![](/screenshots/c5fa21ac-7806-44b2-af8f-d5b1f44ce8c2.png)
ebcfaf.datelocator24.com
Open in
urlscan Pro
144.76.30.237
Malicious Activity!
Public Scan
Effective URL: https://ebcfaf.datelocator24.com/?utm_source=5ff23029c0633&track=xgeri&click_id=xgeri&s=t587wF2l&r=&fp=JTVCJTdCJTIya2V5JTIyJTNBJT...
Submission: On January 26 via manual from US
Summary
TLS certificate: Issued by R3 on December 15th 2020. Valid for: 3 months.
This is the only time ebcfaf.datelocator24.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Porn Scam (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 173.236.186.118 173.236.186.118 | 26347 (DREAMHOST-AS) (DREAMHOST-AS) | |
12 | 144.76.30.237 144.76.30.237 | 24940 (HETZNER-AS) (HETZNER-AS) | |
12 | 1 |
ASN26347 (DREAMHOST-AS, US)
PTR: apache2-heavy.carousel.dreamhost.com
xgeri.me |
ASN24940 (HETZNER-AS, DE)
PTR: static.237.30.76.144.clients.your-server.de
ebcfaf.datelocator24.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
12 |
datelocator24.com
ebcfaf.datelocator24.com |
393 KB |
1 |
xgeri.me
1 redirects
xgeri.me |
139 B |
12 | 2 |
Domain | Requested by | |
---|---|---|
12 | ebcfaf.datelocator24.com |
ebcfaf.datelocator24.com
|
1 | xgeri.me | 1 redirects |
12 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
datelocator24.com R3 |
2020-12-15 - 2021-03-15 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://ebcfaf.datelocator24.com/?utm_source=5ff23029c0633&track=xgeri&click_id=xgeri&s=t587wF2l&r=&fp=JTVCJTdCJTIya2V5JTIyJTNBJTIyX19oYXNoJTIyJTJDJTIydmFsdWUlMjIlM0ElMjI0MTFiYjRiMjc4MzZhZDdiY2NmMTY2ZTNkZjkxNmQ5ZCUyMiU3RCUyQyU3QiUyMmtleSUyMiUzQSUyMm9zQ3B1JTIyJTdEJTJDJTdCJTIya2V5JTIyJTNBJTIybGFuZ3VhZ2VzJTIyJTJDJTIydmFsdWUlMjIlM0ElNUIlNUIlMjJlbi1VUyUyMiU1RCU1RCU3RCUyQyU3QiUyMmtleSUyMiUzQSUyMmNvbG9yRGVwdGglMjIlMkMlMjJ2YWx1ZSUyMiUzQTI0JTdEJTJDJTdCJTIya2V5JTIyJTNBJTIyZGV2aWNlTWVtb3J5JTIyJTJDJTIydmFsdWUlMjIlM0E4JTdEJTJDJTdCJTIya2V5JTIyJTNBJTIyc2NyZWVuUmVzb2x1dGlvbiUyMiUyQyUyMnZhbHVlJTIyJTNBJTVCMTYwMCUyQzEyMDAlNUQlN0QlMkMlN0IlMjJrZXklMjIlM0ElMjJhdmFpbGFibGVTY3JlZW5SZXNvbHV0aW9uJTIyJTJDJTIydmFsdWUlMjIlM0ElNUIxNjAwJTJDMTIwMCU1RCU3RCUyQyU3QiUyMmtleSUyMiUzQSUyMmhhcmR3YXJlQ29uY3VycmVuY3klMjIlMkMlMjJ2YWx1ZSUyMiUzQTE2JTdEJTJDJTdCJTIya2V5JTIyJTNBJTIydGltZXpvbmVPZmZzZXQlMjIlMkMlMjJ2YWx1ZSUyMiUzQS02MCU3RCUyQyU3QiUyMmtleSUyMiUzQSUyMnRpbWV6b25lJTIyJTJDJTIydmFsdWUlMjIlM0ElMjJFdXJvcGUlMkZCZXJsaW4lMjIlN0QlMkMlN0IlMjJrZXklMjIlM0ElMjJzZXNzaW9uU3RvcmFnZSUyMiUyQyUyMnZhbHVlJTIyJTNBdHJ1ZSU3RCUyQyU3QiUyMmtleSUyMiUzQSUyMmxvY2FsU3RvcmFnZSUyMiUyQyUyMnZhbHVlJTIyJTNBdHJ1ZSU3RCUyQyU3QiUyMmtleSUyMiUzQSUyMmluZGV4ZWREQiUyMiUyQyUyMnZhbHVlJTIyJTNBdHJ1ZSU3RCUyQyU3QiUyMmtleSUyMiUzQSUyMm9wZW5EYXRhYmFzZSUyMiUyQyUyMnZhbHVlJTIyJTNBdHJ1ZSU3RCUyQyU3QiUyMmtleSUyMiUzQSUyMmNwdUNsYXNzJTIyJTdEJTJDJTdCJTIya2V5JTIyJTNBJTIycGxhdGZvcm0lMjIlMkMlMjJ2YWx1ZSUyMiUzQSUyMkxpbnV4JTIweDg2XzY0JTIyJTdEJTJDJTdCJTIya2V5JTIyJTNBJTIydG91Y2hTdXBwb3J0JTIyJTJDJTIydmFsdWUlMjIlM0ElN0IlMjJtYXhUb3VjaFBvaW50cyUyMiUzQTAlMkMlMjJ0b3VjaEV2ZW50JTIyJTNBZmFsc2UlMkMlMjJ0b3VjaFN0YXJ0JTIyJTNBZmFsc2UlN0QlN0QlMkMlN0IlMjJrZXklMjIlM0ElMjJhdWRpbyUyMiUyQyUyMnZhbHVlJTIyJTNBMTI0LjA0MzQ3NzIxNDY0JTdEJTJDJTdCJTIya2V5JTIyJTNBJTIycGx1Z2luc1N1cHBvcnQlMjIlMkMlMjJ2YWx1ZSUyMiUzQXRydWUlN0QlMkMlN0IlMjJrZXklMjIlM0ElMjJwcm9kdWN0U3ViJTIyJTJDJTIydmFsdWUlMjIlM0ElMjIyMDAzMDEwNyUyMiU3RCUyQyU3QiUyMmtleSUyMiUzQSUyMmVtcHR5RXZhbExlbmd0aCUyMiUyQyUyMnZhbHVlJTIyJTNBMzMlN0QlMkMlN0IlMjJrZXklMjIlM0ElMjJlcnJvckZGJTIyJTJDJTIydmFsdWUlMjIlM0FmYWxzZSU3RCUyQyU3QiUyMmtleSUyMiUzQSUyMnZlbmRvciUyMiUyQyUyMnZhbHVlJTIyJTNBJTIyR29vZ2xlJTIwSW5jLiUyMiU3RCUyQyU3QiUyMmtleSUyMiUzQSUyMmNocm9tZSUyMiUyQyUyMnZhbHVlJTIyJTNBZmFsc2UlN0QlMkMlN0IlMjJrZXklMjIlM0ElMjJjb29raWVzRW5hYmxlZCUyMiUyQyUyMnZhbHVlJTIyJTNBdHJ1ZSU3RCU1RA==
Frame ID: A8080B0D6C601BF7A8563F2AE533BAD3
Requests: 12 HTTP requests in this frame
Screenshot
![](/screenshots/c5fa21ac-7806-44b2-af8f-d5b1f44ce8c2.png)
Page URL History Show full URLs
-
https://xgeri.me/
HTTP 301
https://ebcfaf.datelocator24.com/?utm_source=5ff23029c0633&track=xgeri&click_id=xgeri Page URL
- https://ebcfaf.datelocator24.com/?utm_source=5ff23029c0633&track=xgeri&click_id=xgeri&s=t587wF2l&r=&fp=JTVCJT... Page URL
Detected technologies
![](/vendor/wappa/icons/Lua.png)
Detected patterns
- headers server /openresty(?:\/([\d.]+))?/i
Detected patterns
- headers server /openresty(?:\/([\d.]+))?/i
![](/vendor/wappa/icons/OpenResty.png)
Detected patterns
- headers server /openresty(?:\/([\d.]+))?/i
Detected patterns
- script /jquery[.-]([\d.]*\d)[^/]*\.js/i
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://xgeri.me/
HTTP 301
https://ebcfaf.datelocator24.com/?utm_source=5ff23029c0633&track=xgeri&click_id=xgeri Page URL
- https://ebcfaf.datelocator24.com/?utm_source=5ff23029c0633&track=xgeri&click_id=xgeri&s=t587wF2l&r=&fp=JTVCJTdCJTIya2V5JTIyJTNBJTIyX19oYXNoJTIyJTJDJTIydmFsdWUlMjIlM0ElMjI0MTFiYjRiMjc4MzZhZDdiY2NmMTY2ZTNkZjkxNmQ5ZCUyMiU3RCUyQyU3QiUyMmtleSUyMiUzQSUyMm9zQ3B1JTIyJTdEJTJDJTdCJTIya2V5JTIyJTNBJTIybGFuZ3VhZ2VzJTIyJTJDJTIydmFsdWUlMjIlM0ElNUIlNUIlMjJlbi1VUyUyMiU1RCU1RCU3RCUyQyU3QiUyMmtleSUyMiUzQSUyMmNvbG9yRGVwdGglMjIlMkMlMjJ2YWx1ZSUyMiUzQTI0JTdEJTJDJTdCJTIya2V5JTIyJTNBJTIyZGV2aWNlTWVtb3J5JTIyJTJDJTIydmFsdWUlMjIlM0E4JTdEJTJDJTdCJTIya2V5JTIyJTNBJTIyc2NyZWVuUmVzb2x1dGlvbiUyMiUyQyUyMnZhbHVlJTIyJTNBJTVCMTYwMCUyQzEyMDAlNUQlN0QlMkMlN0IlMjJrZXklMjIlM0ElMjJhdmFpbGFibGVTY3JlZW5SZXNvbHV0aW9uJTIyJTJDJTIydmFsdWUlMjIlM0ElNUIxNjAwJTJDMTIwMCU1RCU3RCUyQyU3QiUyMmtleSUyMiUzQSUyMmhhcmR3YXJlQ29uY3VycmVuY3klMjIlMkMlMjJ2YWx1ZSUyMiUzQTE2JTdEJTJDJTdCJTIya2V5JTIyJTNBJTIydGltZXpvbmVPZmZzZXQlMjIlMkMlMjJ2YWx1ZSUyMiUzQS02MCU3RCUyQyU3QiUyMmtleSUyMiUzQSUyMnRpbWV6b25lJTIyJTJDJTIydmFsdWUlMjIlM0ElMjJFdXJvcGUlMkZCZXJsaW4lMjIlN0QlMkMlN0IlMjJrZXklMjIlM0ElMjJzZXNzaW9uU3RvcmFnZSUyMiUyQyUyMnZhbHVlJTIyJTNBdHJ1ZSU3RCUyQyU3QiUyMmtleSUyMiUzQSUyMmxvY2FsU3RvcmFnZSUyMiUyQyUyMnZhbHVlJTIyJTNBdHJ1ZSU3RCUyQyU3QiUyMmtleSUyMiUzQSUyMmluZGV4ZWREQiUyMiUyQyUyMnZhbHVlJTIyJTNBdHJ1ZSU3RCUyQyU3QiUyMmtleSUyMiUzQSUyMm9wZW5EYXRhYmFzZSUyMiUyQyUyMnZhbHVlJTIyJTNBdHJ1ZSU3RCUyQyU3QiUyMmtleSUyMiUzQSUyMmNwdUNsYXNzJTIyJTdEJTJDJTdCJTIya2V5JTIyJTNBJTIycGxhdGZvcm0lMjIlMkMlMjJ2YWx1ZSUyMiUzQSUyMkxpbnV4JTIweDg2XzY0JTIyJTdEJTJDJTdCJTIya2V5JTIyJTNBJTIydG91Y2hTdXBwb3J0JTIyJTJDJTIydmFsdWUlMjIlM0ElN0IlMjJtYXhUb3VjaFBvaW50cyUyMiUzQTAlMkMlMjJ0b3VjaEV2ZW50JTIyJTNBZmFsc2UlMkMlMjJ0b3VjaFN0YXJ0JTIyJTNBZmFsc2UlN0QlN0QlMkMlN0IlMjJrZXklMjIlM0ElMjJhdWRpbyUyMiUyQyUyMnZhbHVlJTIyJTNBMTI0LjA0MzQ3NzIxNDY0JTdEJTJDJTdCJTIya2V5JTIyJTNBJTIycGx1Z2luc1N1cHBvcnQlMjIlMkMlMjJ2YWx1ZSUyMiUzQXRydWUlN0QlMkMlN0IlMjJrZXklMjIlM0ElMjJwcm9kdWN0U3ViJTIyJTJDJTIydmFsdWUlMjIlM0ElMjIyMDAzMDEwNyUyMiU3RCUyQyU3QiUyMmtleSUyMiUzQSUyMmVtcHR5RXZhbExlbmd0aCUyMiUyQyUyMnZhbHVlJTIyJTNBMzMlN0QlMkMlN0IlMjJrZXklMjIlM0ElMjJlcnJvckZGJTIyJTJDJTIydmFsdWUlMjIlM0FmYWxzZSU3RCUyQyU3QiUyMmtleSUyMiUzQSUyMnZlbmRvciUyMiUyQyUyMnZhbHVlJTIyJTNBJTIyR29vZ2xlJTIwSW5jLiUyMiU3RCUyQyU3QiUyMmtleSUyMiUzQSUyMmNocm9tZSUyMiUyQyUyMnZhbHVlJTIyJTNBZmFsc2UlN0QlMkMlN0IlMjJrZXklMjIlM0ElMjJjb29raWVzRW5hYmxlZCUyMiUyQyUyMnZhbHVlJTIyJTNBdHJ1ZSU3RCU1RA== Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://xgeri.me/ HTTP 301
- https://ebcfaf.datelocator24.com/?utm_source=5ff23029c0633&track=xgeri&click_id=xgeri
12 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
/
ebcfaf.datelocator24.com/ Redirect Chain
|
2 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
fp.min.js
ebcfaf.datelocator24.com/js/ |
15 KB 16 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
![]() ebcfaf.datelocator24.com/ |
3 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
css.css
ebcfaf.datelocator24.com/bundle/2/assets/css/ |
71 KB 71 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-2.js
ebcfaf.datelocator24.com/bundle/2/assets/js/ |
84 KB 84 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
js.js
ebcfaf.datelocator24.com/bundle/2/assets/js/ |
414 B 671 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
eclick.js
ebcfaf.datelocator24.com/js/ |
2 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
no.png
ebcfaf.datelocator24.com/bundle/2/assets/img/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
yes.png
ebcfaf.datelocator24.com/bundle/2/assets/img/ |
3 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
1.jpg
ebcfaf.datelocator24.com/bundle/2/assets/img/ |
88 KB 89 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
pattern.png
ebcfaf.datelocator24.com/bundle/2/assets/img/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Lato-Regular.ttf
ebcfaf.datelocator24.com/bundle/2/assets/css/fonts/ |
117 KB 118 KB |
Font
font/ttf |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Porn Scam (Online)13 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery function| closingConfirm function| handleError1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.datelocator24.com/ | Name: SID Value: 2d4692196f607d7065085920e5cfd11e |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ebcfaf.datelocator24.com
xgeri.me
144.76.30.237
173.236.186.118
039ca21cd88aa8a09247247b97b814e3734943bdec5105dba2c8d27ae0a7b0f0
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
15d4127cd56e1b50b5d57340161ff54d22713da009df6904925833779ab125d0
3836b0592b467da4cab99eb40b0fc44f34622144bac13a784ac88848b2890bda
552b83194c8de91c93899195a1712a13fef0e7f18e3bfd4a7cc4c2d016fde90a
5cbc28ef1cf07ab8956014b581aa2b96baac861237975813702e63c886b0c004
6bfdecff876226c1e233f71e7b0b1a6e0eb238281a52156c39f051691dd88a43
7ae714b63c2c8b940bdd211a0cc678f01168a34eea8aa13c0df25364f29238a7
a6c44030b44f3a4b8194600e9b25e9c1732db8bc8ffbd3a4c6cf374b0c5f144e
abcedd8902864fd1a01d8b406429107b3c05b67a160f6bf736a29a90be28717e
f92df46462c54bc2ac714a834a336ca1c8c961992495b6f641311ecb587a9a96
fedd7527d1cceee3052bf4bb62e76d56e8200a115d8a2affae23a125578b7ad1