spookchatx.com
Open in
urlscan Pro
185.155.186.43
Malicious Activity!
Public Scan
Effective URL: https://spookchatx.com/l/25/snapcheatv2/3-w2m/global/?c=&a=norule&s=2
Submission: On September 21 via manual from US — Scanned from DE
Summary
TLS certificate: Issued by E5 on August 30th 2024. Valid for: 3 months.
This is the only time spookchatx.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Porn Scam (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 173.212.194.250 173.212.194.250 | 51167 (CONTABO) (CONTABO) | |
2 | 185.155.184.85 185.155.184.85 | 6898 (AS-6898 C...) (AS-6898 C41.CH SAGL - LUGANO Data Center) | |
1 2 | 185.36.140.14 185.36.140.14 | 214790 (BRAINOZA) (BRAINOZA) | |
15 | 185.155.186.43 185.155.186.43 | 203639 (TEKNOLOGY) (TEKNOLOGY) | |
1 | 2a00:1450:400... 2a00:1450:4001:802::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 136.243.216.252 136.243.216.252 | 24940 (HETZNER-AS) (HETZNER-AS) | |
1 | 2a00:1450:400... 2a00:1450:4001:82b::2003 | 15169 (GOOGLE) (GOOGLE) | |
21 | 6 |
ASN51167 (CONTABO, DE)
PTR: panel.shribalajiinfosys.com
www.aakashmarble.com |
ASN6898 (AS-6898 C41.CH SAGL - LUGANO Data Center, CH)
ladiesdating.top |
ASN24940 (HETZNER-AS, DE)
PTR: static.252.216.243.136.clients.your-server.de
fdatajsext.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
15 |
spookchatx.com
spookchatx.com — Cisco Umbrella Rank: 581217 |
314 KB |
2 |
seattaskreg.live
1 redirects
d0dptv2.seattaskreg.live |
743 B |
2 |
ladiesdating.top
ladiesdating.top |
62 KB |
1 |
gstatic.com
fonts.gstatic.com |
18 KB |
1 |
fdatajsext.com
fdatajsext.com — Cisco Umbrella Rank: 425588 |
495 B |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 32 |
1 KB |
1 |
aakashmarble.com
1 redirects
www.aakashmarble.com |
194 B |
21 | 7 |
Domain | Requested by | |
---|---|---|
15 | spookchatx.com |
d0dptv2.seattaskreg.live
spookchatx.com |
2 | d0dptv2.seattaskreg.live |
1 redirects
ladiesdating.top
|
2 | ladiesdating.top | |
1 | fonts.gstatic.com |
fonts.googleapis.com
|
1 | fdatajsext.com |
spookchatx.com
|
1 | fonts.googleapis.com |
spookchatx.com
|
1 | www.aakashmarble.com | 1 redirects |
21 | 7 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
ladiesdating.top R10 |
2024-09-09 - 2024-12-08 |
3 months | crt.sh |
seattaskreg.live E6 |
2024-09-19 - 2024-12-18 |
3 months | crt.sh |
spookchatx.com E5 |
2024-08-30 - 2024-11-28 |
3 months | crt.sh |
upload.video.google.com WR2 |
2024-08-26 - 2024-11-18 |
3 months | crt.sh |
fdatajsext.com E6 |
2024-09-04 - 2024-12-03 |
3 months | crt.sh |
*.gstatic.com WR2 |
2024-08-26 - 2024-11-18 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://spookchatx.com/l/25/snapcheatv2/3-w2m/global/?c=&a=norule&s=2
Frame ID: D2D4D78F8A4ACDA5F96212E9B650AAC1
Requests: 21 HTTP requests in this frame
Screenshot
Page Title
SpookchatPage URL History Show full URLs
-
https://www.aakashmarble.com/uploads/jixcki.php?j1iv1
HTTP 302
https://ladiesdating.top/?u=2vtpd0d&o=ywzbvvy&m=1 Page URL
- https://d0dptv2.seattaskreg.live/uudscqia/?u=2vtpd0d&o=ywzbvvy&m=1&f=1&sid=t2~rcg14idwlf2w004c1ubpqhkf&fp=4fo... Page URL
-
https://d0dptv2.seattaskreg.live/web/
HTTP 302
https://spookchatx.com/l/25/snapcheatv2/3-w2m/global/?c=&a=norule&s=2 Page URL
Detected technologies
jQuery (JavaScript Libraries) ExpandDetected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://www.aakashmarble.com/uploads/jixcki.php?j1iv1
HTTP 302
https://ladiesdating.top/?u=2vtpd0d&o=ywzbvvy&m=1 Page URL
- https://d0dptv2.seattaskreg.live/uudscqia/?u=2vtpd0d&o=ywzbvvy&m=1&f=1&sid=t2~rcg14idwlf2w004c1ubpqhkf&fp=4foQtteJ5PfXd%2BaeIQB%2B5A%3D%3D Page URL
-
https://d0dptv2.seattaskreg.live/web/
HTTP 302
https://spookchatx.com/l/25/snapcheatv2/3-w2m/global/?c=&a=norule&s=2 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://www.aakashmarble.com/uploads/jixcki.php?j1iv1 HTTP 302
- https://ladiesdating.top/?u=2vtpd0d&o=ywzbvvy&m=1
21 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
/
ladiesdating.top/ Redirect Chain
|
62 KB 62 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
favicon.ico
ladiesdating.top/ |
0 136 B |
Other
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
d0dptv2.seattaskreg.live/uudscqia/ |
253 B 422 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
/
spookchatx.com/l/25/snapcheatv2/3-w2m/global/ Redirect Chain
|
5 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.css
spookchatx.com/l/25/snapcheatv2/3-w2m/global/css/ |
65 KB 11 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo_land.png
spookchatx.com/l/25/snapcheatv2/3-w2m/global/images/ |
8 KB 8 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
image.png
spookchatx.com/l/25/snapcheatv2/3-w2m/global/images/ |
208 KB 208 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
eye-off.svg
spookchatx.com/l/25/snapcheatv2/3-w2m/global/images/ |
333 B 543 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
eye-on.svg
spookchatx.com/l/25/snapcheatv2/3-w2m/global/images/ |
315 B 525 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-2.2.4.min.js
spookchatx.com/l/25/snapcheatv2/3-w2m/global/js/ |
84 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
trls.js
spookchatx.com/l/25/snapcheatv2/3-w2m/global/js/ |
38 KB 14 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.js
spookchatx.com/l/25/snapcheatv2/3-w2m/global/js/ |
8 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
utils.js
spookchatx.com/js/ |
4 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fprint2.min.js
spookchatx.com/js/ |
31 KB 11 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
notification-ext.js
spookchatx.com/js/push-ml/ |
10 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
style.css
spookchatx.com/js/push-ml/ |
170 KB 16 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
4 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
favicon.ico
spookchatx.com/ |
1 KB 781 B |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
getextparams
fdatajsext.com/ExtService.svc/ |
537 B 495 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
susan37_ico2.jpg
spookchatx.com/js/push-ml/images/ |
3 KB 3 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v32/ |
18 KB 18 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Porn Scam (Online)39 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery object| translation object| optPushTrls function| getParameterByName function| detect_language string| language string| browserLang function| replace_text function| translation_available function| translate function| languageDetection function| writeLocation object| e function| fingerprintGo function| Cookies function| Fingerprint2 string| optPushMethod object| optPush string| pushPath object| confPush object| textDataArray string| subscribeMethod string| vertical string| isShowedPushCookie object| textData string| availableLang string| pushConfirmHtml string| pushLabelTextClass string| pushLabelHtml function| openChildWindow function| showPushConfirm function| showPushLabel function| runSubscribeMethod function| subscribe function| setCookie function| getCookie function| getAllParams function| getRandomNumber6 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
ladiesdating.top/ | Name: sid Value: t2~rcg14idwlf2w004c1ubpqhkf |
|
ladiesdating.top/ | Name: p1 Value: https://seattaskreg.live/uudscqia/ |
|
ladiesdating.top/ | Name: s1 Value: hawwiag57folqfnt |
|
d0dptv2.seattaskreg.live/ | Name: sid Value: t1~ujfzfl3t2zr2tqqkpldrlcpt |
|
spookchatx.com/ | Name: fph Value: IjE1MTU3YjIwYWRjYTQxODk4N2RjMmFlYTdkOTFhY2Y1Ig== |
|
spookchatx.com/ | Name: fpd Value: W3sia2V5IjoidXNlckFnZW50IiwidmFsdWUiOiJNb3ppbGxhLzUuMCAoWDExOyBMaW51eCB4ODZfNjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS8xMjkuMC4wLjAgU2FmYXJpLzUzNy4zNiJ9LHsia2V5Ijoid2ViZHJpdmVyIiwidmFsdWUiOmZhbHNlfSx7ImtleSI6Imxhbmd1YWdlIiwidmFsdWUiOiJkZS1ERSJ9LHsia2V5IjoiY29sb3JEZXB0aCIsInZhbHVlIjoyNH0seyJrZXkiOiJkZXZpY2VNZW1vcnkiLCJ2YWx1ZSI6OH0seyJrZXkiOiJoYXJkd2FyZUNvbmN1cnJlbmN5IiwidmFsdWUiOjE4fSx7ImtleSI6InNjcmVlblJlc29sdXRpb24iLCJ2YWx1ZSI6WzE2MDAsMTIwMF19LHsia2V5IjoiYXZhaWxhYmxlU2NyZWVuUmVzb2x1dGlvbiIsInZhbHVlIjpbMTYwMCwxMjAwXX0seyJrZXkiOiJ0aW1lem9uZU9mZnNldCIsInZhbHVlIjotMTIwfSx7ImtleSI6InRpbWV6b25lIiwidmFsdWUiOiJFdXJvcGUvQmVybGluIn0seyJrZXkiOiJzZXNzaW9uU3RvcmFnZSIsInZhbHVlIjp0cnVlfSx7ImtleSI6ImxvY2FsU3RvcmFnZSIsInZhbHVlIjp0cnVlfSx7ImtleSI6ImluZGV4ZWREYiIsInZhbHVlIjp0cnVlfSx7ImtleSI6ImFkZEJlaGF2aW9yIiwidmFsdWUiOmZhbHNlfSx7ImtleSI6Im9wZW5EYXRhYmFzZSIsInZhbHVlIjpmYWxzZX0seyJrZXkiOiJjcHVDbGFzcyIsInZhbHVlIjoibm90IGF2YWlsYWJsZSJ9LHsia2V5IjoicGxhdGZvcm0iLCJ2YWx1ZSI6IkxpbnV4IHg4Nl82NCJ9LHsia2V5Ijoid2ViZ2xWZW5kb3JBbmRSZW5kZXJlciIsInZhbHVlIjoiSW50ZWwgSW5jLn5JbnRlbCBJcmlzIE9wZW5HTCBFbmdpbmUifSx7ImtleSI6ImFkQmxvY2siLCJ2YWx1ZSI6ZmFsc2V9LHsia2V5IjoiaGFzTGllZExhbmd1YWdlcyIsInZhbHVlIjp0cnVlfSx7ImtleSI6Imhhc0xpZWRSZXNvbHV0aW9uIiwidmFsdWUiOmZhbHNlfSx7ImtleSI6Imhhc0xpZWRPcyIsInZhbHVlIjpmYWxzZX0seyJrZXkiOiJoYXNMaWVkQnJvd3NlciIsInZhbHVlIjpmYWxzZX0seyJrZXkiOiJ0b3VjaFN1cHBvcnQiLCJ2YWx1ZSI6WzAsZmFsc2UsZmFsc2VdfSx7ImtleSI6ImF1ZGlvIiwidmFsdWUiOiIxMjQuMDQzNDc1Mjc1MTYwNzQifV0= |
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
d0dptv2.seattaskreg.live
fdatajsext.com
fonts.googleapis.com
fonts.gstatic.com
ladiesdating.top
spookchatx.com
www.aakashmarble.com
136.243.216.252
173.212.194.250
185.155.184.85
185.155.186.43
185.36.140.14
2a00:1450:4001:802::200a
2a00:1450:4001:82b::2003
002234b8e1b9b1af3c25b6f08534061fee8b034d75b2bbc0844ebd4c1563fb2d
1a2fff3e0a05499d6a9ed24b1762e7e61f243bbe0bd9ef28bc4ae7736bd844c0
31cbe340b0b5b5ae04b7f823b92f661dc6321126d206d3c35e36dad5bedab608
386578104461cc74fe40006f4f49d7ad850c8f0fb6649381899dcb271b7fda68
38dddd4d46264bad06a78a10ac27a74a8c8f307eb1fd6ee61c42dd6f42ce307c
603d42d6459866c94d83f48ad56ec2cc0a2d058de41bc759dd7b336a35c18629
6ec814effb7e70eafdbdda8d30f3eb8bf8fc12b2c853ed31ed22ebc2deafad6c
716d9649b8acbd0594b5c2d4f927cd1f1eb599305f7ebecd9f4c8d9831d91b7b
872d85642efe35c8e4ea474a12fad1f3c0bdef4a55386865bf538422e2f67601
89978e658e840b927dddb5cb3a835c7d8526ece79933bd9f3096b301fe1a8571
93d1697ee9f1a843a40e09ef85127252bbd95ff577a44eb06990949cb6ad365b
9f9f6ebaf293f7e3f6de13857b060fcaea66dc387d0010a00a6d601893fa3c9d
a028588692ef5567035252584508e7eaa87feddc4e4a8ff7049767f359a66aaf
b08ab6e78793ab31a1568c0bdd3a5cb01b4fa922d8ef2c35ff6822da89352c99
b409c14a10b4caad6b54844aa63a5faf748b83eecc2dd0d4fb1d913f8de55365
b5d6b3a44e98a88a106d982406dcd08b7eda01879473745065302bc2bf207bb7
dc1d54dab6ec8c00f70137927504e4f222c8395f10760b6beecfcfa94e08249f
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f59aa4f89ad59b2b57cf011c603316d7745c325f16b327dbc00717d9d148efe8
ff36c38b7102a85424f8f630f053a1c962dd7ccb89062848a6e92f08aa57ae0f