Report - rewasy-ff-garens.ru/

Report Overview

Submitted URL
rewasy-ff-garens.ru/
IP
172.67.214.45
ASN
#13335 CLOUDFLARENET
Submitted
2024-04-26 15:39:00
Access
public
Website Title
Free Fire
Final URL
rewasy-ff-garens.ru/freefire/
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
38

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
rewasy-ff-garens.ru	unknown	unknown	No data	No data	9.7 kB	318 kB	104.21.23.241
freefiremobile-a.akamaihd.net	20326	2009-09-14	2017-11-25	2024-04-19	462 B	4.8 kB	23.36.76.90

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-04-26	medium	rewasy-ff-garens.ru	Sinkholed
2024-04-26	medium	rewasy-ff-garens.ru	Sinkholed
2024-04-26	medium	rewasy-ff-garens.ru	Sinkholed
2024-04-26	medium	rewasy-ff-garens.ru	Sinkholed
2024-04-26	medium	rewasy-ff-garens.ru	Sinkholed
2024-04-26	medium	rewasy-ff-garens.ru	Sinkholed
2024-04-26	medium	rewasy-ff-garens.ru	Sinkholed
2024-04-26	medium	rewasy-ff-garens.ru	Sinkholed
2024-04-26	medium	rewasy-ff-garens.ru	Sinkholed
2024-04-26	medium	rewasy-ff-garens.ru	Sinkholed
2024-04-26	medium	rewasy-ff-garens.ru	Sinkholed
2024-04-26	medium	rewasy-ff-garens.ru	Sinkholed
2024-04-26	medium	rewasy-ff-garens.ru	Sinkholed
2024-04-26	medium	rewasy-ff-garens.ru	Sinkholed
2024-04-26	medium	rewasy-ff-garens.ru	Sinkholed
2024-04-26	medium	rewasy-ff-garens.ru	Sinkholed
2024-04-26	medium	rewasy-ff-garens.ru	Sinkholed
2024-04-26	medium	rewasy-ff-garens.ru	Sinkholed
2024-04-26	medium	rewasy-ff-garens.ru	Sinkholed

ThreatFox

No alerts detected

JavaScript (2)

	URL	Size	First Seen	Last Seen
	rewasy-ff-garens.ru/freefire/js/analytics.js	47 kB	2023-03-07	2024-04-30
Pretty URL rewasy-ff-garens.ru/freefire/js/analytics.js IP 104.21.23.241 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:02 Last Seen2024-04-30 03:48:55 Times Seen583 Hash 53ee95b384d866e8692bb1aef923b763 a82812b87b667d32a8e51514c578a5175edd94b4 e441c3e2771625ba05630ab464275136a82c99650ee2145ca5aa9853bedeb01b Loading...

	rewasy-ff-garens.ru/freefire/	0 B	2023-03-07	2024-05-07
Pretty URL rewasy-ff-garens.ru/freefire/ IP 104.21.23.241 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 01:01:59 Last Seen2024-05-07 12:06:32 Times Seen37401188 Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Loading...

HTTP Transactions (20)

URL IP Response Size

rewasy-ff-garens.ru/freefire/

104.21.23.241

200 OK

167 B

URL User Request GET HTTP/3
rewasy-ff-garens.ru/freefire/
IP
104.21.23.241:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerGoogle Trust Services LLC
Subjectrewasy-ff-garens.ru
FingerprintA9:6B:92:93:9E:CA:A2:58:32:F3:42:7B:60:D7:85:E4:DF:8A:A6:3C
ValidityThu, 25 Apr 2024 14:51:07 GMT - Wed, 24 Jul 2024 14:51:06 GMT

File type
HTML document, ASCII text, with CRLF line terminators
Size
167 B (167 bytes)
Hash
0104c301c5e02bd6148b8703d19b3a73
7436e0b4b1f8c222c38069890b75fa2baf9ca620
446a6087825fa73eadb045e5a2e9e2adf7df241b571228187728191d961dda1f

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /freefire/ HTTP/1.1
Host: rewasy-ff-garens.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Cookie: PHPSESSID=dkaueucrjgtko44c7kmmvh89h2
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 301 Moved Permanently
Date: Fri, 26 Apr 2024 15:38:34 GMT
Content-Type: text/html
Content-Length: 167
Connection: keep-alive
Cache-Control: max-age=3600
Expires: Fri, 26 Apr 2024 16:38:34 GMT
Location: https://rewasy-ff-garens.ru/freefire/
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uyMHgmC0jXQqNl2uSNaBRs3phEkZbxVn6DAPTAkpPetRK2vNbubfp7%2Bfx9ovncyN84QNd958I8oJ0Qb3Ab%2BoYyGCnoUUDgcf9n1v%2BLlwXJcRmhL1kS96TjeL%2Be6uvwj9nPbQwW9%2B"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 87a7a91d3e9e569b-OSL
alt-svc: h2=":443"; ma=60

rewasy-ff-garens.ru/freefire/imgg/top_teeth-l.png

104.21.23.241

200 OK

144 B

URL GET HTTP/3
rewasy-ff-garens.ru/freefire/imgg/top_teeth-l.png
IP
104.21.23.241:443
ASN
#13335 CLOUDFLARENET

Requested by
https://rewasy-ff-garens.ru/freefire/
Certificate
IssuerGoogle Trust Services LLC
Subjectrewasy-ff-garens.ru
FingerprintA9:6B:92:93:9E:CA:A2:58:32:F3:42:7B:60:D7:85:E4:DF:8A:A6:3C
ValidityThu, 25 Apr 2024 14:51:07 GMT - Wed, 24 Jul 2024 14:51:06 GMT

File type
PNG image data, 350 x 9, 8-bit/color RGBA, non-interlaced
Size
144 B (144 bytes)
Hash
fe98481dd3ffad514594309ceb2ef4ba
0fcc8e2afec22a1abcbf7de83624504919da9a13
42fcead125ad8660c031f3b763fd048fd06b4a70a7a48cf17bc03073fb255fae

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /freefire/imgg/top_teeth-l.png HTTP/1.1
Host: rewasy-ff-garens.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rewasy-ff-garens.ru/freefire/js/responsive.css
Cookie: PHPSESSID=dkaueucrjgtko44c7kmmvh89h2
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 26 Apr 2024 15:38:34 GMT
content-type: image/png
content-length: 144
last-modified: Tue, 02 May 2023 14:12:30 GMT
etag: "64511a4e-90"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-cache-status: HIT
age: 136759
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NNUlLJSLtO9xTWG8%2FXto%2F2p99XcVwd1DNZMKBLk7ctXehn2bCAbSYyPpjC%2Fh9reXG8F3OVE4PM9BXDivbLTY35ALfy0GNar%2Bq26w4J7%2Flv%2Br%2BJQusCw%2Bke3UzxvGOF%2FjoMhsS4Lb"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87a7a91fc83256c0-OSL
alt-svc: h3=":443"; ma=86400

rewasy-ff-garens.ru/freefire/imgg/bg.jpg

104.21.23.241

200 OK

137 kB

URL GET HTTP/3
rewasy-ff-garens.ru/freefire/imgg/bg.jpg
IP
104.21.23.241:443
ASN
#13335 CLOUDFLARENET

Requested by
https://rewasy-ff-garens.ru/freefire/
Certificate
IssuerGoogle Trust Services LLC
Subjectrewasy-ff-garens.ru
FingerprintA9:6B:92:93:9E:CA:A2:58:32:F3:42:7B:60:D7:85:E4:DF:8A:A6:3C
ValidityThu, 25 Apr 2024 14:51:07 GMT - Wed, 24 Jul 2024 14:51:06 GMT

File type
JPEG image data, JFIF standard 1.01, resolution (DPI), density 1x1, segment length 16, progressive, precision 8, 1920x965, components 3
Size
137 kB (136773 bytes)
Hash
57fd6fc58a09519be8012650efd9881d
bf24f16e0901ebef13336a3b4a6e13263ffb6279
ba96000a92f9d03cce2c34ab48fb9f1e67976be7b4233c1bd607a87e6e9af82d

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /freefire/imgg/bg.jpg HTTP/1.1
Host: rewasy-ff-garens.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rewasy-ff-garens.ru/freefire/js/responsive.css
Cookie: PHPSESSID=dkaueucrjgtko44c7kmmvh89h2
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 26 Apr 2024 15:38:34 GMT
content-type: image/jpeg
content-length: 136773
last-modified: Tue, 02 May 2023 14:12:28 GMT
etag: "64511a4c-21645"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-cache-status: HIT
age: 12979
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mlAeyIghMleTVsAvqwdFo4ski3QmQluPj8YnCvaIM69BkdXjN52W9%2FKEggSKs1Krv2U6dcE%2Fy3E4mKRvwWUP6dBVqysJFNmV2PXDg8I%2F86Z3xTAJPrkmk%2BPB6a5%2FRz%2Bm72YoUjgw"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87a7a91fd83356c0-OSL
alt-svc: h3=":443"; ma=86400

rewasy-ff-garens.ru/freefire/js/responsive.css

104.21.23.241

200 OK

16 kB

URL GET HTTP/3
rewasy-ff-garens.ru/freefire/js/responsive.css
IP
104.21.23.241:443
ASN
#13335 CLOUDFLARENET

Requested by
https://rewasy-ff-garens.ru/freefire/
Certificate
IssuerGoogle Trust Services LLC
Subjectrewasy-ff-garens.ru
FingerprintA9:6B:92:93:9E:CA:A2:58:32:F3:42:7B:60:D7:85:E4:DF:8A:A6:3C
ValidityThu, 25 Apr 2024 14:51:07 GMT - Wed, 24 Jul 2024 14:51:06 GMT

File type
ASCII text
Size
16 kB (16123 bytes)
Hash
89c4665eeddefa3ae51fab7382024eba
a77f83c34562350ac65da30bf3a57debf4220dd5
98dd27076c997b543c16f490765c3a78f2c739eaccd284a5e32f8662ca26a681

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /freefire/js/responsive.css HTTP/1.1
Host: rewasy-ff-garens.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rewasy-ff-garens.ru/freefire/
Cookie: PHPSESSID=dkaueucrjgtko44c7kmmvh89h2
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 26 Apr 2024 15:38:34 GMT
content-type: text/css
last-modified: Tue, 02 May 2023 14:12:14 GMT
vary: Accept-Encoding
etag: W/"64511a3e-26bb"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-cache-status: HIT
age: 136759
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CB90vMlBJ7CdP01dFnRuF7z0jgMgo8eH7Iaw%2FL7PieZwx7bRlgDH4Um8lqR1tN4tOJBkDY3cUKcRwzXDlt%2BsuLbGsjmNOEtWDytUVc1MRz5iCBxbpjrYkMIcIZ3VUNAiZc1tgj1m"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87a7a91f6fb156c0-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

rewasy-ff-garens.ru/freefire/js/js

104.21.23.241

404 Not Found

10 kB

URL GET HTTP/3
rewasy-ff-garens.ru/freefire/js/js
IP
104.21.23.241:443
ASN
#13335 CLOUDFLARENET

Requested by
https://rewasy-ff-garens.ru/freefire/
Certificate
IssuerGoogle Trust Services LLC
Subjectrewasy-ff-garens.ru
FingerprintA9:6B:92:93:9E:CA:A2:58:32:F3:42:7B:60:D7:85:E4:DF:8A:A6:3C
ValidityThu, 25 Apr 2024 14:51:07 GMT - Wed, 24 Jul 2024 14:51:06 GMT

File type
HTML document, ASCII text, with very long lines (634)
Size
10 kB (10505 bytes)
Hash
16f9becdacae380114a1c99bb4d528e7
d7c4e5b15078c8a9ea1cf452beafba8eb45c4c95
d9cd6dfca94282619431285858508adf7a4552a70c2bb6dc4f30b0c83d9b1615

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /freefire/js/js HTTP/1.1
Host: rewasy-ff-garens.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rewasy-ff-garens.ru/freefire/
Cookie: PHPSESSID=dkaueucrjgtko44c7kmmvh89h2
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 404 Not Found
date: Fri, 26 Apr 2024 15:38:34 GMT
content-type: text/html; charset=utf-8
vary: Accept-Encoding
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cBrPkW5%2BXCJTFq3H8jeyyM6DHeN2izEcwf4OtqDoytrppgHlVTmCTUNkjF4%2Fhs%2FmEB2bMX4E8iygQoW8zWAkp8BNn8I1XhqsidoReXHb98FaXawhyIIltxa54qFwmz3X0iL4%2B9Xt"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87a7a91f6fb956c0-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

rewasy-ff-garens.ru/freefire/imgg/vk-l.png

104.21.23.241

200 OK

9.8 kB

URL GET HTTP/3
rewasy-ff-garens.ru/freefire/imgg/vk-l.png
IP
104.21.23.241:443
ASN
#13335 CLOUDFLARENET

Requested by
https://rewasy-ff-garens.ru/freefire/
Certificate
IssuerGoogle Trust Services LLC
Subjectrewasy-ff-garens.ru
FingerprintA9:6B:92:93:9E:CA:A2:58:32:F3:42:7B:60:D7:85:E4:DF:8A:A6:3C
ValidityThu, 25 Apr 2024 14:51:07 GMT - Wed, 24 Jul 2024 14:51:06 GMT

File type
PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced
Size
9.8 kB (9846 bytes)
Hash
a53bf2276aa814a0053de1eb24d48b1b
0f7bb9af7af5e9eb07998969744f9105d833e233
8ffae0974acd7014b8e30ff2510ff2c8809103dca22a9e9d252cfd525cc7eff9

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /freefire/imgg/vk-l.png HTTP/1.1
Host: rewasy-ff-garens.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rewasy-ff-garens.ru/freefire/js/responsive.css
Cookie: PHPSESSID=dkaueucrjgtko44c7kmmvh89h2
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 26 Apr 2024 15:38:34 GMT
content-type: image/png
content-length: 9846
last-modified: Tue, 02 May 2023 14:12:24 GMT
etag: "64511a48-2676"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-cache-status: HIT
age: 12979
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5Okq%2FynsrsI1G%2FIhxz7ngKCPa2saKNadV1k2I8wiZgKRryM9ZOTL%2BoJFbrnFjgZSTeR6StzdlMxTiXytMaqDMA%2BJfe4iiSeJyZoky8dj90FgBaRI1secIA1tN%2FITZq4DqcfeRI2X"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87a7a91fd83d56c0-OSL
alt-svc: h3=":443"; ma=86400

rewasy-ff-garens.ru/freefire/imgg/google-l.png

104.21.23.241

200 OK

6.7 kB

URL GET HTTP/3
rewasy-ff-garens.ru/freefire/imgg/google-l.png
IP
104.21.23.241:443
ASN
#13335 CLOUDFLARENET

Requested by
https://rewasy-ff-garens.ru/freefire/
Certificate
IssuerGoogle Trust Services LLC
Subjectrewasy-ff-garens.ru
FingerprintA9:6B:92:93:9E:CA:A2:58:32:F3:42:7B:60:D7:85:E4:DF:8A:A6:3C
ValidityThu, 25 Apr 2024 14:51:07 GMT - Wed, 24 Jul 2024 14:51:06 GMT

File type
PNG image data, 81 x 81, 8-bit/color RGBA, non-interlaced
Size
6.7 kB (6656 bytes)
Hash
5f3e71195ba86afaf49859083e74b5ce
7b5ebf2bf6387331cf90442375ff9f4af5c4fd58
5437ffaa3ad1e6a1fd8272511b2cd6c0c301a339a16f2d3e0e0c496b10a3818d

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /freefire/imgg/google-l.png HTTP/1.1
Host: rewasy-ff-garens.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rewasy-ff-garens.ru/freefire/js/responsive.css
Cookie: PHPSESSID=dkaueucrjgtko44c7kmmvh89h2
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 26 Apr 2024 15:38:34 GMT
content-type: image/png
content-length: 6656
last-modified: Tue, 02 May 2023 14:12:28 GMT
etag: "64511a4c-1a00"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-cache-status: HIT
age: 12979
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1DGbOGEAdCYNozhBveK4w%2BFWgpf%2FmUyIhtu%2BeobTaIAjyJEM7tyD3FSrPhDYcKiXDDA8o%2FRoBTDCdDuK1HMNKSy2x%2F3z%2BLCVAFSIxozsfxDkn%2BAy%2BC0AqMBB%2Fr3P5e5V4CeZmJqm"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87a7a91fd84756c0-OSL
alt-svc: h3=":443"; ma=86400

rewasy-ff-garens.ru/freefire/imgg/huawei-l.png

104.21.23.241

200 OK

5.8 kB

URL GET HTTP/3
rewasy-ff-garens.ru/freefire/imgg/huawei-l.png
IP
104.21.23.241:443
ASN
#13335 CLOUDFLARENET

Requested by
https://rewasy-ff-garens.ru/freefire/
Certificate
IssuerGoogle Trust Services LLC
Subjectrewasy-ff-garens.ru
FingerprintA9:6B:92:93:9E:CA:A2:58:32:F3:42:7B:60:D7:85:E4:DF:8A:A6:3C
ValidityThu, 25 Apr 2024 14:51:07 GMT - Wed, 24 Jul 2024 14:51:06 GMT

File type
PNG image data, 81 x 81, 8-bit/color RGBA, non-interlaced
Size
5.8 kB (5811 bytes)
Hash
b71500650d5d3b5fba7b2f8f8012fe13
049dac5b1bb2864de4e64f4dbb3e084efad7a14c
3149e5da337a71edbf1f389081fb4c9010748eebbf9d9a6d8442e74be2f1f261

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /freefire/imgg/huawei-l.png HTTP/1.1
Host: rewasy-ff-garens.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rewasy-ff-garens.ru/freefire/js/responsive.css
Cookie: PHPSESSID=dkaueucrjgtko44c7kmmvh89h2
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 26 Apr 2024 15:38:34 GMT
content-type: image/png
content-length: 5811
last-modified: Tue, 02 May 2023 14:12:26 GMT
etag: "64511a4a-16b3"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-cache-status: HIT
age: 12979
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0AMo9vD209RCwvn%2FSHKt0QHC62gV1tNfGNImo6swxuGeQAE0hTQULJ53Rx6AENUeWc15GcafdoAxYX6LPXEZqZPmlnXU1myny2Us1nqvjLQaVbV4OiJZQjjLgiWbCvi26QrDMmCf"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87a7a91fd84b56c0-OSL
alt-svc: h3=":443"; ma=86400

rewasy-ff-garens.ru/freefire/imgg/apple-l.png

104.21.23.241

200 OK

9.1 kB

URL GET HTTP/3
rewasy-ff-garens.ru/freefire/imgg/apple-l.png
IP
104.21.23.241:443
ASN
#13335 CLOUDFLARENET

Requested by
https://rewasy-ff-garens.ru/freefire/
Certificate
IssuerGoogle Trust Services LLC
Subjectrewasy-ff-garens.ru
FingerprintA9:6B:92:93:9E:CA:A2:58:32:F3:42:7B:60:D7:85:E4:DF:8A:A6:3C
ValidityThu, 25 Apr 2024 14:51:07 GMT - Wed, 24 Jul 2024 14:51:06 GMT

File type
PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced
Size
9.1 kB (9069 bytes)
Hash
d72825e76a981573e800cb3983bff287
89d064915f45c31853eaa77a416843cb3d3dcc81
ac768dee11c223ac3fba06a7212fd0163c171e7986735b5cd04f9081504126b3

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /freefire/imgg/apple-l.png HTTP/1.1
Host: rewasy-ff-garens.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rewasy-ff-garens.ru/freefire/js/responsive.css
Cookie: PHPSESSID=dkaueucrjgtko44c7kmmvh89h2
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 26 Apr 2024 15:38:34 GMT
content-type: image/png
content-length: 9069
last-modified: Tue, 02 May 2023 14:12:28 GMT
etag: "64511a4c-236d"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-cache-status: HIT
age: 12979
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=034jB0seiVf044lsVspyfFttmN%2BMqHjHKtuiZ9V1GwthEVoeMc2T7smp32Je8yr6ToM9w3Nh%2FvPtbUqtFhhcmBnsOBA0OEoAESrrp%2Fy%2FdL0JAojPT0jAxx8SFhAYWfYcL%2B3Gc%2B%2F5"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87a7a91fd85056c0-OSL
alt-svc: h3=":443"; ma=86400

rewasy-ff-garens.ru/freefire/imgg/twitter-l.png

104.21.23.241

200 OK

9.8 kB

URL GET HTTP/3
rewasy-ff-garens.ru/freefire/imgg/twitter-l.png
IP
104.21.23.241:443
ASN
#13335 CLOUDFLARENET

Requested by
https://rewasy-ff-garens.ru/freefire/
Certificate
IssuerGoogle Trust Services LLC
Subjectrewasy-ff-garens.ru
FingerprintA9:6B:92:93:9E:CA:A2:58:32:F3:42:7B:60:D7:85:E4:DF:8A:A6:3C
ValidityThu, 25 Apr 2024 14:51:07 GMT - Wed, 24 Jul 2024 14:51:06 GMT

File type
PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced
Size
9.8 kB (9812 bytes)
Hash
fac267d563f943d005abd2a01d207764
dbd45b8fae0cf4a32c3a9664443d65b4f8cb2cc3
392c6ef45dc72dc2d72c2a2d16ff5fcd5943766e78e14f1f6bb008c59cf80877

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /freefire/imgg/twitter-l.png HTTP/1.1
Host: rewasy-ff-garens.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rewasy-ff-garens.ru/freefire/js/responsive.css
Cookie: PHPSESSID=dkaueucrjgtko44c7kmmvh89h2
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 26 Apr 2024 15:38:34 GMT
content-type: image/png
content-length: 9812
last-modified: Tue, 02 May 2023 14:12:28 GMT
etag: "64511a4c-2654"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-cache-status: HIT
age: 12979
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=v4VoUgtNN1tiVJYPkx0Yhso1U60Q4plDsZ5jExNOgYn5tpi74GjQye7WvuQqhykrLC%2F%2F9at3r4u4DKM9a7dQaqCE08MyMfCpfVzGr54hROfnpqfW2WWYAbuVwPRlg84B1uS739pj"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87a7a91fe87556c0-OSL
alt-svc: h3=":443"; ma=86400

rewasy-ff-garens.ru/freefire/imgg/logo_small_foot.jpg

104.21.23.241

200 OK

3.5 kB

URL GET HTTP/3
rewasy-ff-garens.ru/freefire/imgg/logo_small_foot.jpg
IP
104.21.23.241:443
ASN
#13335 CLOUDFLARENET

Requested by
https://rewasy-ff-garens.ru/freefire/
Certificate
IssuerGoogle Trust Services LLC
Subjectrewasy-ff-garens.ru
FingerprintA9:6B:92:93:9E:CA:A2:58:32:F3:42:7B:60:D7:85:E4:DF:8A:A6:3C
ValidityThu, 25 Apr 2024 14:51:07 GMT - Wed, 24 Jul 2024 14:51:06 GMT

File type
JPEG image data, baseline, precision 8, 51x51, components 3
Size
3.5 kB (3522 bytes)
Hash
c34038edcf4185b3e75a6b85f1cd3d4f
3aa218daacaef499d9ae080f36993228455dc814
3dec40957ccb5815562b06c0bcb1cb3fc09a5f0738aa0b9ec2d1390e4e30a346

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /freefire/imgg/logo_small_foot.jpg HTTP/1.1
Host: rewasy-ff-garens.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rewasy-ff-garens.ru/freefire/js/all.css
Cookie: PHPSESSID=dkaueucrjgtko44c7kmmvh89h2
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Fri, 26 Apr 2024 15:38:34 GMT
content-type: image/jpeg
content-length: 3522
last-modified: Tue, 02 May 2023 14:12:28 GMT
etag: "64511a4c-dc2"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-cache-status: HIT
age: 136759
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cVkKHgGteXOBFBGgdbqN0zUVdcyQ8o1p2YVDFgcFH5QQaz5hV3YUSV2NnApNACp%2BaWwRyFgf85qD58ggQbhXNnG9g2KkH5pgjsBttIGH%2FH325fxpBIouA8kI%2FXY4wPyouEafESNq"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87a7a91ff89f56c0-OSL
alt-svc: h3=":443"; ma=86400

freefiremobile-a.akamaihd.net/ffwebsite/images/freefire32-2.ico

23.36.76.90

200 OK

4.3 kB

URL GET HTTP/1.1
freefiremobile-a.akamaihd.net/ffwebsite/images/freefire32-2.ico
IP
23.36.76.90:443
ASN
#20940 Akamai International B.V.

Requested by
https://rewasy-ff-garens.ru/freefire/
Certificate
IssuerDigiCert Inc
Subjecta248.e.akamai.net
FingerprintA3:C7:B4:95:4E:16:BD:C5:8A:EE:85:53:5D:C1:C2:CD:43:E9:EC:B9
ValidityTue, 16 May 2023 00:00:00 GMT - Wed, 15 May 2024 23:59:59 GMT

File type
MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Size
4.3 kB (4286 bytes)
Hash
0d2f0e9b2281bf40f5964f6f79fba17a
6288c3d63579f1bf3822471f946e4022fb80ce97
ca80122571d6d7aea0a3c96b926fd53e5d53f7526c23b6a1f79396420bb08990

HTTP Headers

GET /ffwebsite/images/freefire32-2.ico HTTP/1.1
Host: freefiremobile-a.akamaihd.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rewasy-ff-garens.ru/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: OBS
Content-Type: image/x-icon
Content-Length: 4286
x-obs-request-id: 0000018E068173A294107DF8BFE0D5A0
Accept-Ranges: bytes
ETag: "0d2f0e9b2281bf40f5964f6f79fba17a"
Last-Modified: Thu, 04 Aug 2022 12:38:52 GMT
x-obs-id-2: 32AAAQAAEAABAAAQAAEAABAAAQAAEAABCSkXKNcPrqtXqf/WQKFJq279sMOFSaIO
Date: Fri, 26 Apr 2024 15:38:35 GMT
Connection: keep-alive
Alt-Svc: h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"
Cache-Control: public, max-age=3600
Access-Control-Allow-Origin: *

rewasy-ff-garens.ru/freefire

104.21.23.241

301 Moved Permanently

7.2 kB

URL User Request GET HTTP/2
rewasy-ff-garens.ru/freefire
IP
104.21.23.241:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerGoogle Trust Services LLC
Subjectrewasy-ff-garens.ru
FingerprintA9:6B:92:93:9E:CA:A2:58:32:F3:42:7B:60:D7:85:E4:DF:8A:A6:3C
ValidityThu, 25 Apr 2024 14:51:07 GMT - Wed, 24 Jul 2024 14:51:06 GMT

File type

Size
7.2 kB (7207 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /freefire HTTP/1.1
Host: rewasy-ff-garens.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: PHPSESSID=dkaueucrjgtko44c7kmmvh89h2
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 301 Moved Permanently
date: Fri, 26 Apr 2024 15:38:34 GMT
content-type: text/html
location: http://rewasy-ff-garens.ru/freefire/
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NgkgxS6CUAMiaFMYWLpco35IUgpIapwvHZLwYip96XCZlpfsBBlfxwIY5VftQjP0g9Od2VNx3nOeB6SLeJRUwOoz8jmZPYNcS58BO2Z5KI2iXDD1o0kLrHfpTH1My%2Bojt6BiGP%2FZ"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87a7a91c991db505-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

rewasy-ff-garens.ru/freefire/js/all.css

104.21.23.241

200 OK

9.9 kB

URL GET HTTP/3
rewasy-ff-garens.ru/freefire/js/all.css
IP
104.21.23.241:443
ASN
#13335 CLOUDFLARENET

Requested by
https://rewasy-ff-garens.ru/freefire/
Certificate
IssuerGoogle Trust Services LLC
Subjectrewasy-ff-garens.ru
FingerprintA9:6B:92:93:9E:CA:A2:58:32:F3:42:7B:60:D7:85:E4:DF:8A:A6:3C
ValidityThu, 25 Apr 2024 14:51:07 GMT - Wed, 24 Jul 2024 14:51:06 GMT

File type
ASCII text, with very long lines (10522), with no line terminators
Size
9.9 kB (9911 bytes)
Hash
240b2e90f3e582aa04f7850a9c5e7744
466a9edc65d4694babe2701731b7f23edc0f0ff5
356c7c03455bde2b38d92e80d862268b5802727efe258568ff9e612c59084cd5

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /freefire/js/all.css HTTP/1.1
Host: rewasy-ff-garens.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rewasy-ff-garens.ru/freefire/
Cookie: PHPSESSID=dkaueucrjgtko44c7kmmvh89h2
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Fri, 26 Apr 2024 15:38:34 GMT
content-type: text/css
last-modified: Tue, 02 May 2023 14:12:12 GMT
vary: Accept-Encoding
etag: W/"64511a3c-26b7"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-cache-status: HIT
age: 136759
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=B2eUYw%2BrKkcUFf3dydc40mmaeB%2BpAjxUuDQLFcyOYw45tJ2jrQkQX7q5XFkar14bwFZLcie2C4Ho%2BX3NJ6%2BWI0XjEZFjf%2Bh78m2YHtW1tMeGga%2FdwKrpraaJ74SyYwsAsyOcoGiO"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87a7a91f6fb056c0-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

rewasy-ff-garens.ru/freefire/js/analytics.js

104.21.23.241

200 OK

47 kB

URL GET HTTP/3
rewasy-ff-garens.ru/freefire/js/analytics.js
IP
104.21.23.241:443
ASN
#13335 CLOUDFLARENET

Requested by
https://rewasy-ff-garens.ru/freefire/
Certificate
IssuerGoogle Trust Services LLC
Subjectrewasy-ff-garens.ru
FingerprintA9:6B:92:93:9E:CA:A2:58:32:F3:42:7B:60:D7:85:E4:DF:8A:A6:3C
ValidityThu, 25 Apr 2024 14:51:07 GMT - Wed, 24 Jul 2024 14:51:06 GMT

File type
JavaScript source, ASCII text, with very long lines (1325)
Size
47 kB (47051 bytes)
Hash
53ee95b384d866e8692bb1aef923b763
a82812b87b667d32a8e51514c578a5175edd94b4
e441c3e2771625ba05630ab464275136a82c99650ee2145ca5aa9853bedeb01b

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /freefire/js/analytics.js HTTP/1.1
Host: rewasy-ff-garens.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rewasy-ff-garens.ru/freefire/
Cookie: PHPSESSID=dkaueucrjgtko44c7kmmvh89h2
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Fri, 26 Apr 2024 15:38:34 GMT
content-type: application/javascript; charset=utf-8
last-modified: Tue, 02 May 2023 14:12:12 GMT
vary: Accept-Encoding
etag: W/"64511a3c-b7cb"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-cache-status: HIT
age: 136759
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oI7j%2BXhkUmAXqMmvF2wptajFjOmRD3KtSMeuq5%2FafNVXU%2BtQ6PeV9rz500loxbK%2Fyt2GdQ0z%2Bsc0MZmvK32x1kjP9VIgB4dRfR4U0CTHiQd76Qf%2FqyD4z08T6cI1PMWQQ4gs%2FYK%2F"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87a7a91f6fb656c0-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

rewasy-ff-garens.ru/freefire/imgg/logo.png

104.21.23.241

200 OK

14 kB

URL GET HTTP/3
rewasy-ff-garens.ru/freefire/imgg/logo.png
IP
104.21.23.241:443
ASN
#13335 CLOUDFLARENET

Requested by
https://rewasy-ff-garens.ru/freefire/
Certificate
IssuerGoogle Trust Services LLC
Subjectrewasy-ff-garens.ru
FingerprintA9:6B:92:93:9E:CA:A2:58:32:F3:42:7B:60:D7:85:E4:DF:8A:A6:3C
ValidityThu, 25 Apr 2024 14:51:07 GMT - Wed, 24 Jul 2024 14:51:06 GMT

File type
PNG image data, 426 x 104, 8-bit/color RGBA, non-interlaced
Size
14 kB (14297 bytes)
Hash
b3c9dc5b5bba47430a7da8301c09d45b
811aa569261ba03c88fc108d04428264046b66ba
4bb88bccc5bd610423b63fba5ca6f98516d3d8fc631d6b1b977ac669104264be

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /freefire/imgg/logo.png HTTP/1.1
Host: rewasy-ff-garens.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rewasy-ff-garens.ru/freefire/js/responsive.css
Cookie: PHPSESSID=dkaueucrjgtko44c7kmmvh89h2
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Fri, 26 Apr 2024 15:38:34 GMT
content-type: image/png
content-length: 14297
last-modified: Tue, 02 May 2023 14:12:24 GMT
etag: "64511a48-37d9"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-cache-status: HIT
age: 12979
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=y7BcvxRcFrkehSOZWQYsIyUPvPioYqkl4NZ16zK9QMVbqVB6GfwUkda2D0khbJcfjuxVadi7wIEgQxO9YaZ5hWO%2FrWB83WQQoVbw%2FWF98HZVxSj6ANqjCHPWFp%2FWJ47IXWH50Fmf"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87a7a91fd83756c0-OSL
alt-svc: h3=":443"; ma=86400

rewasy-ff-garens.ru/

104.21.23.241

302 Found

7.2 kB

URL User Request GET HTTP/2
rewasy-ff-garens.ru/
IP
104.21.23.241:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerGoogle Trust Services LLC
Subjectrewasy-ff-garens.ru
FingerprintA9:6B:92:93:9E:CA:A2:58:32:F3:42:7B:60:D7:85:E4:DF:8A:A6:3C
ValidityThu, 25 Apr 2024 14:51:07 GMT - Wed, 24 Jul 2024 14:51:06 GMT

File type

Size
7.2 kB (7207 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET / HTTP/1.1
Host: rewasy-ff-garens.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 302 Found
date: Fri, 26 Apr 2024 15:38:34 GMT
content-type: text/html; charset=utf-8
location: https://rewasy-ff-garens.ru/freefire
set-cookie: PHPSESSID=dkaueucrjgtko44c7kmmvh89h2; path=/
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0o3i8lBOH2z5cILpkt8H16prW9M6FU0JpHSx6wzOdXVfMU17851kooLhAeEbmZcFCjwL76JGYXKcYbfVVV29pkBj%2FjYKA1FUSqo1Jqr8E02oNwpmmmZNaxLh92mZfmc8f%2BuOSTu7"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87a7a91c0888b505-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

rewasy-ff-garens.ru/freefire/js/reset.css

104.21.23.241

200 OK

1.1 kB

URL GET HTTP/3
rewasy-ff-garens.ru/freefire/js/reset.css
IP
104.21.23.241:443
ASN
#13335 CLOUDFLARENET

Requested by
https://rewasy-ff-garens.ru/freefire/
Certificate
IssuerGoogle Trust Services LLC
Subjectrewasy-ff-garens.ru
FingerprintA9:6B:92:93:9E:CA:A2:58:32:F3:42:7B:60:D7:85:E4:DF:8A:A6:3C
ValidityThu, 25 Apr 2024 14:51:07 GMT - Wed, 24 Jul 2024 14:51:06 GMT

File type
ASCII text, with very long lines (1153), with no line terminators
Size
1.1 kB (1092 bytes)
Hash
2fe980b8e50df6964d3d4928ef3db3cb
b85c393a01fff025a96b549bc76049f3b582e558
b91a3f3561417b40957b009fd79addc5893a633a714a06e4aa57a2311d81fe04

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /freefire/js/reset.css HTTP/1.1
Host: rewasy-ff-garens.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rewasy-ff-garens.ru/freefire/
Cookie: PHPSESSID=dkaueucrjgtko44c7kmmvh89h2
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Fri, 26 Apr 2024 15:38:34 GMT
content-type: text/css
last-modified: Tue, 02 May 2023 14:12:12 GMT
vary: Accept-Encoding
etag: W/"64511a3c-444"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-cache-status: HIT
age: 136759
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=r7bP2QRaIjtRWffdFfduC%2FeNQ38PFbvWJIf1RvFU2QNcfrsLYDm5xyRVWV4i1huLwna9azDH4FGUEjYaRPyuLwE7WVmF1%2FgT2X1hWVxe3CJjlOz2siQQ861dIh9WR4Xt5ulLnMXC"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87a7a91f6fa956c0-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

rewasy-ff-garens.ru/freefire/js/ie10-viewport-bug-workaround.css

104.21.23.241

200 OK

433 B

URL GET HTTP/3
rewasy-ff-garens.ru/freefire/js/ie10-viewport-bug-workaround.css
IP
104.21.23.241:443
ASN
#13335 CLOUDFLARENET

Requested by
https://rewasy-ff-garens.ru/freefire/
Certificate
IssuerGoogle Trust Services LLC
Subjectrewasy-ff-garens.ru
FingerprintA9:6B:92:93:9E:CA:A2:58:32:F3:42:7B:60:D7:85:E4:DF:8A:A6:3C
ValidityThu, 25 Apr 2024 14:51:07 GMT - Wed, 24 Jul 2024 14:51:06 GMT

File type
ASCII text, with very long lines (446), with no line terminators
Size
433 B (433 bytes)
Hash
70633038c1b05c2fe4facd577f7b664b
b6f59e727d97bd1539eaf6d8cd826885e6cda628
95fb496fb65840b7aa68256aeb4af19747ec9b9831a6e6eede37bacfdbd64c1e

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /freefire/js/ie10-viewport-bug-workaround.css HTTP/1.1
Host: rewasy-ff-garens.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rewasy-ff-garens.ru/freefire/
Cookie: PHPSESSID=dkaueucrjgtko44c7kmmvh89h2
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Fri, 26 Apr 2024 15:38:34 GMT
content-type: text/css
last-modified: Tue, 02 May 2023 14:12:12 GMT
etag: W/"64511a3c-1b1"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-cache-status: HIT
age: 136759
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UKz1KVRXQKMj%2BKkQ28ApPWvY0vRH2G0SZbB2vHuIiEtjHFXnfj%2FAHTppcgecs6ELxB9mNQNy%2FRpWYPYYnM91plSo7Pnq0mWiiTe%2FfjdSLu%2FmOmweBcWh2fu6Bwx0NmyOv1H54tGX"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87a7a91f6fad56c0-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

rewasy-ff-garens.ru/freefire/imgg/facebook-l.png

104.21.23.241

200 OK

9.2 kB

URL GET HTTP/3
rewasy-ff-garens.ru/freefire/imgg/facebook-l.png
IP
104.21.23.241:443
ASN
#13335 CLOUDFLARENET

Requested by
https://rewasy-ff-garens.ru/freefire/
Certificate
IssuerGoogle Trust Services LLC
Subjectrewasy-ff-garens.ru
FingerprintA9:6B:92:93:9E:CA:A2:58:32:F3:42:7B:60:D7:85:E4:DF:8A:A6:3C
ValidityThu, 25 Apr 2024 14:51:07 GMT - Wed, 24 Jul 2024 14:51:06 GMT

File type
PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced
Size
9.2 kB (9175 bytes)
Hash
e328a85faf3ec595e525860c98e34098
e60ea777c0f17e3091eda58a81a9b916fea47f56
94f92c2fa2a770888470701e4e9c0063d11bd846b52739d8b12a06b2dabd3be2

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /freefire/imgg/facebook-l.png HTTP/1.1
Host: rewasy-ff-garens.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rewasy-ff-garens.ru/freefire/js/responsive.css
Cookie: PHPSESSID=dkaueucrjgtko44c7kmmvh89h2
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Fri, 26 Apr 2024 15:38:34 GMT
content-type: image/png
content-length: 9175
last-modified: Tue, 02 May 2023 14:12:24 GMT
etag: "64511a48-23d7"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
cf-cache-status: HIT
age: 12979
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zEqkN2FpaNug8ffccwRCSXsuX9BlypOOqH6GFjFVZI8bzBq7huKAtLNgAmZ027OZZG5hN1xL8w3vYGpTiSwMPkrvvkhzOhVATx6r1kk0kpIVuTL6Cwos5G%2BnV%2BYCtURE4wrYVyc2"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87a7a91fd83856c0-OSL
alt-svc: h3=":443"; ma=86400

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (2)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (20)

URL User Request GET HTTP/3

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/3

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/3

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/3

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers