www.todayhotties.ru Open in urlscan Pro
178.162.199.80 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://bit.ly/3HHvmUX?89b521e2a457247abe4cb84754b4b638
Effective URL:
http://www.todayhotties.ru/s/5af3ff4b5a898?s=123
Submission: On March 06 via api (March 6th 2022, 8:06:29 am UTC) from BE — Scanned from DE

Summary HTTP 13 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 3 countries across 6 domains to perform 13 HTTP transactions. The main IP is 178.162.199.80, located in Germany and belongs to LEASEWEB-DE-FRA-10, DE. The main domain is www.todayhotties.ru.

This is the only time www.todayhotties.ru was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Porn Scam (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 1	67.199.248.11 67.199.248.11	396982 (GOOGLE-PR...) (GOOGLE-PRIVATE-CLOUD)
1	162.214.116.103 162.214.116.103	46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1)
1 1	185.36.100.24 185.36.100.24	62403 (DISKGROUP) (DISKGROUP)
10	178.162.199.80 178.162.199.80	28753 (LEASEWEB-...) (LEASEWEB-DE-FRA-10)
1	2a00:1450:400... 2a00:1450:4001:803::200a	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:810::2003	15169 (GOOGLE) (GOOGLE)
13	4

1 67.199.248.11 (United States) 1 redirects

ASN396982 (GOOGLE-PRIVATE-CLOUD, US)
PTR: bit.ly

bit.ly	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 162.214.116.103 (United States)

ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: vps-4656823.intebra.com.br

loja.intebra.com.br	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.36.100.24 (Haarlem, Netherlands) 1 redirects

ASN62403 (DISKGROUP, VG)

onlinedates.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 178.162.199.80 (Germany)

ASN28753 (LEASEWEB-DE-FRA-10, DE)

www.todayhotties.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:803::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:810::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	todayhotties.ru www.todayhotties.ru	422 KB
1	gstatic.com fonts.gstatic.com	24 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 35	858 B
1	onlinedates.ru 1 redirects onlinedates.ru	267 B
1	intebra.com.br loja.intebra.com.br	346 B
1	bit.ly 1 redirects bit.ly — Cisco Umbrella Rank: 3926	307 B
13	6

	Domain	Requested by
10	www.todayhotties.ru	www.todayhotties.ru
1	fonts.gstatic.com	fonts.googleapis.com
1	fonts.googleapis.com	www.todayhotties.ru
1	onlinedates.ru	1 redirects
1	loja.intebra.com.br
1	bit.ly	1 redirects
13	6

This site contains no links.

Subject Issuer	Validity	Valid
loja.intebra.com.br cPanel, Inc. Certification Authority	`2022-02-23` - `2022-05-24`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2022-02-17` - `2022-05-12`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2022-02-17` - `2022-05-12`	3 months	crt.sh

This page contains 1 frames:

Primary Page: http://www.todayhotties.ru/s/5af3ff4b5a898?s=123
Frame ID: CC5062A036B56F493D60505F43790C4B
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://bit.ly/3HHvmUX?89b521e2a457247abe4cb84754b4b638 HTTP 301
https://loja.intebra.com.br/hearthstone/Millettia_enrobe.html Page URL
http://onlinedates.ru/?land=24195 HTTP 302
http://www.todayhotties.ru/s/5af3ff4b5a898?s=123 Page URL

Page Statistics

13
Requests

23 %
HTTPS

33 %
IPv6

6
Domains

6
Subdomains

4
IPs

3
Countries

447 kB
Transfer

446 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://bit.ly/3HHvmUX?89b521e2a457247abe4cb84754b4b638 HTTP 301
https://loja.intebra.com.br/hearthstone/Millettia_enrobe.html Page URL
http://onlinedates.ru/?land=24195 HTTP 302
http://www.todayhotties.ru/s/5af3ff4b5a898?s=123 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://bit.ly/3HHvmUX?89b521e2a457247abe4cb84754b4b638 HTTP 301
https://loja.intebra.com.br/hearthstone/Millettia_enrobe.html

13 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Millettia_enrobe.html Show response
loja.intebra.com.br/hearthstone/
Redirect Chain

https://bit.ly/3HHvmUX?89b521e2a457247abe4cb84754b4b638
https://loja.intebra.com.br/hearthstone/Millettia_enrobe.html

104 B
346 B

773ms
145ms

Document
text/html

162.214.116.103
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://loja.intebra.com.br/hearthstone/Millettia_enrobe.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.214.116.103 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: vps-4656823.intebra.com.br
Software: Apache /
Resource Hash: 2413af09f3729fcccc77052489d69a6469a74f3c4f652c425e289b12121174d1

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

Date: Sun, 06 Mar 2022 08:06:23 GMT
Server: Apache
Last-Modified: Fri, 28 Jan 2022 23:09:21 GMT
Accept-Ranges: bytes
Content-Length: 104
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html

Redirect headers

server: nginx
date: Sun, 06 Mar 2022 08:06:22 GMT
content-type: text/html; charset=utf-8
content-length: 148
cache-control: private, max-age=90
content-security-policy: referrer always;
location: https://loja.intebra.com.br/hearthstone/Millettia_enrobe.html
referrer-policy: unsafe-url
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H/1.1

200
OK

Primary Request 5af3ff4b5a898 Show response
www.todayhotties.ru/s/
Redirect Chain

http://onlinedates.ru/?land=24195
http://www.todayhotties.ru/s/5af3ff4b5a898?s=123

4 KB
2 KB

1463ms
1437ms

Document
text/html

178.162.199.80
LEASEWEB-DE-FRA-10

General

Check archive.org

Show headers Download Go to

Full URL: http://www.todayhotties.ru/s/5af3ff4b5a898?s=123
Protocol: HTTP/1.1
Server: 178.162.199.80 , Germany, ASN28753 (LEASEWEB-DE-FRA-10, DE),
Reverse DNS
Software: openresty/1.19.3.1 /
Resource Hash: 154fe24e6ac857b898e75eb5618c3633086864454dea0904b309aca04771dd61

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://loja.intebra.com.br/hearthstone/Millettia_enrobe.html

Response headers

Server: openresty/1.19.3.1
Date: Sun, 06 Mar 2022 08:06:25 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Content-Encoding: gzip

Redirect headers

Server: nginx
Date: Sun, 06 Mar 2022 08:06:23 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 0
Connection: keep-alive
Keep-Alive: timeout=60
X-Powered-By: PHP/5.6.40
Location: http://www.todayhotties.ru/s/5af3ff4b5a898?s=123

GET
H/1.1 200
OK main.css
www.todayhotties.ru/bundle/34/assets/css/ 16 KB
17 KB 7ms
6ms Stylesheet
text/css 178.162.199.80
LEASEWEB-DE-FRA-10

General

Check archive.org

Show headers Download Go to

Full URL: http://www.todayhotties.ru/bundle/34/assets/css/main.css
Requested by: Host: www.todayhotties.ru
URL: http://www.todayhotties.ru/s/5af3ff4b5a898?s=123
Protocol: HTTP/1.1
Server: 178.162.199.80 , Germany, ASN28753 (LEASEWEB-DE-FRA-10, DE),
Reverse DNS
Software: openresty/1.19.3.1 /
Resource Hash: 7276788c73c7f7252ff2b133f9e8ef476ff0874723f40c10c40874bc957c7436

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://www.todayhotties.ru/s/5af3ff4b5a898?s=123
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Sun, 06 Mar 2022 08:06:25 GMT
Last-Modified: Thu, 17 May 2018 07:33:05 GMT
Server: openresty/1.19.3.1
ETag: "5afd3031-41d5"
Vary: Accept-Encoding
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 16853

GET
H/1.1 200
OK script.min.js Show response
www.todayhotties.ru/bundle/34/assets/js/ 252 KB
252 KB 13ms
6ms Script
application/javascript 178.162.199.80
LEASEWEB-DE-FRA-10

General

Check archive.org

Show headers Download Go to

Full URL: http://www.todayhotties.ru/bundle/34/assets/js/script.min.js
Requested by: Host: www.todayhotties.ru
URL: http://www.todayhotties.ru/s/5af3ff4b5a898?s=123
Protocol: HTTP/1.1
Server: 178.162.199.80 , Germany, ASN28753 (LEASEWEB-DE-FRA-10, DE),
Reverse DNS
Software: openresty/1.19.3.1 /
Resource Hash: 76d703389c75e3c1e9946072b1e18f6d61842f77eac3f03cfb366baba8035850

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://www.todayhotties.ru/s/5af3ff4b5a898?s=123
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Sun, 06 Mar 2022 08:06:25 GMT
Last-Modified: Thu, 17 May 2018 07:33:05 GMT
Server: openresty/1.19.3.1
ETag: "5afd3031-3f0a5"
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 258213

GET
H/1.1 200
OK function.js Show response
www.todayhotties.ru/bundle/34/assets/js/ 229 B
508 B 37ms
23ms Script
application/javascript 178.162.199.80
LEASEWEB-DE-FRA-10

General

Check archive.org

Show headers Download Go to

Full URL: http://www.todayhotties.ru/bundle/34/assets/js/function.js
Requested by: Host: www.todayhotties.ru
URL: http://www.todayhotties.ru/s/5af3ff4b5a898?s=123
Protocol: HTTP/1.1
Server: 178.162.199.80 , Germany, ASN28753 (LEASEWEB-DE-FRA-10, DE),
Reverse DNS
Software: openresty/1.19.3.1 /
Resource Hash: 52526b07b7efc57565d0169115d44524752d678dc65275175d978cf14ac49b3e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://www.todayhotties.ru/s/5af3ff4b5a898?s=123
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Sun, 06 Mar 2022 08:06:25 GMT
Last-Modified: Thu, 17 May 2018 07:33:05 GMT
Server: openresty/1.19.3.1
ETag: "5afd3031-e5"
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 229

GET
H/1.1 200
OK click.js Show response
www.todayhotties.ru/js/ 4 KB
4 KB 81ms
80ms Script
application/javascript 178.162.199.80
LEASEWEB-DE-FRA-10

General

Check archive.org

Show headers Download Go to

Full URL: http://www.todayhotties.ru/js/click.js
Requested by: Host: www.todayhotties.ru
URL: http://www.todayhotties.ru/s/5af3ff4b5a898?s=123
Protocol: HTTP/1.1
Server: 178.162.199.80 , Germany, ASN28753 (LEASEWEB-DE-FRA-10, DE),
Reverse DNS
Software: openresty/1.19.3.1 /
Resource Hash: 8abe2a77b34ca2d18a92f3c8619e5315bc86526b2cd0a6a5e219c566d39681bb

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://www.todayhotties.ru/s/5af3ff4b5a898?s=123
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Sun, 06 Mar 2022 08:06:25 GMT
Last-Modified: Mon, 07 Feb 2022 14:58:49 GMT
Server: openresty/1.19.3.1
ETag: "620133a9-109f"
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 4255

GET
H2 200 css
fonts.googleapis.com/ 664 B
858 B 43ms
16ms Stylesheet
text/css 2a00:1450:4001:803::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Lato&subset=latin-ext

Requested by

Host: www.todayhotties.ru
URL: http://www.todayhotties.ru/bundle/34/assets/css/main.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

05410fbe1192a21525520421f6ddce4a065a94658a42146ae707a814926fa77d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://www.todayhotties.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Sun, 06 Mar 2022 08:06:25 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Sun, 06 Mar 2022 08:06:25 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sun, 06 Mar 2022 08:06:25 GMT

GET
H/1.1 200
OK no.png
www.todayhotties.ru/bundle/34/assets/img/ 322 B
566 B 7ms
6ms Image
image/png 178.162.199.80
LEASEWEB-DE-FRA-10

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.todayhotties.ru/bundle/34/assets/img/no.png
Requested by: Host: www.todayhotties.ru
URL: http://www.todayhotties.ru/bundle/34/assets/css/main.css
Protocol: HTTP/1.1
Server: 178.162.199.80 , Germany, ASN28753 (LEASEWEB-DE-FRA-10, DE),
Reverse DNS
Software: openresty/1.19.3.1 /
Resource Hash: 855f62c34d296773b690bcd61d702db042b6085294928d1f7064c022b47d2695

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://www.todayhotties.ru/bundle/34/assets/css/main.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Sun, 06 Mar 2022 08:06:25 GMT
Last-Modified: Thu, 17 May 2018 07:33:04 GMT
Server: openresty/1.19.3.1
ETag: "5afd3030-142"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 322

GET
H/1.1 200
OK yes.png
www.todayhotties.ru/bundle/34/assets/img/ 594 B
838 B 14ms
14ms Image
image/png 178.162.199.80
LEASEWEB-DE-FRA-10

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.todayhotties.ru/bundle/34/assets/img/yes.png
Requested by: Host: www.todayhotties.ru
URL: http://www.todayhotties.ru/bundle/34/assets/css/main.css
Protocol: HTTP/1.1
Server: 178.162.199.80 , Germany, ASN28753 (LEASEWEB-DE-FRA-10, DE),
Reverse DNS
Software: openresty/1.19.3.1 /
Resource Hash: 3e80058e1e64f3e5085e47096d373ae6b74987d494aec75b3f67872706569ef4

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://www.todayhotties.ru/bundle/34/assets/css/main.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Sun, 06 Mar 2022 08:06:25 GMT
Last-Modified: Thu, 17 May 2018 07:33:05 GMT
Server: openresty/1.19.3.1
ETag: "5afd3031-252"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 594

GET
H/1.1 200
OK 1.jpg
www.todayhotties.ru/bundle/34/assets/img/ 114 KB
114 KB 12ms
6ms Image
image/jpeg 178.162.199.80
LEASEWEB-DE-FRA-10

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.todayhotties.ru/bundle/34/assets/img/1.jpg
Requested by: Host: www.todayhotties.ru
URL: http://www.todayhotties.ru/bundle/34/assets/css/main.css
Protocol: HTTP/1.1
Server: 178.162.199.80 , Germany, ASN28753 (LEASEWEB-DE-FRA-10, DE),
Reverse DNS
Software: openresty/1.19.3.1 /
Resource Hash: fb971c13685acd143b913da3ea0928ee9426695c0482b37f9254046c4a2bb83d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://www.todayhotties.ru/bundle/34/assets/css/main.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Sun, 06 Mar 2022 08:06:25 GMT
Last-Modified: Thu, 17 May 2018 07:33:05 GMT
Server: openresty/1.19.3.1
ETag: "5afd3031-1c77f"
Content-Type: image/jpeg
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 116607

GET
H/1.1 200
OK pattern.png
www.todayhotties.ru/bundle/34/assets/img/ 100 B
343 B 14ms
7ms Image
image/png 178.162.199.80
LEASEWEB-DE-FRA-10

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.todayhotties.ru/bundle/34/assets/img/pattern.png
Requested by: Host: www.todayhotties.ru
URL: http://www.todayhotties.ru/bundle/34/assets/css/main.css
Protocol: HTTP/1.1
Server: 178.162.199.80 , Germany, ASN28753 (LEASEWEB-DE-FRA-10, DE),
Reverse DNS
Software: openresty/1.19.3.1 /
Resource Hash: 13de289b7d770632c2b87d7019cdb10416061bcdb50f07cadcc5e4c6cdf33a36

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://www.todayhotties.ru/bundle/34/assets/css/main.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Sun, 06 Mar 2022 08:06:25 GMT
Last-Modified: Thu, 17 May 2018 07:33:05 GMT
Server: openresty/1.19.3.1
ETag: "5afd3031-64"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 100

GET
H2 200 S6uyw4BMUTPHjx4wXg.woff2
fonts.gstatic.com/s/lato/v22/ 23 KB
24 KB 30ms
7ms Font
font/woff2 2a00:1450:4001:810::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v22/S6uyw4BMUTPHjx4wXg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Lato&subset=latin-ext

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: http://www.todayhotties.ru
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Wed, 02 Mar 2022 19:30:55 GMT
x-content-type-options: nosniff
age: 304530
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 23580
x-xss-protection: 0
last-modified: Wed, 26 Jan 2022 19:14:03 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Thu, 02 Mar 2023 19:30:55 GMT

GET
H/1.1 200
OK fp2.min.js Show response
www.todayhotties.ru/js/ 30 KB
30 KB 85ms
85ms Script
application/javascript 178.162.199.80
LEASEWEB-DE-FRA-10

General

Check archive.org

Show headers Download Go to

Full URL: http://www.todayhotties.ru/js/fp2.min.js
Requested by: Host: www.todayhotties.ru
URL: http://www.todayhotties.ru/js/click.js
Protocol: HTTP/1.1
Server: 178.162.199.80 , Germany, ASN28753 (LEASEWEB-DE-FRA-10, DE),
Reverse DNS
Software: openresty/1.19.3.1 /
Resource Hash: 6e1bf43d1d49858aacd5de53b32b551732bca4b2a46b1f808eb6d6d0f2b70c0e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://www.todayhotties.ru/s/5af3ff4b5a898
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Sun, 06 Mar 2022 08:06:25 GMT
Last-Modified: Mon, 07 Feb 2022 14:58:49 GMT
Server: openresty/1.19.3.1
ETag: "620133a9-77dd"
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 30685

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Porn Scam (Online)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.bit.ly/	1970-01-20 05:41:45	Name: _bit Value: m2686m-f3aaa4749650b32a52-00z
			.todayhotties.ru/	1970-01-21 03:39:21	Name: SID Value: 09062cfc986404b2720cd06c8930bd78

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
rendering	warning	URL: http://www.todayhotties.ru/s/5af3ff4b5a898?s=123(Line 6) Message: The value "false" for key "user-scalable" is invalid, and has been ignored.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bit.ly
fonts.googleapis.com
fonts.gstatic.com
loja.intebra.com.br
onlinedates.ru
www.todayhotties.ru
162.214.116.103
178.162.199.80
185.36.100.24
2a00:1450:4001:803::200a
2a00:1450:4001:810::2003
67.199.248.11
05410fbe1192a21525520421f6ddce4a065a94658a42146ae707a814926fa77d
13de289b7d770632c2b87d7019cdb10416061bcdb50f07cadcc5e4c6cdf33a36
154fe24e6ac857b898e75eb5618c3633086864454dea0904b309aca04771dd61
2413af09f3729fcccc77052489d69a6469a74f3c4f652c425e289b12121174d1
3e80058e1e64f3e5085e47096d373ae6b74987d494aec75b3f67872706569ef4
52526b07b7efc57565d0169115d44524752d678dc65275175d978cf14ac49b3e
6e1bf43d1d49858aacd5de53b32b551732bca4b2a46b1f808eb6d6d0f2b70c0e
7276788c73c7f7252ff2b133f9e8ef476ff0874723f40c10c40874bc957c7436
76d703389c75e3c1e9946072b1e18f6d61842f77eac3f03cfb366baba8035850
855f62c34d296773b690bcd61d702db042b6085294928d1f7064c022b47d2695
8abe2a77b34ca2d18a92f3c8619e5315bc86526b2cd0a6a5e219c566d39681bb
918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537
fb971c13685acd143b913da3ea0928ee9426695c0482b37f9254046c4a2bb83d

www.todayhotties.ru Open in urlscan Pro 178.162.199.80 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Page Statistics

13 Requests

23 %HTTPS

33 %IPv6

6 Domains

6 Subdomains

4 IPs

3 Countries

447 kBTransfer

446 kBSize

2 Cookies

0 Outgoing links

Page URL History

Redirected requests

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

11 JavaScript Global Variables

2 Cookies

1 Console Messages

Indicators

www.todayhotties.ru Open in urlscan Pro
178.162.199.80 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

13
Requests

23 %
HTTPS

33 %
IPv6

6
Domains

6
Subdomains

4
IPs

3
Countries

447 kB
Transfer

446 kB
Size

2
Cookies

13 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!