www.todayhotties.ru
Open in
urlscan Pro
158.69.126.131
Malicious Activity!
Public Scan
Effective URL: http://www.todayhotties.ru/s/5af3ff4b5a866
Submission: On November 21 via manual from AU — Scanned from US
Summary
This is the only time www.todayhotties.ru was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Porn Scam (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 67.199.248.10 67.199.248.10 | 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM) | |
1 2 | 151.101.2.159 151.101.2.159 | 54113 (FASTLY) (FASTLY) | |
1 1 | 185.36.100.24 185.36.100.24 | 62403 (GO4CLOUD) (GO4CLOUD) | |
11 | 158.69.126.131 158.69.126.131 | 16276 (OVH) (OVH) | |
1 | 2607:f8b0:400... 2607:f8b0:4004:c1b::5f | 15169 (GOOGLE) (GOOGLE) | |
1 | 2607:f8b0:402... 2607:f8b0:4024:c01::5e | 15169 (GOOGLE) (GOOGLE) | |
14 | 4 |
ASN16276 (OVH, FR)
PTR: ns522380.ip-158-69-126.net
www.todayhotties.ru |
Apex Domain Subdomains |
Transfer | |
---|---|---|
11 |
todayhotties.ru
www.todayhotties.ru |
499 KB |
2 |
experiencebrightwater.ca
1 redirects
experiencebrightwater.ca |
1 KB |
1 |
gstatic.com
fonts.gstatic.com |
24 KB |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 43 |
858 B |
1 |
onlinedates.ru
1 redirects
onlinedates.ru |
261 B |
1 |
bit.ly
1 redirects
bit.ly — Cisco Umbrella Rank: 5383 |
272 B |
14 | 6 |
Domain | Requested by | |
---|---|---|
11 | www.todayhotties.ru |
www.todayhotties.ru
|
2 | experiencebrightwater.ca | 1 redirects |
1 | fonts.gstatic.com |
fonts.googleapis.com
|
1 | fonts.googleapis.com |
www.todayhotties.ru
|
1 | onlinedates.ru | 1 redirects |
1 | bit.ly | 1 redirects |
14 | 6 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
experiencebrightwater.ca R3 |
2022-10-07 - 2023-01-05 |
3 months | crt.sh |
upload.video.google.com GTS CA 1C3 |
2022-11-02 - 2023-01-25 |
3 months | crt.sh |
*.gstatic.com GTS CA 1C3 |
2022-11-02 - 2023-01-25 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
http://www.todayhotties.ru/s/5af3ff4b5a866
Frame ID: E5182E16EC9C8EE096D2AB983C637591
Requests: 14 HTTP requests in this frame
Screenshot
Page Title
The most popular dating site of this monthPage URL History Show full URLs
-
https://bit.ly/3QxeghK?+
HTTP 301
http://experiencebrightwater.ca/eblast/issue25/images/suctorian/attorneyism_lactone.html HTTP 301
https://experiencebrightwater.ca/eblast/issue25/images/suctorian/attorneyism_lactone.html Page URL
-
http://onlinedates.ru/?land=70364
HTTP 302
http://www.todayhotties.ru/s/5af3ff4b5a866 Page URL
Detected technologies
animate.css (Web Frameworks) ExpandDetected patterns
- <link [^>]+(?:/([\d.]+)/)?animate\.(?:min\.)?css
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://bit.ly/3QxeghK?+
HTTP 301
http://experiencebrightwater.ca/eblast/issue25/images/suctorian/attorneyism_lactone.html HTTP 301
https://experiencebrightwater.ca/eblast/issue25/images/suctorian/attorneyism_lactone.html Page URL
-
http://onlinedates.ru/?land=70364
HTTP 302
http://www.todayhotties.ru/s/5af3ff4b5a866 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://bit.ly/3QxeghK?+ HTTP 301
- http://experiencebrightwater.ca/eblast/issue25/images/suctorian/attorneyism_lactone.html HTTP 301
- https://experiencebrightwater.ca/eblast/issue25/images/suctorian/attorneyism_lactone.html
14 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
attorneyism_lactone.html
experiencebrightwater.ca/eblast/issue25/images/suctorian/ Redirect Chain
|
104 B 536 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
5af3ff4b5a866
www.todayhotties.ru/s/ Redirect Chain
|
4 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
animate.min.css
www.todayhotties.ru/bundle/16/assets/css/ |
52 KB 52 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
style.css
www.todayhotties.ru/bundle/16/assets/css/ |
15 KB 15 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-2.2.4.min.js
www.todayhotties.ru/bundle/16/assets/js/ |
84 KB 84 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
script.min.js
www.todayhotties.ru/bundle/16/assets/js/ |
252 KB 252 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
click.js
www.todayhotties.ru/js/ |
5 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
664 B 858 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
no.png
www.todayhotties.ru/bundle/16/assets/img/ |
322 B 566 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
yes.png
www.todayhotties.ru/bundle/16/assets/img/ |
594 B 838 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
1.jpg
www.todayhotties.ru/bundle/16/assets/img/ |
55 KB 55 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
pattern.png
www.todayhotties.ru/bundle/16/assets/img/ |
100 B 343 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
S6uyw4BMUTPHjx4wXg.woff2
fonts.gstatic.com/s/lato/v23/ |
23 KB 24 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
fp2.min.js
www.todayhotties.ru/js/ |
30 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Porn Scam (Online)10 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery function| fingerprintGo function| closingConfirm function| handleError function| getParameterByName function| collectParams function| setLeadInfo function| setCF function| Fingerprint22 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.bit.ly/ | Name: _bit Value: malc74-5e4bdf89008c749a40-00P |
|
.todayhotties.ru/ | Name: s Value: 7NDDwHItog1gHmeLt0rgvSzoZ6y7AneTY51%2FizszR47u6SRiceEhWB2Zwrtt5DkBm8Sr0%2BNtwl5nnUrwQDCVDSB%2BNvgRH5tb%2FTdQQoLuZHGPGCjP1PbghYjd29Iexrgzb6UnoX6RS%2Fh0XBCP04rEApslYO%2FLv0P%2FJztMzL3o8RVOpbNnJi%2BizSXbCdfwHXFlY26hkdr%2BwazweyDvQlTXGumvYboEYvkCmr3LuHYaD7Z%2BAwnnzW2380bXk8lsNsTnT1TB9Via%2BWwsindoks18Zw3fCsVqT2rrV9XiFfiY2mZieBrrspi8qGXn68QADx%2FZAUzr5nn%2FpVM9P%2B4vOpiOaTIdqFAM2y5ue9jwu%2F%2FtXA6a4VqqQ81aPgH61KycxcwR1emyOL23BHsMcJIIEqQzdm8Dci87oWbSvt4Zfpu%2FcjBsuhNkJcqhobmZiMgFm8qBb%2Fzzaqs2pk6VybUbMSlG%2FWJ0%2FfsdvcVRUv6tHL5D5HydQIi1norMI%2BuXGBlMMiVCazqoZN0TfVz4iNCjQhaCbo9ozjVVPIMohwb%2Buh2Qu5EOnBxbMQAR%2B7GL54gd8ImWDciIuyWDDlhEm5AT8SlVpC1cy3DOuuB616z1UWr6I8Fb6%2F0v8K0MoAVk2mpbvH%2FWBxqyHW6KSLRYxWbyQHVb9WhcKt2cHfuYDEBZskrtAvJCvc67icDoZKknVUoD0GQYkOx%2B6NGW6YR5LENfuC48YSFqRmmofa4p3zCILU8kEZCg7qOC7yzkz8fXLBb1hk%2FS5ieqeS123M%2BoUsKPRwvuHsB5MuPbqsRZuhKYo9ZALFAcusiN%2BaZw0BCmxGI993ZHBwM6eCuz4wStVO4b%2BY710AWyNr22viqhFfZ8QTtJwA8L%2B0dTarmbpA52ydZhiinkewVSyWIoqTzBs1220XKrLbhfw8xYJmA6itnEuMkzeixutEqFQ%2FbUKACLq4Ulc8FQZ3hJzvdbutzHaxC5VqCyhjeTxx7q3NN5a6ZQqEy1Lld2xmUgPwUSsRv1tRWt%2FAmQG8NkGWrB3jJSaS8GGXYvLYKH2uKXButqlKYRFu9Gz4zv5JNwcG1tyXqDgBRgEC4jmMGyeHpGF6B%2BWZ9nwiHCx3hg7b6poQFgA24YF7y1a99DVN3%2FIIB9kCNaehIhi6%2BeO9lyl131pZowBRzIY7DZQDSwTi%2B2Og6FDzD5r5QE4Aq773yXqicyz0bP2IRByV50wblDZAndKy%2B14W7DNCq7rmfkfU0YcorFGjHRqTUdE6HimmCjqPmOkOfGxkOp3EF4c1yBi0SjGfOtEPZR76uvYVjFTM0pZZ8%2FijwqSw6gNSD44POikZ3VRDHnaULqODMyOGocf%2FkbT1FyoK4x6nceviyy1v7mRVw3piWJkkggYuSDks7dhKoRG7gHY7GzAweW0hQX4jdMakGrhOTxNPynr62W3P9gupEGN9PXlHqyCifsH4HxyloSmDnKf6lp0muwCrfgNQ0eEO%2FDxJbadXtJZcZwMwkGHwf3zuF72yfvpC8a%2FoJntVnzJIMpIfWUJoN9j0td%2BQe8dMggZue0Nza3ZUKX%2Bc%2BoKwmS%2BwQPOLk%3D |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Content-Type-Options | nosniff |
X-Xss-Protection | 1 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
bit.ly
experiencebrightwater.ca
fonts.googleapis.com
fonts.gstatic.com
onlinedates.ru
www.todayhotties.ru
151.101.2.159
158.69.126.131
185.36.100.24
2607:f8b0:4004:c1b::5f
2607:f8b0:4024:c01::5e
67.199.248.10
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
13de289b7d770632c2b87d7019cdb10416061bcdb50f07cadcc5e4c6cdf33a36
1fc723fa76d4f15c9600cdccc80a44c73e1e0ce9af593e72440198c68b6716d4
3e80058e1e64f3e5085e47096d373ae6b74987d494aec75b3f67872706569ef4
3fa7cbd6ccb0e62abc11ba89609c6cdd73aaa458973ae65b7d590830475ff261
5a9f9b8fdda3dc64dc104281767edc8ce0798cd76bfc307c17a7c7b4db115c86
6e1bf43d1d49858aacd5de53b32b551732bca4b2a46b1f808eb6d6d0f2b70c0e
76d703389c75e3c1e9946072b1e18f6d61842f77eac3f03cfb366baba8035850
855f62c34d296773b690bcd61d702db042b6085294928d1f7064c022b47d2695
8fe3fa119255adb5e0c12479331f9e092e85bcff56ab6ecc0510bfa2056b898d
918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537
a88f88462c0343bc65173e05743424a0894478ce81f27d1a02af664b278f9700
f71ae9723255b00dcc8e3631fe419cbbb56a80b3034f184ca5292127d7b3eea9