bfjcgfi.bustydatng.com
Open in
urlscan Pro
158.69.126.131
Malicious Activity!
Public Scan
Submitted URL: http://big1-pu0ssy.co/
Effective URL: https://bfjcgfi.bustydatng.com/s/63a440ec09eed?subsource=yrm&track=ys&ext_click_id=yn&sub1=yj
Submission: On March 23 via api from US — Scanned from US
Effective URL: https://bfjcgfi.bustydatng.com/s/63a440ec09eed?subsource=yrm&track=ys&ext_click_id=yn&sub1=yj
Submission: On March 23 via api from US — Scanned from US
Summary
This website contacted 1 IPs
in 2 countries
across 2 domains to perform 11 HTTP transactions.
The main IP is 158.69.126.131, located in
Montreal, Canada and
belongs to OVH, FR.
The main domain is bfjcgfi.bustydatng.com.
TLS certificate: Issued by R3 on February 11th 2024. Valid for: 3 months.
This is the only time bfjcgfi.bustydatng.com was scanned on urlscan.io!
TLS certificate: Issued by R3 on February 11th 2024. Valid for: 3 months.
This is the only time bfjcgfi.bustydatng.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Porn Scam (Online)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 1 | 192.64.119.227 192.64.119.227 | 22612 (NAMECHEAP...) (NAMECHEAP-NET) | |
| 11 | 158.69.126.131 158.69.126.131 | 16276 (OVH) (OVH) | |
| 11 | 1 |
11
158.69.126.131
(Montreal, Canada)
ASN16276 (OVH, FR)
PTR: ns522380.ip-158-69-126.net
ASN16276 (OVH, FR)
PTR: ns522380.ip-158-69-126.net
| bfjcgfi.bustydatng.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 11 |
bustydatng.com
bfjcgfi.bustydatng.com |
366 KB |
| 1 |
big1-pu0ssy.co
1 redirects
big1-pu0ssy.co |
310 B |
| 11 | 2 |
| Domain | Requested by | |
|---|---|---|
| 11 | bfjcgfi.bustydatng.com |
bfjcgfi.bustydatng.com
|
| 1 | big1-pu0ssy.co | 1 redirects |
| 11 | 2 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| bustydatng.com R3 |
2024-02-11 - 2024-05-11 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://bfjcgfi.bustydatng.com/s/63a440ec09eed?subsource=yrm&track=ys&ext_click_id=yn&sub1=yj
Frame ID: 933E8A12C6383D21A8CBB3D8C13BD6E0
Requests: 11 HTTP requests in this frame
Screenshot
Page Title
The most popular dating site of the monthPage URL History Show full URLs
-
http://big1-pu0ssy.co/
HTTP 302
https://bfjcgfi.bustydatng.com/s/63a440ec09eed?subsource=yrm&track=ys&ext_click_id=yn&sub1=yj Page URL
Detected technologies
animate.css (Web Frameworks) Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <link [^>]+(?:/([\d.]+)/)?animate\.(?:min\.)?css
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://big1-pu0ssy.co/
HTTP 302
https://bfjcgfi.bustydatng.com/s/63a440ec09eed?subsource=yrm&track=ys&ext_click_id=yn&sub1=yj Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
11 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
63a440ec09eed
bfjcgfi.bustydatng.com/s/ Redirect Chain
|
42 KB 18 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
animate.min.css
bfjcgfi.bustydatng.com/bundle/18/assets/css/ |
52 KB 52 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
style.css
bfjcgfi.bustydatng.com/bundle/18/assets/css/ |
14 KB 15 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery-2.2.4.min.js
bfjcgfi.bustydatng.com/bundle/18/assets/js/ |
84 KB 84 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
js.js
bfjcgfi.bustydatng.com/bundle/18/assets/js/ |
650 B 930 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
no.png
bfjcgfi.bustydatng.com/bundle/18/assets/img/ |
322 B 566 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
yes.png
bfjcgfi.bustydatng.com/bundle/18/assets/img/ |
594 B 838 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
1.jpg
bfjcgfi.bustydatng.com/bundle/18/assets/img/ |
76 KB 77 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
pattern.png
bfjcgfi.bustydatng.com/bundle/18/assets/img/ |
100 B 343 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
Lato-Regular.ttf
bfjcgfi.bustydatng.com/bundle/18/assets/fonts/ |
117 KB 118 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
POST H/1.1 |
track.php
bfjcgfi.bustydatng.com/ |
0 254 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Porn Scam (Online)16 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery string| cf boolean| exitPopunder string| fpDataEncoded function| sendTrack function| Fingerprint2 function| fingerprintGo function| collectTrackParams function| closingConfirm function| handleError function| getParameterByName function| collectParams function| checkRequired function| setLeadInfo function| setCF2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| .bustydatng.com/ | Name: s Value: yVGErHxvpoVFbKuVWGI%2FiAXgP0ru%2FGlb0%2FNAm2pKBspS98N4SqOhzyyF9JLU7Y85ddK7siO%2FP192%2BiUHkK%2BVciB%2B3vmRPqtb%2FRxQEokhDbh1zSGDyaYuz0nGtxoNtT426Xym3RYiKsEGNvq6pNrz449Hzf098%2BFhHcu4%2F7jj0bl1IPdd9I5WyIRtCGNTpGANH83XAPIpHFr7Mnunl0gGz27ElesmNfbdy0OTpLP80H8XdYM47bpDv4PjKKnYJuynUlbBDckgBmBiw9MvJZfkE0PGMKg1xq%2FK5aiQNlyfQq3DO9530DlewrYZjmzqkPwiMdK5ph3SAe%2BX%2BTt1riK6IYqmRLDrPhNwf4jZsUvZA2Hg7I1hAvSNQ%2FcLor6x%2FANJoGGVWLy4743l4Dm0VXBZ7NPkBDAxd8M90A4w2GzeRyx2oRDVeZaVi0vze9Q4cSMe02kEY6GmFR15wk7lS0mQJ2%2FmhwYb9cxo99bYXQIQ0CiletF4oGngYrJ%2B1f53I63hDU7O5gj73zoxOHfqVQzzyIz8LbATsbgHooz3FeGVY71BrBp%2FyilPftCdNsflk%2Ffz2IRxjI7AA2Ec%2B7UCEEaXVGdFx%2F0LhAtRYSO7w0t26YGrvwpU8W5U8jThUZFiwf4ST3kEzoCOl6GceyBl59wdHMmcD53XuVid2jX7%2B3TC7bgN8QPlIbWAtuGHbbGGTDEyz6%2BnFZFy0DF67deb8nPru2b4VtEP231ChMmJ76jdNnEzpHMEn%2FU49T45tfuiXkfgI0k98YoCyL3Igh3YbEjjz6cbYmSu19AyW%2B67MX8bbwfWQeSUQobp7VRftA%2F11xbJDmBHa69Y89%2BdLOX7MoogXsrcCytFq70ZFyBP%2FzT6YjhyxTdi2P4BRH8w%2B3kFfAVvkRl3vCZ3D%2BEh5ZRv%2FqLEZgbcEUSv9bq6BWNCLKiwD8KOKbTalSGnaxOs7uRJYUAHWrxzD%2FDUsvntRj3eppKwZdkjMpjtozEjDKuKWkitHB9E0PoCGJTucuVWXLfdi3P0HpxrMoGlGGzxtC%2BIC6vDouEqxV2Yrc2ivFlLOsbOdotDzk5wtVu2iqTsGDQcPFri6GbOqtmHQDCCyidcW81q75aRff4u74SdAtkY7AgnwXAsRy4CMvXlcfqa2T61t40n6aqyZwGSkeQ6%2Fl%2FM8Dvf7mArw0Lej1xaSHv443KWnfvzZ4kuUWbjIwc%2Ft8UURXapsDCfFCgr82zlwSdupBnZiIzN9TIsIdODte1rh5%2BKFLDLDpZ%2BeOBJIcMfpUZffdFlg1YbkWAeh455Jp1B%2FnkjbjgaASz6IJgAOwMhUAWmj8fpEPXo9HyU9O88ZyhH2vSnDhCJn7Ak51hVXptxDpui8RnNgBl8Lut%2BDwCo%2BEE2GvjJqeY24cfg8TFEhoALAYHOgBaV%2Bzrt%2F2l%2BpHbOUe5zXHrOeCMxTpJmE664uCDN8UytbHigmgV18qVZRo3Mnnu2ffes%2Fwv0SA40LMcvApnuul92zRAIRHorhj9%2FVWxVFCCJ9XZ%2BkH4RsKMpdX%2Fz9qaz01IIk50cSN6RhZ%2F%2Blwx9mBlg6FbQmHtc18Awphnk7vKmSYS0hq81%2FcEpof0CePvrv0exesOZYMquK08txBnBxj0O1BikVhhc4kmThp0iYDCnEGP4fWE1iNNU7bI1%2B4k6Ifh6GqXs%2BSbGRHZQAPmv56%2B2VWkuCJ%2FQlurBBZZw97snC3Ye6IqiEMt7fELjuSJC%2BVQKrAukicMQdneQPNzxskqj313pO%2FO9PkUMPjD8p618K12GyCdvbjDhMrWqjAakr3TO7wn4x%2F3T8Oh9AOyQkiN69zt62qcAOhuI%2BVxeHlf3pLevaPpy1bC4jamYYTRi%2Be75 |
|
| bfjcgfi.bustydatng.com/ | Name: CF Value: XYs7rioiscMLkbnW2kyWHA__ |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
bfjcgfi.bustydatng.com
big1-pu0ssy.co
158.69.126.131
192.64.119.227
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
13de289b7d770632c2b87d7019cdb10416061bcdb50f07cadcc5e4c6cdf33a36
3e80058e1e64f3e5085e47096d373ae6b74987d494aec75b3f67872706569ef4
61578380385ef83a3ad40c2a0d5d0bad8ff6713845848098e70591ab20f0ce40
623cd33a00c598dfe9d63cb47e5798ecc598684f998f5e2eaf210513dbbd330c
6a81a25ca7fec3b6540c76f8da05d0be2b75103cd3d2066e70eeba35bb9315cd
7ae714b63c2c8b940bdd211a0cc678f01168a34eea8aa13c0df25364f29238a7
855f62c34d296773b690bcd61d702db042b6085294928d1f7064c022b47d2695
8fe3fa119255adb5e0c12479331f9e092e85bcff56ab6ecc0510bfa2056b898d
c7305aeef2479d4f6f31faec42da254f1d33614aabe39d9c7a459cc7a81120c7
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855