beastmode.co.il Open in urlscan Pro
35.197.218.44  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request d.html Show response beastmode.co.il/wp-content/plugins/seoplugins/	10 KB 4 KB	1494ms 193ms	Document text/html	35.197.218.44 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://beastmode.co.il/wp-content/plugins/seoplugins/d.html?id=6057935666 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.197.218.44 London, United Kingdom, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 44.218.197.35.bc.googleusercontent.com Software nginx / WP Engine Resource Hash a476a4444e709e690c0ad9746f786dd57ddd3c2e024428356bc7ac3a16fd2564 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 accept-language en-US,en;q=0.9 Response headers cache-control max-age=600, must-revalidate content-encoding br content-type text/html date Tue, 09 Jan 2024 12:06:16 GMT etag W/"2624-60bc27358ed10-gzip" last-modified Tue, 05 Dec 2023 12:34:07 GMT server nginx vary Accept-Encoding Accept-Encoding Accept-Encoding Accept-Encoding,Cookie x-cache HIT: 5 x-cache-group normal x-cacheable SHORT x-powered-by WP Engine
GET H2	200	style.css ai-hoshino.pw/server/d/css/	2 KB 1 KB	132ms 39ms	Stylesheet text/css	2606:4700:3034::ac43:82cd CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ai-hoshino.pw/server/d/css/style.css Requested by Host: beastmode.co.il URL: https://beastmode.co.il/wp-content/plugins/seoplugins/d.html?id=6057935666 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3034::ac43:82cd , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash b9afcac7ebc49bb9b5afeb669962293e68fab982fd3c64dffe157941ed6f1e45 Request headers accept-language en-US,en;q=0.9 Referer https://beastmode.co.il/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers date Tue, 09 Jan 2024 12:06:16 GMT content-encoding br cf-cache-status HIT last-modified Mon, 18 Sep 2023 10:42:42 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare age 52946 vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dp0hHDaXaTZXyKQGMwgqBHFMa6oKJiIt2UtG8Euh6TogWem6V6C0YqfCRol6yAR1LWm3bofiQzzgtWUsk5wcCK%2BYBolwdq2mgAJGXhzJawdEmZs0297vH%2Bfo1wYqkrUf9SXAHSW9KhECDc3W"}],"group":"cf-nel","max_age":604800} content-type text/css access-control-allow-origin * cache-control public, max-age=604800 cf-ray 842c8d9fd9e54bc3-BUF alt-svc h3=":443"; ma=86400 expires Mon, 15 Jan 2024 21:23:50 GMT
GET H2	200	jquery.min.js Show response cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/	87 KB 28 KB	101ms 37ms	Script application/javascript	2606:4700::6811:180e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/jquery.min.js Requested by Host: beastmode.co.il URL: https://beastmode.co.il/wp-content/plugins/seoplugins/d.html?id=6057935666 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers accept-language en-US,en;q=0.9 Referer https://beastmode.co.il/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers date Tue, 09 Jan 2024 12:06:16 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} strict-transport-security max-age=15780000 age 1307426 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 27938 last-modified Tue, 02 Mar 2021 18:58:36 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "603e8adc-15d9d" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=L82JJH6pfO3g8jHcrNM6FZRcc0Rb7IugmnUubSm03TK72G60pm1%2B%2FN6d0Za8%2FXrmEQtw6ujtQwOo0qFUd9UXaEuysGDPNWx4b9OdF%2BAiVVNBdoUozwLnAXOYf9kqf3SGh6PNWng9vm3XFqH3UDNGPnFm"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=30672000 accept-ranges bytes timing-allow-origin * cf-ray 842c8d9fac226aee-BUF expires Sun, 29 Dec 2024 12:06:16 GMT
GET H2	200	script.js Show response ai-hoshino.pw/server/d/js/	124 KB 46 KB	136ms 44ms	Script application/javascript	2606:4700:3034::ac43:82cd CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ai-hoshino.pw/server/d/js/script.js Requested by Host: beastmode.co.il URL: https://beastmode.co.il/wp-content/plugins/seoplugins/d.html?id=6057935666 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3034::ac43:82cd , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 129a3acc6b937e6d234c7ba7ee919af1e1e7f64de9ee0b9cdf9739b29742c2f2 Request headers accept-language en-US,en;q=0.9 Referer https://beastmode.co.il/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers date Tue, 09 Jan 2024 12:06:16 GMT content-encoding br cf-cache-status HIT last-modified Mon, 18 Sep 2023 10:42:42 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare age 52946 vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2B8tc5Zlnz1ObyuIdZMnA8Vq8FqQh4YSt0vbcfxS8BqqFn041kbOKiXkAMfmXkvZvJLjYeqaL6lehoitMKYNlkfCMppXR5h55dsEoao8mxslsaPbeXuXkaxFmBC5%2B9okspBOuJWbjAN%2BwjtBI"}],"group":"cf-nel","max_age":604800} content-type application/javascript access-control-allow-origin * cache-control public, max-age=604800 cf-ray 842c8d9fd9e94bc3-BUF alt-svc h3=":443"; ma=86400 expires Mon, 15 Jan 2024 21:23:50 GMT
GET H2	200	icon.png ai-hoshino.pw/server/d/img/	809 B 1 KB	37ms 36ms	Image image/png	2606:4700:3034::ac43:82cd CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://ai-hoshino.pw/server/d/img/icon.png Requested by Host: beastmode.co.il URL: https://beastmode.co.il/wp-content/plugins/seoplugins/d.html?id=6057935666 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3034::ac43:82cd , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a9a2ba912d382201027bb69a4c93fbbf05077484555ce372f880690fdc210cdf Request headers accept-language en-US,en;q=0.9 Referer https://beastmode.co.il/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36 Response headers date Tue, 09 Jan 2024 12:06:16 GMT cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 52946 alt-svc h3=":443"; ma=86400 content-length 809 last-modified Mon, 18 Sep 2023 10:42:42 GMT server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mDwEQd5TToa5jt5GIhPD030huGEnduD72vtAhg2GuR36RrQZKMJRf4qjouZA9Bp1Yd0X6JTNK7WNi5Id7%2BcEPMlInYbyNQHvlmS57gN1Ws%2FE6FWSl1JPlac7NOaQUlTiggo3QnV3fP9Hkrq8"}],"group":"cf-nel","max_age":604800} content-type image/png access-control-allow-origin * cache-control public, max-age=604800 accept-ranges bytes cf-ray 842c8da02a324bc3-BUF expires Mon, 15 Jan 2024 21:23:50 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

51 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture function| $ function| jQuery object| shortcut string| userDomain string| userServer string| userContent function| _0x18b9 function| _0x353a function| _0x138834 object| s object| r object| fs object| fr function| erp function| base function| _0x1cb1 number| trying boolean| running object| datetime number| width number| height string| platform function| _0x567c86 string| useragent string| deviceram function| _0x4816a2 string| localtime object| networkinfo function| _0x38d042 string| userURL object| battery string| batterypercentage string| ischarging string| userID string| userData string| networkType string| downlink string| language string| referrer function| lodebattery function| getbattery function| parseURLParams function| _0x59a4c5 function| getUserID function| strReplace function| uniqString function| setUserData function| _0x5e8e function| _0x4b61bc function| _0x12554d

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ai-hoshino.pw
beastmode.co.il
cdnjs.cloudflare.com
2606:4700:3034::ac43:82cd
2606:4700::6811:180e
35.197.218.44
129a3acc6b937e6d234c7ba7ee919af1e1e7f64de9ee0b9cdf9739b29742c2f2
a476a4444e709e690c0ad9746f786dd57ddd3c2e024428356bc7ac3a16fd2564
a9a2ba912d382201027bb69a4c93fbbf05077484555ce372f880690fdc210cdf
b9afcac7ebc49bb9b5afeb669962293e68fab982fd3c64dffe157941ed6f1e45
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e