lp.discreet-flirt-site4.com
Open in
urlscan Pro
188.114.97.3
Malicious Activity!
Public Scan
Effective URL: https://lp.discreet-flirt-site4.com/?u=2pyk60a&o=yl0glr7&t=3057&cid=w0ps2pqipb7mkop235ltk2pm
Submission: On July 17 via api from GB — Scanned from GB
Summary
TLS certificate: Issued by WE1 on June 16th 2024. Valid for: 3 months.
This is the only time lp.discreet-flirt-site4.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Porn Scam (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 2 | 18.198.60.255 18.198.60.255 | 16509 (AMAZON-02) (AMAZON-02) | |
16 | 188.114.97.3 188.114.97.3 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 1 | 188.114.96.3 188.114.96.3 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 2 | 2600:9000:244... 2600:9000:2440:c800:12:1573:1600:93a1 | 16509 (AMAZON-02) (AMAZON-02) | |
2 2 | 3.120.62.154 3.120.62.154 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 2a00:1450:400... 2a00:1450:4001:829::200a | 15169 (GOOGLE) (GOOGLE) | |
3 | 2a00:1450:400... 2a00:1450:4001:82a::2003 | 15169 (GOOGLE) (GOOGLE) | |
21 | 4 |
ASN16509 (AMAZON-02, US)
PTR: ec2-18-198-60-255.eu-central-1.compute.amazonaws.com
cy.trck-capt-prv2.com |
ASN13335 (CLOUDFLARENET, US)
vip.romancepath.live | |
lp.discreet-flirt-site4.com |
ASN16509 (AMAZON-02, US)
PTR: ec2-3-120-62-154.eu-central-1.compute.amazonaws.com
nicking-unding.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
15 |
discreet-flirt-site4.com
lp.discreet-flirt-site4.com |
472 KB |
3 |
gstatic.com
fonts.gstatic.com |
79 KB |
2 |
nicking-unding.com
2 redirects
nicking-unding.com |
1 KB |
2 |
opentraffics.com
2 redirects
v.opentraffics.com |
1 KB |
2 |
trck-capt-prv2.com
1 redirects
cy.trck-capt-prv2.com |
27 KB |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 110 |
1 KB |
1 |
hooksexy.com
1 redirects
hello.hooksexy.com |
1 KB |
1 |
romancepath.live
vip.romancepath.live |
863 B |
21 | 8 |
Domain | Requested by | |
---|---|---|
15 | lp.discreet-flirt-site4.com |
vip.romancepath.live
lp.discreet-flirt-site4.com |
3 | fonts.gstatic.com |
fonts.googleapis.com
|
2 | nicking-unding.com | 2 redirects |
2 | v.opentraffics.com | 2 redirects |
2 | cy.trck-capt-prv2.com | 1 redirects |
1 | fonts.googleapis.com |
lp.discreet-flirt-site4.com
|
1 | hello.hooksexy.com | 1 redirects |
1 | vip.romancepath.live |
cy.trck-capt-prv2.com
|
21 | 8 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
ph.guardlnkcaptcha.com Amazon RSA 2048 M02 |
2024-02-14 - 2025-03-15 |
a year | crt.sh |
romancepath.live WE1 |
2024-07-16 - 2024-10-14 |
3 months | crt.sh |
discreet-flirt-site4.com WE1 |
2024-06-16 - 2024-09-14 |
3 months | crt.sh |
upload.video.google.com WR2 |
2024-06-24 - 2024-09-16 |
3 months | crt.sh |
*.gstatic.com WR2 |
2024-06-24 - 2024-09-16 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://lp.discreet-flirt-site4.com/?u=2pyk60a&o=yl0glr7&t=3057&cid=w0ps2pqipb7mkop235ltk2pm
Frame ID: 5F8615A67A4478F01AA51C0823DC68E9
Requests: 21 HTTP requests in this frame
Screenshot
Page Title
LovemePage URL History Show full URLs
-
https://cy.trck-capt-prv2.com/click?o=5344&a=1235&sub_id1=2fme2g4wagfvo1jlvetejtn4854jeg&sub_id3=4fa2b3956...
HTTP 302
http://cy.trck-capt-prv2.com/click?a=1235&sub_id1=2fme2g4wagfvo1jlvetejtn4854jeg&sub_id3=4fa2b39560b4e13a... HTTP 307
https://cy.trck-capt-prv2.com/click?a=1235&sub_id1=2fme2g4wagfvo1jlvetejtn4854jeg&sub_id3=4fa2b39560b4e13a... Page URL
- https://vip.romancepath.live/click?campaign_id=62&pub_id=71&p1=7ceec38bfd480f8fac6cb2191c9426a1&source=12... Page URL
-
https://hello.hooksexy.com/fed72075-87a2-403c-913e-1297481fba73?pub_id=71&campaign=62&referer=&source=1...
HTTP 302
https://v.opentraffics.com/1adac89b-33e0-4396-bca9-9e69b57d482b?t1=fed72075-87a2-403c-913e-1297481fba73... HTTP 307
https://v.opentraffics.com/1adac89b-33e0-4396-bca9-9e69b57d482b/2?t1=fed72075-87a2-403c-913e-1297481fba... HTTP 302
https://nicking-unding.com/aa26f8e2-c7ff-42dc-ac74-b70333bdac36?s1=fed72075-87a2-403c-913e-1297481fba73... HTTP 307
https://nicking-unding.com/aa26f8e2-c7ff-42dc-ac74-b70333bdac36/2?s1=fed72075-87a2-403c-913e-1297481fba... HTTP 302
https://lp.discreet-flirt-site4.com/?u=2pyk60a&o=yl0glr7&t=3057&cid=w0ps2pqipb7mkop235ltk2pm Page URL
Detected technologies
Google Font API (Font Scripts) ExpandDetected patterns
- <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://cy.trck-capt-prv2.com/click?o=5344&a=1235&sub_id1=2fme2g4wagfvo1jlvetejtn4854jeg&sub_id3=4fa2b39560b4e13a40ed7fb19bf058af
HTTP 302
http://cy.trck-capt-prv2.com/click?a=1235&sub_id1=2fme2g4wagfvo1jlvetejtn4854jeg&sub_id3=4fa2b39560b4e13a40ed7fb19bf058af&o=4880 HTTP 307
https://cy.trck-capt-prv2.com/click?a=1235&sub_id1=2fme2g4wagfvo1jlvetejtn4854jeg&sub_id3=4fa2b39560b4e13a40ed7fb19bf058af&o=4880 Page URL
- https://vip.romancepath.live/click?campaign_id=62&pub_id=71&p1=7ceec38bfd480f8fac6cb2191c9426a1&source=1235&sub_source=4fa2b39560b4e13a40ed7fb19bf058af Page URL
-
https://hello.hooksexy.com/fed72075-87a2-403c-913e-1297481fba73?pub_id=71&campaign=62&referer=&source=1235&sub_source=4fa2b39560b4e13a40ed7fb19bf058af&p1=7ceec38bfd480f8fac6cb2191c9426a1&p2=&revenue={revenue}&clickid=6697f68f261aea0355cb2a2f
HTTP 302
https://v.opentraffics.com/1adac89b-33e0-4396-bca9-9e69b57d482b?t1=fed72075-87a2-403c-913e-1297481fba73_71&t2=1235&tag=w0ps2pqipb7mkop23j6i4iei HTTP 307
https://v.opentraffics.com/1adac89b-33e0-4396-bca9-9e69b57d482b/2?t1=fed72075-87a2-403c-913e-1297481fba73_71&t2=1235&tag=w0ps2pqipb7mkop23j6i4iei HTTP 302
https://nicking-unding.com/aa26f8e2-c7ff-42dc-ac74-b70333bdac36?s1=fed72075-87a2-403c-913e-1297481fba73_71&s2=1235&s3=&s4=&s5=&s6=&s7=&s8=&s9=&ks=3057&cost=&tag=wqch6pcl88gfrop23repj3u4 HTTP 307
https://nicking-unding.com/aa26f8e2-c7ff-42dc-ac74-b70333bdac36/2?s1=fed72075-87a2-403c-913e-1297481fba73_71&s2=1235&s3=&s4=&s5=&s6=&s7=&s8=&s9=&ks=3057&cost=&tag=wqch6pcl88gfrop23repj3u4 HTTP 302
https://lp.discreet-flirt-site4.com/?u=2pyk60a&o=yl0glr7&t=3057&cid=w0ps2pqipb7mkop235ltk2pm Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://cy.trck-capt-prv2.com/click?o=5344&a=1235&sub_id1=2fme2g4wagfvo1jlvetejtn4854jeg&sub_id3=4fa2b39560b4e13a40ed7fb19bf058af HTTP 302
- http://cy.trck-capt-prv2.com/click?a=1235&sub_id1=2fme2g4wagfvo1jlvetejtn4854jeg&sub_id3=4fa2b39560b4e13a40ed7fb19bf058af&o=4880 HTTP 307
- https://cy.trck-capt-prv2.com/click?a=1235&sub_id1=2fme2g4wagfvo1jlvetejtn4854jeg&sub_id3=4fa2b39560b4e13a40ed7fb19bf058af&o=4880
21 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
click
cy.trck-capt-prv2.com/ Redirect Chain
|
26 KB 27 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
click
vip.romancepath.live/ |
704 B 863 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
Primary Request
/
lp.discreet-flirt-site4.com/ Redirect Chain
|
5 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
8 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
style.css
lp.discreet-flirt-site4.com/media/dating/dirtysinder/css/ |
16 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
flag-icon.css
lp.discreet-flirt-site4.com/util/flag-icon/css/ |
40 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
utils.js
lp.discreet-flirt-site4.com/util/ |
7 KB 3 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
logo-loveme_black1.svg
lp.discreet-flirt-site4.com/media/dating/dirtysinder/images/ |
4 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
jquery-2.2.4.min.js
lp.discreet-flirt-site4.com/media/dating/dirtysinder/js/ |
84 KB 31 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
trls.js
lp.discreet-flirt-site4.com/media/dating/dirtysinder/js/ |
18 KB 8 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
main.js
lp.discreet-flirt-site4.com/media/dating/dirtysinder/js/ |
3 KB 2 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
bb.js
lp.discreet-flirt-site4.com/media/ |
639 B 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
exit1.js
lp.discreet-flirt-site4.com/media/exit-new/ |
3 KB 2 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
1.jpg
lp.discreet-flirt-site4.com/media/dating/dirtysinder/images/ |
142 KB 142 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
2.jpg
lp.discreet-flirt-site4.com/media/dating/dirtysinder/images/ |
121 KB 122 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
3.jpg
lp.discreet-flirt-site4.com/media/dating/dirtysinder/images/ |
146 KB 147 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOlCnqEu92Fr1MmSU5fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ |
15 KB 15 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ |
15 KB 16 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1Ptug8zYS_SKggPNyC0ITw.woff2
fonts.gstatic.com/s/raleway/v34/ |
47 KB 47 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
gb.svg
lp.discreet-flirt-site4.com/util/flag-icon/flags/4x3/ |
971 B 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
favicon.ico
lp.discreet-flirt-site4.com/ |
0 418 B |
Other
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Porn Scam (Online)33 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| requestLink object| geoData string| ip function| getParameterByName function| hideUnsub function| languageDetection function| writeLocation object| geoRefData function| showLocation function| appendPixels function| getCookie function| getBackendParamsByName function| addSessionId function| docReady function| $ function| jQuery object| translation function| detect_language string| language string| browserLang function| replace_text function| translation_available function| translate function| cycleImages function| getUrlParameter function| getUrlWithParam string| exitsplashpage function| DisplayExitSplash function| addLoadEvent function| addClickEvent function| disablelinksfunc function| disableformsfunc object| x10 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
cy.trck-capt-prv2.com/ | Name: U-2fe5a27cde066c0b65acb8f2c1717464 Value: unique |
|
cy.trck-capt-prv2.com/ | Name: o_2fe5a27cde066c0b65acb8f2c1717464 Value: 96a16f05-cae1-4e7b-9b35-fe5d37be994e |
|
vip.romancepath.live/ | Name: sess_63a335c66757a06256582d92 Value: 63a335d20f5cc401856ad4dc |
|
.hello.hooksexy.com/ | Name: fed72075-87a2-403c-913e-1297481fba73-v4 Value: nZWF69US0fi1oXaU5szsCKNDdHQFU-JXrRWOauBGpVE |
|
.hello.hooksexy.com/ | Name: voluum-cid-v4 Value: %7B%22cid%22%3A%22w0ps2pqipb7mkop23j6i4iei%22%2C%22caid%22%3A%22fed72075-87a2-403c-913e-1297481fba73%22%7D |
|
.v.opentraffics.com/ | Name: 1adac89b-33e0-4396-bca9-9e69b57d482b-v4 Value: 5KMqS6VVj4D2E_8nxQ3CHOEP9YI5_dHI9s8Yxgvm7qo |
|
.v.opentraffics.com/ | Name: voluum-cid-v4 Value: %7B%22cid%22%3A%22wqch6pcl88gfrop23repj3u4%22%2C%22caid%22%3A%221adac89b-33e0-4396-bca9-9e69b57d482b%22%7D |
|
.nicking-unding.com/ | Name: aa26f8e2-c7ff-42dc-ac74-b70333bdac36-v4 Value: 9OWLq5PsKFp3oWWnkFA-Jkn-3X2bg0ezGQGpedT6Y8s |
|
.nicking-unding.com/ | Name: cc-v4 Value: FwHwLKr7YUWNkZvYdsp6FSZD8L2PwwltY8lO0n8mbfXdbaOgzU6V%2B8a4Sb%2Fq%2Btzwg9iPduQcUO13iYelIZ3wJOU5evlNYR9yXtbnI%2Bm5upWt7d23tIpm2rEzFR46LKxxvPDbZaxsCB3EZNFUzEhRYQ%3D%3D |
|
lp.discreet-flirt-site4.com/ | Name: sid Value: t1~likctiiawdwgcaogloepeizi |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cy.trck-capt-prv2.com
fonts.googleapis.com
fonts.gstatic.com
hello.hooksexy.com
lp.discreet-flirt-site4.com
nicking-unding.com
v.opentraffics.com
vip.romancepath.live
18.198.60.255
188.114.96.3
188.114.97.3
2600:9000:2440:c800:12:1573:1600:93a1
2a00:1450:4001:829::200a
2a00:1450:4001:82a::2003
3.120.62.154
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
0982dadd535925cdc02610ef878d3cf9cdd9d74a9b0806cf8e8f6095d85d4f9b
1be1304c675449b1bad38ea8c3da6c1da0763ed2fad339ee1aa461c7bf4e2a68
2949d919c1cbfea9a960e5a7a9fe4fe5086c1f9073c278d7e653980917a5a740
37a751df9353725b7e06bec81bc5c9f42c77c21701e4717465a13f4df5c0540d
3fd4d4a7fe6c0d2743ef52f04eddd31432c86c95fd79f39fe8bdffb7d8fba0b3
47d477915fa5912616e2dc5df8c5780f9202671678cf275472bd39f3381c0098
618f345a156a0eda55177a1bf0e8a414104f9b6c6ff5cdbe71966f081ccb8a46
6466d0a865bd3488110eaf1e30732411cd0589a9f5afb9e7ac812977508b311a
8f31c428593d808f5dd1697233414338d03fdc0f7f88334ef3be339efc2ebda2
93a93b5df3be25e67e3069683f81ff8797cf1080fea683c210121e52e9c120de
9c0fba4352f346a81523df1f943addecb49b9f082cd6fee3962b1681a7fbd5f5
a0f801b749c46ed0906d0481cf7de681a0c5f29ecd12d1f5eecea75f7993b441
a487d76bb55539f230c127ef33550d5c455ac0b67ca2b78b87452345bb0dc718
d6afd8d9abc2967f29ad396854cd05b1a12dcf9b7084f944c136ca6f540c5a39
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
f75911313e1c7802c23345ab57e754d87801581706780c993fb23ff4e0fe62ef
f9de722ba758581764351ed733db03426e34dbb00af780abb733ba5092b09b6b