urlscan.io logo urlscan.io
SecurityTrails logo

www.todayhotties.ru Open in urlscan Pro
178.162.199.80  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://bit.ly/3LNqroz?4fb61d7f3084bdfdd3034e56eae7d930
Effective URL: http://www.todayhotties.ru/s/5af3ff4b5a898?s=123
Submission: On February 21 via api from BE — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 4 countries across 4 domains to perform 12 HTTP transactions. The main IP is 178.162.199.80, located in Germany and belongs to LEASEWEB-DE-FRA-10, DE. The main domain is www.todayhotties.ru.
This is the only time www.todayhotties.ru was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Porn Scam (Online)

Domain & IP information

IP Address AS Autonomous System
1 1 67.199.248.11 396982 (GOOGLE-PR...)
1 2 200.55.156.187 27725 (Empresa d...)
1 1 185.36.100.24 62403 (DISKGROUP)
11 178.162.199.80 28753 (LEASEWEB-...)
12 2
Apex Domain
Subdomains		 Transfer
11 todayhotties.ru
www.todayhotties.ru
573 KB
2 rimed.cu
dpema.rimed.cu
811 B
1 onlinedates.ru
onlinedates.ru
267 B
1 bit.ly
bit.ly — Cisco Umbrella Rank: 4034
325 B
12 4
Domain Requested by
11 www.todayhotties.ru www.todayhotties.ru
2 dpema.rimed.cu 1 redirects
1 onlinedates.ru 1 redirects
1 bit.ly 1 redirects
12 4

This site contains no links.

Subject Issuer Validity Valid
*.rimed.cu
R3		 2022-02-09 -
2022-05-10		 3 months crt.sh

This page contains 1 frames:

Primary Page: http://www.todayhotties.ru/s/5af3ff4b5a898?s=123
Frame ID: E9E44E65173CCA1FE55BE7EE38AE28EF
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Die beliebtesten Dating-Website des Monats

Page URL History Show full URLs

  1. https://bit.ly/3LNqroz?4fb61d7f3084bdfdd3034e56eae7d930 HTTP 301
    http://dpema.rimed.cu/wp-content/uploads/mailpoet/klephtism/ultraeducationist_besra.html HTTP 301
    https://dpema.rimed.cu/wp-content/uploads/mailpoet/klephtism/ultraeducationist_besra.html Page URL
  2. http://onlinedates.ru/?land=51648 HTTP 302
    http://www.todayhotties.ru/s/5af3ff4b5a898?s=123 Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • /wp-(?:content|includes)/
Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

12
Requests

8 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

2
IPs

4
Countries

574 kB
Transfer

574 kB
Size

3
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://bit.ly/3LNqroz?4fb61d7f3084bdfdd3034e56eae7d930 HTTP 301
    http://dpema.rimed.cu/wp-content/uploads/mailpoet/klephtism/ultraeducationist_besra.html HTTP 301
    https://dpema.rimed.cu/wp-content/uploads/mailpoet/klephtism/ultraeducationist_besra.html Page URL
  2. http://onlinedates.ru/?land=51648 HTTP 302
    http://www.todayhotties.ru/s/5af3ff4b5a898?s=123 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://bit.ly/3LNqroz?4fb61d7f3084bdfdd3034e56eae7d930 HTTP 301
  • http://dpema.rimed.cu/wp-content/uploads/mailpoet/klephtism/ultraeducationist_besra.html HTTP 301
  • https://dpema.rimed.cu/wp-content/uploads/mailpoet/klephtism/ultraeducationist_besra.html

12 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
ultraeducationist_besra.html
dpema.rimed.cu/wp-content/uploads/mailpoet/klephtism/
Redirect Chain
  • https://bit.ly/3LNqroz?4fb61d7f3084bdfdd3034e56eae7d930
  • http://dpema.rimed.cu/wp-content/uploads/mailpoet/klephtism/ultraeducationist_besra.html
  • https://dpema.rimed.cu/wp-content/uploads/mailpoet/klephtism/ultraeducationist_besra.html
104 B
638 B 		Document
General
Check archive.org
Download Go to
Full URL
https://dpema.rimed.cu/wp-content/uploads/mailpoet/klephtism/ultraeducationist_besra.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
200.55.156.187 , Cuba, ASN27725 (Empresa de Telecomunicaciones de Cuba, S.A., CU),
Reverse DNS
free.rimed.cu
Software
Apache /
Resource Hash
3557da7b26e70da3f5ae71522e48a422338ec07c06a6ce2ed388afa2fce8562b
Security Headers
Name Value
Strict-Transport-Security max-age=2592000;
X-Content-Type-Options nosniff;
X-Frame-Options SAMEORIGIN, SAMEORIGIN
X-Xss-Protection 1; mode=block 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

Date
Mon, 21 Feb 2022 21:06:15 GMT
Server
Apache
X-XSS-Protection
1; mode=block 1; mode=block
Strict-Transport-Security
max-age=2592000;
X-Content-Type-Options
nosniff;
X-Frame-Options
SAMEORIGIN, SAMEORIGIN
Upgrade
h2,h2c
Connection
Upgrade, close
Last-Modified
Sun, 20 Feb 2022 09:34:21 GMT
Accept-Ranges
bytes
Vary
Accept-Encoding
Content-Encoding
gzip
Content-Length
112
Content-Type
text/html
Cache-control
private

Redirect headers

Content-length
0
Location
https://dpema.rimed.cu/wp-content/uploads/mailpoet/klephtism/ultraeducationist_besra.html
Connection
close
Primary Request 5af3ff4b5a898
www.todayhotties.ru/s/
Redirect Chain
  • http://onlinedates.ru/?land=51648
  • http://www.todayhotties.ru/s/5af3ff4b5a898?s=123
5 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://www.todayhotties.ru/s/5af3ff4b5a898?s=123
Protocol
HTTP/1.1
Server
178.162.199.80 , Germany, ASN28753 (LEASEWEB-DE-FRA-10, DE),
Reverse DNS
Software
openresty/1.19.3.1 /
Resource Hash
82a548f55d58b3a0a0d0c3de99286d660ca08d2d831d65575de702d078c487ff

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://dpema.rimed.cu/wp-content/uploads/mailpoet/klephtism/ultraeducationist_besra.html

Response headers

Server
openresty/1.19.3.1
Date
Mon, 21 Feb 2022 21:04:21 GMT
Content-Type
text/html; charset=UTF-8
Transfer-Encoding
chunked
Connection
keep-alive
Vary
Accept-Encoding
Content-Encoding
gzip

Redirect headers

Server
nginx
Date
Mon, 21 Feb 2022 21:04:20 GMT
Content-Type
text/html; charset=UTF-8
Content-Length
0
Connection
keep-alive
Keep-Alive
timeout=60
X-Powered-By
PHP/5.6.40
Location
http://www.todayhotties.ru/s/5af3ff4b5a898?s=123
style.css
www.todayhotties.ru/bundle/19/assets/css/ 		50 KB
50 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://www.todayhotties.ru/bundle/19/assets/css/style.css
Requested by
Host: www.todayhotties.ru
URL: http://www.todayhotties.ru/s/5af3ff4b5a898?s=123
Protocol
HTTP/1.1
Server
178.162.199.80 , Germany, ASN28753 (LEASEWEB-DE-FRA-10, DE),
Reverse DNS
Software
openresty/1.19.3.1 /
Resource Hash
bc61625502941dc4c9fbf12a0848178bfbfa79fb8ad1c010271f716673ff3fef

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://www.todayhotties.ru/s/5af3ff4b5a898?s=123
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date
Mon, 21 Feb 2022 21:04:21 GMT
Last-Modified
Wed, 28 Mar 2018 09:34:45 GMT
Server
openresty/1.19.3.1
ETag
"5abb61b5-c8e1"
Vary
Accept-Encoding
Content-Type
text/css
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
51425
jquery-2.2.4.min.js
www.todayhotties.ru/bundle/19/assets/js/ 		84 KB
84 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://www.todayhotties.ru/bundle/19/assets/js/jquery-2.2.4.min.js
Requested by
Host: www.todayhotties.ru
URL: http://www.todayhotties.ru/s/5af3ff4b5a898?s=123
Protocol
HTTP/1.1
Server
178.162.199.80 , Germany, ASN28753 (LEASEWEB-DE-FRA-10, DE),
Reverse DNS
Software
openresty/1.19.3.1 /
Resource Hash
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://www.todayhotties.ru/s/5af3ff4b5a898?s=123
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date
Mon, 21 Feb 2022 21:04:21 GMT
Last-Modified
Wed, 28 Mar 2018 09:34:45 GMT
Server
openresty/1.19.3.1
ETag
"5abb61b5-14e4a"
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
85578
script.min.js
www.todayhotties.ru/bundle/19/assets/js/ 		254 KB
254 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://www.todayhotties.ru/bundle/19/assets/js/script.min.js
Requested by
Host: www.todayhotties.ru
URL: http://www.todayhotties.ru/s/5af3ff4b5a898?s=123
Protocol
HTTP/1.1
Server
178.162.199.80 , Germany, ASN28753 (LEASEWEB-DE-FRA-10, DE),
Reverse DNS
Software
openresty/1.19.3.1 /
Resource Hash
49341eafd7cb8b62ead1ecd2e2ca916c6c55c449ceb45c2c3ca423be00d971b8

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://www.todayhotties.ru/s/5af3ff4b5a898?s=123
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date
Mon, 21 Feb 2022 21:04:21 GMT
Last-Modified
Wed, 28 Mar 2018 09:34:45 GMT
Server
openresty/1.19.3.1
ETag
"5abb61b5-3f619"
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
259609
click.js
www.todayhotties.ru/js/ 		4 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://www.todayhotties.ru/js/click.js
Requested by
Host: www.todayhotties.ru
URL: http://www.todayhotties.ru/s/5af3ff4b5a898?s=123
Protocol
HTTP/1.1
Server
178.162.199.80 , Germany, ASN28753 (LEASEWEB-DE-FRA-10, DE),
Reverse DNS
Software
openresty/1.19.3.1 /
Resource Hash
8abe2a77b34ca2d18a92f3c8619e5315bc86526b2cd0a6a5e219c566d39681bb

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://www.todayhotties.ru/s/5af3ff4b5a898?s=123
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date
Mon, 21 Feb 2022 21:04:21 GMT
Last-Modified
Mon, 07 Feb 2022 14:58:49 GMT
Server
openresty/1.19.3.1
ETag
"620133a9-109f"
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
4255
logo.png
www.todayhotties.ru/bundle/19/assets/img/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://www.todayhotties.ru/bundle/19/assets/img/logo.png
Requested by
Host: www.todayhotties.ru
URL: http://www.todayhotties.ru/s/5af3ff4b5a898?s=123
Protocol
HTTP/1.1
Server
178.162.199.80 , Germany, ASN28753 (LEASEWEB-DE-FRA-10, DE),
Reverse DNS
Software
openresty/1.19.3.1 /
Resource Hash
3f68f0782d363750744f67d981d9c32c6244e71e23293ec8d17bdcb0b36945c2

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://www.todayhotties.ru/s/5af3ff4b5a898?s=123
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date
Mon, 21 Feb 2022 21:04:21 GMT
Last-Modified
Wed, 28 Mar 2018 09:34:45 GMT
Server
openresty/1.19.3.1
ETag
"5abb61b5-4ea"
Content-Type
image/png
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1258
bg.jpg
www.todayhotties.ru/bundle/19/assets/img/ 		101 KB
101 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://www.todayhotties.ru/bundle/19/assets/img/bg.jpg
Requested by
Host: www.todayhotties.ru
URL: http://www.todayhotties.ru/bundle/19/assets/css/style.css
Protocol
HTTP/1.1
Server
178.162.199.80 , Germany, ASN28753 (LEASEWEB-DE-FRA-10, DE),
Reverse DNS
Software
openresty/1.19.3.1 /
Resource Hash
408b7f5fdce3b7f93fdba3bcb4e47f6e64e70a15c02d38879b6297e9d7cb9e45

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://www.todayhotties.ru/bundle/19/assets/css/style.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date
Mon, 21 Feb 2022 21:04:21 GMT
Last-Modified
Wed, 28 Mar 2018 09:34:45 GMT
Server
openresty/1.19.3.1
ETag
"5abb61b5-19375"
Content-Type
image/jpeg
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
103285
1.jpg
www.todayhotties.ru/bundle/19/assets/img/ 		17 KB
17 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://www.todayhotties.ru/bundle/19/assets/img/1.jpg
Requested by
Host: www.todayhotties.ru
URL: http://www.todayhotties.ru/bundle/19/assets/css/style.css
Protocol
HTTP/1.1
Server
178.162.199.80 , Germany, ASN28753 (LEASEWEB-DE-FRA-10, DE),
Reverse DNS
Software
openresty/1.19.3.1 /
Resource Hash
d23157cff1e15192fb85ef456dad32c54b0e34d85235822005207517facbda38

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://www.todayhotties.ru/bundle/19/assets/css/style.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date
Mon, 21 Feb 2022 21:04:21 GMT
Last-Modified
Wed, 28 Mar 2018 09:34:45 GMT
Server
openresty/1.19.3.1
ETag
"5abb61b5-4227"
Content-Type
image/jpeg
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
16935
2.jpg
www.todayhotties.ru/bundle/19/assets/img/ 		12 KB
13 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://www.todayhotties.ru/bundle/19/assets/img/2.jpg
Requested by
Host: www.todayhotties.ru
URL: http://www.todayhotties.ru/bundle/19/assets/css/style.css
Protocol
HTTP/1.1
Server
178.162.199.80 , Germany, ASN28753 (LEASEWEB-DE-FRA-10, DE),
Reverse DNS
Software
openresty/1.19.3.1 /
Resource Hash
df33173c7d5d08e9ce01490ffcea6df05910654dad4b04443eb0a6276dce3092

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://www.todayhotties.ru/bundle/19/assets/css/style.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date
Mon, 21 Feb 2022 21:04:21 GMT
Last-Modified
Wed, 28 Mar 2018 09:34:45 GMT
Server
openresty/1.19.3.1
ETag
"5abb61b5-31c2"
Content-Type
image/jpeg
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
12738
3.jpg
www.todayhotties.ru/bundle/19/assets/img/ 		16 KB
17 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://www.todayhotties.ru/bundle/19/assets/img/3.jpg
Requested by
Host: www.todayhotties.ru
URL: http://www.todayhotties.ru/bundle/19/assets/css/style.css
Protocol
HTTP/1.1
Server
178.162.199.80 , Germany, ASN28753 (LEASEWEB-DE-FRA-10, DE),
Reverse DNS
Software
openresty/1.19.3.1 /
Resource Hash
91bc529d2329ad04e61d303f0408524469340da5f78216f57075c3b20950e47f

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://www.todayhotties.ru/bundle/19/assets/css/style.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date
Mon, 21 Feb 2022 21:04:21 GMT
Last-Modified
Wed, 28 Mar 2018 09:34:45 GMT
Server
openresty/1.19.3.1
ETag
"5abb61b5-41e9"
Content-Type
image/jpeg
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
16873
fp2.min.js
www.todayhotties.ru/js/ 		30 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://www.todayhotties.ru/js/fp2.min.js
Requested by
Host: www.todayhotties.ru
URL: http://www.todayhotties.ru/js/click.js
Protocol
HTTP/1.1
Server
178.162.199.80 , Germany, ASN28753 (LEASEWEB-DE-FRA-10, DE),
Reverse DNS
Software
openresty/1.19.3.1 /
Resource Hash
6e1bf43d1d49858aacd5de53b32b551732bca4b2a46b1f808eb6d6d0f2b70c0e

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://www.todayhotties.ru/s/5af3ff4b5a898
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date
Mon, 21 Feb 2022 21:04:22 GMT
Last-Modified
Mon, 07 Feb 2022 14:58:49 GMT
Server
openresty/1.19.3.1
ETag
"620133a9-77dd"
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
30685

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Porn Scam (Online)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| structuredClone function| $ function| jQuery string| fpDataEncoded function| fingerprintGo function| closingConfirm function| handleError function| getParameterByName function| Fingerprint2

3 Cookies

Domain/Path Name / Value
.bit.ly/ Name: _bit
Value: m1ll4i-e916a7f01d78e428c8-00X
dpema.rimed.cu/ Name: SERVERID
Value: Server2
.todayhotties.ru/ Name: SID
Value: b07460ec8cece627666147055ed0bc00

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=2592000;
X-Content-Type-Options nosniff;
X-Frame-Options SAMEORIGIN, SAMEORIGIN
X-Xss-Protection 1; mode=block 1; mode=block