heyfire.net Open in urlscan Pro
35.209.61.15 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://heyfire.net/
Submission: On April 14 via manual (April 14th 2023, 1:23:32 am UTC) from TN — Scanned from DE

Summary HTTP 21 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 1 countries across 3 domains to perform 21 HTTP transactions. The main IP is 35.209.61.15, located in Council Bluffs, United States and belongs to GOOGLE-2, US. The main domain is heyfire.net.
TLS certificate: Issued by R3 on March 20th 2023. Valid for: 3 months.

This is the only time heyfire.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Scam (Online)

Domain & IP information

	IP Address	AS Autonomous System
14	35.209.61.15 35.209.61.15	19527 (GOOGLE-2) (GOOGLE-2)
1	2600:9000:249... 2600:9000:2491:a800:d:e9c:2500:21	16509 (AMAZON-02) (AMAZON-02)
5	2600:9000:249... 2600:9000:2491:dc00:1c:8de0:8c80:21	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700:303... 2606:4700:3031::6815:a18	13335 (CLOUDFLAR...) (CLOUDFLARENET)
21	4

14 35.209.61.15 (Council Bluffs, United States)

ASN19527 (GOOGLE-2, US)
PTR: 15.61.209.35.bc.googleusercontent.com

heyfire.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2491:a800:d:e9c:2500:21 (United States)

ASN16509 (AMAZON-02, US)

d2bb5k76l7oivo.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2600:9000:2491:dc00:1c:8de0:8c80:21 (United States)

ASN16509 (AMAZON-02, US)

d2punpeg7vtjci.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3031::6815:a18 (United States)

ASN13335 (CLOUDFLARENET, US)

bootstraplugin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
14	heyfire.net heyfire.net	339 KB
6	cloudfront.net d2bb5k76l7oivo.cloudfront.net d2punpeg7vtjci.cloudfront.net	28 KB
1	bootstraplugin.com bootstraplugin.com	490 B
21	3

	Domain	Requested by
14	heyfire.net	heyfire.net
5	d2punpeg7vtjci.cloudfront.net	d2bb5k76l7oivo.cloudfront.net
1	bootstraplugin.com	heyfire.net
1	d2bb5k76l7oivo.cloudfront.net	heyfire.net
21	4

This site contains no links.

Subject Issuer	Validity	Valid
heyfire.net R3	`2023-03-20` - `2023-06-18`	3 months	crt.sh
*.cloudfront.net Amazon RSA 2048 M01	`2022-12-08` - `2023-12-07`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-06-12` - `2023-06-12`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://heyfire.net/
Frame ID: 0A89F837ABD8F7B55CA198A81D5FDEC2
Requests: 21 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

شحن جواهر فري فاير

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

21
Requests

100 %
HTTPS

75 %
IPv6

3
Domains

4
Subdomains

4
IPs

1
Countries

367 kB
Transfer

663 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

21 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response heyfire.net/	5 KB 1 KB	547ms 134ms	Document text/html	35.209.61.15 GOOGLE-2
General Check archive.org Show headers Download Go to Full URL https://heyfire.net/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.209.61.15 Council Bluffs, United States, ASN19527 (GOOGLE-2, US), Reverse DNS 15.61.209.35.bc.googleusercontent.com Software nginx / Resource Hash `daeedc1db6bc78ff2d7326be2b09e7705e86ab478e1e17ce43db3c0a246e115f` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers content-encoding br content-type text/html date Fri, 14 Apr 2023 01:23:27 GMT etag W/"12ab-5f75c5b0ddadf" host-header 8441280b0c35cbc1147f8ba998a563a7 last-modified Mon, 20 Mar 2023 22:22:00 GMT server nginx vary Accept-Encoding x-httpd-modphp 1 x-proxy-cache HIT
GET H2	200	bootstrap.min.css heyfire.net/	152 KB 20 KB	267ms 266ms	Stylesheet text/css	35.209.61.15 GOOGLE-2
General Check archive.org Show headers Download Go to Full URL https://heyfire.net/bootstrap.min.css Requested by Host: heyfire.net URL: https://heyfire.net/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.209.61.15 Council Bluffs, United States, ASN19527 (GOOGLE-2, US), Reverse DNS 15.61.209.35.bc.googleusercontent.com Software nginx / Resource Hash `60b19e5da6a9234ff9220668a5ec1125c157a268513256188ee80f2d2c8d8d36` Request headers accept-language de-DE,de;q=0.9 Referer https://heyfire.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers date Fri, 14 Apr 2023 01:23:27 GMT content-encoding br last-modified Mon, 20 Mar 2023 02:15:58 GMT server nginx etag W/"6417c1de-2606e" vary Accept-Encoding x-proxy-cache-info DT:1 content-type text/css cache-control max-age=31536000 host-header 8441280b0c35cbc1147f8ba998a563a7 expires Sat, 13 Apr 2024 01:23:27 GMT
GET H2	200	devices.min.css heyfire.net/	27 KB 4 KB	268ms 267ms	Stylesheet text/css	35.209.61.15 GOOGLE-2
General Check archive.org Show headers Download Go to Full URL https://heyfire.net/devices.min.css Requested by Host: heyfire.net URL: https://heyfire.net/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.209.61.15 Council Bluffs, United States, ASN19527 (GOOGLE-2, US), Reverse DNS 15.61.209.35.bc.googleusercontent.com Software nginx / Resource Hash `5633df035604a708de9c711578df1528cc8ac8b1470e7cd027cc791caf5d622a` Request headers accept-language de-DE,de;q=0.9 Referer https://heyfire.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers date Fri, 14 Apr 2023 01:23:27 GMT content-encoding br last-modified Mon, 20 Mar 2023 02:15:46 GMT server nginx etag W/"6417c1d2-6c52" vary Accept-Encoding x-proxy-cache-info DT:1 content-type text/css cache-control max-age=31536000 host-header 8441280b0c35cbc1147f8ba998a563a7 expires Sat, 13 Apr 2024 01:23:27 GMT
GET H2	200	main.css heyfire.net/	5 KB 1 KB	268ms 267ms	Stylesheet text/css	35.209.61.15 GOOGLE-2
General Check archive.org Show headers Download Go to Full URL https://heyfire.net/main.css Requested by Host: heyfire.net URL: https://heyfire.net/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.209.61.15 Council Bluffs, United States, ASN19527 (GOOGLE-2, US), Reverse DNS 15.61.209.35.bc.googleusercontent.com Software nginx / Resource Hash `64cf779673730eb2cb5650f14a3c41ff76a4c71511aed31f7de9c4d3a78e6962` Request headers accept-language de-DE,de;q=0.9 Referer https://heyfire.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers date Fri, 14 Apr 2023 01:23:27 GMT content-encoding br last-modified Mon, 20 Mar 2023 02:15:51 GMT server nginx etag W/"6417c1d7-123a" vary Accept-Encoding x-proxy-cache-info DT:1 content-type text/css cache-control max-age=31536000 host-header 8441280b0c35cbc1147f8ba998a563a7 expires Sat, 13 Apr 2024 01:23:27 GMT
GET H2	200	09626be.js Show response d2bb5k76l7oivo.cloudfront.net/	23 KB 7 KB	422ms 361ms	Script application/javascript	2600:9000:2491:a800:d:e9c:2500:21 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://d2bb5k76l7oivo.cloudfront.net/09626be.js Requested by Host: heyfire.net URL: https://heyfire.net/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2491:a800:d:e9c:2500:21 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash `d212a5a732e0632cb7a63412830a021c8c0a4aaa835a604ef008c1b0e4b00300` Request headers accept-language de-DE,de;q=0.9 Referer https://heyfire.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers date Fri, 14 Apr 2023 01:15:21 GMT content-encoding gzip via 1.1 da749f044be44d389a30372d73356c4e.cloudfront.net (CloudFront) last-modified Wed, 11 Jan 2023 21:50:46 GMT server AmazonS3 x-amz-cf-pop FRA56-P7 age 514 etag W/"8ab72c4473621e1b30a24ec89af90bcf" vary Accept-Encoding x-cache Error from cloudfront content-type application/javascript x-amz-cf-id Xs1xM4F1fBbkeEs2DtmGXHnKrVjjhcyO-l2IQC91QvpD3S36sXfZ9A==
GET H2	200	LOGO.png heyfire.net/	34 KB 34 KB	145ms 143ms	Image image/png	35.209.61.15 GOOGLE-2
General Check archive.org Show headers Download Go to Show image Full URL https://heyfire.net/LOGO.png Requested by Host: heyfire.net URL: https://heyfire.net/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.209.61.15 Council Bluffs, United States, ASN19527 (GOOGLE-2, US), Reverse DNS 15.61.209.35.bc.googleusercontent.com Software nginx / Resource Hash `77ed354b9c47d0dd91e21c332aff4d40317d05891a03d4ab091455f55cf84efe` Request headers accept-language de-DE,de;q=0.9 Referer https://heyfire.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers date Fri, 14 Apr 2023 01:23:27 GMT last-modified Mon, 20 Mar 2023 02:15:49 GMT server nginx etag "6417c1d5-8665" x-proxy-cache-info DT:1 content-type image/png cache-control max-age=31536000 host-header 8441280b0c35cbc1147f8ba998a563a7 accept-ranges bytes content-length 34405 expires Sat, 13 Apr 2024 01:23:27 GMT
GET H2	200	coin.png heyfire.net/	130 KB 130 KB	260ms 258ms	Image image/png	35.209.61.15 GOOGLE-2
General Check archive.org Show headers Download Go to Show image Full URL https://heyfire.net/coin.png Requested by Host: heyfire.net URL: https://heyfire.net/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.209.61.15 Council Bluffs, United States, ASN19527 (GOOGLE-2, US), Reverse DNS 15.61.209.35.bc.googleusercontent.com Software nginx / Resource Hash `32de12d419d187ce1b7e16eb6b9c5a4065eb79b1122015338e668ee23c867f4a` Request headers accept-language de-DE,de;q=0.9 Referer https://heyfire.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers date Fri, 14 Apr 2023 01:23:27 GMT last-modified Mon, 20 Mar 2023 22:07:24 GMT server nginx etag "6418d91c-2067b" x-proxy-cache-info DT:1 content-type image/png cache-control max-age=31536000 host-header 8441280b0c35cbc1147f8ba998a563a7 accept-ranges bytes content-length 132731 expires Sat, 13 Apr 2024 01:23:27 GMT
GET H2	200	BOTTOM.jpg heyfire.net/	29 KB 30 KB	259ms 258ms	Image image/jpeg	35.209.61.15 GOOGLE-2
General Check archive.org Show headers Download Go to Show image Full URL https://heyfire.net/BOTTOM.jpg Requested by Host: heyfire.net URL: https://heyfire.net/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.209.61.15 Council Bluffs, United States, ASN19527 (GOOGLE-2, US), Reverse DNS 15.61.209.35.bc.googleusercontent.com Software nginx / Resource Hash `98262cb4755e766680dab18aa85ea8f280c395f4982a5bf15b6c1642cfc6b353` Request headers accept-language de-DE,de;q=0.9 Referer https://heyfire.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers date Fri, 14 Apr 2023 01:23:27 GMT last-modified Mon, 20 Mar 2023 02:15:59 GMT server nginx etag "6417c1df-75db" x-proxy-cache-info DT:1 content-type image/jpeg cache-control max-age=31536000 host-header 8441280b0c35cbc1147f8ba998a563a7 accept-ranges bytes content-length 30171 expires Sat, 13 Apr 2024 01:23:27 GMT
GET H2	200	jquery-3.4.1.min.js Show response heyfire.net/	86 KB 30 KB	137ms 137ms	Script application/javascript	35.209.61.15 GOOGLE-2
General Check archive.org Show headers Download Go to Full URL https://heyfire.net/jquery-3.4.1.min.js Requested by Host: heyfire.net URL: https://heyfire.net/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.209.61.15 Council Bluffs, United States, ASN19527 (GOOGLE-2, US), Reverse DNS 15.61.209.35.bc.googleusercontent.com Software nginx / Resource Hash `7f7df5b1c1e2cfd042e8d13b88b06aaaaa27ce98ce60d1c93b01b8b837aa44b0` Request headers accept-language de-DE,de;q=0.9 Referer https://heyfire.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers date Fri, 14 Apr 2023 01:23:27 GMT content-encoding br last-modified Mon, 20 Mar 2023 02:15:49 GMT server nginx etag W/"6417c1d5-15994" vary Accept-Encoding x-proxy-cache-info DT:1 content-type application/javascript cache-control max-age=31536000 host-header 8441280b0c35cbc1147f8ba998a563a7 expires Sat, 13 Apr 2024 01:23:27 GMT
GET H2	200	popper.min.js Show response heyfire.net/	21 KB 7 KB	135ms 135ms	Script application/javascript	35.209.61.15 GOOGLE-2
General Check archive.org Show headers Download Go to Full URL https://heyfire.net/popper.min.js Requested by Host: heyfire.net URL: https://heyfire.net/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.209.61.15 Council Bluffs, United States, ASN19527 (GOOGLE-2, US), Reverse DNS 15.61.209.35.bc.googleusercontent.com Software nginx / Resource Hash `66f3a07e1fa9b64a686b66381e4458dbc8abf3dbbff954720c4eec07b84411c2` Request headers accept-language de-DE,de;q=0.9 Referer https://heyfire.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers date Fri, 14 Apr 2023 01:23:27 GMT content-encoding br last-modified Mon, 20 Mar 2023 02:15:51 GMT server nginx etag W/"6417c1d7-520c" vary Accept-Encoding x-proxy-cache-info DT:1 content-type application/javascript cache-control max-age=31536000 host-header 8441280b0c35cbc1147f8ba998a563a7 expires Sat, 13 Apr 2024 01:23:27 GMT
GET H2	200	bootstrap.min.js Show response heyfire.net/	57 KB 15 KB	137ms 135ms	Script application/javascript	35.209.61.15 GOOGLE-2
General Check archive.org Show headers Download Go to Full URL https://heyfire.net/bootstrap.min.js Requested by Host: heyfire.net URL: https://heyfire.net/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.209.61.15 Council Bluffs, United States, ASN19527 (GOOGLE-2, US), Reverse DNS 15.61.209.35.bc.googleusercontent.com Software nginx / Resource Hash `0a34a87842c539c1f4feec56bba982fd596b73500046a6e6fe38a22260c6577b` Request headers accept-language de-DE,de;q=0.9 Referer https://heyfire.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers date Fri, 14 Apr 2023 01:23:27 GMT content-encoding br last-modified Mon, 20 Mar 2023 02:15:59 GMT server nginx etag W/"6417c1df-e2d8" vary Accept-Encoding x-proxy-cache-info DT:1 content-type application/javascript cache-control max-age=31536000 host-header 8441280b0c35cbc1147f8ba998a563a7 expires Sat, 13 Apr 2024 01:23:27 GMT
GET H2	200	countUp.js Show response heyfire.net/	7 KB 2 KB	140ms 138ms	Script application/javascript	35.209.61.15 GOOGLE-2
General Check archive.org Show headers Download Go to Full URL https://heyfire.net/countUp.js Requested by Host: heyfire.net URL: https://heyfire.net/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.209.61.15 Council Bluffs, United States, ASN19527 (GOOGLE-2, US), Reverse DNS 15.61.209.35.bc.googleusercontent.com Software nginx / Resource Hash `f662ddd0dc42f44d4bcc8b9b3916f7cfacbc867c255e2350067bcfc4a195ff46` Request headers accept-language de-DE,de;q=0.9 Referer https://heyfire.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers date Fri, 14 Apr 2023 01:23:27 GMT content-encoding br last-modified Mon, 20 Mar 2023 02:15:47 GMT server nginx etag W/"6417c1d3-1d79" vary Accept-Encoding x-proxy-cache-info DT:1 content-type application/javascript cache-control max-age=31536000 host-header 8441280b0c35cbc1147f8ba998a563a7 expires Sat, 13 Apr 2024 01:23:27 GMT
GET H2	200	main.js Show response heyfire.net/	6 KB 2 KB	143ms 141ms	Script application/javascript	35.209.61.15 GOOGLE-2
General Check archive.org Show headers Download Go to Full URL https://heyfire.net/main.js Requested by Host: heyfire.net URL: https://heyfire.net/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.209.61.15 Council Bluffs, United States, ASN19527 (GOOGLE-2, US), Reverse DNS 15.61.209.35.bc.googleusercontent.com Software nginx / Resource Hash `b710114ccd3fab037c372975e456d0f32e76ee8c6f02bd3aa8b97a5383c9eca8` Request headers accept-language de-DE,de;q=0.9 Referer https://heyfire.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers date Fri, 14 Apr 2023 01:23:27 GMT content-encoding br last-modified Mon, 20 Mar 2023 22:00:24 GMT server nginx etag W/"6418d778-1746" vary Accept-Encoding x-proxy-cache-info DT:1 content-type application/javascript cache-control max-age=31536000 host-header 8441280b0c35cbc1147f8ba998a563a7 expires Sat, 13 Apr 2024 01:23:27 GMT
GET H2	200	html.3616949.cd32a.0.js Show response d2punpeg7vtjci.cloudfront.net/public/external/v2/	11 KB 12 KB	411ms 184ms	Script application/javascript	2600:9000:2491:dc00:1c:8de0:8c80:21 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://d2punpeg7vtjci.cloudfront.net/public/external/v2/html.3616949.cd32a.0.js Requested by Host: d2bb5k76l7oivo.cloudfront.net URL: https://d2bb5k76l7oivo.cloudfront.net/09626be.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2491:dc00:1c:8de0:8c80:21 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Apache/2.4.46 () OpenSSL/1.0.2k-fips PHP/7.4.11 / PHP/7.4.11 Resource Hash `58d17c759fe046bad9af90ac5e1ad5115df64567473ffdbb976b2651cb198f66` Request headers accept-language de-DE,de;q=0.9 Referer https://heyfire.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers date Fri, 14 Apr 2023 01:23:27 GMT via 1.1 0d78cc90106520d13c1b5c5b16dd8246.cloudfront.net (CloudFront) server Apache/2.4.46 () OpenSSL/1.0.2k-fips PHP/7.4.11 x-amz-cf-pop FRA56-P7 x-powered-by PHP/7.4.11 x-cache Miss from cloudfront content-type application/javascript x-amz-cf-id _GuzbvRQqmEimVOvcsLnqBZjM1brj6oHqTOcQgyKdvi4Y1hwPnCVqQ==
GET H2	200	css_front.css d2punpeg7vtjci.cloudfront.net/public/external/	6 KB 7 KB	402ms 173ms	Stylesheet text/css	2600:9000:2491:dc00:1c:8de0:8c80:21 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://d2punpeg7vtjci.cloudfront.net/public/external/css_front.css Requested by Host: d2bb5k76l7oivo.cloudfront.net URL: https://d2bb5k76l7oivo.cloudfront.net/09626be.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2491:dc00:1c:8de0:8c80:21 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Apache/2.4.46 () OpenSSL/1.0.2k-fips PHP/7.4.11 / Resource Hash `a7bd79b6fba60944ee3a9c153108ff0819d2db57850116ac7065a86db08af4ec` Request headers accept-language de-DE,de;q=0.9 Referer https://heyfire.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers date Fri, 14 Apr 2023 01:23:27 GMT via 1.1 0d78cc90106520d13c1b5c5b16dd8246.cloudfront.net (CloudFront) last-modified Tue, 23 Jun 2020 20:06:47 GMT server Apache/2.4.46 () OpenSSL/1.0.2k-fips PHP/7.4.11 x-amz-cf-pop FRA56-P7 etag "19c4-5a8c5e62e9d0a" x-cache Miss from cloudfront content-type text/css accept-ranges bytes content-length 6596 x-amz-cf-id x5o28SvKga4DPnqATGBadlYx3uMJB9dY4TdZhVdihD6scTIT3ejtow==
GET H2	200	ClarikaGrotesque-Medium.woff2 heyfire.net/	31 KB 32 KB	257ms 256ms	Font font/woff2	35.209.61.15 GOOGLE-2
General Check archive.org Show headers Download Go to Full URL https://heyfire.net/ClarikaGrotesque-Medium.woff2 Requested by Host: heyfire.net URL: https://heyfire.net/main.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.209.61.15 Council Bluffs, United States, ASN19527 (GOOGLE-2, US), Reverse DNS 15.61.209.35.bc.googleusercontent.com Software nginx / Resource Hash `9e5f6e7a0567646c68c006ca0f27cd689b4097cd6a739681479ab96541a91f18` Request headers Referer https://heyfire.net/main.css Origin https://heyfire.net accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers date Fri, 14 Apr 2023 01:23:27 GMT last-modified Mon, 20 Mar 2023 02:16:03 GMT server nginx etag "6417c1e3-7d80" x-proxy-cache-info DT:1 content-type font/woff2 cache-control max-age=31536000 host-header 8441280b0c35cbc1147f8ba998a563a7 accept-ranges bytes content-length 32128 expires Sat, 13 Apr 2024 01:23:27 GMT
GET H2	200	ClarikaGrotesque-Regular.woff2 heyfire.net/	32 KB 32 KB	257ms 256ms	Font font/woff2	35.209.61.15 GOOGLE-2
General Check archive.org Show headers Download Go to Full URL https://heyfire.net/ClarikaGrotesque-Regular.woff2 Requested by Host: heyfire.net URL: https://heyfire.net/main.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.209.61.15 Council Bluffs, United States, ASN19527 (GOOGLE-2, US), Reverse DNS 15.61.209.35.bc.googleusercontent.com Software nginx / Resource Hash `e43239ea9a2b7f60b62a5963e42b92a73609d20c37ee33964f6e8cb65a66195b` Request headers Referer https://heyfire.net/main.css Origin https://heyfire.net accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers date Fri, 14 Apr 2023 01:23:27 GMT last-modified Mon, 20 Mar 2023 02:16:05 GMT server nginx etag "6417c1e5-7e70" x-proxy-cache-info DT:1 content-type font/woff2 cache-control max-age=31536000 host-header 8441280b0c35cbc1147f8ba998a563a7 accept-ranges bytes content-length 32368 expires Sat, 13 Apr 2024 01:23:27 GMT
GET H2	200	p.php Show response bootstraplugin.com/	0 490 B	336ms 264ms	Script text/html	2606:4700:3031::6815:a18 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://bootstraplugin.com/p.php?id=5937 Requested by Host: heyfire.net URL: https://heyfire.net/jquery-3.4.1.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3031::6815:a18 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers accept-language de-DE,de;q=0.9 Referer https://heyfire.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers date Fri, 14 Apr 2023 01:23:28 GMT via 1.1 vegur content-encoding br cf-cache-status DYNAMIC nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Adz8HVkBE1UsGfHj%2FrqZRToVSE9omAqor5kEZchhk63Gbk%2F470QrOHuyAVverHt8%2FSsc0U88%2Fn9TJQC2LJ2yuV6sEvT4bOtbrnJnO9K1VePIF4IcsH3%2FvOyOI8xKGvWU1NAOHSTJIvXdrb6CPe5JDWM%3D"}],"group":"cf-nel","max_age":604800} content-type text/html; charset=UTF-8 cache-control no-cache, private cf-ray 7b7824c3abf6362f-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H2	200	css.css d2punpeg7vtjci.cloudfront.net/public/clockers/PrimeApps/	1010 B 1 KB	172ms 172ms	Stylesheet text/css	2600:9000:2491:dc00:1c:8de0:8c80:21 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://d2punpeg7vtjci.cloudfront.net/public/clockers/PrimeApps/css.css Requested by Host: d2bb5k76l7oivo.cloudfront.net URL: https://d2bb5k76l7oivo.cloudfront.net/09626be.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2491:dc00:1c:8de0:8c80:21 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Apache/2.4.46 () OpenSSL/1.0.2k-fips PHP/7.4.11 / Resource Hash `a7081a117335212b9e7f2e348f7369a64423d51db1666310b3451e7375f0b7de` Request headers accept-language de-DE,de;q=0.9 Referer https://heyfire.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers date Fri, 14 Apr 2023 01:23:28 GMT via 1.1 0d78cc90106520d13c1b5c5b16dd8246.cloudfront.net (CloudFront) last-modified Fri, 10 Apr 2020 22:29:00 GMT server Apache/2.4.46 () OpenSSL/1.0.2k-fips PHP/7.4.11 x-amz-cf-pop FRA56-P7 etag "3f2-5a2f7428ae907" x-cache Miss from cloudfront content-type text/css accept-ranges bytes content-length 1010 x-amz-cf-id 82SBZkLHGe7uS9SuAYTC5I4I356o2nnYfP9qASINaEMt_XRegg9JZQ==
GET H2	200	guid Show response d2punpeg7vtjci.cloudfront.net/public/	0 278 B	174ms 174ms	Script text/html	2600:9000:2491:dc00:1c:8de0:8c80:21 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://d2punpeg7vtjci.cloudfront.net/public/guid?cpguid=1dw669wkt&e=ll&t=1681435408628 Requested by Host: d2bb5k76l7oivo.cloudfront.net URL: https://d2bb5k76l7oivo.cloudfront.net/09626be.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2491:dc00:1c:8de0:8c80:21 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Apache/2.4.46 () OpenSSL/1.0.2k-fips PHP/7.4.11 / PHP/7.4.11 Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers accept-language de-DE,de;q=0.9 Referer https://heyfire.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers date Fri, 14 Apr 2023 01:23:28 GMT via 1.1 0d78cc90106520d13c1b5c5b16dd8246.cloudfront.net (CloudFront) server Apache/2.4.46 () OpenSSL/1.0.2k-fips PHP/7.4.11 x-amz-cf-pop FRA56-P7 x-powered-by PHP/7.4.11 x-cache Miss from cloudfront content-type text/html; charset=UTF-8 content-length 0 x-amz-cf-id 2lZAVkP7j7W8dZggE77zmMBGf2XoFkFq3My7gudQUHbpPHp7CVPhAw==
GET H2	200	check.php Show response d2punpeg7vtjci.cloudfront.net/public/external/	78 B 373 B	173ms 173ms	Script application/javascript	2600:9000:2491:dc00:1c:8de0:8c80:21 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://d2punpeg7vtjci.cloudfront.net/public/external/check.php?it=3616949&time=1681435410059 Requested by Host: d2bb5k76l7oivo.cloudfront.net URL: https://d2bb5k76l7oivo.cloudfront.net/09626be.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2491:dc00:1c:8de0:8c80:21 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Apache/2.4.46 () OpenSSL/1.0.2k-fips PHP/7.4.11 / PHP/7.4.11 Resource Hash `9ef4a63fc5e0a14a7301d693d65d6acfc44cdf14853c4a20890198f2d5e52e3b` Request headers accept-language de-DE,de;q=0.9 Referer https://heyfire.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers date Fri, 14 Apr 2023 01:23:30 GMT via 1.1 0d78cc90106520d13c1b5c5b16dd8246.cloudfront.net (CloudFront) server Apache/2.4.46 () OpenSSL/1.0.2k-fips PHP/7.4.11 x-amz-cf-pop FRA56-P7 x-powered-by PHP/7.4.11 x-cache Miss from cloudfront content-type application/javascript content-length 78 x-amz-cf-id 8bkzygu8rqIpNtP6urzEGG7q17YFEgZQIqi8GrNXAiLcGNOFDIWyvg==

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Scam (Online)

32 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			heyfire.net/	1970-01-20 11:18:19	Name: _cpguid Value: 1dw669wkt

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bootstraplugin.com
d2bb5k76l7oivo.cloudfront.net
d2punpeg7vtjci.cloudfront.net
heyfire.net
2600:9000:2491:a800:d:e9c:2500:21
2600:9000:2491:dc00:1c:8de0:8c80:21
2606:4700:3031::6815:a18
35.209.61.15
0a34a87842c539c1f4feec56bba982fd596b73500046a6e6fe38a22260c6577b
32de12d419d187ce1b7e16eb6b9c5a4065eb79b1122015338e668ee23c867f4a
5633df035604a708de9c711578df1528cc8ac8b1470e7cd027cc791caf5d622a
58d17c759fe046bad9af90ac5e1ad5115df64567473ffdbb976b2651cb198f66
60b19e5da6a9234ff9220668a5ec1125c157a268513256188ee80f2d2c8d8d36
64cf779673730eb2cb5650f14a3c41ff76a4c71511aed31f7de9c4d3a78e6962
66f3a07e1fa9b64a686b66381e4458dbc8abf3dbbff954720c4eec07b84411c2
77ed354b9c47d0dd91e21c332aff4d40317d05891a03d4ab091455f55cf84efe
7f7df5b1c1e2cfd042e8d13b88b06aaaaa27ce98ce60d1c93b01b8b837aa44b0
98262cb4755e766680dab18aa85ea8f280c395f4982a5bf15b6c1642cfc6b353
9e5f6e7a0567646c68c006ca0f27cd689b4097cd6a739681479ab96541a91f18
9ef4a63fc5e0a14a7301d693d65d6acfc44cdf14853c4a20890198f2d5e52e3b
a7081a117335212b9e7f2e348f7369a64423d51db1666310b3451e7375f0b7de
a7bd79b6fba60944ee3a9c153108ff0819d2db57850116ac7065a86db08af4ec
b710114ccd3fab037c372975e456d0f32e76ee8c6f02bd3aa8b97a5383c9eca8
d212a5a732e0632cb7a63412830a021c8c0a4aaa835a604ef008c1b0e4b00300
daeedc1db6bc78ff2d7326be2b09e7705e86ab478e1e17ce43db3c0a246e115f
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e43239ea9a2b7f60b62a5963e42b92a73609d20c37ee33964f6e8cb65a66195b
f662ddd0dc42f44d4bcc8b9b3916f7cfacbc867c255e2350067bcfc4a195ff46

heyfire.net Open in urlscan Pro 35.209.61.15 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

21 Requests

100 %HTTPS

75 %IPv6

3 Domains

4 Subdomains

4 IPs

1 Countries

367 kBTransfer

663 kBSize

1 Cookies

0 Outgoing links

Redirected requests

21 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

32 JavaScript Global Variables

1 Cookies

Indicators

heyfire.net Open in urlscan Pro
35.209.61.15 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

21
Requests

100 %
HTTPS

75 %
IPv6

3
Domains

4
Subdomains

4
IPs

1
Countries

367 kB
Transfer

663 kB
Size

1
Cookies

21 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!