xbdlvn.dateswonder.com
Open in
urlscan Pro
18.204.61.222
Malicious Activity!
Public Scan
Effective URL: https://xbdlvn.dateswonder.com/c/1c7da227ef4ea60e?click_id=miwjm677c5cb50001a7c7&j1=1&j2=&j3=&j4=&j5=&j9=1&lp=MJ&s1=222445&s2=2...
Submission: On January 06 via api from US — Scanned from US
Summary
TLS certificate: Issued by R11 on October 27th 2024. Valid for: 3 months.
This is the only time xbdlvn.dateswonder.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Porn Scam (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 14.128.15.148 14.128.15.148 | 136246 (TOMATTOST...) (TOMATTOSTL-AS-AP Tomattos Technologies Ltd.) | |
1 1 | 2600:9000:26f... 2600:9000:26fa:a200:1d:ab44:aa00:93a1 | 16509 (AMAZON-02) (AMAZON-02) | |
2 | 2600:9000:251... 2600:9000:2510:bc00:16:be1:6a80:93a1 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 2600:9000:26f... 2600:9000:26fa:ea00:1d:ab44:aa00:93a1 | 16509 (AMAZON-02) (AMAZON-02) | |
1 2 | 18.204.61.222 18.204.61.222 | 14618 (AMAZON-AES) (AMAZON-AES) | |
17 | 23.44.136.79 23.44.136.79 | 20940 (AKAMAI-AS...) (AKAMAI-ASN1 Akamai International B.V.) | |
1 | 104.17.25.14 104.17.25.14 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
22 | 5 |
ASN136246 (TOMATTOSTL-AS-AP Tomattos Technologies Ltd., BD)
linax2.free-live.co |
ASN14618 (AMAZON-AES, US)
PTR: ec2-18-204-61-222.compute-1.amazonaws.com
xbdlvn.dateswonder.com |
ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL)
PTR: a23-44-136-79.deploy.static.akamaitechnologies.com
cdn-dimi.akamaized.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
17 |
akamaized.net
cdn-dimi.akamaized.net — Cisco Umbrella Rank: 276474 |
714 KB |
2 |
dateswonder.com
1 redirects
xbdlvn.dateswonder.com |
8 KB |
2 |
go-fr-dt.com
go-fr-dt.com |
2 KB |
2 |
meetflirtmatch.com
1 redirects
meetflirtmatch.com |
2 KB |
1 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 225 |
1 KB |
1 |
free-live.co
1 redirects
linax2.free-live.co |
1 KB |
22 | 6 |
Domain | Requested by | |
---|---|---|
17 | cdn-dimi.akamaized.net |
xbdlvn.dateswonder.com
cdn-dimi.akamaized.net |
2 | xbdlvn.dateswonder.com |
1 redirects
meetflirtmatch.com
|
2 | go-fr-dt.com |
meetflirtmatch.com
|
2 | meetflirtmatch.com |
1 redirects
go-fr-dt.com
|
1 | cdnjs.cloudflare.com |
xbdlvn.dateswonder.com
|
1 | linax2.free-live.co | 1 redirects |
22 | 6 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
go-fr-dt.com Amazon RSA 2048 M02 |
2024-06-12 - 2025-07-11 |
a year | crt.sh |
meetflirtmatch.com Amazon RSA 2048 M03 |
2024-10-02 - 2025-10-31 |
a year | crt.sh |
*.dateswonder.com R11 |
2024-10-27 - 2025-01-25 |
3 months | crt.sh |
a248.e.akamai.net DigiCert TLS RSA SHA256 2020 CA1 |
2024-04-18 - 2025-04-19 |
a year | crt.sh |
cdnjs.cloudflare.com WE1 |
2024-11-26 - 2025-02-24 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://xbdlvn.dateswonder.com/c/1c7da227ef4ea60e?click_id=miwjm677c5cb50001a7c7&j1=1&j2=&j3=&j4=&j5=&j9=1&lp=MJ&s1=222445&s2=2031534&s3=sml_8ddbc82b&s5=
Frame ID: 17DD15F78B2DBA82CE5529653E752030
Requests: 22 HTTP requests in this frame
Screenshot
Page Title
LocalDatesPage URL History Show full URLs
-
https://linax2.free-live.co/
HTTP 301
https://meetflirtmatch.com/tds/ae?tdsId=s0792tok_r&tds_campaign=s0792tok&utm_sub=opnfnl&s1=ps&utm_sourc... HTTP 302
https://go-fr-dt.com/tds/interlayer/eb/s/8baf79c2c3e3b5da2d8b84159d4a0a83?__t=1736203444129&__l=3... Page URL
-
https://xbdlvn.dateswonder.com/?j1=1&s3=sml_8ddbc82b&s1=222445&s2=2031534&click_id=cdbec30396de8447b10fc27a...
HTTP 302
https://xbdlvn.dateswonder.com/c/1c7da227ef4ea60e?click_id=miwjm677c5cb50001a7c7&j1=1&j2=&j3=&j4=&j5=&j9=1&... Page URL
Detected technologies
Bootstrap (Web Frameworks) ExpandDetected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://linax2.free-live.co/
HTTP 301
https://meetflirtmatch.com/tds/ae?tdsId=s0792tok_r&tds_campaign=s0792tok&utm_sub=opnfnl&s1=ps&utm_source=int&affid=8ddbc82b&subid={VPM2}&clickid={550}&subid2={subid2} HTTP 302
https://go-fr-dt.com/tds/interlayer/eb/s/8baf79c2c3e3b5da2d8b84159d4a0a83?__t=1736203444129&__l=3600&__c=cdbec30396de8447b10fc27a138e2d084a41b414&__u= Page URL
-
https://xbdlvn.dateswonder.com/?j1=1&s3=sml_8ddbc82b&s1=222445&s2=2031534&click_id=cdbec30396de8447b10fc27a138e2d084a41b414&s5=%7BVPM2%7D&utm_source=e2905f55ec3a568b&j9=1
HTTP 302
https://xbdlvn.dateswonder.com/c/1c7da227ef4ea60e?click_id=miwjm677c5cb50001a7c7&j1=1&j2=&j3=&j4=&j5=&j9=1&lp=MJ&s1=222445&s2=2031534&s3=sml_8ddbc82b&s5= Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://linax2.free-live.co/ HTTP 301
- https://meetflirtmatch.com/tds/ae?tdsId=s0792tok_r&tds_campaign=s0792tok&utm_sub=opnfnl&s1=ps&utm_source=int&affid=8ddbc82b&subid={VPM2}&clickid={550}&subid2={subid2} HTTP 302
- https://go-fr-dt.com/tds/interlayer/eb/s/8baf79c2c3e3b5da2d8b84159d4a0a83?__t=1736203444129&__l=3600&__c=cdbec30396de8447b10fc27a138e2d084a41b414&__u=
22 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
8baf79c2c3e3b5da2d8b84159d4a0a83
go-fr-dt.com/tds/interlayer/eb/s/ Redirect Chain
|
905 B 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
index.js
meetflirtmatch.com/lp-external/ |
2 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
interlayer
go-fr-dt.com/tds/ |
0 497 B |
Ping
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
1c7da227ef4ea60e
xbdlvn.dateswonder.com/c/ Redirect Chain
|
31 KB 7 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bootstrap332.min.css
cdn-dimi.akamaized.net/landings/290508/1723635429/css/ |
103 KB 17 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
style.css
cdn-dimi.akamaized.net/landings/290508/1723635429/css/ |
45 KB 9 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.min.js
cdn-dimi.akamaized.net/landings/290508/1723635429/js/ |
85 KB 30 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.validate.min.js
cdn-dimi.akamaized.net/landings/290508/1723635429/js/ |
24 KB 8 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
main.js
cdn-dimi.akamaized.net/landings/290508/1723635429/js/ |
116 KB 33 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
newlogo_hd.png
cdn-dimi.akamaized.net/landings/290508/1723635429/images/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
1.jpg
cdn-dimi.akamaized.net/landings/290508/1723635429/images/ |
32 KB 33 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
2.jpg
cdn-dimi.akamaized.net/landings/290508/1723635429/images/ |
43 KB 43 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
3.jpg
cdn-dimi.akamaized.net/landings/290508/1723635429/images/ |
33 KB 33 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
4.jpg
cdn-dimi.akamaized.net/landings/290508/1723635429/images/ |
38 KB 38 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
5.jpg
cdn-dimi.akamaized.net/landings/290508/1723635429/images/ |
38 KB 39 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
6.jpg
cdn-dimi.akamaized.net/landings/290508/1723635429/images/ |
29 KB 30 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
one_night_stand.png
cdn-dimi.akamaized.net/landings/290508/1723635429/images/ |
868 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
fuckbuddy.png
cdn-dimi.akamaized.net/landings/290508/1723635429/images/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
discreet_affair.png
cdn-dimi.akamaized.net/landings/290508/1723635429/images/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
background.jpg
cdn-dimi.akamaized.net/landings/290508/1723635429/images/ |
388 KB 388 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
us.svg
cdnjs.cloudflare.com/ajax/libs/flag-icon-css/4.1.5/flags/4x3/ |
4 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
favicon.ico
cdn-dimi.akamaized.net/images/ |
4 KB 4 KB |
Other
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Porn Scam (Online)9 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| imiFinButClickSubscribe function| imiFinButSubscriberDone function| imiBBQAdd function| imiBB object| _rup function| $ function| jQuery object| formData string| k8 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.meetflirtmatch.com/ | Name: dci Value: 1a32e5dfdbdf58026ad29c187b085b0ec9994e59 |
|
meetflirtmatch.com/ | Name: dm Value: fe450dd0d1dadc615429144d33241f42 |
|
xbdlvn.dateswonder.com/ | Name: unique_id Value: 677c5b160008f5e5 |
|
xbdlvn.dateswonder.com/ | Name: unique_id2 Value: 677c5b16000b395e |
|
xbdlvn.dateswonder.com/ | Name: ref_token Value: 195527_222445 |
|
xbdlvn.dateswonder.com/ | Name: tid Value: miwjm677c5cb50001a7c7 |
|
xbdlvn.dateswonder.com/ | Name: 677c5b16000b395e_c Value: 2 |
|
xbdlvn.dateswonder.com/ | Name: 677c5b16000b395e_sl Value: [290508] |
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn-dimi.akamaized.net
cdnjs.cloudflare.com
go-fr-dt.com
linax2.free-live.co
meetflirtmatch.com
xbdlvn.dateswonder.com
104.17.25.14
14.128.15.148
18.204.61.222
23.44.136.79
2600:9000:2510:bc00:16:be1:6a80:93a1
2600:9000:26fa:a200:1d:ab44:aa00:93a1
2600:9000:26fa:ea00:1d:ab44:aa00:93a1
18d94c11cae06037bc8a0193cbb690b94fe58cea7771b73062ba3b9c384487b1
1df276a5c6aad589e3eb722a20f2491f9fd3cc5a2ad6a2a61928fffb553ae699
1f5ef8d69be2ffdc453b1129369ac3fb604083542b9156a7972e1acaeee06638
1ffe519cc782c2c8bc45a2436c14db80daed5e6c08dc3b32ea3e8a563f77efc1
270524b0d27afd1d3b6622d1a176c678daed94564c143297e217a63e21ce9820
3cb15758524c936862e63d815f4746eeb4ae18e4ddb062af37c4bcaad7e20213
4d654cf2ee4831fe0629b74ab6b718525ce760092db3aa44c906e8024b183dda
5d23fe80fad154372ab38323fddffcbe9d11ea3b4f0d4be9bd0ee067f288cae2
6f2c3686d3aedb862687d80861a706a842237ba9a2bc46609bfb628f679e814a
7e828c5e570b117c910de31c51f7cf9b4ca70fda96dda6e108b4cb18e75146bb
92764ca3bf1a032a09407e28bfcddb3054db468baeaa03cf34a707b71f64d377
9f5c632feed8f09f4a199f01209ba67b7b02bd2c7b651a6180ecb153725230af
b2dc9e1eee1078fedccfe49cfa0fd6299c33efc55801c390913a3d0528b3391a
b545372941b2eca91bc8deb1b28a241c5f2780ce720120b3c58223ac10ee6e3d
d5fc2e724c05cc3bafad0702df94444734e27dafca8cc0b33e4df40eb92ed450
dcc4bef3340603affe48f8fb64b7aafc3d9069cf1f6a4f2e63976ad6d9b30525
e5db71b4c3ecbaa2a634d0d638c1bd3aa61f7e5884d3d1466f030a4f181cd563
e66f2e0dee68319473c09eb9ae76f4b8752e901a4dfc0c6ef28049dd3f333526
fa576ebe176ba69c9ee4c794795cfb4afe59ef68f78b6085f6f2deb993dfd26a
fbfff44a653dc193b93620f1035d221d3aaddf3238742270b3385482986ef7f0
fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a