urlscan.io logo urlscan.io
SecurityTrails logo

efade.bustyaffar.com Open in urlscan Pro
178.162.199.80  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://gardanos.ru/1101L50754407-00114337-001113-1011H.html
Effective URL: https://efade.bustyaffar.com/s/63bf007e02311
Submission: On June 27 via manual from SK — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 4 countries across 5 domains to perform 8 HTTP transactions. The main IP is 178.162.199.80, located in Berlin, Germany and belongs to LEASEWEB-DE-FRA-10, DE. The main domain is efade.bustyaffar.com.
TLS certificate: Issued by R3 on June 16th 2023. Valid for: 3 months.
This is the only time efade.bustyaffar.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Porn Scam (Online)

Domain & IP information

IP Address AS Autonomous System
1 1 45.89.65.106 205090 (FIRST-SER...)
1 1 185.195.26.119 204997 (FIRSTBYTE-AS)
1 1 2a06:98c1:312... 13335 (CLOUDFLAR...)
7 178.162.199.80 28753 (LEASEWEB-...)
1 2001:4de0:ac1... 20446 (STACKPATH...)
8 2
1    45.89.65.106 (Moscow Oblast, Russian Federation)

ASN205090 (FIRST-SERVER-EUROPE, GB)
PTR: gardanos.ru
gardanos.ru
1    185.195.26.119 (Moscow Oblast, Russian Federation)

ASN204997 (FIRSTBYTE-AS, GB)
PTR: rukodelie-zarabotok.ru
rukodelie-zarabotok.ru
1    2a06:98c1:3120::3 (United States)

ASN13335 (CLOUDFLARENET, US)
shawield.ru
7    178.162.199.80 (Berlin, Germany)

ASN28753 (LEASEWEB-DE-FRA-10, DE)
efade.bustyaffar.com
1    2001:4de0:ac18::1:a:3a (Netherlands)

ASN20446 (STACKPATH-CDN, US)
code.jquery.com
Apex Domain
Subdomains		 Transfer
7 bustyaffar.com
efade.bustyaffar.com
136 KB
1 jquery.com
code.jquery.com — Cisco Umbrella Rank: 749
30 KB
1 shawield.ru
shawield.ru
541 B
1 rukodelie-zarabotok.ru
rukodelie-zarabotok.ru
258 B
1 gardanos.ru
gardanos.ru
317 B
8 5
Domain Requested by
7 efade.bustyaffar.com efade.bustyaffar.com
code.jquery.com
1 code.jquery.com efade.bustyaffar.com
1 shawield.ru 1 redirects
1 rukodelie-zarabotok.ru 1 redirects
1 gardanos.ru 1 redirects
8 5

This site contains no links.

Subject Issuer Validity Valid
bustyaffar.com
R3		 2023-06-16 -
2023-09-14		 3 months crt.sh
*.jquery.com
Sectigo RSA Domain Validation Secure Server CA		 2022-08-03 -
2023-07-14		 a year crt.sh

This page contains 1 frames:

Primary Page: https://efade.bustyaffar.com/s/63bf007e02311
Frame ID: E209ED101F2314D481CF03AB00ECDDD3
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Die beliebtesten Dating-Website des Monats

Page URL History Show full URLs

  1. http://gardanos.ru/1101L50754407-00114337-001113-1011H.html HTTP 301
    http://rukodelie-zarabotok.ru/1101L50754407-00114337-001113-1011H.html HTTP 302
    https://shawield.ru/interspire HTTP 302
    https://efade.bustyaffar.com/s/63bf007e02311 Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

8
Requests

100 %
HTTPS

40 %
IPv6

5
Domains

5
Subdomains

2
IPs

4
Countries

165 kB
Transfer

220 kB
Size

3
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://gardanos.ru/1101L50754407-00114337-001113-1011H.html HTTP 301
    http://rukodelie-zarabotok.ru/1101L50754407-00114337-001113-1011H.html HTTP 302
    https://shawield.ru/interspire HTTP 302
    https://efade.bustyaffar.com/s/63bf007e02311 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request 63bf007e02311
efade.bustyaffar.com/s/
Redirect Chain
  • http://gardanos.ru/1101L50754407-00114337-001113-1011H.html
  • http://rukodelie-zarabotok.ru/1101L50754407-00114337-001113-1011H.html
  • https://shawield.ru/interspire
  • https://efade.bustyaffar.com/s/63bf007e02311
6 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://efade.bustyaffar.com/s/63bf007e02311
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
178.162.199.80 Berlin, Germany, ASN28753 (LEASEWEB-DE-FRA-10, DE),
Reverse DNS
Software
openresty/1.19.3.1 /
Resource Hash
3cc1e5075efa45b3b2898316b31070fb5151881405b115863b30d5f9c3157146

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Connection
keep-alive
Content-Encoding
gzip
Content-Type
text/html; charset=UTF-8
Date
Tue, 27 Jun 2023 10:37:47 GMT
Server
openresty/1.19.3.1
Transfer-Encoding
chunked
Vary
Accept-Encoding

Redirect headers

access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
7ddd0e7b9d613688-FRA
content-type
text/html; charset=UTF-8
date
Tue, 27 Jun 2023 10:37:46 GMT
location
https://efade.bustyaffar.com/s/63bf007e02311
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=U%2ByOxwUankMbL1m5IlEJdnu%2B5AL%2BvU8KzZaloCRMSIvlxtwS6rCO0lWrYWKwM3ooklsAuxlidgwHIiubhq5BK8P7X%2BImmLFrPaD4as71XIn0RYq16JnFhbTvseQGfo9ZJucvpx%2BEF7pmLg%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
x-powered-by
PHP/7.4.33
style.css
efade.bustyaffar.com/bundle/373/assets/css/ 		8 KB
8 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://efade.bustyaffar.com/bundle/373/assets/css/style.css
Requested by
Host: efade.bustyaffar.com
URL: https://efade.bustyaffar.com/s/63bf007e02311
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
178.162.199.80 Berlin, Germany, ASN28753 (LEASEWEB-DE-FRA-10, DE),
Reverse DNS
Software
openresty/1.19.3.1 /
Resource Hash
564be9acf9a12554f06ec1c07117f284232284923d5def54f1688559ef28818d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://efade.bustyaffar.com/s/63bf007e02311
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 10:37:47 GMT
Last-Modified
Fri, 20 Nov 2020 19:02:09 GMT
Server
openresty/1.19.3.1
ETag
"5fb812b1-1e16"
Vary
Accept-Encoding
Content-Type
text/css
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
7702
jquery-3.2.1.min.js
code.jquery.com/ 		85 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/jquery-3.2.1.min.js
Requested by
Host: efade.bustyaffar.com
URL: https://efade.bustyaffar.com/s/63bf007e02311
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac18::1:a:3a , Netherlands, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
Software
nginx /
Resource Hash
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de

Request headers

Referer
https://efade.bustyaffar.com/
Origin
https://efade.bustyaffar.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Tue, 27 Jun 2023 10:37:47 GMT
content-encoding
gzip
last-modified
Fri, 12 Aug 2022 13:47:02 GMT
server
nginx
etag
W/"62f659d6-15283"
vary
Accept-Encoding
x-hw
1687862267.dop262.fr8.t,1687862267.cds147.fr8.hn,1687862267.cds133.fr8.c
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
content-length
30125
functions.js
efade.bustyaffar.com/bundle/373/assets/js/ 		1 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://efade.bustyaffar.com/bundle/373/assets/js/functions.js
Requested by
Host: efade.bustyaffar.com
URL: https://efade.bustyaffar.com/s/63bf007e02311
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
178.162.199.80 Berlin, Germany, ASN28753 (LEASEWEB-DE-FRA-10, DE),
Reverse DNS
Software
openresty/1.19.3.1 /
Resource Hash
48e7fce4de999dc2a1a99ec249b03011fe571e6f4d5383f8a447337b8a64d982

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://efade.bustyaffar.com/s/63bf007e02311
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 10:37:47 GMT
Last-Modified
Fri, 20 Nov 2020 19:02:09 GMT
Server
openresty/1.19.3.1
ETag
"5fb812b1-50e"
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1294
click.js
efade.bustyaffar.com/js/ 		7 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://efade.bustyaffar.com/js/click.js?10
Requested by
Host: efade.bustyaffar.com
URL: https://efade.bustyaffar.com/s/63bf007e02311
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
178.162.199.80 Berlin, Germany, ASN28753 (LEASEWEB-DE-FRA-10, DE),
Reverse DNS
Software
openresty/1.19.3.1 /
Resource Hash
18505ac7b697920c4bf75c30355001f1c3947d739fc45ba8774de9a793da4d8b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://efade.bustyaffar.com/s/63bf007e02311
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 10:37:47 GMT
Last-Modified
Thu, 15 Jun 2023 13:02:19 GMT
Server
openresty/1.19.3.1
ETag
"648b0bdb-1b07"
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
6919
1.jpg
efade.bustyaffar.com/bundle/373/assets/img/ 		85 KB
85 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://efade.bustyaffar.com/bundle/373/assets/img/1.jpg
Requested by
Host: efade.bustyaffar.com
URL: https://efade.bustyaffar.com/bundle/373/assets/css/style.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
178.162.199.80 Berlin, Germany, ASN28753 (LEASEWEB-DE-FRA-10, DE),
Reverse DNS
Software
openresty/1.19.3.1 /
Resource Hash
a4b00bc34b3e6fb222d380c95a9ed2fd409720e31977a92046deeb44780acbee

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://efade.bustyaffar.com/bundle/373/assets/css/style.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 10:37:47 GMT
Last-Modified
Fri, 20 Nov 2020 19:02:09 GMT
Server
openresty/1.19.3.1
ETag
"5fb812b1-15214"
Content-Type
image/jpeg
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
86548
fp2.min.js
efade.bustyaffar.com/js/ 		30 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://efade.bustyaffar.com/js/fp2.min.js
Requested by
Host: efade.bustyaffar.com
URL: https://efade.bustyaffar.com/js/click.js?10
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
178.162.199.80 Berlin, Germany, ASN28753 (LEASEWEB-DE-FRA-10, DE),
Reverse DNS
Software
openresty/1.19.3.1 /
Resource Hash
6e1bf43d1d49858aacd5de53b32b551732bca4b2a46b1f808eb6d6d0f2b70c0e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://efade.bustyaffar.com/s/63bf007e02311
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date
Tue, 27 Jun 2023 10:37:47 GMT
Last-Modified
Thu, 15 Jun 2023 13:02:19 GMT
Server
openresty/1.19.3.1
ETag
"648b0bdb-77dd"
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
30685
track.php
efade.bustyaffar.com/ 		0
254 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://efade.bustyaffar.com/track.php
Requested by
Host: code.jquery.com
URL: https://code.jquery.com/jquery-3.2.1.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
178.162.199.80 Berlin, Germany, ASN28753 (LEASEWEB-DE-FRA-10, DE),
Reverse DNS
Software
openresty/1.19.3.1 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept
*/*
Referer
https://efade.bustyaffar.com/s/63bf007e02311
X-Requested-With
XMLHttpRequest
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

Date
Tue, 27 Jun 2023 10:37:48 GMT
Content-Encoding
gzip
Server
openresty/1.19.3.1
Connection
keep-alive
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
text/html; charset=UTF-8

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Porn Scam (Online)

16 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| onbeforetoggle object| onscrollend function| $ function| jQuery function| fingerprintGo function| sendTrack function| collectTrackParams function| closingConfirm function| handleError function| getParameterByName function| collectParams function| checkRequired function| setLeadInfo function| setCF function| Fingerprint2

3 Cookies

Domain/Path Name / Value
shawield.ru/ Name: qwerty_interspire
Value: 0
.bustyaffar.com/ Name: s
Value: p8nh1rmxypRD9fwlEgMFYVZ1XtA2PzB2PmOs19sfVKO9sGnfO92iq6LSP9hRo%2FRWrJ2iKuKn0p8Q%2B0bw8utZdCB%2BNvkRH5tb%2FTdQQiJD4fhWdm6BckcEsmhkLX439bj97CLwWNBAPgMZk5tR59o2wLVTOL%2BnQSb6JztMzL1gcPFt0IavNC2gPcnIQvTieArb6t2SO6%2FPJlHHXO%2FW6DlGsH80eqhD84DzqTD1HEjkwPwVo0g2OtiHwVokiGqwlXdlqGPj7E9yk9Wz5Qi35OB8F%2F0CgvOCcBiUqWQRuT8yZGjgrOpdQ1sDyZDcpzmOg5BF%2FJDVhG0oyisLjf7pdVywI%2F8ctfBqQHsh1iaI2cPK9VLyttVlA3gg%2FeRzbYURVAdY5I1rUtBW87amyWAg5phwaGbjjxiShabjsbtdrLFMZhuI55Ib8HmuhD8%2BDWxbXgA6aAdqa5o938c%2B63RMjYJ6Kr2g0RVRui7V7dHkpdI5gbfLS0ZmTedT80HZoRyZOsbsLtauISW7wlGIqLcGtjJSlbTTslfgvHLcLkFqv9OOofYLN5u61TxTZ1ANRfd04GX9nlmyzOwSaE2y3cwy%2BsZ2Uy0Y20%2Flu8zGwreUz10jJxoanqUbSWTypf7ZI3sQd69JC3l6Ag%2FdCLTnr%2BEyxMkk669Qds5uRvvoQ5I5c6S1uU%2B%2BWFQMBebZkkgb2O3cSAjgo7YHgCG%2FKj%2FsAIYRz%2F9JrlIbawheicm40V0rTVSWITRWrbHRw2drbiFndPiNI3kIhf5GBZtrI2lusUhstXIOLpf%2B2H%2FQTf53C2BPi%2BnTyH6c6uQTdWcj2cHFMEYDWiY91JMyTNWiMlfnMHg1EEnPmBkxGkD9NSkkoMmTTOkk2TLKK3SxwztSztE99cdSG7q4kuzu5AzlQAT%2ByagNVCygWdP%2FrZe1p6edFnWLqhWSjQdqZeyoNpmdYYDSPPfcjVfupWsJmid5ExzSBg%2FfWgtL95VYtd7hYU%2BKak%2F%2FCqAl1dMbmDaM%2B0xMkS9glMiCUyrEcf%2FnbUjVtYoKz8qE15a%2FKEqip3I7JSTtwT4O4ONPZPwFKVhn0zzBp9nOwWLo7qIpzFDDJQ3pvRNRpeW9%2BL4EXNfNz9Y7sesNU1ZDXb6hUkaxTsVTr5jYU1ZM5LX6z0hdokPbDE00dWCG3trbd9OQEopgq39XlWrQqLI0zE87l7UDXwofnTYzBrzediP1EIUhLxN8YQgBUzKG6kX7wD3hKpg0yne6l8HRZmlrsPXySB%2FZHi3CGKBazc6%2FfDYeRWcBiKnUfWUVUuQFtM8nBuHLb8it0g%2Fk5Vhsl3i5GK4VnkEKADzdvxwdwzL27tITOhmZejmVypQuF6AOdemIgbmrzYOZ8GJVKomucvdmEEoz75bxre84G1FZkebeNGC%2Bl4vNlTiYNG1uRhpz%2BWbHXCqn3TswUzapjDXK1wXT2jCgETod41EEDpT79xthOfyA%2FkMwZ5WkdWh8VHvVAwq5XWLafjQJbGgt6KRDyk%2FaWDKF2oSidepm1jNGI25yZyUwl4IgNyPYVnGyIA2VdZMS6Vo%2BBdIna2qQR2z7fgzqnDYgqJgxsg7Li%2ByYqqDa2D5T4K6IXd7MteR00Rt7t0ejAEOs6FcudAvNowEJpCch
efade.bustyaffar.com/ Name: CF
Value: eCycpBMPS+AErCGDWo9mVg__