![](/screenshots/1e0a9207-6ee0-4e54-ab67-bfa9ef552567.png)
manyprizes-here.life
Open in
urlscan Pro
49.12.43.218
Malicious Activity!
Public Scan
Effective URL: https://manyprizes-here.life/?u%5C%5C=20nkte4%5Cu0026o%5C%5C%3Dynwp7ph%5Cu0026t%5C%5C%3Dmixiz
Submission Tags: falconsandbox
Submission: On October 10 via api from US — Scanned from DE
Summary
TLS certificate: Issued by R3 on August 8th 2022. Valid for: 3 months.
This is the only time manyprizes-here.life was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 9 | 49.12.43.218 49.12.43.218 | 24940 (HETZNER-AS) (HETZNER-AS) | |
15 | 2 |
ASN24940 (HETZNER-AS, DE)
PTR: static.218.43.12.49.clients.your-server.de
manyprizes-here.life |
Apex Domain Subdomains |
Transfer | |
---|---|---|
9 |
manyprizes-here.life
1 redirects
manyprizes-here.life |
163 KB |
0 |
gstatic.com
Failed
fonts.gstatic.com Failed |
|
0 |
fling.com
Failed
promos.fling.com Failed |
|
15 | 3 |
Domain | Requested by | |
---|---|---|
9 | manyprizes-here.life |
1 redirects
manyprizes-here.life
|
0 | fonts.gstatic.com Failed |
manyprizes-here.life
|
0 | promos.fling.com Failed |
manyprizes-here.life
|
15 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
manyprizes-here.life R3 |
2022-08-08 - 2022-11-06 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://manyprizes-here.life/?u%5C%5C=20nkte4%5Cu0026o%5C%5C%3Dynwp7ph%5Cu0026t%5C%5C%3Dmixiz
Frame ID: 038195A8E79E18858F2FC60EB5BB9B21
Requests: 15 HTTP requests in this frame
Screenshot
![](/screenshots/1e0a9207-6ee0-4e54-ab67-bfa9ef552567.png)
Page Title
Get Laid TonightPage URL History Show full URLs
-
http://manyprizes-here.life/?u%5C%5C=20nkte4%5Cu0026o%5C%5C%3Dynwp7ph%5Cu0026t%5C%5C%3Dmixiz
HTTP 301
https://manyprizes-here.life/?u%5C%5C=20nkte4%5Cu0026o%5C%5C%3Dynwp7ph%5Cu0026t%5C%5C%3Dmixiz Page URL
Detected technologies
Detected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://manyprizes-here.life/?u%5C%5C=20nkte4%5Cu0026o%5C%5C%3Dynwp7ph%5Cu0026t%5C%5C%3Dmixiz
HTTP 301
https://manyprizes-here.life/?u%5C%5C=20nkte4%5Cu0026o%5C%5C%3Dynwp7ph%5Cu0026t%5C%5C%3Dmixiz Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
15 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
manyprizes-here.life/ Redirect Chain
|
9 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
fonts.css
manyprizes-here.life/media/dating/timer/css/ |
1 KB 651 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
black.css
manyprizes-here.life/media/dating/timer/css/ |
9 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.js
manyprizes-here.life/media/dating/timer/js/ |
91 KB 31 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
en.js
manyprizes-here.life/media/dating/timer/js/ |
3 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
utils.js
manyprizes-here.life/util/ |
7 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
intro_black.gif
manyprizes-here.life/media/dating/timer/images/ |
116 KB 115 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
loading0.gif
manyprizes-here.life/media/dating/timer/images/ |
6 KB 6 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET |
location.php
promos.fling.com/geo/txt/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET |
DXI1ORHCpsQm3Vp6mXoaTXhCUOGz7vYGh680lGh-uXM.woff
fonts.gstatic.com/s/opensans/v10/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET |
cJZKeOuBrn4kERxqtaUH3T8E0i7KZn-EPnyo3HZu7kw.woff
fonts.gstatic.com/s/opensans/v10/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET |
MTP_ySUJH_bn48VBG8sNSnhCUOGz7vYGh680lGh-uXM.woff
fonts.gstatic.com/s/opensans/v10/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET |
k3k702ZOKiLJc3WVjuplzHhCUOGz7vYGh680lGh-uXM.woff
fonts.gstatic.com/s/opensans/v10/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET |
xjAJXh38I15wypJXxuGMBobN6UDyHWBl620a-IRfuBk.woff
fonts.gstatic.com/s/opensans/v10/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET |
PRmiXeptR36kaC0GEAetxjqR_3kx9_hJXbbyU8S6IN0.woff
fonts.gstatic.com/s/opensans/v10/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- promos.fling.com
- URL
- http://promos.fling.com/geo/txt/location.php?testip=
- Domain
- fonts.gstatic.com
- URL
- http://fonts.gstatic.com/s/opensans/v10/DXI1ORHCpsQm3Vp6mXoaTXhCUOGz7vYGh680lGh-uXM.woff
- Domain
- fonts.gstatic.com
- URL
- http://fonts.gstatic.com/s/opensans/v10/cJZKeOuBrn4kERxqtaUH3T8E0i7KZn-EPnyo3HZu7kw.woff
- Domain
- fonts.gstatic.com
- URL
- http://fonts.gstatic.com/s/opensans/v10/MTP_ySUJH_bn48VBG8sNSnhCUOGz7vYGh680lGh-uXM.woff
- Domain
- fonts.gstatic.com
- URL
- http://fonts.gstatic.com/s/opensans/v10/k3k702ZOKiLJc3WVjuplzHhCUOGz7vYGh680lGh-uXM.woff
- Domain
- fonts.gstatic.com
- URL
- http://fonts.gstatic.com/s/opensans/v10/xjAJXh38I15wypJXxuGMBobN6UDyHWBl620a-IRfuBk.woff
- Domain
- fonts.gstatic.com
- URL
- http://fonts.gstatic.com/s/opensans/v10/PRmiXeptR36kaC0GEAetxjqR_3kx9_hJXbbyU8S6IN0.woff
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic (Online)35 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| requestLink object| geoData string| ip function| $ function| jQuery function| Tick object| Timer number| TotalSeconds function| CreateTimer function| UpdateTimer function| LeadingZero object| now string| current function| getParameterByName function| hideUnsub function| languageDetection function| writeLocation object| geoRefData function| showLocation function| appendPixels function| getCookie function| getBackendParamsByName function| addSessionId undefined| randomNumber function| docReady object| dataLayer1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
manyprizes-here.life/ | Name: sid Value: t1~4rgk5aaoa0tqpic3omehgj4m |
7 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
fonts.gstatic.com
manyprizes-here.life
promos.fling.com
fonts.gstatic.com
promos.fling.com
49.12.43.218
372a69fee04e30bd0bec56898de8354559c63f46337f52f0fb86b91606ba23fa
467bd3c2a7c7eea8cf3425c3f9139d8be45f74ac5f35fb2c16cbf245d0ab0a71
89a15e9c40bc6b14809f236ee8cd3ed1ea42393c1f6ca55c7855cd779b3f922e
8b3c83a330bf1120a13eff6ef60c1e268b827b7bc49b42a7a1f5d8ad6941f2ea
9306a182adf8e430b0b667162ae85ede56721fbdcc09b6d373c089c012699564
ad93ebf236149854e02b2dcb7ca0095033c5fb6b9fa3540da68cfb8ec8ec38d6
bf6a6bcd1a849bb95da78f5126325d51560d0a1041118bccccb472de6e04a5a2
dfa0ad12a293332f47c0c0b7c4d7681d3670915a2f75f086aaf61b9a2835b24a