befjajh.flirtosmart.com
81.30.157.12 Malicious Activity! Public Scan Open in urlscan Pro

Go To Rescan
Add Verdict Report

Submitted URL:
https://is.gd/QJB07D 12yr old
Effective URL:
https://befjajh.flirtosmart.com/s/42cf1c2250951 1yr old
Submission: On September 27 via manual (September 27th 2025, 9:48:29 pm UTC) from DE — Scanned from DE

Summary HTTP 13 Redirects Behaviour Indicators

Summary

This website contacted 6 IPs in 4 countries across 8 domains to perform 13 HTTP transactions. The main IP is 81.30.157.12, located in Germany and belongs to MYLOC-AS WIIT AG, DE. The main domain is befjajh.flirtosmart.com. 1yr old
TLS certificate: Issued by R13 on September 4th 2025. Valid for: 3mo.

This is the only time befjajh.flirtosmart.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Porn Scam (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 1	172.67.83.132 172.67.83.132	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	94.23.99.218 94.23.99.218	16276 (OVH OVH SAS) (OVH OVH SAS)
2	88.214.27.56 88.214.27.56	209272 (AS-ALVIVA...) (AS-ALVIVA Alviva Holding Limited)
1	13.32.99.33 13.32.99.33	16509 (AMAZON-02) (AMAZON-02)
7	81.30.157.12 81.30.157.12	24961 (MYLOC-AS ...) (MYLOC-AS WIIT AG)
1	104.18.0.22 104.18.0.22	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	142.250.186.170 142.250.186.170	15169 (GOOGLE) (GOOGLE)
1	142.250.185.131 142.250.185.131	15169 (GOOGLE) (GOOGLE)
13	6

1 172.67.83.132 (Ascension Island) 1 redirects

ASN13335 (CLOUDFLARENET, US)

is.gd 12yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 94.23.99.218 (France) 1 redirects

ASN16276 (OVH OVH SAS, FR)
PTR: ip218.ip-94-23-99.eu

medialead.de 13yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

2 88.214.27.56 (Germany)

ASN209272 (AS-ALVIVA Alviva Holding Limited, SC)

tdzebli.com 8mo old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 13.32.99.33 (New York, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-99-33.fra60.r.cloudfront.net

openfpcdn.io 4yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

7 81.30.157.12 (Germany)

ASN24961 (MYLOC-AS WIIT AG, DE)
PTR: srv11409.dus4.dedicated.server-hosting.expert

befjajh.flirtosmart.com 1yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 104.18.0.22 (Ascension Island)

ASN13335 (CLOUDFLARENET, US)

unpkg.com 10yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 142.250.186.170 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s08-in-f10.1e100.net

fonts.googleapis.com 56yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

1 142.250.185.131 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s50-in-f3.1e100.net

fonts.gstatic.com 9yr old	Domain lookup VirusTotal SecurityTrails crt.sh Domaintools

	Apex Domain Subdomains	Transfer
7	flirtosmart.com befjajh.flirtosmart.com 1yr old	1 MB
2	tdzebli.com tdzebli.com 8mo old	2 KB
1	gstatic.com fonts.gstatic.com 9yr old	18 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 45 56yr old	1 KB
1	unpkg.com unpkg.com — Cisco Umbrella Rank: 730 10yr old	7 KB
1	openfpcdn.io openfpcdn.io — Cisco Umbrella Rank: 13847 4yr old	5 KB
1	medialead.de 1 redirects medialead.de — Cisco Umbrella Rank: 88027 13yr old	886 B
1	is.gd 1 redirects is.gd — Cisco Umbrella Rank: 178722 12yr old	435 B
13	8

	Domain	Requested by
7	befjajh.flirtosmart.com	tdzebli.com befjajh.flirtosmart.com
2	tdzebli.com
1	fonts.gstatic.com	fonts.googleapis.com
1	fonts.googleapis.com	befjajh.flirtosmart.com
1	unpkg.com	befjajh.flirtosmart.com
1	openfpcdn.io	tdzebli.com
1	medialead.de	1 redirects
1	is.gd	1 redirects
13	8

This site contains no links.

Subject Issuer	Validity	Valid
tdzebli.com Sectigo Public Server Authentication CA DV E36	`2025-08-13` - `2026-08-13`	1yr	crt.sh
openfpcdn.io Amazon RSA 2048 M02	`2024-11-27` - `2025-12-27`	1yr	crt.sh
flirtosmart.com R13	`2025-09-04` - `2025-12-03`	3mo	crt.sh
unpkg.com WE1	`2025-08-25` - `2025-11-23`	3mo	crt.sh
upload.video.google.com WE2	`2025-09-08` - `2025-12-01`	3mo	crt.sh
*.gstatic.com WE2	`2025-09-08` - `2025-12-01`	3mo	crt.sh

This page contains 1 frames:

Primary Page: https://befjajh.flirtosmart.com/s/42cf1c2250951
Frame ID: 158D76C9E0B31D0A31A55ADBDC88BEA7
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Warning

This screenshot might contain NSFW content. Hover to show image.

Page Title

Die beliebtesten Dating-Website des Monats

Page URL History Show full URLs

https://is.gd/QJB07D HTTP 301
https://medialead.de/trck/eclick/b14e29c4436a70df0adb51eebb5d3bae?url=%68ttps%3A%2F%2F%74d%7A%65%... HTTP 301
https://tdzebli.com/1/?emid=68d85baeb4c27501df0e02d1 Page URL
https://befjajh.flirtosmart.com/s/42cf1c2250951 Page URL

Detected technologies

jQuery (JavaScript libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

13
Requests

100 %
HTTPS

0 %
IPv6

8
Domains

8
Subdomains

6
IPs

4
Countries

1070 kB
Transfer

1183 kB
Size

4
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://is.gd/QJB07D HTTP 301
https://medialead.de/trck/eclick/b14e29c4436a70df0adb51eebb5d3bae?url=%68ttps%3A%2F%2F%74d%7A%65%62%6C%69%2Ec%6F%6D%2F%31%2F%23%5A%79%6B%39%34%7A%5F%56%72 HTTP 301
https://tdzebli.com/1/?emid=68d85baeb4c27501df0e02d1 Page URL
https://befjajh.flirtosmart.com/s/42cf1c2250951 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://is.gd/QJB07D HTTP 301
https://medialead.de/trck/eclick/b14e29c4436a70df0adb51eebb5d3bae?url=%68ttps%3A%2F%2F%74d%7A%65%62%6C%69%2Ec%6F%6D%2F%31%2F%23%5A%79%6B%39%34%7A%5F%56%72 HTTP 301
https://tdzebli.com/1/?emid=68d85baeb4c27501df0e02d1

13 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

/ Show response
tdzebli.com/1/
Redirect Chain

https://is.gd/QJB07D
https://medialead.de/trck/eclick/b14e29c4436a70df0adb51eebb5d3bae?url=%68ttps%3A%2F%2F%74d%7A%65%62%6C%69%2Ec%6F%6D%2F%31%2F%23%5A%79%6B%39%34%7A%5F%56%72
https://tdzebli.com/1/?emid=68d85baeb4c27501df0e02d1

2 KB
1 KB

405ms
143ms

Document
text/html

88.214.27.56
AS-ALVIVA Alviva ...

General

Check archive.org

Download Go to

Full URL: https://tdzebli.com/1/?emid=68d85baeb4c27501df0e02d1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 88.214.27.56 , Germany, ASN209272 (AS-ALVIVA Alviva Holding Limited, SC),
Reverse DNS
Software: Apache/2 /
Resource Hash: e8ce51106238701772193096dc28a411356eb152398117fc3a00e56adfa49569

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36

Response headers

Accept-Ranges: bytes
Connection: Upgrade, Keep-Alive
Content-Encoding: gzip
Content-Length: 701
Content-Type: text/html
Date: Sat, 27 Sep 2025 21:48:31 GMT
ETag: "6dc-63d45aa738880-gzip"
Keep-Alive: timeout=2, max=100
Last-Modified: Tue, 26 Aug 2025 14:41:22 GMT
Server: Apache/2
Upgrade: h2,h2c
Vary: Accept-Encoding,User-Agent

Redirect headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Range, Content-Disposition, Content-Type, Authorization
access-control-allow-methods: GET,PUT,POST,DELETE,OPTIONS
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
content-type: text/html; charset=UTF-8
date: Sat, 27 Sep 2025 21:48:31 GMT
expires: 0
location: https://tdzebli.com/1/?emid=68d85baeb4c27501df0e02d1#Zyk94z_Vr
pragma: no-cache
server: nginx
x-robots-tag: nofollow

GET
H2 200 v1 Show response
openfpcdn.io/botd/ 15 KB
5 KB 52ms
13ms Script
text/javascript 13.32.99.33
AMAZON-02

General

Check archive.org

Download Go to

Full URL

https://openfpcdn.io/botd/v1

Requested by

Host: tdzebli.com
URL: https://tdzebli.com/1/?emid=68d85baeb4c27501df0e02d1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.32.99.33 New York, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-32-99-33.fra60.r.cloudfront.net

Software

CloudFront /

Resource Hash

29cb26e06f2a4a877f1134a46480d9b78f8b6e0e6f9b0fe67e34307c312b5a89

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36
Origin: https://tdzebli.com
Referer: https://tdzebli.com/

Response headers

content-encoding: gzip
etag: W/"5co2cnhGrt59+8B+iLKwJesMrpA"
age: 8265
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: qkBQWcc5dcSnc471apiRQMPPk3E_R2nlDvDKXk1PJxBZe83VBZaSKQ==
date: Sat, 27 Sep 2025 19:32:27 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
strict-transport-security: max-age=63072000; includeSubDomains; preload
cache-control: public, max-age=581444, s-maxage=10790
cross-origin-resource-policy: cross-origin
via: 1.1 968007545c497b68cc41825f11e930ba.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-amz-cf-pop: FRA60-P3
server: CloudFront

GET
H/1.1 404
Not Found favicon.ico
tdzebli.com/ 315 B
517 B 76ms
75ms Other
text/html 88.214.27.56
AS-ALVIVA Alviva ...

General

Check archive.org

Download Go to

Full URL: https://tdzebli.com/favicon.ico
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 88.214.27.56 , Germany, ASN209272 (AS-ALVIVA Alviva Holding Limited, SC),
Reverse DNS
Software: Apache/2 /
Resource Hash: d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36
Referer: https://tdzebli.com/1/?emid=68d85baeb4c27501df0e02d1

Response headers

Keep-Alive: timeout=2, max=99
Content-Length: 315
Date: Sat, 27 Sep 2025 21:48:31 GMT
Content-Type: text/html; charset=iso-8859-1
Server: Apache/2
Connection: Keep-Alive

GET
H2 200 Primary Request 42cf1c2250951 Show response
befjajh.flirtosmart.com/s/ 48 KB
23 KB 261ms
147ms Document
text/html 81.30.157.12
MYLOC-AS WIIT AG

General

Check archive.org

Download Go to

Full URL: https://befjajh.flirtosmart.com/s/42cf1c2250951
Requested by: Host: tdzebli.com
URL: https://tdzebli.com/1/?emid=68d85baeb4c27501df0e02d1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 81.30.157.12 , Germany, ASN24961 (MYLOC-AS WIIT AG, DE),
Reverse DNS: srv11409.dus4.dedicated.server-hosting.expert
Software: openresty /
Resource Hash: c96698fb6891d1167ab95b727603e92953f4c0d4ec70087faa97f07636a9024d

Request headers

Referer: https://tdzebli.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36

Response headers

cache-control: must-revalidate, no-cache, no-store, private
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Sat, 27 Sep 2025 21:48:32 GMT
expires: 0
pragma: no-cache
server: openresty
vary: Accept-Encoding
x-tarantool-version: 3.4.0

GET
H2 200 style.css
befjajh.flirtosmart.com/bundle/132/assets/css/ 7 KB
2 KB 18ms
17ms Stylesheet
text/css 81.30.157.12
MYLOC-AS WIIT AG

General

Check archive.org

Download Go to

Full URL: https://befjajh.flirtosmart.com/bundle/132/assets/css/style.css
Requested by: Host: befjajh.flirtosmart.com
URL: https://befjajh.flirtosmart.com/s/42cf1c2250951
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 81.30.157.12 , Germany, ASN24961 (MYLOC-AS WIIT AG, DE),
Reverse DNS: srv11409.dus4.dedicated.server-hosting.expert
Software: openresty /
Resource Hash: c1476b8789218a2e53d33967b092cf36a5a26c5933031e51580f1d8ef31005ec

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36
Referer: https://befjajh.flirtosmart.com/s/42cf1c2250951

Response headers

x-cache-status: HIT
cache-control: max-age=86400, public
content-encoding: gzip
date: Sat, 27 Sep 2025 21:48:32 GMT
content-type: text/css; charset=UTF-8
vary: Accept-Encoding
server: openresty

GET
H2 200 jquery.js Show response
befjajh.flirtosmart.com/bundle/132/assets/js/ 84 KB
32 KB 25ms
24ms Script
application/javascript 81.30.157.12
MYLOC-AS WIIT AG

General

Check archive.org

Download Go to

Full URL: https://befjajh.flirtosmart.com/bundle/132/assets/js/jquery.js
Requested by: Host: befjajh.flirtosmart.com
URL: https://befjajh.flirtosmart.com/s/42cf1c2250951
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 81.30.157.12 , Germany, ASN24961 (MYLOC-AS WIIT AG, DE),
Reverse DNS: srv11409.dus4.dedicated.server-hosting.expert
Software: openresty /
Resource Hash: 05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36
Referer: https://befjajh.flirtosmart.com/s/42cf1c2250951

Response headers

x-cache-status: HIT
cache-control: max-age=86400, public
content-encoding: gzip
date: Sat, 27 Sep 2025 21:48:32 GMT
content-type: application/javascript
vary: Accept-Encoding
server: openresty

GET
H2 200 functions.js Show response
befjajh.flirtosmart.com/bundle/132/assets/js/ 4 KB
2 KB 39ms
39ms Script
application/javascript 81.30.157.12
MYLOC-AS WIIT AG

General

Check archive.org

Download Go to

Full URL: https://befjajh.flirtosmart.com/bundle/132/assets/js/functions.js
Requested by: Host: befjajh.flirtosmart.com
URL: https://befjajh.flirtosmart.com/s/42cf1c2250951
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 81.30.157.12 , Germany, ASN24961 (MYLOC-AS WIIT AG, DE),
Reverse DNS: srv11409.dus4.dedicated.server-hosting.expert
Software: openresty /
Resource Hash: 43778890cc4ca3651ae747978ced2715ab26dd17893e783c36e13e86324a1dc2

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36
Referer: https://befjajh.flirtosmart.com/s/42cf1c2250951

Response headers

x-cache-status: HIT
cache-control: max-age=86400, public
content-encoding: gzip
date: Sat, 27 Sep 2025 21:48:32 GMT
content-type: application/javascript
vary: Accept-Encoding
server: openresty

GET
H2 200 main.js Show response
befjajh.flirtosmart.com/bundle/132/assets/js/ 118 B
248 B 41ms
40ms Script
application/javascript 81.30.157.12
MYLOC-AS WIIT AG

General

Check archive.org

Download Go to

Full URL: https://befjajh.flirtosmart.com/bundle/132/assets/js/main.js
Requested by: Host: befjajh.flirtosmart.com
URL: https://befjajh.flirtosmart.com/s/42cf1c2250951
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 81.30.157.12 , Germany, ASN24961 (MYLOC-AS WIIT AG, DE),
Reverse DNS: srv11409.dus4.dedicated.server-hosting.expert
Software: openresty /
Resource Hash: ba8b334c9a57119ba9643a6034378cc5541dce29d18f7ee9b8de5046798cd4ec

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36
Referer: https://befjajh.flirtosmart.com/s/42cf1c2250951

Response headers

x-cache-status: HIT
cache-control: max-age=86400, public
content-encoding: gzip
date: Sat, 27 Sep 2025 21:48:32 GMT
content-type: application/javascript
vary: Accept-Encoding
server: openresty

GET
H3 200 just-validate.production.min.js Show response
unpkg.com/just-validate@4.1.0/dist/ 28 KB
7 KB 47ms
35ms Script
text/javascript 104.18.0.22
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://unpkg.com/just-validate@4.1.0/dist/just-validate.production.min.js

Requested by

Host: befjajh.flirtosmart.com
URL: https://befjajh.flirtosmart.com/s/42cf1c2250951

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.0.22 , Ascension Island, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c08b11b232cea03b467d40d5b0990d7deaee04ae1de7af2d4eb94c3544b4c1a5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36
Referer: https://befjajh.flirtosmart.com/

Response headers

access-control-expose-headers: *
content-encoding: gzip
cf-cache-status: HIT
age: 771048
access-control-allow-methods: GET, HEAD, OPTIONS
x-content-type-options: nosniff
expires: Sun, 27 Sep 2026 21:48:32 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Sat, 27 Sep 2025 21:48:32 GMT
content-type: text/javascript; charset=utf-8
last-modified: Thu, 04 Sep 2025 18:07:59 GMT
vary: Accept-Encoding
fly-request-id: 01K4AYKYJ8CZHGB7GS0VB37ANW-fra
access-control-allow-headers: *
strict-transport-security: max-age=31536000; includeSubDomains; preload
priority: u=1,i=?0
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
via: 1.1 fly.io, 1.1 fly.io
cf-ray: 985e34b17d413612-FRA
content-digest: sha256=:wIsRsjLOoDtGfUDVsJkNferuBK4d568tTrlMNUS0waU=:
access-control-allow-origin: *
server: cloudflare

GET
H2 200 1.mp4
befjajh.flirtosmart.com/bundle/132/assets/img/ 974 KB
976 KB 36ms
36ms Media
video/mp4 81.30.157.12
MYLOC-AS WIIT AG

General

Check archive.org

Download Go to

Full URL: https://befjajh.flirtosmart.com/bundle/132/assets/img/1.mp4
Requested by: Host: befjajh.flirtosmart.com
URL: https://befjajh.flirtosmart.com/s/42cf1c2250951
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 81.30.157.12 , Germany, ASN24961 (MYLOC-AS WIIT AG, DE),
Reverse DNS: srv11409.dus4.dedicated.server-hosting.expert
Software: openresty /
Resource Hash: 2b3b62fbea6a0f85a16904129c448a32bac1b84f6d63987fb12a4bec2bc91e97

Request headers

Referer: https://befjajh.flirtosmart.com/s/42cf1c2250951
Accept-Encoding: identity;q=1, *;q=0
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36
Range: bytes=0-

Response headers

x-cache-status: HIT
cache-control: max-age=86400, public
date: Sat, 27 Sep 2025 21:48:32 GMT
content-type: video/mp4
server: openresty

GET
H2 200 css
fonts.googleapis.com/ 2 KB
1 KB 100ms
20ms Stylesheet
text/css 142.250.186.170
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fonts.googleapis.com/css?family=Montserrat&subset=latin-ext

Requested by

Host: befjajh.flirtosmart.com
URL: https://befjajh.flirtosmart.com/bundle/132/assets/css/style.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.170 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f10.1e100.net

Software

ESF /

Resource Hash

3e4fc43d2973ddc920952f6c69750e388386b105591ae0867b600561ab37a2af

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36
Referer: https://befjajh.flirtosmart.com/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Sat, 27 Sep 2025 21:48:32 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sat, 27 Sep 2025 21:48:32 GMT
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified: Sat, 27 Sep 2025 21:19:34 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H3 200 JTUHjIg1_i6t8kCHKm4532VJOt5-QNFgpCtr6Hw5aXo.woff2
fonts.gstatic.com/s/montserrat/v31/ 18 KB
18 KB 26ms
9ms Font
font/woff2 142.250.185.131
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v31/JTUHjIg1_i6t8kCHKm4532VJOt5-QNFgpCtr6Hw5aXo.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Montserrat&subset=latin-ext

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.131 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f3.1e100.net

Software

sffe /

Resource Hash

e66bcd2761ab6924b25ce70dafe10e57a39193c4fea1516730bd9cb5240af6c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36
Origin: https://befjajh.flirtosmart.com
Referer: https://fonts.googleapis.com/

Response headers

age: 395644
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Wed, 23 Sep 2026 07:54:29 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 23 Sep 2025 07:54:29 GMT
last-modified: Thu, 04 Sep 2025 17:09:31 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 18780
x-xss-protection: 0
server: sffe

GET
H2 200 favicon.png
befjajh.flirtosmart.com/bundle/132/assets/img/ 2 KB
2 KB 17ms
17ms Other
image/png 81.30.157.12
MYLOC-AS WIIT AG

General

Check archive.org

Download Go to

Full URL: https://befjajh.flirtosmart.com/bundle/132/assets/img/favicon.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 81.30.157.12 , Germany, ASN24961 (MYLOC-AS WIIT AG, DE),
Reverse DNS: srv11409.dus4.dedicated.server-hosting.expert
Software: openresty /
Resource Hash: fd6e46b55498cbc3c13dfe377d33b7037ac5dc89ec8518d6e78a36f9e079e095

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36
Referer: https://befjajh.flirtosmart.com/s/42cf1c2250951

Response headers

x-cache-status: HIT
cache-control: max-age=86400, public
date: Sat, 27 Sep 2025 21:48:33 GMT
content-type: image/png
server: openresty

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Porn Scam (Online)

19 JavaScript Window variables

These are the non-standard variables defined on the window object. These include var declarations and global functions and can be helpful in identifying possible client-side frameworks and code.

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.is.gd/	1970-01-21 08:36:51	Name: __cf_bm Value: 6stYVmTS2c_LlgAhIuIm3zxqdM1EPvIYY7Puo9Yp22c-1759009710-1.0.1.1-bM_gEH5aWUzBpZSy.pctYiUwYTsvfthkWwxjR7Y0cLTMnSgefOoocGcik2FfLnW_.nK7btWa9j0Qat0M0z9H50Xrdwzc0lHGm40YFbC69aE
.medialead.de/	1969-12-31 23:59:59	Name: session_trs Value: 68d85baeb4c27501df0e02d0
.medialead.de/	1970-01-21 17:22:25	Name: trs Value: 68d85baeb4c27501df0e02d0
.medialead.de/	1970-01-21 17:22:25	Name: trscj Value: MTc1OTAwOTcxMXxMM1J5WTJzdlpXTnNhV05yTDJJeE5HVXlPV00wTkRNMllUY3daR1l3WVdSaU5URmxaV0ppTldRelltRmxQM1Z5YkQwbE5qaDBkSEJ6SlROQkpUSkdKVEpHSlRjMFpDVTNRU1UyTlNVMk1pVTJReVUyT1NVeVJXTWxOa1lsTmtRbE1rWWxNekVsTWtZbE1qTWxOVUVsTnprbE5rSWxNemtsTXpRbE4wRWxOVVlsTlRZbE56ST18VGs5T1JRPT0%3D

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
rendering	warning	URL: https://tdzebli.com/1/?emid=68d85baeb4c27501df0e02d1#Zyk94z_Vr Message: [GroupMarkerNotSet(crbug.com/242999)!:A010210014270000]Automatic fallback to software WebGL has been deprecated. Please use the --enable-unsafe-swiftshader (about:flags#enable-unsafe-swiftshader) flag to opt in to lower security guarantees for trusted content.
network	error	URL: https://tdzebli.com/favicon.ico Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

befjajh.flirtosmart.com
fonts.googleapis.com
fonts.gstatic.com
is.gd
medialead.de
openfpcdn.io
tdzebli.com
unpkg.com
104.18.0.22
13.32.99.33
142.250.185.131
142.250.186.170
172.67.83.132
81.30.157.12
88.214.27.56
94.23.99.218
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
29cb26e06f2a4a877f1134a46480d9b78f8b6e0e6f9b0fe67e34307c312b5a89
2b3b62fbea6a0f85a16904129c448a32bac1b84f6d63987fb12a4bec2bc91e97
3e4fc43d2973ddc920952f6c69750e388386b105591ae0867b600561ab37a2af
43778890cc4ca3651ae747978ced2715ab26dd17893e783c36e13e86324a1dc2
ba8b334c9a57119ba9643a6034378cc5541dce29d18f7ee9b8de5046798cd4ec
c08b11b232cea03b467d40d5b0990d7deaee04ae1de7af2d4eb94c3544b4c1a5
c1476b8789218a2e53d33967b092cf36a5a26c5933031e51580f1d8ef31005ec
c96698fb6891d1167ab95b727603e92953f4c0d4ec70087faa97f07636a9024d
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
e66bcd2761ab6924b25ce70dafe10e57a39193c4fea1516730bd9cb5240af6c8
e8ce51106238701772193096dc28a411356eb152398117fc3a00e56adfa49569
fd6e46b55498cbc3c13dfe377d33b7037ac5dc89ec8518d6e78a36f9e079e095

befjajh.flirtosmart.com 81.30.157.12 Malicious Activity! Public Scan Open in urlscan Pro

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

13 Requests

100 %HTTPS

0 %IPv6

8 Domains

8 Subdomains

6 IPs

4 Countries

1070 kBTransfer

1183 kBSize

4 Cookies

0 Outgoing links

Page URL History

Redirected requests

13 HTTP transactions Everything HTML Script Fetch XHR CSS Image Font Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

19 JavaScript Window variables

4 Cookies

2 Console Messages

Indicators

befjajh.flirtosmart.com
81.30.157.12 Malicious Activity! Public Scan Open in urlscan Pro

Screenshot
Live screenshot

Full Image

13
Requests

100 %
HTTPS

0 %
IPv6

8
Domains

8
Subdomains

6
IPs

4
Countries

1070 kB
Transfer

1183 kB
Size

4
Cookies

13 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!