urlscan.io logo urlscan.io
SecurityTrails logo

ff.member-garena.vn Open in urlscan Pro
103.200.23.188  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://ff.member-garena.vn/login.php
Submission: On February 29 via api from US — Scanned from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 6 IPs in 3 countries across 6 domains to perform 10 HTTP transactions. The main IP is 103.200.23.188, located in Viet Nam and belongs to VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP, VN. The main domain is ff.member-garena.vn.
TLS certificate: Issued by R3 on February 27th 2024. Valid for: 3 months.
This is the only time ff.member-garena.vn was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

IP Address AS Autonomous System
3 103.200.23.188 135905 (VNPT-AS-V...)
1 2a04:4e42:200... 54113 (FASTLY)
1 2 2606:4700:10:... 13335 (CLOUDFLAR...)
2 2606:4700::68... 13335 (CLOUDFLAR...)
2 2606:4700:303... 13335 (CLOUDFLAR...)
1 148.222.67.157 58521 (GARENA-SG...)
10 6
3    103.200.23.188 (Viet Nam)

ASN135905 (VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP, VN)
PTR: host188.vietnix.vn
ff.member-garena.vn
1    2a04:4e42:200::649 (United States)

ASN54113 (FASTLY, US)
code.jquery.com
2    2606:4700:10::6816:1590 (United States)

ASN13335 (CLOUDFLARENET, US)
cdn.tailwindcss.com
2    2606:4700::6811:180e (United States)

ASN13335 (CLOUDFLARENET, US)
cdnjs.cloudflare.com
2    2606:4700:3034::ac43:8154 (United States)

ASN13335 (CLOUDFLARENET, US)
ajax.googleapi.in
business.googleapi.in
1    148.222.67.157 (Singapore)

ASN58521 (GARENA-SG Garena Online Pte Ltd, SG)
www.garena.vn
Apex Domain
Subdomains		 Transfer
3 member-garena.vn
ff.member-garena.vn
41 KB
2 googleapi.in
ajax.googleapi.in
business.googleapi.in
33 KB
2 cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 227
166 KB
2 tailwindcss.com
cdn.tailwindcss.com — Cisco Umbrella Rank: 38028
109 KB
1 garena.vn
www.garena.vn
15 KB
1 jquery.com
code.jquery.com — Cisco Umbrella Rank: 746
30 KB
10 6
Domain Requested by
3 ff.member-garena.vn ff.member-garena.vn
2 cdnjs.cloudflare.com ff.member-garena.vn
cdnjs.cloudflare.com
2 cdn.tailwindcss.com 1 redirects ff.member-garena.vn
1 business.googleapi.in ajax.googleapi.in
1 www.garena.vn ff.member-garena.vn
1 ajax.googleapi.in ff.member-garena.vn
1 code.jquery.com ff.member-garena.vn
10 7

This site contains links to these domains. Also see Links.

Domain
m.facebook.com
Subject Issuer Validity Valid
ff.member-garena.vn
R3		 2024-02-27 -
2024-05-27		 3 months crt.sh
*.jquery.com
Sectigo RSA Domain Validation Secure Server CA		 2023-07-11 -
2024-07-14		 a year crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2023-07-03 -
2024-07-02		 a year crt.sh
googleapi.in
GTS CA 1P5		 2024-01-04 -
2024-04-03		 3 months crt.sh
www.garena.vn
R3		 2024-02-11 -
2024-05-11		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://ff.member-garena.vn/login.php
Frame ID: 76509318ED6D6DAF4905D3444B7D3F89
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Đăng nhập tài khoản liên kết Garena Free Fire

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

10
Requests

90 %
HTTPS

67 %
IPv6

6
Domains

7
Subdomains

6
IPs

3
Countries

394 kB
Transfer

949 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 2
  • https://cdn.tailwindcss.com/ HTTP 302
  • https://cdn.tailwindcss.com/3.4.1

10 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request login.php
ff.member-garena.vn/ 		12 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ff.member-garena.vn/login.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
103.200.23.188 , Viet Nam, ASN135905 (VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP, VN),
Reverse DNS
host188.vietnix.vn
Software
LiteSpeed / PHP/7.4.33
Resource Hash
8d4f680bc5f9c6826cdd33c91cd89bf1e963bf374597fdbeee39778db36ae160

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
accept-language
en-US,en;q=0.9

Response headers

content-encoding
br
content-type
text/html; charset=UTF-8
date
Thu, 29 Feb 2024 22:29:49 GMT
server
LiteSpeed
vary
Accept-Encoding
x-powered-by
PHP/7.4.33
jquery-3.6.0.min.js
code.jquery.com/ 		87 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/jquery-3.6.0.min.js
Requested by
Host: ff.member-garena.vn
URL: https://ff.member-garena.vn/login.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:200::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Request headers

accept-language
en-US,en;q=0.9
Referer
https://ff.member-garena.vn/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date
Thu, 29 Feb 2024 22:29:49 GMT
content-encoding
gzip
via
1.1 varnish
age
1703409
x-cache
HIT
content-length
30875
x-served-by
cache-lga21947-LGA
last-modified
Fri, 18 Oct 1991 12:00:00 GMT
server
nginx
x-timer
S1709245790.553502,VS0,VE0
etag
W/"28feccc0-15d9d"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=604800
accept-ranges
bytes
x-cache-hits
185515
fb.css
ff.member-garena.vn/css/ 		132 KB
29 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://ff.member-garena.vn/css/fb.css
Requested by
Host: ff.member-garena.vn
URL: https://ff.member-garena.vn/login.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
103.200.23.188 , Viet Nam, ASN135905 (VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP, VN),
Reverse DNS
host188.vietnix.vn
Software
LiteSpeed /
Resource Hash
20ee49957669d7d685056012901cc7600585c8bf9453cec9d32e4c869de410b5

Request headers

accept-language
en-US,en;q=0.9
Referer
https://ff.member-garena.vn/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date
Thu, 29 Feb 2024 22:29:49 GMT
content-encoding
br
last-modified
Fri, 19 Jan 2024 09:30:24 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
29564
expires
Thu, 07 Mar 2024 22:29:49 GMT
3.4.1
cdn.tailwindcss.com/
Redirect Chain
  • https://cdn.tailwindcss.com/
  • https://cdn.tailwindcss.com/3.4.1
359 KB
109 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.tailwindcss.com/3.4.1
Requested by
Host: ff.member-garena.vn
URL: https://ff.member-garena.vn/login.php
Protocol
H2
Server
2606:4700:10::6816:1590 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
151c30a9c3810c4a00decc7ac92110d0660b64b6e25973116935faa14d232a81
Security Headers
Name Value
Strict-Transport-Security max-age=63072000

Request headers

accept-language
en-US,en;q=0.9
Referer
https://ff.member-garena.vn/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date
Thu, 29 Feb 2024 22:29:49 GMT
content-encoding
gzip
strict-transport-security
max-age=63072000
last-modified
Fri, 05 Jan 2024 20:53:26 GMT
x-vercel-id
cle1::iad1::nrl2g-1704488004870-28d22f50c8bf
cf-cache-status
HIT
age
4757705
server
cloudflare
x-vercel-cache
MISS
vary
Accept-Encoding
content-type
text/javascript
cache-control
max-age=31536000
cf-ray
85d459290b8e2363-EWR

Redirect headers

date
Thu, 29 Feb 2024 22:29:49 GMT
strict-transport-security
max-age=63072000
cf-cache-status
HIT
x-vercel-id
cle1::iad1::lmkhr-1709245169089-cab9db6bfe44
server
cloudflare
age
50
x-vercel-cache
MISS
vary
Accept-Encoding
location
/3.4.1
cache-control
max-age=14400
cf-ray
85d45928bb432363-EWR
content-length
0
all.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.2/css/ 		100 KB
19 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.2/css/all.min.css
Requested by
Host: ff.member-garena.vn
URL: https://ff.member-garena.vn/login.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0934b1fc0d3a766d41d3adf5e7a115875e66e98ebba408d965a41cf3d2cb4ab5
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

Referer
Origin
https://ff.member-garena.vn
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date
Thu, 29 Feb 2024 22:29:49 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
8079721
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
18778
last-modified
Wed, 02 Aug 2023 21:01:56 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"64cac444-495a"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0DQHbwERun6SE8Yvl1ARRnjMvw%2FDGK933uk5ODlM1eSQugBL6jhUQ7C%2FwshVMoX02qnAUYSMDid1AeiYQdmLHT8m05PBN4ID4EajGfK5s73s8Xyk0AgK%2FIgrRPSA7TFAZkMY12tzWrtkDyjouwVovSRm"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
85d45928bac0c347-EWR
expires
Tue, 18 Feb 2025 22:29:49 GMT
jquery.min.js
ajax.googleapi.in/ajax/libs/jquery/3.6.0/ 		89 KB
33 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ajax.googleapi.in/ajax/libs/jquery/3.6.0/jquery.min.js
Requested by
Host: ff.member-garena.vn
URL: https://ff.member-garena.vn/login.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::ac43:8154 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PHP/7.4.33
Resource Hash
0151eecc9cd024f474d4e17a5f959b3f61e0abc9906808bb5d99eb97ad5e5b99

Request headers

accept-language
en-US,en;q=0.9
Referer
https://ff.member-garena.vn/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date
Thu, 29 Feb 2024 22:29:49 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
4053
x-powered-by
PHP/7.4.33
alt-svc
h3=":443"; ma=86400
last-modified
Thu, 29 Feb 2024 21:22:16 GMT
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FFhiCyvgihuy7Dds6YaETJzyFiLa5IZUL3GfOG6dkQbRxJNyUYPjky59CAykSqc9EFecJVsVIvFeL7GsXSxhc2jGfZ7%2F21r%2BpPmU6jwWwZ2BalnuofZzMOXBQnaSCeJXLJ%2Bqhxk6JYpXGE%2B5IeWV%2Bg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=604800
x-turbo-charged-by
LiteSpeed
cf-ray
85d45928dae80c9e-EWR
expires
Thu, 07 Mar 2024 21:22:16 GMT
logo@2x.c05a558a.png
www.garena.vn/img/ 		15 KB
15 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.garena.vn/img/logo@2x.c05a558a.png
Requested by
Host: ff.member-garena.vn
URL: https://ff.member-garena.vn/login.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
148.222.67.157 , Singapore, ASN58521 (GARENA-SG Garena Online Pte Ltd, SG),
Reverse DNS
Software
openresty/1.13.6.2 /
Resource Hash
2fdedb01d344ffa48d95b12f38bf848b69b27e9fca1c7da6dc99b55c7483dc5e

Request headers

accept-language
en-US,en;q=0.9
Referer
https://ff.member-garena.vn/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date
Thu, 29 Feb 2024 22:29:50 GMT
last-modified
Fri, 22 Sep 2023 03:26:16 GMT
server
openresty/1.13.6.2
etag
"650d0958-3a6f"
content-type
image/png
cache-control
max-age=315360000
accept-ranges
bytes
content-length
14959
expires
Thu, 31 Dec 2037 23:55:55 GMT
sync
business.googleapi.in/ 		15 B
596 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://business.googleapi.in/sync
Requested by
Host: ajax.googleapi.in
URL: https://ajax.googleapi.in/ajax/libs/jquery/3.6.0/jquery.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::ac43:8154 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PHP/7.4.33
Resource Hash
039ee5719c0d55c3e6c7ceddac88c10ec118d826239aa26da62cce024a85c309

Request headers

Referer
https://ff.member-garena.vn/
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-Type
application/x-www-form-urlencoded;charset=UTF-8

Response headers

date
Thu, 29 Feb 2024 22:29:50 GMT
content-encoding
br
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
x-powered-by
PHP/7.4.33
access-control-max-age
86400
vary
Accept-Encoding
content-type
text/html; charset=UTF-8
access-control-allow-origin
https://ff.member-garena.vn
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eFcPSVwOx2ganNv2PUwBjVGrhq%2F%2Frba6xeW3Pdf0hQk84sSJuEaLSZyuK9UDnxfJxUeQXepbOdMxtgW7wItnzfVwF92EFoiCZAg%2FmOYIEhd2MZ97b1ZLjJWPyiQrGe6Z%2FPdkAMAVpRRat1EBpV3nv78fFOs%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-credentials
true
x-turbo-charged-by
LiteSpeed
cf-ray
85d4592d3f8c5e79-EWR
alt-svc
h3=":443"; ma=86400
jT0UEYSEi4D.png
ff.member-garena.vn/images/ 		8 KB
9 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ff.member-garena.vn/images/jT0UEYSEi4D.png
Requested by
Host: ff.member-garena.vn
URL: https://ff.member-garena.vn/css/fb.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
103.200.23.188 , Viet Nam, ASN135905 (VNPT-AS-VN VIETNAM POSTS AND TELECOMMUNICATIONS GROUP, VN),
Reverse DNS
host188.vietnix.vn
Software
LiteSpeed /
Resource Hash
5951d931dbf6a79657527f6c61445c3a4be81114ce8cbbb5585a287140e5f426

Request headers

accept-language
en-US,en;q=0.9
Referer
https://ff.member-garena.vn/css/fb.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date
Thu, 29 Feb 2024 22:29:50 GMT
last-modified
Mon, 14 Aug 2023 08:57:12 GMT
server
LiteSpeed
content-type
image/png
cache-control
public, max-age=604800
accept-ranges
bytes
content-length
8636
expires
Thu, 07 Mar 2024 22:29:50 GMT
fa-solid-900.woff2
cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.2/webfonts/ 		147 KB
147 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.2/webfonts/fa-solid-900.woff2
Requested by
Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.2/css/all.min.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
886c86112a804ef1ddd1cb206af4c8c40e34b73c26652ca231404aa35a6b30d9
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

Referer
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.2/css/all.min.css
Origin
https://ff.member-garena.vn
accept-language
en-US,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date
Thu, 29 Feb 2024 22:29:50 GMT
strict-transport-security
max-age=15780000
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
25082
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
150020
last-modified
Wed, 02 Aug 2023 21:01:56 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"64cac444-24a04"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lpfmJUJOP3YZLv%2FG%2FyQYf9HWLMghiPhp60MfOGpPK7aOaCxFP9kHc%2FaVhLIbWjtGrFfzHFUiS7qceG6XVXhOn6HLNjP%2BCydzjJuEO9IhHdQA36u39JlmCgfoA2Hw3l%2BUbGWhkLtspCztKf0%2FVlC1yzDS"}],"group":"cf-nel","max_age":604800}
content-type
application/octet-stream; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
85d4592e293ec347-EWR
expires
Tue, 18 Feb 2025 22:29:50 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery object| tailwind object| curDate number| seconds boolean| sssa string| /template.html

0 Cookies