urlscan.io logo urlscan.io
SecurityTrails logo

bfjcgfi.bustydatng.com Open in urlscan Pro
176.123.10.32  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://prt0ygir1.de/
Effective URL: https://bfjcgfi.bustydatng.com/s/63a440ec09eed?track=hf&subsource=g&sub1=g
Submission: On December 30 via manual from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 2 countries across 3 domains to perform 7 HTTP transactions. The main IP is 176.123.10.32, located in Moldova and belongs to ALEXHOST, MD. The main domain is bfjcgfi.bustydatng.com.
TLS certificate: Issued by R3 on December 13th 2023. Valid for: 3 months.
This is the only time bfjcgfi.bustydatng.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Scam (Online)

Domain & IP information

IP Address AS Autonomous System
1 1 162.255.119.9 22612 (NAMECHEAP...)
6 176.123.10.32 200019 (ALEXHOST)
1 2606:4700::68... 13335 (CLOUDFLAR...)
7 2
Apex Domain
Subdomains		 Transfer
6 bustydatng.com
bfjcgfi.bustydatng.com
445 KB
1 bootstrapcdn.com
stackpath.bootstrapcdn.com — Cisco Umbrella Rank: 2842
7 KB
1 prt0ygir1.de
prt0ygir1.de
290 B
7 3
Domain Requested by
6 bfjcgfi.bustydatng.com bfjcgfi.bustydatng.com
1 stackpath.bootstrapcdn.com bfjcgfi.bustydatng.com
1 prt0ygir1.de 1 redirects
7 3

This site contains no links.

Subject Issuer Validity Valid
bustydatng.com
R3		 2023-12-13 -
2024-03-12		 3 months crt.sh
bootstrapcdn.com
GTS CA 1P5		 2023-11-30 -
2024-02-28		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://bfjcgfi.bustydatng.com/s/63a440ec09eed?track=hf&subsource=g&sub1=g
Frame ID: EC6262D0A2D96BFF2CF265B61866DB68
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

der Internet-Anschluss

Page URL History Show full URLs

  1. http://prt0ygir1.de/ HTTP 302
    https://bfjcgfi.bustydatng.com/s/63a440ec09eed?track=hf&subsource=g&sub1=g Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
  • <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

7
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

2
IPs

2
Countries

453 kB
Transfer

502 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://prt0ygir1.de/ HTTP 302
    https://bfjcgfi.bustydatng.com/s/63a440ec09eed?track=hf&subsource=g&sub1=g Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request 63a440ec09eed
bfjcgfi.bustydatng.com/s/
Redirect Chain
  • http://prt0ygir1.de/
  • https://bfjcgfi.bustydatng.com/s/63a440ec09eed?track=hf&subsource=g&sub1=g
47 KB
20 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://bfjcgfi.bustydatng.com/s/63a440ec09eed?track=hf&subsource=g&sub1=g
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
176.123.10.32 , Moldova, ASN200019 (ALEXHOST, MD),
Reverse DNS
Software
openresty/1.19.3.1 /
Resource Hash
b4800336cc366e131d9d51851dfd23500b8543f2eca488c327cb582c77b85aaa

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Encoding
gzip
Content-Type
text/html; charset=UTF-8
Date
Sat, 30 Dec 2023 17:50:16 GMT
Expires
0
Pragma
no-cache
Server
openresty/1.19.3.1
Transfer-Encoding
chunked
Vary
Accept-Encoding

Redirect headers

Connection
keep-alive
Content-Length
97
Content-Type
text/html; charset=utf-8
Date
Sat, 30 Dec 2023 17:50:15 GMT
Location
https://bfjcgfi.bustydatng.com/s/63a440ec09eed?track=hf&subsource=g&sub1=g
Server
namecheap-nginx
X-Served-By
Namecheap URL Forward
style.css
bfjcgfi.bustydatng.com/bundle/302/assets/css/ 		2 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://bfjcgfi.bustydatng.com/bundle/302/assets/css/style.css
Requested by
Host: bfjcgfi.bustydatng.com
URL: https://bfjcgfi.bustydatng.com/s/63a440ec09eed?track=hf&subsource=g&sub1=g
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
176.123.10.32 , Moldova, ASN200019 (ALEXHOST, MD),
Reverse DNS
Software
openresty/1.19.3.1 /
Resource Hash
bc7da3819f5351addb3853324860e2ba01a074bd8d4bdc61b177403da5a67742

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://bfjcgfi.bustydatng.com/s/63a440ec09eed?track=hf&subsource=g&sub1=g
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date
Sat, 30 Dec 2023 17:50:16 GMT
Last-Modified
Tue, 27 Sep 2022 09:43:26 GMT
Server
openresty/1.19.3.1
ETag
"6332c5be-790"
Vary
Accept-Encoding
Content-Type
text/css
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1936
font-awesome.min.css
stackpath.bootstrapcdn.com/font-awesome/4.7.0/css/ 		30 KB
7 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://stackpath.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css
Requested by
Host: bfjcgfi.bustydatng.com
URL: https://bfjcgfi.bustydatng.com/s/63a440ec09eed?track=hf&subsource=g&sub1=g
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://bfjcgfi.bustydatng.com/
Origin
https://bfjcgfi.bustydatng.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

date
Sat, 30 Dec 2023 17:50:16 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
MISS
content-encoding
br
cdn-edgestorageid
722
cdn-cachedat
10/31/2023 18:48:06
cdn-pullzone
252412
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
last-modified
Mon, 25 Jan 2021 22:04:55 GMT
cdn-proxyver
1.04
cdn-requestpullcode
200
server
cloudflare
etag
W/"269550530cc127b6aa5a35925a7de6ce"
vary
Accept-Encoding
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cdn-cache
HIT
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cache-control
public, max-age=31919000
cdn-requestid
b0f7ea7a04a1a230131cca84c648ebfe
timing-allow-origin
*
cdn-requestcountrycode
DE
cdn-status
200
cf-ray
83dc1fc78cbd2c45-FRA
cdn-requestpullsuccess
True
jquery.js
bfjcgfi.bustydatng.com/bundle/302/assets/js/ 		84 KB
84 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://bfjcgfi.bustydatng.com/bundle/302/assets/js/jquery.js
Requested by
Host: bfjcgfi.bustydatng.com
URL: https://bfjcgfi.bustydatng.com/s/63a440ec09eed?track=hf&subsource=g&sub1=g
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
176.123.10.32 , Moldova, ASN200019 (ALEXHOST, MD),
Reverse DNS
Software
openresty/1.19.3.1 /
Resource Hash
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://bfjcgfi.bustydatng.com/s/63a440ec09eed?track=hf&subsource=g&sub1=g
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date
Sat, 30 Dec 2023 17:50:16 GMT
Last-Modified
Tue, 27 Sep 2022 09:43:27 GMT
Server
openresty/1.19.3.1
ETag
"6332c5bf-14e4a"
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
85578
functions.js
bfjcgfi.bustydatng.com/bundle/302/assets/js/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://bfjcgfi.bustydatng.com/bundle/302/assets/js/functions.js
Requested by
Host: bfjcgfi.bustydatng.com
URL: https://bfjcgfi.bustydatng.com/s/63a440ec09eed?track=hf&subsource=g&sub1=g
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
176.123.10.32 , Moldova, ASN200019 (ALEXHOST, MD),
Reverse DNS
Software
openresty/1.19.3.1 /
Resource Hash
bcc57d3a442a70e9352320038b7dec514b03520e7b1c6c8645cf2ac8d7578723

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://bfjcgfi.bustydatng.com/s/63a440ec09eed?track=hf&subsource=g&sub1=g
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date
Sat, 30 Dec 2023 17:50:16 GMT
Last-Modified
Tue, 27 Sep 2022 09:43:27 GMT
Server
openresty/1.19.3.1
ETag
"6332c5bf-43d"
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1085
body.jpg
bfjcgfi.bustydatng.com/bundle/302/assets/img/ 		338 KB
338 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bfjcgfi.bustydatng.com/bundle/302/assets/img/body.jpg
Requested by
Host: bfjcgfi.bustydatng.com
URL: https://bfjcgfi.bustydatng.com/bundle/302/assets/css/style.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
176.123.10.32 , Moldova, ASN200019 (ALEXHOST, MD),
Reverse DNS
Software
openresty/1.19.3.1 /
Resource Hash
a97b3a6a51a87af2cf849ac895c62960a6a15e0c41e6b9a4b4316aac4a3f7d24

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://bfjcgfi.bustydatng.com/bundle/302/assets/css/style.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36

Response headers

Date
Sat, 30 Dec 2023 17:50:16 GMT
Last-Modified
Tue, 27 Sep 2022 09:43:26 GMT
Server
openresty/1.19.3.1
ETag
"6332c5be-54747"
Content-Type
image/jpeg
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
345927
track.php
bfjcgfi.bustydatng.com/ 		0
254 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://bfjcgfi.bustydatng.com/track.php
Requested by
Host: bfjcgfi.bustydatng.com
URL: https://bfjcgfi.bustydatng.com/bundle/302/assets/js/jquery.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
176.123.10.32 , Moldova, ASN200019 (ALEXHOST, MD),
Reverse DNS
Software
openresty/1.19.3.1 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept
*/*
Referer
https://bfjcgfi.bustydatng.com/s/63a440ec09eed?track=hf&subsource=g&sub1=g
X-Requested-With
XMLHttpRequest
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.109 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

Date
Sat, 30 Dec 2023 17:50:16 GMT
Content-Encoding
gzip
Server
openresty/1.19.3.1
Connection
keep-alive
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
text/html; charset=UTF-8

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Scam (Online)

18 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture function| $ function| jQuery string| sid boolean| exitPopunder string| fpDataEncoded string| cf function| sendTrack function| Fingerprint2 function| fingerprintGo function| collectTrackParams function| closingConfirm function| handleError function| getParameterByName function| collectParams function| checkRequired function| setLeadInfo function| setCF

2 Cookies

Domain/Path Name / Value
.bustydatng.com/ Name: s
Value: lIRqo49Er9FvaUJiEIQGyzo4VESHQpWHuphzbOqORdBRmypwA%2FZ6dQF%2FjSF%2BIq4Bvy4hUT02PdacXSKKbDwLoiB%2BNvmBHqNV%2FTS4H7BLYdElVwOsR7aEIpDzZnqOx6yQe6hKefqp2Qh3JJQgGMrcnAg1Q4gOednpScR4IkH9m%2FrXTY3xeujRVpK3zgaeMtZ0tbq94ao0STZEZe4bVT6N56Ui3MlGtg15X8%2BD5AEu1rTLQI%2B0jTLkM5G6iekuBnE9DqXJ6WH8RGSBCUL%2BtcKg18UOSREKeth8sWz5vbJfY%2FqhbZQLytXstWHBBrHbI3HmjTf8wfJhLXssZ5J4nEN6p67XkEVWksXJQ9zSOMCZLYQ%2BjdCMe7rKDuEEWQBaJp3YxMKTCJiU32ITSKuv4w4hcq8aM4k1ljo5Obvof3YauXRwqqP2vZPsnVVbjdGN3eDFQYLLiC65Vl37T0sfnRD4nuaB8zfwQxiwVVrvAYd%2FUkcfmo2mfIoMgSCzbOaTiT3iwnVjblFl%2BpE05k60j1DOwwp2dr5ohbA9BA3F9YzMzM9Jnj%2F2yN7%2FqQYpb2zsJfZwAUp59K3Km1sAkHv1wQOD3uwobys14wNgwzrRqIFT%2BMLnNJOpWqJ60mRqswaXKvOhAlDGFpAURH1xwoMh9IMzTWcp37yCiJhcV4zrKMhmPQf%2BPsnukR%2FRR%2BenfWzCnO0whnjvfV8hIUC45%2BPCu6fyChbmbI5cvDlhMzDKCkEKo%2BcdUFwBlOT1zoS%2FfFRGFJHs7aXV0K%2BSha8%2FhcIDlEQj3tHTFbLOMTxY5TtfXsLumjmAEhO7akr821bK4pe8DuCjLHr3iSFcL1uPt7rCo%2B%2Bj5TgkAj6irmWcHFeIA81v6jjL%2BpHoL3SEtGABTV7KjMrmraFHQgJAqHtZVdQaDuYVzmuThfw3WK1hBKGHgaHucVNZwPL8FW5dW1uMMVhIrQ%2FmDCZSg8bsIEpx06WEjYpNHLA0ziASTfXLjrpYq4uZkG0lFaVwZtTknw3SjbQVh4gn2eHd2yimwzz4NAuNd%2FhWlbMjP8bNzl448jyiPI0fTB2K5YjfgBe07LJkrXnyOxJR9q3bbPDGa8bfWOFY3OGEqt86UURHqPlKQrG3VG%2Fq7ygKZP%2BfDzt37Y%2Fk3mvbjEoc%2FQP9XHLEvj0G4igEOwVUG0X7AerCcfYpsdnyayZFPIwUqOHiacN%2BiVXWzhU%2BNhOySiVI2rlp1gLfx%2FV62RFoBiBbkqj0ro86QYt03pZeW0dRQUZNkQo0w%2BHAGJmNGQWMyvDob4yPf6R%2BCF12oFwGPPEuvKJngKcke3oXbe8kDPk%2Famkj8buex9Rwey4dWTJ%2FhIBvvrCJmcdRHj2bdOpPY%2FyuLqKptOjBdssl2CdEVhSxx1lTz8zPXTVT7fynjx2DDjuCpff0a1PqGRhytUHMPA0bP3eZkb%2Fb4GFLKM6bPNtCGwpcyVRZMxSYI39j3IwgFd8jmTwCyiOljT0BJ%2Bw2KtuTFiXwYL1baicVN9yeZiN7t1CyHz56n0%2FzzuF%2BafMWvMJG214OBHav3LFqh%2FY6%2Bi7tWgQjEpBai3NZ%2FSmuHbmY4ny1W1dWCyjWtlyfpuz%2BMLYyK8ZRORJghjvSVMf%2BiqNlkLktmmJEpHYJwyoY1WCaV1ydNlHyQSgiT0T8hgxJvOSPSVuF5Nm9FW0yj5PJOfDr58bgWwpsgEEgICQY6so6Vfaeie%2F%2FNoe7zshcx%2FiHx7NQfouLP2aZSxAIXROuZJFiMK55adjN3el9NCJNl0XUjOy3s%2BqkSU6c2IkGYA%3D%3D
bfjcgfi.bustydatng.com/ Name: CF
Value: 8lCaLgEbfMuzrWrcdXb+bg__

1 Console Messages

Source Level URL
Text
rendering warning URL: https://bfjcgfi.bustydatng.com/s/63a440ec09eed?track=hf&subsource=g&sub1=g(Line 6)
Message:
The value "false" for key "user-scalable" is invalid, and has been ignored.