herethebestshopnow.shopping Open in urlscan Pro
2a06:98c1:3120::3  Malicious Activity! Public Scan

Submitted URL: http://testomaster.info/
Effective URL: https://herethebestshopnow.shopping/?u=fy082k7&o=mb2kpbt&cid=fsp8aj7hhl0s&t=testomaster.info
Submission: On November 07 via api from US — Scanned from NL

Summary

This website contacted 3 IPs in 2 countries across 4 domains to perform 19 HTTP transactions. The main IP is 2a06:98c1:3120::3, located in United States and belongs to CLOUDFLARENET, US. The main domain is herethebestshopnow.shopping.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on October 9th 2022. Valid for: a year.
This is the only time herethebestshopnow.shopping was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Porn Scam (Online)

Domain & IP information

IP Address AS Autonomous System
1 1 2a06:98c1:312... 13335 (CLOUDFLAR...)
15 2a06:98c1:312... 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
3 2a00:1450:400... 15169 (GOOGLE)
19 3
Apex Domain
Subdomains
Transfer
15 herethebestshopnow.shopping
herethebestshopnow.shopping
423 KB
3 gstatic.com
fonts.gstatic.com
77 KB
1 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 118
1 KB
1 testomaster.info
testomaster.info
1 KB
19 4
Domain Requested by
15 herethebestshopnow.shopping herethebestshopnow.shopping
3 fonts.gstatic.com fonts.googleapis.com
1 fonts.googleapis.com herethebestshopnow.shopping
1 testomaster.info 1 redirects
19 4

This site contains no links.

Subject Issuer Validity Valid
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2022-10-09 -
2023-10-09
a year crt.sh
upload.video.google.com
GTS CA 1C3
2022-10-17 -
2023-01-09
3 months crt.sh
*.gstatic.com
GTS CA 1C3
2022-10-17 -
2023-01-09
3 months crt.sh

This page contains 1 frames:

Primary Page: https://herethebestshopnow.shopping/?u=fy082k7&o=mb2kpbt&cid=fsp8aj7hhl0s&t=testomaster.info
Frame ID: E37C8618699DB649E9DBF80999955BCF
Requests: 19 HTTP requests in this frame

Screenshot

Page Title

Loveme

Page URL History Show full URLs

  1. http://testomaster.info/ HTTP 302
    https://herethebestshopnow.shopping/?u=fy082k7&o=mb2kpbt&cid=fsp8aj7hhl0s&t=testomaster.info Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

19
Requests

100 %
HTTPS

100 %
IPv6

4
Domains

4
Subdomains

3
IPs

2
Countries

502 kB
Transfer

677 kB
Size

4
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://testomaster.info/ HTTP 302
    https://herethebestshopnow.shopping/?u=fy082k7&o=mb2kpbt&cid=fsp8aj7hhl0s&t=testomaster.info Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

19 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
herethebestshopnow.shopping/
Redirect Chain
  • http://testomaster.info/
  • https://herethebestshopnow.shopping/?u=fy082k7&o=mb2kpbt&cid=fsp8aj7hhl0s&t=testomaster.info
5 KB
5 KB
Document
General
Full URL
https://herethebestshopnow.shopping/?u=fy082k7&o=mb2kpbt&cid=fsp8aj7hhl0s&t=testomaster.info
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ff2b8a1d40681f2e38ca6c88c948c8cfcd5645ad8c0df8032cc9a7d625e001f5

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36
accept-language
nl-NL,nl;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control
private no-transform
cf-cache-status
DYNAMIC
cf-ray
7664006b08e49205-FRA
content-length
4776
content-type
text/html
date
Mon, 07 Nov 2022 06:27:11 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jfjfVnuk8w7TLWh0WKhMWpHxvSVzNjCep%2FL91jPm3%2BoSNwEBCWP8jDPgHzGKiPZuTQOZNzRjahDt4tgZEPJE%2FikCbu9EStjRifmyZBgEZXKdVCT5LvyBENX5JZLlqsf0HXJhQQWXPUUqMD9DphlNISfRpYAbDJ%2B3n58%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare

Redirect headers

CF-Cache-Status
DYNAMIC
CF-RAY
766400680b139b22-FRA
Cache-Control
no-store, no-cache, must-revalidate
Connection
keep-alive
Content-Type
text/html; charset=UTF-8
Date
Mon, 07 Nov 2022 06:27:11 GMT
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Location
https://herethebestshopnow.shopping/?u=fy082k7&o=mb2kpbt&cid=fsp8aj7hhl0s&t=testomaster.info
NEL
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Pragma
no-cache
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ijxRfZNaYK3663S2c2sdaapByIMxaP7fXLre4daxkxsJxakCE4Y3vAf9FHouk6ppW50HZXsC1%2BRsWkxvlzFjJM8e%2BZYHY3jnnti0MKKEQLhJlwnvEhRmsGNK7RFWPI6%2Flq7msNZmEcImxB0%2BwDjN"}],"group":"cf-nel","max_age":604800}
Server
cloudflare
Transfer-Encoding
chunked
X-Powered-By
PHP/7.2.24
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
css
fonts.googleapis.com/
7 KB
1 KB
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Monoton|Raleway:400,700|Roboto:300,700
Requested by
Host: herethebestshopnow.shopping
URL: https://herethebestshopnow.shopping/?u=fy082k7&o=mb2kpbt&cid=fsp8aj7hhl0s&t=testomaster.info
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
3b73704d99c3f9f97a00cac54e301e4f5d98b463c86feb4d3f8cc2fd741c474b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://herethebestshopnow.shopping/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Mon, 07 Nov 2022 06:27:11 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Mon, 07 Nov 2022 06:27:11 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Mon, 07 Nov 2022 06:27:11 GMT
style.css
herethebestshopnow.shopping/media/dating/dirtysinder/css/
16 KB
4 KB
Stylesheet
General
Full URL
https://herethebestshopnow.shopping/media/dating/dirtysinder/css/style.css
Requested by
Host: herethebestshopnow.shopping
URL: https://herethebestshopnow.shopping/?u=fy082k7&o=mb2kpbt&cid=fsp8aj7hhl0s&t=testomaster.info
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9c0fba4352f346a81523df1f943addecb49b9f082cd6fee3962b1681a7fbd5f5

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://herethebestshopnow.shopping/?u=fy082k7&o=mb2kpbt&cid=fsp8aj7hhl0s&t=testomaster.info
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date
Mon, 07 Nov 2022 06:27:11 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Tue, 17 May 2022 10:18:22 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
4061
etag
W/"6283766e-3e0d"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3%2F4XJ%2BqOPF7A1Czj62w%2B75jdpgAxjsgkzI8g74aopT7VYXeWNPeYPGTsnUuvveihsOhPyVpvqIDwAfCL6ltu2X8ETVR11ogylQGNxKu8HId7cyCXT8zUv2zOM2UyMNPNjC8VDI9ZgrdriRCPTe7z5B4SUnlNZBShk40%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400, no-transform
cf-ray
7664006bb9d79205-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
flag-icon.css
herethebestshopnow.shopping/util/flag-icon/css/
40 KB
3 KB
Stylesheet
General
Full URL
https://herethebestshopnow.shopping/util/flag-icon/css/flag-icon.css
Requested by
Host: herethebestshopnow.shopping
URL: https://herethebestshopnow.shopping/?u=fy082k7&o=mb2kpbt&cid=fsp8aj7hhl0s&t=testomaster.info
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d6afd8d9abc2967f29ad396854cd05b1a12dcf9b7084f944c136ca6f540c5a39

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://herethebestshopnow.shopping/?u=fy082k7&o=mb2kpbt&cid=fsp8aj7hhl0s&t=testomaster.info
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date
Mon, 07 Nov 2022 06:27:11 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Wed, 19 May 2021 12:38:50 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
4061
etag
W/"60a506da-9eb3"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vnBr4MCfYAMI35Sm8rSXkIYB7Vw%2Fv26m%2FcFIjJUgPs5bdv8yXjrEnA9MJTyFPL23QolTqyroZOCyy4NbtlbbCEmW3gWmgZC6%2Fdkkuevfr59Y8c8iuNDcdvvE2EWiiz5XOd6QsdfxnV2MJu1pz3bB5SGjufZdsuF%2Fj20%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400, no-transform
cf-ray
7664006bb9d99205-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
js.cookie.js
herethebestshopnow.shopping/cookie/
4 KB
2 KB
Script
General
Full URL
https://herethebestshopnow.shopping/cookie/js.cookie.js
Requested by
Host: herethebestshopnow.shopping
URL: https://herethebestshopnow.shopping/?u=fy082k7&o=mb2kpbt&cid=fsp8aj7hhl0s&t=testomaster.info
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
985659942ab60a92b3c0a7f876d9ef60e8f048ff655a622a172fa4b44f901b6c

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://herethebestshopnow.shopping/?u=fy082k7&o=mb2kpbt&cid=fsp8aj7hhl0s&t=testomaster.info
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date
Mon, 07 Nov 2022 06:27:11 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Thu, 21 Jul 2022 10:04:53 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
4386
etag
W/"62d924c5-10a8"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=l%2FewIHNRoBk%2B2fBOWNakLJV2zBiiSOtCBr9GhtSIxTgiZaur%2FRCFnO82x4HYOAzQHb2SgLufDcHOgcD9OhK8pLvOiF4yMR9Pi2RwlPdrbPoA6RPT4achr3GBPs%2FlEA7i70rDYw5otjdNKEb7XJ%2FQLnnEhw%2FObpT%2ByhU%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400, no-transform
cf-ray
7664006bb9da9205-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
utils.js
herethebestshopnow.shopping/util/
7 KB
3 KB
Script
General
Full URL
https://herethebestshopnow.shopping/util/utils.js
Requested by
Host: herethebestshopnow.shopping
URL: https://herethebestshopnow.shopping/?u=fy082k7&o=mb2kpbt&cid=fsp8aj7hhl0s&t=testomaster.info
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8b3c83a330bf1120a13eff6ef60c1e268b827b7bc49b42a7a1f5d8ad6941f2ea

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://herethebestshopnow.shopping/?u=fy082k7&o=mb2kpbt&cid=fsp8aj7hhl0s&t=testomaster.info
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date
Mon, 07 Nov 2022 06:27:11 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Fri, 29 Jul 2022 09:09:07 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
4386
etag
W/"62e3a3b3-1d58"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jZ3cLSjLlZIpOTEyjclyaKKZHpCR%2BUSTpOabJ7E2Y%2F%2Bi7r3LFG01WJ2TRzI34S%2FSolFDli%2BNbsjMURDtRZPxQqTGLpYucew7UvQtHbhiKp2ta7vXCRCaPtC9BeWeyQLWgMHXrTJcwZwqXTmWo0iu%2FxXclgrR7mI9GwI%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400, no-transform
cf-ray
7664006bb9db9205-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
logo-loveme_black1.svg
herethebestshopnow.shopping/media/dating/dirtysinder/images/
4 KB
3 KB
Image
General
Full URL
https://herethebestshopnow.shopping/media/dating/dirtysinder/images/logo-loveme_black1.svg
Requested by
Host: herethebestshopnow.shopping
URL: https://herethebestshopnow.shopping/?u=fy082k7&o=mb2kpbt&cid=fsp8aj7hhl0s&t=testomaster.info
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3fd4d4a7fe6c0d2743ef52f04eddd31432c86c95fd79f39fe8bdffb7d8fba0b3

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://herethebestshopnow.shopping/?u=fy082k7&o=mb2kpbt&cid=fsp8aj7hhl0s&t=testomaster.info
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date
Mon, 07 Nov 2022 06:27:11 GMT
content-encoding
gzip
cf-cache-status
MISS
last-modified
Tue, 17 May 2022 10:18:22 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"6283766e-1161"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2Bdt6TW7XsO0p7T%2B8KxnESBwohPU%2BojWidH8roLGwm5xUms1B2Oti6yg2e%2B%2BU88%2FbIP67M8zE5ZCjFOMqqXphrCSqSeE9WCM%2BOwNr%2BkQoQDT775tcPo%2Bre2qL5wYObDKkFlI%2BSYOkqrwp3genXJ7FY2hOqTDE1p%2FxnNs%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/svg+xml
cache-control
max-age=14400, no-transform
cf-ray
7664006c486e9159-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
jquery-2.2.4.min.js
herethebestshopnow.shopping/media/dating/dirtysinder/js/
84 KB
30 KB
Script
General
Full URL
https://herethebestshopnow.shopping/media/dating/dirtysinder/js/jquery-2.2.4.min.js
Requested by
Host: herethebestshopnow.shopping
URL: https://herethebestshopnow.shopping/?u=fy082k7&o=mb2kpbt&cid=fsp8aj7hhl0s&t=testomaster.info
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://herethebestshopnow.shopping/?u=fy082k7&o=mb2kpbt&cid=fsp8aj7hhl0s&t=testomaster.info
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date
Mon, 07 Nov 2022 06:27:11 GMT
content-encoding
gzip
cf-cache-status
MISS
last-modified
Fri, 29 Jul 2022 09:19:22 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"62e3a61a-14e4a"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jaCLqFEgfzpdkj4dO6Z59czvAtwKOTVvnYr%2FGy6oJhyvZCl%2BQpRPJzLQ4JG1AWNPg5ZzoaKb3obXDMLxT8YSDjuM%2Fcb3%2ButrMRNHGQM5RbdwI5l63vf5G10lEbJ7O3tIkH31T7m8%2Bm0QCt5u3Pn3rdG%2BVhrcwADt%2Fuc%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400, no-transform
cf-ray
7664006bffd89159-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
trls.js
herethebestshopnow.shopping/media/dating/dirtysinder/js/
17 KB
7 KB
Script
General
Full URL
https://herethebestshopnow.shopping/media/dating/dirtysinder/js/trls.js
Requested by
Host: herethebestshopnow.shopping
URL: https://herethebestshopnow.shopping/?u=fy082k7&o=mb2kpbt&cid=fsp8aj7hhl0s&t=testomaster.info
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1a7eb7795296faf56df1f30f1c6771b7eaa9290c60127e3e9d86696668ea48c8

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://herethebestshopnow.shopping/?u=fy082k7&o=mb2kpbt&cid=fsp8aj7hhl0s&t=testomaster.info
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date
Mon, 07 Nov 2022 06:27:11 GMT
content-encoding
gzip
cf-cache-status
MISS
last-modified
Fri, 29 Jul 2022 09:19:22 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"62e3a61a-4559"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NN6ATVlMsarrTZC%2Bi2qGQ2Ewutk3KPRfU2YtOLtsIiqR9V1SzUUhrUi5gbk%2FH2GnGW13XpktDJqAll0Aw9PVz4PunEYmoMzERPh2EfocyOMX16c68fZbWX2jh2N47ehSlLOutQ2DPZfauAS%2FaJlZs3RQMlb13TsA2Fw%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400, no-transform
cf-ray
7664006c38629159-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
main.js
herethebestshopnow.shopping/media/dating/dirtysinder/js/
3 KB
1 KB
Script
General
Full URL
https://herethebestshopnow.shopping/media/dating/dirtysinder/js/main.js
Requested by
Host: herethebestshopnow.shopping
URL: https://herethebestshopnow.shopping/?u=fy082k7&o=mb2kpbt&cid=fsp8aj7hhl0s&t=testomaster.info
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2c03acf3d158e2105bd0881aab875eadf0cca1167beb22d930888b28f34ae5a5

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://herethebestshopnow.shopping/?u=fy082k7&o=mb2kpbt&cid=fsp8aj7hhl0s&t=testomaster.info
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date
Mon, 07 Nov 2022 06:27:11 GMT
content-encoding
gzip
cf-cache-status
MISS
last-modified
Fri, 29 Jul 2022 09:19:22 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"62e3a61a-c45"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4x5sHho9pgaeibrXcF%2B%2F3P67i0T%2BGhIl0%2BZxL7doK%2FnhXLSpsxFzYbBCL%2BpAX650K2mVQMo4RRHW%2FcemV5s9tpE3XAUIos7ZgWKAiqniBYdVTnKb69N6p%2ByQvWLWnpZzE1%2FXqERtBpela4TkuCH%2F7hsRejzmp4tdzv4%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400, no-transform
cf-ray
7664006c48689159-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
bb.js
herethebestshopnow.shopping/media/
639 B
905 B
Script
General
Full URL
https://herethebestshopnow.shopping/media/bb.js
Requested by
Host: herethebestshopnow.shopping
URL: https://herethebestshopnow.shopping/?u=fy082k7&o=mb2kpbt&cid=fsp8aj7hhl0s&t=testomaster.info
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1be1304c675449b1bad38ea8c3da6c1da0763ed2fad339ee1aa461c7bf4e2a68

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://herethebestshopnow.shopping/?u=fy082k7&o=mb2kpbt&cid=fsp8aj7hhl0s&t=testomaster.info
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date
Mon, 07 Nov 2022 06:27:11 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Thu, 28 Jul 2022 18:00:18 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
2577
etag
W/"62e2ceb2-27f"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vTvf%2BajApqwsPd6EUQdVuoyFgUDvrmHMV4P08vAqFj2tJeqwdKimISj1DMI59%2F3M7dhk40wmbtoVWRdS%2FOpb82oiIXQ7j7J%2Bawb7WC5KgdP31pH8OD2wlStuQ9R%2BqkLP2YbY5poVwai3l17Kom0vWaGx5Awx49tWQk8%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400, no-transform
cf-ray
7664006c486a9159-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
exit1.js
herethebestshopnow.shopping/media/exit-new/
3 KB
2 KB
Script
General
Full URL
https://herethebestshopnow.shopping/media/exit-new/exit1.js
Requested by
Host: herethebestshopnow.shopping
URL: https://herethebestshopnow.shopping/?u=fy082k7&o=mb2kpbt&cid=fsp8aj7hhl0s&t=testomaster.info
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
618f345a156a0eda55177a1bf0e8a414104f9b6c6ff5cdbe71966f081ccb8a46

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://herethebestshopnow.shopping/?u=fy082k7&o=mb2kpbt&cid=fsp8aj7hhl0s&t=testomaster.info
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date
Mon, 07 Nov 2022 06:27:11 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Mon, 31 May 2021 11:57:39 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
2960
etag
W/"60b4cf33-d91"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vDZGO9h7ml%2FTeqoF4Q7TJCuEwZxhjmSLHuHCsbg94jLMu6OJLNxFwRtmspAsnhDA%2BVaUhInuAWw6hRqaFTOuBbGlqfZwuBkGgAdvUSVYkTeEY5PztXvB8VhREJLiew9fJkxIbJXuKgbLf2RFdS8M2iawsD0XdDf%2FV7s%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400, no-transform
cf-ray
7664006c486b9159-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
1.jpg
herethebestshopnow.shopping/media/dating/dirtysinder/images/
142 KB
125 KB
Image
General
Full URL
https://herethebestshopnow.shopping/media/dating/dirtysinder/images/1.jpg
Requested by
Host: herethebestshopnow.shopping
URL: https://herethebestshopnow.shopping/?u=fy082k7&o=mb2kpbt&cid=fsp8aj7hhl0s&t=testomaster.info
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
37a751df9353725b7e06bec81bc5c9f42c77c21701e4717465a13f4df5c0540d

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://herethebestshopnow.shopping/?u=fy082k7&o=mb2kpbt&cid=fsp8aj7hhl0s&t=testomaster.info
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date
Mon, 07 Nov 2022 06:27:11 GMT
content-encoding
gzip
cf-cache-status
MISS
last-modified
Wed, 23 Feb 2022 14:01:04 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"62163e20-23667"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fSqZA3hSPrerou67Ae06rWyTPKli0wbdCrIdVrU6g%2F5ByCeMFCFngoYytVJhQRUxdv%2BnH33%2BgmVb2%2FfJG9%2Fnweq3f%2FOowiryhStL0PuLB2x0%2Fhgv0rVsRuizvWXW9psbp2Rv0QY9FOj89UcznWgPgv0LYqSRygWKS%2F4%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
cache-control
max-age=14400, no-transform
cf-ray
7664006c48719159-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
2.jpg
herethebestshopnow.shopping/media/dating/dirtysinder/images/
121 KB
106 KB
Image
General
Full URL
https://herethebestshopnow.shopping/media/dating/dirtysinder/images/2.jpg
Requested by
Host: herethebestshopnow.shopping
URL: https://herethebestshopnow.shopping/?u=fy082k7&o=mb2kpbt&cid=fsp8aj7hhl0s&t=testomaster.info
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2949d919c1cbfea9a960e5a7a9fe4fe5086c1f9073c278d7e653980917a5a740

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://herethebestshopnow.shopping/?u=fy082k7&o=mb2kpbt&cid=fsp8aj7hhl0s&t=testomaster.info
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date
Mon, 07 Nov 2022 06:27:11 GMT
content-encoding
gzip
cf-cache-status
MISS
last-modified
Wed, 23 Feb 2022 14:01:05 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"62163e21-1e5f9"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VhsZ%2Bq7STvMNK3JVS6eVnZTnGwcuPQOGDJxE4pxt4S45xn%2B2rGhsPTE%2FF0LtNd967Voh%2BsN5gEoYnBL3HjXCy69bEQnySkBzNdr%2FrUVenj%2FGyrA41FS62fgRNNkc%2BiOJSwKhqnUkfgdeANMSlBomvzbDmr55cx9Xc10%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
cache-control
max-age=14400, no-transform
cf-ray
7664006c48749159-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
3.jpg
herethebestshopnow.shopping/media/dating/dirtysinder/images/
146 KB
130 KB
Image
General
Full URL
https://herethebestshopnow.shopping/media/dating/dirtysinder/images/3.jpg
Requested by
Host: herethebestshopnow.shopping
URL: https://herethebestshopnow.shopping/?u=fy082k7&o=mb2kpbt&cid=fsp8aj7hhl0s&t=testomaster.info
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8f31c428593d808f5dd1697233414338d03fdc0f7f88334ef3be339efc2ebda2

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://herethebestshopnow.shopping/?u=fy082k7&o=mb2kpbt&cid=fsp8aj7hhl0s&t=testomaster.info
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date
Mon, 07 Nov 2022 06:27:11 GMT
content-encoding
gzip
cf-cache-status
MISS
last-modified
Wed, 23 Feb 2022 14:01:05 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"62163e21-24781"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kpiJ%2FHZxdcdZ%2FIokAEvji%2Frt0LxGn7jgst6bsw5%2FqFPQhXDxutJltdl3v8dw1FBKd8Ko9LLCo7u8%2FHowOWu43ZjxKi2WDCs7n1u418Y3MZETI0n5MfEvg4XD1kcAzHNHGL04l6T5sY0LZC6KDGHCOjrJXwXZD2uwwZA%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
cache-control
max-age=14400, no-transform
cf-ray
7664006c48769159-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
KFOlCnqEu92Fr1MmSU5fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/
15 KB
16 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fBBc4.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Monoton|Raleway:400,700|Roboto:300,700
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f75911313e1c7802c23345ab57e754d87801581706780c993fb23ff4e0fe62ef
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://herethebestshopnow.shopping
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date
Fri, 04 Nov 2022 20:22:20 GMT
x-content-type-options
nosniff
age
209091
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15740
x-xss-protection
0
last-modified
Wed, 11 May 2022 19:24:56 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 04 Nov 2023 20:22:20 GMT
KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/
15 KB
16 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Monoton|Raleway:400,700|Roboto:300,700
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://herethebestshopnow.shopping
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date
Fri, 04 Nov 2022 05:09:29 GMT
x-content-type-options
nosniff
age
263862
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15860
x-xss-protection
0
last-modified
Wed, 11 May 2022 19:24:42 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 04 Nov 2023 05:09:29 GMT
1Ptug8zYS_SKggPNyC0ITw.woff2
fonts.gstatic.com/s/raleway/v28/
45 KB
46 KB
Font
General
Full URL
https://fonts.gstatic.com/s/raleway/v28/1Ptug8zYS_SKggPNyC0ITw.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Monoton|Raleway:400,700|Roboto:300,700
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
405ceee1c2f5c31f1cb94ebc63d49a43fddd1471c2c7401a01c7c11bb1d93826
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://herethebestshopnow.shopping
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date
Fri, 04 Nov 2022 08:23:46 GMT
x-content-type-options
nosniff
age
252205
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
46524
x-xss-protection
0
last-modified
Mon, 18 Jul 2022 19:58:01 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sat, 04 Nov 2023 08:23:46 GMT
nl.svg
herethebestshopnow.shopping/util/flag-icon/flags/4x3/
380 B
901 B
Image
General
Full URL
https://herethebestshopnow.shopping/util/flag-icon/flags/4x3/nl.svg
Requested by
Host: herethebestshopnow.shopping
URL: https://herethebestshopnow.shopping/util/flag-icon/css/flag-icon.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3305095b3544d76cbb66aab63bd7b3debd18ae41f8a7ca4df8fe0875b2bec4f

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://herethebestshopnow.shopping/util/flag-icon/css/flag-icon.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.87 Safari/537.36

Response headers

date
Mon, 07 Nov 2022 06:27:11 GMT
cf-cache-status
MISS
last-modified
Wed, 19 May 2021 12:39:17 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"60a506f5-17c"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8UjIbepJ%2BQLpEJQc2s1Y7fYFbfHxyb%2BJYo8VGL6OjYWC5CouL6YSPqDITw4JTH3PaLNhOnRMUDDb33SNFp9BvNzk9ghkrjKb552YLihX0bZF%2FbO%2Btw1rM7hrPpk9HbdY5ZghSQZZNfwzX9Tk%2B%2FzFd3CbKyG3NeP0ZTI%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/svg+xml
cache-control
max-age=14400, no-transform
accept-ranges
bytes
cf-ray
7664006d19c59159-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
380

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Porn Scam (Online)

49 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| requestLink object| geoData string| ip number| exDays boolean| validNavigation function| wireUpEvents function| Cookies function| docReady function| getParameterByName function| hideUnsub function| languageDetection function| writeLocation object| geoRefData function| showLocation function| appendPixels function| getCookie function| getBackendParamsByName function| addSessionId undefined| randomNumber function| $ function| jQuery object| translation function| detect_language string| language string| browserLang function| replace_text function| translation_available function| translate function| cycleImages boolean| PreventBb function| getUrlParameter function| getUrlWithParam boolean| PreventExitSplash string| exitsplashpage function| DisplayExitSplash function| addLoadEvent function| addClickEvent function| disablelinksfunc function| disableformsfunc object| x

4 Cookies

Domain/Path Name / Value
testomaster.info/ Name: PHPSESSID
Value: j5i5evh801i9231sf9qr47ktru
.testomaster.info/ Name: _subid
Value: fsp8aj7hhl0s
.testomaster.info/ Name: 73013
Value: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjM2XCI6MTY2NzgwMjQzMH0sXCJjYW1wYWlnbnNcIjp7XCI1XCI6MTY2NzgwMjQzMH0sXCJ0aW1lXCI6MTY2NzgwMjQzMH0ifQ.0d-L17Extw-RnStpDuYsFQgGyYbCTiASh0Pk1uRYZPk
herethebestshopnow.shopping/ Name: sid
Value: t4~kbo5seqtn1qwv2vjam3khqam

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.googleapis.com
fonts.gstatic.com
herethebestshopnow.shopping
testomaster.info
2a00:1450:4001:80f::200a
2a00:1450:4001:812::2003
2a06:98c1:3120::3
2a06:98c1:3121::3
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
1a7eb7795296faf56df1f30f1c6771b7eaa9290c60127e3e9d86696668ea48c8
1be1304c675449b1bad38ea8c3da6c1da0763ed2fad339ee1aa461c7bf4e2a68
2949d919c1cbfea9a960e5a7a9fe4fe5086c1f9073c278d7e653980917a5a740
2c03acf3d158e2105bd0881aab875eadf0cca1167beb22d930888b28f34ae5a5
37a751df9353725b7e06bec81bc5c9f42c77c21701e4717465a13f4df5c0540d
3b73704d99c3f9f97a00cac54e301e4f5d98b463c86feb4d3f8cc2fd741c474b
3fd4d4a7fe6c0d2743ef52f04eddd31432c86c95fd79f39fe8bdffb7d8fba0b3
405ceee1c2f5c31f1cb94ebc63d49a43fddd1471c2c7401a01c7c11bb1d93826
618f345a156a0eda55177a1bf0e8a414104f9b6c6ff5cdbe71966f081ccb8a46
8b3c83a330bf1120a13eff6ef60c1e268b827b7bc49b42a7a1f5d8ad6941f2ea
8f31c428593d808f5dd1697233414338d03fdc0f7f88334ef3be339efc2ebda2
985659942ab60a92b3c0a7f876d9ef60e8f048ff655a622a172fa4b44f901b6c
9c0fba4352f346a81523df1f943addecb49b9f082cd6fee3962b1681a7fbd5f5
d6afd8d9abc2967f29ad396854cd05b1a12dcf9b7084f944c136ca6f540c5a39
e3305095b3544d76cbb66aab63bd7b3debd18ae41f8a7ca4df8fe0875b2bec4f
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
f75911313e1c7802c23345ab57e754d87801581706780c993fb23ff4e0fe62ef
ff2b8a1d40681f2e38ca6c88c948c8cfcd5645ad8c0df8032cc9a7d625e001f5