![](/screenshots/4a94f7e9-2d18-419c-bceb-ed89c0b4dfc2.png)
ww25.laudypauty.com
Open in
urlscan Pro
199.59.243.225
Malicious Activity!
Public Scan
Effective URL: http://ww25.laudypauty.com/1014ba03c4e6c96c000/19?subid1=20231119-0335-12d9-b0d1-7e7204c7c40b
Submission Tags: @phish_report
Submission: On November 18 via api from FI — Scanned from FI
Summary
This is the only time ww25.laudypauty.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Community Verdicts: Malicious — 2 votes Show Verdicts
Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 104.244.42.69 104.244.42.69 | 13414 (TWITTER) (TWITTER) | |
1 | 2a00:1450:400... 2a00:1450:4001:811::200a | 15169 (GOOGLE) (GOOGLE) | |
1 1 | 103.224.212.217 103.224.212.217 | 133618 (TRELLIAN-...) (TRELLIAN-AS-AP Trellian Pty. Limited) | |
4 | 199.59.243.225 199.59.243.225 | 16509 (AMAZON-02) (AMAZON-02) | |
5 | 2a00:1450:400... 2a00:1450:4001:80b::2004 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:831::2002 | 15169 (GOOGLE) (GOOGLE) | |
2 | 2a00:1450:400... 2a00:1450:4001:82a::2001 | 15169 (GOOGLE) (GOOGLE) | |
14 | 6 |
ASN15169 (GOOGLE, US)
firebasestorage.googleapis.com |
ASN133618 (TRELLIAN-AS-AP Trellian Pty. Limited, AU)
PTR: lb-212-217.above.com
laudypauty.com |
ASN15169 (GOOGLE, US)
partner.googleadservices.com |
ASN15169 (GOOGLE, US)
afs.googleusercontent.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
5 |
google.com
www.google.com — Cisco Umbrella Rank: 2 |
110 KB |
5 |
laudypauty.com
1 redirects
laudypauty.com ww25.laudypauty.com |
37 KB |
2 |
googleusercontent.com
afs.googleusercontent.com — Cisco Umbrella Rank: 9168 |
1 KB |
1 |
googleadservices.com
partner.googleadservices.com — Cisco Umbrella Rank: 1181 |
593 B |
1 |
googleapis.com
firebasestorage.googleapis.com — Cisco Umbrella Rank: 6216 |
649 B |
1 |
t.co
t.co — Cisco Umbrella Rank: 607 |
647 B |
14 | 6 |
Domain | Requested by | |
---|---|---|
5 | www.google.com |
ww25.laudypauty.com
www.google.com |
4 | ww25.laudypauty.com |
firebasestorage.googleapis.com
ww25.laudypauty.com |
2 | afs.googleusercontent.com |
www.google.com
|
1 | partner.googleadservices.com |
www.google.com
|
1 | laudypauty.com | 1 redirects |
1 | firebasestorage.googleapis.com |
t.co
|
1 | t.co | |
14 | 7 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
t.co DigiCert TLS Hybrid ECC SHA384 2020 CA1 |
2023-02-05 - 2024-02-05 |
a year | crt.sh |
upload.video.google.com GTS CA 1C3 |
2023-10-23 - 2024-01-15 |
3 months | crt.sh |
www.google.com GTS CA 1C3 |
2023-10-23 - 2024-01-15 |
3 months | crt.sh |
*.googleadservices.com GTS CA 1C3 |
2023-10-23 - 2024-01-15 |
3 months | crt.sh |
*.google.com GTS CA 1C3 |
2023-10-23 - 2024-01-15 |
3 months | crt.sh |
*.googleusercontent.com GTS CA 1C3 |
2023-10-23 - 2024-01-15 |
3 months | crt.sh |
This page contains 2 frames:
Primary Page:
http://ww25.laudypauty.com/1014ba03c4e6c96c000/19?subid1=20231119-0335-12d9-b0d1-7e7204c7c40b
Frame ID: BB99623FB22182265A7E3B3AB7E26029
Requests: 10 HTTP requests in this frame
Frame:
https://www.google.com/afs/ads?adtest=off&psid=3113057640&pcsa=false&channel=pid-bodis-gcontrol202%2Cpid-bodis-gcontrol97%2Cpid-bodis-gcontrol316%2Cpid-bodis-gcontrol152%2Cpid-bodis-gcontrol466&client=dp-bodis30_3ph&r=m&hl=en&rpbu=http%3A%2F%2Fww25.laudypauty.com%3Fcaf%26subid1%3D20231119-0335-12d9-b0d1-7e7204c7c40b&max_radlink_len=50&type=3&uiopt=false&swp=as-drid-2497786236455022&oe=UTF-8&ie=UTF-8&fexp=21404%2C17301157&format=r3&nocache=8381700325313701&num=0&output=afd_ads&domain_name=ww25.laudypauty.com&v=3&bsl=8&pac=0&u_his=2&u_tz=120&dt=1700325313702&u_w=1600&u_h=1200&biw=1600&bih=1200&psw=1600&psh=1080&frm=0&cl=579967862&uio=-&cont=rs&jsid=caf&jsv=579967862&rurl=http%3A%2F%2Fww25.laudypauty.com%2F1014ba03c4e6c96c000%2F19%3Fsubid1%3D20231119-0335-12d9-b0d1-7e7204c7c40b
Frame ID: C8DAAE2F9862728DE945D0B02EE8D51A
Requests: 4 HTTP requests in this frame
Screenshot
![](/screenshots/4a94f7e9-2d18-419c-bceb-ed89c0b4dfc2.png)
Page Title
Laudypauty.comPage URL History Show full URLs
- https://t.co/Q7TL616IGE Page URL
- https://firebasestorage.googleapis.com/v0/b/sohqibq.appspot.com/o/walmrt.html?alt=media&token=128a1bf5-b2d7-4a3c-99... Page URL
-
https://laudypauty.com/1014ba03c4e6c96c000/19
HTTP 302
http://ww25.laudypauty.com/1014ba03c4e6c96c000/19?subid1=20231119-0335-12d9-b0d1-7e7204c7c40b Page URL
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://t.co/Q7TL616IGE Page URL
- https://firebasestorage.googleapis.com/v0/b/sohqibq.appspot.com/o/walmrt.html?alt=media&token=128a1bf5-b2d7-4a3c-9985-9b0c7411ae65 Page URL
-
https://laudypauty.com/1014ba03c4e6c96c000/19
HTTP 302
http://ww25.laudypauty.com/1014ba03c4e6c96c000/19?subid1=20231119-0335-12d9-b0d1-7e7204c7c40b Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
14 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Q7TL616IGE
t.co/ |
557 B 647 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
walmrt.html
firebasestorage.googleapis.com/v0/b/sohqibq.appspot.com/o/ |
89 B 649 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
19
ww25.laudypauty.com/1014ba03c4e6c96c000/ Redirect Chain
|
1 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bpGuWYFrA.js
ww25.laudypauty.com/ |
31 KB 32 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
_fd
ww25.laudypauty.com/ |
5 KB 3 KB |
Fetch
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
caf.js
www.google.com/adsense/domains/ |
146 KB 54 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cookie.js
partner.googleadservices.com/gampad/ |
382 B 593 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ads
www.google.com/afs/ Frame C8DA |
13 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
caf.js
www.google.com/adsense/domains/ Frame C8DA |
146 KB 53 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
chevron.svg
afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/ Frame C8DA |
200 B 700 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
call_to_action_arrow.svg
afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/ Frame C8DA |
444 B 393 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
_tr
ww25.laudypauty.com/ |
2 B 0 |
Fetch
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
gen_204
www.google.com/afs/ |
0 22 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
gen_204
www.google.com/afs/ |
0 21 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Malicious
page.domain
Submitted on
November 18th 2023, 4:36:15 pm
UTC —
From United States
Threats:
Malware
Unwanted Software
Potentially Harmful Application
Comment: RUSSIAN SPYWARE: https://t.co/Q7TL616IGE sent by RUSSIAN MALNET using harvested emails and MALICIOUS websites: https://t.co https://firebasestorage.googleapis.com https://laudypauty.com http://ww25.laudypauty.com http://binga.pro https://storage.googleapis.com http://holor.cc https://zommermist.com https://yaffscup.online https://tinyurl.com/yo2bsea8 https://clk-1699884554.newtopoffer.live https://clk-1699884554.imaginio.live https://s-1699884554.dopino.co
Malicious
task.url
Submitted on
November 18th 2023, 4:35:58 pm
UTC —
From United States
Threats:
Malware
Unwanted Software
Potentially Harmful Application
Comment: RUSSIAN SPYWARE: https://t.co/Q7TL616IGE sent by RUSSIAN MALNET using harvested emails and MALICIOUS websites: https://t.co https://firebasestorage.googleapis.com https://laudypauty.com http://ww25.laudypauty.com http://binga.pro https://storage.googleapis.com http://holor.cc https://zommermist.com https://yaffscup.online https://tinyurl.com/yo2bsea8 https://clk-1699884554.newtopoffer.live https://clk-1699884554.imaginio.live https://s-1699884554.dopino.co
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
9 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 string| park object| version object| __parkour number| googleNDT_ number| googleAltLoader object| google function| __sasCookie number| experimentId_5 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
laudypauty.com/1014ba03c4e6c96c000 | Name: __tad Value: 1700325312.2087370 |
|
.t.co/ | Name: muc Value: 5af281e7-59b0-40f3-9ac4-4718a3da2d5b |
|
ww25.laudypauty.com/ | Name: parking_session Value: 48d79206-3c3b-4a9b-bfe9-6a559e0dcf4c |
|
.laudypauty.com/ | Name: __gsas Value: ID=a6dd2e7dcedba5c7:T=1700325313:RT=1700325313:S=ALNI_MYtoVsccr0y7cn79IMX0X4pmU6rbw |
|
.google.com/ | Name: NID Value: 511=KsanvmgtlLVp5auhyAeoePF-SbHdop8Vb3o8cJAqYFeQy-cDRYWTc8_A3clceTpIAtlSUuIdxc2RAuriaKZE9RaqrOaUYRIFsnLFppwxXfqrIrzXCne6wa737swx8cr9TPIyAtGjL9gCnmnsX3JshxZqpmWsr91l5hIuSkOnVfo |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=0 |
X-Xss-Protection | 0 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
afs.googleusercontent.com
firebasestorage.googleapis.com
laudypauty.com
partner.googleadservices.com
t.co
ww25.laudypauty.com
www.google.com
103.224.212.217
104.244.42.69
199.59.243.225
2a00:1450:4001:80b::2004
2a00:1450:4001:811::200a
2a00:1450:4001:82a::2001
2a00:1450:4001:831::2002
2311b7f476967188dddb6a5da6e499766cc63b52921dbaf24d78ea39e6fb5b07
2b73790f4314e3db3d6bca4be7739fe2cf5829091153bd0f19a8f7a08a4609c1
3503f88f15c97af34775dd6a1601c85fed1402b075d1889a263b28dedbafc37f
46e2c2af87720b7ae5a86434547bd9bef9ff21fab2956b64bc48f17dc73c63a7
5455d8d4b8ae5150039ff7a83a6679d4338a435945985fa9f8d0ecbea9ae2f6e
5a0687ea8c9aa404a7724490f046e30023ec6b5aa81d01ae4f225889a64174f6
7a08cc4df936b3b9281a4f83dfbb82f4f5b6198300041a8d7d4b95bb6ac4f3de
a1f85a8b9c0ae7e01a01780b44c447ebbadb5d856c6ff826e2cd9fe19f15135f
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f70501fc11a83cfb8bfa02e5e52d0d7998e9179d401bec1142696857825855b5