bfghabd.flirtarea.link
Open in
urlscan Pro
176.123.10.32
Malicious Activity!
Public Scan
Effective URL: https://bfghabd.flirtarea.link/s/75a694c44e329?sub2=ppdf&track=ppdf
Submission: On August 13 via api from US — Scanned from DE
Summary
TLS certificate: Issued by R11 on June 27th 2024. Valid for: 3 months.
This is the only time bfghabd.flirtarea.link was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Porn Scam (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 | 172.67.142.155 172.67.142.155 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
11 | 176.123.10.32 176.123.10.32 | 200019 (ALEXHOST) (ALEXHOST) | |
13 | 2 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
11 |
flirtarea.link
bfghabd.flirtarea.link |
286 KB |
2 |
2024dating.info
2024dating.info |
1 KB |
13 | 2 |
Domain | Requested by | |
---|---|---|
11 | bfghabd.flirtarea.link |
bfghabd.flirtarea.link
|
2 | 2024dating.info | |
13 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
2024dating.info WE1 |
2024-07-28 - 2024-10-26 |
3 months | crt.sh |
flirtarea.link R11 |
2024-06-27 - 2024-09-25 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://bfghabd.flirtarea.link/s/75a694c44e329?sub2=ppdf&track=ppdf
Frame ID: A46D318066F9C0FB60EBBF76166D15EA
Requests: 13 HTTP requests in this frame
Screenshot
Page Title
Die beliebtesten Dating-Website des MonatsPage URL History Show full URLs
-
http://2024dating.info/?id=3v0h1
HTTP 307
https://2024dating.info/?id=3v0h1 Page URL
- https://bfghabd.flirtarea.link/s/75a694c44e329?sub2=ppdf&track=ppdf Page URL
Detected technologies
jQuery (JavaScript Libraries) ExpandDetected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://2024dating.info/?id=3v0h1
HTTP 307
https://2024dating.info/?id=3v0h1 Page URL
- https://bfghabd.flirtarea.link/s/75a694c44e329?sub2=ppdf&track=ppdf Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://2024dating.info/?id=3v0h1 HTTP 307
- https://2024dating.info/?id=3v0h1
13 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H3 |
/
2024dating.info/ Redirect Chain
|
111 B 539 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
75a694c44e329
bfghabd.flirtarea.link/s/ |
43 KB 17 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
favicon.ico
2024dating.info/ |
111 B 544 B |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
style.css
bfghabd.flirtarea.link/bundle/19/assets/css/ |
50 KB 13 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-2.2.4.min.js
bfghabd.flirtarea.link/bundle/19/assets/js/ |
84 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
script.min.js
bfghabd.flirtarea.link/bundle/19/assets/js/ |
254 KB 77 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo.png
bfghabd.flirtarea.link/bundle/19/assets/img/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bg.jpg
bfghabd.flirtarea.link/bundle/19/assets/img/ |
101 KB 101 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
1.jpg
bfghabd.flirtarea.link/bundle/19/assets/img/ |
17 KB 17 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
2.jpg
bfghabd.flirtarea.link/bundle/19/assets/img/ |
12 KB 13 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
3.jpg
bfghabd.flirtarea.link/bundle/19/assets/img/ |
16 KB 17 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
track.php
bfghabd.flirtarea.link/ |
0 277 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
favicon.ico
bfghabd.flirtarea.link/ |
0 116 B |
Other
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Porn Scam (Online)16 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery string| cf boolean| exitPopunder string| fpDataEncoded function| sendTrack function| Fingerprint2 function| fingerprintGo function| collectTrackParams function| closingConfirm function| handleError function| getParameterByName function| collectParams function| checkRequired function| setLeadInfo function| setCF2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.flirtarea.link/ | Name: s Value: DXW38dLism1sW7bAjRyRaIlRG%2FQ8XA60zwHMeY5hTPsuxrU3gwnuukhj4j54QJkiGjlUcmSN3bNM6bGwVGnAhCB%2B3vmhPqNb%2BR9Q5iRz1bjlnijdx4sw7w%2BxvfYr9xRoJYNVgYjSXxiztS5I5EiEjVirhK2FbAn0OukGtEEnXC5brPJ7DL63%2BXc7ovy6GCMSDDrcCL5FBjA1TgDKHZ846y9fZ%2Fjozk0%2BmNhvSRkD2JGLmLBdbFPxzJXWuJXvOvqZzRkiHqWNy4Cd9nAfrdzUXGdVdT4GVQZauNdBsI6WIBHBV9eZI1ycyjjnAik3umMg8Me%2FLiRqWN2GYex%2Fbd%2BUdyMyAvvBnmp1jEyW%2FzB3YCVWdLNXdMkUWFVPxC5ABXdQjr0g286pGD1zo9WHDdh%2FI7Ef7Q2%2BxfIOc2PYbUGS1NlGSIxBG1Y97aJYAJeJxqV%2BEwJT%2FqbbVd%2BcaY07I3mMB8D32bO5H%2BP%2F1dRdCI2SVlaHhVsqzd5pS1N6AhGPu3doLodfVLnlEyhBg%2BSiemcPq%2BdTjz5hSLv9MnagZHEV2Yktu3XLackkj8us0lRDWKCzWyoZ126JNky%2Fj%2BGI5rFWn8%2FotzjYCsBq8zuM4DKSFU6vQmVTivFhdre03eFWGnBQTnpK3pEgWZeK%2BcMU1noRu25fMQEcZCvqqmQT1wNB796ZIDp1uXGIVNsFMxYSr80dcyLrloL6yLbGQzLd%2B07kMVqT2bFL0hNrhPLR0r3vpVhcDggZPSz3dVs2oRpC2ZGUUZWIPjKdOk9lFT6%2Fatt9QZQT6RQ9M89%2FzVOTfZIK5HrNyqIpn41giPrrf4%2FKlLJA158f4KrqFsnrKf7FDQa7uLk2cry30hpOYYPAx1H5ZxGTY2RQfU%2FQ0FsDKcooQ44eH32OLzacxQ52REhRC%2FAW7I1blo17EkRqLJdDP1ayzVX9Cc3NW4GD0B0XKX7L5wGGbikERtcKEjrFF8FmKIUyH55DtNNcqhAS0LDRs3owvnbNuKjwPw7f27Si9QEj12cD2Q3tU0zuR24z4mvK3%2BjZnA%2FYy9D15FRlqS%2FxQf%2FfDF1GIy5%2FG9i2bJ0zvkto7qHgoq58dlx2i0z3QNYjb1HexsNJNPjFL9OgGo%2F2vyIsAZypl27HQqbZxbNznewSGVkZUK3LiWWefqkVF7MVh8nenlfSSACgwdhEzsZG0xuwGqD7SRU%2BgorL3tct5ZkG63bztuNta37kVU3tWfpN%2FrbJ%2FV8IKQrErc2mYLnuAqZn0yfKSXQ%2Fnr9cAGDZOwkMsyTRsCsHj%2BbDRcG66W4qp%2FrXiEycp5fWb6db5F6Wg2fY64c8zxD8s53xKgbQHt1YfaUxpzcL79pW4XLpjwiRwJF7k43Oauh4EQ6O00C1qMXRwpsLZLl3ikwgsTGd56g6HLhv0%2BvkUSlWGz0C1lft1EetoSI%2F5FuKF8gwaBSnTLuGCjhqpOj7BGMaeqbpskw46GXkq7%2F8%2FfFtdfQc6B8mItSy%2FKuT7V9tvLpqsGWhD1KgHg8em%2BCEJl4sq4BACiuvAMW%2FrSePB%2FXcF7rFm6hksscJgoC20D%2Fe%2Btmwdahp%2BDBa6I8Xt9ZMJf1PryNuwMC2wKVyUnWGurxdj2YN4N8apW%2FGx%2FmuMt%2BgMTIRrSv7AsJzpCyCclJwiwDLKwqloTrssZYlWVaKNWzhQqe%2BWorrmrrSqQ17x02pba3gmDBc8JdZi6pVmpXQTTYiXrmUx4QQYBr1NDmhgyAVfWoBacuTuDiSwYU9lIY4cjZ1%2FNkbuuQr3Wb%2B8SkP49YJ0J%2FXcd7eCxcvUtj3Ufcr%2FqswhW0g0AqU0efRZQ1CB5CK6fg0BUxBkfUekAlNhlrmY8sHcYKx5qhO4%2BfHYWU%3D |
|
bfghabd.flirtarea.link/ | Name: CF Value: 8APUVKrPXwLqsSRSUo+Vog__ |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
2024dating.info
bfghabd.flirtarea.link
172.67.142.155
176.123.10.32
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
3f68f0782d363750744f67d981d9c32c6244e71e23293ec8d17bdcb0b36945c2
408b7f5fdce3b7f93fdba3bcb4e47f6e64e70a15c02d38879b6297e9d7cb9e45
49341eafd7cb8b62ead1ecd2e2ca916c6c55c449ceb45c2c3ca423be00d971b8
91bc529d2329ad04e61d303f0408524469340da5f78216f57075c3b20950e47f
94b921a4a0aae90ff9bbc7d2ee272e267b9d821ae420c66ecf449b2be7d55e35
bc61625502941dc4c9fbf12a0848178bfbfa79fb8ad1c010271f716673ff3fef
d23157cff1e15192fb85ef456dad32c54b0e34d85235822005207517facbda38
df33173c7d5d08e9ce01490ffcea6df05910654dad4b04443eb0a6276dce3092
e2dab790f9f4f5e418ae79f78a92eeafd27b2fd3c95f086c1d3ad78db7449469
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855