![](/screenshots/09b94b9e-d689-4d97-b91b-215b133eff5e.png)
dirtyflirt2.com
Open in
urlscan Pro
2606:4700:3033::ac43:c892
Malicious Activity!
Public Scan
Effective URL: https://dirtyflirt2.com/?utm_source=axuEDzhQ3zsB&s2=c9aoeridb15
Submission: On November 09 via manual from IT — Scanned from IT
Summary
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on July 1st 2021. Valid for: a year.
This is the only time dirtyflirt2.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Porn Scam (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 185.237.224.13 185.237.224.13 | 204957 (GREENFLOI...) (GREENFLOID-AS) | |
3 | 2606:4700:303... 2606:4700:3033::ac43:c892 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 2606:4700::68... 2606:4700::6812:acf | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
3 | 157.90.28.169 157.90.28.169 | 24940 (HETZNER-AS) (HETZNER-AS) | |
1 | 2001:4de0:ac1... 2001:4de0:ac18::1:a:1b | 20446 (HIGHWINDS3) (HIGHWINDS3) | |
9 | 4 |
ASN204957 (GREENFLOID-AS, BG)
PTR: andre28433.vds
erogermany.site |
ASN24940 (HETZNER-AS, DE)
PTR: static.169.28.90.157.clients.your-server.de
trustmeiamcdn.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
3 |
trustmeiamcdn.com
trustmeiamcdn.com |
897 KB |
3 |
dirtyflirt2.com
dirtyflirt2.com |
8 KB |
2 |
bootstrapcdn.com
maxcdn.bootstrapcdn.com |
31 KB |
1 |
jquery.com
code.jquery.com |
29 KB |
1 |
erogermany.site
1 redirects
erogermany.site |
975 B |
9 | 5 |
Domain | Requested by | |
---|---|---|
3 | trustmeiamcdn.com |
dirtyflirt2.com
|
3 | dirtyflirt2.com |
dirtyflirt2.com
trustmeiamcdn.com |
2 | maxcdn.bootstrapcdn.com |
dirtyflirt2.com
|
1 | code.jquery.com |
dirtyflirt2.com
|
1 | erogermany.site | 1 redirects |
9 | 5 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2021-07-01 - 2022-06-30 |
a year | crt.sh |
trustmeiamcdn.com R3 |
2021-09-15 - 2021-12-14 |
3 months | crt.sh |
*.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2021-07-14 - 2022-08-14 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://dirtyflirt2.com/?utm_source=axuEDzhQ3zsB&s2=c9aoeridb15
Frame ID: C37BBCF87F2C3BF4F6D0C65B70D33055
Requests: 9 HTTP requests in this frame
Screenshot
![](/screenshots/09b94b9e-d689-4d97-b91b-215b133eff5e.png)
Page Title
Il sito di datazione piĆ¹ popolare di questo mesePage URL History Show full URLs
-
https://erogermany.site/?id=24osc24b&c=007&p=a
HTTP 302
https://dirtyflirt2.com/?utm_source=axuEDzhQ3zsB&s2=c9aoeridb15 Page URL
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://erogermany.site/?id=24osc24b&c=007&p=a
HTTP 302
https://dirtyflirt2.com/?utm_source=axuEDzhQ3zsB&s2=c9aoeridb15 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
9 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
dirtyflirt2.com/ Redirect Chain
|
23 KB 7 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/ |
118 KB 20 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
radar.gif
trustmeiamcdn.com/assets/002929c117fa100f9d536cc76cbecb29/images/ |
172 KB 172 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-2.2.4.min.js
code.jquery.com/ |
84 KB 29 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.js
maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/ |
36 KB 10 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
p.js
dirtyflirt2.com/ |
422 B 849 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
f.js
trustmeiamcdn.com/assets/ |
2 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1.jpg
trustmeiamcdn.com/assets/002929c117fa100f9d536cc76cbecb29/images/ |
723 KB 724 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
featrepl
dirtyflirt2.com/ |
2 B 332 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Porn Scam (Online)19 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler function| $ function| jQuery string| _determinate string| _indeterminate string| _update string| _type string| _click string| _touch string| _add string| _remove string| _callback string| _label string| _cursor boolean| _mobile string| u6 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
erogermany.site/ | Name: _subid Value: c9aoeridb15 |
|
erogermany.site/ | Name: _token Value: uuid_c9aoeridb15_c9aoeridb15618a7c957df8b8.85414040 |
|
erogermany.site/ | Name: 0b6b5 Value: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjE5N1wiOjE2MzY0NjU4MTN9LFwiY2FtcGFpZ25zXCI6e1wiMTEwXCI6MTYzNjQ2NTgxM30sXCJ0aW1lXCI6MTYzNjQ2NTgxM30ifQ.wTeY3DBb3klJ-2ELG-DL-T_z19J5mL0z5rJ1dAkF06Y |
|
dirtyflirt2.com/ | Name: c Value: 9m5jwzfu8h5eaf |
|
dirtyflirt2.com/ | Name: k Value: SFMyNTY.g3QAAAAIbQAAAARhdW5xdAAAAAFtAAAABTQ1NzExbQAAAApwZ1BnTEJabURSbQAAAANoaWRtAAAAJGxyVUxzeWpSRWZLYXJTUW9UcXJFd3BaYU1rQmVWaXZWYUNSQW0AAAACaGxhAW0AAAACcGxkAANuaWxtAAAABXN1Yl8xZAADbmlsbQAAAAVzdWJfMm0AAAALYzlhb2VyaWRiMTVtAAAAB3RyYWNrZXJtAAAAB25vdHJhY2ttAAAAA3VucW0AAAAMeVBocWtOUXZkenRx.iIizieXohWMs9dtjlDA634U_dY9ceIpVxQCzHbwLm-s |
|
dirtyflirt2.com/ | Name: __fjs Value: 1111111111110100111111111011 |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Content-Type-Options | nosniff |
X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
code.jquery.com
dirtyflirt2.com
erogermany.site
maxcdn.bootstrapcdn.com
trustmeiamcdn.com
157.90.28.169
185.237.224.13
2001:4de0:ac18::1:a:1b
2606:4700:3033::ac43:c892
2606:4700::6812:acf
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
2ded6c768c7ade3c27ed8b5d6552a33069a14730f5bd1122c9cc1578d2c96aeb
53964478a7c634e8dad34ecc303dd8048d00dce4993906de1bacf67f663486ef
89495896bcc3deb0b6a643cf55ddfe620ada0cdb66cd09ce4ba801a06396fcef
963a44fa6cbb7486c60762c3ee87598cebac50d93ffc8bcda9ac4b946637138b
d6ee9c67932d89e4005c4c8e62ad16d553810236b3944aab20db0282e62de65e
eba308b6592fe8e148fb7bc4a540d7f7d06a3ac711a86bffe5fd802f9d249599
f75e846cc83bd11432f4b1e21a45f31bc85283d11d372f7b19accd1bf6a2635c