www.lienquan9thang10garenamobile.cf
Open in
urlscan Pro
103.130.216.180
Malicious Activity!
Public Scan
URL:
http://www.lienquan9thang10garenamobile.cf/ui/login/
Submission: On November 02 via automatic, source openphish — Scanned from DE
Submission: On November 02 via automatic, source openphish — Scanned from DE
Summary
This website contacted 2 IPs
in 2 countries
across 2 domains to perform 5 HTTP transactions.
The main IP is 103.130.216.180, located in
Viet Nam and
belongs to WEBICO-AS-VN Webico Company Limited, VN.
The main domain is www.lienquan9thang10garenamobile.cf.
This is the only time www.lienquan9thang10garenamobile.cf was scanned on urlscan.io!
This is the only time www.lienquan9thang10garenamobile.cf was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Garena Free Fire (Gaming)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 | 103.130.216.180 103.130.216.180 | 135951 (WEBICO-AS...) (WEBICO-AS-VN Webico Company Limited) | |
| 1 5 | 202.81.112.197 202.81.112.197 | 58521 (GARENA-SG...) (GARENA-SG Garena Online Pte Ltd) | |
| 5 | 2 |
1
103.130.216.180
(Viet Nam)
ASN135951 (WEBICO-AS-VN Webico Company Limited, VN)
PTR: rdns.tino.org
ASN135951 (WEBICO-AS-VN Webico Company Limited, VN)
PTR: rdns.tino.org
| www.lienquan9thang10garenamobile.cf |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 5 |
garena.com
1 redirects
auth.garena.com — Cisco Umbrella Rank: 390667 |
25 KB |
| 1 |
lienquan9thang10garenamobile.cf
www.lienquan9thang10garenamobile.cf |
1 KB |
| 5 | 2 |
| Domain | Requested by | |
|---|---|---|
| 5 | auth.garena.com |
1 redirects
www.lienquan9thang10garenamobile.cf
auth.garena.com |
| 1 | www.lienquan9thang10garenamobile.cf | |
| 5 | 2 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| auth.garena.com SSL.com RSA SSL subCA |
2022-06-28 - 2023-06-28 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
http://www.lienquan9thang10garenamobile.cf/ui/login/
Frame ID: 0DAEB2F0B6C2E092F2E8A339F20F1B9D
Requests: 5 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://auth.garena.com/css/sso.css?v=0.54 HTTP 301
- https://auth.garena.com/css/sso.css?v=0.54
5 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
/
www.lienquan9thang10garenamobile.cf/ui/login/ |
2 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
sso.css
auth.garena.com/css/ Redirect Chain
|
30 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
img_garena_logo.png
auth.garena.com/images/ |
6 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bg.png
auth.garena.com/images/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
logo-facebook.png
auth.garena.com/images/ |
9 KB 9 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Garena Free Fire (Gaming)7 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch object| navigation1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| www.lienquan9thang10garenamobile.cf/ | Name: PHPSESSID Value: c1b927a26f2c3de3b5a51a7211b6392e |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
| Header | Value |
|---|---|
| X-Frame-Options | SAMEORIGIN |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
auth.garena.com
www.lienquan9thang10garenamobile.cf
103.130.216.180
202.81.112.197
1052ac0fe02e8c3300c458dc1a059335150c1e46d0476a5d0fb5a809af3ef263
55ff8578db3a7e8d57214fb961b4c908ce5fd4bf66a53be77d989b1b16d82410
693e7e2e7b0c34658a121509472985dbaf3d238b17689534e100f5854b0e5513
94f92c2fa2a770888470701e4e9c0063d11bd846b52739d8b12a06b2dabd3be2
b2c86bb5830e8d04e822146ed6c7e834b797e1c2992fbb08b43d6a166ea72cf2