www.datemeets.link Open in urlscan Pro
178.162.199.80  Malicious Activity! Public Scan

Submitted URL: https://bit.ly/4aOq5um?e140c40455fd345219fd6c20916b0861
Effective URL: https://www.datemeets.link/s/daa84f83f1d2d
Submission: On January 08 via manual — Scanned from DE

Summary

This website contacted 3 IPs in 4 countries across 5 domains to perform 8 HTTP transactions. The main IP is 178.162.199.80, located in Germany and belongs to LEASEWEB-DE-FRA-10, DE. The main domain is www.datemeets.link.
TLS certificate: Issued by R3 on December 6th 2023. Valid for: 3 months.
This is the only time www.datemeets.link was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Scam (Online)

Domain & IP information

IP Address AS Autonomous System
1 1 67.199.248.10 396982 (GOOGLE-CL...)
1 2 178.128.110.243 14061 (DIGITALOC...)
1 1 185.110.92.18 21276 (XSG)
6 178.162.199.80 28753 (LEASEWEB-...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
8 3
Apex Domain
Subdomains
Transfer
6 datemeets.link
www.datemeets.link
445 KB
2 mymks.com.au
admin.mymks.com.au
579 B
1 bootstrapcdn.com
stackpath.bootstrapcdn.com — Cisco Umbrella Rank: 4303
7 KB
1 freehookups4.site
www.freehookups4.site
261 B
1 bit.ly
bit.ly — Cisco Umbrella Rank: 6271
327 B
8 5
Domain Requested by
6 www.datemeets.link www.datemeets.link
2 admin.mymks.com.au 1 redirects
1 stackpath.bootstrapcdn.com www.datemeets.link
1 www.freehookups4.site 1 redirects
1 bit.ly 1 redirects
8 5

This site contains no links.

Subject Issuer Validity Valid
admin.mymks.com.au
R3
2024-01-02 -
2024-04-01
3 months crt.sh
datemeets.link
R3
2023-12-06 -
2024-03-05
3 months crt.sh
bootstrapcdn.com
GTS CA 1P5
2023-11-30 -
2024-02-28
3 months crt.sh

This page contains 1 frames:

Primary Page: https://www.datemeets.link/s/daa84f83f1d2d
Frame ID: 1DF12D541670AC224EF63E80371584E1
Requests: 8 HTTP requests in this frame

Screenshot

Page Title

der Internet-Anschluss

Page URL History Show full URLs

  1. https://bit.ly/4aOq5um?e140c40455fd345219fd6c20916b0861 HTTP 301
    http://admin.mymks.com.au/vendor/laravel-admin/offendedly/ruralize_hypocotyledonous.html HTTP 301
    https://admin.mymks.com.au/vendor/laravel-admin/offendedly/ruralize_hypocotyledonous.html Page URL
  2. http://www.freehookups4.site/?land=94323 HTTP 302
    https://www.datemeets.link/s/daa84f83f1d2d Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
  • <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

8
Requests

100 %
HTTPS

20 %
IPv6

5
Domains

5
Subdomains

3
IPs

4
Countries

453 kB
Transfer

502 kB
Size

3
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://bit.ly/4aOq5um?e140c40455fd345219fd6c20916b0861 HTTP 301
    http://admin.mymks.com.au/vendor/laravel-admin/offendedly/ruralize_hypocotyledonous.html HTTP 301
    https://admin.mymks.com.au/vendor/laravel-admin/offendedly/ruralize_hypocotyledonous.html Page URL
  2. http://www.freehookups4.site/?land=94323 HTTP 302
    https://www.datemeets.link/s/daa84f83f1d2d Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://bit.ly/4aOq5um?e140c40455fd345219fd6c20916b0861 HTTP 301
  • http://admin.mymks.com.au/vendor/laravel-admin/offendedly/ruralize_hypocotyledonous.html HTTP 301
  • https://admin.mymks.com.au/vendor/laravel-admin/offendedly/ruralize_hypocotyledonous.html

8 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
ruralize_hypocotyledonous.html
admin.mymks.com.au/vendor/laravel-admin/offendedly/
Redirect Chain
  • https://bit.ly/4aOq5um?e140c40455fd345219fd6c20916b0861
  • http://admin.mymks.com.au/vendor/laravel-admin/offendedly/ruralize_hypocotyledonous.html
  • https://admin.mymks.com.au/vendor/laravel-admin/offendedly/ruralize_hypocotyledonous.html
111 B
315 B
Document
General
Full URL
https://admin.mymks.com.au/vendor/laravel-admin/offendedly/ruralize_hypocotyledonous.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
178.128.110.243 Singapore, Singapore, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
nginx /
Resource Hash
ba82219f28905b8206633eb4f6501b3fe9fb52630d451accf205c394c5931d6d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
content-length
111
content-type
text/html; charset=utf-8
date
Mon, 08 Jan 2024 21:30:43 GMT
etag
"65973303-6f"
last-modified
Thu, 04 Jan 2024 22:36:51 GMT
server
nginx
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-xss-protection
1; mode=block

Redirect headers

Connection
keep-alive
Content-Length
169
Content-Type
text/html
Date
Mon, 08 Jan 2024 21:30:43 GMT
Location
https://admin.mymks.com.au/vendor/laravel-admin/offendedly/ruralize_hypocotyledonous.html
Server
nginx/1.17.3
Primary Request daa84f83f1d2d
www.datemeets.link/s/
Redirect Chain
  • http://www.freehookups4.site/?land=94323
  • https://www.datemeets.link/s/daa84f83f1d2d
47 KB
20 KB
Document
General
Full URL
https://www.datemeets.link/s/daa84f83f1d2d
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
178.162.199.80 , Germany, ASN28753 (LEASEWEB-DE-FRA-10, DE),
Reverse DNS
Software
openresty/1.19.3.1 /
Resource Hash
e46fed403423d765d85da52d9a72c2555a22f17a9fd26b85c8caef1e71b8a10c

Request headers

Referer
https://admin.mymks.com.au/vendor/laravel-admin/offendedly/ruralize_hypocotyledonous.html
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Encoding
gzip
Content-Type
text/html; charset=UTF-8
Date
Mon, 08 Jan 2024 21:30:44 GMT
Expires
0
Pragma
no-cache
Server
openresty/1.19.3.1
Transfer-Encoding
chunked
Vary
Accept-Encoding

Redirect headers

Connection
keep-alive
Content-Length
0
Content-Type
text/html; charset=UTF-8
Date
Mon, 08 Jan 2024 21:30:43 GMT
Keep-Alive
timeout=60
Location
https://www.datemeets.link/s/daa84f83f1d2d
Server
nginx
X-Powered-By
PHP/5.6.40
style.css
www.datemeets.link/bundle/302/assets/css/
2 KB
2 KB
Stylesheet
General
Full URL
https://www.datemeets.link/bundle/302/assets/css/style.css
Requested by
Host: www.datemeets.link
URL: https://www.datemeets.link/s/daa84f83f1d2d
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
178.162.199.80 , Germany, ASN28753 (LEASEWEB-DE-FRA-10, DE),
Reverse DNS
Software
openresty/1.19.3.1 /
Resource Hash
bc7da3819f5351addb3853324860e2ba01a074bd8d4bdc61b177403da5a67742

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.datemeets.link/s/daa84f83f1d2d
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

Date
Mon, 08 Jan 2024 21:30:44 GMT
Last-Modified
Tue, 27 Sep 2022 09:43:26 GMT
Server
openresty/1.19.3.1
ETag
"6332c5be-790"
Vary
Accept-Encoding
Content-Type
text/css
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1936
font-awesome.min.css
stackpath.bootstrapcdn.com/font-awesome/4.7.0/css/
30 KB
7 KB
Stylesheet
General
Full URL
https://stackpath.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css
Requested by
Host: www.datemeets.link
URL: https://www.datemeets.link/s/daa84f83f1d2d
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.datemeets.link/
Origin
https://www.datemeets.link
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date
Mon, 08 Jan 2024 21:30:44 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
cdn-edgestorageid
722
age
2112629
cdn-cachedat
10/31/2023 18:48:06
cdn-pullzone
252412
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
last-modified
Mon, 25 Jan 2021 22:04:55 GMT
cdn-proxyver
1.04
cdn-requestpullcode
200
server
cloudflare
etag
W/"269550530cc127b6aa5a35925a7de6ce"
vary
Accept-Encoding
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cdn-cache
HIT
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cache-control
public, max-age=31919000
cdn-requestid
92e343312a9bfd6c64c0f2800fd2fb92
timing-allow-origin
*
cdn-requestcountrycode
DE
cdn-status
200
cf-ray
84278b1b1a983732-FRA
cdn-requestpullsuccess
True
jquery.js
www.datemeets.link/bundle/302/assets/js/
84 KB
84 KB
Script
General
Full URL
https://www.datemeets.link/bundle/302/assets/js/jquery.js
Requested by
Host: www.datemeets.link
URL: https://www.datemeets.link/s/daa84f83f1d2d
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
178.162.199.80 , Germany, ASN28753 (LEASEWEB-DE-FRA-10, DE),
Reverse DNS
Software
openresty/1.19.3.1 /
Resource Hash
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.datemeets.link/s/daa84f83f1d2d
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

Date
Mon, 08 Jan 2024 21:30:44 GMT
Last-Modified
Tue, 27 Sep 2022 09:43:27 GMT
Server
openresty/1.19.3.1
ETag
"6332c5bf-14e4a"
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
85578
functions.js
www.datemeets.link/bundle/302/assets/js/
1 KB
1 KB
Script
General
Full URL
https://www.datemeets.link/bundle/302/assets/js/functions.js
Requested by
Host: www.datemeets.link
URL: https://www.datemeets.link/s/daa84f83f1d2d
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
178.162.199.80 , Germany, ASN28753 (LEASEWEB-DE-FRA-10, DE),
Reverse DNS
Software
openresty/1.19.3.1 /
Resource Hash
bcc57d3a442a70e9352320038b7dec514b03520e7b1c6c8645cf2ac8d7578723

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.datemeets.link/s/daa84f83f1d2d
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

Date
Mon, 08 Jan 2024 21:30:44 GMT
Last-Modified
Tue, 27 Sep 2022 09:43:27 GMT
Server
openresty/1.19.3.1
ETag
"6332c5bf-43d"
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1085
body.jpg
www.datemeets.link/bundle/302/assets/img/
338 KB
338 KB
Image
General
Full URL
https://www.datemeets.link/bundle/302/assets/img/body.jpg
Requested by
Host: www.datemeets.link
URL: https://www.datemeets.link/bundle/302/assets/css/style.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
178.162.199.80 , Germany, ASN28753 (LEASEWEB-DE-FRA-10, DE),
Reverse DNS
Software
openresty/1.19.3.1 /
Resource Hash
a97b3a6a51a87af2cf849ac895c62960a6a15e0c41e6b9a4b4316aac4a3f7d24

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.datemeets.link/bundle/302/assets/css/style.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

Date
Mon, 08 Jan 2024 21:30:44 GMT
Last-Modified
Tue, 27 Sep 2022 09:43:26 GMT
Server
openresty/1.19.3.1
ETag
"6332c5be-54747"
Content-Type
image/jpeg
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
345927
track.php
www.datemeets.link/
0
254 B
XHR
General
Full URL
https://www.datemeets.link/track.php
Requested by
Host: www.datemeets.link
URL: https://www.datemeets.link/bundle/302/assets/js/jquery.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
178.162.199.80 , Germany, ASN28753 (LEASEWEB-DE-FRA-10, DE),
Reverse DNS
Software
openresty/1.19.3.1 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept
*/*
Referer
https://www.datemeets.link/s/daa84f83f1d2d
X-Requested-With
XMLHttpRequest
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

Date
Mon, 08 Jan 2024 21:30:44 GMT
Content-Encoding
gzip
Server
openresty/1.19.3.1
Connection
keep-alive
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
text/html; charset=UTF-8

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Scam (Online)

18 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture function| $ function| jQuery string| sid boolean| exitPopunder string| fpDataEncoded string| cf function| sendTrack function| Fingerprint2 function| fingerprintGo function| collectTrackParams function| closingConfirm function| handleError function| getParameterByName function| collectParams function| checkRequired function| setLeadInfo function| setCF

3 Cookies

Domain/Path Name / Value
.bit.ly/ Name: _bit
Value: o08luG-e352a7cafa1eec4817-00U
.datemeets.link/ Name: s
Value: 9JIQJuGZICrg5s07SXqOG6zV8gepwJSr7%2BpFmJp3ArY4mOcAFJhl025qlw%2FzZWTtrsaos7qP984c3UFN%2Bv85wyB%2BNvmRHuNb%2BRS47yAzDU%2Fffq7cz3CGkkHGAA9dxi%2FuTi1uaI760wZQrCv658IaVH09UT8ZCJvrf%2FTMZEmuEm3u45IuYP1%2FSOm1DdZTZyF7Ub2vzJ6aaf6foZNt%2Bst0f9x8NPUxl23rzCPgHYqLeGwh3hAjHI5vTGzX25N9USQOyLor8cX2436eXwkhan4KZfbV%2BYgfmo7kurYQEcN%2BoXdQZ1XI0I61EFxAGNct08dGXYDlTTHphfXtYRKevWUh4LkNOXmJCL7mb8Jljv959jzbbQXTpTpJScEl3pk2rd1vfBav2dIU5Nq1eNsmFtoOl0j14H4TateoIrY4gYS%2FS%2FggVIrI83q5e7Lgz4OEPKY29Hn1GgVav%2FzxZkV7P4Nv8QQ%2BBH%2Bdg40qc%2BUZEXXmQkR5ddOUZnjz9muV59VzgS%2FzJMeKMoMsh7R6KNwFDnCGmAjHUSKwIvrk0x5wH4PefDOQmBdUuxinU6CpEkjkAIk0xzlD4KTqbMSdeON8jHVDdJA5WK2MTdPJPskOBBv48R3tGjL9BF6dztm1YKvNPP4j8vLQ8BoNsZ3YT37qvp1OtncVqHQ%2BYoNp0%2BBH6H%2BqJc4b8HSgc5uDZVIQBmz3qAn8NW4kuBIyUYLlIL2JygIzWxQTtC%2BvQvnUpxRntOGxDS0fJDaeV8JsK5fKp%2FaYgIVlQkZA6L3lmOBxnuxnWmjGzCqHU1%2B7PzHxT17tlyo8zBMYwiosjPANUmFvbolUcVfuYHvJgFPF77E%2FIEcvO%2By2HaOaIDT3AsYm4iY0wvMGUd6AtjWZizSf3O115tk0wR%2B7ww16LOSpJW2utiaALjnFDdZh9ztc%2FUhNm%2Fd4GKIjDp9lUVltEwhfj1Waqpjw0SMQW1K1wupzsNXcIs5LaSb3WLMcfV4qqi%2BSdaNeh5vejlEJEeoAl0daz14JDCsnRqcg6XN0iYI2bbBoNRYTg%2BMkDO9K6ozIA3b8xCyPGgvGk%2B2lXkeJeD2obN4ZWnvgBPuCgqybByNB%2FbwOacR%2BhqC2jghagv5SA%2FqdtBnsfTnSsXeTsQCZE4qnqpYhsxMBkCqvAA1L2CQV69EGD7FzW9urmrlIhYH9WXCS5%2Bl4BA1MaNzFxy4T7chpvEja8KoSU1%2BI7OApx4uj%2Bu%2B3IXiVsNMhBpMxXsEXmEZ3HZcTz%2F0vJR0mnWOJql%2FayAOII8rznjoFemthut5b7l7WYE7mwciJx3zhypQ6evFwZ8JGOpRrCmF4XCYu3mQBGNTv9gIMr4%2B0YWkJy2B3WbzwXfNMfl354xuZwTCcjtjQT4HdFGkKUOouRgXa9Cm1h2C9AbAjEW3vgP%2FfXgThtmTnJrVP77Idy9Alujn7rwWti7I7%2Bdlc6YWl%2FTJz5OvflW6mo%2FAqWnmEYGer13E8diyAm1F51ijSZ04dm68mxgM6yOsrhp7irL%2Fv%2BZc0AmXQb5WUIrOO08Djajcpiqm9xbDKGM1UX0MuG%2F7XVdtQkOMgyaFMm0bRHuwTVffWCLAkG4LDr%2Fg6HUIvueJE7QKkYIsMQD9iB0vBqJfC1L3mnXR6XHP8Od6GqiVvC7PYuRHl5lYdn48tbquhRVej%2BTZWz1VH498HnSJmInEQxnyJiYU%2B%2FCtxavWn1EsC9JR2G70KlyFz2Vo1PztgGUnlaZWWvyHZPceiSPHnHmVSJkSW1gugiPvCUU9KX6VdqUPVXfa1uUgqRwpk7rneyEieG18%3D
www.datemeets.link/ Name: CF
Value: DEP9YpVeq9lWC/sLBKKKJA__

1 Console Messages

Source Level URL
Text
rendering warning URL: https://www.datemeets.link/s/daa84f83f1d2d(Line 6)
Message:
The value "false" for key "user-scalable" is invalid, and has been ignored.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block