www.milfs-club.ru Open in urlscan Pro
178.162.199.80 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://bit.ly/3agxjgw
Effective URL:
http://www.milfs-club.ru/s/4107abf3ed83b?s=123
Submission: On July 11 via manual (July 11th 2022, 11:32:27 pm UTC) from PL — Scanned from DE

Summary HTTP 8 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 3 countries across 5 domains to perform 8 HTTP transactions. The main IP is 178.162.199.80, located in Wuppertal, Germany and belongs to LEASEWEB-DE-FRA-10, DE. The main domain is www.milfs-club.ru.

This is the only time www.milfs-club.ru was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Porn Scam (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 1	67.199.248.11 67.199.248.11	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	2a06:98c1:312... 2a06:98c1:3121::3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	185.36.100.24 185.36.100.24	62403 (GO4CLOUD) (GO4CLOUD)
6	178.162.199.80 178.162.199.80	28753 (LEASEWEB-...) (LEASEWEB-DE-FRA-10)
1	2001:4de0:ac1... 2001:4de0:ac18::1:a:1b	20446 (STACKPATH...) (STACKPATH-CDN)
8	3

1 67.199.248.11 (United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: bit.ly

bit.ly	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a06:98c1:3121::3 (United States)

ASN13335 (CLOUDFLARENET, US)

armah.it	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.36.100.24 (Haarlem, Netherlands) 1 redirects

ASN62403 (GO4CLOUD, VG)

local-dates.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 178.162.199.80 (Wuppertal, Germany)

ASN28753 (LEASEWEB-DE-FRA-10, DE)

www.milfs-club.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac18::1:a:1b (Netherlands)

ASN20446 (STACKPATH-CDN, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	milfs-club.ru www.milfs-club.ru	131 KB
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 630	30 KB
1	local-dates.ru 1 redirects local-dates.ru	265 B
1	armah.it armah.it	2 KB
1	bit.ly 1 redirects bit.ly — Cisco Umbrella Rank: 4421	295 B
8	5

	Domain	Requested by
6	www.milfs-club.ru	www.milfs-club.ru
1	code.jquery.com	www.milfs-club.ru
1	local-dates.ru	1 redirects
1	armah.it
1	bit.ly	1 redirects
8	5

This site contains no links.

Subject Issuer	Validity	Valid
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2021-07-14` - `2022-08-14`	a year	crt.sh

This page contains 1 frames:

Primary Page: http://www.milfs-club.ru/s/4107abf3ed83b?s=123
Frame ID: BFCBD59FECCDA2FF31A244FEF70B38B2
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Die beliebtesten Dating-Website des Monats

Page URL History Show full URLs

https://bit.ly/3agxjgw HTTP 301
http://armah.it/ripup/phelloderm_madame.html Page URL
http://local-dates.ru/?land=80662 HTTP 302
http://www.milfs-club.ru/s/4107abf3ed83b?s=123 Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

8
Requests

13 %
HTTPS

40 %
IPv6

5
Domains

5
Subdomains

3
IPs

3
Countries

163 kB
Transfer

219 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://bit.ly/3agxjgw HTTP 301
http://armah.it/ripup/phelloderm_madame.html Page URL
http://local-dates.ru/?land=80662 HTTP 302
http://www.milfs-club.ru/s/4107abf3ed83b?s=123 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://bit.ly/3agxjgw HTTP 301
http://armah.it/ripup/phelloderm_madame.html

8 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

phelloderm_madame.html Show response
armah.it/ripup/
Redirect Chain

https://bit.ly/3agxjgw?
http://armah.it/ripup/phelloderm_madame.html

1 KB
2 KB

94ms
68ms

Document
text/html

2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

http://armah.it/ripup/phelloderm_madame.html

Protocol

HTTP/1.1

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

238690b8075929e1afa7346298abba1670a90d61356fc37d2c97db9980816f4c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

CF-Cache-Status: DYNAMIC
CF-RAY: 729556867dcd92a2-FRA
Cache-Control: max-age=315360000
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html
Date: Mon, 11 Jul 2022 23:32:22 GMT
Expires: Thu, 31 Dec 2037 23:55:55 GMT
Last-Modified: Wed, 08 Jun 2022 22:31:17 GMT
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=maenjUUwISSm7X2faXk6zGHVf0SFQaKbPJQHuc6hpC8lmy4Sj8yH0tetQtK%2BQUCfPL0bi%2BmPaOdei71uzWcbp9lZk3%2FuoQoklB23kjhOZApIDEcFLWc3K9UXkMiHL9sBC7yiaEaX9A%3D%3D"}],"group":"cf-nel","max_age":604800}
Server: cloudflare
Transfer-Encoding: chunked
X-Cache: HIT from Backend
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=90
content-length: 131
content-security-policy: referrer always;
content-type: text/html; charset=utf-8
date: Mon, 11 Jul 2022 23:32:22 GMT
location: http://armah.it/ripup/phelloderm_madame.html
referrer-policy: unsafe-url
server: nginx
via: 1.1 google

GET
H/1.1

200
OK

Primary Request 4107abf3ed83b Show response
www.milfs-club.ru/s/
Redirect Chain

http://local-dates.ru/?land=80662
http://www.milfs-club.ru/s/4107abf3ed83b?s=123

5 KB
2 KB

863ms
683ms

Document
text/html

178.162.199.80
LEASEWEB-DE-FRA-10

General

Check archive.org

Show headers Download Go to

Full URL: http://www.milfs-club.ru/s/4107abf3ed83b?s=123
Protocol: HTTP/1.1
Server: 178.162.199.80 Wuppertal, Germany, ASN28753 (LEASEWEB-DE-FRA-10, DE),
Reverse DNS
Software: openresty/1.19.3.1 /
Resource Hash: 7bc61546772b9900f0852c33b8214a3f027a54c83d7188ef52cd24c6f7293765

Request headers

Referer: http://armah.it/ripup/phelloderm_madame.html
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html; charset=UTF-8
Date: Mon, 11 Jul 2022 23:32:23 GMT
Server: openresty/1.19.3.1
Transfer-Encoding: chunked
Vary: Accept-Encoding

Redirect headers

Connection: keep-alive
Content-Length: 0
Content-Type: text/html; charset=UTF-8
Date: Mon, 11 Jul 2022 23:32:22 GMT
Keep-Alive: timeout=60
Location: http://www.milfs-club.ru/s/4107abf3ed83b?s=123
Server: nginx
X-Powered-By: PHP/5.6.40

GET
H/1.1 200
OK style.css
www.milfs-club.ru/bundle/373/assets/css/ 8 KB
8 KB 13ms
13ms Stylesheet
text/css 178.162.199.80
LEASEWEB-DE-FRA-10

General

Check archive.org

Show headers Download Go to

Full URL: http://www.milfs-club.ru/bundle/373/assets/css/style.css
Requested by: Host: www.milfs-club.ru
URL: http://www.milfs-club.ru/s/4107abf3ed83b?s=123
Protocol: HTTP/1.1
Server: 178.162.199.80 Wuppertal, Germany, ASN28753 (LEASEWEB-DE-FRA-10, DE),
Reverse DNS
Software: openresty/1.19.3.1 /
Resource Hash: 564be9acf9a12554f06ec1c07117f284232284923d5def54f1688559ef28818d

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://www.milfs-club.ru/s/4107abf3ed83b?s=123
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Mon, 11 Jul 2022 23:32:23 GMT
Last-Modified: Fri, 20 Nov 2020 19:02:09 GMT
Server: openresty/1.19.3.1
ETag: "5fb812b1-1e16"
Vary: Accept-Encoding
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 7702

GET
H2 200 jquery-3.2.1.min.js Show response
code.jquery.com/ 85 KB
30 KB 66ms
18ms Script
application/javascript 2001:4de0:ac18::1:a:1b
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.2.1.min.js
Requested by: Host: www.milfs-club.ru
URL: http://www.milfs-club.ru/s/4107abf3ed83b?s=123
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac18::1:a:1b , Netherlands, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
Software: nginx /
Resource Hash: 87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de

Request headers

Referer: http://www.milfs-club.ru/
Origin: http://www.milfs-club.ru
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

date: Mon, 11 Jul 2022 23:32:23 GMT
content-encoding: gzip
last-modified: Fri, 20 Aug 2021 17:47:53 GMT
server: nginx
etag: W/"611feac9-15283"
vary: Accept-Encoding
x-hw: 1657582343.dop125.am5.t,1657582343.cds133.am5.hn,1657582343.cds255.am5.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 30125

GET
H/1.1 200
OK functions.js Show response
www.milfs-club.ru/bundle/373/assets/js/ 1 KB
2 KB 27ms
13ms Script
application/javascript 178.162.199.80
LEASEWEB-DE-FRA-10

General

Check archive.org

Show headers Download Go to

Full URL: http://www.milfs-club.ru/bundle/373/assets/js/functions.js
Requested by: Host: www.milfs-club.ru
URL: http://www.milfs-club.ru/s/4107abf3ed83b?s=123
Protocol: HTTP/1.1
Server: 178.162.199.80 Wuppertal, Germany, ASN28753 (LEASEWEB-DE-FRA-10, DE),
Reverse DNS
Software: openresty/1.19.3.1 /
Resource Hash: 48e7fce4de999dc2a1a99ec249b03011fe571e6f4d5383f8a447337b8a64d982

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://www.milfs-club.ru/s/4107abf3ed83b?s=123
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Mon, 11 Jul 2022 23:32:23 GMT
Last-Modified: Fri, 20 Nov 2020 19:02:09 GMT
Server: openresty/1.19.3.1
ETag: "5fb812b1-50e"
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1294

GET
H/1.1 200
OK click.js Show response
www.milfs-club.ru/js/ 5 KB
5 KB 74ms
72ms Script
application/javascript 178.162.199.80
LEASEWEB-DE-FRA-10

General

Check archive.org

Show headers Download Go to

Full URL: http://www.milfs-club.ru/js/click.js
Requested by: Host: www.milfs-club.ru
URL: http://www.milfs-club.ru/s/4107abf3ed83b?s=123
Protocol: HTTP/1.1
Server: 178.162.199.80 Wuppertal, Germany, ASN28753 (LEASEWEB-DE-FRA-10, DE),
Reverse DNS
Software: openresty/1.19.3.1 /
Resource Hash: 21796d03b31b6f7f1be149aa71b5a56a25de6003291b6950b51bc862452ded49

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://www.milfs-club.ru/s/4107abf3ed83b?s=123
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Mon, 11 Jul 2022 23:32:23 GMT
Last-Modified: Thu, 30 Jun 2022 13:44:02 GMT
Server: openresty/1.19.3.1
ETag: "62bda8a2-1208"
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 4616

GET
H/1.1 200
OK 1.jpg
www.milfs-club.ru/bundle/373/assets/img/ 85 KB
85 KB 30ms
20ms Image
image/jpeg 178.162.199.80
LEASEWEB-DE-FRA-10

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://www.milfs-club.ru/bundle/373/assets/img/1.jpg
Requested by: Host: www.milfs-club.ru
URL: http://www.milfs-club.ru/bundle/373/assets/css/style.css
Protocol: HTTP/1.1
Server: 178.162.199.80 Wuppertal, Germany, ASN28753 (LEASEWEB-DE-FRA-10, DE),
Reverse DNS
Software: openresty/1.19.3.1 /
Resource Hash: a4b00bc34b3e6fb222d380c95a9ed2fd409720e31977a92046deeb44780acbee

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://www.milfs-club.ru/bundle/373/assets/css/style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Mon, 11 Jul 2022 23:32:23 GMT
Last-Modified: Fri, 20 Nov 2020 19:02:09 GMT
Server: openresty/1.19.3.1
ETag: "5fb812b1-15214"
Content-Type: image/jpeg
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 86548

GET
H/1.1 200
OK fp2.min.js Show response
www.milfs-club.ru/js/ 30 KB
30 KB 67ms
67ms Script
application/javascript 178.162.199.80
LEASEWEB-DE-FRA-10

General

Check archive.org

Show headers Download Go to

Full URL: http://www.milfs-club.ru/js/fp2.min.js
Requested by: Host: www.milfs-club.ru
URL: http://www.milfs-club.ru/js/click.js
Protocol: HTTP/1.1
Server: 178.162.199.80 Wuppertal, Germany, ASN28753 (LEASEWEB-DE-FRA-10, DE),
Reverse DNS
Software: openresty/1.19.3.1 /
Resource Hash: 6e1bf43d1d49858aacd5de53b32b551732bca4b2a46b1f808eb6d6d0f2b70c0e

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://www.milfs-club.ru/s/4107abf3ed83b
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36

Response headers

Date: Mon, 11 Jul 2022 23:32:23 GMT
Last-Modified: Thu, 30 Jun 2022 13:44:02 GMT
Server: openresty/1.19.3.1
ETag: "62bda8a2-77dd"
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 30685

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Porn Scam (Online)

15 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.bit.ly/	1970-01-20 08:45:34	Name: _bit Value: m6bnwm-beca884eb46ae778fc-00K
			.milfs-club.ru/	1970-01-21 06:43:10	Name: SID Value: 3be096af335f60910bbe85536643a8c5

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

armah.it
bit.ly
code.jquery.com
local-dates.ru
www.milfs-club.ru
178.162.199.80
185.36.100.24
2001:4de0:ac18::1:a:1b
2a06:98c1:3121::3
67.199.248.11
21796d03b31b6f7f1be149aa71b5a56a25de6003291b6950b51bc862452ded49
238690b8075929e1afa7346298abba1670a90d61356fc37d2c97db9980816f4c
48e7fce4de999dc2a1a99ec249b03011fe571e6f4d5383f8a447337b8a64d982
564be9acf9a12554f06ec1c07117f284232284923d5def54f1688559ef28818d
6e1bf43d1d49858aacd5de53b32b551732bca4b2a46b1f808eb6d6d0f2b70c0e
7bc61546772b9900f0852c33b8214a3f027a54c83d7188ef52cd24c6f7293765
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
a4b00bc34b3e6fb222d380c95a9ed2fd409720e31977a92046deeb44780acbee

www.milfs-club.ru Open in urlscan Pro 178.162.199.80 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

8 Requests

13 %HTTPS

40 %IPv6

5 Domains

5 Subdomains

3 IPs

3 Countries

163 kBTransfer

219 kBSize

2 Cookies

0 Outgoing links

Page URL History

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

15 JavaScript Global Variables

2 Cookies

Security Headers

Indicators

www.milfs-club.ru Open in urlscan Pro
178.162.199.80 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

13 %
HTTPS

40 %
IPv6

5
Domains

5
Subdomains

3
IPs

3
Countries

163 kB
Transfer

219 kB
Size

2
Cookies

8 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!