xacminh.riotgames-vn.com
Open in
urlscan Pro
14.249.212.183
Malicious Activity!
Public Scan
Submission: On May 09 via api from US
Summary
TLS certificate: Issued by Let's Encrypt Authority X3 on March 27th 2020. Valid for: 3 months.
This is the only time xacminh.riotgames-vn.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Garena Free Fire (Gaming)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
3 | 14.249.212.183 14.249.212.183 | 45899 (VNPT-AS-V...) (VNPT-AS-VN VNPT Corp) | |
4 | 103.247.206.12 103.247.206.12 | 58521 (GARENA-SG...) (GARENA-SG Garena Online Pte Ltd) | |
2 | 2606:4700::68... 2606:4700::6810:84e5 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
9 | 3 |
ASN45899 (VNPT-AS-VN VNPT Corp, VN)
PTR: static.vnpt.vn
xacminh.riotgames-vn.com |
ASN58521 (GARENA-SG Garena Online Pte Ltd, SG)
auth.garena.com | |
gop.captcha.garena.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
4 |
garena.com
auth.garena.com gop.captcha.garena.com |
18 KB |
3 |
riotgames-vn.com
xacminh.riotgames-vn.com |
14 KB |
2 |
cloudflare.com
cdnjs.cloudflare.com |
43 KB |
9 | 3 |
Domain | Requested by | |
---|---|---|
3 | auth.garena.com |
xacminh.riotgames-vn.com
|
3 | xacminh.riotgames-vn.com |
xacminh.riotgames-vn.com
|
2 | cdnjs.cloudflare.com |
xacminh.riotgames-vn.com
|
1 | gop.captcha.garena.com |
xacminh.riotgames-vn.com
|
9 | 4 |
This site contains links to these domains. Also see Links.
Domain |
---|
account.garena.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
xacminh.riotgames-vn.com Let's Encrypt Authority X3 |
2020-03-27 - 2020-06-25 |
3 months | crt.sh |
auth.garena.com SSL.com RSA SSL subCA |
2020-04-29 - 2022-07-28 |
2 years | crt.sh |
cloudflare.com CloudFlare Inc ECC CA-2 |
2020-01-07 - 2020-10-09 |
9 months | crt.sh |
gop.captcha.garena.com Sectigo RSA Domain Validation Secure Server CA |
2019-12-09 - 2021-12-08 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
https://xacminh.riotgames-vn.com/garena_login_ss=T80wzIkaIEM1.php?game=LMHT
Frame ID: 9382B8ED74F07E643A6096140FC54AA1
Requests: 9 HTTP requests in this frame
1 Outgoing links
These are links going to different origins than the main page.
Title: Quên mật khẩu?
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
9 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
garena_login_ss=T80wzIkaIEM1.php
xacminh.riotgames-vn.com/ |
3 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
sso.css
auth.garena.com/css/ |
27 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
img_garena_logo.png
auth.garena.com/images/ |
6 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
cdnjs.cloudflare.com/ajax/libs/jquery/3.3.1/ |
85 KB 29 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.js
cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/4.1.3/js/ |
50 KB 13 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sweetalert.min.js
xacminh.riotgames-vn.com/assets/js/ |
40 KB 12 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
script1.js
xacminh.riotgames-vn.com/assets/js/ |
3 KB 933 B |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bg.png
auth.garena.com/images/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
image
gop.captcha.garena.com/ |
3 KB 3 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Garena Free Fire (Gaming)13 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate function| $ function| jQuery object| bootstrap function| setImmediate function| clearImmediate function| swal function| sweetAlert function| captchaGenerate function| refreshCaptcha function| loginHandle function| eventHandle1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
xacminh.riotgames-vn.com/ | Name: PHPSESSID Value: oaqjj1od00unq3cp0i9fsghbn5 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
auth.garena.com
cdnjs.cloudflare.com
gop.captcha.garena.com
xacminh.riotgames-vn.com
103.247.206.12
14.249.212.183
2606:4700::6810:84e5
1052ac0fe02e8c3300c458dc1a059335150c1e46d0476a5d0fb5a809af3ef263
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
1b69cd309f505d5fa3b31eb8ce3e5532a777f8c70e8c30949146ba722ea46838
28f1ede50635bda21c5df516178edf4625a44f98e9f7062524e8b6c93cdb26ec
49215a13355f13e9e569b0af0771dc53785b9b95a03fbb5572047face5351603
55ff8578db3a7e8d57214fb961b4c908ce5fd4bf66a53be77d989b1b16d82410
56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4
6c1040c11e8e717af263c9a2a4b3f25abfbdfef74d39fdc980b48035b58e85b5
c0fa1162cad4e56b9dee88282c3fc251a083c9254325143345ce332495516e24