ebacfb.bustyaffar.com Open in urlscan Pro
178.162.199.80 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://warmthhh.online/
Effective URL:
https://ebacfb.bustyaffar.com/s/5ee74e7bd6cab
Submission Tags: falconsandbox
Submission: On August 03 via api (August 3rd 2022, 3:46:58 am UTC) from US — Scanned from DE

Summary HTTP 11 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 2 countries across 2 domains to perform 11 HTTP transactions. The main IP is 178.162.199.80, located in Germany and belongs to LEASEWEB-DE-FRA-10, DE. The main domain is ebacfb.bustyaffar.com.
TLS certificate: Issued by R3 on June 21st 2022. Valid for: 3 months.

This is the only time ebacfb.bustyaffar.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Porn Scam (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 1	162.215.226.7 162.215.226.7	46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1)
11	178.162.199.80 178.162.199.80	28753 (LEASEWEB-...) (LEASEWEB-DE-FRA-10)
11	1

1 162.215.226.7 (United States) 1 redirects

ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: 162-215-226-7.unifiedlayer.com

warmthhh.online	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 178.162.199.80 (Germany)

ASN28753 (LEASEWEB-DE-FRA-10, DE)

ebacfb.bustyaffar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	bustyaffar.com ebacfb.bustyaffar.com	574 KB
1	warmthhh.online 1 redirects warmthhh.online	261 B
11	2

	Domain	Requested by
11	ebacfb.bustyaffar.com	ebacfb.bustyaffar.com
1	warmthhh.online	1 redirects
11	2

This site contains no links.

Subject Issuer	Validity	Valid
bustyaffar.com R3	`2022-06-21` - `2022-09-19`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://ebacfb.bustyaffar.com/s/5ee74e7bd6cab
Frame ID: 2E73D5E972B3DA6C77ED76420E076DD1
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Die beliebtesten Dating-Website des Monats

Page URL History Show full URLs

http://warmthhh.online/ HTTP 301
https://ebacfb.bustyaffar.com/s/5ee74e7bd6cab Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

11
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

1
IPs

2
Countries

574 kB
Transfer

574 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://warmthhh.online/ HTTP 301
https://ebacfb.bustyaffar.com/s/5ee74e7bd6cab Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request 5ee74e7bd6cab Show response ebacfb.bustyaffar.com/s/ Redirect Chain http://warmthhh.online/ https://ebacfb.bustyaffar.com/s/5ee74e7bd6cab	5 KB 2 KB	505ms 325ms	Document text/html	178.162.199.80 LEASEWEB-DE-FRA-10
General Check archive.org Show headers Download Go to Full URL https://ebacfb.bustyaffar.com/s/5ee74e7bd6cab Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 178.162.199.80 , Germany, ASN28753 (LEASEWEB-DE-FRA-10, DE), Reverse DNS Software openresty/1.19.3.1 / Resource Hash `25519b93c8504bcfb9a373ba965ccd1a3ba456cdd0437199cdb33bab305bd004` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Connection keep-alive Content-Encoding gzip Content-Type text/html; charset=UTF-8 Date Wed, 03 Aug 2022 03:46:53 GMT Server openresty/1.19.3.1 Transfer-Encoding chunked Vary Accept-Encoding Redirect headers Connection keep-alive Content-Type text/html; charset=utf-8 Date Wed, 03 Aug 2022 03:46:52 GMT Location https://ebacfb.bustyaffar.com/s/5ee74e7bd6cab Server nginx Transfer-Encoding chunked X-Frame-Options GOFORIT
GET H/1.1	200 OK	style.css ebacfb.bustyaffar.com/bundle/19/assets/css/	50 KB 50 KB	42ms 42ms	Stylesheet text/css	178.162.199.80 LEASEWEB-DE-FRA-10
General Check archive.org Show headers Download Go to Full URL https://ebacfb.bustyaffar.com/bundle/19/assets/css/style.css Requested by Host: ebacfb.bustyaffar.com URL: https://ebacfb.bustyaffar.com/s/5ee74e7bd6cab Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 178.162.199.80 , Germany, ASN28753 (LEASEWEB-DE-FRA-10, DE), Reverse DNS Software openresty/1.19.3.1 / Resource Hash `bc61625502941dc4c9fbf12a0848178bfbfa79fb8ad1c010271f716673ff3fef` Request headers accept-language de-DE,de;q=0.9 Referer https://ebacfb.bustyaffar.com/s/5ee74e7bd6cab User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36 Response headers Date Wed, 03 Aug 2022 03:46:53 GMT Last-Modified Wed, 28 Mar 2018 09:34:45 GMT Server openresty/1.19.3.1 ETag "5abb61b5-c8e1" Vary Accept-Encoding Content-Type text/css Connection keep-alive Accept-Ranges bytes Content-Length 51425
GET H/1.1	200 OK	jquery-2.2.4.min.js Show response ebacfb.bustyaffar.com/bundle/19/assets/js/	84 KB 84 KB	90ms 45ms	Script application/javascript	178.162.199.80 LEASEWEB-DE-FRA-10
General Check archive.org Show headers Download Go to Full URL https://ebacfb.bustyaffar.com/bundle/19/assets/js/jquery-2.2.4.min.js Requested by Host: ebacfb.bustyaffar.com URL: https://ebacfb.bustyaffar.com/s/5ee74e7bd6cab Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 178.162.199.80 , Germany, ASN28753 (LEASEWEB-DE-FRA-10, DE), Reverse DNS Software openresty/1.19.3.1 / Resource Hash `05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e` Request headers accept-language de-DE,de;q=0.9 Referer https://ebacfb.bustyaffar.com/s/5ee74e7bd6cab User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36 Response headers Date Wed, 03 Aug 2022 03:46:53 GMT Last-Modified Wed, 28 Mar 2018 09:34:45 GMT Server openresty/1.19.3.1 ETag "5abb61b5-14e4a" Vary Accept-Encoding Content-Type application/javascript Connection keep-alive Accept-Ranges bytes Content-Length 85578
GET H/1.1	200 OK	script.min.js Show response ebacfb.bustyaffar.com/bundle/19/assets/js/	254 KB 254 KB	92ms 47ms	Script application/javascript	178.162.199.80 LEASEWEB-DE-FRA-10
General Check archive.org Show headers Download Go to Full URL https://ebacfb.bustyaffar.com/bundle/19/assets/js/script.min.js Requested by Host: ebacfb.bustyaffar.com URL: https://ebacfb.bustyaffar.com/s/5ee74e7bd6cab Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 178.162.199.80 , Germany, ASN28753 (LEASEWEB-DE-FRA-10, DE), Reverse DNS Software openresty/1.19.3.1 / Resource Hash `49341eafd7cb8b62ead1ecd2e2ca916c6c55c449ceb45c2c3ca423be00d971b8` Request headers accept-language de-DE,de;q=0.9 Referer https://ebacfb.bustyaffar.com/s/5ee74e7bd6cab User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36 Response headers Date Wed, 03 Aug 2022 03:46:53 GMT Last-Modified Wed, 28 Mar 2018 09:34:45 GMT Server openresty/1.19.3.1 ETag "5abb61b5-3f619" Vary Accept-Encoding Content-Type application/javascript Connection keep-alive Accept-Ranges bytes Content-Length 259609
GET H/1.1	200 OK	click.js Show response ebacfb.bustyaffar.com/js/	5 KB 5 KB	49ms 49ms	Script application/javascript	178.162.199.80 LEASEWEB-DE-FRA-10
General Check archive.org Show headers Download Go to Full URL https://ebacfb.bustyaffar.com/js/click.js Requested by Host: ebacfb.bustyaffar.com URL: https://ebacfb.bustyaffar.com/s/5ee74e7bd6cab Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 178.162.199.80 , Germany, ASN28753 (LEASEWEB-DE-FRA-10, DE), Reverse DNS Software openresty/1.19.3.1 / Resource Hash `21796d03b31b6f7f1be149aa71b5a56a25de6003291b6950b51bc862452ded49` Request headers accept-language de-DE,de;q=0.9 Referer https://ebacfb.bustyaffar.com/s/5ee74e7bd6cab User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36 Response headers Date Wed, 03 Aug 2022 03:46:53 GMT Last-Modified Thu, 28 Jul 2022 12:41:42 GMT Server openresty/1.19.3.1 ETag "62e28406-1208" Vary Accept-Encoding Content-Type application/javascript Connection keep-alive Accept-Ranges bytes Content-Length 4616
GET H/1.1	200 OK	logo.png ebacfb.bustyaffar.com/bundle/19/assets/img/	1 KB 1 KB	21ms 21ms	Image image/png	178.162.199.80 LEASEWEB-DE-FRA-10
General Check archive.org Show headers Download Go to Show image Full URL https://ebacfb.bustyaffar.com/bundle/19/assets/img/logo.png Requested by Host: ebacfb.bustyaffar.com URL: https://ebacfb.bustyaffar.com/s/5ee74e7bd6cab Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 178.162.199.80 , Germany, ASN28753 (LEASEWEB-DE-FRA-10, DE), Reverse DNS Software openresty/1.19.3.1 / Resource Hash `3f68f0782d363750744f67d981d9c32c6244e71e23293ec8d17bdcb0b36945c2` Request headers accept-language de-DE,de;q=0.9 Referer https://ebacfb.bustyaffar.com/s/5ee74e7bd6cab User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36 Response headers Date Wed, 03 Aug 2022 03:46:53 GMT Last-Modified Wed, 28 Mar 2018 09:34:45 GMT Server openresty/1.19.3.1 ETag "5abb61b5-4ea" Content-Type image/png Connection keep-alive Accept-Ranges bytes Content-Length 1258
GET H/1.1	200 OK	bg.jpg ebacfb.bustyaffar.com/bundle/19/assets/img/	101 KB 101 KB	21ms 21ms	Image image/jpeg	178.162.199.80 LEASEWEB-DE-FRA-10
General Check archive.org Show headers Download Go to Show image Full URL https://ebacfb.bustyaffar.com/bundle/19/assets/img/bg.jpg Requested by Host: ebacfb.bustyaffar.com URL: https://ebacfb.bustyaffar.com/bundle/19/assets/css/style.css Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 178.162.199.80 , Germany, ASN28753 (LEASEWEB-DE-FRA-10, DE), Reverse DNS Software openresty/1.19.3.1 / Resource Hash `408b7f5fdce3b7f93fdba3bcb4e47f6e64e70a15c02d38879b6297e9d7cb9e45` Request headers accept-language de-DE,de;q=0.9 Referer https://ebacfb.bustyaffar.com/bundle/19/assets/css/style.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36 Response headers Date Wed, 03 Aug 2022 03:46:53 GMT Last-Modified Wed, 28 Mar 2018 09:34:45 GMT Server openresty/1.19.3.1 ETag "5abb61b5-19375" Content-Type image/jpeg Connection keep-alive Accept-Ranges bytes Content-Length 103285
GET H/1.1	200 OK	1.jpg ebacfb.bustyaffar.com/bundle/19/assets/img/	17 KB 17 KB	22ms 22ms	Image image/jpeg	178.162.199.80 LEASEWEB-DE-FRA-10
General Check archive.org Show headers Download Go to Show image Full URL https://ebacfb.bustyaffar.com/bundle/19/assets/img/1.jpg Requested by Host: ebacfb.bustyaffar.com URL: https://ebacfb.bustyaffar.com/bundle/19/assets/css/style.css Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 178.162.199.80 , Germany, ASN28753 (LEASEWEB-DE-FRA-10, DE), Reverse DNS Software openresty/1.19.3.1 / Resource Hash `d23157cff1e15192fb85ef456dad32c54b0e34d85235822005207517facbda38` Request headers accept-language de-DE,de;q=0.9 Referer https://ebacfb.bustyaffar.com/bundle/19/assets/css/style.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36 Response headers Date Wed, 03 Aug 2022 03:46:53 GMT Last-Modified Wed, 28 Mar 2018 09:34:45 GMT Server openresty/1.19.3.1 ETag "5abb61b5-4227" Content-Type image/jpeg Connection keep-alive Accept-Ranges bytes Content-Length 16935
GET H/1.1	200 OK	2.jpg ebacfb.bustyaffar.com/bundle/19/assets/img/	12 KB 13 KB	33ms 21ms	Image image/jpeg	178.162.199.80 LEASEWEB-DE-FRA-10
General Check archive.org Show headers Download Go to Show image Full URL https://ebacfb.bustyaffar.com/bundle/19/assets/img/2.jpg Requested by Host: ebacfb.bustyaffar.com URL: https://ebacfb.bustyaffar.com/bundle/19/assets/css/style.css Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 178.162.199.80 , Germany, ASN28753 (LEASEWEB-DE-FRA-10, DE), Reverse DNS Software openresty/1.19.3.1 / Resource Hash `df33173c7d5d08e9ce01490ffcea6df05910654dad4b04443eb0a6276dce3092` Request headers accept-language de-DE,de;q=0.9 Referer https://ebacfb.bustyaffar.com/bundle/19/assets/css/style.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36 Response headers Date Wed, 03 Aug 2022 03:46:53 GMT Last-Modified Wed, 28 Mar 2018 09:34:45 GMT Server openresty/1.19.3.1 ETag "5abb61b5-31c2" Content-Type image/jpeg Connection keep-alive Accept-Ranges bytes Content-Length 12738
GET H/1.1	200 OK	3.jpg ebacfb.bustyaffar.com/bundle/19/assets/img/	16 KB 17 KB	43ms 21ms	Image image/jpeg	178.162.199.80 LEASEWEB-DE-FRA-10
General Check archive.org Show headers Download Go to Show image Full URL https://ebacfb.bustyaffar.com/bundle/19/assets/img/3.jpg Requested by Host: ebacfb.bustyaffar.com URL: https://ebacfb.bustyaffar.com/bundle/19/assets/css/style.css Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 178.162.199.80 , Germany, ASN28753 (LEASEWEB-DE-FRA-10, DE), Reverse DNS Software openresty/1.19.3.1 / Resource Hash `91bc529d2329ad04e61d303f0408524469340da5f78216f57075c3b20950e47f` Request headers accept-language de-DE,de;q=0.9 Referer https://ebacfb.bustyaffar.com/bundle/19/assets/css/style.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36 Response headers Date Wed, 03 Aug 2022 03:46:53 GMT Last-Modified Wed, 28 Mar 2018 09:34:45 GMT Server openresty/1.19.3.1 ETag "5abb61b5-41e9" Content-Type image/jpeg Connection keep-alive Accept-Ranges bytes Content-Length 16873
GET H/1.1	200 OK	fp2.min.js Show response ebacfb.bustyaffar.com/js/	30 KB 30 KB	117ms 108ms	Script application/javascript	178.162.199.80 LEASEWEB-DE-FRA-10
General Check archive.org Show headers Download Go to Full URL https://ebacfb.bustyaffar.com/js/fp2.min.js Requested by Host: ebacfb.bustyaffar.com URL: https://ebacfb.bustyaffar.com/js/click.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 178.162.199.80 , Germany, ASN28753 (LEASEWEB-DE-FRA-10, DE), Reverse DNS Software openresty/1.19.3.1 / Resource Hash `6e1bf43d1d49858aacd5de53b32b551732bca4b2a46b1f808eb6d6d0f2b70c0e` Request headers accept-language de-DE,de;q=0.9 Referer https://ebacfb.bustyaffar.com/s/5ee74e7bd6cab User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36 Response headers Date Wed, 03 Aug 2022 03:46:53 GMT Last-Modified Thu, 28 Jul 2022 12:41:42 GMT Server openresty/1.19.3.1 ETag "62e28406-77dd" Vary Accept-Encoding Content-Type application/javascript Connection keep-alive Accept-Ranges bytes Content-Length 30685

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Porn Scam (Online)

17 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.bustyaffar.com/	1970-01-21 07:15:06	Name: SID Value: c11c7ba3b4c75f0b027ff43fc78d9e79

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ebacfb.bustyaffar.com
warmthhh.online
162.215.226.7
178.162.199.80
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
21796d03b31b6f7f1be149aa71b5a56a25de6003291b6950b51bc862452ded49
25519b93c8504bcfb9a373ba965ccd1a3ba456cdd0437199cdb33bab305bd004
3f68f0782d363750744f67d981d9c32c6244e71e23293ec8d17bdcb0b36945c2
408b7f5fdce3b7f93fdba3bcb4e47f6e64e70a15c02d38879b6297e9d7cb9e45
49341eafd7cb8b62ead1ecd2e2ca916c6c55c449ceb45c2c3ca423be00d971b8
6e1bf43d1d49858aacd5de53b32b551732bca4b2a46b1f808eb6d6d0f2b70c0e
91bc529d2329ad04e61d303f0408524469340da5f78216f57075c3b20950e47f
bc61625502941dc4c9fbf12a0848178bfbfa79fb8ad1c010271f716673ff3fef
d23157cff1e15192fb85ef456dad32c54b0e34d85235822005207517facbda38
df33173c7d5d08e9ce01490ffcea6df05910654dad4b04443eb0a6276dce3092

ebacfb.bustyaffar.com Open in urlscan Pro 178.162.199.80 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

11 Requests

100 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

1 IPs

2 Countries

574 kBTransfer

574 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

17 JavaScript Global Variables

1 Cookies

Indicators

ebacfb.bustyaffar.com Open in urlscan Pro
178.162.199.80 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

1
IPs

2
Countries

574 kB
Transfer

574 kB
Size

1
Cookies

11 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!