sweethottiesyz.com Open in urlscan Pro
2606:4700:3031::ac43:d1b7  Malicious Activity! Public Scan

1 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. http://www.xn--vrebropizza-98a.com/css/font-awesome/css/cigar/spatial_puree.html Page URL
2. https://sweethottiesyz.com/?utm_source=G1BUkEGUo0PTl Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	spatial_puree.html Show response www.xn--vrebropizza-98a.com/css/font-awesome/css/cigar/	206 B 534 B	37ms 10ms	Document text/html	92.204.218.63 GODADDY-SXB
General Check archive.org Show headers Download Go to Full URL http://www.xn--vrebropizza-98a.com/css/font-awesome/css/cigar/spatial_puree.html Protocol HTTP/1.1 Server 92.204.218.63 Strasbourg, France, ASN21499 (GODADDY-SXB, DE), Reverse DNS ip-92-204-218-63.ip.secureserver.net Software Apache / Resource Hash 0796d812c48b2dcc2c8bdd2ddd8c4b0e264c6192d8fc7a1253b90ab8c995f69a Request headers Host www.xn--vrebropizza-98a.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Sun, 09 May 2021 04:45:39 GMT Server Apache Upgrade h2,h2c Connection Upgrade, Keep-Alive Last-Modified Tue, 23 Mar 2021 07:47:27 GMT ETag "21014b9-ce-5be2f64c621c0-gzip" Accept-Ranges bytes Vary Accept-Encoding,User-Agent Content-Encoding gzip Content-Length 178 Keep-Alive timeout=5 Content-Type text/html
GET H2	200	Primary Request / Show response sweethottiesyz.com/	4 KB 2 KB	73ms 44ms	Document text/html	2606:4700:3031::ac43:d1b7 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://sweethottiesyz.com/?utm_source=G1BUkEGUo0PTl Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3031::ac43:d1b7 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 37b2c46e6799bb7934c4ef9e163c06e543ce5d345d734c6e44e07a715624ea9a Security Headers Name Value X-Frame-Options SAMEORIGIN Request headers :method GET :authority sweethottiesyz.com :scheme https :path /?utm_source=G1BUkEGUo0PTl pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest document referer http://www.xn--vrebropizza-98a.com/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Referer http://www.xn--vrebropizza-98a.com/ Response headers date Sun, 09 May 2021 04:45:39 GMT content-type text/html; charset=UTF-8 set-cookie __cfduid=d705e54a3877b4bd61a6344ee1fa8eafc1620535539; expires=Tue, 08-Jun-21 04:45:39 GMT; path=/; domain=.sweethottiesyz.com; HttpOnly; SameSite=Lax x-frame-options SAMEORIGIN cf-request-id 09f10b105300002ba1e53a7000000001 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=%2BSI1JtO%2BRe%2B2rcP3inIrQ2ozbxfRKyjylH0nF8ju5qZHwF1X8CbD%2FFkCI0iP7XsWj51yh2dBbl3CfxlXSHeh%2BWYAdHl1Ks62NL3BzhmKCCqsXQT%2Bt9UEH7CvYiiWFdM%3D"}],"group":"cf-nel","max_age":604800} nel {"report_to":"cf-nel","max_age":604800} vary Accept-Encoding server cloudflare cf-ray 64c84793bfb42ba1-FRA content-encoding br alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
GET H3-29	200	cf.errors.css sweethottiesyz.com/cdn-cgi/styles/	23 KB 5 KB	22ms 11ms	Stylesheet text/css	2606:4700:3031::ac43:d1b7 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://sweethottiesyz.com/cdn-cgi/styles/cf.errors.css Requested by Host: sweethottiesyz.com URL: https://sweethottiesyz.com/?utm_source=G1BUkEGUo0PTl Protocol H3-29 Security QUIC, , AES_128_GCM Server 2606:4700:3031::ac43:d1b7 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 16fd28061d42cf29268600418d5aa26b585435027ca599a42141cbc820f2547c Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options DENY Request headers :path /cdn-cgi/styles/cf.errors.css pragma no-cache cookie __cfduid=d705e54a3877b4bd61a6344ee1fa8eafc1620535539 accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept text/css,*/*;q=0.1 cache-control no-cache sec-fetch-dest style :authority sweethottiesyz.com referer https://sweethottiesyz.com/?utm_source=G1BUkEGUo0PTl :scheme https sec-fetch-site same-origin :method GET Referer https://sweethottiesyz.com/?utm_source=G1BUkEGUo0PTl User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sun, 09 May 2021 04:45:39 GMT content-encoding gzip x-content-type-options nosniff last-modified Fri, 07 May 2021 18:47:34 GMT server cloudflare etag W/"60958b46-5c88" x-frame-options DENY content-type text/css cache-control max-age=7200 public cf-ray 64c8479419c44e37-FRA vary Accept-Encoding expires Sun, 09 May 2021 06:45:39 GMT
GET H3-29	200	icon-exclamation.png sweethottiesyz.com/cdn-cgi/images/	452 B 637 B	9ms 9ms	Image image/png	2606:4700:3031::ac43:d1b7 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://sweethottiesyz.com/cdn-cgi/images/icon-exclamation.png?1376755637 Requested by Host: sweethottiesyz.com URL: https://sweethottiesyz.com/cdn-cgi/styles/cf.errors.css Protocol H3-29 Security QUIC, , AES_128_GCM Server 2606:4700:3031::ac43:d1b7 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options DENY Request headers :path /cdn-cgi/images/icon-exclamation.png?1376755637 pragma no-cache cookie __cfduid=d705e54a3877b4bd61a6344ee1fa8eafc1620535539 accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority sweethottiesyz.com referer https://sweethottiesyz.com/cdn-cgi/styles/cf.errors.css :scheme https sec-fetch-site same-origin :method GET Referer https://sweethottiesyz.com/cdn-cgi/styles/cf.errors.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sun, 09 May 2021 04:45:39 GMT x-content-type-options nosniff last-modified Fri, 07 May 2021 18:47:34 GMT server cloudflare etag "60958b46-1c4" x-frame-options DENY content-type image/png cache-control max-age=7200 public accept-ranges bytes cf-ray 64c8479439e24e37-FRA vary Accept-Encoding content-length 452 expires Sun, 09 May 2021 06:45:39 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Cloudflare (Online)

12 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated object| _cf_translation

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.sweethottiesyz.com/	1970-01-19 18:52:07	Name: __cfduid Value: d705e54a3877b4bd61a6344ee1fa8eafc1620535539

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

sweethottiesyz.com
www.xn--vrebropizza-98a.com
2606:4700:3031::ac43:d1b7
92.204.218.63
0796d812c48b2dcc2c8bdd2ddd8c4b0e264c6192d8fc7a1253b90ab8c995f69a
16fd28061d42cf29268600418d5aa26b585435027ca599a42141cbc820f2547c
37b2c46e6799bb7934c4ef9e163c06e543ce5d345d734c6e44e07a715624ea9a
f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016