urlscan.io logo urlscan.io
SecurityTrails logo

moredating.space Open in urlscan Pro
92.119.160.54  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://bedstrory.space/hot35/habaymyy
Effective URL: https://moredating.space/?u=54lkaeg&o=grmpkza&m=1&t=hot35&cid=hot35
Submission: On February 28 via api from BE — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 1 countries across 4 domains to perform 15 HTTP transactions. The main IP is 92.119.160.54, located in Russian Federation and belongs to SELECTEL, RU. The main domain is moredating.space. The Cisco Umbrella rank of the primary domain is 693661.
TLS certificate: Issued by R3 on January 25th 2022. Valid for: 3 months.
This is the only time moredating.space was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic (Online)

Domain & IP information

IP Address AS Autonomous System
1 1 95.46.114.132 212913 (TIMEHOST-AS)
8 92.119.160.54 49505 (SELECTEL)
15 2
Apex Domain
Subdomains		 Transfer
8 moredating.space
moredating.space — Cisco Umbrella Rank: 693661
168 KB
1 bedstrory.space
bedstrory.space
286 B
0 gstatic.com Failed
fonts.gstatic.com Failed
0 fling.com Failed
promos.fling.com Failed
15 4
Domain Requested by
8 moredating.space moredating.space
1 bedstrory.space 1 redirects
0 fonts.gstatic.com Failed moredating.space
0 promos.fling.com Failed moredating.space
15 4

This site contains no links.

Subject Issuer Validity Valid
moredating.space
R3		 2022-01-25 -
2022-04-25		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://moredating.space/?u=54lkaeg&o=grmpkza&m=1&t=hot35&cid=hot35
Frame ID: D7801D38873341D1475D0F711396A282
Requests: 15 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Get Laid Tonight

Page URL History Show full URLs

  1. http://bedstrory.space/hot35/habaymyy HTTP 302
    https://moredating.space/?u=54lkaeg&o=grmpkza&m=1&t=hot35&cid=hot35 Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

15
Requests

53 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

2
IPs

1
Countries

168 kB
Transfer

242 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://bedstrory.space/hot35/habaymyy HTTP 302
    https://moredating.space/?u=54lkaeg&o=grmpkza&m=1&t=hot35&cid=hot35 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

15 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
moredating.space/
Redirect Chain
  • http://bedstrory.space/hot35/habaymyy
  • https://moredating.space/?u=54lkaeg&o=grmpkza&m=1&t=hot35&cid=hot35
9 KB
9 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://moredating.space/?u=54lkaeg&o=grmpkza&m=1&t=hot35&cid=hot35
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
92.119.160.54 , Russian Federation, ASN49505 (SELECTEL, RU),
Reverse DNS
Software
nginx /
Resource Hash
21daf53861dd33f66fc28cf30a74ccb4d58b2ac25e849cef5797126a3e6c52e5

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

Server
nginx
Date
Mon, 28 Feb 2022 09:42:10 GMT
Content-Type
text/html
Content-Length
9171
Connection
keep-alive
Cache-Control
private no-transform

Redirect headers

Server
nginx
Date
Mon, 28 Feb 2022 09:42:09 GMT
Content-Type
text/html; charset=UTF-8
Content-Length
0
Connection
keep-alive
Keep-Alive
timeout=60
X-Powered-By
PHP/5.6.40
Location
https://moredating.space/?u=54lkaeg&o=grmpkza&m=1&t=hot35&cid=hot35
fonts.css
moredating.space/media/dating/timer/css/ 		1 KB
651 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://moredating.space/media/dating/timer/css/fonts.css
Requested by
Host: moredating.space
URL: https://moredating.space/?u=54lkaeg&o=grmpkza&m=1&t=hot35&cid=hot35
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
92.119.160.54 , Russian Federation, ASN49505 (SELECTEL, RU),
Reverse DNS
Software
nginx /
Resource Hash
9306a182adf8e430b0b667162ae85ede56721fbdcc09b6d373c089c012699564

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://moredating.space/?u=54lkaeg&o=grmpkza&m=1&t=hot35&cid=hot35
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date
Mon, 28 Feb 2022 09:42:10 GMT
Content-Encoding
br
Last-Modified
Wed, 19 May 2021 13:02:40 GMT
Server
nginx
ETag
W/"60a50c70-5f3"
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
no-transform
Connection
close
black.css
moredating.space/media/dating/timer/css/ 		9 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://moredating.space/media/dating/timer/css/black.css
Requested by
Host: moredating.space
URL: https://moredating.space/?u=54lkaeg&o=grmpkza&m=1&t=hot35&cid=hot35
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
92.119.160.54 , Russian Federation, ASN49505 (SELECTEL, RU),
Reverse DNS
Software
nginx /
Resource Hash
bf6a6bcd1a849bb95da78f5126325d51560d0a1041118bccccb472de6e04a5a2

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://moredating.space/?u=54lkaeg&o=grmpkza&m=1&t=hot35&cid=hot35
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date
Mon, 28 Feb 2022 09:42:10 GMT
Content-Encoding
br
Last-Modified
Wed, 19 May 2021 13:02:40 GMT
Server
nginx
ETag
W/"60a50c70-2256"
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
no-transform
Connection
close
jquery.js
moredating.space/media/dating/timer/js/ 		91 KB
31 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://moredating.space/media/dating/timer/js/jquery.js
Requested by
Host: moredating.space
URL: https://moredating.space/?u=54lkaeg&o=grmpkza&m=1&t=hot35&cid=hot35
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
92.119.160.54 , Russian Federation, ASN49505 (SELECTEL, RU),
Reverse DNS
Software
nginx /
Resource Hash
89a15e9c40bc6b14809f236ee8cd3ed1ea42393c1f6ca55c7855cd779b3f922e

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://moredating.space/?u=54lkaeg&o=grmpkza&m=1&t=hot35&cid=hot35
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date
Mon, 28 Feb 2022 09:42:10 GMT
Content-Encoding
br
Last-Modified
Wed, 19 May 2021 13:02:42 GMT
Server
nginx
ETag
W/"60a50c72-16bac"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
no-transform
Connection
close
en.js
moredating.space/media/dating/timer/js/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://moredating.space/media/dating/timer/js/en.js
Requested by
Host: moredating.space
URL: https://moredating.space/?u=54lkaeg&o=grmpkza&m=1&t=hot35&cid=hot35
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
92.119.160.54 , Russian Federation, ASN49505 (SELECTEL, RU),
Reverse DNS
Software
nginx /
Resource Hash
372a69fee04e30bd0bec56898de8354559c63f46337f52f0fb86b91606ba23fa

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://moredating.space/?u=54lkaeg&o=grmpkza&m=1&t=hot35&cid=hot35
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date
Mon, 28 Feb 2022 09:42:10 GMT
Content-Encoding
br
Last-Modified
Wed, 19 May 2021 13:02:42 GMT
Server
nginx
ETag
W/"60a50c72-a6f"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
no-transform
Connection
close
utils.js
moredating.space/util/ 		7 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://moredating.space/util/utils.js
Requested by
Host: moredating.space
URL: https://moredating.space/?u=54lkaeg&o=grmpkza&m=1&t=hot35&cid=hot35
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
92.119.160.54 , Russian Federation, ASN49505 (SELECTEL, RU),
Reverse DNS
Software
nginx /
Resource Hash
9d3e2b083b6e120ba261fe376a4ccd4effde642640e8af81036ecaff262a68d7

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://moredating.space/?u=54lkaeg&o=grmpkza&m=1&t=hot35&cid=hot35
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date
Mon, 28 Feb 2022 09:42:10 GMT
Content-Encoding
br
Last-Modified
Mon, 21 Jun 2021 15:49:01 GMT
Server
nginx
ETag
W/"60d0b4ed-1d57"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
no-transform
Connection
close
intro_black.gif
moredating.space/media/dating/timer/images/ 		116 KB
115 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://moredating.space/media/dating/timer/images/intro_black.gif
Requested by
Host: moredating.space
URL: https://moredating.space/?u=54lkaeg&o=grmpkza&m=1&t=hot35&cid=hot35
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
92.119.160.54 , Russian Federation, ASN49505 (SELECTEL, RU),
Reverse DNS
Software
nginx /
Resource Hash
ad93ebf236149854e02b2dcb7ca0095033c5fb6b9fa3540da68cfb8ec8ec38d6

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://moredating.space/?u=54lkaeg&o=grmpkza&m=1&t=hot35&cid=hot35
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date
Mon, 28 Feb 2022 09:42:10 GMT
Content-Encoding
br
Last-Modified
Wed, 19 May 2021 13:02:41 GMT
Server
nginx
ETag
W/"60a50c71-1d180"
Vary
Accept-Encoding
Content-Type
image/gif
Cache-Control
no-transform
Connection
close
loading0.gif
moredating.space/media/dating/timer/images/ 		6 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://moredating.space/media/dating/timer/images/loading0.gif
Requested by
Host: moredating.space
URL: https://moredating.space/?u=54lkaeg&o=grmpkza&m=1&t=hot35&cid=hot35
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
92.119.160.54 , Russian Federation, ASN49505 (SELECTEL, RU),
Reverse DNS
Software
nginx /
Resource Hash
dfa0ad12a293332f47c0c0b7c4d7681d3670915a2f75f086aaf61b9a2835b24a

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://moredating.space/?u=54lkaeg&o=grmpkza&m=1&t=hot35&cid=hot35
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date
Mon, 28 Feb 2022 09:42:10 GMT
Content-Encoding
br
Last-Modified
Wed, 19 May 2021 13:02:41 GMT
Server
nginx
ETag
W/"60a50c71-16cd"
Vary
Accept-Encoding
Content-Type
image/gif
Cache-Control
no-transform
Connection
close
location.php
promos.fling.com/geo/txt/ 		0
0
DXI1ORHCpsQm3Vp6mXoaTXhCUOGz7vYGh680lGh-uXM.woff
fonts.gstatic.com/s/opensans/v10/ 		0
0
cJZKeOuBrn4kERxqtaUH3T8E0i7KZn-EPnyo3HZu7kw.woff
fonts.gstatic.com/s/opensans/v10/ 		0
0
MTP_ySUJH_bn48VBG8sNSnhCUOGz7vYGh680lGh-uXM.woff
fonts.gstatic.com/s/opensans/v10/ 		0
0
k3k702ZOKiLJc3WVjuplzHhCUOGz7vYGh680lGh-uXM.woff
fonts.gstatic.com/s/opensans/v10/ 		0
0
xjAJXh38I15wypJXxuGMBobN6UDyHWBl620a-IRfuBk.woff
fonts.gstatic.com/s/opensans/v10/ 		0
0
PRmiXeptR36kaC0GEAetxjqR_3kx9_hJXbbyU8S6IN0.woff
fonts.gstatic.com/s/opensans/v10/ 		0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
promos.fling.com
URL
http://promos.fling.com/geo/txt/location.php?testip=
Domain
fonts.gstatic.com
URL
http://fonts.gstatic.com/s/opensans/v10/DXI1ORHCpsQm3Vp6mXoaTXhCUOGz7vYGh680lGh-uXM.woff
Domain
fonts.gstatic.com
URL
http://fonts.gstatic.com/s/opensans/v10/cJZKeOuBrn4kERxqtaUH3T8E0i7KZn-EPnyo3HZu7kw.woff
Domain
fonts.gstatic.com
URL
http://fonts.gstatic.com/s/opensans/v10/MTP_ySUJH_bn48VBG8sNSnhCUOGz7vYGh680lGh-uXM.woff
Domain
fonts.gstatic.com
URL
http://fonts.gstatic.com/s/opensans/v10/k3k702ZOKiLJc3WVjuplzHhCUOGz7vYGh680lGh-uXM.woff
Domain
fonts.gstatic.com
URL
http://fonts.gstatic.com/s/opensans/v10/xjAJXh38I15wypJXxuGMBobN6UDyHWBl620a-IRfuBk.woff
Domain
fonts.gstatic.com
URL
http://fonts.gstatic.com/s/opensans/v10/PRmiXeptR36kaC0GEAetxjqR_3kx9_hJXbbyU8S6IN0.woff

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic (Online)

27 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| structuredClone function| requestLink object| geoData string| ip function| $ function| jQuery function| Tick object| Timer number| TotalSeconds function| CreateTimer function| UpdateTimer function| LeadingZero object| now string| current function| getParameterByName function| hideUnsub function| languageDetection function| writeLocation object| geoRefData function| showLocation function| appendPixels function| getCookie function| getBackendParamsByName function| addSessionId undefined| randomNumber function| docReady object| dataLayer

1 Cookies

Domain/Path Name / Value
moredating.space/ Name: sid
Value: t4~nnmap0phrftcm2gsoxl23gli

7 Console Messages

Source Level URL
Text
security error URL: https://moredating.space/?u=54lkaeg&o=grmpkza&m=1&t=hot35&cid=hot35
Message:
Mixed Content: The page at 'https://moredating.space/?u=54lkaeg&o=grmpkza&m=1&t=hot35&cid=hot35' was loaded over HTTPS, but requested an insecure script 'http://promos.fling.com/geo/txt/location.php?testip='. This request has been blocked; the content must be served over HTTPS.
security error URL: https://moredating.space/?u=54lkaeg&o=grmpkza&m=1&t=hot35&cid=hot35
Message:
Mixed Content: The page at 'https://moredating.space/?u=54lkaeg&o=grmpkza&m=1&t=hot35&cid=hot35' was loaded over HTTPS, but requested an insecure font 'http://fonts.gstatic.com/s/opensans/v10/DXI1ORHCpsQm3Vp6mXoaTXhCUOGz7vYGh680lGh-uXM.woff'. This request has been blocked; the content must be served over HTTPS.
security error URL: https://moredating.space/?u=54lkaeg&o=grmpkza&m=1&t=hot35&cid=hot35
Message:
Mixed Content: The page at 'https://moredating.space/?u=54lkaeg&o=grmpkza&m=1&t=hot35&cid=hot35' was loaded over HTTPS, but requested an insecure font 'http://fonts.gstatic.com/s/opensans/v10/cJZKeOuBrn4kERxqtaUH3T8E0i7KZn-EPnyo3HZu7kw.woff'. This request has been blocked; the content must be served over HTTPS.
security error URL: https://moredating.space/?u=54lkaeg&o=grmpkza&m=1&t=hot35&cid=hot35
Message:
Mixed Content: The page at 'https://moredating.space/?u=54lkaeg&o=grmpkza&m=1&t=hot35&cid=hot35' was loaded over HTTPS, but requested an insecure font 'http://fonts.gstatic.com/s/opensans/v10/MTP_ySUJH_bn48VBG8sNSnhCUOGz7vYGh680lGh-uXM.woff'. This request has been blocked; the content must be served over HTTPS.
security error URL: https://moredating.space/?u=54lkaeg&o=grmpkza&m=1&t=hot35&cid=hot35
Message:
Mixed Content: The page at 'https://moredating.space/?u=54lkaeg&o=grmpkza&m=1&t=hot35&cid=hot35' was loaded over HTTPS, but requested an insecure font 'http://fonts.gstatic.com/s/opensans/v10/k3k702ZOKiLJc3WVjuplzHhCUOGz7vYGh680lGh-uXM.woff'. This request has been blocked; the content must be served over HTTPS.
security error URL: https://moredating.space/?u=54lkaeg&o=grmpkza&m=1&t=hot35&cid=hot35
Message:
Mixed Content: The page at 'https://moredating.space/?u=54lkaeg&o=grmpkza&m=1&t=hot35&cid=hot35' was loaded over HTTPS, but requested an insecure font 'http://fonts.gstatic.com/s/opensans/v10/xjAJXh38I15wypJXxuGMBobN6UDyHWBl620a-IRfuBk.woff'. This request has been blocked; the content must be served over HTTPS.
security error URL: https://moredating.space/?u=54lkaeg&o=grmpkza&m=1&t=hot35&cid=hot35
Message:
Mixed Content: The page at 'https://moredating.space/?u=54lkaeg&o=grmpkza&m=1&t=hot35&cid=hot35' was loaded over HTTPS, but requested an insecure font 'http://fonts.gstatic.com/s/opensans/v10/PRmiXeptR36kaC0GEAetxjqR_3kx9_hJXbbyU8S6IN0.woff'. This request has been blocked; the content must be served over HTTPS.