urlscan.io logo urlscan.io
SecurityTrails logo

sweetgirls.cam Open in urlscan Pro
185.61.154.217  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://4.fo/BELISKAY?fireglass_diagnostics.js=true&ver=1.16.58-clamav-fix-side-branch+4
Effective URL: https://sweetgirls.cam/
Submission: On April 18 via manual from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 3 countries across 6 domains to perform 9 HTTP transactions. The main IP is 185.61.154.217, located in United Kingdom and belongs to NAMECHEAP-NET, US. The main domain is sweetgirls.cam.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on June 5th 2022. Valid for: a year.
This is the only time sweetgirls.cam was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Porn Scam (Online)

Domain & IP information

IP Address AS Autonomous System
2 2 2606:4700:303... 13335 (CLOUDFLAR...)
1 6 185.61.154.217 22612 (NAMECHEAP...)
2 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 1 2606:4700:303... 13335 (CLOUDFLAR...)
1 34.255.77.156 16509 (AMAZON-02)
9 4
2    2606:4700:3031::ac43:95a3 (United States)

ASN13335 (CLOUDFLARENET, US)
4.fo
6    185.61.154.217 (United Kingdom)

ASN22612 (NAMECHEAP-NET, US)
PTR: premium88-5.web-hosting.com
sweetgirls.cam
2    2606:4700::6812:bcf (United States)

ASN13335 (CLOUDFLARENET, US)
maxcdn.bootstrapcdn.com
1    2606:4700::6811:190e (United States)

ASN13335 (CLOUDFLARENET, US)
cdnjs.cloudflare.com
1    2606:4700:3037::ac43:c62b (United States)

ASN13335 (CLOUDFLARENET, US)
foxyfinder6.com
1    34.255.77.156 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-255-77-156.eu-west-1.compute.amazonaws.com
www.bmtracks.com
Apex Domain
Subdomains		 Transfer
6 sweetgirls.cam
sweetgirls.cam
189 KB
2 bootstrapcdn.com
maxcdn.bootstrapcdn.com — Cisco Umbrella Rank: 1289
30 KB
2 4.fo
4.fo
1 KB
1 bmtracks.com
www.bmtracks.com
563 B
1 foxyfinder6.com
foxyfinder6.com
909 B
1 cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 344
27 KB
9 6
Domain Requested by
6 sweetgirls.cam 1 redirects sweetgirls.cam
2 maxcdn.bootstrapcdn.com sweetgirls.cam
2 4.fo 2 redirects
1 www.bmtracks.com
1 foxyfinder6.com 1 redirects
1 cdnjs.cloudflare.com sweetgirls.cam
9 6

This site contains no links.

Subject Issuer Validity Valid
sweetgirls.cam
Sectigo RSA Domain Validation Secure Server CA		 2022-06-05 -
2023-06-05		 a year crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2022-12-30 -
2023-12-30		 a year crt.sh

This page contains 1 frames:

Frame: http://www.bmtracks.com/aff_c?offer_id=89&aff_id=1373&url_id=349&source=1905756&aff_click_id=XOUbsdvzlIZzmIqTbrbNGxQjjkEwUjBkcjN
Frame ID: C25631C127278D51C33615DFEE9FAFAC
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. http://4.fo/BELISKAY?fireglass_diagnostics.js=true&ver=1.16.58-clamav-fix-side-branch+4 HTTP 301
    https://4.fo/BELISKAY?fireglass_diagnostics.js=true&ver=1.16.58-clamav-fix-side-branch+4 HTTP 302
    http://sweetgirls.cam/ HTTP 301
    https://sweetgirls.cam/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

9
Requests

89 %
HTTPS

67 %
IPv6

6
Domains

6
Subdomains

4
IPs

3
Countries

247 kB
Transfer

430 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://4.fo/BELISKAY?fireglass_diagnostics.js=true&ver=1.16.58-clamav-fix-side-branch+4 HTTP 301
    https://4.fo/BELISKAY?fireglass_diagnostics.js=true&ver=1.16.58-clamav-fix-side-branch+4 HTTP 302
    http://sweetgirls.cam/ HTTP 301
    https://sweetgirls.cam/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 7
  • https://foxyfinder6.com/?utm_source=OyxIoGDyC42vsg&utm_campaign=lunox HTTP 302
  • http://www.bmtracks.com/aff_c?offer_id=89&aff_id=1373&url_id=349&source=1905756&aff_click_id=XOUbsdvzlIZzmIqTbrbNGxQjjkEwUjBkcjN

9 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
sweetgirls.cam/
Redirect Chain
  • http://4.fo/BELISKAY?fireglass_diagnostics.js=true&ver=1.16.58-clamav-fix-side-branch+4
  • https://4.fo/BELISKAY?fireglass_diagnostics.js=true&ver=1.16.58-clamav-fix-side-branch+4
  • http://sweetgirls.cam/
  • https://sweetgirls.cam/
1 KB
705 B 		Document
General
Check archive.org
Download Go to
Full URL
https://sweetgirls.cam/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.61.154.217 , United Kingdom, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
premium88-5.web-hosting.com
Software
LiteSpeed / PHP/7.2.34
Resource Hash
695873e966d519329370ca9411ce89c0d52a5565bbf8fae5aaff15df9addabe4

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

content-encoding
br
content-length
459
content-type
text/html; charset=UTF-8
date
Tue, 18 Apr 2023 19:01:34 GMT
refresh
1;url=https://foxyfinder6.com/?utm_source=OyxIoGDyC42vsg&utm_campaign=lunox
server
LiteSpeed
vary
Accept-Encoding
x-powered-by
PHP/7.2.34
x-turbo-charged-by
LiteSpeed

Redirect headers

content-length
707
content-type
text/html
date
Tue, 18 Apr 2023 19:01:33 GMT
keep-alive
timeout=5, max=100
location
https://sweetgirls.cam/
server
LiteSpeed
x-turbo-charged-by
LiteSpeed
bootstrap.min.css
maxcdn.bootstrapcdn.com/bootstrap/3.3.6/css/ 		118 KB
20 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://maxcdn.bootstrapcdn.com/bootstrap/3.3.6/css/bootstrap.min.css
Requested by
Host: sweetgirls.cam
URL: https://sweetgirls.cam/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
eece6e0c65b7007ab0eb1b4998d36dafe381449525824349128efc3f86f4c91c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://sweetgirls.cam/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Tue, 18 Apr 2023 19:01:34 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
cdn-edgestorageid
617, 617
age
9046302
cdn-cachedat
2021-06-08 14:35:37
cdn-pullzone
252412
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Mon, 25 Jan 2021 22:03:59 GMT
server
cloudflare
cdn-requestpullcode
200
vary
Accept-Encoding
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cdn-cache
HIT
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cache-control
public, max-age=31919000
cdn-requestid
99c1d09077b4e57e56c2eebd1d4007b1
timing-allow-origin
*
cdn-requestcountrycode
US
cdn-status
200
cf-ray
7b9f28386f452c2f-FRA
cdn-requestpullsuccess
True
style.css
sweetgirls.cam/ 		4 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://sweetgirls.cam/style.css
Requested by
Host: sweetgirls.cam
URL: https://sweetgirls.cam/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.61.154.217 , United Kingdom, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
premium88-5.web-hosting.com
Software
LiteSpeed /
Resource Hash
0d200aaab5d1273fcd990e2a567a7c45036aacef3ce80559990e3052f643ac2a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://sweetgirls.cam/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Tue, 18 Apr 2023 19:01:34 GMT
content-encoding
br
last-modified
Mon, 29 Aug 2022 12:05:46 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=604800
x-turbo-charged-by
LiteSpeed
accept-ranges
bytes
content-length
963
expires
Tue, 25 Apr 2023 19:01:34 GMT
loading.gif
sweetgirls.cam/ 		80 KB
80 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sweetgirls.cam/loading.gif
Requested by
Host: sweetgirls.cam
URL: https://sweetgirls.cam/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.61.154.217 , United Kingdom, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
premium88-5.web-hosting.com
Software
LiteSpeed /
Resource Hash
05eb745176d79ec27d52d544582483fc4d0f6378c7ed2060be24dfc4e8990668

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://sweetgirls.cam/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Tue, 18 Apr 2023 19:01:34 GMT
last-modified
Mon, 29 Aug 2022 12:05:46 GMT
server
LiteSpeed
content-type
image/gif
cache-control
public, max-age=604800
x-turbo-charged-by
LiteSpeed
accept-ranges
bytes
content-length
81572
expires
Tue, 25 Apr 2023 19:01:34 GMT
jquery.min.js
cdnjs.cloudflare.com/ajax/libs/jquery/2.2.2/ 		84 KB
27 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/jquery/2.2.2/jquery.min.js
Requested by
Host: sweetgirls.cam
URL: https://sweetgirls.cam/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dfa729d82a3effadab1000181cb99108f232721e3b0af74cfae4c12704b35a32
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://sweetgirls.cam/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Tue, 18 Apr 2023 19:01:34 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
93641
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
27010
last-modified
Mon, 04 May 2020 16:11:48 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03ec4-14e98"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rPoRp753RvG6FsbEgFNJw6%2FH7GLwVXGM5JsMq82BwCYmTtPM3OIkyGR2TBdaj0mUClBhfYelB12I9XMG5lI0uTIldzRggoS%2Fcfb9DTbhkO%2BCJcLY%2Bc0INYKdnT6H11wm41e%2FxEcm1Q3cZq6EEYpWsUbT"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
7b9f28388c64380a-FRA
expires
Sun, 07 Apr 2024 19:01:34 GMT
bootstrap.min.js
maxcdn.bootstrapcdn.com/bootstrap/3.3.6/js/ 		36 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://maxcdn.bootstrapcdn.com/bootstrap/3.3.6/js/bootstrap.min.js
Requested by
Host: sweetgirls.cam
URL: https://sweetgirls.cam/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2979f9a6e32fc42c3e7406339ee9fe76b31d1b52059776a02b4a7fa6a4fd280a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://sweetgirls.cam/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Tue, 18 Apr 2023 19:01:34 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
cdn-edgestorageid
617, 617
age
9046603
cdn-cachedat
2021-06-02 08:01:10
cdn-pullzone
252412
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified
Mon, 25 Jan 2021 22:03:59 GMT
server
cloudflare
cdn-requestpullcode
200
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cdn-cache
HIT
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cache-control
public, max-age=31919000
cdn-requestid
8ff74073ea4785eb8286bc82811c608d
timing-allow-origin
*
cdn-requestcountrycode
US
cf-ray
7b9f28386f472c2f-FRA
cdn-requestpullsuccess
True
script.js
sweetgirls.cam/ 		223 B
436 B 		Script
General
Check archive.org
Download Go to
Full URL
https://sweetgirls.cam/script.js
Requested by
Host: sweetgirls.cam
URL: https://sweetgirls.cam/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.61.154.217 , United Kingdom, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
premium88-5.web-hosting.com
Software
LiteSpeed /
Resource Hash
d420d63692c08b3e81350bbc773084aa1a7550a164a45f324fda2dc51885546a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://sweetgirls.cam/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Tue, 18 Apr 2023 19:01:34 GMT
last-modified
Mon, 29 Aug 2022 12:05:46 GMT
server
LiteSpeed
content-type
application/javascript
cache-control
public, max-age=604800
x-turbo-charged-by
LiteSpeed
accept-ranges
bytes
content-length
223
expires
Tue, 25 Apr 2023 19:01:34 GMT
1.jpg
sweetgirls.cam/ 		107 KB
107 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sweetgirls.cam/1.jpg
Requested by
Host: sweetgirls.cam
URL: https://sweetgirls.cam/style.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.61.154.217 , United Kingdom, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
premium88-5.web-hosting.com
Software
LiteSpeed /
Resource Hash
774af49fd9ce15f6ac491a91e36136101caf320ba70c9014311a869cc4ed785f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://sweetgirls.cam/style.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Tue, 18 Apr 2023 19:01:34 GMT
last-modified
Mon, 29 Aug 2022 12:05:46 GMT
server
LiteSpeed
content-type
image/jpeg
cache-control
public, max-age=604800
x-turbo-charged-by
LiteSpeed
accept-ranges
bytes
content-length
109351
expires
Tue, 25 Apr 2023 19:01:34 GMT
aff_c
www.bmtracks.com/
Redirect Chain
  • https://foxyfinder6.com/?utm_source=OyxIoGDyC42vsg&utm_campaign=lunox
  • http://www.bmtracks.com/aff_c?offer_id=89&aff_id=1373&url_id=349&source=1905756&aff_click_id=XOUbsdvzlIZzmIqTbrbNGxQjjkEwUjBkcjN
0
563 B 		Document
General
Check archive.org
Download Go to
Full URL
http://www.bmtracks.com/aff_c?offer_id=89&aff_id=1373&url_id=349&source=1905756&aff_click_id=XOUbsdvzlIZzmIqTbrbNGxQjjkEwUjBkcjN
Protocol
HTTP/1.1
Server
34.255.77.156 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-255-77-156.eu-west-1.compute.amazonaws.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://sweetgirls.cam/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Access-Control-Allow-Headers
Tune-SDK-Version
Access-Control-Allow-Origin
*
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
0
Date
Tue, 18 Apr 2023 19:01:35 GMT
Expires
Sat, 26 Jul 1997 05:00:00 GMT
P3p
CP="NOI CUR OUR NOR INT"
Pragma
no-cache
Server
nginx
Tracking_id
102fa9efef53cce239560f2458a9c1
X-Request-Id
83615a7578da5752cc65a178f0722d96
X-Robots-Tag
noindex, nofollow

Redirect headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control
max-age=0, private, must-revalidate
cf-cache-status
DYNAMIC
cf-ray
7b9f28411952996e-FRA
content-type
text/html; charset=utf-8
date
Tue, 18 Apr 2023 19:01:35 GMT
location
http://www.bmtracks.com/aff_c?offer_id=89&aff_id=1373&url_id=349&source=1905756&aff_click_id=XOUbsdvzlIZzmIqTbrbNGxQjjkEwUjBkcjN
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy
strict-origin-when-cross-origin
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kAhLyD0QpiEMIoMzBv9IVLmcgbRr32vLhrfOW8rYnfM9tSSQrdUdTmFVDT58Mca7h4arQwq1oqACh%2FUgDf7ASAvkScYhv99Pdpg6H5c0DeKqJKQNLk7knGzgbJzwvNtTMqVMuwDanMZbCYuWMMY%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
x-content-type-options
nosniff
x-download-options
noopen
x-permitted-cross-domain-policies
none

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Porn Scam (Online)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless

1 Cookies

Domain/Path Name / Value
foxyfinder6.com/ Name: k
Value: SFMyNTY.g3QAAAAEbQAAAARhdW5xdAAAAAFtAAAABTk4MjM3bQAAAApSWmpNUFpsZHhSbQAAAANoaWRtAAAAI1hPVWJzZHZ6bElaem1JcVRicmJOR3hRamprRXdVakJrY2pObQAAAAJobGQAA25pbG0AAAADdW5xbQAAAAxWQWhvWnhiam1RY2o.lnwhZCO06sp3yUAM7Jg5Nm8kR2LMIYIIGk3C9m8TCnU