www.privatedate.link Open in urlscan Pro
178.162.199.80  Malicious Activity! Public Scan

Submitted URL: https://bit.ly/3S9tGL3
Effective URL: https://www.privatedate.link/s/62cf1c2250951?track=looker3
Submission: On January 23 via api from BE — Scanned from DE

Summary

This website contacted 5 IPs in 3 countries across 6 domains to perform 9 HTTP transactions. The main IP is 178.162.199.80, located in Germany and belongs to LEASEWEB-DE-FRA-10, DE. The main domain is www.privatedate.link.
TLS certificate: Issued by R3 on January 18th 2024. Valid for: 3 months.
This is the only time www.privatedate.link was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Porn Scam (Online)

Domain & IP information

IP Address AS Autonomous System
1 1 67.199.248.10 396982 (GOOGLE-CL...)
1 2 2a03:6f00:1::... 9123 (TIMEWEB-AS)
1 88.214.27.36 209272 (AS-ALVIVA)
1 13.32.99.97 16509 (AMAZON-02)
5 178.162.199.80 28753 (LEASEWEB-...)
1 2a04:4e42:600... 54113 (FASTLY)
9 5
Apex Domain
Subdomains
Transfer
5 privatedate.link
www.privatedate.link
113 KB
2 hype-machine.ru
vkclips.hype-machine.ru
531 B
1 jquery.com
code.jquery.com — Cisco Umbrella Rank: 760
30 KB
1 openfpcdn.io
openfpcdn.io — Cisco Umbrella Rank: 20495
5 KB
1 localswag.net
localswag.net
1 KB
1 bit.ly
bit.ly — Cisco Umbrella Rank: 7478
346 B
9 6
Domain Requested by
5 www.privatedate.link localswag.net
www.privatedate.link
code.jquery.com
2 vkclips.hype-machine.ru 1 redirects
1 code.jquery.com www.privatedate.link
1 openfpcdn.io localswag.net
1 localswag.net
1 bit.ly 1 redirects
9 6

This site contains no links.

Subject Issuer Validity Valid
vkclips.hype-machine.ru
R3
2023-12-23 -
2024-03-22
3 months crt.sh
openfpcdn.io
Amazon RSA 2048 M02
2023-12-27 -
2025-01-25
a year crt.sh
privatedate.link
R3
2024-01-18 -
2024-04-17
3 months crt.sh
*.jquery.com
Sectigo RSA Domain Validation Secure Server CA
2023-07-11 -
2024-07-14
a year crt.sh

This page contains 1 frames:

Primary Page: https://www.privatedate.link/s/62cf1c2250951?track=looker3
Frame ID: A64AB11021C946C6F490CE03B88F8E82
Requests: 9 HTTP requests in this frame

Screenshot

Page Title

Die beliebtesten Dating-Website des Monats

Page URL History Show full URLs

  1. https://bit.ly/3S9tGL3 HTTP 301
    http://vkclips.hype-machine.ru/wp-admin/network/hapteron/undertake/neighbourlike_potentiometer.html?uyfe=gq... HTTP 301
    https://vkclips.hype-machine.ru/wp-admin/network/hapteron/undertake/neighbourlike_potentiometer.html?uyfe=gq... Page URL
  2. http://localswag.net/ Page URL
  3. https://www.privatedate.link/s/62cf1c2250951?track=looker3 Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

9
Requests

89 %
HTTPS

33 %
IPv6

6
Domains

6
Subdomains

5
IPs

3
Countries

149 kB
Transfer

238 kB
Size

3
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://bit.ly/3S9tGL3 HTTP 301
    http://vkclips.hype-machine.ru/wp-admin/network/hapteron/undertake/neighbourlike_potentiometer.html?uyfe=gqv60fw6 HTTP 301
    https://vkclips.hype-machine.ru/wp-admin/network/hapteron/undertake/neighbourlike_potentiometer.html?uyfe=gqv60fw6 Page URL
  2. http://localswag.net/ Page URL
  3. https://www.privatedate.link/s/62cf1c2250951?track=looker3 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://bit.ly/3S9tGL3 HTTP 301
  • http://vkclips.hype-machine.ru/wp-admin/network/hapteron/undertake/neighbourlike_potentiometer.html?uyfe=gqv60fw6 HTTP 301
  • https://vkclips.hype-machine.ru/wp-admin/network/hapteron/undertake/neighbourlike_potentiometer.html?uyfe=gqv60fw6

9 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
neighbourlike_potentiometer.html
vkclips.hype-machine.ru/wp-admin/network/hapteron/undertake/
Redirect Chain
  • https://bit.ly/3S9tGL3
  • http://vkclips.hype-machine.ru/wp-admin/network/hapteron/undertake/neighbourlike_potentiometer.html?uyfe=gqv60fw6
  • https://vkclips.hype-machine.ru/wp-admin/network/hapteron/undertake/neighbourlike_potentiometer.html?uyfe=gqv60fw6
93 B
242 B
Document
General
Full URL
https://vkclips.hype-machine.ru/wp-admin/network/hapteron/undertake/neighbourlike_potentiometer.html?uyfe=gqv60fw6
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a03:6f00:1::5c35:6078 , Russian Federation, ASN9123 (TIMEWEB-AS, RU),
Reverse DNS
Software
nginx/1.24.0 /
Resource Hash
17bfca49830053b1265cecc9de1a287768734dfe080489b35913a23cfbcdc695

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
content-length
93
content-type
text/html; charset=utf-8
date
Tue, 23 Jan 2024 10:47:25 GMT
etag
"5d-60dc1c87194c0"
last-modified
Sat, 30 Dec 2023 22:36:43 GMT
server
nginx/1.24.0

Redirect headers

Connection
keep-alive
Content-Length
169
Content-Type
text/html
Date
Tue, 23 Jan 2024 10:47:25 GMT
Location
https://vkclips.hype-machine.ru/wp-admin/network/hapteron/undertake/neighbourlike_potentiometer.html?uyfe=gqv60fw6
Server
nginx/1.24.0
/
localswag.net/
2 KB
1 KB
Document
General
Full URL
http://localswag.net/
Protocol
HTTP/1.1
Server
88.214.27.36 , Germany, ASN209272 (AS-ALVIVA, SC),
Reverse DNS
Software
Apache/2 /
Resource Hash
54d3c33c2ad5124396fb7b996d10854e5412d9ef1e521480b64103b72ec4993f

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Accept-Ranges
bytes
Connection
Upgrade, Keep-Alive
Content-Encoding
gzip
Content-Length
728
Content-Type
text/html
Date
Tue, 23 Jan 2024 10:47:27 GMT
ETag
"6ff-60f3fb4ec3840-gzip"
Keep-Alive
timeout=2, max=100
Last-Modified
Thu, 18 Jan 2024 22:15:53 GMT
Server
Apache/2
Upgrade
h2,h2c
Vary
Accept-Encoding,User-Agent
v1
openfpcdn.io/botd/
15 KB
5 KB
Script
General
Full URL
https://openfpcdn.io/botd/v1
Requested by
Host: localswag.net
URL: http://localswag.net/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.32.99.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-99-97.fra60.r.cloudfront.net
Software
CloudFront /
Resource Hash
06a89873f4eb2ccd1bc1a17e110527144dfa40ce1e7890a6b74c314034d56fd1
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
http://localswag.net/
Origin
http://localswag.net
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

strict-transport-security
max-age=63072000; includeSubDomains; preload
content-encoding
br
x-content-type-options
nosniff
date
Tue, 23 Jan 2024 08:41:36 GMT
via
1.1 ca8cb14c76df16342491237cea8cfed6.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA60-P3
age
7551
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
server
CloudFront
etag
W/"Bi9wqxtE/vuVm3DkF3FOSUMjDrE"
vary
Accept-Encoding
content-type
text/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=602486, s-maxage=10528
x-amz-cf-id
xWYjT1DSmtWZX6xZcCbimJprv0508jZRZi4tk_stQOXClvFW0PVAqQ==
Primary Request 62cf1c2250951
www.privatedate.link/s/
43 KB
19 KB
Document
General
Full URL
https://www.privatedate.link/s/62cf1c2250951?track=looker3
Requested by
Host: localswag.net
URL: http://localswag.net/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
178.162.199.80 , Germany, ASN28753 (LEASEWEB-DE-FRA-10, DE),
Reverse DNS
Software
openresty/1.19.3.1 /
Resource Hash
f39aeaeca7851635b09a6e312d4f265ccbdf686d161d935a7bfdb1537e38a785

Request headers

Referer
http://localswag.net/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Encoding
gzip
Content-Type
text/html; charset=UTF-8
Date
Tue, 23 Jan 2024 10:47:28 GMT
Expires
0
Pragma
no-cache
Server
openresty/1.19.3.1
Transfer-Encoding
chunked
Vary
Accept-Encoding
style.css
www.privatedate.link/bundle/373/assets/css/
8 KB
8 KB
Stylesheet
General
Full URL
https://www.privatedate.link/bundle/373/assets/css/style.css
Requested by
Host: www.privatedate.link
URL: https://www.privatedate.link/s/62cf1c2250951?track=looker3
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
178.162.199.80 , Germany, ASN28753 (LEASEWEB-DE-FRA-10, DE),
Reverse DNS
Software
openresty/1.19.3.1 /
Resource Hash
564be9acf9a12554f06ec1c07117f284232284923d5def54f1688559ef28818d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.privatedate.link/s/62cf1c2250951?track=looker3
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date
Tue, 23 Jan 2024 10:47:28 GMT
Last-Modified
Fri, 20 Nov 2020 19:02:09 GMT
Server
openresty/1.19.3.1
ETag
"5fb812b1-1e16"
Vary
Accept-Encoding
Content-Type
text/css
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
7702
jquery-3.2.1.min.js
code.jquery.com/
85 KB
30 KB
Script
General
Full URL
https://code.jquery.com/jquery-3.2.1.min.js
Requested by
Host: www.privatedate.link
URL: https://www.privatedate.link/s/62cf1c2250951?track=looker3
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:600::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de

Request headers

Referer
https://www.privatedate.link/
Origin
https://www.privatedate.link
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date
Tue, 23 Jan 2024 10:47:28 GMT
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
age
555413
x-cache
HIT, HIT
content-length
30125
x-served-by
cache-lga21971-LGA, cache-fra-eddf8230047-FRA
last-modified
Fri, 18 Oct 1991 12:00:00 GMT
server
nginx
x-timer
S1706006849.563492,VS0,VE0
etag
W/"28feccc0-15283"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=604800
accept-ranges
bytes
x-cache-hits
18, 118732
functions.js
www.privatedate.link/bundle/373/assets/js/
1 KB
2 KB
Script
General
Full URL
https://www.privatedate.link/bundle/373/assets/js/functions.js
Requested by
Host: www.privatedate.link
URL: https://www.privatedate.link/s/62cf1c2250951?track=looker3
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
178.162.199.80 , Germany, ASN28753 (LEASEWEB-DE-FRA-10, DE),
Reverse DNS
Software
openresty/1.19.3.1 /
Resource Hash
48e7fce4de999dc2a1a99ec249b03011fe571e6f4d5383f8a447337b8a64d982

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.privatedate.link/s/62cf1c2250951?track=looker3
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date
Tue, 23 Jan 2024 10:47:28 GMT
Last-Modified
Fri, 20 Nov 2020 19:02:09 GMT
Server
openresty/1.19.3.1
ETag
"5fb812b1-50e"
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1294
1.jpg
www.privatedate.link/bundle/373/assets/img/
85 KB
85 KB
Image
General
Full URL
https://www.privatedate.link/bundle/373/assets/img/1.jpg
Requested by
Host: www.privatedate.link
URL: https://www.privatedate.link/bundle/373/assets/css/style.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
178.162.199.80 , Germany, ASN28753 (LEASEWEB-DE-FRA-10, DE),
Reverse DNS
Software
openresty/1.19.3.1 /
Resource Hash
a4b00bc34b3e6fb222d380c95a9ed2fd409720e31977a92046deeb44780acbee

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.privatedate.link/bundle/373/assets/css/style.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Date
Tue, 23 Jan 2024 10:47:28 GMT
Last-Modified
Fri, 20 Nov 2020 19:02:09 GMT
Server
openresty/1.19.3.1
ETag
"5fb812b1-15214"
Content-Type
image/jpeg
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
86548
track.php
www.privatedate.link/
0
254 B
XHR
General
Full URL
https://www.privatedate.link/track.php
Requested by
Host: code.jquery.com
URL: https://code.jquery.com/jquery-3.2.1.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
178.162.199.80 , Germany, ASN28753 (LEASEWEB-DE-FRA-10, DE),
Reverse DNS
Software
openresty/1.19.3.1 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept
*/*
Referer
https://www.privatedate.link/s/62cf1c2250951?track=looker3
X-Requested-With
XMLHttpRequest
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

Date
Tue, 23 Jan 2024 10:47:28 GMT
Content-Encoding
gzip
Server
openresty/1.19.3.1
Connection
keep-alive
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
text/html; charset=UTF-8

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Porn Scam (Online)

17 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery string| sid boolean| exitPopunder string| fpDataEncoded string| cf function| sendTrack function| Fingerprint2 function| fingerprintGo function| collectTrackParams function| closingConfirm function| handleError function| getParameterByName function| collectParams function| checkRequired function| setLeadInfo function| setCF

3 Cookies

Domain/Path Name / Value
.bit.ly/ Name: _bit
Value: o0naLp-8c399e657f275dbd53-00w
.privatedate.link/ Name: s
Value: WmskEWyo06vhMlFz%2BemifjMJr3elFP0I1JxscZ7dyODLo25k91VCkRMfAu%2FC4mhWM%2FLK0MN9mA7gQIOc0R%2BFsCB%2BNvmRPqNb%2BRxQ5mRnYX8%2F090ntBQvwWxksVoqtQ6iBERE3jC58UoFNkqtpNqacYUWG83Kf29vvfCS5ZNltd1DcCt3IqHxXMyJgtaeTvjTGR2fNRscNIUtTwGRsUJxqTV4eDHzS6%2BaOUW8%2BwcNWl0YkMEVdSlRJZ0r5YufUzTIjVsxCPltO9mREdVNHO2AMfdOzOskBXF87v1%2BkJKEAQarkAQoXdUe%2BihOtgjagFfe3lGs8PZuYT2vPlPaTBWyIgGdMHtzkP0xbzrt251KSJCQjyh1evF72DrBwoxPGq%2FFqu%2Fo5y%2BCgJK7nZoDtq%2F3f9B2aUBGDr2pX4aEb8lyH5PhSvHmvPj05sl37V6bHUzas%2FtJPYLI0yO%2ByhSRqTsG2oALLkJrFi0XYP47Ok9w4rkJhfx1S2ScpTt44ljq8I3QVUNkunmpBZSzODpIhFxWVYEIyK%2BVWG4MyRSVXwP%2FNOzI18DF5B%2BX58LmyZ5xkH2NPZHCIYTq561YKNOh7hXCdZAFWK2ED5PkvpsBTZ2EJLgRIfPn0BcH1PBkfYsNHQPBg1dFWLIdPEsBMOf6PYYctBLwQ5pO%2BXKLSl2PHiMdwV8qDWgSex2v0oNHg%2FkzIeXBlNkgvxBmycCt%2ByhQdS2Rluu%2FBzqEFdjKWQgAXZWGo4eKdlir0uJAw4s3NXwX0ob9Si%2ByLD9bo4zojdcHrlgbfYoFRDMAA4jEA1LeKeG5SxMDt8T23ih0XOcEi6mB5bUuhXWBhJyoUWqA1Rm6p9UHDRWcvCOHEJwyqu%2B%2B4wE7PoOk3MOEbodh8MFkMA0IJ%2FiSIisustyBTxiUzi6%2FzMeYd51FDWpr7HB5Ysposb7tCV5csvoRto68GmTUvzzR29HGHzAJkJ%2FH2GlM%2FVH0DzUeEheFgjfXHOESxfH4fDsVmXdM4OQV%2BSZQuxtt68sE2rYeyUWcvtMxYEwVxqKtRppYDahkXKBk2mlZVIzA9rkks9fiIYa7eUQtQmlhQOSZF2COudorHydQ4eEDKhwFvZFsGGw3dAMdSj7zCgT7Nzxp49CqMXgODfFZlN86%2BlYjnDPnF%2B%2Fvng10Cx78Vv3pcRAIcvfBIhXPvrLQpJn%2F5BP5%2FWuJBVY4jSWRAWd8hGrL8maNeFO5PZwcqqTHsSnYYfh6WEoYdZp%2BEjDfs7n%2FVjdgp2LX2w7SWwJexJUs53OUc7YpD2G0Dv6XVXgRirhv1l1ZjzEcq2qC4Hp8eApnjx%2FctYcE1%2BPLhpudrfP67IQnVg2VI4DCtin1vWzC3iWFtr5DYmSCJTEzQsqltnPrFPiwcCojmkC473PoXdF1kMLmCquDwxPgccETdPyBcvZ9tWvXu5JGGeoz4Xp99GdsTZJtwKzwhcpfrfCDToGeFCFHQJnp68wZwPtrgHPemU4vq3eCi1V4OrCxiLFfOSY2H8Z9o5PkwjejQeozk%2FFKxjix2p0Bm7LnS5EMG4JaAtik1gKVKiKTIQUJK%2FaNTBh%2BenEuYVDJZ2VXFesDdJuaQ9lYXon1hGjkh42580EW5fQYA7G3ntbtOB%2F3WiiS6zCX8hJVun1Z9elkZG13rKX9zGtjMLrexuYB84h1ebAI%2FZwi0PACIFZUhve0Ue1I1jYsoTYxxem2Sa6coboDK1llHh4ZCBVWkpevBIycO%2BuLZk7XVEKjF6UgjUgbal7AGVLlQFZH
www.privatedate.link/ Name: CF
Value: 4EUbmQZ4relWwZx+RrH8cw__