befjajh.offerdate.link
Open in
urlscan Pro
178.162.199.80
Malicious Activity!
Public Scan
Submitted URL: http://www.e-way.co.il/license/hylozoistic/nonconjectural_tripody.html?gtb=cz9wpojp
Effective URL: https://befjajh.offerdate.link/s/62cf1c2250951?track=looker3
Submission: On May 12 via api from US — Scanned from IL
Effective URL: https://befjajh.offerdate.link/s/62cf1c2250951?track=looker3
Submission: On May 12 via api from US — Scanned from IL
Summary
This website contacted 4 IPs
in 3 countries
across 4 domains to perform 15 HTTP transactions.
The main IP is 178.162.199.80, located in
Germany and
belongs to LEASEWEB-DE-FRA-10, DE.
The main domain is befjajh.offerdate.link.
TLS certificate: Issued by R3 on April 25th 2024. Valid for: 3 months.
This is the only time befjajh.offerdate.link was scanned on urlscan.io!
TLS certificate: Issued by R3 on April 25th 2024. Valid for: 3 months.
This is the only time befjajh.offerdate.link was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Porn Scam (Online)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 2 | 192.114.144.106 192.114.144.106 | 8551 (BEZEQ-INT...) (BEZEQ-INTERNATIONAL-AS Bezeqint Internet Backbone) | |
| 2 | 88.214.27.56 88.214.27.56 | 209272 (AS-ALVIVA) (AS-ALVIVA) | |
| 1 | 13.32.99.33 13.32.99.33 | 16509 (AMAZON-02) (AMAZON-02) | |
| 10 | 178.162.199.80 178.162.199.80 | 28753 (LEASEWEB-...) (LEASEWEB-DE-FRA-10) | |
| 15 | 4 |
2
192.114.144.106
(Israel)
ASN8551 (BEZEQ-INTERNATIONAL-AS Bezeqint Internet Backbone, IL)
PTR: plesk5-106.secured.co.il
ASN8551 (BEZEQ-INTERNATIONAL-AS Bezeqint Internet Backbone, IL)
PTR: plesk5-106.secured.co.il
| www.e-way.co.il |
1
13.32.99.33
(United States)
ASN16509 (AMAZON-02, US)
PTR: server-13-32-99-33.fra60.r.cloudfront.net
ASN16509 (AMAZON-02, US)
PTR: server-13-32-99-33.fra60.r.cloudfront.net
| openfpcdn.io |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 10 |
offerdate.link
befjajh.offerdate.link |
406 KB |
| 2 |
blueredapple.com
blueredapple.com |
2 KB |
| 2 |
e-way.co.il
www.e-way.co.il |
15 KB |
| 1 |
openfpcdn.io
openfpcdn.io — Cisco Umbrella Rank: 17607 |
5 KB |
| 15 | 4 |
| Domain | Requested by | |
|---|---|---|
| 10 | befjajh.offerdate.link |
blueredapple.com
befjajh.offerdate.link |
| 2 | blueredapple.com | |
| 2 | www.e-way.co.il | |
| 1 | openfpcdn.io |
blueredapple.com
|
| 15 | 4 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| e-way.co.il R3 |
2024-04-29 - 2024-07-28 |
3 months | crt.sh |
| localhost localhost |
2019-11-05 - 2047-03-22 |
27 years | crt.sh |
| openfpcdn.io Amazon RSA 2048 M02 |
2023-12-27 - 2025-01-25 |
a year | crt.sh |
| offerdate.link R3 |
2024-04-25 - 2024-07-24 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://befjajh.offerdate.link/s/62cf1c2250951?track=looker3
Frame ID: CCE325B264D23CEA0C4CA5F2C83E4ED5
Requests: 15 HTTP requests in this frame
Screenshot
Page Title
The most popular dating site of this monthPage URL History Show full URLs
-
http://www.e-way.co.il/license/hylozoistic/nonconjectural_tripody.html?gtb=cz9wpojp
HTTP 307
https://www.e-way.co.il/license/hylozoistic/nonconjectural_tripody.html?gtb=cz9wpojp Page URL
-
http://blueredapple.com/mk/index.html
HTTP 307
https://blueredapple.com/mk/index.html Page URL
- https://befjajh.offerdate.link/s/62cf1c2250951?track=looker3 Page URL
Detected technologies
Bootstrap
(Web Frameworks)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://www.e-way.co.il/license/hylozoistic/nonconjectural_tripody.html?gtb=cz9wpojp
HTTP 307
https://www.e-way.co.il/license/hylozoistic/nonconjectural_tripody.html?gtb=cz9wpojp Page URL
-
http://blueredapple.com/mk/index.html
HTTP 307
https://blueredapple.com/mk/index.html Page URL
- https://befjajh.offerdate.link/s/62cf1c2250951?track=looker3 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://www.e-way.co.il/license/hylozoistic/nonconjectural_tripody.html?gtb=cz9wpojp HTTP 307
- https://www.e-way.co.il/license/hylozoistic/nonconjectural_tripody.html?gtb=cz9wpojp
- http://blueredapple.com/mk/index.html HTTP 307
- https://blueredapple.com/mk/index.html
15 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
nonconjectural_tripody.html
www.e-way.co.il/license/hylozoistic/ Redirect Chain
|
109 B 302 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
index.html
blueredapple.com/mk/ Redirect Chain
|
2 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
favicon.ico
www.e-way.co.il/ |
15 KB 15 KB |
Other
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
v1
openfpcdn.io/botd/ |
15 KB 5 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
favicon.ico
blueredapple.com/ |
483 B 462 B |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
Primary Request
62cf1c2250951
befjajh.offerdate.link/s/ |
57 KB 18 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bootstrap.min.css
befjajh.offerdate.link/bundle/61/assets/css/ |
118 KB 20 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
css.css
befjajh.offerdate.link/bundle/61/assets/css/ |
3 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery-2.2.4.min.js
befjajh.offerdate.link/bundle/61/assets/js/ |
84 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bootstrap.min.js
befjajh.offerdate.link/bundle/61/assets/js/ |
36 KB 10 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
js.js
befjajh.offerdate.link/bundle/61/assets/js/ |
6 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
radar.gif
befjajh.offerdate.link/bundle/61/assets/img/ |
172 KB 172 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
1.jpg
befjajh.offerdate.link/bundle/61/assets/img/ |
150 KB 151 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
POST H/1.1 |
track.php
befjajh.offerdate.link/ |
0 277 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
favicon.ico
befjajh.offerdate.link/ |
0 116 B |
Other
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Porn Scam (Online)28 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery string| cf boolean| exitPopunder string| fpDataEncoded function| sendTrack function| Fingerprint2 function| fingerprintGo function| collectTrackParams function| closingConfirm function| handleError function| getParameterByName function| collectParams function| checkRequired function| setLeadInfo function| setCF string| _determinate string| _indeterminate string| _update string| _type string| _click string| _touch string| _add string| _remove string| _callback string| _label string| _cursor boolean| _mobile2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| .offerdate.link/ | Name: s Value: pBznngdDNZmBJQhRafM2N3AgaO%2FairQtGWXPXTpbCUefhyg69C%2F9tiNoy6OezHCvu%2B4zlPQ4jDOtRYS6hk8BeiB%2B3vkRH5tb%2FTdQQiJD4fZWEB8CdbKwDUkDXniH99Q5z%2BBDuzy8SryIUtiMLsfEqZ2Xm8cocvJlzQ6iKC0VN7hGe29X4BX3GoNVMZbW6TijVoutVtr0zqxIFVWqnuMo1u%2FMc5tWsDdxTRNIi9rm57hnKm%2BAj2pMKyrvuMlQ%2FX99Zl8nLE9KU6W%2FRTdX9GJ1FfISavyC%2B8Ht5ganqC0A6jExWbLEaYOatR%2BOzEP%2BAbEw%2BjhHk8h%2FBBThBRpCNDqs3GJbu2rMljInR9%2FxiCKcyVQpmfx%2BoEOdw1yNJy8K05hw3gglzLenpwkflh8gC9ocj73WM5iGbygMj76NcOHhvHxHbEwMPbENF0EaaKnksj2RWSO9cDgc3Rx8IKK6L%2FQ2%2BbRpdTmDykY0oUT2GGHZIpxAzIhB7OzJv7eThZdBPewUpqL71FjlK22gtfTKe8zjVZwDjMcuDI8YfI8syfEUgCCI7Szn%2F2DFXITfp7CnMSTdIn3hiuPVkpW4zBasl6SqFxkcaEeiaXDNBamuOs9nWIFtPAcg6trIh9UqpGIkfWyEMnH3iTGUQea4PyW9iJKzsHBzo%2FSRsDodqLcqaKjAzJolt9YtL6CYKZANujK2M%2FkeKr9GyRgeaQp%2FoPmv3Whkmhw16jtJDIiDjkDkUcGX%2BMqK%2BCVu6j7Q2dYjw3XDOkoHSFz1f4Y6XzcRzOdIMhn4j0Rtv4Wl8Ve4xYk2oXAz%2BDMyG1g5supLekfb8H0OOjImoeHgjnQnhCXFtnYklAAo63%2ByTebiAAIVkh41p7poIS1uLB4k8o8Hih2%2BPrCojvuIZGVEvDgBYUh8GnfFuzCq%2BQJ1ArGry%2BEKbZxQ%2F2anmb%2Bvft%2FLUGTdltRJZP6DOgh9SZ4EpMP9Dp6%2FAVscUXz5pzf36MOkO0SU3MN%2FnJlJPVbFlqn0XDw5qLwqp7UiyoPL5UxGaz9GPshVQRlNdKSslNI4NFx9vxNudoP37VWPggQ0L2mD0DfORIJ%2BepC2BJsNWCK6HTtup8gta62QCuCh7i7Z21X0mcbaevjTgpkvmn1QYmJngJ6ggdONQQmktf%2BzUakJ0ut0RGnlP2N2ZXet8nnDeY6D2O98mH5Vn5e5tu1%2BP2w%2BXnv%2FUWf7bqNv%2BG5TLJAkXVs1SxvcwJrCaRh5linTVUQSOu%2FldpQ466dp%2Fwc0eTa7HG46LXIaM7HwYPQU4%2BVlbRQ0FNKcXUbOecnzJUm%2F4FqidVvb2As31yd%2BsyXj4SQl3b646mrjUaCf0%2By77z23zgZxNKHBhTcCxBUny2xdk6rlEZLFYXwe4TJkd6Fie1RB7yXLr6jJBp5rDpXHRVCXkFWZY7AIS%2FredK1aK%2BZgwPXc3BpZMLNav3%2BhfwXxSEgCpTGFPWWXQo53qoFvhwZ0Pk4IrGn6BNcX%2Fzg5AUtd%2FtSNvw%2FpJOjSWrO%2BvnlJ1lOsUXo7hYYwsjYRV6p1JhylEqwksEdFwT6pkra05npR29MHKOoBLr6H%2F17wpKqaZcMdjY%2Bv%2BU1GAKAc8TWG0oQyw14zMD5wkxaJKrL1kh00i8YpfcPN%2B4Gx13g9zM1DC%2FwdqWk4OxwnEqPB0yJIBpZKcCyIoUcFUjHAPfIDn2xQ%2Fe9NC50d9SdUJjTsyMWlj2La%2FssTigc0on8cwp4xG07A1XaAGnYSZ%2BT%2FeD1RUUnpkvx23wa0IA03oSp6GWT65ml%2FO0CDoB2CYud78PKRqUnKOxLK14mQn2WWCzoSVlngGLmR5DTNduEqPm0BmMwFtVU856sLs2OKGiPKKQj3k0CyCnLfKo3Qj6U0 |
|
| befjajh.offerdate.link/ | Name: CF Value: W8Rid07aOnWgH0kLM/Oj5w__ |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
befjajh.offerdate.link
blueredapple.com
openfpcdn.io
www.e-way.co.il
13.32.99.33
178.162.199.80
192.114.144.106
88.214.27.56
009a8645427f1e1b5ada711e78da2f4d905069b7e8e913c98874cb197358c7eb
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
086e0dea879b2f0c14f765e3061b0ffd7bb25465e68040127191d311fe8075d1
29cb26e06f2a4a877f1134a46480d9b78f8b6e0e6f9b0fe67e34307c312b5a89
38b7db90bc6b42c8bda27df166a451400496596f9f66a98b0359c0640740fac9
53964478a7c634e8dad34ecc303dd8048d00dce4993906de1bacf67f663486ef
62824d9ac5dcb7aa0b55bfd033a79161fdcbe9733a240b6ec5aa17043d7eca4d
67a4773e735c02a5e8b3415e33761459bbdec37bcfda19ff3400fe97b096652b
698e02cb1c98cab1201138181b8afbccf28d1a1d0853c68c9229932b54b2f065
73fa3bcaa8a3d333c3d23aa6ee0f682cce90452c598de3ae4007d80db6eb55c5
89495896bcc3deb0b6a643cf55ddfe620ada0cdb66cd09ce4ba801a06396fcef
8caec8fd649aa4490220685f8a8571491e1029a6400a5ef790375107c15001d5
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855