www.cityxgirl.me
Open in
urlscan Pro
198.54.114.172
Malicious Activity!
Public Scan
Effective URL: https://www.cityxgirl.me/nsa/
Submission: On March 22 via automatic, source openphish
Summary
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on March 19th 2020. Valid for: a year.
This is the only time www.cityxgirl.me was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Tinder (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 12 | 198.54.114.172 198.54.114.172 | 22612 (NAMECHEAP...) (NAMECHEAP-NET) | |
1 | 2606:4700:303... 2606:4700:3036::681b:a3f8 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 2a00:1450:400... 2a00:1450:4001:81c::2003 | 15169 (GOOGLE) (GOOGLE) | |
14 | 3 |
ASN22612 (NAMECHEAP-NET, US)
PTR: server91-1.web-hosting.com
www.cityxgirl.me |
Apex Domain Subdomains |
Transfer | |
---|---|---|
12 |
cityxgirl.me
1 redirects
www.cityxgirl.me |
527 KB |
2 |
gstatic.com
fonts.gstatic.com |
35 KB |
1 |
onlylocalcams.com
onlylocalcams.com |
|
14 | 3 |
Domain | Requested by | |
---|---|---|
12 | www.cityxgirl.me |
1 redirects
www.cityxgirl.me
|
2 | fonts.gstatic.com |
www.cityxgirl.me
|
1 | onlylocalcams.com |
www.cityxgirl.me
|
14 | 3 |
This site contains links to these domains. Also see Links.
Domain |
---|
safetryagain.me |
Subject Issuer | Validity | Valid | |
---|---|---|---|
cityxgirl.me Sectigo RSA Domain Validation Secure Server CA |
2020-03-19 - 2021-03-19 |
a year | crt.sh |
sni.cloudflaressl.com CloudFlare Inc ECC CA-2 |
2019-12-22 - 2020-10-09 |
10 months | crt.sh |
*.google.com GTS CA 1O1 |
2020-03-03 - 2020-05-26 |
3 months | crt.sh |
This page contains 2 frames:
Primary Page:
https://www.cityxgirl.me/nsa/
Frame ID: 6A7B51FFF4C29BBE12644B27DCC45DCA
Requests: 13 HTTP requests in this frame
Frame:
https://onlylocalcams.com/Digital01
Frame ID: FB0F5EECEF12406F10A6B9CCE61492B7
Requests: 1 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://www.cityxgirl.me/nsa/
HTTP 301
https://www.cityxgirl.me/nsa/ Page URL
Detected technologies
Apache (Web Servers) ExpandDetected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: Click Here
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://www.cityxgirl.me/nsa/
HTTP 301
https://www.cityxgirl.me/nsa/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
14 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
www.cityxgirl.me/nsa/ Redirect Chain
|
5 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css.css
www.cityxgirl.me/nsa/Tinder%20Safe%20Dating%20-%20Personal%20Meetings_files/ |
3 KB 613 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
normalize.css
www.cityxgirl.me/nsa/Tinder%20Safe%20Dating%20-%20Personal%20Meetings_files/ |
8 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
skeleton.css
www.cityxgirl.me/nsa/Tinder%20Safe%20Dating%20-%20Personal%20Meetings_files/ |
12 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
style.css
www.cityxgirl.me/nsa/Tinder%20Safe%20Dating%20-%20Personal%20Meetings_files/ |
11 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logopof.png
www.cityxgirl.me/nsa/ |
143 KB 143 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logosdf1.png
www.cityxgirl.me/nsa/Tinder%20Safe%20Dating%20-%20Personal%20Meetings_files/ |
23 KB 24 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1.jpg
www.cityxgirl.me/nsa/imagefile/ |
58 KB 59 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
2.jpg
www.cityxgirl.me/nsa/imagefile/ |
235 KB 235 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
3.jpg
www.cityxgirl.me/nsa/imagefile/ |
48 KB 48 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
as-seen-on.gif
www.cityxgirl.me/nsa/Tinder%20Safe%20Dating%20-%20Personal%20Meetings_files/ |
8 KB 8 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Digital01
onlylocalcams.com/ Frame FB0F |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
2-c49IRs1JiJN1FRAMjTN5zd9vgsFH1eYCDE0hY.woff2
fonts.gstatic.com/s/merriweathersans/v9/ |
17 KB 18 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
2-c49IRs1JiJN1FRAMjTN5zd9vgsFH1OZyDE0hY.woff2
fonts.gstatic.com/s/merriweathersans/v9/ |
17 KB 17 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Tinder (Online)3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate function| changeImage5 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.rhsfty.com/ | Name: __utmb Value: 69496403.1.10.1584881440 |
|
.rhsfty.com/ | Name: __utmz Value: 69496403.1584881440.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none) |
|
.rhsfty.com/ | Name: __utmt Value: 1 |
|
.rhsfty.com/ | Name: __utmc Value: 69496403 |
|
.rhsfty.com/ | Name: __utma Value: 69496403.770942479.1584881440.1584881440.1584881440.1 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
fonts.gstatic.com
onlylocalcams.com
www.cityxgirl.me
198.54.114.172
2606:4700:3036::681b:a3f8
2a00:1450:4001:81c::2003
055395b01212455e2e3cf174208947ef347110b0a0d8710f097237698d8eee2b
146ca30e79339708e76fa0f2fa4bc60015b98c2296e19c3393a68c355fcaf72c
198814fa3098ba2d30dfde90c8f6c34fd14ea42c97e1002faee9ce0f5336b32d
1ee120fd9f6065721a492193e4628687c2a6b109ccdee4dec52d0832a6146b93
519ee46f437e46672232693bcbffa220c415c2ae736247ca1fc8e45a83ea1e1a
65fb4e4bc5d13c796e26a329f6373554bca614862dc7c90ac71fe343c8bf5d37
676efbfa1f34b4a59c4ba6305c2eff567213fbad7a2512b55d990699fff68df3
8e223cc1c0b5d03c2ea02dcb46cbd4a6e6efcb1c1b255654e15ce01b8f21dac2
9fc3c5a4463b7c1d440c48237477e5f212c598ca694e4ccf2cd9394169796be8
b8832d76aac71653d96ea0314637ac7143614d4a8d60374880bb6a3a77220322
c6758ed7f5557a12a7e1be0a76af5a78bc041d68ca0ff727b9e13977b92e6080
d2af45368bed634685d02dd59dc604e02a8e60ca64d3e27f9e61c2433a3c5b52
e057397a0b25381197ecdffa4a0d9505c7f75edffed90790d0dd8c32295c2b39