getnews321.shop
Open in
urlscan Pro
188.114.97.3
Malicious Activity!
Public Scan
Effective URL: https://getnews321.shop/?u=5718kw2&o=gd9k0bp&t=21445&cid=1027ba2875a9c8a0ba6ff331f0ab1b
Submission: On August 09 via api from US — Scanned from NL
Summary
TLS certificate: Issued by WE1 on August 1st 2024. Valid for: 3 months.
This is the only time getnews321.shop was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Porn Scam (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 23 | 188.114.97.3 188.114.97.3 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 1 | 2a06:98c1:312... 2a06:98c1:3121::3 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 2a00:1450:400... 2a00:1450:4001:801::200a | 15169 (GOOGLE) (GOOGLE) | |
2 | 2a00:1450:400... 2a00:1450:4001:80b::2003 | 15169 (GOOGLE) (GOOGLE) | |
25 | 3 |
ASN13335 (CLOUDFLARENET, US)
nefhxlup5.thenewstores.shop | |
getnews321.shop |
Apex Domain Subdomains |
Transfer | |
---|---|---|
21 |
getnews321.shop
getnews321.shop |
734 KB |
2 |
gstatic.com
fonts.gstatic.com |
66 KB |
2 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 110 |
2 KB |
2 |
thenewstores.shop
2 redirects
nefhxlup5.thenewstores.shop |
936 B |
1 |
adtrk28.com
1 redirects
trk.adtrk28.com |
2 KB |
25 | 5 |
Domain | Requested by | |
---|---|---|
21 | getnews321.shop |
getnews321.shop
|
2 | fonts.gstatic.com |
fonts.googleapis.com
|
2 | fonts.googleapis.com |
getnews321.shop
|
2 | nefhxlup5.thenewstores.shop | 2 redirects |
1 | trk.adtrk28.com | 1 redirects |
25 | 5 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
getnews321.shop WE1 |
2024-08-01 - 2024-10-30 |
3 months | crt.sh |
upload.video.google.com WR2 |
2024-07-30 - 2024-10-22 |
3 months | crt.sh |
*.gstatic.com WR2 |
2024-07-30 - 2024-10-22 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://getnews321.shop/?u=5718kw2&o=gd9k0bp&t=21445&cid=1027ba2875a9c8a0ba6ff331f0ab1b
Frame ID: 3AF3AA97222B03EA97ABE9FF5019B3C6
Requests: 25 HTTP requests in this frame
Screenshot
Page Title
Beter dan Sinder!Page URL History Show full URLs
-
https://nefhxlup5.thenewstores.shop/
HTTP 301
http://nefhxlup5.thenewstores.shop/api/index.php HTTP 307
https://nefhxlup5.thenewstores.shop/api/index.php HTTP 302
https://trk.adtrk28.com/aff_c?offer_id=21864&aff_id=21445 HTTP 302
https://getnews321.shop/?u=5718kw2&o=gd9k0bp&t=21445&cid=1027ba2875a9c8a0ba6ff331f0ab1b Page URL
Detected technologies
Bootstrap (Web Frameworks) ExpandDetected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
animate.css (Web Frameworks) Expand
Detected patterns
- <link [^>]+(?:/([\d.]+)/)?animate\.(?:min\.)?css
Google Font API (Font Scripts) Expand
Detected patterns
- <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://nefhxlup5.thenewstores.shop/
HTTP 301
http://nefhxlup5.thenewstores.shop/api/index.php HTTP 307
https://nefhxlup5.thenewstores.shop/api/index.php HTTP 302
https://trk.adtrk28.com/aff_c?offer_id=21864&aff_id=21445 HTTP 302
https://getnews321.shop/?u=5718kw2&o=gd9k0bp&t=21445&cid=1027ba2875a9c8a0ba6ff331f0ab1b Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
25 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H3 |
Primary Request
/
getnews321.shop/ Redirect Chain
|
6 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
6 KB 802 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
3 KB 983 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
bootstrap.min.css
getnews321.shop/media/dating/sinder2-2/css/ |
97 KB 17 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
style.css
getnews321.shop/media/dating/sinder2-2/css/ |
5 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
animate.css
getnews321.shop/media/dating/sinder2-2/css/ |
44 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
vegas.css
getnews321.shop/media/dating/sinder2-2/css/ |
15 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
flag-icon.css
getnews321.shop/util/flag-icon/css/ |
40 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
jquery.js
getnews321.shop/media/dating/sinder2-2/js/ |
91 KB 34 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
vegas.js
getnews321.shop/media/dating/sinder2-2/js/ |
22 KB 5 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
jquery.countdown.js
getnews321.shop/media/dating/sinder2-2/js/ |
9 KB 4 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
utils.js
getnews321.shop/util/ |
7 KB 4 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
logo.svg
getnews321.shop/media/dating/sinder2-2/images/ |
4 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
wow.min.js
getnews321.shop/media/dating/sinder2-2/js/ |
7 KB 3 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
bootstrap.js
getnews321.shop/media/dating/sinder2-2/js/ |
59 KB 12 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
touchswipe.min.js
getnews321.shop/media/dating/sinder2-2/js/ |
11 KB 5 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
timer.js
getnews321.shop/media/dating/sinder2-2/js/ |
639 B 1007 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1Ptug8zYS_SKggPNyC0ITw.woff2
fonts.gstatic.com/s/raleway/v34/ |
47 KB 47 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOlCnqEu92Fr1MmSU5fBBc4.woff2
fonts.gstatic.com/s/roboto/v32/ |
18 KB 19 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
nl.svg
getnews321.shop/util/flag-icon/flags/4x3/ |
380 B 999 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
slide3.jpg
getnews321.shop/media/dating/sinder2-2/images/ |
151 KB 151 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
favicon.ico
getnews321.shop/ |
0 402 B |
Other
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
slide4.jpg
getnews321.shop/media/dating/sinder2-2/images/ |
160 KB 161 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
slide2.jpg
getnews321.shop/media/dating/sinder2-2/images/ |
165 KB 166 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
slide1.jpg
getnews321.shop/media/dating/sinder2-2/images/ |
154 KB 155 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Porn Scam (Online)27 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| requestLink object| geoData string| ip function| $ function| jQuery function| getParameterByName function| hideUnsub function| languageDetection function| writeLocation object| geoRefData function| showLocation function| appendPixels function| getCookie function| getBackendParamsByName function| addSessionId function| docReady function| clear_delay function| run_loading_run_1 function| run_loading_1 function| run_loading_run_2 function| run_loading_2 function| run_loading_run_3 function| run_loading_3 function| run_loading_run_4 function| run_loading_4 function| WOW object| jQuery1102027428554618541613 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
trk.adtrk28.com/ | Name: enc_aff_session_21864 Value: ENC0337da804fc8635f10c755e32ca23261d8de97ab9cced4e6b924250e73e2a9e827ba277f5b340f33e109771667d39f558aa010b580a38168a778118014c46f260035b6840ad15dc4173334189df9c2a891f2afd7cfb6d25990c7c1759f1356b0c4242638f2729f2f81affdb0bf2319e954432a597245dec3cebd3989287ec61929177cef10 |
|
trk.adtrk28.com/ | Name: ho_mob Value: eyJtb2JpbGVfZGV2aWNlX29zIjoiRGVza3RvcCIsIm1vYmlsZV9vc192ZXJzaW9uIjoiMCIsIm1vYmlsZV9kZXZpY2VfbW9kZWwiOiJDaHJvbWUiLCJtb2JpbGVfZGV2aWNlX2JyYW5kIjoiR29vZ2xlIiwibW9iaWxlX2Jyb3dzZXIiOiJDaHJvbWUgRGVza3RvcCIsIm1vYmlsZV9icm93c2VyX3ZlcnNpb24iOiIxMjciLCJtb2JpbGVfY2FycmllciI6Ij8iLCJ1c2VyX2FnZW50IjoiTW96aWxsYS81LjAgKFgxMTsgTGludXggWDg2XzY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBMaWtlIEdlY2tvKSBDaHJvbWUvMTI3LjAuMC4wIFNhZmFyaS81MzcuMzYiLCJhY2NlcHRfbGFuZ3VhZ2UiOiJubC1OTCxubDtxPTAuOSIsImNvbm5lY3Rpb25fc3BlZWQiOiJicm9hZGJhbmQifQ== |
|
getnews321.shop/ | Name: sid Value: t4~lbpiosfbwa0je2p5w4bzg0mu |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
fonts.googleapis.com
fonts.gstatic.com
getnews321.shop
nefhxlup5.thenewstores.shop
trk.adtrk28.com
188.114.97.3
2a00:1450:4001:801::200a
2a00:1450:4001:80b::2003
2a06:98c1:3121::3
0ab340987711378e8cb5582b1f97f6938037712213396d8e7c7f8fa7b1ab4e5a
0ba081f546084bd5097aa8a73c75931d5aa1fc4d6e846e53c21f98e6a1509988
0f8539022b5a1a5ba0c8205d9841b8f029802a8a2fe7f87714dc864946f32f4d
20951afadf3ff45b6135f7bc197884ba8b2232f6757f343f19923e03f326807d
3417f549b6a1018ee687dd84aec136cb7fba2bb5b4c83cf269f9f8e958cc48de
35b0887d34c681aebbeef4ed06c05839766c1118d89808b2934e3d1bc5c68438
435075bfaaad1b71e115e3799952f3e29ae121b1d7bce2d40d498b34bb5035ca
47d477915fa5912616e2dc5df8c5780f9202671678cf275472bd39f3381c0098
4dbd328e347e890a801d51f9a5f8d38a3efd51ec34c0aa22cc83d0a95d6d9d71
53922e18b268322f8562cbe94ce52834a08b975d7feac93a21a344c0bd85185c
70394ae11e694041cb4aafd0069608eacd0dc7bf294abaf561b49416221c079e
7e0c4fad4a323fbb6bf7e758020dec12446617eccc5ed042a97b3c098ad7d4ec
8b3c83a330bf1120a13eff6ef60c1e268b827b7bc49b42a7a1f5d8ad6941f2ea
917bbaafab2d22de7ed3c4415bae64cc9a230238840fd2082818f11c438aa5e5
97e59049e63e06a4074f168ae352e158a213dc928066ae9df6f138c6ab07de68
aea66e66c9609f40f41877444473b430cfe99cc28f294a7c1660767e9db37b8c
b18fa00e948ce4a17e7cfa703c82e27fc8e1bababa97327ead9562c2281aff0f
d6afd8d9abc2967f29ad396854cd05b1a12dcf9b7084f944c136ca6f540c5a39
e3305095b3544d76cbb66aab63bd7b3debd18ae41f8a7ca4df8fe0875b2bec4f
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f185a0c68a5a909fb9dc99b3fc8ecd5867e9d80ac9f06015f55cef897f4ded27
f964f7d6d3b27013577d6e2e4e9564717cd0881a31f7d86189783b76244398c1
fe021b8ac1b62ed1205600c44b1da6db3b4bf10b4d80f3fe080e16f01cf7de79
ff4f2111640943da61697206b422470b7743bcb33b28b048bfc257dfcdb4b860