www.todayhotties.ru Open in urlscan Pro
178.162.199.80 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://bit.ly/3wGmNak?65fa0ad810d218df13e9c569b2ab9f5e
Effective URL:
http://www.todayhotties.ru/s/5af3ff4b5a866
Submission: On September 12 via api (September 12th 2022, 12:17:48 am UTC) from BE — Scanned from DE

Summary HTTP 9 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 4 countries across 4 domains to perform 9 HTTP transactions. The main IP is 178.162.199.80, located in Cologne, Germany and belongs to LEASEWEB-DE-FRA-10, DE. The main domain is www.todayhotties.ru. The Cisco Umbrella rank of the primary domain is 911643.

This is the only time www.todayhotties.ru was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Scam (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 1	67.199.248.11 67.199.248.11	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	2a03:6f00:6:1... 2a03:6f00:6:1::517:3364	9123 (TIMEWEB-AS) (TIMEWEB-AS)
1 1	185.36.100.24 185.36.100.24	62403 (GO4CLOUD) (GO4CLOUD)
8	178.162.199.80 178.162.199.80	28753 (LEASEWEB-...) (LEASEWEB-DE-FRA-10)
9	2

1 67.199.248.11 (United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: bit.ly

bit.ly	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:6f00:6:1::517:3364 (Russian Federation)

ASN9123 (TIMEWEB-AS, RU)

multiki-rki.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.36.100.24 (Haarlem, Netherlands) 1 redirects

ASN62403 (GO4CLOUD, VG)

onlinedates.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 178.162.199.80 (Cologne, Germany)

ASN28753 (LEASEWEB-DE-FRA-10, DE)

www.todayhotties.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	todayhotties.ru www.todayhotties.ru — Cisco Umbrella Rank: 911643	490 KB
1	onlinedates.ru 1 redirects onlinedates.ru	261 B
1	multiki-rki.ru multiki-rki.ru	361 B
1	bit.ly 1 redirects bit.ly — Cisco Umbrella Rank: 4581	269 B
9	4

	Domain	Requested by
8	www.todayhotties.ru	www.todayhotties.ru
1	onlinedates.ru	1 redirects
1	multiki-rki.ru
1	bit.ly	1 redirects
9	4

This site contains no links.

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://www.todayhotties.ru/s/5af3ff4b5a866
Frame ID: B376CA275353D86034E9F3FBC7474A26
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

der Internet-Anschluss

Page URL History Show full URLs

https://bit.ly/3wGmNak?65fa0ad810d218df13e9c569b2ab9f5e HTTP 301
http://multiki-rki.ru/wp-includes/images/media/procompetition/uprestore_Erinize.html Page URL
http://onlinedates.ru/?land=35099 HTTP 302
http://www.todayhotties.ru/s/5af3ff4b5a866 Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

9
Requests

0 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

2
IPs

4
Countries

491 kB
Transfer

495 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://bit.ly/3wGmNak?65fa0ad810d218df13e9c569b2ab9f5e HTTP 301
http://multiki-rki.ru/wp-includes/images/media/procompetition/uprestore_Erinize.html Page URL
http://onlinedates.ru/?land=35099 HTTP 302
http://www.todayhotties.ru/s/5af3ff4b5a866 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://bit.ly/3wGmNak?65fa0ad810d218df13e9c569b2ab9f5e HTTP 301
http://multiki-rki.ru/wp-includes/images/media/procompetition/uprestore_Erinize.html

9 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	uprestore_Erinize.html Show response multiki-rki.ru/wp-includes/images/media/procompetition/ Redirect Chain https://bit.ly/3wGmNak?65fa0ad810d218df13e9c569b2ab9f5e http://multiki-rki.ru/wp-includes/images/media/procompetition/uprestore_Erinize.html	104 B 361 B	296ms 60ms	Document text/html	2a03:6f00:6:1::517:3364 TIMEWEB-AS
General Check archive.org Show headers Download Go to Full URL http://multiki-rki.ru/wp-includes/images/media/procompetition/uprestore_Erinize.html Protocol HTTP/1.1 Server 2a03:6f00:6:1::517:3364 , Russian Federation, ASN9123 (TIMEWEB-AS, RU), Reverse DNS Software nginx/1.20.2 / Resource Hash `963603faf966a5095882d586846086390928f5d854af7edcb1d4ef5f2843ad9d` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Accept-Ranges bytes Connection keep-alive Content-Length 104 Content-Type text/html; charset=utf-8 Date Mon, 12 Sep 2022 00:17:42 GMT ETag "68-5e23c09453940" Last-Modified Sat, 25 Jun 2022 01:59:25 GMT Server nginx/1.20.2 Redirect headers alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 cache-control private, max-age=90 content-length 171 content-type text/html; charset=utf-8 date Mon, 12 Sep 2022 00:17:42 GMT location http://multiki-rki.ru/wp-includes/images/media/procompetition/uprestore_Erinize.html server nginx via 1.1 google
GET H/1.1	200 OK	Primary Request 5af3ff4b5a866 Show response www.todayhotties.ru/s/ Redirect Chain http://onlinedates.ru/?land=35099 http://www.todayhotties.ru/s/5af3ff4b5a866	9 KB 3 KB	695ms 376ms	Document text/html	178.162.199.80 LEASEWEB-DE-FRA-10
General Check archive.org Show headers Download Go to Full URL http://www.todayhotties.ru/s/5af3ff4b5a866 Protocol HTTP/1.1 Server 178.162.199.80 Cologne, Germany, ASN28753 (LEASEWEB-DE-FRA-10, DE), Reverse DNS Software openresty/1.19.3.1 / Resource Hash `569d7bb41323e87fa1038e37e7a746606deb4d4feff3d8c44a1bde8c2d832fdd` Request headers Referer http://multiki-rki.ru/wp-includes/images/media/procompetition/uprestore_Erinize.html Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Connection keep-alive Content-Encoding gzip Content-Type text/html; charset=UTF-8 Date Mon, 12 Sep 2022 00:17:43 GMT Server openresty/1.19.3.1 Transfer-Encoding chunked Vary Accept-Encoding Redirect headers Connection keep-alive Content-Length 0 Content-Type text/html; charset=UTF-8 Date Mon, 12 Sep 2022 00:17:42 GMT Keep-Alive timeout=60 Location http://www.todayhotties.ru/s/5af3ff4b5a866 Server nginx X-Powered-By PHP/5.6.40
GET H/1.1	200 OK	font-awesome.css www.todayhotties.ru/bundle/4/assets/css/	26 KB 26 KB	17ms 13ms	Stylesheet text/css	178.162.199.80 LEASEWEB-DE-FRA-10
General Check archive.org Show headers Download Go to Full URL http://www.todayhotties.ru/bundle/4/assets/css/font-awesome.css Requested by Host: www.todayhotties.ru URL: http://www.todayhotties.ru/s/5af3ff4b5a866 Protocol HTTP/1.1 Server 178.162.199.80 Cologne, Germany, ASN28753 (LEASEWEB-DE-FRA-10, DE), Reverse DNS Software openresty/1.19.3.1 / Resource Hash `d20b06d72585a42c2facc26bf6fb9b15c155c2bd73e466e24405bdf90cab7172` Request headers accept-language de-DE,de;q=0.9 Referer http://www.todayhotties.ru/s/5af3ff4b5a866 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers Date Mon, 12 Sep 2022 00:17:43 GMT Last-Modified Sun, 25 Feb 2018 11:06:37 GMT Server openresty/1.19.3.1 ETag "5a9298bd-6845" Vary Accept-Encoding Content-Type text/css Connection keep-alive Accept-Ranges bytes Content-Length 26693
GET H/1.1	200 OK	css.css www.todayhotties.ru/bundle/4/assets/css/	2 KB 3 KB	32ms 13ms	Stylesheet text/css	178.162.199.80 LEASEWEB-DE-FRA-10
General Check archive.org Show headers Download Go to Full URL http://www.todayhotties.ru/bundle/4/assets/css/css.css Requested by Host: www.todayhotties.ru URL: http://www.todayhotties.ru/s/5af3ff4b5a866 Protocol HTTP/1.1 Server 178.162.199.80 Cologne, Germany, ASN28753 (LEASEWEB-DE-FRA-10, DE), Reverse DNS Software openresty/1.19.3.1 / Resource Hash `150c1ca57f6f6e5e26725950acab9bb6a9dffedeead12dfcd329344a8fd57a5b` Request headers accept-language de-DE,de;q=0.9 Referer http://www.todayhotties.ru/s/5af3ff4b5a866 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers Date Mon, 12 Sep 2022 00:17:43 GMT Last-Modified Sun, 25 Feb 2018 11:06:37 GMT Server openresty/1.19.3.1 ETag "5a9298bd-8ff" Vary Accept-Encoding Content-Type text/css Connection keep-alive Accept-Ranges bytes Content-Length 2303
GET H/1.1	200 OK	jquery-2.js Show response www.todayhotties.ru/bundle/4/assets/js/	84 KB 84 KB	30ms 13ms	Script application/javascript	178.162.199.80 LEASEWEB-DE-FRA-10
General Check archive.org Show headers Download Go to Full URL http://www.todayhotties.ru/bundle/4/assets/js/jquery-2.js Requested by Host: www.todayhotties.ru URL: http://www.todayhotties.ru/s/5af3ff4b5a866 Protocol HTTP/1.1 Server 178.162.199.80 Cologne, Germany, ASN28753 (LEASEWEB-DE-FRA-10, DE), Reverse DNS Software openresty/1.19.3.1 / Resource Hash `05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e` Request headers Referer http://www.todayhotties.ru/s/5af3ff4b5a866 Origin http://www.todayhotties.ru accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers Date Mon, 12 Sep 2022 00:17:43 GMT Last-Modified Sun, 25 Feb 2018 11:06:37 GMT Server openresty/1.19.3.1 ETag "5a9298bd-14e4a" Vary Accept-Encoding Content-Type application/javascript Connection keep-alive Accept-Ranges bytes Content-Length 85578
GET H/1.1	200 OK	js.js Show response www.todayhotties.ru/bundle/4/assets/js/	1 KB 1 KB	30ms 14ms	Script application/javascript	178.162.199.80 LEASEWEB-DE-FRA-10
General Check archive.org Show headers Download Go to Full URL http://www.todayhotties.ru/bundle/4/assets/js/js.js Requested by Host: www.todayhotties.ru URL: http://www.todayhotties.ru/s/5af3ff4b5a866 Protocol HTTP/1.1 Server 178.162.199.80 Cologne, Germany, ASN28753 (LEASEWEB-DE-FRA-10, DE), Reverse DNS Software openresty/1.19.3.1 / Resource Hash `874c4caed753f9aac0999abd80227f190ce106720436e01ffaa12b7f66ac5193` Request headers accept-language de-DE,de;q=0.9 Referer http://www.todayhotties.ru/s/5af3ff4b5a866 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers Date Mon, 12 Sep 2022 00:17:43 GMT Last-Modified Sun, 25 Feb 2018 11:06:37 GMT Server openresty/1.19.3.1 ETag "5a9298bd-45c" Vary Accept-Encoding Content-Type application/javascript Connection keep-alive Accept-Ranges bytes Content-Length 1116
GET H/1.1	200 OK	click.js Show response www.todayhotties.ru/js/	5 KB 5 KB	39ms 38ms	Script application/javascript	178.162.199.80 LEASEWEB-DE-FRA-10
General Check archive.org Show headers Download Go to Full URL http://www.todayhotties.ru/js/click.js?2 Requested by Host: www.todayhotties.ru URL: http://www.todayhotties.ru/s/5af3ff4b5a866 Protocol HTTP/1.1 Server 178.162.199.80 Cologne, Germany, ASN28753 (LEASEWEB-DE-FRA-10, DE), Reverse DNS Software openresty/1.19.3.1 / Resource Hash `77123007bc08642e539cef883548f19653f8d6e86c0efca325ce34b5fd8fc09c` Request headers accept-language de-DE,de;q=0.9 Referer http://www.todayhotties.ru/s/5af3ff4b5a866 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers Date Mon, 12 Sep 2022 00:17:43 GMT Last-Modified Thu, 01 Sep 2022 07:53:33 GMT Server openresty/1.19.3.1 ETag "631064fd-13a3" Vary Accept-Encoding Content-Type application/javascript Connection keep-alive Accept-Ranges bytes Content-Length 5027
GET H/1.1	200 OK	body.jpg www.todayhotties.ru/bundle/4/assets/img/	338 KB 338 KB	13ms 13ms	Image image/jpeg	178.162.199.80 LEASEWEB-DE-FRA-10
General Check archive.org Show headers Download Go to Show image Full URL http://www.todayhotties.ru/bundle/4/assets/img/body.jpg Requested by Host: www.todayhotties.ru URL: http://www.todayhotties.ru/bundle/4/assets/css/css.css Protocol HTTP/1.1 Server 178.162.199.80 Cologne, Germany, ASN28753 (LEASEWEB-DE-FRA-10, DE), Reverse DNS Software openresty/1.19.3.1 / Resource Hash `a97b3a6a51a87af2cf849ac895c62960a6a15e0c41e6b9a4b4316aac4a3f7d24` Request headers accept-language de-DE,de;q=0.9 Referer http://www.todayhotties.ru/bundle/4/assets/css/css.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers Date Mon, 12 Sep 2022 00:17:43 GMT Last-Modified Sun, 25 Feb 2018 11:06:37 GMT Server openresty/1.19.3.1 ETag "5a9298bd-54747" Content-Type image/jpeg Connection keep-alive Accept-Ranges bytes Content-Length 345927
GET H/1.1	200 OK	fp2.min.js Show response www.todayhotties.ru/js/	30 KB 30 KB	71ms 71ms	Script application/javascript	178.162.199.80 LEASEWEB-DE-FRA-10
General Check archive.org Show headers Download Go to Full URL http://www.todayhotties.ru/js/fp2.min.js Requested by Host: www.todayhotties.ru URL: http://www.todayhotties.ru/js/click.js?2 Protocol HTTP/1.1 Server 178.162.199.80 Cologne, Germany, ASN28753 (LEASEWEB-DE-FRA-10, DE), Reverse DNS Software openresty/1.19.3.1 / Resource Hash `6e1bf43d1d49858aacd5de53b32b551732bca4b2a46b1f808eb6d6d0f2b70c0e` Request headers accept-language de-DE,de;q=0.9 Referer http://www.todayhotties.ru/s/5af3ff4b5a866 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers Date Mon, 12 Sep 2022 00:17:43 GMT Last-Modified Thu, 01 Sep 2022 07:53:33 GMT Server openresty/1.19.3.1 ETag "631064fd-77dd" Vary Accept-Encoding Content-Type application/javascript Connection keep-alive Accept-Ranges bytes Content-Length 30685

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Scam (Online)

17 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.bit.ly/	1970-01-20 10:14:53	Name: _bit Value: m8c0hG-0bcff8cee575ea8a45-00s
			.todayhotties.ru/	1970-01-20 15:31:41	Name: SID Value: 39b49ae2f536c75f708a52af68d3a14c

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
rendering	warning	URL: http://www.todayhotties.ru/s/5af3ff4b5a866(Line 7) Message: The value "false" for key "user-scalable" is invalid, and has been ignored.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bit.ly
multiki-rki.ru
onlinedates.ru
www.todayhotties.ru
178.162.199.80
185.36.100.24
2a03:6f00:6:1::517:3364
67.199.248.11
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
150c1ca57f6f6e5e26725950acab9bb6a9dffedeead12dfcd329344a8fd57a5b
569d7bb41323e87fa1038e37e7a746606deb4d4feff3d8c44a1bde8c2d832fdd
6e1bf43d1d49858aacd5de53b32b551732bca4b2a46b1f808eb6d6d0f2b70c0e
77123007bc08642e539cef883548f19653f8d6e86c0efca325ce34b5fd8fc09c
874c4caed753f9aac0999abd80227f190ce106720436e01ffaa12b7f66ac5193
963603faf966a5095882d586846086390928f5d854af7edcb1d4ef5f2843ad9d
a97b3a6a51a87af2cf849ac895c62960a6a15e0c41e6b9a4b4316aac4a3f7d24
d20b06d72585a42c2facc26bf6fb9b15c155c2bd73e466e24405bdf90cab7172

www.todayhotties.ru Open in urlscan Pro 178.162.199.80 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

9 Requests

0 %HTTPS

25 %IPv6

4 Domains

4 Subdomains

2 IPs

4 Countries

491 kBTransfer

495 kBSize

2 Cookies

0 Outgoing links

Page URL History

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

17 JavaScript Global Variables

2 Cookies

1 Console Messages

Indicators

www.todayhotties.ru Open in urlscan Pro
178.162.199.80 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

0 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

2
IPs

4
Countries

491 kB
Transfer

495 kB
Size

2
Cookies

9 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!