major-liga.com Open in urlscan Pro
38.153.122.36 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://major-liga.com/4t75mn45vums.html
Submission Tags: @phish_report
Submission: On December 07 via api (December 7th 2024, 7:53:00 pm UTC) from FI — Scanned from FI

Summary HTTP 8 Redirects Links 7 Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 8 HTTP transactions. The main IP is 38.153.122.36, located in United States and belongs to SERVER-MANIA, CA. The main domain is major-liga.com.
TLS certificate: Issued by R11 on November 18th 2024. Valid for: 3 months.

This is the only time major-liga.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Steam (Gaming)

Domain & IP information

	IP Address	AS Autonomous System
2	38.153.122.36 38.153.122.36	55286 (SERVER-MANIA) (SERVER-MANIA)
6	92.51.45.44 92.51.45.44	9123 (TimeWeb-A...) (TimeWeb-AS TimeWeb Ltd.)
8	3

2 38.153.122.36 (United States)

ASN55286 (SERVER-MANIA, CA)
PTR: darkhost.pro

major-liga.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 92.51.45.44 (Amsterdam, Netherlands)

ASN9123 (TimeWeb-AS TimeWeb Ltd., RU)
PTR: vds-ci74127.timeweb.ru

godzeella.shop	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	godzeella.shop godzeella.shop	1 KB
2	major-liga.com major-liga.com	1 MB
8	2

	Domain	Requested by
6	godzeella.shop	major-liga.com
2	major-liga.com	major-liga.com
8	2

This site contains links to these domains. Also see Links.

Domain
store.steampowered.com
steamcommunity.com
help.steampowered.com

Subject Issuer	Validity	Valid
major-liga.com R11	`2024-11-18` - `2025-02-16`	3 months	crt.sh
godzeella.shop R11	`2024-11-30` - `2025-02-28`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://major-liga.com/4t75mn45vums.html
Frame ID: 7B37EA5DE41BEDC394A582413CFFCCFA
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Kirjaudu sisään

Page Statistics

8
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

1331 kB
Transfer

1501 kB
Size

1
Cookies

7 Outgoing links

These are links going to different origins than the main page.

URL: https://store.steampowered.com/
Title: KAUPPA

Search URL Search Domain Scan URL

URL: https://steamcommunity.com/
Title: YHTEISÖ

Search URL Search Domain Scan URL

URL: https://store.steampowered.com/about/
Title: TIETOJA

Search URL Search Domain Scan URL

URL: https://help.steampowered.com/
Title: TUKI

Search URL Search Domain Scan URL

URL: https://help.steampowered.com/wizard/HelpWithLogin
Title: Apua! En pääse tililleni.

Search URL Search Domain Scan URL

URL: https://store.steampowered.com/mobile
Title: Steam-mobiilisovellus

Search URL Search Domain Scan URL

URL: https://store.steampowered.com/join
Title: Liity Steamiin

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions
7 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request 4t75mn45vums.html Show response major-liga.com/	51 KB 51 KB	718ms 262ms	Document text/html	38.153.122.36 SERVER-MANIA
General Check archive.org Show headers Download Go to Full URL https://major-liga.com/4t75mn45vums.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 38.153.122.36 , United States, ASN55286 (SERVER-MANIA, CA), Reverse DNS darkhost.pro Software nginx / Resource Hash `2bd673a24b568cc3df5fb08dac22224050332177cdf120bedc56d494b264359e` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers accept-ranges bytes content-length 51795 content-type text/html; charset=UTF-8 date Sat, 07 Dec 2024 19:52:56 GMT etag "ca53-6288c82610758" last-modified Thu, 05 Dec 2024 21:23:28 GMT server nginx
GET H2	200	m91o74wllm32.js Show response major-liga.com/	1 MB 1 MB	130ms 130ms	Script application/javascript	38.153.122.36 SERVER-MANIA
General Check archive.org Show headers Download Go to Full URL https://major-liga.com/m91o74wllm32.js Requested by Host: major-liga.com URL: https://major-liga.com/4t75mn45vums.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 38.153.122.36 , United States, ASN55286 (SERVER-MANIA, CA), Reverse DNS darkhost.pro Software nginx / Resource Hash `f18eae8c5cd9e9c45413bdf6c1b024c8fb932447dbbe7a9f1a47163262450ce3` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer https://major-liga.com/4t75mn45vums.html Response headers accept-ranges bytes content-length 1308636 date Sat, 07 Dec 2024 19:52:57 GMT etag "675219d0-13f7dc" content-type application/javascript; charset=UTF-8 last-modified Thu, 05 Dec 2024 21:23:28 GMT server nginx
OPTIONS H/1.1	204 No Content	dkheikvrhobordyqqhmiksncrlyaekxfgtbhicwsiytgxn godzeella.shop/	0 0	328ms 63ms	Preflight	92.51.45.44 TimeWeb-AS TimeWe...
General Check archive.org Show headers Download Go to Full URL https://godzeella.shop/dkheikvrhobordyqqhmiksncrlyaekxfgtbhicwsiytgxn Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 92.51.45.44 Amsterdam, Netherlands, ASN9123 (TimeWeb-AS TimeWeb Ltd., RU), Reverse DNS vds-ci74127.timeweb.ru Software / Express Resource Hash Request headers Accept / Access-Control-Request-Headers content-type Access-Control-Request-Method POST Origin https://major-liga.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers Access-Control-Allow-Headers Origin, X-Requested-With, Content-Type, Accept Access-Control-Allow-Origin * Connection keep-alive Date Sat, 07 Dec 2024 19:52:57 GMT ETag W/"a-bAsFyilMr4Ra1hIU5PyoyFRunpI" Keep-Alive timeout=5 X-Powered-By Express
POST H/1.1	200 OK	dkheikvrhobordyqqhmiksncrlyaekxfgtbhicwsiytgxn Show response godzeella.shop/	48 B 393 B	96ms 95ms	XHR application/json	92.51.45.44 TimeWeb-AS TimeWe...
General Check archive.org Show headers Download Go to Full URL https://godzeella.shop/dkheikvrhobordyqqhmiksncrlyaekxfgtbhicwsiytgxn Requested by Host: major-liga.com URL: https://major-liga.com/m91o74wllm32.js Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 92.51.45.44 Amsterdam, Netherlands, ASN9123 (TimeWeb-AS TimeWeb Ltd., RU), Reverse DNS vds-ci74127.timeweb.ru Software / Express Resource Hash `d1ecea0416266170fd29376274143b0383f584f0791186a8dc03dbe7d4a023ea` Request headers Referer https://major-liga.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept application/json, text/plain, / Content-Type application/json Response headers ETag W/"30-spwkPwJV+zgVH8lObUWD2HHwZ+Y" Connection keep-alive Access-Control-Allow-Origin * Content-Length 48 Keep-Alive timeout=5 Date Sat, 07 Dec 2024 19:52:57 GMT Content-Type application/json; charset=utf-8 X-Powered-By Express Access-Control-Allow-Headers Origin, X-Requested-With, Content-Type, Accept
GET DATA	200 OK	truncated /	291 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `23341256db7f44b1f3811880fa2bae6b7748bbf6b62c544a162e38cf0d5c5082` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer Response headers Content-Type image/png
GET DATA	200 OK	truncated /	61 B 0		Image image/gif
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `42c062de8dcd760b409c57fb256a68db9435008f1097d3940131ee0ac9a43d27` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer Response headers Content-Type image/gif
GET DATA	200 OK	truncated /	122 KB 0		Image image/jpeg
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `9a75f8cc40bbe9c9499e7b2d3bab98a447685a361489357a111479517005c954` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer Response headers Content-Type image/jpeg
GET DATA	200 OK	truncated /	4 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `fc9e6260a2706ae146282d77e67bc1b74688435f8912ab4c1932641eec28bffa` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer Response headers Content-Type image/png
GET DATA	200 OK	truncated /	11 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `6cb869df089146c12efb5e9c968e911c314842624ba6f052a11346ac734cadc8` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer Response headers Content-Type image/png
GET DATA	200 OK	truncated /	33 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `a59657d4f7db10fefd0c0812bc93e00fa5bb4469b7ab55cebd41a0a9961f8e44` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer Response headers Content-Type image/png
GET DATA	200 OK	truncated /	4 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `ae9f6c61e25d15882bf57bde193d10d375bd315c9741cabda11d700fd1bb7dd1` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Referer Response headers Content-Type image/png
POST H/1.1	200 OK	cczuhqrkeulfczbpk Show response godzeella.shop/	71 B 416 B	464ms 462ms	XHR application/json	92.51.45.44 TimeWeb-AS TimeWe...
General Check archive.org Show headers Download Go to Full URL https://godzeella.shop/cczuhqrkeulfczbpk Requested by Host: major-liga.com URL: https://major-liga.com/m91o74wllm32.js Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 92.51.45.44 Amsterdam, Netherlands, ASN9123 (TimeWeb-AS TimeWeb Ltd., RU), Reverse DNS vds-ci74127.timeweb.ru Software / Express Resource Hash `fe647b8ac0bc577c9b52998cec5d72098798ea296a2d09d671ec3740559f72e1` Request headers Referer https://major-liga.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept application/json, text/plain, / Content-Type application/json Response headers ETag W/"47-NGsCefN7Zm56ZW2ytUmtADi9j2Y" Connection keep-alive Access-Control-Allow-Origin * Content-Length 71 Keep-Alive timeout=5 Date Sat, 07 Dec 2024 19:52:57 GMT Content-Type application/json; charset=utf-8 X-Powered-By Express Access-Control-Allow-Headers Origin, X-Requested-With, Content-Type, Accept
OPTIONS H/1.1	204 No Content	cczuhqrkeulfczbpk godzeella.shop/	0 0	62ms 62ms	Preflight	92.51.45.44 TimeWeb-AS TimeWe...
General Check archive.org Show headers Download Go to Full URL https://godzeella.shop/cczuhqrkeulfczbpk Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 92.51.45.44 Amsterdam, Netherlands, ASN9123 (TimeWeb-AS TimeWeb Ltd., RU), Reverse DNS vds-ci74127.timeweb.ru Software / Express Resource Hash Request headers Accept / Access-Control-Request-Headers content-type Access-Control-Request-Method POST Origin https://major-liga.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers Access-Control-Allow-Headers Origin, X-Requested-With, Content-Type, Accept Access-Control-Allow-Origin * Connection keep-alive Date Sat, 07 Dec 2024 19:52:57 GMT ETag W/"a-bAsFyilMr4Ra1hIU5PyoyFRunpI" Keep-Alive timeout=5 X-Powered-By Express
POST H/1.1	200 OK	ckxshjvpehspcuqxk Show response godzeella.shop/	79 B 424 B	116ms 115ms	XHR application/json	92.51.45.44 TimeWeb-AS TimeWe...
General Check archive.org Show headers Download Go to Full URL https://godzeella.shop/ckxshjvpehspcuqxk Requested by Host: major-liga.com URL: https://major-liga.com/m91o74wllm32.js Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 92.51.45.44 Amsterdam, Netherlands, ASN9123 (TimeWeb-AS TimeWeb Ltd., RU), Reverse DNS vds-ci74127.timeweb.ru Software / Express Resource Hash `12391bd913362c5760121082c45cf23112bf30a8513de1830b6ba615b9b8b4a6` Request headers Referer https://major-liga.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept application/json, text/plain, / Content-Type application/json Response headers ETag W/"4f-Cehoks2F9Tjby/qlrXMqxK1YuEs" Connection keep-alive Access-Control-Allow-Origin * Content-Length 79 Keep-Alive timeout=5 Date Sat, 07 Dec 2024 19:52:59 GMT Content-Type application/json; charset=utf-8 X-Powered-By Express Access-Control-Allow-Headers Origin, X-Requested-With, Content-Type, Accept
OPTIONS H/1.1	204 No Content	ckxshjvpehspcuqxk godzeella.shop/	0 0	64ms 64ms	Preflight	92.51.45.44 TimeWeb-AS TimeWe...
General Check archive.org Show headers Download Go to Full URL https://godzeella.shop/ckxshjvpehspcuqxk Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 92.51.45.44 Amsterdam, Netherlands, ASN9123 (TimeWeb-AS TimeWeb Ltd., RU), Reverse DNS vds-ci74127.timeweb.ru Software / Express Resource Hash Request headers Accept / Access-Control-Request-Headers content-type Access-Control-Request-Method POST Origin https://major-liga.com Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Response headers Access-Control-Allow-Headers Origin, X-Requested-With, Content-Type, Accept Access-Control-Allow-Origin * Connection keep-alive Date Sat, 07 Dec 2024 19:52:59 GMT ETag W/"a-bAsFyilMr4Ra1hIU5PyoyFRunpI" Keep-Alive timeout=5 X-Powered-By Express

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Steam (Gaming)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| s28_0x5e0e function| s28_0x3257 function| _ function| cl

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			major-liga.com/	1969-12-31 23:59:59	Name: uv Value: m4eldoyv-mjx2w8o1

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	verbose	URL: https://major-liga.com/4t75mn45vums.html Message: [DOM] Password field is not contained in a form: (More info: https://goo.gl/9p2vKq) %o

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

godzeella.shop
major-liga.com
38.153.122.36
92.51.45.44
12391bd913362c5760121082c45cf23112bf30a8513de1830b6ba615b9b8b4a6
23341256db7f44b1f3811880fa2bae6b7748bbf6b62c544a162e38cf0d5c5082
2bd673a24b568cc3df5fb08dac22224050332177cdf120bedc56d494b264359e
42c062de8dcd760b409c57fb256a68db9435008f1097d3940131ee0ac9a43d27
6cb869df089146c12efb5e9c968e911c314842624ba6f052a11346ac734cadc8
9a75f8cc40bbe9c9499e7b2d3bab98a447685a361489357a111479517005c954
a59657d4f7db10fefd0c0812bc93e00fa5bb4469b7ab55cebd41a0a9961f8e44
ae9f6c61e25d15882bf57bde193d10d375bd315c9741cabda11d700fd1bb7dd1
d1ecea0416266170fd29376274143b0383f584f0791186a8dc03dbe7d4a023ea
f18eae8c5cd9e9c45413bdf6c1b024c8fb932447dbbe7a9f1a47163262450ce3
fc9e6260a2706ae146282d77e67bc1b74688435f8912ab4c1932641eec28bffa
fe647b8ac0bc577c9b52998cec5d72098798ea296a2d09d671ec3740559f72e1

major-liga.com Open in urlscan Pro 38.153.122.36 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

8 Requests

100 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

3 IPs

2 Countries

1331 kBTransfer

1501 kBSize

1 Cookies

7 Outgoing links

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 7 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

1 Cookies

1 Console Messages

Indicators

major-liga.com Open in urlscan Pro
38.153.122.36 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

1331 kB
Transfer

1501 kB
Size

1
Cookies

8 HTTP transactions
7 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!