Submitted URL: http://iwantu.store/
Effective URL: https://dating01t.datingem.com/?bg=1&chk=1&rt=25&utm_source=86d58f08&utm_medium=notomica&utm_campaign=Mr%20Nobody&utm_content=G...
Submission Tags: @phish_report
Submission: On March 03 via api from FI — Scanned from FI

Summary

This website contacted 1 IPs in 3 countries across 6 domains to perform 5 HTTP transactions. The main IP is 96.126.127.210, located in Richardson, United States and belongs to AKAMAI-LINODE-AP Akamai Connected Cloud, SG. The main domain is dating01t.datingem.com.
TLS certificate: Issued by R3 on February 17th 2024. Valid for: 3 months.
This is the only time dating01t.datingem.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 192.64.119.222 22612 (NAMECHEAP...)
1 1 2a05:d014:286... 16509 (AMAZON-02)
1 1 2a06:98c1:312... 13335 (CLOUDFLAR...)
1 1 34.242.181.14 16509 (AMAZON-02)
1 1 18.195.19.123 16509 (AMAZON-02)
5 96.126.127.210 63949 (AKAMAI-LI...)
5 1
Apex Domain
Subdomains
Transfer
5 datingem.com
dating01t.datingem.com
96 KB
1 gambol.link
v.gambol.link
728 B
1 linkedsecured.com
clik.linkedsecured.com
2 KB
1 campaignsrus.com
campaignsrus.com
713 B
1 love4uonline.site
love4uonline.site
1 KB
1 iwantu.store
iwantu.store
280 B
5 6
Domain Requested by
5 dating01t.datingem.com dating01t.datingem.com
1 v.gambol.link 1 redirects
1 clik.linkedsecured.com 1 redirects
1 campaignsrus.com 1 redirects
1 love4uonline.site 1 redirects
1 iwantu.store 1 redirects
5 6

This site contains no links.

Subject Issuer Validity Valid
*.datingem.com
R3
2024-02-17 -
2024-05-17
3 months crt.sh

This page contains 1 frames:

Primary Page: https://dating01t.datingem.com/?bg=1&chk=1&rt=25&utm_source=86d58f08&utm_medium=notomica&utm_campaign=Mr%20Nobody&utm_content=GSL-6682&zid=notomica&bid=BG1&email=%7Bemail%7D&data2=&data3=&data4=10257b3727112b048982ca4493addb&cid=w26ut95j6mapmijviho7io1o
Frame ID: 9EDBFCD2CE9311044E5AC668C9194D23
Requests: 5 HTTP requests in this frame

Screenshot

Page Title

Confirm notifications

Page URL History Show full URLs

  1. http://iwantu.store/ HTTP 302
    http://love4uonline.site/go/e838386a-f6bd-4106-a7c9-6f034bf14cd5 HTTP 302
    https://campaignsrus.com/cr.php?cid=6645&aff_id=6682&doland&aff_sub3=4jaXu56urKmboijdihMtJd&aff_sub=M... HTTP 302
    https://clik.linkedsecured.com/aff_c?offer_id=6601&aff_unique4=4044:5214&aff_unique5=SCuP030336138&aff_id=6... HTTP 302
    https://v.gambol.link/86d58f08-f4a3-44d1-9fe4-ff0def6287a9?utm_source=86d58f08&utm_medium=64&utm_c... HTTP 302
    https://dating01t.datingem.com/?bg=1&chk=1&rt=25&utm_source=86d58f08&utm_medium=notomica&utm_campaign=Mr%20... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <script[^>]*src="[^"]*browser\.sentry\-cdn\.com/([0-9.]+)/bundle(?:\.tracing)?(?:\.min)?\.js

Page Statistics

5
Requests

100 %
HTTPS

33 %
IPv6

6
Domains

6
Subdomains

1
IPs

3
Countries

96 kB
Transfer

101 kB
Size

11
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://iwantu.store/ HTTP 302
    http://love4uonline.site/go/e838386a-f6bd-4106-a7c9-6f034bf14cd5 HTTP 302
    https://campaignsrus.com/cr.php?cid=6645&aff_id=6682&doland&aff_sub3=4jaXu56urKmboijdihMtJd&aff_sub=Mr%20Nobody HTTP 302
    https://clik.linkedsecured.com/aff_c?offer_id=6601&aff_unique4=4044:5214&aff_unique5=SCuP030336138&aff_id=6682&aff_sub3=4jaXu56urKmboijdihMtJd&aff_sub=Mr+Nobody HTTP 302
    https://v.gambol.link/86d58f08-f4a3-44d1-9fe4-ff0def6287a9?utm_source=86d58f08&utm_medium=64&utm_campaign=Mr+Nobody&utm_content=GSL-6682&zid={zoneid}&bid={bannerID}&email={email}&cid=10257b3727112b048982ca4493addb&data4=10257b3727112b048982ca4493addb HTTP 302
    https://dating01t.datingem.com/?bg=1&chk=1&rt=25&utm_source=86d58f08&utm_medium=notomica&utm_campaign=Mr%20Nobody&utm_content=GSL-6682&zid=notomica&bid=BG1&email=%7Bemail%7D&data2=&data3=&data4=10257b3727112b048982ca4493addb&cid=w26ut95j6mapmijviho7io1o Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
dating01t.datingem.com/
Redirect Chain
  • http://iwantu.store/
  • http://love4uonline.site/go/e838386a-f6bd-4106-a7c9-6f034bf14cd5
  • https://campaignsrus.com/cr.php?cid=6645&aff_id=6682&doland&aff_sub3=4jaXu56urKmboijdihMtJd&aff_sub=Mr%20Nobody
  • https://clik.linkedsecured.com/aff_c?offer_id=6601&aff_unique4=4044:5214&aff_unique5=SCuP030336138&aff_id=6682&aff_sub3=4jaXu56urKmboijdihMtJd&aff_sub=Mr+Nobody
  • https://v.gambol.link/86d58f08-f4a3-44d1-9fe4-ff0def6287a9?utm_source=86d58f08&utm_medium=64&utm_campaign=Mr+Nobody&utm_content=GSL-6682&zid={zoneid}&bid={bannerID}&email={email}&cid=10257b3727112b...
  • https://dating01t.datingem.com/?bg=1&chk=1&rt=25&utm_source=86d58f08&utm_medium=notomica&utm_campaign=Mr%20Nobody&utm_content=GSL-6682&zid=notomica&bid=BG1&email=%7Bemail%7D&data2=&data3=&data4=102...
5 KB
6 KB
Document
General
Full URL
https://dating01t.datingem.com/?bg=1&chk=1&rt=25&utm_source=86d58f08&utm_medium=notomica&utm_campaign=Mr%20Nobody&utm_content=GSL-6682&zid=notomica&bid=BG1&email=%7Bemail%7D&data2=&data3=&data4=10257b3727112b048982ca4493addb&cid=w26ut95j6mapmijviho7io1o
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
96.126.127.210 Richardson, United States, ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG),
Reverse DNS
li376-210.members.linode.com
Software
nginx /
Resource Hash
f1c846818eb2df007d4713720bd61119296efed04c6d4abe87b3637505414625
Security Headers
Name Value
Content-Security-Policy default-src * data: 'unsafe-eval' 'unsafe-inline'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
accept-language
fi-FI,fi;q=0.9

Response headers

Accept-Ranges
bytes
Connection
keep-alive
Content-Length
5422
Content-Security-Policy
default-src * data: 'unsafe-eval' 'unsafe-inline'
Content-Type
text/html
Date
Sun, 03 Mar 2024 10:02:19 GMT
ETag
"65cf52bf-152e"
Last-Modified
Fri, 16 Feb 2024 12:19:11 GMT
Referrer-Policy
no-referrer-when-downgrade
Server
nginx
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
X-Content-Type-Options
nosniff
X-Frame-Options
SAMEORIGIN
X-XSS-Protection
1; mode=block

Redirect headers

cache-control
no-store, no-cache, pre-check=0, post-check=0
content-length
0
date
Sun, 03 Mar 2024 10:02:18 GMT
expires
Thu, 01 Jan 1970 00:00:00 GMT
location
https://dating01t.datingem.com/?bg=1&chk=1&rt=25&utm_source=86d58f08&utm_medium=notomica&utm_campaign=Mr%20Nobody&utm_content=GSL-6682&zid=notomica&bid=BG1&email=%7Bemail%7D&data2=&data3=&data4=10257b3727112b048982ca4493addb&cid=w26ut95j6mapmijviho7io1o
pragma
no-cache
server
nginx
push.css
dating01t.datingem.com/
2 KB
3 KB
Stylesheet
General
Full URL
https://dating01t.datingem.com/push.css
Requested by
Host: dating01t.datingem.com
URL: https://dating01t.datingem.com/?bg=1&chk=1&rt=25&utm_source=86d58f08&utm_medium=notomica&utm_campaign=Mr%20Nobody&utm_content=GSL-6682&zid=notomica&bid=BG1&email=%7Bemail%7D&data2=&data3=&data4=10257b3727112b048982ca4493addb&cid=w26ut95j6mapmijviho7io1o
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
96.126.127.210 Richardson, United States, ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG),
Reverse DNS
li376-210.members.linode.com
Software
nginx /
Resource Hash
e12ee8d2700fb2e9f9c530e3177d41855f12421f95c093cb87db4d6fd37bb3f6
Security Headers
Name Value
Content-Security-Policy default-src * data: 'unsafe-eval' 'unsafe-inline'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://dating01t.datingem.com/?bg=1&chk=1&rt=25&utm_source=86d58f08&utm_medium=notomica&utm_campaign=Mr%20Nobody&utm_content=GSL-6682&zid=notomica&bid=BG1&email=%7Bemail%7D&data2=&data3=&data4=10257b3727112b048982ca4493addb&cid=w26ut95j6mapmijviho7io1o
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

Date
Sun, 03 Mar 2024 10:02:19 GMT
Content-Security-Policy
default-src * data: 'unsafe-eval' 'unsafe-inline'
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Connection
keep-alive
Content-Length
2541
X-XSS-Protection
1; mode=block
Referrer-Policy
no-referrer-when-downgrade
Last-Modified
Thu, 28 Oct 2021 09:28:41 GMT
Server
nginx
ETag
"617a6d49-9ed"
X-Frame-Options
SAMEORIGIN
Content-Type
text/css
Cache-Control
max-age=604800
Accept-Ranges
bytes
Expires
Sun, 10 Mar 2024 10:02:19 GMT
arrow.png
dating01t.datingem.com/img/
2 KB
2 KB
Image
General
Full URL
https://dating01t.datingem.com/img/arrow.png
Requested by
Host: dating01t.datingem.com
URL: https://dating01t.datingem.com/?bg=1&chk=1&rt=25&utm_source=86d58f08&utm_medium=notomica&utm_campaign=Mr%20Nobody&utm_content=GSL-6682&zid=notomica&bid=BG1&email=%7Bemail%7D&data2=&data3=&data4=10257b3727112b048982ca4493addb&cid=w26ut95j6mapmijviho7io1o
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
96.126.127.210 Richardson, United States, ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG),
Reverse DNS
li376-210.members.linode.com
Software
nginx /
Resource Hash
56abcaeb7062d1a6eea4948909e0d6aa2379d1479e91e210e9aea43c468b5f57
Security Headers
Name Value
Content-Security-Policy default-src * data: 'unsafe-eval' 'unsafe-inline'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://dating01t.datingem.com/?bg=1&chk=1&rt=25&utm_source=86d58f08&utm_medium=notomica&utm_campaign=Mr%20Nobody&utm_content=GSL-6682&zid=notomica&bid=BG1&email=%7Bemail%7D&data2=&data3=&data4=10257b3727112b048982ca4493addb&cid=w26ut95j6mapmijviho7io1o
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

Date
Sun, 03 Mar 2024 10:02:19 GMT
Content-Security-Policy
default-src * data: 'unsafe-eval' 'unsafe-inline'
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Connection
keep-alive
Content-Length
1757
X-XSS-Protection
1; mode=block
Referrer-Policy
no-referrer-when-downgrade
Last-Modified
Thu, 28 Oct 2021 09:28:29 GMT
Server
nginx
ETag
"617a6d3d-6dd"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
max-age=604800
Accept-Ranges
bytes
Expires
Sun, 10 Mar 2024 10:02:19 GMT
push.min.js
dating01t.datingem.com/
11 KB
4 KB
Script
General
Full URL
https://dating01t.datingem.com/push.min.js?_=12
Requested by
Host: dating01t.datingem.com
URL: https://dating01t.datingem.com/?bg=1&chk=1&rt=25&utm_source=86d58f08&utm_medium=notomica&utm_campaign=Mr%20Nobody&utm_content=GSL-6682&zid=notomica&bid=BG1&email=%7Bemail%7D&data2=&data3=&data4=10257b3727112b048982ca4493addb&cid=w26ut95j6mapmijviho7io1o
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
96.126.127.210 Richardson, United States, ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG),
Reverse DNS
li376-210.members.linode.com
Software
nginx /
Resource Hash
9d9f3c47703ec9331015da4b869038c99e082f9362cfd342c490b207d40e9d2b
Security Headers
Name Value
Content-Security-Policy default-src * data: 'unsafe-eval' 'unsafe-inline'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://dating01t.datingem.com/?bg=1&chk=1&rt=25&utm_source=86d58f08&utm_medium=notomica&utm_campaign=Mr%20Nobody&utm_content=GSL-6682&zid=notomica&bid=BG1&email=%7Bemail%7D&data2=&data3=&data4=10257b3727112b048982ca4493addb&cid=w26ut95j6mapmijviho7io1o
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

Date
Sun, 03 Mar 2024 10:02:19 GMT
Content-Security-Policy
default-src * data: 'unsafe-eval' 'unsafe-inline'
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Encoding
gzip
Transfer-Encoding
chunked
Connection
keep-alive
X-XSS-Protection
1; mode=block
Referrer-Policy
no-referrer-when-downgrade
Last-Modified
Sun, 31 Oct 2021 04:25:59 GMT
Server
nginx
ETag
W/"617e1ad7-2c27"
Vary
Accept-Encoding
X-Frame-Options
SAMEORIGIN
Content-Type
application/javascript
Cache-Control
max-age=604800
Expires
Sun, 10 Mar 2024 10:02:19 GMT
1.jpg
dating01t.datingem.com/img/
80 KB
81 KB
Image
General
Full URL
https://dating01t.datingem.com/img/1.jpg
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
96.126.127.210 Richardson, United States, ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG),
Reverse DNS
li376-210.members.linode.com
Software
nginx /
Resource Hash
62ca68d81fc74e12b654b5b01afcff9454bc3fbbf25990679ea5534c5acd053b
Security Headers
Name Value
Content-Security-Policy default-src * data: 'unsafe-eval' 'unsafe-inline'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://dating01t.datingem.com/?bg=1&chk=1&rt=25&utm_source=86d58f08&utm_medium=notomica&utm_campaign=Mr%20Nobody&utm_content=GSL-6682&zid=notomica&bid=BG1&email=%7Bemail%7D&data2=&data3=&data4=10257b3727112b048982ca4493addb&cid=w26ut95j6mapmijviho7io1o
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

Date
Sun, 03 Mar 2024 10:02:20 GMT
Content-Security-Policy
default-src * data: 'unsafe-eval' 'unsafe-inline'
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Connection
keep-alive
Content-Length
82062
X-XSS-Protection
1; mode=block
Referrer-Policy
no-referrer-when-downgrade
Last-Modified
Sun, 24 Oct 2021 04:24:45 GMT
Server
nginx
ETag
"6174e00d-1408e"
X-Frame-Options
SAMEORIGIN
Content-Type
image/jpeg
Cache-Control
max-age=604800
Accept-Ranges
bytes
Expires
Sun, 10 Mar 2024 10:02:20 GMT

Verdicts & Comments Add Verdict or Comment

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| showContinue object| _paq function| WPush

11 Cookies

Domain/Path Name / Value
.love4uonline.site/ Name: bemob-viewer-id
Value: 41de323e-37ca-4b35-9298-672580f0ba23
.love4uonline.site/ Name: bemob-uniq-visit:e838386a-f6bd-4106-a7c9-6f034bf14cd5
Value: 1
.love4uonline.site/ Name: bemob-rotation:e838386a-f6bd-4106-a7c9-6f034bf14cd5:random:96918f73c944ee1c5ca388b045ebaca6
Value: 0-0-0
.love4uonline.site/ Name: bemob-click-id
Value: 4jaXu56urKmboijdihMtJd
campaignsrus.com/ Name: hskp
Value: SCuP030336138%2C
campaignsrus.com/ Name: skip
Value: -1709460138%2C25416
campaignsrus.com/ Name: 6645_25416_0
Value: 1709460138
clik.linkedsecured.com/ Name: enc_aff_session_6601
Value: ENC03b9b17c12e7f7a7e6be4ae8c3cb31b557d6a38353565183914129a6e40c9469af33fcf8b7a25a38980f4540bd27a86aa54e169a2fb35ad24ee489deee484ca74bf2007c499bae77df6ab26abd15fbff3f5556c228a61e0df4511eaee1c5fbf97d4d1680a8eab556fe33bade44d9a542f9970e44bdc432f480b1cec11c355d057c933070ffc793b22ddb7d2909400dad63b719f6ba400c5be1ba63f74c1adff40731584a36
clik.linkedsecured.com/ Name: ho_mob
Value: eyJtb2JpbGVfZGV2aWNlX29zIjoiRGVza3RvcCIsIm1vYmlsZV9vc192ZXJzaW9uIjoiMCIsIm1vYmlsZV9kZXZpY2VfbW9kZWwiOiJDaHJvbWUiLCJtb2JpbGVfZGV2aWNlX2JyYW5kIjoiR29vZ2xlIiwibW9iaWxlX2Jyb3dzZXIiOiJDaHJvbWUgRGVza3RvcCIsIm1vYmlsZV9icm93c2VyX3ZlcnNpb24iOiIxMjIiLCJtb2JpbGVfY2FycmllciI6Ij8iLCJ1c2VyX2FnZW50IjoiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IFg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgTGlrZSBHZWNrbykgQ2hyb21lLzEyMi4wLjYyNjEuOTQgU2FmYXJpLzUzNy4zNiIsImFjY2VwdF9sYW5ndWFnZSI6ImZpLUZJLGZpO3E9MC45IiwiY29ubmVjdGlvbl9zcGVlZCI6ImJyb2FkYmFuZCJ9
.v.gambol.link/ Name: 86d58f08-f4a3-44d1-9fe4-ff0def6287a9-v4
Value: EH7EslvWyUACyR9sYdQ2Gn_i7fE8TspiDS02myoIgdk
.v.gambol.link/ Name: cc-v4
Value: GHwAcuj9CbFGEe0nOmlkYXNA0KUUsYjQdiJCsYftu7UjPjnhXwsjDyFnakYzxOg9XAIQnABZvGKWDsgrE%2FEuWLb8WbJbJ15hGamqbnwZ7Vd%2BPFkiX5qj%2BmRTbLvcO%2BMEwPYABiYo78s2DNoCp3QhIA%3D%3D

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy default-src * data: 'unsafe-eval' 'unsafe-inline'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block