cehdii.naughtymets.com Open in urlscan Pro
5.104.107.248 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://joselynjayla.ruyii.xyz/82ed65025bbd216194b5526ec8956dce
Effective URL:
https://cehdii.naughtymets.com/s/5e45720035298?track=KORBAN_THREADS
Submission: On January 08 via api (January 8th 2025, 6:04:36 am UTC) from US — Scanned from FR

Summary HTTP 13 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 13 HTTP transactions. The main IP is 5.104.107.248, located in Düsseldorf, Germany and belongs to MYLOC-AS WIIT AG, DE. The main domain is cehdii.naughtymets.com.
TLS certificate: Issued by R10 on December 21st 2024. Valid for: 3 months.

This is the only time cehdii.naughtymets.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Porn Scam (Online)

Domain & IP information

	IP Address	AS Autonomous System
1	68.66.226.117 68.66.226.117	55293 (A2HOSTING) (A2HOSTING)
10	5.104.107.248 5.104.107.248	24961 (MYLOC-AS ...) (MYLOC-AS WIIT AG)
1	2a00:1450:400... 2a00:1450:4001:808::200a	15169 (GOOGLE) (GOOGLE)
1	142.250.186.35 142.250.186.35	15169 (GOOGLE) (GOOGLE)
13	4

1 68.66.226.117 (United States)

ASN55293 (A2HOSTING, US)
PTR: az1-ts101.a2hosting.com

joselynjayla.ruyii.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 5.104.107.248 (Düsseldorf, Germany)

ASN24961 (MYLOC-AS WIIT AG, DE)
PTR: srv11409.dus4.dedicated.server-hosting.expert

cehdii.naughtymets.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:808::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.186.35 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s04-in-f3.1e100.net

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	naughtymets.com cehdii.naughtymets.com	199 KB
1	gstatic.com fonts.gstatic.com	23 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 29	838 B
1	ruyii.xyz joselynjayla.ruyii.xyz	806 B
13	4

	Domain	Requested by
10	cehdii.naughtymets.com	joselynjayla.ruyii.xyz cehdii.naughtymets.com
1	fonts.gstatic.com	fonts.googleapis.com
1	fonts.googleapis.com	cehdii.naughtymets.com
1	joselynjayla.ruyii.xyz
13	4

This site contains no links.

Subject Issuer	Validity	Valid
*.ruyii.xyz R10	`2024-12-16` - `2025-03-16`	3 months	crt.sh
naughtymets.com R10	`2024-12-21` - `2025-03-21`	3 months	crt.sh
upload.video.google.com WR2	`2024-12-09` - `2025-03-03`	3 months	crt.sh
*.gstatic.com WR2	`2024-12-09` - `2025-03-03`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://cehdii.naughtymets.com/s/5e45720035298?track=KORBAN_THREADS
Frame ID: 966B8AD1B1B35146382FF9B699B33EAE
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Le site de rencontres le plus populaire de ce mois-ci

Page URL History Show full URLs

https://joselynjayla.ruyii.xyz/82ed65025bbd216194b5526ec8956dce Page URL
https://cehdii.naughtymets.com/s/5e45720035298?track=KORBAN_THREADS Page URL

Detected technologies

animate.css (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link [^>]+(?:/([\d.]+)/)?animate\.(?:min\.)?css

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

13
Requests

100 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

224 kB
Transfer

525 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://joselynjayla.ruyii.xyz/82ed65025bbd216194b5526ec8956dce Page URL
https://cehdii.naughtymets.com/s/5e45720035298?track=KORBAN_THREADS Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 82ed65025bbd216194b5526ec8956dce
joselynjayla.ruyii.xyz/ 1 KB
806 B 1341ms
909ms Document
text/html 68.66.226.117
A2HOSTING

General

Check archive.org

Show headers Download Go to

Full URL

https://joselynjayla.ruyii.xyz/82ed65025bbd216194b5526ec8956dce

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

68.66.226.117 , United States, ASN55293 (A2HOSTING, US),

Reverse DNS

az1-ts101.a2hosting.com

Software

LiteSpeed / PHP/7.4.33

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
cache-control: no-cache
content-encoding: br
content-length: 446
content-type: text/html; charset=UTF-8
date: Wed, 08 Jan 2025 06:04:29 GMT
pragma: no-cache
server: LiteSpeed
strict-transport-security: max-age=63072000; includeSubDomains
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-powered-by: PHP/7.4.33

GET
H2 200 Primary Request 5e45720035298 Show response
cehdii.naughtymets.com/s/ 41 KB
17 KB 584ms
146ms Document
text/html 5.104.107.248
MYLOC-AS WIIT AG

General

Check archive.org

Show headers Download Go to

Full URL: https://cehdii.naughtymets.com/s/5e45720035298?track=KORBAN_THREADS
Requested by: Host: joselynjayla.ruyii.xyz
URL: https://joselynjayla.ruyii.xyz/82ed65025bbd216194b5526ec8956dce
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 5.104.107.248 Düsseldorf, Germany, ASN24961 (MYLOC-AS WIIT AG, DE),
Reverse DNS: srv11409.dus4.dedicated.server-hosting.expert
Software: openresty /
Resource Hash: bb51ed9f3911c06649c716f301c15e0ce918218b1d5049f6d435896b2574274b

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

cache-control: must-revalidate, no-cache, no-store, private
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Wed, 08 Jan 2025 06:04:29 GMT
expires: 0
pragma: no-cache
server: openresty
vary: Accept-Encoding

GET
H2 200 animate.min.css
cehdii.naughtymets.com/bundle/16/assets/css/ 52 KB
5 KB 31ms
30ms Stylesheet
text/css 5.104.107.248
MYLOC-AS WIIT AG

General

Check archive.org

Show headers Download Go to

Full URL: https://cehdii.naughtymets.com/bundle/16/assets/css/animate.min.css
Requested by: Host: cehdii.naughtymets.com
URL: https://cehdii.naughtymets.com/s/5e45720035298?track=KORBAN_THREADS
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 5.104.107.248 Düsseldorf, Germany, ASN24961 (MYLOC-AS WIIT AG, DE),
Reverse DNS: srv11409.dus4.dedicated.server-hosting.expert
Software: openresty /
Resource Hash: 8fe3fa119255adb5e0c12479331f9e092e85bcff56ab6ecc0510bfa2056b898d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://cehdii.naughtymets.com/s/5e45720035298?track=KORBAN_THREADS

Response headers

cache-control: max-age=2592000
content-encoding: gzip
etag: W/"5abb60c6-ce35"
expires: Fri, 07 Feb 2025 06:04:30 GMT
date: Wed, 08 Jan 2025 06:04:30 GMT
content-type: text/css
vary: Accept-Encoding
server: openresty
last-modified: Wed, 28 Mar 2018 09:30:46 GMT

GET
H2 200 style.css
cehdii.naughtymets.com/bundle/16/assets/css/ 15 KB
3 KB 33ms
32ms Stylesheet
text/css 5.104.107.248
MYLOC-AS WIIT AG

General

Check archive.org

Show headers Download Go to

Full URL: https://cehdii.naughtymets.com/bundle/16/assets/css/style.css
Requested by: Host: cehdii.naughtymets.com
URL: https://cehdii.naughtymets.com/s/5e45720035298?track=KORBAN_THREADS
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 5.104.107.248 Düsseldorf, Germany, ASN24961 (MYLOC-AS WIIT AG, DE),
Reverse DNS: srv11409.dus4.dedicated.server-hosting.expert
Software: openresty /
Resource Hash: 3fa7cbd6ccb0e62abc11ba89609c6cdd73aaa458973ae65b7d590830475ff261

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://cehdii.naughtymets.com/s/5e45720035298?track=KORBAN_THREADS

Response headers

cache-control: max-age=2592000
content-encoding: gzip
etag: W/"5abb60c6-3a04"
expires: Fri, 07 Feb 2025 06:04:30 GMT
date: Wed, 08 Jan 2025 06:04:30 GMT
content-type: text/css
vary: Accept-Encoding
server: openresty
last-modified: Wed, 28 Mar 2018 09:30:46 GMT

GET
H2 200 jquery-2.2.4.min.js Show response
cehdii.naughtymets.com/bundle/16/assets/js/ 84 KB
32 KB 34ms
33ms Script
application/javascript 5.104.107.248
MYLOC-AS WIIT AG

General

Check archive.org

Show headers Download Go to

Full URL: https://cehdii.naughtymets.com/bundle/16/assets/js/jquery-2.2.4.min.js
Requested by: Host: cehdii.naughtymets.com
URL: https://cehdii.naughtymets.com/s/5e45720035298?track=KORBAN_THREADS
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 5.104.107.248 Düsseldorf, Germany, ASN24961 (MYLOC-AS WIIT AG, DE),
Reverse DNS: srv11409.dus4.dedicated.server-hosting.expert
Software: openresty /
Resource Hash: 05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://cehdii.naughtymets.com/s/5e45720035298?track=KORBAN_THREADS

Response headers

cache-control: max-age=2592000
content-encoding: gzip
etag: W/"5abb60c6-14e4a"
expires: Fri, 07 Feb 2025 06:04:30 GMT
date: Wed, 08 Jan 2025 06:04:30 GMT
content-type: application/javascript
vary: Accept-Encoding
server: openresty
last-modified: Wed, 28 Mar 2018 09:30:46 GMT

GET
H2 200 script.min.js Show response
cehdii.naughtymets.com/bundle/16/assets/js/ 252 KB
84 KB 62ms
62ms Script
application/javascript 5.104.107.248
MYLOC-AS WIIT AG

General

Check archive.org

Show headers Download Go to

Full URL: https://cehdii.naughtymets.com/bundle/16/assets/js/script.min.js
Requested by: Host: cehdii.naughtymets.com
URL: https://cehdii.naughtymets.com/s/5e45720035298?track=KORBAN_THREADS
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 5.104.107.248 Düsseldorf, Germany, ASN24961 (MYLOC-AS WIIT AG, DE),
Reverse DNS: srv11409.dus4.dedicated.server-hosting.expert
Software: openresty /
Resource Hash: 76d703389c75e3c1e9946072b1e18f6d61842f77eac3f03cfb366baba8035850

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://cehdii.naughtymets.com/s/5e45720035298?track=KORBAN_THREADS

Response headers

cache-control: max-age=2592000
content-encoding: gzip
etag: W/"5abb60c6-3f0a5"
expires: Fri, 07 Feb 2025 06:04:30 GMT
date: Wed, 08 Jan 2025 06:04:30 GMT
content-type: application/javascript
vary: Accept-Encoding
server: openresty
last-modified: Wed, 28 Mar 2018 09:30:46 GMT

GET
H2 200 css
fonts.googleapis.com/ 774 B
838 B 88ms
32ms Stylesheet
text/css 2a00:1450:4001:808::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Lato&subset=latin-ext

Requested by

Host: cehdii.naughtymets.com
URL: https://cehdii.naughtymets.com/bundle/16/assets/css/style.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

52d62465d244bef9c22960bed269d931eb2b705dff7f09a0bcf5ddba62554f45

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://cehdii.naughtymets.com/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Wed, 08 Jan 2025 06:04:30 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 08 Jan 2025 06:04:30 GMT
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified: Wed, 08 Jan 2025 06:04:30 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H2 200 no.png
cehdii.naughtymets.com/bundle/16/assets/img/ 322 B
492 B 36ms
35ms Image
image/png 5.104.107.248
MYLOC-AS WIIT AG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cehdii.naughtymets.com/bundle/16/assets/img/no.png
Requested by: Host: cehdii.naughtymets.com
URL: https://cehdii.naughtymets.com/bundle/16/assets/css/style.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 5.104.107.248 Düsseldorf, Germany, ASN24961 (MYLOC-AS WIIT AG, DE),
Reverse DNS: srv11409.dus4.dedicated.server-hosting.expert
Software: openresty /
Resource Hash: 855f62c34d296773b690bcd61d702db042b6085294928d1f7064c022b47d2695

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://cehdii.naughtymets.com/bundle/16/assets/css/style.css

Response headers

cache-control: max-age=2592000
etag: "5abb60c6-142"
expires: Fri, 07 Feb 2025 06:04:30 GMT
content-length: 322
date: Wed, 08 Jan 2025 06:04:30 GMT
content-type: image/png
last-modified: Wed, 28 Mar 2018 09:30:46 GMT
server: openresty

GET
H2 200 yes.png
cehdii.naughtymets.com/bundle/16/assets/img/ 594 B
764 B 37ms
36ms Image
image/png 5.104.107.248
MYLOC-AS WIIT AG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cehdii.naughtymets.com/bundle/16/assets/img/yes.png
Requested by: Host: cehdii.naughtymets.com
URL: https://cehdii.naughtymets.com/bundle/16/assets/css/style.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 5.104.107.248 Düsseldorf, Germany, ASN24961 (MYLOC-AS WIIT AG, DE),
Reverse DNS: srv11409.dus4.dedicated.server-hosting.expert
Software: openresty /
Resource Hash: 3e80058e1e64f3e5085e47096d373ae6b74987d494aec75b3f67872706569ef4

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://cehdii.naughtymets.com/bundle/16/assets/css/style.css

Response headers

cache-control: max-age=2592000
etag: "5abb60c6-252"
expires: Fri, 07 Feb 2025 06:04:30 GMT
content-length: 594
date: Wed, 08 Jan 2025 06:04:30 GMT
content-type: image/png
last-modified: Wed, 28 Mar 2018 09:30:46 GMT
server: openresty

GET
H2 200 1.jpg
cehdii.naughtymets.com/bundle/16/assets/img/ 55 KB
55 KB 38ms
38ms Image
image/jpeg 5.104.107.248
MYLOC-AS WIIT AG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cehdii.naughtymets.com/bundle/16/assets/img/1.jpg
Requested by: Host: cehdii.naughtymets.com
URL: https://cehdii.naughtymets.com/bundle/16/assets/css/style.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 5.104.107.248 Düsseldorf, Germany, ASN24961 (MYLOC-AS WIIT AG, DE),
Reverse DNS: srv11409.dus4.dedicated.server-hosting.expert
Software: openresty /
Resource Hash: a88f88462c0343bc65173e05743424a0894478ce81f27d1a02af664b278f9700

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://cehdii.naughtymets.com/bundle/16/assets/css/style.css

Response headers

cache-control: max-age=2592000
etag: "5abb60c6-dbde"
expires: Fri, 07 Feb 2025 06:04:30 GMT
content-length: 56286
date: Wed, 08 Jan 2025 06:04:30 GMT
content-type: image/jpeg
last-modified: Wed, 28 Mar 2018 09:30:46 GMT
server: openresty

GET
H2 200 pattern.png
cehdii.naughtymets.com/bundle/16/assets/img/ 100 B
270 B 39ms
39ms Image
image/png 5.104.107.248
MYLOC-AS WIIT AG

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cehdii.naughtymets.com/bundle/16/assets/img/pattern.png
Requested by: Host: cehdii.naughtymets.com
URL: https://cehdii.naughtymets.com/bundle/16/assets/css/style.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 5.104.107.248 Düsseldorf, Germany, ASN24961 (MYLOC-AS WIIT AG, DE),
Reverse DNS: srv11409.dus4.dedicated.server-hosting.expert
Software: openresty /
Resource Hash: 13de289b7d770632c2b87d7019cdb10416061bcdb50f07cadcc5e4c6cdf33a36

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://cehdii.naughtymets.com/bundle/16/assets/css/style.css

Response headers

cache-control: max-age=2592000
etag: "5abb60c6-64"
expires: Fri, 07 Feb 2025 06:04:30 GMT
content-length: 100
date: Wed, 08 Jan 2025 06:04:30 GMT
content-type: image/png
last-modified: Wed, 28 Mar 2018 09:30:46 GMT
server: openresty

GET
H3 200 S6uyw4BMUTPHjx4wXg.woff2
fonts.gstatic.com/s/lato/v24/ 23 KB
23 KB 59ms
25ms Font
font/woff2 142.250.186.35
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v24/S6uyw4BMUTPHjx4wXg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Lato&subset=latin-ext

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.35 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f3.1e100.net

Software

sffe /

Resource Hash

918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://cehdii.naughtymets.com
Referer: https://fonts.googleapis.com/

Response headers

age: 76297
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Wed, 07 Jan 2026 08:52:53 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 07 Jan 2025 08:52:53 GMT
last-modified: Tue, 02 May 2023 15:17:22 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 23580
x-xss-protection: 0
server: sffe

GET
H2 404 favicon.ico
cehdii.naughtymets.com/ 993 B
779 B 35ms
35ms Other
text/html 5.104.107.248
MYLOC-AS WIIT AG

General

Check archive.org

Show headers Download Go to

Full URL: https://cehdii.naughtymets.com/favicon.ico
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 5.104.107.248 Düsseldorf, Germany, ASN24961 (MYLOC-AS WIIT AG, DE),
Reverse DNS: srv11409.dus4.dedicated.server-hosting.expert
Software: openresty /
Resource Hash: 25d3409669519deee0adb32c70906510d0d85f8174025bb6b6a0ab1954bb0621

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://cehdii.naughtymets.com/s/5e45720035298?track=KORBAN_THREADS

Response headers

cache-control: no-cache, private
content-encoding: gzip
date: Wed, 08 Jan 2025 06:04:30 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding, Accept
server: openresty

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Porn Scam (Online)

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.naughtymets.com/	1970-01-21 02:20:02	Name: s Value: DYwHNTlLK2rZGnjHm4OjVGFVq%2Ff3Y%2BADAAo78eQIf%2FlogxkMuOPDKl6KcFtzkeGaZXgiIT4qf4N4xrkvT%2BFTiCB%2BLvaXHuNb%2BRe4X6l7DYLG3rcBzsuFplZvwI3s0gYUR%2FVkvKrd0yZQrCvy58KWpLH79a94WlSuFmtqBBHp7rrfqey68ciI0p3Mblfbsj%2B0FhGH7Yb74XmD2xTdzZTbFxq%2FQWNsY4LJfAFm560Q1gEnLkQiiMmms4KFNRuQJl%2BqO9dQ2N576MZGrMslkgRDJK9Z1izWKgq9o23kzL84fG%2B9XpkrgkaHPGu8ezN0V6fanIIXzYt6YhpGp5NWkiTeHMqoozexPVrnz759F39OKkInxzWSfhkBfVdbL4PBjcOqkNFWEMQbLDMjBpSRjEdYEfIpELu39dTbcvr2MlA69u9S3UnktzgWt7jrB9GAdPLy%2FQh2P0Us1pDdxRAzlk3oXTuZzaBu03gRYtk7gU55wpDfxnttlm39889rcR4H7WZwWiDIuEanQG2JMoPL3dKLY3qGTwGtDcwJu0tungvwdk3dRLqIbN4dH821ESANeo64hdtyKcl53XODegaUtxiFOT94tfiGpSt8JmpSl6PMTJuHoh%2BJ1zzqnRt5TnvChhynsfh6lnlH2xAUw1mW3bJcwMcPo3MrBt8rZOqpYHohVaTbXZcNZZcDkEmOM3shrgjP8Dg1Uc4dt2lAnSAaPz0llCbkie8QQ5nL0gSj5pfrJrVznnZA%2B4oYm8QIyJ1Ldt3c8CWkcM5aNho0cJh53tuC9btXqPn%2B8e6miXFcPNCWIYs%2Fa1kuUhdcWkCG9qyRk7mD5fjRxWL0uQ3p%2FyO5grhCmqqzkhRXiJi6lz%2B8OgdcvHv3qBIwg%2FW4LGBBJaweMLp1PraJQL6Dy1Rk%2FMBZPK9HQtFMZ03rBYjdy2AiMiCIFfMTBKI2jM8oyFYVND6wlw18TVTwdKbF%2FjGPHhCqN%2BBWRJYkwV%2F3yIBJHJbK34AA%2F4Pdv2m5tz2zU0jYMBL0Xb5GDBvyo2u5cp8FGN%2BvANBG9%2Bhsn7Tkjn%2FbQJ599HTSsAYDh0ukilikxz9dI2MpNlwQZL9SH1dc%2F4NJU4uPPV6oLT8IrFuyYkXdilnRkgHgJniJlwNA9gqqMPwPXL9czou5AIF7N3x924G9%2FznoE%2B4M5Bp9pItOiz6AS9hnGD223aa%2BTEE8a3TjCZuuK1j1QOMnwdmRcGvmTHIJkU%2FBmGJxVKz%2BgzNtR%2FKerGZc45AHmGUYXL4Cnw0ubTvzaaVMRron00d4Nf%2F7TWF19pfSMkEnQgXvKRdJQz%2FkA9GhExtXg%2BR8RLIFOImbzSiV33wfr54CC7E85qE0N4twkUoR%2BGUIP06fOqpBIPb6inPU5tFtocSCMTmN2OPPLQJcGdTVGRfouf5LQJZBVQg8lUP00Cqk1qgGugPqgDrlUBV8hgm%2Fn5nRQiSD5%2FlOM8c2VhWkg8dKCvZKTEePUpUAPQkNqGNWLbuZfOUtcvDmlRjp89DUTRgvc6FQyzVVD3AQWiBBU%2FF1GiNlLqnKMeHGXR%2B8QsK0pGRGIQNXva8RywDQe%2Fd%2Brmksq%2FZdxihDe%2FAQ7uk6LmKbcBWEDdyGaaAxuA9MFSzEPbrAhkCsgjRUJhdXBsUZlAJaJ8bNjv4gS3buPpLhWHk%2B3yDLGUSCW0p5eTiGQcFQFmZ6n8HVCLp%2F36rkfry8tESsQJiRVOkSnJRrL0qck9zB3B3dBKu5PqE9%2Fkkm0gyYKWrCTRk0dsjlIUu35%2F33%2BiRbbxJP2sj%2FzgR%2BKeUhYq%2BXvs%2BJo10wGUyI3jDedUy6YEeIyXB%2FBhSUg5II3fmsEVNepmwDWfpynk5T7%2FiXjGtgzsDrVdKxzQpHfcLxcTWRAsbNIwxcX08%2FNn%2BqJxmUnyCER7Bj%2BdF3LeZbUnhHUKFZVjZ8c1HiLHqisQw%3D

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://cehdii.naughtymets.com/favicon.ico Message: Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cehdii.naughtymets.com
fonts.googleapis.com
fonts.gstatic.com
joselynjayla.ruyii.xyz
142.250.186.35
2a00:1450:4001:808::200a
5.104.107.248
68.66.226.117
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
13de289b7d770632c2b87d7019cdb10416061bcdb50f07cadcc5e4c6cdf33a36
25d3409669519deee0adb32c70906510d0d85f8174025bb6b6a0ab1954bb0621
3e80058e1e64f3e5085e47096d373ae6b74987d494aec75b3f67872706569ef4
3fa7cbd6ccb0e62abc11ba89609c6cdd73aaa458973ae65b7d590830475ff261
52d62465d244bef9c22960bed269d931eb2b705dff7f09a0bcf5ddba62554f45
76d703389c75e3c1e9946072b1e18f6d61842f77eac3f03cfb366baba8035850
855f62c34d296773b690bcd61d702db042b6085294928d1f7064c022b47d2695
8fe3fa119255adb5e0c12479331f9e092e85bcff56ab6ecc0510bfa2056b898d
918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537
a88f88462c0343bc65173e05743424a0894478ce81f27d1a02af664b278f9700
bb51ed9f3911c06649c716f301c15e0ce918218b1d5049f6d435896b2574274b

cehdii.naughtymets.com Open in urlscan Pro 5.104.107.248 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

13 Requests

100 %HTTPS

25 %IPv6

4 Domains

4 Subdomains

4 IPs

2 Countries

224 kBTransfer

525 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

13 JavaScript Global Variables

1 Cookies

1 Console Messages

Security Headers

Indicators

cehdii.naughtymets.com Open in urlscan Pro
5.104.107.248 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

13
Requests

100 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

224 kB
Transfer

525 kB
Size

1
Cookies

13 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!