vip-flirtbooks.com
Open in
urlscan Pro
5.8.32.98
Malicious Activity!
Public Scan
Effective URL: http://vip-flirtbooks.com/?u=eddkte4&o=71xbav2&t=oko_push_nov-2&cid=p4APIDx-Ah05Zk20kRnnDyFQ3ljrPiSZl4z9scFMy3zjqAJ1jsyo4y...
Submission: On November 15 via manual from CA
Summary
This is the only time vip-flirtbooks.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Scam (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 100.24.228.132 100.24.228.132 | 14618 (AMAZON-AES) (AMAZON-AES - Amazon.com) | |
3 | 2606:4700:20:... 2606:4700:20::6819:1214 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
1 | 23.111.9.35 23.111.9.35 | 33438 (HIGHWINDS2) (HIGHWINDS2 - Highwinds Network Group) | |
1 | 2606:4700::68... 2606:4700::6813:c797 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
4 | 2a00:1450:400... 2a00:1450:4001:81a::200e | 15169 (GOOGLE) (GOOGLE - Google LLC) | |
12 | 5.8.32.98 5.8.32.98 | 202023 (LLHOST) (LLHOST) | |
21 | 5 |
ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-100-24-228-132.compute-1.amazonaws.com
upgradefinishbesttheclicks.icu |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
notification.premium-news.me |
ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US)
use.fontawesome.com |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
ajax.cloudflare.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
12 |
vip-flirtbooks.com
vip-flirtbooks.com |
608 KB |
4 |
google-analytics.com
www.google-analytics.com |
|
3 |
premium-news.me
notification.premium-news.me |
6 KB |
1 |
cloudflare.com
ajax.cloudflare.com |
4 KB |
1 |
fontawesome.com
use.fontawesome.com |
13 KB |
1 |
upgradefinishbesttheclicks.icu
1 redirects
upgradefinishbesttheclicks.icu |
529 B |
21 | 6 |
Domain | Requested by | |
---|---|---|
12 | vip-flirtbooks.com |
notification.premium-news.me
vip-flirtbooks.com |
4 | www.google-analytics.com |
notification.premium-news.me
|
3 | notification.premium-news.me |
notification.premium-news.me
ajax.cloudflare.com |
1 | ajax.cloudflare.com |
notification.premium-news.me
|
1 | use.fontawesome.com |
notification.premium-news.me
|
1 | upgradefinishbesttheclicks.icu | 1 redirects |
21 | 6 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
ssl388064.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2 |
2018-09-18 - 2019-03-27 |
6 months | crt.sh |
*.fontawesome.com DigiCert SHA2 Secure Server CA |
2018-09-17 - 2019-11-21 |
a year | crt.sh |
ssl412106.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2 |
2018-09-22 - 2019-03-31 |
6 months | crt.sh |
*.google-analytics.com Google Internet Authority G3 |
2018-10-30 - 2019-01-22 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
http://vip-flirtbooks.com/?u=eddkte4&o=71xbav2&t=oko_push_nov-2&cid=p4APIDx-Ah05Zk20kRnnDyFQ3ljrPiSZl4z9scFMy3zjqAJ1jsyo4ylmT9_mYWNTNMNc3QqKOprhLIOzHTaTovB2P1YSLqHRreKXtDP4OCGR-3EktWDj2xvkUFEO3-e27sY1E7wt3_wxPrn6VzzXW8LKxOGW1tFh3prcwnCIJwiFfvdWRcaCfCQLTq3jdZmr
Frame ID: 1BB0FDB6B8A3992DE531F030B4536AF5
Requests: 21 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://upgradefinishbesttheclicks.icu/lBh3wEvY4IqL3muPqdLDbpeXh5oeA2XnMhn0DGwlp3s?cid=71aa3a494d386d13a545e577d7b5...
HTTP 302
https://notification.premium-news.me/lp2.html?utm_source=oko_push_nov-2&utm_time=1542309827.626&click_id=p4APIDx-... Page URL
- http://vip-flirtbooks.com/?u=eddkte4&o=71xbav2&t=oko_push_nov-2&cid=p4APIDx-Ah05Zk20kRnnDyFQ3ljrPiSZl4... Page URL
Detected technologies
CloudFlare (CDN) ExpandDetected patterns
- headers server /cloudflare/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /jquery(?:\-|\.)([\d.]*\d)[^\/]*\.js/i
- script /jquery.*\.js/i
- env /^jQuery$/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://upgradefinishbesttheclicks.icu/lBh3wEvY4IqL3muPqdLDbpeXh5oeA2XnMhn0DGwlp3s?cid=71aa3a494d386d13a545e577d7b5e526&sid=70825
HTTP 302
https://notification.premium-news.me/lp2.html?utm_source=oko_push_nov-2&utm_time=1542309827.626&click_id=p4APIDx-Ah05Zk20kRnnDyFQ3ljrPiSZl4z9scFMy3zjqAJ1jsyo4ylmT9_mYWNTNMNc3QqKOprhLIOzHTaTovB2P1YSLqHRreKXtDP4OCGR-3EktWDj2xvkUFEO3-e27sY1E7wt3_wxPrn6VzzXW8LKxOGW1tFh3prcwnCIJwiFfvdWRcaCfCQLTq3jdZmr&cc=DE Page URL
- http://vip-flirtbooks.com/?u=eddkte4&o=71xbav2&t=oko_push_nov-2&cid=p4APIDx-Ah05Zk20kRnnDyFQ3ljrPiSZl4z9scFMy3zjqAJ1jsyo4ylmT9_mYWNTNMNc3QqKOprhLIOzHTaTovB2P1YSLqHRreKXtDP4OCGR-3EktWDj2xvkUFEO3-e27sY1E7wt3_wxPrn6VzzXW8LKxOGW1tFh3prcwnCIJwiFfvdWRcaCfCQLTq3jdZmr Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://upgradefinishbesttheclicks.icu/lBh3wEvY4IqL3muPqdLDbpeXh5oeA2XnMhn0DGwlp3s?cid=71aa3a494d386d13a545e577d7b5e526&sid=70825 HTTP 302
- https://notification.premium-news.me/lp2.html?utm_source=oko_push_nov-2&utm_time=1542309827.626&click_id=p4APIDx-Ah05Zk20kRnnDyFQ3ljrPiSZl4z9scFMy3zjqAJ1jsyo4ylmT9_mYWNTNMNc3QqKOprhLIOzHTaTovB2P1YSLqHRreKXtDP4OCGR-3EktWDj2xvkUFEO3-e27sY1E7wt3_wxPrn6VzzXW8LKxOGW1tFh3prcwnCIJwiFfvdWRcaCfCQLTq3jdZmr&cc=DE
21 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
lp2.html
notification.premium-news.me/ Redirect Chain
|
8 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
all.css
use.fontawesome.com/releases/v5.4.1/css/ |
49 KB 13 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
download2.svg
notification.premium-news.me/images/ |
874 B 730 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
rocket-loader.min.js
ajax.cloudflare.com/cdn-cgi/scripts/2448a7bd/cloudflare-static/ |
11 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
client.js
notification.premium-news.me/ |
4 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST S |
collect
www.google-analytics.com/ |
35 B 0 |
Fetch
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST S |
collect
www.google-analytics.com/ |
35 B 0 |
Fetch
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST S |
collect
www.google-analytics.com/ |
35 B 0 |
Fetch
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST S |
collect
www.google-analytics.com/ |
35 B 0 |
Fetch
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
Cookie set
/
vip-flirtbooks.com/ |
7 KB 7 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
animate.min.css
vip-flirtbooks.com/media/dating/toon2/css/ |
52 KB 52 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
style.css
vip-flirtbooks.com/media/dating/toon2/css/ |
8 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
js.cookie.js
vip-flirtbooks.com/cookie/ |
4 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
utils.js
vip-flirtbooks.com/util/ |
5 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
123.jpg
vip-flirtbooks.com/media/dating/toon2/images/ |
175 KB 175 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-2.2.4.min.js
vip-flirtbooks.com/media/dating/toon2/js/ |
84 KB 84 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bb.js
vip-flirtbooks.com/media/ |
932 B 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
exit-popup.css
vip-flirtbooks.com/media/exit-new/ |
3 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
exit1.js
vip-flirtbooks.com/media/exit-new/ |
32 KB 33 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bg.jpg
vip-flirtbooks.com/media/dating/toon2/images/ |
117 KB 117 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Lato-Regular.ttf
vip-flirtbooks.com/media/dating/toon2/fonts/ |
117 KB 118 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Scam (Online)34 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
number| exDays boolean| validNavigation function| wireUpEvents function| Cookies function| docReady function| getParameterByName function| hideUnsub function| languageDetection function| writeLocation function| showLocation function| appendPixels function| $ function| jQuery boolean| PreventBb function| getUrlParameter function| getUrlWithParam string| lang string| popup_style string| popup_glow string| thePopup string| current_href boolean| PreventExitSplash object| alert_lang function| trans_available function| detect_lang string| exitsplashpage string| exitsplashmessage function| appendHtml function| DisplayExitSplash function| addLoadEvent function| addClickEvent object| a function| disablelinksfunc function| disableformsfunc1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
vip-flirtbooks.com/ | Name: ASP.NET_SessionId Value: l5lcg021qlrbntqotcshxjhz |
8 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.cloudflare.com
notification.premium-news.me
upgradefinishbesttheclicks.icu
use.fontawesome.com
vip-flirtbooks.com
www.google-analytics.com
100.24.228.132
23.111.9.35
2606:4700:20::6819:1214
2606:4700::6813:c797
2a00:1450:4001:81a::200e
5.8.32.98
01f5536a69228df08dfacc7aaaa4a13ce862c8638781a472f986a44bac8dd5c2
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
1c7361fcec43aecb4c517914dde9ecbf1fe1aaa0969411a7a383391236f335f4
2599b3867b5b87ea6aa160ad0a0ab5c520639d7b3dff21292c7e6c4a0fa2089c
3493abbdef3202f502f59b11be045f3b4df6d94f047d882da751dc36087a31b0
4bf6cf088a9251ad9651f8084b539022ad9fcbb37796314f95b9bf150722b970
4d3b4d5d99f92dcc1f1c169db00f76aa1dc65d5d82192afcff04cf8a018a7ba1
7ae714b63c2c8b940bdd211a0cc678f01168a34eea8aa13c0df25364f29238a7
8a5cd04f05e7403f250137f28adc11c92eaf37b53f8049052b0abc58644b9e24
8fe3fa119255adb5e0c12479331f9e092e85bcff56ab6ecc0510bfa2056b898d
a423c9d5700bdb64f6067397b25640e0bab53f2ef1bb21a75d9bd176d5d624cb
ccd8441c2778d6a6a80444629bf89670bc4d7572e30c6771ae7fe5a1e6513901
d2caa153e5dfb8161c9f71b5f15e6777618bd745b8f2c7ef5a95a17d0eb487b1
d61b7eaf050e50635956a30ef7ec426c292b1a47074033e70f840575f99b74e5
f6113b1f6bdd279404fd53c920f6ba411b66a897db4c67e16d2129af22370a57
f61d61e21e118725699a14b9b85a45185b12fbfea3220818c5ea6f811d520f29
fcbf35f1e6e222afa907b3de156f003c6dde21c4fb55e8552c2b449fcf1c2981