sweethottiesyz.com Open in urlscan Pro
2606:4700:3031::ac43:d1b7  Malicious Activity! Public Scan

1 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. http://mhi8.com/paratitla/subvirate_tartemorion.html Page URL
2. https://sweethottiesyz.com/?utm_source=G1BUkEGUo0PTl Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	subvirate_tartemorion.html Show response mhi8.com/paratitla/	206 B 436 B	868ms 577ms	Document text/html	185.216.119.98 CLOUDIE-AS-AP Clo...
General Check archive.org Show headers Download Go to Full URL http://mhi8.com/paratitla/subvirate_tartemorion.html Protocol HTTP/1.1 Server 185.216.119.98 , Hong Kong, ASN55933 (CLOUDIE-AS-AP Cloudie Limited, HK), Reverse DNS noc.ayidc.com Software nginx / Resource Hash 0796d812c48b2dcc2c8bdd2ddd8c4b0e264c6192d8fc7a1253b90ab8c995f69a Request headers Host mhi8.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36 Response headers Server nginx Date Sun, 09 May 2021 13:31:56 GMT Content-Type text/html Content-Length 206 Last-Modified Tue, 06 Apr 2021 11:11:53 GMT Connection keep-alive ETag "606c41f9-ce" Accept-Ranges bytes
GET H2	200	Primary Request / Show response sweethottiesyz.com/	4 KB 2 KB	45ms 14ms	Document text/html	2606:4700:3031::ac43:d1b7 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://sweethottiesyz.com/?utm_source=G1BUkEGUo0PTl Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3031::ac43:d1b7 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0f218eeabeb4e0a1f0e315d5d6cc013326e4629abbfa3337fdd4e0ee932f68b7 Security Headers Name Value X-Frame-Options SAMEORIGIN Request headers :method GET :authority sweethottiesyz.com :scheme https :path /?utm_source=G1BUkEGUo0PTl pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest document referer http://mhi8.com/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36 Referer http://mhi8.com/ Response headers date Sun, 09 May 2021 13:33:40 GMT content-type text/html; charset=UTF-8 set-cookie __cfduid=da1082aed943218e7faff5333caddb60d1620567220; expires=Tue, 08-Jun-21 13:33:40 GMT; path=/; domain=.sweethottiesyz.com; HttpOnly; SameSite=Lax x-frame-options SAMEORIGIN cf-request-id 09f2ee784000004a7ff201c000000001 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=e2NHkIDzm81WkfLQIOmXXwg9tLg4%2BDV0fuVvCk21kB3dZmjTIseAfjHHESHaIJVu11RZY69N472Blz21824hCMYzxXk5aEtjYt79KpR1WinyFfpZEdcv1%2FG8aX1a2bw%3D"}],"group":"cf-nel","max_age":604800} nel {"report_to":"cf-nel","max_age":604800} vary Accept-Encoding server cloudflare cf-ray 64cb4d06ce314a7f-FRA content-encoding br alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
GET H3-29	200	cf.errors.css sweethottiesyz.com/cdn-cgi/styles/	23 KB 5 KB	23ms 11ms	Stylesheet text/css	2606:4700:3031::ac43:d1b7 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://sweethottiesyz.com/cdn-cgi/styles/cf.errors.css Requested by Host: sweethottiesyz.com URL: https://sweethottiesyz.com/?utm_source=G1BUkEGUo0PTl Protocol H3-29 Security QUIC, , AES_128_GCM Server 2606:4700:3031::ac43:d1b7 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 16fd28061d42cf29268600418d5aa26b585435027ca599a42141cbc820f2547c Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options DENY Request headers :path /cdn-cgi/styles/cf.errors.css pragma no-cache cookie __cfduid=da1082aed943218e7faff5333caddb60d1620567220 accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36 sec-fetch-mode no-cors accept text/css,*/*;q=0.1 cache-control no-cache sec-fetch-dest style :authority sweethottiesyz.com referer https://sweethottiesyz.com/?utm_source=G1BUkEGUo0PTl :scheme https sec-fetch-site same-origin :method GET Referer https://sweethottiesyz.com/?utm_source=G1BUkEGUo0PTl User-Agent Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36 Response headers date Sun, 09 May 2021 13:33:40 GMT content-encoding gzip x-content-type-options nosniff last-modified Fri, 07 May 2021 18:47:34 GMT server cloudflare etag W/"60958b46-5c88" x-frame-options DENY content-type text/css cache-control max-age=7200 public cf-ray 64cb4d070cd4dfdb-FRA vary Accept-Encoding expires Sun, 09 May 2021 15:33:40 GMT
GET H3-29	200	icon-exclamation.png sweethottiesyz.com/cdn-cgi/images/	452 B 635 B	10ms 10ms	Image image/png	2606:4700:3031::ac43:d1b7 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://sweethottiesyz.com/cdn-cgi/images/icon-exclamation.png?1376755637 Requested by Host: sweethottiesyz.com URL: https://sweethottiesyz.com/cdn-cgi/styles/cf.errors.css Protocol H3-29 Security QUIC, , AES_128_GCM Server 2606:4700:3031::ac43:d1b7 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options DENY Request headers :path /cdn-cgi/images/icon-exclamation.png?1376755637 pragma no-cache cookie __cfduid=da1082aed943218e7faff5333caddb60d1620567220 accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority sweethottiesyz.com referer https://sweethottiesyz.com/cdn-cgi/styles/cf.errors.css :scheme https sec-fetch-site same-origin :method GET Referer https://sweethottiesyz.com/cdn-cgi/styles/cf.errors.css User-Agent Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36 Response headers date Sun, 09 May 2021 13:33:40 GMT x-content-type-options nosniff last-modified Fri, 07 May 2021 18:47:34 GMT server cloudflare etag "60958b46-1c4" x-frame-options DENY content-type image/png cache-control max-age=7200 public accept-ranges bytes cf-ray 64cb4d071d0edfdb-FRA vary Accept-Encoding content-length 452 expires Sun, 09 May 2021 15:33:40 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Cloudflare (Online)

12 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated object| _cf_translation

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.sweethottiesyz.com/	1970-01-19 18:52:39	Name: __cfduid Value: da1082aed943218e7faff5333caddb60d1620567220

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

mhi8.com
sweethottiesyz.com
185.216.119.98
2606:4700:3031::ac43:d1b7
0796d812c48b2dcc2c8bdd2ddd8c4b0e264c6192d8fc7a1253b90ab8c995f69a
0f218eeabeb4e0a1f0e315d5d6cc013326e4629abbfa3337fdd4e0ee932f68b7
16fd28061d42cf29268600418d5aa26b585435027ca599a42141cbc820f2547c
f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016