache /
Resource Hash: d71424139b7dc1c7425fc314c95a24e3d96d88e06062385bfe7ce3667ae9d174

Request headers

Referer: http://eventff.vipevent.gq/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 26 Nov 2020 16:58:43 GMT
Last-Modified: Thu, 11 Jun 2020 00:17:03 GMT
Server: Apache
Content-Type: image/gif
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 619415

GET
H/1.1 200
OK dm.jpg
eventff.vipevent.gq/imgu/ 363 KB
363 KB 3491ms
3457ms Image
image/jpeg 80.209.234.118
RACKRAY UAB Rakrejus

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://eventff.vipevent.gq/imgu/dm.jpg
Requested by: Host: eventff.vipevent.gq
URL: http://eventff.vipevent.gq/
Protocol: HTTP/1.1
Server: 80.209.234.118 , Lithuania, ASN62282 (RACKRAY UAB Rakrejus, LT),
Reverse DNS: 311g.c.serverhost.name
Software: Apache /
Resource Hash: ff34d9a43cdfd481c94273e3dc41f543c41d633e6636a4ea2d9b3f84d3492fdf

Request headers

Referer: http://eventff.vipevent.gq/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 26 Nov 2020 16:58:43 GMT
Last-Modified: Thu, 11 Jun 2020 00:17:03 GMT
Server: Apache
Content-Type: image/jpeg
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 371384

GET
H/1.1 200
OK magic.jpg
eventff.vipevent.gq/imgu/ 8 KB
8 KB 3741ms
3707ms Image
image/jpeg 80.209.234.118
RACKRAY UAB Rakrejus

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://eventff.vipevent.gq/imgu/magic.jpg
Requested by: Host: eventff.vipevent.gq
URL: http://eventff.vipevent.gq/
Protocol: HTTP/1.1
Server: 80.209.234.118 , Lithuania, ASN62282 (RACKRAY UAB Rakrejus, LT),
Reverse DNS: 311g.c.serverhost.name
Software: Apache /
Resource Hash: edc8fcfb73df10bd2695eea06db9d54d90ff1955145081927f1a51ae7e8f84f4

Request headers

Referer: http://eventff.vipevent.gq/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 26 Nov 2020 16:58:43 GMT
Last-Modified: Thu, 11 Jun 2020 00:17:03 GMT
Server: Apache
Content-Type: image/jpeg
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 7951

GET
H/1.1 200
OK epas.jpg
eventff.vipevent.gq/imgu/ 8 KB
8 KB 3490ms
3456ms Image
image/jpeg 80.209.234.118
RACKRAY UAB Rakrejus

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://eventff.vipevent.gq/imgu/epas.jpg
Requested by: Host: eventff.vipevent.gq
URL: http://eventff.vipevent.gq/
Protocol: HTTP/1.1
Server: 80.209.234.118 , Lithuania, ASN62282 (RACKRAY UAB Rakrejus, LT),
Reverse DNS: 311g.c.serverhost.name
Software: Apache /
Resource Hash: 86bed392c79aad6af0b9fab5993a58ff5ab654350bf30d25b7bf6ffcf818060f

Request headers

Referer: http://eventff.vipevent.gq/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 26 Nov 2020 16:58:43 GMT
Last-Modified: Thu, 11 Jun 2020 00:17:03 GMT
Server: Apache
Content-Type: image/jpeg
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 8074

GET
H/1.1 200
OK titan.jpg
eventff.vipevent.gq/imgu/ 10 KB
10 KB 3740ms
3706ms Image
image/jpeg 80.209.234.118
RACKRAY UAB Rakrejus

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://eventff.vipevent.gq/imgu/titan.jpg
Requested by: Host: eventff.vipevent.gq
URL: http://eventff.vipevent.gq/
Protocol: HTTP/1.1
Server: 80.209.234.118 , Lithuania, ASN62282 (RACKRAY UAB Rakrejus, LT),
Reverse DNS: 311g.c.serverhost.name
Software: Apache /
Resource Hash: ead5a6f3d6ea198c9e24f78edce38e94af52c66ade0546b29ef4ae6fb81a54fb

Request headers

Referer: http://eventff.vipevent.gq/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 26 Nov 2020 16:58:43 GMT
Last-Modified: Thu, 11 Jun 2020 00:17:03 GMT
Server: Apache
Content-Type: image/jpeg
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 9730

GET
H/1.1 200
OK mp40.jpg
eventff.vipevent.gq/imgu/ 9 KB
10 KB 47ms
47ms Image
image/jpeg 80.209.234.118
RACKRAY UAB Rakrejus

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://eventff.vipevent.gq/imgu/mp40.jpg
Requested by: Host: eventff.vipevent.gq
URL: http://eventff.vipevent.gq/
Protocol: HTTP/1.1
Server: 80.209.234.118 , Lithuania, ASN62282 (RACKRAY UAB Rakrejus, LT),
Reverse DNS: 311g.c.serverhost.name
Software: Apache /
Resource Hash: a3f16167a3fdf4f85b291063a3379f196dc86202d052394c3010433ca5ad95c2

Request headers

Referer: http://eventff.vipevent.gq/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 26 Nov 2020 16:58:39 GMT
Last-Modified: Thu, 11 Jun 2020 00:17:03 GMT
Server: Apache
Content-Type: image/jpeg
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 9673

GET
H/1.1 200
OK awm.jpg
eventff.vipevent.gq/imgu/ 11 KB
11 KB 48ms
47ms Image
image/jpeg 80.209.234.118
RACKRAY UAB Rakrejus

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://eventff.vipevent.gq/imgu/awm.jpg
Requested by: Host: eventff.vipevent.gq
URL: http://eventff.vipevent.gq/
Protocol: HTTP/1.1
Server: 80.209.234.118 , Lithuania, ASN62282 (RACKRAY UAB Rakrejus, LT),
Reverse DNS: 311g.c.serverhost.name
Software: Apache /
Resource Hash: 5c2ff772430cb634810b4a5fbb9dbece0374c280ff61629f598c1b582511ed55

Request headers

Referer: http://eventff.vipevent.gq/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 26 Nov 2020 16:58:39 GMT
Last-Modified: Thu, 11 Jun 2020 00:17:03 GMT
Server: Apache
Content-Type: image/jpeg
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=97
Content-Length: 11277

GET
H/1.1 200
OK bandit.jpg
eventff.vipevent.gq/imgu/ 10 KB
10 KB 48ms
47ms Image
image/jpeg 80.209.234.118
RACKRAY UAB Rakrejus

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://eventff.vipevent.gq/imgu/bandit.jpg
Requested by: Host: eventff.vipevent.gq
URL: http://eventff.vipevent.gq/
Protocol: HTTP/1.1
Server: 80.209.234.118 , Lithuania, ASN62282 (RACKRAY UAB Rakrejus, LT),
Reverse DNS: 311g.c.serverhost.name
Software: Apache /
Resource Hash: 5c23aac857d1a487423c546c1827940e644cc3800157086abd6fe478b61b106f

Request headers

Referer: http://eventff.vipevent.gq/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 26 Nov 2020 16:58:40 GMT
Last-Modified: Thu, 11 Jun 2020 00:17:03 GMT
Server: Apache
Content-Type: image/jpeg
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=96
Content-Length: 9936

GET
H/1.1 200
OK zs.jpg
eventff.vipevent.gq/imgu/ 13 KB
14 KB 48ms
47ms Image
image/jpeg 80.209.234.118
RACKRAY UAB Rakrejus

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://eventff.vipevent.gq/imgu/zs.jpg
Requested by: Host: eventff.vipevent.gq
URL: http://eventff.vipevent.gq/
Protocol: HTTP/1.1
Server: 80.209.234.118 , Lithuania, ASN62282 (RACKRAY UAB Rakrejus, LT),
Reverse DNS: 311g.c.serverhost.name
Software: Apache /
Resource Hash: 2b6f13f131f1de7993ebe6595e026adb589b1af410544dfd19213b3a4d56c1dd

Request headers

Referer: http://eventff.vipevent.gq/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 26 Nov 2020 16:58:40 GMT
Last-Modified: Thu, 11 Jun 2020 00:17:03 GMT
Server: Apache
Content-Type: image/jpeg
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=95
Content-Length: 13718

GET
H/1.1 200
OK alok.jpg
eventff.vipevent.gq/imgu/ 12 KB
12 KB 47ms
47ms Image
image/jpeg 80.209.234.118
RACKRAY UAB Rakrejus

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://eventff.vipevent.gq/imgu/alok.jpg
Requested by: Host: eventff.vipevent.gq
URL: http://eventff.vipevent.gq/
Protocol: HTTP/1.1
Server: 80.209.234.118 , Lithuania, ASN62282 (RACKRAY UAB Rakrejus, LT),
Reverse DNS: 311g.c.serverhost.name
Software: Apache /
Resource Hash: 4e4e018ac55d23b0db7d6baabee63dfcc29e52c43f8559d53c9bc5f8ad1e498a

Request headers

Referer: http://eventff.vipevent.gq/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 26 Nov 2020 16:58:40 GMT
Last-Modified: Thu, 11 Jun 2020 00:17:03 GMT
Server: Apache
Content-Type: image/jpeg
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=94
Content-Length: 12047

GET
H/1.1 200
OK throne.jpg
eventff.vipevent.gq/imgu/ 9 KB
9 KB 47ms
47ms Image
image/jpeg 80.209.234.118
RACKRAY UAB Rakrejus

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://eventff.vipevent.gq/imgu/throne.jpg
Requested by: Host: eventff.vipevent.gq
URL: http://eventff.vipevent.gq/
Protocol: HTTP/1.1
Server: 80.209.234.118 , Lithuania, ASN62282 (RACKRAY UAB Rakrejus, LT),
Reverse DNS: 311g.c.serverhost.name
Software: Apache /
Resource Hash: 31866c3ebf852f792077b3197064ba5d07f8ef3f3f187afc2b7a629d57346016

Request headers

Referer: http://eventff.vipevent.gq/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 26 Nov 2020 16:58:40 GMT
Last-Modified: Thu, 11 Jun 2020 00:17:03 GMT
Server: Apache
Content-Type: image/jpeg
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=93
Content-Length: 9254

GET
H/1.1 200
OK evo.jpg
eventff.vipevent.gq/imgu/ 11 KB
11 KB 48ms
48ms Image
image/jpeg 80.209.234.118
RACKRAY UAB Rakrejus

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://eventff.vipevent.gq/imgu/evo.jpg
Requested by: Host: eventff.vipevent.gq
URL: http://eventff.vipevent.gq/
Protocol: HTTP/1.1
Server: 80.209.234.118 , Lithuania, ASN62282 (RACKRAY UAB Rakrejus, LT),
Reverse DNS: 311g.c.serverhost.name
Software: Apache /
Resource Hash: 5fe40743a466790f8e3eb341585003c17cf3f761380afcf1201d58c41e3a8a54

Request headers

Referer: http://eventff.vipevent.gq/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 26 Nov 2020 16:58:40 GMT
Last-Modified: Thu, 11 Jun 2020 00:17:03 GMT
Server: Apache
Content-Type: image/jpeg
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=92
Content-Length: 10931

GET
H/1.1 200
OK royale.jpg
eventff.vipevent.gq/imgu/ 12 KB
12 KB 47ms
47ms Image
image/jpeg 80.209.234.118
RACKRAY UAB Rakrejus

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://eventff.vipevent.gq/imgu/royale.jpg
Requested by: Host: eventff.vipevent.gq
URL: http://eventff.vipevent.gq/
Protocol: HTTP/1.1
Server: 80.209.234.118 , Lithuania, ASN62282 (RACKRAY UAB Rakrejus, LT),
Reverse DNS: 311g.c.serverhost.name
Software: Apache /
Resource Hash: 933760a7e298e5057032b1a9ad57b931a1969fa9e6f7a9492787ed7c81c24e8e

Request headers

Referer: http://eventff.vipevent.gq/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 26 Nov 2020 16:58:40 GMT
Last-Modified: Thu, 11 Jun 2020 00:17:03 GMT
Server: Apache
Content-Type: image/jpeg
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=91
Content-Length: 12545

GET
H2 200 wall2.png
i.ibb.co/ByrgPgc/ 9 KB
9 KB 194ms
65ms Image
image/png 51.210.112.130
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.ibb.co/ByrgPgc/wall2.png
Requested by: Host: eventff.vipevent.gq
URL: http://eventff.vipevent.gq/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 51.210.112.130 , France, ASN16276 (OVH, FR),
Reverse DNS: i.ibb.co
Software: openresty /
Resource Hash: 9750c52ae21c07f2bd166c7d964e122c8172745e6547ad000f1f2298fbdf9499

Request headers

Referer: http://eventff.vipevent.gq/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 26 Nov 2020 16:58:39 GMT
last-modified: Wed, 10 Jun 2020 23:57:30 GMT
server: openresty
access-control-allow-methods: GET, OPTIONS
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 9232
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK css
fonts.googleapis.com/ 386 B
819 B 22ms
16ms Stylesheet
text/css 2a00:1450:4001:820::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.googleapis.com/css?family=Indie+Flower

Requested by

Host: eventff.vipevent.gq
URL: http://eventff.vipevent.gq/ccss/style.css

Protocol

HTTP/1.1

Server

2a00:1450:4001:820::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

69408d996bc3ea194ad2b6390434e8b225b46a25b1f63143aa4047aa86b78cd6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: http://eventff.vipevent.gq/ccss/style.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 26 Nov 2020 16:58:39 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Thu, 26 Nov 2020 16:58:39 GMT
Server: ESF
X-Frame-Options: SAMEORIGIN
Content-Type: text/css; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: private, max-age=86400, stale-while-revalidate=604800
Transfer-Encoding: chunked
Timing-Allow-Origin: *
Link: <http://fonts.gstatic.com>; rel=preconnect; crossorigin
X-XSS-Protection: 0
Expires: Thu, 26 Nov 2020 16:58:39 GMT

GET
H/1.1 200
OK css
fonts.googleapis.com/ 6 KB
1 KB 21ms
15ms Stylesheet
text/css 2a00:1450:4001:820::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.googleapis.com/css?family=Open+Sans:300,400,700

Requested by

Host: eventff.vipevent.gq
URL: http://eventff.vipevent.gq/ccss/style.css

Protocol

HTTP/1.1

Server

2a00:1450:4001:820::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

ae8f0977f256489188ec57bbd456515b35ec83f5cfc7172c5bbe13bf71ea1dbe

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: http://eventff.vipevent.gq/ccss/style.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 26 Nov 2020 16:58:39 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Thu, 26 Nov 2020 16:58:39 GMT
Server: ESF
X-Frame-Options: SAMEORIGIN
Content-Type: text/css; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: private, max-age=86400, stale-while-revalidate=604800
Transfer-Encoding: chunked
Timing-Allow-Origin: *
Link: <http://fonts.gstatic.com>; rel=preconnect; crossorigin
X-XSS-Protection: 0
Expires: Thu, 26 Nov 2020 16:58:39 GMT

GET
H/1.1 200
OK m8JVjfNVeKWVnh3QMuKkFcZVaUuH99GUDg.woff2
fonts.gstatic.com/s/indieflower/v12/ 19 KB
19 KB 12ms
7ms Font
font/woff2 2a00:1450:4001:819::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.gstatic.com/s/indieflower/v12/m8JVjfNVeKWVnh3QMuKkFcZVaUuH99GUDg.woff2

Requested by

Host: fonts.googleapis.com
URL: http://fonts.googleapis.com/css?family=Indie+Flower

Protocol

HTTP/1.1

Server

2a00:1450:4001:819::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

acf0fe7ea6f4217046d19a3f9ff5ea32e97849dac48b5a35b3c61c0c98b98bb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: http://eventff.vipevent.gq
Referer: http://fonts.googleapis.com/css?family=Indie+Flower
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sun, 22 Nov 2020 02:51:18 GMT
X-Content-Type-Options: nosniff
Last-Modified: Thu, 10 Sep 2020 17:07:01 GMT
Server: sffe
Age: 396442
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31536000
Accept-Ranges: bytes
Timing-Allow-Origin: *
Content-Length: 19120
X-XSS-Protection: 0
Expires: Mon, 22 Nov 2021 02:51:18 GMT

GET
H/1.1 200
OK mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
fonts.gstatic.com/s/opensans/v18/ 9 KB
9 KB 11ms
6ms Font
font/woff2 2a00:1450:4001:819::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://fonts.gstatic.com/s/opensans/v18/mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2

Requested by

Host: fonts.googleapis.com
URL: http://fonts.googleapis.com/css?family=Open+Sans:300,400,700

Protocol

HTTP/1.1

Server

2a00:1450:4001:819::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: http://eventff.vipevent.gq
Referer: http://fonts.googleapis.com/css?family=Open+Sans:300,400,700
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 23 Nov 2020 10:17:03 GMT
X-Content-Type-Options: nosniff
Last-Modified: Tue, 15 Sep 2020 18:09:28 GMT
Server: sffe
Age: 283297
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31536000
Accept-Ranges: bytes
Timing-Allow-Origin: *
Content-Length: 9132
X-XSS-Protection: 0
Expires: Tue, 23 Nov 2021 10:17:03 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Gaming (Entertainment)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdngarenanow-a.akamaihd.net
eventff.vipevent.gq
fonts.googleapis.com
fonts.gstatic.com
i.ibb.co
2a00:1450:4001:819::2003
2a00:1450:4001:820::200a
51.210.112.130
80.209.234.118
92.122.188.17
2b6f13f131f1de7993ebe6595e026adb589b1af410544dfd19213b3a4d56c1dd
31866c3ebf852f792077b3197064ba5d07f8ef3f3f187afc2b7a629d57346016
4e4e018ac55d23b0db7d6baabee63dfcc29e52c43f8559d53c9bc5f8ad1e498a
54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775
5c23aac857d1a487423c546c1827940e644cc3800157086abd6fe478b61b106f
5c2ff772430cb634810b4a5fbb9dbece0374c280ff61629f598c1b582511ed55
5f88f7c773d956e35d2979b1e51f44b72ce7d0293d0e06373554c86efb57e56b
5fe40743a466790f8e3eb341585003c17cf3f761380afcf1201d58c41e3a8a54
69408d996bc3ea194ad2b6390434e8b225b46a25b1f63143aa4047aa86b78cd6
7e05a3b6916243f60f936bac42334654b013204dc0970fdcdba85d398582a5d5
86bed392c79aad6af0b9fab5993a58ff5ab654350bf30d25b7bf6ffcf818060f
933760a7e298e5057032b1a9ad57b931a1969fa9e6f7a9492787ed7c81c24e8e
9750c52ae21c07f2bd166c7d964e122c8172745e6547ad000f1f2298fbdf9499
a3f16167a3fdf4f85b291063a3379f196dc86202d052394c3010433ca5ad95c2
acf0fe7ea6f4217046d19a3f9ff5ea32e97849dac48b5a35b3c61c0c98b98bb9
ae8f0977f256489188ec57bbd456515b35ec83f5cfc7172c5bbe13bf71ea1dbe
d71424139b7dc1c7425fc314c95a24e3d96d88e06062385bfe7ce3667ae9d174
ead5a6f3d6ea198c9e24f78edce38e94af52c66ade0546b29ef4ae6fb81a54fb
edc8fcfb73df10bd2695eea06db9d54d90ff1955145081927f1a51ae7e8f84f4
f1c94b08ff08f29b3efe4e2154ccfe19b48c80a7121fb8f6f3d4c195a429cad5
ff34d9a43cdfd481c94273e3dc41f543c41d633e6636a4ea2d9b3f84d3492fdf

eventff.vipevent.gq Open in urlscan Pro 80.209.234.118 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

21 Requests

10 %HTTPS

40 %IPv6

5 Domains

5 Subdomains

5 IPs

4 Countries

1141 kBTransfer

1161 kBSize

0 Cookies

0 Outgoing links

Redirected requests

21 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

5 JavaScript Global Variables

0 Cookies

Indicators

eventff.vipevent.gq Open in urlscan Pro
80.209.234.118 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

21
Requests

10 %
HTTPS

40 %
IPv6

5
Domains

5
Subdomains

5
IPs

4
Countries

1141 kB
Transfer

1161 kB
Size

0
Cookies

21 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!