urlscan.io logo urlscan.io
SecurityTrails logo

nubabytop.biz Open in urlscan Pro
2a06:98c1:3121::7  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://qxhjwbmkfi3sr_click_now___mwtmkglmdo9ln.consrovenmozuc.ga/
Effective URL: http://nubabytop.biz/?s1=fhy1&s6=jessikast
Submission Tags: phishing malicious Search All
Submission: On March 30 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 1 IPs in 2 countries across 3 domains to perform 8 HTTP transactions. The main IP is 2a06:98c1:3121::7, located in United States and belongs to CLOUDFLARENET, US. The main domain is nubabytop.biz.
This is the only time nubabytop.biz was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 185.217.0.153 42237 (ICME)
8 2a06:98c1:312... 13335 (CLOUDFLAR...)
8 1
Apex Domain
Subdomains		 Transfer
7 nubabytop.biz
nubabytop.biz
74 KB
1 svntrk.com
svntrk.com — Cisco Umbrella Rank: 77239
609 B
1 consrovenmozuc.ga
qxhjwbmkfi3sr_click_now___mwtmkglmdo9ln.consrovenmozuc.ga
227 B
8 3
Domain Requested by
7 nubabytop.biz nubabytop.biz
1 svntrk.com nubabytop.biz
1 qxhjwbmkfi3sr_click_now___mwtmkglmdo9ln.consrovenmozuc.ga 1 redirects
8 3

This site contains no links.

Subject Issuer Validity Valid
*.svntrk.com
E1		 2022-02-07 -
2022-05-08		 3 months crt.sh

This page contains 1 frames:

Primary Page: http://nubabytop.biz/?s1=fhy1&s6=jessikast
Frame ID: EB9130B4F3C6CECC3DD663EEF87FE9C6
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Better than dating

Page URL History Show full URLs

  1. http://qxhjwbmkfi3sr_click_now___mwtmkglmdo9ln.consrovenmozuc.ga/ HTTP 302
    http://nubabytop.biz/?s1=fhy1&s6=jessikast Page URL

Detected technologies

Overall confidence: 100%
Detected patterns

Page Statistics

8
Requests

13 %
HTTPS

50 %
IPv6

3
Domains

3
Subdomains

1
IPs

2
Countries

74 kB
Transfer

140 kB
Size

4
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://qxhjwbmkfi3sr_click_now___mwtmkglmdo9ln.consrovenmozuc.ga/ HTTP 302
    http://nubabytop.biz/?s1=fhy1&s6=jessikast Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
nubabytop.biz/
Redirect Chain
  • http://qxhjwbmkfi3sr_click_now___mwtmkglmdo9ln.consrovenmozuc.ga/
  • http://nubabytop.biz/?s1=fhy1&s6=jessikast
4 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://nubabytop.biz/?s1=fhy1&s6=jessikast
Protocol
HTTP/1.1
Server
2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d8df14983ae89e4e2a1a0ecbfa61597c435f4b18dfb52b72339851615c0f51ce

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

Date
Wed, 30 Mar 2022 03:18:12 GMT
Content-Type
text/html; charset=UTF-8
Transfer-Encoding
chunked
Connection
keep-alive
cache-control
private, must-revalidate
pragma
no-cache
expires
-1
CF-Cache-Status
DYNAMIC
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qYdJ4ST8JlzlYJ2PYcRifng4MHFsDv4Be9OCmarFxp3UpoTlXEBFxqcA3TLVh0W7epwS2NQO0eLgp0zfawhn3yv6N6e3RYtBMaAcOnr7O32DwTjBWA4Qmvcscb1235%2FXtfox9ylsScwq7Fzk"}],"group":"cf-nel","max_age":604800}
NEL
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server
cloudflare
CF-RAY
6f3db25789a39975-FRA
Content-Encoding
gzip

Redirect headers

Server
nginx/1.14.2
Date
Wed, 30 Mar 2022 03:18:12 GMT
Content-Type
text/html; charset=UTF-8
Transfer-Encoding
chunked
Connection
keep-alive
Location
http://nubabytop.biz/?s1=fhy1&s6=jessikast
fhy1_6243cbf495a54.js
svntrk.com/assets/ 		0
609 B 		Script
General
Check archive.org
Download Go to
Full URL
https://svntrk.com/assets/fhy1_6243cbf495a54.js
Requested by
Host: nubabytop.biz
URL: http://nubabytop.biz/?s1=fhy1&s6=jessikast
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

date
Wed, 30 Mar 2022 03:18:12 GMT
content-encoding
br
cf-cache-status
BYPASS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IsDOj%2FcE5YZA0uRKiLkj%2Bvvqhe9JigKROybR%2FEFYcXL8BuscWynTWsgwL4GgOq%2FDbl4MRZtBv1Eshwx9JrZyx%2FZypldSk23qGPoudW4t13odG2rUYrCn6xjpzkS7fcuyyU%2BUKSmZqBb%2B"}],"group":"cf-nel","max_age":604800}
content-type
text/javascript; charset=UTF-8
cache-control
no-cache, private
cf-ray
6f3db259be0f9b77-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
vendor.css
nubabytop.biz/landings/2/fonts/ 		9 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://nubabytop.biz/landings/2/fonts/vendor.css
Requested by
Host: nubabytop.biz
URL: http://nubabytop.biz/?s1=fhy1&s6=jessikast
Protocol
HTTP/1.1
Server
2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7fb7eff1010d286e1f01b8a902a5e1d62cba36d37191ff5a77163027a155eac7

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

Date
Wed, 30 Mar 2022 03:18:13 GMT
Content-Encoding
gzip
CF-Cache-Status
EXPIRED
last-modified
Thu, 10 Mar 2022 11:34:47 GMT
Server
cloudflare
etag
W/"6229e257-22cb"
Vary
Accept-Encoding
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3frUJlOQsHjovGupSwUpDXo7QMJ09hA864wXRPPECUgfaCMR%2FoiS%2Bs7liw5cBHrKP3TS2NHur82sPYZk1hq1qcg9QF9MlMD6E0lEqrXg7zEhmAkdOhksxTW1cnfvk3zZiYFuxJoYZZRX32hX"}],"group":"cf-nel","max_age":604800}
Content-Type
text/css
Cache-Control
max-age=14400
Transfer-Encoding
chunked
Connection
keep-alive
CF-RAY
6f3db2598c639975-FRA
NEL
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vendor.js
nubabytop.biz/landings/2/js/ 		97 KB
34 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://nubabytop.biz/landings/2/js/vendor.js
Requested by
Host: nubabytop.biz
URL: http://nubabytop.biz/?s1=fhy1&s6=jessikast
Protocol
HTTP/1.1
Server
2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0cf2a33968a1f3efec0c5c9163a95ffdf0e86f5d4d0a919344f4f7834023a565

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

Date
Wed, 30 Mar 2022 03:18:13 GMT
Content-Encoding
gzip
CF-Cache-Status
REVALIDATED
last-modified
Thu, 10 Mar 2022 11:34:47 GMT
Server
cloudflare
etag
W/"6229e257-18475"
Vary
Accept-Encoding
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XUKY1%2FEHqzvLP5uDrNVoDtOknT0XvJJXZhUDBqTAWMkFOKdCnELcYoWiwO1HrwXU8NkIq8K1Yv0NVm0zCMQ%2BprBWk0hCidNSBCmOEOpPK2S4CtBumRNI%2BxYDEfNxt4UQVtCeo5Glk%2BmiQlB7"}],"group":"cf-nel","max_age":604800}
Content-Type
application/javascript; charset=utf-8
Cache-Control
max-age=14400
Transfer-Encoding
chunked
Connection
keep-alive
CF-RAY
6f3db2599d679177-FRA
NEL
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
image.jpg
nubabytop.biz/landings/2/img/ 		7 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://nubabytop.biz/landings/2/img/image.jpg
Requested by
Host: nubabytop.biz
URL: http://nubabytop.biz/?s1=fhy1&s6=jessikast
Protocol
HTTP/1.1
Server
2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
db43599b614a9d5e5d041ca09f15c1e522a84107d8deac4ec72834f2f746a8aa

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

Date
Wed, 30 Mar 2022 03:18:13 GMT
CF-Cache-Status
HIT
last-modified
Thu, 10 Mar 2022 11:34:35 GMT
Server
cloudflare
Age
4777
etag
"6229e24b-1a8e"
Vary
Accept-Encoding
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HV%2BcVl2AXr1xe%2FdzcNURbOTRf8jevcETwK25KXziiVzZm4tcaooa3MISpRT47FWY%2BHOKkdy7%2BD6V9RPFWsRjlcAK1KtwlJ%2BCUgAJGvLrPEDaBS0tHSdVnpBah51p3qW8MyuP1mg%2FOf4r2GtN"}],"group":"cf-nel","max_age":604800}
Content-Type
image/jpeg
Cache-Control
max-age=14400
NEL
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Connection
keep-alive
Accept-Ranges
bytes
CF-RAY
6f3db25baf339975-FRA
Content-Length
6798
bg-body.jpg
nubabytop.biz/landings/2/img/ 		22 KB
22 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://nubabytop.biz/landings/2/img/bg-body.jpg
Requested by
Host: nubabytop.biz
URL: http://nubabytop.biz/landings/2/fonts/vendor.css
Protocol
HTTP/1.1
Server
2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
945af3067da63cf0aa0fd8b08a207908030f1986bb1243419d31acb2a857bee0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://nubabytop.biz/landings/2/fonts/vendor.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

Date
Wed, 30 Mar 2022 03:18:13 GMT
CF-Cache-Status
EXPIRED
last-modified
Thu, 10 Mar 2022 11:34:47 GMT
Server
cloudflare
etag
"6229e257-571e"
Vary
Accept-Encoding
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6Icg16Dv9fKfUBS2hMl9QybInGnqQB9jYa8PTz0yzXIjDDrBDkAQCOGoK2fOXLIDrPTCWDG8PC0i9J7Gwrw9qOMlR8tN3vr2cAG8edceTEpuO21cZGIsVfJ9cidqtZz9fCqFDOvFCPjDeZ0k"}],"group":"cf-nel","max_age":604800}
Content-Type
image/jpeg
Cache-Control
max-age=14400
NEL
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Connection
keep-alive
Accept-Ranges
bytes
CF-RAY
6f3db25bef7e9975-FRA
Content-Length
22302
str.png
nubabytop.biz/landings/2/img/ 		540 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://nubabytop.biz/landings/2/img/str.png
Requested by
Host: nubabytop.biz
URL: http://nubabytop.biz/landings/2/fonts/vendor.css
Protocol
HTTP/1.1
Server
2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6461a9d26999e985b804ce022dde07e9ec43e969499f1db7a16b86f6a467f044

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://nubabytop.biz/landings/2/fonts/vendor.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

Date
Wed, 30 Mar 2022 03:18:13 GMT
CF-Cache-Status
REVALIDATED
last-modified
Thu, 10 Mar 2022 11:34:47 GMT
Server
cloudflare
etag
"6229e257-21c"
Vary
Accept-Encoding
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cPKEJnUvB6lwIfcHqnc1%2Fv1HNipqGFh71UpCOirZEBti5rxuIpkI0%2Fd1L4uclkU52stVA9mVYj9mh1QoXIQerqeHFB5u0xq9UJeOQ0JMtvurgUM66zgUzSeBy0xugg5o3xlnM%2F7NsrunLcXI"}],"group":"cf-nel","max_age":604800}
Content-Type
image/png
Cache-Control
max-age=14400
NEL
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Connection
keep-alive
Accept-Ranges
bytes
CF-RAY
6f3db25be80b9177-FRA
Content-Length
540
hand.png
nubabytop.biz/landings/2/img/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://nubabytop.biz/landings/2/img/hand.png
Requested by
Host: nubabytop.biz
URL: http://nubabytop.biz/landings/2/fonts/vendor.css
Protocol
HTTP/1.1
Server
2a06:98c1:3121::7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
77d88d67a0aaa08ea08edce9b4213aa220ddb3d26f1f014406b934479ce1ce88

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://nubabytop.biz/landings/2/fonts/vendor.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36

Response headers

Date
Wed, 30 Mar 2022 03:18:13 GMT
CF-Cache-Status
EXPIRED
last-modified
Thu, 10 Mar 2022 11:34:47 GMT
Server
cloudflare
etag
"6229e257-5fe"
Vary
Accept-Encoding
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RVpX6WNA17ev0LcLBD74feWXebq2ZI6S%2FBVwSVc8BYpvAJZ3xT9dblgenU407m3Ab04slWoUbTP2K71msifONN3Pr709%2B9rzRkDe73Y8zXMtGf3lTU06MYzNoAaWWFWsGDZHPUq9wXKAKVax"}],"group":"cf-nel","max_age":604800}
Content-Type
image/png
Cache-Control
max-age=14400
NEL
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Connection
keep-alive
Accept-Ranges
bytes
CF-RAY
6f3db25bffe0904f-FRA
Content-Length
1534

Verdicts & Comments Add Verdict or Comment

24 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| structuredClone object| oncontextlost object| oncontextrestored string| thirdParty string| r string| vl string| redirectURL function| openPopup function| clickButton function| nextStep function| getTimezone function| x64Add function| x64Multiply function| x64Rotl function| x64LeftShift function| x64Xor function| x64Fmix function| x64hash128 function| picassoCanvas function| picasso function| getVideoCardInfo function| $ function| jQuery string| ce

4 Cookies

Domain/Path Name / Value
nubabytop.biz/ Name: XSRF-TOKEN
Value: eyJpdiI6InVnWmFqcVY2bXdDQlQ3d01KeE1jWFE9PSIsInZhbHVlIjoiR3hqZk9HNkl3cytkU0lsa1g1Unc3aXEvZ0xKWTRhQ2pKOE94SFZOR1pwK1NtYlZLWkI4TFZOdlhLbm5scU1kaSIsIm1hYyI6ImI2OGI3NTVlNjFiZTE5NTcwZjk4ZWI2YzJiMmY3YWU5ZTgzNDc2ZWRkNjQyMmYxYTJlYjY0ZTI5ZDhhNjczNzUifQ%3D%3D
nubabytop.biz/ Name: laravel_session
Value: eyJpdiI6Im43Z3laOS9VbUQ0SkxOL1Q0SlZSZmc9PSIsInZhbHVlIjoiZnEwS1J2b1VpNmsxZzM0S0JDOW9JbDZKWnRmME9Sb3orcUh0alNpN0F4TnRrRUpZQk9zQjJsb2JHbHBzOHY2VSIsIm1hYyI6ImU5NDlhMDYwY2FlOTBlYmYzZjUwY2Y5ZDgwNzA3ZDExNTlmOWU4YWUyMDFiNmNmMGZhZDI0NmIzZDFhYTE4NjkifQ%3D%3D
nubabytop.biz/ Name: SRVNAME
Value: w2
svntrk.com/ Name: svnimp
Value: 6243cbf4c898a