efade.bustyaffar.com
Open in
urlscan Pro
178.162.199.80
Malicious Activity!
Public Scan
Effective URL: https://efade.bustyaffar.com/s/63bf007e02311
Submission: On November 06 via manual from HU — Scanned from DE
Summary
TLS certificate: Issued by R3 on October 14th 2023. Valid for: 3 months.
This is the only time efade.bustyaffar.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Porn Scam (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 84.252.74.109 84.252.74.109 | 205090 (FIRST-SER...) (FIRST-SERVER-EUROPE) | |
1 1 | 185.195.26.119 185.195.26.119 | 204997 (FIRSTBYTE-AS) (FIRSTBYTE-AS) | |
1 1 | 2a06:98c1:312... 2a06:98c1:3121::3 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
11 | 178.162.199.80 178.162.199.80 | 28753 (LEASEWEB-...) (LEASEWEB-DE-FRA-10) | |
11 | 1 |
ASN205090 (FIRST-SERVER-EUROPE, GB)
PTR: felonrad.store
felonrad.store |
ASN204997 (FIRSTBYTE-AS, GB)
PTR: rukodelie-zarabotok.ru
rukodelie-zarabotok.ru |
Apex Domain Subdomains |
Transfer | |
---|---|---|
11 |
bustyaffar.com
efade.bustyaffar.com |
250 KB |
1 |
shawield.ru
1 redirects
shawield.ru |
538 B |
1 |
rukodelie-zarabotok.ru
1 redirects
rukodelie-zarabotok.ru |
258 B |
1 |
felonrad.store
1 redirects
felonrad.store |
317 B |
11 | 4 |
Domain | Requested by | |
---|---|---|
11 | efade.bustyaffar.com |
efade.bustyaffar.com
|
1 | shawield.ru | 1 redirects |
1 | rukodelie-zarabotok.ru | 1 redirects |
1 | felonrad.store | 1 redirects |
11 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
bustyaffar.com R3 |
2023-10-14 - 2024-01-12 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://efade.bustyaffar.com/s/63bf007e02311
Frame ID: 91848E212CF4E8D866C5D0F34C8A0A09
Requests: 11 HTTP requests in this frame
Screenshot
Page Title
Die beliebtesten Dating-Website des MonatsPage URL History Show full URLs
-
http://felonrad.store/1000L10007468-01015911-100113-0111H.html
HTTP 301
http://rukodelie-zarabotok.ru/1000L10007468-01015911-100113-0111H.html HTTP 302
https://shawield.ru/interspire HTTP 302
https://efade.bustyaffar.com/s/63bf007e02311 Page URL
Detected technologies
animate.css (Web Frameworks) ExpandDetected patterns
- <link [^>]+(?:/([\d.]+)/)?animate\.(?:min\.)?css
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://felonrad.store/1000L10007468-01015911-100113-0111H.html
HTTP 301
http://rukodelie-zarabotok.ru/1000L10007468-01015911-100113-0111H.html HTTP 302
https://shawield.ru/interspire HTTP 302
https://efade.bustyaffar.com/s/63bf007e02311 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
11 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
63bf007e02311
efade.bustyaffar.com/s/ Redirect Chain
|
42 KB 17 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
animate.min.css
efade.bustyaffar.com/bundle/18/assets/css/ |
52 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
style.css
efade.bustyaffar.com/bundle/18/assets/css/ |
14 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-2.2.4.min.js
efade.bustyaffar.com/bundle/18/assets/js/ |
84 KB 29 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
js.js
efade.bustyaffar.com/bundle/18/assets/js/ |
650 B 930 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
no.png
efade.bustyaffar.com/bundle/18/assets/img/ |
322 B 566 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
yes.png
efade.bustyaffar.com/bundle/18/assets/img/ |
594 B 838 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
1.jpg
efade.bustyaffar.com/bundle/18/assets/img/ |
76 KB 77 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
pattern.png
efade.bustyaffar.com/bundle/18/assets/img/ |
100 B 343 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Lato-Regular.ttf
efade.bustyaffar.com/bundle/18/assets/fonts/ |
117 KB 118 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
track.php
efade.bustyaffar.com/ |
0 254 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Porn Scam (Online)18 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| documentPictureInPicture function| $ function| jQuery string| sid boolean| exitPopunder string| fpDataEncoded string| cf function| Fingerprint2 function| fingerprintGo function| sendTrack function| collectTrackParams function| closingConfirm function| handleError function| getParameterByName function| collectParams function| checkRequired function| setLeadInfo function| setCF3 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
shawield.ru/ | Name: qwerty_interspire Value: 0 |
|
.bustyaffar.com/ | Name: s Value: H5CL%2BU7yx5uqqu80gd%2BPCS6fWgZKtv80pEJsJ%2BmsYlCiDEkzR7WSmF%2BKk7b901gZJAPzuQdcqut4jLTwtkcxFSB%2BNvmBHqNV%2FTS4TyxzYdElx%2Fq%2F5z56jrXhZnpOxqyQe%2Fgy4iVDhI%2Bo0v8pGcrcnAiVmMRiM5j7DwDv7LlGIDyE6uAUGrV6%2BlN5jtSaTNDT4VH0403ABOQ8Dg9rPZmlx5xtbOeGTiulsjyu%2FidVoV2Ycx5xIa9Mv7UXoeFopeVtcOtESGHS74P9tmNL60%2BaB7OTYVZqBqtjw1wpoOGvBZFQsir1IILwNKmeAGSWdMNg2NqzbLkvacN%2FaDY3f91HAHJPVmztc60EPVWZsDj8fNDtamAx9%2FC9AxFbohTSbutZ6c%2B8aCnvNupbfo5UCwsA6si5UbGhOI4%2BLGhA9xHfdXlVLMi51cRAki%2BpTKUKzUqNKd55Ke4o8zB95hNLgGQG5cQdVp4xwx%2BCwGIetCYbBDnHZfjs72WRPFkdA2YETYtByKUq3u%2BJTECz5YCF2rM0wlCD7wDBoJXBhR533QC%2FNKwI1sHE6F9XEG9OIkjFABb3zzpCcCjZbNiNeOEMhDVPDju9YnUoUp%2Fy%2FhGNaMo69rJP3whEjNNKtDEpdvdSI4HMYSwM5sZ9FWakh7tTE7adl8m2SQPQBI3BQ2cXJ8H3YRC45bqdkYdkiNI1hPfTagfCJ8MrLjrIYSge%2BcaJyooyWxAStD7fa3q5S3jCFXyTV8g0HVqhqfoFQPrNoQ%2BmIp67s198gk6EUhzPnIdIReuoRykyob8MUuDq%2Bz%2Btx1CPa4pREXxyz5CtzSSdahtsBPCDbefKi8y88ud5v3WxElWj29dW55WGPd5RG1x165aw7nfKu9oPKtlhB0wqhqGWT4S3Ivopl0aEzrIF89F4%2Fe592yju7hqsOztsZx%2B%2B1lV%2FrnbQhYBvX4Zv1om%2Fb8ildi2GEiarPfwHKu%2BxszMbpn0WEjIpRX4QNqMlu2PDVanatlrgaHBHMW2RYw4Zb3njxDeTsTlY9NKOkyirxuoAj2HXEUXPhTaNP%2Fv6omEJtjB1ntvmD2e3if28Wj6mTRwf%2BqHssZX30XG9C1a%2BJe9BqSdATJmaqOx3ChNefO5sckNWdonXiCdAoDR9WscFG6OgxzMcrdAs0XZfUvqQCKx4lW9MzY2X6t94v1I2hp3fS7DUCI7gOPwNXOa8EiZhNnT7oCEf5z6ulsvo70KNt72l0gH6%2BvMMWU5j7IlMBmHo5z2EQruGk0gkFfXkf14J8AjgNg8AkZLwRGHqPe2jfuecUMnoUG6%2FCcKKkhGJ%2F0AiyXitEHb0RyPwkmQjsSHTzaQMwtGmLFqE3gQ6lQyBa7oIkWPzK7FCC7gsZTh0C8JoilJa38Emdy5z1bBFDuzktnx6oPCUKMvGQH%2FKvC6wRkSz1nNZm%2BU25gFzfPCJ%2BfBRfG9A89oM%2Bz7QcDxqIY4iwfmabZYcHq9F2p42OrLUxVsLMFlonAL8M3zz8jkWnq84o7kK3bRGZKU68Gaf03alRO2iFuijLMyZRHlF%2BeEa7u3jRCb6jkFtGlbnTShX248UIFSIS%2B8jSnantcROs2am24t%2BJDaKon6hwRZxJYpUGq5M1xR4sJXgRpzisWu%2BRe0nwsQTEDWHm9oMMLtLIq%2FVALGLUoyI1i0MKbw1gWMluM6iTyjRy6u3YwzXQ%2FH3 |
|
efade.bustyaffar.com/ | Name: CF Value: +ISiW+VMFgtJ/MirIDGe0A__ |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
efade.bustyaffar.com
felonrad.store
rukodelie-zarabotok.ru
shawield.ru
178.162.199.80
185.195.26.119
2a06:98c1:3121::3
84.252.74.109
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
13de289b7d770632c2b87d7019cdb10416061bcdb50f07cadcc5e4c6cdf33a36
3e80058e1e64f3e5085e47096d373ae6b74987d494aec75b3f67872706569ef4
61578380385ef83a3ad40c2a0d5d0bad8ff6713845848098e70591ab20f0ce40
623cd33a00c598dfe9d63cb47e5798ecc598684f998f5e2eaf210513dbbd330c
6a81a25ca7fec3b6540c76f8da05d0be2b75103cd3d2066e70eeba35bb9315cd
7ae714b63c2c8b940bdd211a0cc678f01168a34eea8aa13c0df25364f29238a7
855f62c34d296773b690bcd61d702db042b6085294928d1f7064c022b47d2695
8d3e2c4dc26f3d2b9574f1a5c77c0ce3b7322acfba9db89c68132446e5c93b10
8fe3fa119255adb5e0c12479331f9e092e85bcff56ab6ecc0510bfa2056b898d
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855