mendating.life Open in urlscan Pro
23.88.34.247 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://shorturl.ca/eddy25
Effective URL:
https://mendating.life/?u=h2wp605&o=lx8k9zh&t=losg&cid=losg
Submission: On June 10 via manual (June 10th 2023, 9:20:10 am UTC) from US — Scanned from CA

Summary HTTP 14 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 4 countries across 5 domains to perform 14 HTTP transactions. The main IP is 23.88.34.247, located in Gunzenhausen, Germany and belongs to HETZNER-AS, DE. The main domain is mendating.life.
TLS certificate: Issued by R3 on May 2nd 2023. Valid for: 3 months.

This is the only time mendating.life was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Porn Scam (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 1	91.215.219.133 91.215.219.133	49699 (ICN-) (ICN-)
1 1	81.91.178.150 81.91.178.150	204601 (ON-LINE-D...) (ON-LINE-DATA Server location - Netherlands)
12	23.88.34.247 23.88.34.247	24940 (HETZNER-AS) (HETZNER-AS)
1	2607:f8b0:400... 2607:f8b0:4006:81c::200a	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:400... 2607:f8b0:4006:816::2003	15169 (GOOGLE) (GOOGLE)
14	3

1 91.215.219.133 (Sofia, Bulgaria) 1 redirects

ASN49699 (ICN-, BG)
PTR: reverse-219-133.icnhost.net

shorturl.ca	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 81.91.178.150 (Amsterdam, Netherlands) 1 redirects

ASN204601 (ON-LINE-DATA Server location - Netherlands, Dronten, NL)
PTR: s29.server-panel.net

girlslinkclub.live	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 23.88.34.247 (Gunzenhausen, Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.247.34.88.23.clients.your-server.de

mendating.life	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:81c::200a (Flushing, United States)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:816::2003 (Flushing, United States)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	mendating.life mendating.life	360 KB
1	gstatic.com fonts.gstatic.com	24 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 67	779 B
1	girlslinkclub.live 1 redirects girlslinkclub.live	559 B
1	shorturl.ca 1 redirects shorturl.ca	129 B
14	5

	Domain	Requested by
12	mendating.life	mendating.life
1	fonts.gstatic.com	fonts.googleapis.com
1	fonts.googleapis.com	mendating.life
1	girlslinkclub.live	1 redirects
1	shorturl.ca	1 redirects
14	5

This site contains no links.

Subject Issuer	Validity	Valid
mendating.life R3	`2023-05-02` - `2023-07-31`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2023-05-19` - `2023-08-11`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2023-05-19` - `2023-08-11`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://mendating.life/?u=h2wp605&o=lx8k9zh&t=losg&cid=losg
Frame ID: 71BAB8FBCEB9A304EF2A8314E336D094
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Looking for sex tonight in Montreal?

Page URL History Show full URLs

https://shorturl.ca/eddy25 HTTP 301
https://girlslinkclub.live/1q93jn HTTP 302
https://mendating.life/?u=h2wp605&o=lx8k9zh&t=losg&cid=losg Page URL

Page Statistics

14
Requests

100 %
HTTPS

40 %
IPv6

5
Domains

5
Subdomains

3
IPs

4
Countries

385 kB
Transfer

375 kB
Size

3
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://shorturl.ca/eddy25 HTTP 301
https://girlslinkclub.live/1q93jn HTTP 302
https://mendating.life/?u=h2wp605&o=lx8k9zh&t=losg&cid=losg Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request / Show response
mendating.life/
Redirect Chain

https://shorturl.ca/eddy25
https://girlslinkclub.live/1q93jn
https://mendating.life/?u=h2wp605&o=lx8k9zh&t=losg&cid=losg

6 KB
6 KB

388ms
159ms

Document
text/html

23.88.34.247
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://mendating.life/?u=h2wp605&o=lx8k9zh&t=losg&cid=losg
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, CHACHA20_POLY1305
Server: 23.88.34.247 Gunzenhausen, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.247.34.88.23.clients.your-server.de
Software: nginx /
Resource Hash: 85bc7a95a989a6a1a9958a175eadcbb1c02f646047f9bc5f93fa18f4caf98030

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Cache-Control: no-transform
Connection: keep-alive
Content-Length: 5860
Content-Type: text/html
Date: Sat, 10 Jun 2023 09:20:05 GMT
Server: nginx
cache-control: private

Redirect headers

cache-control: max-age=0
content-encoding: br
content-type: text/html; charset=utf-8
date: Sat, 10 Jun 2023 09:20:04 GMT
expires: Thu, 21 Jul 1977 07:30:00 GMT
last-modified: Sat, 10 Jun 2023 09:20:04 GMT
location: https://mendating.life/?u=h2wp605&o=lx8k9zh&t=losg&cid=losg
pragma: no-cache
server: ddos-guard
vary: Accept-Encoding
x-powered-by: PHP/5.6.40

GET
H/1.1 200
OK main.css
mendating.life/media/gay-dating/casualred/ 18 KB
18 KB 107ms
106ms Stylesheet
text/css 23.88.34.247
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://mendating.life/media/gay-dating/casualred/main.css

Requested by

Host: mendating.life
URL: https://mendating.life/?u=h2wp605&o=lx8k9zh&t=losg&cid=losg

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, CHACHA20_POLY1305

Server

23.88.34.247 Gunzenhausen, Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

static.247.34.88.23.clients.your-server.de

Software

nginx /

Resource Hash

b616b429b4c415453d68ed3333f92d7dc2f4be1f2671ed01b99d3b5ee625a83b

Security Headers

Name	Value
Content-Security-Policy	block-all-mixed-content
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://mendating.life/?u=h2wp605&o=lx8k9zh&t=losg&cid=losg
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

Date: Sat, 10 Jun 2023 09:20:05 GMT
Content-Security-Policy: block-all-mixed-content
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Amz-Request-Id: 17674064215C57EE
Connection: keep-alive
Content-Length: 18004
X-Xss-Protection: 1; mode=block
Last-Modified: Mon, 20 Feb 2023 09:32:51 GMT
Server: nginx
x-amz-meta-mm-source-mtime: 2022-06-16T13:20:50.210869Z
ETag: "75e2e54dd48877c2dfc70140007c0b1a"
Vary: Origin, Accept-Encoding
Content-Type: text/css
Cache-Control: max-age=31536000, no-transform
Accept-Ranges: bytes
x-amz-meta-mc-attrs: atime:1676843369#603717015/gid:0/gname:root/mode:33279/mtime:1655385650#210869000/uid:0/uname:root
Expires: Sun, 09 Jun 2024 09:20:05 GMT

GET
H/1.1 200
OK script.min.js Show response
mendating.life/media/gay-dating/casualred/ 252 KB
252 KB 316ms
105ms Script
application/javascript 23.88.34.247
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://mendating.life/media/gay-dating/casualred/script.min.js

Requested by

Host: mendating.life
URL: https://mendating.life/?u=h2wp605&o=lx8k9zh&t=losg&cid=losg

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, CHACHA20_POLY1305

Server

23.88.34.247 Gunzenhausen, Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

static.247.34.88.23.clients.your-server.de

Software

nginx /

Resource Hash

322d600431f53fb186989dad7e4ed1365b0d3012a808cd114390855a0dce16a6

Security Headers

Name	Value
Content-Security-Policy	block-all-mixed-content
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://mendating.life/?u=h2wp605&o=lx8k9zh&t=losg&cid=losg
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

Date: Sat, 10 Jun 2023 09:20:05 GMT
Content-Security-Policy: block-all-mixed-content
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Amz-Request-Id: 1767406442938EE7
Connection: keep-alive
Content-Length: 257552
X-Xss-Protection: 1; mode=block
Last-Modified: Mon, 20 Feb 2023 09:32:52 GMT
Server: nginx
x-amz-meta-mm-source-mtime: 2022-06-16T13:20:50.50287Z
ETag: "28c2e529f18ba1afa7f17dc8776448d0"
Vary: Origin, Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=31536000, no-transform
Accept-Ranges: bytes
x-amz-meta-mc-attrs: atime:1676843369#603717015/gid:0/gname:root/mode:33279/mtime:1655385650#502870000/uid:0/uname:root
Expires: Sun, 09 Jun 2024 09:20:05 GMT

GET
H/1.1 200
OK function.js Show response
mendating.life/media/gay-dating/casualred/ 2 KB
3 KB 321ms
106ms Script
application/javascript 23.88.34.247
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://mendating.life/media/gay-dating/casualred/function.js

Requested by

Host: mendating.life
URL: https://mendating.life/?u=h2wp605&o=lx8k9zh&t=losg&cid=losg

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, CHACHA20_POLY1305

Server

23.88.34.247 Gunzenhausen, Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

static.247.34.88.23.clients.your-server.de

Software

nginx /

Resource Hash

42eacfd4b560b54c52dcb35db3bdb0adb5129ac0ca357f91703ec49354a40e86

Security Headers

Name	Value
Content-Security-Policy	block-all-mixed-content
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://mendating.life/?u=h2wp605&o=lx8k9zh&t=losg&cid=losg
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

Date: Sat, 10 Jun 2023 09:20:05 GMT
Content-Security-Policy: block-all-mixed-content
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Amz-Request-Id: 176740643889D0BC
Connection: keep-alive
Content-Length: 2245
X-Xss-Protection: 1; mode=block
Last-Modified: Mon, 20 Feb 2023 09:32:51 GMT
Server: nginx
x-amz-meta-mm-source-mtime: 2022-07-29T09:14:03.965069Z
ETag: "66ca190ab1102e93f3fa2ac6b4ae7f57"
Vary: Origin, Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=31536000, no-transform
Accept-Ranges: bytes
x-amz-meta-mc-attrs: atime:1676801157#908345725/gid:0/gname:root/mode:33188/mtime:1659086043#965069000/uid:0/uname:root
Expires: Sun, 09 Jun 2024 09:20:05 GMT

GET
H/1.1 200
OK js.cookie12.js Show response
mendating.life/cookie/ 4 KB
5 KB 321ms
107ms Script
application/javascript 23.88.34.247
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://mendating.life/cookie/js.cookie12.js

Requested by

Host: mendating.life
URL: https://mendating.life/?u=h2wp605&o=lx8k9zh&t=losg&cid=losg

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, CHACHA20_POLY1305

Server

23.88.34.247 Gunzenhausen, Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

static.247.34.88.23.clients.your-server.de

Software

nginx /

Resource Hash

aa5d1b6067126f0258e1eb7d49c12332eada6e0faa6d12780c5c7cceb7c2917b

Security Headers

Name	Value
Content-Security-Policy	block-all-mixed-content
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://mendating.life/?u=h2wp605&o=lx8k9zh&t=losg&cid=losg
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

Date: Sat, 10 Jun 2023 09:20:05 GMT
Content-Security-Policy: block-all-mixed-content
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Amz-Request-Id: 176740808A524176
Connection: keep-alive
Content-Length: 4132
X-Xss-Protection: 1; mode=block
Last-Modified: Wed, 31 Aug 2022 09:31:17 GMT
Server: nginx
ETag: "96297175d62baf61cf9c239d8729ed39"
Vary: Origin, Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=31536000, no-transform
Accept-Ranges: bytes
Expires: Sun, 09 Jun 2024 09:20:05 GMT

GET
H/1.1 200
OK utils-gd.js Show response
mendating.life/util/ 5 KB
6 KB 325ms
108ms Script
application/javascript 23.88.34.247
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://mendating.life/util/utils-gd.js

Requested by

Host: mendating.life
URL: https://mendating.life/?u=h2wp605&o=lx8k9zh&t=losg&cid=losg

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, CHACHA20_POLY1305

Server

23.88.34.247 Gunzenhausen, Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

static.247.34.88.23.clients.your-server.de

Software

nginx /

Resource Hash

d0ebdabad30953e3025171033595ea64977cb50fd9d3ca8e0920cf031e441aff

Security Headers

Name	Value
Content-Security-Policy	block-all-mixed-content
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://mendating.life/?u=h2wp605&o=lx8k9zh&t=losg&cid=losg
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

Date: Sat, 10 Jun 2023 09:20:05 GMT
Content-Security-Policy: block-all-mixed-content
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Amz-Request-Id: 176740808991A02D
Connection: keep-alive
Content-Length: 5289
X-Xss-Protection: 1; mode=block
Last-Modified: Mon, 20 Feb 2023 09:36:45 GMT
Server: nginx
x-amz-meta-mm-source-mtime: 2022-07-29T09:04:49.484136Z
ETag: "2d1fa146401375dc0d305edf9f2b75b2"
Vary: Origin, Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=31536000, no-transform
Accept-Ranges: bytes
x-amz-meta-mc-attrs: atime:1676885559#334512232/gid:0/gname:root/mode:33188/mtime:1659085489#484136000/uid:0/uname:root
Expires: Sun, 09 Jun 2024 09:20:05 GMT

GET
H/1.1 200
OK bbg.js Show response
mendating.life/media/ 1 KB
2 KB 326ms
108ms Script
application/javascript 23.88.34.247
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://mendating.life/media/bbg.js

Requested by

Host: mendating.life
URL: https://mendating.life/?u=h2wp605&o=lx8k9zh&t=losg&cid=losg

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, CHACHA20_POLY1305

Server

23.88.34.247 Gunzenhausen, Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

static.247.34.88.23.clients.your-server.de

Software

nginx /

Resource Hash

937b56fed15e05e9c90f278f2bef06f3969f3333a0b0d8be998ab22a13f9d673

Security Headers

Name	Value
Content-Security-Policy	block-all-mixed-content
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://mendating.life/?u=h2wp605&o=lx8k9zh&t=losg&cid=losg
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

Date: Sat, 10 Jun 2023 09:20:05 GMT
Content-Security-Policy: block-all-mixed-content
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Amz-Request-Id: 176740808AB81859
Connection: keep-alive
Content-Length: 1132
X-Xss-Protection: 1; mode=block
Last-Modified: Mon, 20 Feb 2023 09:29:45 GMT
Server: nginx
x-amz-meta-mm-source-mtime: 2022-07-28T17:55:53.256807Z
ETag: "150774bc12561727ed84f625acdd3b47"
Vary: Origin, Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=31536000, no-transform
Accept-Ranges: bytes
x-amz-meta-mc-attrs: atime:1676832256#258761277/gid:0/gname:root/mode:33188/mtime:1659030953#256807000/uid:0/uname:root
Expires: Sun, 09 Jun 2024 09:20:05 GMT

GET
H2 200 css
fonts.googleapis.com/ 717 B
779 B 82ms
35ms Stylesheet
text/css 2607:f8b0:4006:81c::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Lato&subset=latin-ext

Requested by

Host: mendating.life
URL: https://mendating.life/media/gay-dating/casualred/main.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81c::200a Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

eb91e77384f9aff2e81a868ae4f2ae6fb5940c573d0e39088ff637414b4ffed9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://mendating.life/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sat, 10 Jun 2023 09:20:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sat, 10 Jun 2023 09:03:57 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 10 Jun 2023 09:20:05 GMT

GET
H/1.1 200
OK no.png
mendating.life/media/gay-dating/casualred/ 3 KB
4 KB 106ms
105ms Image
image/png 23.88.34.247
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mendating.life/media/gay-dating/casualred/no.png

Requested by

Host: mendating.life
URL: https://mendating.life/media/gay-dating/casualred/main.css

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, CHACHA20_POLY1305

Server

23.88.34.247 Gunzenhausen, Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

static.247.34.88.23.clients.your-server.de

Software

nginx /

Resource Hash

fedd7527d1cceee3052bf4bb62e76d56e8200a115d8a2affae23a125578b7ad1

Security Headers

Name	Value
Content-Security-Policy	block-all-mixed-content
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://mendating.life/media/gay-dating/casualred/main.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

Date: Sat, 10 Jun 2023 09:20:05 GMT
Content-Security-Policy: block-all-mixed-content
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Amz-Request-Id: 176740647ABD8B6B
Connection: keep-alive
Content-Length: 3134
X-Xss-Protection: 1; mode=block
Last-Modified: Mon, 20 Feb 2023 09:32:51 GMT
Server: nginx
x-amz-meta-mm-source-mtime: 2022-06-16T13:20:50.274869Z
ETag: "e51438397f6333f22081857d4236efca"
Vary: Origin, Accept-Encoding
Content-Type: image/png
Cache-Control: max-age=31536000, no-transform
Accept-Ranges: bytes
x-amz-meta-mc-attrs: atime:1676843369#603717015/gid:0/gname:root/mode:33279/mtime:1655385650#274869000/uid:0/uname:root
Expires: Sun, 09 Jun 2024 09:20:05 GMT

GET
H/1.1 200
OK yes.png
mendating.life/media/gay-dating/casualred/ 3 KB
4 KB 111ms
110ms Image
image/png 23.88.34.247
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mendating.life/media/gay-dating/casualred/yes.png

Requested by

Host: mendating.life
URL: https://mendating.life/media/gay-dating/casualred/main.css

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, CHACHA20_POLY1305

Server

23.88.34.247 Gunzenhausen, Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

static.247.34.88.23.clients.your-server.de

Software

nginx /

Resource Hash

6bfdecff876226c1e233f71e7b0b1a6e0eb238281a52156c39f051691dd88a43

Security Headers

Name	Value
Content-Security-Policy	block-all-mixed-content
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://mendating.life/media/gay-dating/casualred/main.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

Date: Sat, 10 Jun 2023 09:20:05 GMT
Content-Security-Policy: block-all-mixed-content
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Amz-Request-Id: 176740647B086D08
Connection: keep-alive
Content-Length: 3480
X-Xss-Protection: 1; mode=block
Last-Modified: Mon, 20 Feb 2023 09:32:52 GMT
Server: nginx
x-amz-meta-mm-source-mtime: 2022-06-16T13:20:50.56287Z
ETag: "3d0dab8337c085af1541ee5b7d63b53b"
Vary: Origin, Accept-Encoding
Content-Type: image/png
Cache-Control: max-age=31536000, no-transform
Accept-Ranges: bytes
x-amz-meta-mc-attrs: atime:1676843369#603717015/gid:0/gname:root/mode:33279/mtime:1655385650#562870000/uid:0/uname:root
Expires: Sun, 09 Jun 2024 09:20:05 GMT

GET
H/1.1 200
OK 1.jpg
mendating.life/media/gay-dating/casualred/ 53 KB
54 KB 110ms
110ms Image
image/jpeg 23.88.34.247
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mendating.life/media/gay-dating/casualred/1.jpg

Requested by

Host: mendating.life
URL: https://mendating.life/media/gay-dating/casualred/main.css

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, CHACHA20_POLY1305

Server

23.88.34.247 Gunzenhausen, Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

static.247.34.88.23.clients.your-server.de

Software

nginx /

Resource Hash

ceab9d809e41e4cb7a5f795de8ab3ede5052b345af1632c4bedaef76471a7dba

Security Headers

Name	Value
Content-Security-Policy	block-all-mixed-content
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://mendating.life/media/gay-dating/casualred/main.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

Date: Sat, 10 Jun 2023 09:20:05 GMT
Content-Security-Policy: block-all-mixed-content
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Amz-Request-Id: 176740647B3E74DB
Connection: keep-alive
Content-Length: 54105
X-Xss-Protection: 1; mode=block
Last-Modified: Mon, 20 Feb 2023 09:32:51 GMT
Server: nginx
x-amz-meta-mm-source-mtime: 2022-06-16T13:20:49.106867Z
ETag: "7cf7dcdff18e9d1bdcac07ba7dd924b8"
Vary: Origin, Accept-Encoding
Content-Type: image/jpeg
Cache-Control: max-age=31536000, no-transform
Accept-Ranges: bytes
x-amz-meta-mc-attrs: atime:1676843369#599717010/gid:0/gname:root/mode:33279/mtime:1655385649#106867000/uid:0/uname:root
Expires: Sun, 09 Jun 2024 09:20:05 GMT

GET
H/1.1 200
OK pattern.png
mendating.life/media/gay-dating/casualred/ 3 KB
4 KB 107ms
106ms Image
image/png 23.88.34.247
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mendating.life/media/gay-dating/casualred/pattern.png

Requested by

Host: mendating.life
URL: https://mendating.life/media/gay-dating/casualred/main.css

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, CHACHA20_POLY1305

Server

23.88.34.247 Gunzenhausen, Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

static.247.34.88.23.clients.your-server.de

Software

nginx /

Resource Hash

5cbc28ef1cf07ab8956014b581aa2b96baac861237975813702e63c886b0c004

Security Headers

Name	Value
Content-Security-Policy	block-all-mixed-content
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://mendating.life/media/gay-dating/casualred/main.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

Date: Sat, 10 Jun 2023 09:20:05 GMT
Content-Security-Policy: block-all-mixed-content
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Amz-Request-Id: 176740647B3ED373
Connection: keep-alive
Content-Length: 2801
X-Xss-Protection: 1; mode=block
Last-Modified: Mon, 20 Feb 2023 09:32:51 GMT
Server: nginx
x-amz-meta-mm-source-mtime: 2022-06-16T13:20:50.330869Z
ETag: "f06b5903c3ed5ef39db9b98b60deba70"
Vary: Origin, Accept-Encoding
Content-Type: image/png
Cache-Control: max-age=31536000, no-transform
Accept-Ranges: bytes
x-amz-meta-mc-attrs: atime:1676843369#603717015/gid:0/gname:root/mode:33279/mtime:1655385650#330869000/uid:0/uname:root
Expires: Sun, 09 Jun 2024 09:20:05 GMT

GET
H2 200 S6uyw4BMUTPHjx4wXg.woff2
fonts.gstatic.com/s/lato/v24/ 23 KB
24 KB 66ms
19ms Font
font/woff2 2607:f8b0:4006:816::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v24/S6uyw4BMUTPHjx4wXg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Lato&subset=latin-ext

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:816::2003 Flushing, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://mendating.life
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

date: Fri, 09 Jun 2023 23:33:59 GMT
x-content-type-options: nosniff
age: 35166
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23580
x-xss-protection: 0
last-modified: Tue, 02 May 2023 15:17:22 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 08 Jun 2024 23:33:59 GMT

GET
H/1.1 200
OK alert.mp3 Show response
mendating.life/media/gay-dating/casualred/ 2 KB
3 KB 109ms
108ms XHR
audio/mpeg 23.88.34.247
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://mendating.life/media/gay-dating/casualred/alert.mp3

Requested by

Host: mendating.life
URL: https://mendating.life/?u=h2wp605&o=lx8k9zh&t=losg&cid=losg

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, CHACHA20_POLY1305

Server

23.88.34.247 Gunzenhausen, Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

static.247.34.88.23.clients.your-server.de

Software

nginx /

Resource Hash

67a6dc7e24f4a3c142724bb37a358037538befb731478c33d58f236ba836ed78

Security Headers

Name	Value
Content-Security-Policy	block-all-mixed-content
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://mendating.life/?u=h2wp605&o=lx8k9zh&t=losg&cid=losg
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36

Response headers

Date: Sat, 10 Jun 2023 09:20:06 GMT
Content-Security-Policy: block-all-mixed-content
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Amz-Request-Id: 17674064AE3D5ACA
Connection: keep-alive
Content-Length: 2428
X-Xss-Protection: 1; mode=block
Last-Modified: Mon, 20 Feb 2023 09:32:51 GMT
Server: nginx
x-amz-meta-mm-source-mtime: 2022-06-16T13:20:49.578868Z
ETag: "1cc1d4ac3c38c157acf9380ce15cd8ff"
Vary: Origin, Accept-Encoding
Content-Type: audio/mpeg
Cache-Control: max-age=31536000, no-transform
Accept-Ranges: bytes
x-amz-meta-mc-attrs: atime:1676843369#599717010/gid:0/gname:root/mode:33279/mtime:1655385649#578868000/uid:0/uname:root
Expires: Sun, 09 Jun 2024 09:20:06 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Porn Scam (Online)

31 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.girlslinkclub.live/	1970-01-20 21:12:04	Name: __ddg1_ Value: klosCzXaUbvcvluF0e7Z
.girlslinkclub.live/	1970-01-20 13:11:07	Name: 847ba Value: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjI1XCI6MTY4NjM4ODgwNH0sXCJjYW1wYWlnbnNcIjp7XCI0XCI6MTY4NjM4ODgwNH0sXCJ0aW1lXCI6MTY4NjM4ODgwNH0ifQ.teu6Q-cLDXs3tmuAOctrnFgVFu9O-ywWaTrMV0aPPfg
mendating.life/	1969-12-31 23:59:59	Name: sid Value: t1~s3oshvopxwuy5w1lywskvkyg

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	URL: https://mendating.life/?u=h2wp605&o=lx8k9zh&t=losg&cid=losg(Line 139) Message: The AudioContext was not allowed to start. It must be resumed (or created) after a user gesture on the page. https://goo.gl/7K7WLu
other	warning	URL: https://mendating.life/?u=h2wp605&o=lx8k9zh&t=losg&cid=losg(Line 153) Message: The AudioContext was not allowed to start. It must be resumed (or created) after a user gesture on the page. https://goo.gl/7K7WLu

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.googleapis.com
fonts.gstatic.com
girlslinkclub.live
mendating.life
shorturl.ca
23.88.34.247
2607:f8b0:4006:816::2003
2607:f8b0:4006:81c::200a
81.91.178.150
91.215.219.133
322d600431f53fb186989dad7e4ed1365b0d3012a808cd114390855a0dce16a6
42eacfd4b560b54c52dcb35db3bdb0adb5129ac0ca357f91703ec49354a40e86
5cbc28ef1cf07ab8956014b581aa2b96baac861237975813702e63c886b0c004
67a6dc7e24f4a3c142724bb37a358037538befb731478c33d58f236ba836ed78
6bfdecff876226c1e233f71e7b0b1a6e0eb238281a52156c39f051691dd88a43
85bc7a95a989a6a1a9958a175eadcbb1c02f646047f9bc5f93fa18f4caf98030
918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537
937b56fed15e05e9c90f278f2bef06f3969f3333a0b0d8be998ab22a13f9d673
aa5d1b6067126f0258e1eb7d49c12332eada6e0faa6d12780c5c7cceb7c2917b
b616b429b4c415453d68ed3333f92d7dc2f4be1f2671ed01b99d3b5ee625a83b
ceab9d809e41e4cb7a5f795de8ab3ede5052b345af1632c4bedaef76471a7dba
d0ebdabad30953e3025171033595ea64977cb50fd9d3ca8e0920cf031e441aff
eb91e77384f9aff2e81a868ae4f2ae6fb5940c573d0e39088ff637414b4ffed9
fedd7527d1cceee3052bf4bb62e76d56e8200a115d8a2affae23a125578b7ad1

mendating.life Open in urlscan Pro 23.88.34.247 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

14 Requests

100 %HTTPS

40 %IPv6

5 Domains

5 Subdomains

3 IPs

4 Countries

385 kBTransfer

375 kBSize

3 Cookies

0 Outgoing links

Page URL History

Redirected requests

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

31 JavaScript Global Variables

3 Cookies

2 Console Messages

Indicators

mendating.life Open in urlscan Pro
23.88.34.247 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

14
Requests

100 %
HTTPS

40 %
IPv6

5
Domains

5
Subdomains

3
IPs

4
Countries

385 kB
Transfer

375 kB
Size

3
Cookies

14 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!