befjajh.hornydats.com Open in urlscan Pro
178.162.199.80 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://bit.ly/3Ig9LW9
Effective URL:
https://befjajh.hornydats.com/s/62cf1c2230951
Submission: On February 20 via api (February 20th 2023, 9:10:56 am UTC) from BE — Scanned from DE

Summary HTTP 15 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 4 countries across 4 domains to perform 15 HTTP transactions. The main IP is 178.162.199.80, located in Germany and belongs to LEASEWEB-DE-FRA-10, DE. The main domain is befjajh.hornydats.com.
TLS certificate: Issued by R3 on February 11th 2023. Valid for: 3 months.

This is the only time befjajh.hornydats.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Porn Scam (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 1	67.199.248.10 67.199.248.10	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	103.212.229.26 103.212.229.26	21859 (ZEN-ECN) (ZEN-ECN)
2	46.161.40.116 46.161.40.116	209272 (AS-ALVIVA) (AS-ALVIVA)
12	178.162.199.80 178.162.199.80	28753 (LEASEWEB-...) (LEASEWEB-DE-FRA-10)
15	3

1 67.199.248.10 (United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: bit.ly

bit.ly	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 103.212.229.26 (China)

ASN21859 (ZEN-ECN, US)

28jjd.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 46.161.40.116 (Tighina, Moldova)

ASN209272 (AS-ALVIVA, SC)
PTR: hosting-by.ankas-group.net

loveandflirts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 178.162.199.80 (Germany)

ASN28753 (LEASEWEB-DE-FRA-10, DE)

befjajh.hornydats.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	hornydats.com befjajh.hornydats.com	388 KB
2	loveandflirts.com loveandflirts.com	1 KB
1	28jjd.com 28jjd.com	343 B
1	bit.ly 1 redirects bit.ly — Cisco Umbrella Rank: 5284	275 B
15	4

	Domain	Requested by
12	befjajh.hornydats.com	loveandflirts.com befjajh.hornydats.com
2	loveandflirts.com	loveandflirts.com
1	28jjd.com
1	bit.ly	1 redirects
15	4

This site contains no links.

Subject Issuer	Validity	Valid
hornydats.com R3	`2023-02-11` - `2023-05-12`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://befjajh.hornydats.com/s/62cf1c2230951
Frame ID: D06CE9CE3B2B5B5980D1486563E88EFA
Requests: 15 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Die beliebtesten Dating-Website des Monats

Page URL History Show full URLs

https://bit.ly/3Ig9LW9 HTTP 301
http://28jjd.com/wp-content/plugins/Uwogh-Segs/chelicere/bigness_chloroplast.html?if=6tsp Page URL
http://loveandflirts.com/love1/index.html Page URL
https://befjajh.hornydats.com/s/62cf1c2230951 Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

animate.css (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link [^>]+(?:/([\d.]+)/)?animate\.(?:min\.)?css

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

15
Requests

80 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

3
IPs

4
Countries

390 kB
Transfer

387 kB
Size

3
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://bit.ly/3Ig9LW9 HTTP 301
http://28jjd.com/wp-content/plugins/Uwogh-Segs/chelicere/bigness_chloroplast.html?if=6tsp Page URL
http://loveandflirts.com/love1/index.html Page URL
https://befjajh.hornydats.com/s/62cf1c2230951 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://bit.ly/3Ig9LW9 HTTP 301
http://28jjd.com/wp-content/plugins/Uwogh-Segs/chelicere/bigness_chloroplast.html?if=6tsp

15 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	bigness_chloroplast.html Show response 28jjd.com/wp-content/plugins/Uwogh-Segs/chelicere/ Redirect Chain https://bit.ly/3Ig9LW9 http://28jjd.com/wp-content/plugins/Uwogh-Segs/chelicere/bigness_chloroplast.html?if=6tsp	113 B 343 B	335ms 162ms	Document text/html	103.212.229.26 ZEN-ECN
General Check archive.org Show headers Download Go to Full URL http://28jjd.com/wp-content/plugins/Uwogh-Segs/chelicere/bigness_chloroplast.html?if=6tsp Protocol HTTP/1.1 Server 103.212.229.26 , China, ASN21859 (ZEN-ECN, US), Reverse DNS Software nginx / Resource Hash `ae547aacec8769c3c26efa0f50de5ab8da569ba05a1dbed9313953ab3775b24e` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Accept-Ranges bytes Connection keep-alive Content-Length 113 Content-Type text/html Date Mon, 20 Feb 2023 09:08:40 GMT ETag "63992349-71" Last-Modified Wed, 14 Dec 2022 01:13:45 GMT Server nginx Redirect headers alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 cache-control private, max-age=90 content-length 176 content-type text/html; charset=utf-8 date Mon, 20 Feb 2023 09:10:49 GMT location http://28jjd.com/wp-content/plugins/Uwogh-Segs/chelicere/bigness_chloroplast.html?if=6tsp server nginx via 1.1 google
GET H/1.1	200 OK	index.html Show response loveandflirts.com/love1/	124 B 473 B	231ms 79ms	Document text/html	46.161.40.116 AS-ALVIVA
General Check archive.org Show headers Download Go to Full URL http://loveandflirts.com/love1/index.html Protocol HTTP/1.1 Server 46.161.40.116 Tighina, Moldova, ASN209272 (AS-ALVIVA, SC), Reverse DNS hosting-by.ankas-group.net Software Apache/2 / Resource Hash `b8dda5bb93956f0e7ed6648828517825c31cf1efc1d237631ea07670caefa13c` Request headers Referer http://28jjd.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Accept-Ranges bytes Connection Upgrade, Keep-Alive Content-Encoding gzip Content-Length 114 Content-Type text/html Date Mon, 20 Feb 2023 09:10:50 GMT ETag "7c-5c33f97483100-gzip" Keep-Alive timeout=2, max=100 Last-Modified Wed, 26 May 2021 18:12:52 GMT Server Apache/2 Upgrade h2,h2c Vary Accept-Encoding,User-Agent
GET H/1.1	200 OK	obfuscated_redirect.js Show response loveandflirts.com/love1/	1 KB 980 B	74ms 74ms	Script application/javascript	46.161.40.116 AS-ALVIVA
General Check archive.org Show headers Download Go to Full URL http://loveandflirts.com/love1/obfuscated_redirect.js Requested by Host: loveandflirts.com URL: http://loveandflirts.com/love1/index.html Protocol HTTP/1.1 Server 46.161.40.116 Tighina, Moldova, ASN209272 (AS-ALVIVA, SC), Reverse DNS hosting-by.ankas-group.net Software Apache/2 / Resource Hash `a4ee9b5362c7fd6518138e14e557035d370bc8e907502bdc4e7bcffdde6c83f7` Request headers accept-language de-DE,de;q=0.9 Referer http://loveandflirts.com/love1/index.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers Date Mon, 20 Feb 2023 09:10:50 GMT Content-Encoding gzip Last-Modified Wed, 03 Aug 2022 18:28:24 GMT Server Apache/2 ETag "4d1-5e55a65f62200-gzip" Vary Accept-Encoding,User-Agent Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=2, max=99 Content-Length 634
GET H/1.1	200 OK	Primary Request 62cf1c2230951 Show response befjajh.hornydats.com/s/	4 KB 4 KB	858ms 652ms	Document text/html	178.162.199.80 LEASEWEB-DE-FRA-10
General Check archive.org Show headers Download Go to Full URL https://befjajh.hornydats.com/s/62cf1c2230951 Requested by Host: loveandflirts.com URL: http://loveandflirts.com/love1/obfuscated_redirect.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 178.162.199.80 , Germany, ASN28753 (LEASEWEB-DE-FRA-10, DE), Reverse DNS Software openresty/1.19.3.1 / Resource Hash `39a9591e2e2a21a75393b0b6a5e8dc2647b0a3269abad406fd96580409015547` Request headers Referer http://loveandflirts.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Connection keep-alive Content-Encoding gzip Content-Type text/html; charset=UTF-8 Date Mon, 20 Feb 2023 09:10:54 GMT Server openresty/1.19.3.1 Transfer-Encoding chunked Vary Accept-Encoding
GET H/1.1	200 OK	animate.min.css befjajh.hornydats.com/bundle/18/assets/css/	52 KB 52 KB	40ms 39ms	Stylesheet text/css	178.162.199.80 LEASEWEB-DE-FRA-10
General Check archive.org Show headers Download Go to Full URL https://befjajh.hornydats.com/bundle/18/assets/css/animate.min.css Requested by Host: befjajh.hornydats.com URL: https://befjajh.hornydats.com/s/62cf1c2230951 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 178.162.199.80 , Germany, ASN28753 (LEASEWEB-DE-FRA-10, DE), Reverse DNS Software openresty/1.19.3.1 / Resource Hash `8fe3fa119255adb5e0c12479331f9e092e85bcff56ab6ecc0510bfa2056b898d` Request headers accept-language de-DE,de;q=0.9 Referer https://befjajh.hornydats.com/s/62cf1c2230951 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers Date Mon, 20 Feb 2023 09:10:54 GMT Last-Modified Wed, 28 Mar 2018 09:33:42 GMT Server openresty/1.19.3.1 ETag "5abb6176-ce35" Vary Accept-Encoding Content-Type text/css Connection keep-alive Accept-Ranges bytes Content-Length 52789
GET H/1.1	200 OK	style.css befjajh.hornydats.com/bundle/18/assets/css/	14 KB 15 KB	80ms 40ms	Stylesheet text/css	178.162.199.80 LEASEWEB-DE-FRA-10
General Check archive.org Show headers Download Go to Full URL https://befjajh.hornydats.com/bundle/18/assets/css/style.css Requested by Host: befjajh.hornydats.com URL: https://befjajh.hornydats.com/s/62cf1c2230951 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 178.162.199.80 , Germany, ASN28753 (LEASEWEB-DE-FRA-10, DE), Reverse DNS Software openresty/1.19.3.1 / Resource Hash `623cd33a00c598dfe9d63cb47e5798ecc598684f998f5e2eaf210513dbbd330c` Request headers accept-language de-DE,de;q=0.9 Referer https://befjajh.hornydats.com/s/62cf1c2230951 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers Date Mon, 20 Feb 2023 09:10:54 GMT Last-Modified Wed, 28 Mar 2018 09:33:42 GMT Server openresty/1.19.3.1 ETag "5abb6176-39d1" Vary Accept-Encoding Content-Type text/css Connection keep-alive Accept-Ranges bytes Content-Length 14801
GET H/1.1	200 OK	jquery-2.2.4.min.js Show response befjajh.hornydats.com/bundle/18/assets/js/	84 KB 84 KB	81ms 41ms	Script application/javascript	178.162.199.80 LEASEWEB-DE-FRA-10
General Check archive.org Show headers Download Go to Full URL https://befjajh.hornydats.com/bundle/18/assets/js/jquery-2.2.4.min.js Requested by Host: befjajh.hornydats.com URL: https://befjajh.hornydats.com/s/62cf1c2230951 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 178.162.199.80 , Germany, ASN28753 (LEASEWEB-DE-FRA-10, DE), Reverse DNS Software openresty/1.19.3.1 / Resource Hash `05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e` Request headers accept-language de-DE,de;q=0.9 Referer https://befjajh.hornydats.com/s/62cf1c2230951 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers Date Mon, 20 Feb 2023 09:10:54 GMT Last-Modified Wed, 28 Mar 2018 09:33:42 GMT Server openresty/1.19.3.1 ETag "5abb6176-14e4a" Vary Accept-Encoding Content-Type application/javascript Connection keep-alive Accept-Ranges bytes Content-Length 85578
GET H/1.1	200 OK	js.js Show response befjajh.hornydats.com/bundle/18/assets/js/	650 B 930 B	62ms 21ms	Script application/javascript	178.162.199.80 LEASEWEB-DE-FRA-10
General Check archive.org Show headers Download Go to Full URL https://befjajh.hornydats.com/bundle/18/assets/js/js.js Requested by Host: befjajh.hornydats.com URL: https://befjajh.hornydats.com/s/62cf1c2230951 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 178.162.199.80 , Germany, ASN28753 (LEASEWEB-DE-FRA-10, DE), Reverse DNS Software openresty/1.19.3.1 / Resource Hash `61578380385ef83a3ad40c2a0d5d0bad8ff6713845848098e70591ab20f0ce40` Request headers accept-language de-DE,de;q=0.9 Referer https://befjajh.hornydats.com/s/62cf1c2230951 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers Date Mon, 20 Feb 2023 09:10:54 GMT Last-Modified Wed, 28 Mar 2018 09:33:42 GMT Server openresty/1.19.3.1 ETag "5abb6176-28a" Vary Accept-Encoding Content-Type application/javascript Connection keep-alive Accept-Ranges bytes Content-Length 650
GET H/1.1	200 OK	click.js Show response befjajh.hornydats.com/js/	6 KB 7 KB	21ms 21ms	Script application/javascript	178.162.199.80 LEASEWEB-DE-FRA-10
General Check archive.org Show headers Download Go to Full URL https://befjajh.hornydats.com/js/click.js?9 Requested by Host: befjajh.hornydats.com URL: https://befjajh.hornydats.com/s/62cf1c2230951 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 178.162.199.80 , Germany, ASN28753 (LEASEWEB-DE-FRA-10, DE), Reverse DNS Software openresty/1.19.3.1 / Resource Hash `b9f1c39a20a76c81597029e11b2592c3ab1f7f90234a08f9eaab5bb0555d5cbc` Request headers accept-language de-DE,de;q=0.9 Referer https://befjajh.hornydats.com/s/62cf1c2230951 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers Date Mon, 20 Feb 2023 09:10:54 GMT Last-Modified Thu, 16 Feb 2023 14:18:57 GMT Server openresty/1.19.3.1 ETag "63ee3b51-1904" Vary Accept-Encoding Content-Type application/javascript Connection keep-alive Accept-Ranges bytes Content-Length 6404
GET H/1.1	200 OK	fp2.min.js Show response befjajh.hornydats.com/js/	30 KB 30 KB	21ms 21ms	Script application/javascript	178.162.199.80 LEASEWEB-DE-FRA-10
General Check archive.org Show headers Download Go to Full URL https://befjajh.hornydats.com/js/fp2.min.js Requested by Host: befjajh.hornydats.com URL: https://befjajh.hornydats.com/js/click.js?9 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 178.162.199.80 , Germany, ASN28753 (LEASEWEB-DE-FRA-10, DE), Reverse DNS Software openresty/1.19.3.1 / Resource Hash `6e1bf43d1d49858aacd5de53b32b551732bca4b2a46b1f808eb6d6d0f2b70c0e` Request headers accept-language de-DE,de;q=0.9 Referer https://befjajh.hornydats.com/s/62cf1c2230951 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers Date Mon, 20 Feb 2023 09:10:54 GMT Last-Modified Thu, 16 Feb 2023 14:18:57 GMT Server openresty/1.19.3.1 ETag "63ee3b51-77dd" Vary Accept-Encoding Content-Type application/javascript Connection keep-alive Accept-Ranges bytes Content-Length 30685
GET H/1.1	200 OK	no.png befjajh.hornydats.com/bundle/18/assets/img/	322 B 566 B	21ms 20ms	Image image/png	178.162.199.80 LEASEWEB-DE-FRA-10
General Check archive.org Show headers Download Go to Show image Full URL https://befjajh.hornydats.com/bundle/18/assets/img/no.png Requested by Host: befjajh.hornydats.com URL: https://befjajh.hornydats.com/bundle/18/assets/css/style.css Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 178.162.199.80 , Germany, ASN28753 (LEASEWEB-DE-FRA-10, DE), Reverse DNS Software openresty/1.19.3.1 / Resource Hash `855f62c34d296773b690bcd61d702db042b6085294928d1f7064c022b47d2695` Request headers accept-language de-DE,de;q=0.9 Referer https://befjajh.hornydats.com/bundle/18/assets/css/style.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers Date Mon, 20 Feb 2023 09:10:54 GMT Last-Modified Wed, 28 Mar 2018 09:33:42 GMT Server openresty/1.19.3.1 ETag "5abb6176-142" Content-Type image/png Connection keep-alive Accept-Ranges bytes Content-Length 322
GET H/1.1	200 OK	yes.png befjajh.hornydats.com/bundle/18/assets/img/	594 B 838 B	22ms 21ms	Image image/png	178.162.199.80 LEASEWEB-DE-FRA-10
General Check archive.org Show headers Download Go to Show image Full URL https://befjajh.hornydats.com/bundle/18/assets/img/yes.png Requested by Host: befjajh.hornydats.com URL: https://befjajh.hornydats.com/bundle/18/assets/css/style.css Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 178.162.199.80 , Germany, ASN28753 (LEASEWEB-DE-FRA-10, DE), Reverse DNS Software openresty/1.19.3.1 / Resource Hash `3e80058e1e64f3e5085e47096d373ae6b74987d494aec75b3f67872706569ef4` Request headers accept-language de-DE,de;q=0.9 Referer https://befjajh.hornydats.com/bundle/18/assets/css/style.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers Date Mon, 20 Feb 2023 09:10:54 GMT Last-Modified Wed, 28 Mar 2018 09:33:42 GMT Server openresty/1.19.3.1 ETag "5abb6176-252" Content-Type image/png Connection keep-alive Accept-Ranges bytes Content-Length 594
GET H/1.1	200 OK	1.jpg befjajh.hornydats.com/bundle/18/assets/img/	76 KB 77 KB	21ms 20ms	Image image/jpeg	178.162.199.80 LEASEWEB-DE-FRA-10
General Check archive.org Show headers Download Go to Show image Full URL https://befjajh.hornydats.com/bundle/18/assets/img/1.jpg Requested by Host: befjajh.hornydats.com URL: https://befjajh.hornydats.com/bundle/18/assets/css/style.css Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 178.162.199.80 , Germany, ASN28753 (LEASEWEB-DE-FRA-10, DE), Reverse DNS Software openresty/1.19.3.1 / Resource Hash `6a81a25ca7fec3b6540c76f8da05d0be2b75103cd3d2066e70eeba35bb9315cd` Request headers accept-language de-DE,de;q=0.9 Referer https://befjajh.hornydats.com/bundle/18/assets/css/style.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers Date Mon, 20 Feb 2023 09:10:54 GMT Last-Modified Wed, 28 Mar 2018 09:33:42 GMT Server openresty/1.19.3.1 ETag "5abb6176-1316d" Content-Type image/jpeg Connection keep-alive Accept-Ranges bytes Content-Length 78189
GET H/1.1	200 OK	pattern.png befjajh.hornydats.com/bundle/18/assets/img/	100 B 343 B	43ms 20ms	Image image/png	178.162.199.80 LEASEWEB-DE-FRA-10
General Check archive.org Show headers Download Go to Show image Full URL https://befjajh.hornydats.com/bundle/18/assets/img/pattern.png Requested by Host: befjajh.hornydats.com URL: https://befjajh.hornydats.com/bundle/18/assets/css/style.css Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 178.162.199.80 , Germany, ASN28753 (LEASEWEB-DE-FRA-10, DE), Reverse DNS Software openresty/1.19.3.1 / Resource Hash `13de289b7d770632c2b87d7019cdb10416061bcdb50f07cadcc5e4c6cdf33a36` Request headers accept-language de-DE,de;q=0.9 Referer https://befjajh.hornydats.com/bundle/18/assets/css/style.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers Date Mon, 20 Feb 2023 09:10:54 GMT Last-Modified Wed, 28 Mar 2018 09:33:42 GMT Server openresty/1.19.3.1 ETag "5abb6176-64" Content-Type image/png Connection keep-alive Accept-Ranges bytes Content-Length 100
GET H/1.1	200 OK	Lato-Regular.ttf befjajh.hornydats.com/bundle/18/assets/fonts/	117 KB 118 KB	40ms 21ms	Font application/octet-stream	178.162.199.80 LEASEWEB-DE-FRA-10
General Check archive.org Show headers Download Go to Full URL https://befjajh.hornydats.com/bundle/18/assets/fonts/Lato-Regular.ttf Requested by Host: befjajh.hornydats.com URL: https://befjajh.hornydats.com/bundle/18/assets/css/style.css Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 178.162.199.80 , Germany, ASN28753 (LEASEWEB-DE-FRA-10, DE), Reverse DNS Software openresty/1.19.3.1 / Resource Hash `7ae714b63c2c8b940bdd211a0cc678f01168a34eea8aa13c0df25364f29238a7` Request headers Referer https://befjajh.hornydats.com/bundle/18/assets/css/style.css Origin https://befjajh.hornydats.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers Date Mon, 20 Feb 2023 09:10:54 GMT Last-Modified Wed, 28 Mar 2018 09:33:42 GMT Server openresty/1.19.3.1 ETag "5abb6176-1d584" Content-Type application/octet-stream Connection keep-alive Accept-Ranges bytes Content-Length 120196

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Porn Scam (Online)

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.bit.ly/	1970-01-20 14:07:16	Name: _bit Value: n1k9aN-1a8ca26a59bf606834-003
.hornydats.com/	1970-01-20 09:49:30	Name: s Value: DDDMEpVx3yXnI4aQIcc81iSb0XRS4LIcJxMbzv57b4tjl65Uxgz75NOZ0GzdZgvTKVqLjfWhiOvWPT0tdkiUlSB%2BNvkRH6NV%2FTdQQiJzjdAl1ySYcHdcp3qkLX7wQRrgDeEzZAWohP6vvHsz%2F%2BoQNo%2FpVO0ivhIJ%2BHS77oJhJ97nviKoNbn5IAhVddIuqI9W52T5RR%2B%2BU8YPmd3eml2mEFtzCbKcSgJ2F1QlQDUlRvXQGEWUiKBLebKgHKomJ9ARQkqa6cyv%2BWzVCoKosErk1hI6o6ZqfYldejyzKgLrTpa3eahQLlWG9VGaXQcMhXpG4GTDWaH64JdFzI3nT%2FSUX%2FmA832TRLjhbD5BVKMLqzLzFsVlA3ig7UDhgGrjkHma3M0msK9Baov85eThduKj3jZ8kb2Y49P1CS40NwdjzVdLm0g2QjDkX3wIw0axiZz3jeYRa7ZwEkFQ6xretwkghNbdcCfWbNbSlYcXHaepFzlpbbQqknEWHgmfg89UEXYFuXkBhpK%2FKV%2Bd8MTIENwe2mVvuull7WL%2Fuy2DQP%2FiquzVeKSUHXltbSLjZCnj0g4%2BzfcKUmtRDBhF9I3y7UWnOh%2BIXhABbuh1VpzL%2Bm1yijmCkF9FQr0De1kpZlwG7sfgCbnUHfL1dxM3Y%2F9dytznWxHC4nx2ioiQy0f01HY889DM2U%2FXQqVHW9i45REtY1xIQUYdDfctqYZSQDNZAasJ89y4goVxxJlcJA0E1KnXiY0DyznMkDpXP%2BBJ1BGtYNkKuKhT6ufYlnJqxVlFxN7HfUT1g5rrYOrSzhVzdozUaaDrykuscAZ9rNeqvbpIWpnn5WXuO2pNOcHegTYCCP2Rims7InhH7vISQvI%2FVd9qs7V%2Flx7nlQkNAIvhXSlWm4j3dXXdK%2Fne0iUF4MxPUSC49nAdkE8F3TE3e4TwwluXw%2BeHuQ7UlJewxshvyVpWtO0jtvvLY1Z8YqkFItaVFISnG3wcsirORwpKs0RDSWoNyuNBhU6w0t9tJn%2FRU85qABTS2bBFyF3s9jojNqzRqx4K8USeJUDbC9aD8YadOIow5Md0Gp8L%2F8tHx5zn%2F0CGRf8y%2BbCbyuKTmBUHNmfRkNCdLuGgZhZMwPCpzKFSDLuZ6lwpdQ%2BOvNgASrlSnQqguV7ehwtDWp5iEYRtuuyrYzn74lsv7eyb8z52Yghn60wjB0aguP6He1yRAENZoLyQhzlNp3f9XMD7cnirOV6nz0Y8aEqAW%2FDV90nGYLMabffK1jmmFX27%2F8JEK2v0lK365YxKn%2FaH5ABfI4k3kqiJHqVuhLyukBIfuh6%2BXtAC4mcJlXtdsVLbzRu1MrpJ3LYq1Dq9nhHUhMTya9BfY0ab%2F7pudIY3xU%2FjO5MR72jP1dY10DY4anekKhMLOFsBGYZ4fWzY6yBFeetAM3YAda30XTyhL61qRYR5pHH2c8sZhXx%2Bt6tEzoof5DxjUioARGqg0AMkRtV9T8ZY%2FZt8VFtGMnO1NBl9V51Y2dSpbhgDwJdb%2FAzQzl4jgH8Kf31sWnbL8ivy8zw3ip8G47Ha3ABI3flqgRyJ3Nl8eyAmZrV7Vhh9PlNLEa%2Fb1G%2BVSTk95lbs8ndYcGh8Qr6cIf8AKs5iNFe9dGQ0lYaRmImG%2BTWtGGWYx5SrGF%2FjHKaFsGwl8c9BL5Y%3D
befjajh.hornydats.com/	1969-12-31 23:59:59	Name: CF Value: SH4qXQNHwbcm2fkmBbIG0A__

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

28jjd.com
befjajh.hornydats.com
bit.ly
loveandflirts.com
103.212.229.26
178.162.199.80
46.161.40.116
67.199.248.10
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
13de289b7d770632c2b87d7019cdb10416061bcdb50f07cadcc5e4c6cdf33a36
39a9591e2e2a21a75393b0b6a5e8dc2647b0a3269abad406fd96580409015547
3e80058e1e64f3e5085e47096d373ae6b74987d494aec75b3f67872706569ef4
61578380385ef83a3ad40c2a0d5d0bad8ff6713845848098e70591ab20f0ce40
623cd33a00c598dfe9d63cb47e5798ecc598684f998f5e2eaf210513dbbd330c
6a81a25ca7fec3b6540c76f8da05d0be2b75103cd3d2066e70eeba35bb9315cd
6e1bf43d1d49858aacd5de53b32b551732bca4b2a46b1f808eb6d6d0f2b70c0e
7ae714b63c2c8b940bdd211a0cc678f01168a34eea8aa13c0df25364f29238a7
855f62c34d296773b690bcd61d702db042b6085294928d1f7064c022b47d2695
8fe3fa119255adb5e0c12479331f9e092e85bcff56ab6ecc0510bfa2056b898d
a4ee9b5362c7fd6518138e14e557035d370bc8e907502bdc4e7bcffdde6c83f7
ae547aacec8769c3c26efa0f50de5ab8da569ba05a1dbed9313953ab3775b24e
b8dda5bb93956f0e7ed6648828517825c31cf1efc1d237631ea07670caefa13c
b9f1c39a20a76c81597029e11b2592c3ab1f7f90234a08f9eaab5bb0555d5cbc

befjajh.hornydats.com Open in urlscan Pro 178.162.199.80 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

15 Requests

80 %HTTPS

0 %IPv6

4 Domains

4 Subdomains

3 IPs

4 Countries

390 kBTransfer

387 kBSize

3 Cookies

0 Outgoing links

Page URL History

Redirected requests

15 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

13 JavaScript Global Variables

3 Cookies

Indicators

befjajh.hornydats.com Open in urlscan Pro
178.162.199.80 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

15
Requests

80 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

3
IPs

4
Countries

390 kB
Transfer

387 kB
Size

3
Cookies

15 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!