csgo-magic.pw
Open in
urlscan Pro
2606:4700:30::681b:9e68
Malicious Activity!
Public Scan
Effective URL: https://csgo-magic.pw/93xfKZyVGi/fxxmbgxh47/x6uk42r3rg?q=93xfKZyVGi&s=0ec96858e7481ad031dfd885bb62413
Submission: On October 14 via manual from SE
Summary
TLS certificate: Issued by CloudFlare Inc ECC CA-2 on October 11th 2018. Valid for: a year.
This is the only time csgo-magic.pw was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Gaming (Entertainment)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 19 | 2606:4700:30:... 2606:4700:30::681b:9e68 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
1 | 205.185.208.52 205.185.208.52 | 20446 (HIGHWINDS3) (HIGHWINDS3 - Highwinds Network Group) | |
19 | 3 |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
csgo-magic.pw |
ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US)
PTR: vip052.ssl.hwcdn.net
code.jquery.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
19 |
csgo-magic.pw
1 redirects
csgo-magic.pw |
1 MB |
1 |
jquery.com
code.jquery.com |
30 KB |
19 | 2 |
Domain | Requested by | |
---|---|---|
19 | csgo-magic.pw |
1 redirects
csgo-magic.pw
code.jquery.com |
1 | code.jquery.com |
csgo-magic.pw
|
19 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni.cloudflaressl.com CloudFlare Inc ECC CA-2 |
2018-10-11 - 2019-10-11 |
a year | crt.sh |
code.jquery.com Let's Encrypt Authority X3 |
2018-08-29 - 2018-11-27 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://csgo-magic.pw/93xfKZyVGi/fxxmbgxh47/x6uk42r3rg?q=93xfKZyVGi&s=0ec96858e7481ad031dfd885bb62413
Frame ID: B24115479B920BD22A9EF24BF6E0DF8D
Requests: 20 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://csgo-magic.pw/93xfKZyVGi/fxxmbgxh47/x6uk42r3rg?q=93xfKZyVGi&s=0ec96858e7481ad031dfd885bb62413
HTTP 301
https://csgo-magic.pw/93xfKZyVGi/fxxmbgxh47/x6uk42r3rg?q=93xfKZyVGi&s=0ec96858e7481ad031dfd885bb62413 Page URL
Detected technologies
CloudFlare (CDN) ExpandDetected patterns
- headers server /cloudflare/i
Font Awesome (Font Scripts) Expand
Detected patterns
- html /<link[^>]* href=[^>]+font-awesome(?:\.min)?\.css/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /jquery(?:\-|\.)([\d.]*\d)[^\/]*\.js/i
- script /jquery.*\.js/i
- env /^jQuery$/i
- script /jquery-ui.*\.js/i
jQuery UI (JavaScript Libraries) Expand
Detected patterns
- script /jquery-ui.*\.js/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://csgo-magic.pw/93xfKZyVGi/fxxmbgxh47/x6uk42r3rg?q=93xfKZyVGi&s=0ec96858e7481ad031dfd885bb62413
HTTP 301
https://csgo-magic.pw/93xfKZyVGi/fxxmbgxh47/x6uk42r3rg?q=93xfKZyVGi&s=0ec96858e7481ad031dfd885bb62413 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
19 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
x6uk42r3rg
csgo-magic.pw/93xfKZyVGi/fxxmbgxh47/ Redirect Chain
|
375 KB 162 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
font-awesome.min.css
csgo-magic.pw/Content/csgomagic/ |
28 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-3.3.1.min.js
code.jquery.com/ |
85 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-ui.min.js
csgo-magic.pw/Content/js/ |
248 KB 66 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-ui.css
csgo-magic.pw/Content/css/ |
35 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
csgo-magic.pw/Content/js/main.js/ |
286 KB 19 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo.svg
csgo-magic.pw/Content/csgomagic/ |
816 KB 609 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
f1e2c30d334b232e0c35e98d644ece19.jpg
csgo-magic.pw/Content/csgomagic/ |
267 KB 268 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fontawesome-webfont.woff2
csgo-magic.pw/Content/fonts/ |
69 KB 69 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
24 KB 0 |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-ui.min.js
csgo-magic.pw/Content/js/ |
248 KB 66 KB |
XHR
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ui-icons_444444_256x240.png
csgo-magic.pw/Content/css/images/ |
64 KB 64 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
b1.png
csgo-magic.pw/Content/window/ |
182 B 263 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
b1_hover.png
csgo-magic.pw/Content/window/ |
190 B 263 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
b2.png
csgo-magic.pw/Content/window/ |
198 B 256 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
b2_hover.png
csgo-magic.pw/Content/window/ |
206 B 265 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
b3.png
csgo-magic.pw/Content/window/ |
247 B 305 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
b3_hover.png
csgo-magic.pw/Content/window/ |
342 B 416 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
https1.png
csgo-magic.pw/Content/window/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
https2.png
csgo-magic.pw/Content/window/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Gaming (Entertainment)15 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery string| nYg5FdvOp7Gbw32hBvDfEv6s6U string| nYg5FdvOp7Gbw32hBvDfEv6s6U1 string| nYg5FdvOp7Gbw32hBvDfEv6s6U2 string| iuHy6d6Yhhdyh82hHgthjd29Uh8 object| rehbr04de function| rehbre04d object| rehbr4c6b object| _0x6a99 object| _0xe58e boolean| isMobile function| gen_string function| GetCookie function| setCookie3 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
csgo-magic.pw/ | Name: f3d4628044020f0367ce451eecf42ab4 Value: 12317d5c684415bd639e8d9e712a62ae |
|
csgo-magic.pw/ | Name: 71d13acc511d18810c42772608787343 Value: IPhKReGhyY |
|
.csgo-magic.pw/ | Name: __cfduid Value: dbe94698835468b974415a4d16e5f08411539531258 |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
code.jquery.com
csgo-magic.pw
205.185.208.52
2606:4700:30::681b:9e68
099baa3865b253513ad293b1265b38afd78b695b02bca4588da940bdd6d21f73
14e289ddfcf954a3c444052a4df4f91aa9eaf966e5cd961da8bcd6a359978108
159033fda21b2a1fa95a4556cfc05a75d567c3811d0d71343690fa5c9e90c03e
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
1ed578ce4277b69c8c1220a3350090b07029420cab6849e914e8d7c5db64b81b
1f65c35ba697a5dca01a6a1f027985aeb3c4b2173db3c9cacfcf05d985996d9c
24b44c02f3951bf9f8705cee0141e776e12ea2c9b9380292cde5220b088f026f
44f8a56d427917b5fa0dd7933ba545679be5e6b3b93099e64a4e29c2159f57c0
4c5a11635038c1bda084afa1b18ef8c8344a17fc58c012e36bb0a62f5e92f22a
5517f3b0d61890ed5ea17d8dd79c1c8ee22cc636d32f7a9f7748d0ed9705d7ae
55accff7b642c2d7a402cbe03c1494c0f14a76bc03dee9d47d219562b6a152a5
768aa55a5e4391696b4ef2eecb1e4e6df56149e6529f633531b4d9eef8d87962
805bf80e5f90e9f5700846b29ead135b8931d242d1b54c46cc83c8c0d3b5b7cd
a6538f89697a8037a90e19790867ac94b0fb9a0276402312f11c639d2e81bfec
d3ebb498192527b985939ae62cc4e5eb5c108efc1896184126b45d866868e73d
de27d189999924b6ac5e36e0c2e9c26a7e11e9b2a2e06ba1ecce7971d879fd66
e0e8c3f32872eabfe3c405c13ea5c463339188212ecea1d9660b735c1a1af16e
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f357c6f62b6a3d86c15ab0c5d31d7695a77b7882a26f42a0b5399c1f0901c1e9