beastmode.co.il Open in urlscan Pro
35.197.218.44  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request d.html Show response beastmode.co.il/wp-content/plugins/seoplugins/	10 KB 5 KB	482ms 185ms	Document text/html	35.197.218.44 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL http://beastmode.co.il/wp-content/plugins/seoplugins/d.html?id=6391189612 Protocol HTTP/1.1 Server 35.197.218.44 London, United Kingdom, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 44.218.197.35.bc.googleusercontent.com Software nginx / WP Engine Resource Hash a476a4444e709e690c0ad9746f786dd57ddd3c2e024428356bc7ac3a16fd2564 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 accept-language en-US,en;q=0.9 Response headers Cache-Control max-age=600, must-revalidate Connection keep-alive Content-Encoding gzip Content-Type text/html Date Tue, 09 Jan 2024 17:04:46 GMT ETag W/"2624-60bc27358ed10-gzip" Keep-Alive timeout=20 Last-Modified Tue, 05 Dec 2023 12:34:07 GMT Server nginx Transfer-Encoding chunked Vary Accept-Encoding Accept-Encoding Accept-Encoding,Cookie X-Cache HIT: 1 X-Cache-Group normal X-Cacheable SHORT X-Powered-By WP Engine
GET H2	200	style.css ai-hoshino.pw/server/d/css/	2 KB 1 KB	105ms 26ms	Stylesheet text/css	172.67.130.205 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ai-hoshino.pw/server/d/css/style.css Requested by Host: beastmode.co.il URL: http://beastmode.co.il/wp-content/plugins/seoplugins/d.html?id=6391189612 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.67.130.205 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash b9afcac7ebc49bb9b5afeb669962293e68fab982fd3c64dffe157941ed6f1e45 Request headers accept-language en-US,en;q=0.9 Referer http://beastmode.co.il/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers date Tue, 09 Jan 2024 17:04:46 GMT content-encoding br cf-cache-status HIT last-modified Mon, 18 Sep 2023 10:42:42 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare age 70856 vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bodpNQgBb92kj5tBZ2vRZ%2FYJGpiulhsc5%2FhXvXiABlLv4vXztsCClP2YPEpslnfK7ScjqHmkUR5RqK4W9auOlhvbcDg8RaLFSxmSbvv4ZBOK1fQeP%2FtOLrKRiZtsNNyH"}],"group":"cf-nel","max_age":604800} content-type text/css access-control-allow-origin * cache-control public, max-age=604800 cf-ray 842e42e2ef014bcc-BUF alt-svc h3=":443"; ma=86400 expires Mon, 15 Jan 2024 21:23:50 GMT
GET H2	200	jquery.min.js Show response cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/	87 KB 28 KB	119ms 48ms	Script application/javascript	104.17.25.14 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/jquery.min.js Requested by Host: beastmode.co.il URL: http://beastmode.co.il/wp-content/plugins/seoplugins/d.html?id=6391189612 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers accept-language en-US,en;q=0.9 Referer http://beastmode.co.il/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers date Tue, 09 Jan 2024 17:04:46 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} strict-transport-security max-age=15780000 age 3477804 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 27938 last-modified Tue, 02 Mar 2021 18:58:36 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "603e8adc-15d9d" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=utOEzspftX1%2FfZ7xuiRnUN0W4NQE%2Fm1uiXSFH8WH6oILudNDf6MQ9pYHqrgOQOyCvrjdEvu1Luei0a7sWpiNe71Mo76Y9yRao5rN3Ok%2BG4qutHT8aPeVAy5Bfd9Subo8xAWWFk%2BX"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=30672000 accept-ranges bytes timing-allow-origin * cf-ray 842e42e2effc36c4-YYZ expires Sun, 29 Dec 2024 17:04:46 GMT
GET H2	200	script.js Show response ai-hoshino.pw/server/d/js/	124 KB 46 KB	108ms 30ms	Script application/javascript	172.67.130.205 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ai-hoshino.pw/server/d/js/script.js Requested by Host: beastmode.co.il URL: http://beastmode.co.il/wp-content/plugins/seoplugins/d.html?id=6391189612 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.67.130.205 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 129a3acc6b937e6d234c7ba7ee919af1e1e7f64de9ee0b9cdf9739b29742c2f2 Request headers accept-language en-US,en;q=0.9 Referer http://beastmode.co.il/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers date Tue, 09 Jan 2024 17:04:46 GMT content-encoding br cf-cache-status HIT last-modified Mon, 18 Sep 2023 10:42:42 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare age 70856 vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MAYdcQSE7tusSi%2BsxMqBVT33ikntTyUd0EzHWwOX%2F4t5xTJ%2BH6d2JekJXV72C4L25HQjT0dMPhabTYZseWBpHg%2FxPldfzOUWxZZOQ2%2B9b7zCqrIyMhYZdjWnk17RlASq"}],"group":"cf-nel","max_age":604800} content-type application/javascript access-control-allow-origin * cache-control public, max-age=604800 cf-ray 842e42e2ef024bcc-BUF alt-svc h3=":443"; ma=86400 expires Mon, 15 Jan 2024 21:23:50 GMT
GET H2	200	icon.png ai-hoshino.pw/server/d/img/	809 B 1 KB	26ms 25ms	Image image/png	172.67.130.205 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://ai-hoshino.pw/server/d/img/icon.png Requested by Host: beastmode.co.il URL: http://beastmode.co.il/wp-content/plugins/seoplugins/d.html?id=6391189612 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.67.130.205 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a9a2ba912d382201027bb69a4c93fbbf05077484555ce372f880690fdc210cdf Request headers accept-language en-US,en;q=0.9 Referer http://beastmode.co.il/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers date Tue, 09 Jan 2024 17:04:46 GMT cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 70856 alt-svc h3=":443"; ma=86400 content-length 809 last-modified Mon, 18 Sep 2023 10:42:42 GMT server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=m%2F6bn9Zs0NQ3%2Fdsh7RvcpMM96SGn91a29r2M2YC%2FgrK5wd81hS2QYFdF2Y8wISBl93utM8A5Fggayt6f2CfVo6EH5oQj82rOt1Ds1u3KJkCLFdzhUSj44rqVJm8c5hBm"}],"group":"cf-nel","max_age":604800} content-type image/png access-control-allow-origin * cache-control public, max-age=604800 accept-ranges bytes cf-ray 842e42e36f7b4bcc-BUF expires Mon, 15 Jan 2024 21:23:50 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

50 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery object| shortcut string| userDomain string| userServer string| userContent function| _0x18b9 function| _0x353a function| _0x138834 object| s object| r object| fs object| fr function| erp function| base function| _0x1cb1 number| trying boolean| running object| datetime number| width number| height string| platform function| _0x567c86 string| useragent string| deviceram function| _0x4816a2 string| localtime object| networkinfo function| _0x38d042 string| userURL object| battery string| batterypercentage string| ischarging string| userID string| userData string| networkType string| downlink string| language string| referrer function| lodebattery function| getbattery function| parseURLParams function| _0x59a4c5 function| getUserID function| strReplace function| uniqString function| setUserData function| _0x5e8e function| _0x4b61bc function| _0x12554d

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ai-hoshino.pw
beastmode.co.il
cdnjs.cloudflare.com
104.17.25.14
172.67.130.205
35.197.218.44
129a3acc6b937e6d234c7ba7ee919af1e1e7f64de9ee0b9cdf9739b29742c2f2
a476a4444e709e690c0ad9746f786dd57ddd3c2e024428356bc7ac3a16fd2564
a9a2ba912d382201027bb69a4c93fbbf05077484555ce372f880690fdc210cdf
b9afcac7ebc49bb9b5afeb669962293e68fab982fd3c64dffe157941ed6f1e45
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e