befjajh.offerdate.link Open in urlscan Pro
176.123.10.32 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://www.e-way.co.il/license/hylozoistic/nonconjectural_tripody.html?ri=dw4fsw88
Effective URL:
https://befjajh.offerdate.link/s/62cf1c2250951?track=looker3
Submission: On May 16 via api (May 16th 2024, 10:42:59 pm UTC) from US — Scanned from IL

Summary HTTP 18 Redirects Behaviour Indicators

Summary

This website contacted 6 IPs in 3 countries across 6 domains to perform 18 HTTP transactions. The main IP is 176.123.10.32, located in and belongs to . The main domain is befjajh.offerdate.link.
TLS certificate: Issued by R3 on April 25th 2024. Valid for: 3 months.

This is the only time befjajh.offerdate.link was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Porn Scam (Online)

Domain & IP information

	IP Address	AS Autonomous System
2	192.114.144.106 192.114.144.106	8551 (BEZEQ-INT...) (BEZEQ-INTERNATIONAL-AS Bezeqint Internet Backbone)
2	88.214.27.56 88.214.27.56	209272 (AS-ALVIVA) (AS-ALVIVA)
1	13.32.99.118 13.32.99.118	16509 (AMAZON-02) (AMAZON-02)
11	176.123.10.32 176.123.10.32	() ()
1	142.250.186.74 142.250.186.74	() ()
1	142.250.181.227 142.250.181.227	() ()
18	6

2 192.114.144.106 (Israel)

ASN8551 (BEZEQ-INTERNATIONAL-AS Bezeqint Internet Backbone, IL)
PTR: plesk5-106.secured.co.il

www.e-way.co.il	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 88.214.27.56 (Germany)

ASN209272 (AS-ALVIVA, SC)

blueredapple.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.32.99.118 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-99-118.fra60.r.cloudfront.net

openfpcdn.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 176.123.10.32 (None, )

ASN- ()

befjajh.offerdate.link	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.186.74 (None, )

ASN- ()

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.181.227 (None, )

ASN- ()

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	offerdate.link befjajh.offerdate.link	189 KB
2	blueredapple.com blueredapple.com	2 KB
2	e-way.co.il www.e-way.co.il	15 KB
1	gstatic.com fonts.gstatic.com	24 KB
1	googleapis.com fonts.googleapis.com	779 B
1	openfpcdn.io openfpcdn.io — Cisco Umbrella Rank: 17607	5 KB
18	6

	Domain	Requested by
11	befjajh.offerdate.link	blueredapple.com befjajh.offerdate.link
2	blueredapple.com
2	www.e-way.co.il
1	fonts.gstatic.com	fonts.googleapis.com
1	fonts.googleapis.com	befjajh.offerdate.link
1	openfpcdn.io	blueredapple.com
18	6

This site contains no links.

Subject Issuer	Validity	Valid
e-way.co.il R3	`2024-04-29` - `2024-07-28`	3 months	crt.sh
localhost localhost	`2019-11-05` - `2047-03-22`	27 years	crt.sh
openfpcdn.io Amazon RSA 2048 M02	`2023-12-27` - `2025-01-25`	a year	crt.sh
offerdate.link R3	`2024-04-25` - `2024-07-24`	3 months	crt.sh
upload.video.google.com WR2	`2024-05-06` - `2024-07-29`	3 months	crt.sh
*.gstatic.com WR2	`2024-05-06` - `2024-07-29`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://befjajh.offerdate.link/s/62cf1c2250951?track=looker3
Frame ID: CD703FB8AB01DE353BF122F593B2F969
Requests: 18 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://www.e-way.co.il/license/hylozoistic/nonconjectural_tripody.html?ri=dw4fsw88 HTTP 307
https://www.e-way.co.il/license/hylozoistic/nonconjectural_tripody.html?ri=dw4fsw88 Page URL
http://blueredapple.com/mk/index.html HTTP 307
https://blueredapple.com/mk/index.html Page URL
https://befjajh.offerdate.link/s/62cf1c2250951?track=looker3 Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

18
Requests

89 %
HTTPS

0 %
IPv6

6
Domains

6
Subdomains

6
IPs

3
Countries

235 kB
Transfer

555 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://www.e-way.co.il/license/hylozoistic/nonconjectural_tripody.html?ri=dw4fsw88 HTTP 307
https://www.e-way.co.il/license/hylozoistic/nonconjectural_tripody.html?ri=dw4fsw88 Page URL
http://blueredapple.com/mk/index.html HTTP 307
https://blueredapple.com/mk/index.html Page URL
https://befjajh.offerdate.link/s/62cf1c2250951?track=looker3 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://www.e-way.co.il/license/hylozoistic/nonconjectural_tripody.html?ri=dw4fsw88 HTTP 307
https://www.e-way.co.il/license/hylozoistic/nonconjectural_tripody.html?ri=dw4fsw88

Request Chain 1

http://blueredapple.com/mk/index.html HTTP 307
https://blueredapple.com/mk/index.html

18 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

nonconjectural_tripody.html Show response
www.e-way.co.il/license/hylozoistic/
Redirect Chain

http://www.e-way.co.il/license/hylozoistic/nonconjectural_tripody.html?ri=dw4fsw88
https://www.e-way.co.il/license/hylozoistic/nonconjectural_tripody.html?ri=dw4fsw88

109 B
302 B

299ms
59ms

Document
text/html

192.114.144.106
BEZEQ-INTERNATION...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.e-way.co.il/license/hylozoistic/nonconjectural_tripody.html?ri=dw4fsw88
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.114.144.106 , Israel, ASN8551 (BEZEQ-INTERNATIONAL-AS Bezeqint Internet Backbone, IL),
Reverse DNS: plesk5-106.secured.co.il
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 086e0dea879b2f0c14f765e3061b0ffd7bb25465e68040127191d311fe8075d1

Request headers

Accept-Language: he-IL,he;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
content-encoding: br
content-length: 113
content-type: text/html
date: Thu, 16 May 2024 22:42:44 GMT
etag: "9cdc4e18169ada1:0"
last-modified: Mon, 29 Apr 2024 09:17:44 GMT
server: Microsoft-IIS/10.0
vary: Accept-Encoding
x-powered-by: ASP.NET
x-powered-by-plesk: PleskWin

Redirect headers

Location: https://www.e-way.co.il/license/hylozoistic/nonconjectural_tripody.html?ri=dw4fsw88
Non-Authoritative-Reason: HttpsUpgrades

GET
H/1.1

200
OK

index.html Show response
blueredapple.com/mk/
Redirect Chain

http://blueredapple.com/mk/index.html
https://blueredapple.com/mk/index.html

2 KB
1 KB

774ms
163ms

Document
text/html

88.214.27.56
AS-ALVIVA

General

Check archive.org

Show headers Download Go to

Full URL: https://blueredapple.com/mk/index.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 88.214.27.56 , Germany, ASN209272 (AS-ALVIVA, SC),
Reverse DNS
Software: Apache/2 /
Resource Hash: 009a8645427f1e1b5ada711e78da2f4d905069b7e8e913c98874cb197358c7eb

Request headers

Accept-Language: he-IL,he;q=0.9;q=0.9
Referer: https://www.e-way.co.il/license/hylozoistic/nonconjectural_tripody.html?ri=dw4fsw88
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36

Response headers

Accept-Ranges: bytes
Connection: Upgrade, Keep-Alive
Content-Encoding: gzip
Content-Length: 719
Content-Type: text/html
Date: Thu, 16 May 2024 22:42:46 GMT
ETag: "6ed-6179dbbf58cc0-gzip"
Keep-Alive: timeout=2, max=100
Last-Modified: Sat, 04 May 2024 09:48:11 GMT
Server: Apache/2
Upgrade: h2,h2c
Vary: Accept-Encoding,User-Agent

Redirect headers

Location: https://blueredapple.com/mk/index.html
Non-Authoritative-Reason: HttpsUpgrades

GET
H2 200 favicon.ico
www.e-way.co.il/ 15 KB
15 KB 79ms
79ms Other
image/x-icon 192.114.144.106
BEZEQ-INTERNATION...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.e-way.co.il/favicon.ico
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.114.144.106 , Israel, ASN8551 (BEZEQ-INTERNATIONAL-AS Bezeqint Internet Backbone, IL),
Reverse DNS: plesk5-106.secured.co.il
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.e-way.co.il/license/hylozoistic/nonconjectural_tripody.html?ri=dw4fsw88
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-powered-by-plesk: PleskWin
date: Thu, 16 May 2024 22:42:44 GMT
last-modified: Tue, 27 Feb 2024 11:34:12 GMT
server: Microsoft-IIS/10.0
etag: "1a7a21e37069da1:0"
x-powered-by: ASP.NET
content-type: image/x-icon
accept-ranges: bytes
content-length: 15086

GET
H2 200 v1 Show response
openfpcdn.io/botd/ 15 KB
5 KB 388ms
127ms Script
text/javascript 13.32.99.118
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://openfpcdn.io/botd/v1

Requested by

Host: blueredapple.com
URL: https://blueredapple.com/mk/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.32.99.118 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-32-99-118.fra60.r.cloudfront.net

Software

CloudFront /

Resource Hash

29cb26e06f2a4a877f1134a46480d9b78f8b6e0e6f9b0fe67e34307c312b5a89

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://blueredapple.com/
Origin: https://blueredapple.com
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Thu, 16 May 2024 22:12:19 GMT
via: 1.1 968007545c497b68cc41825f11e930ba.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P3
age: 1827
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
server: CloudFront
etag: W/"5co2cnhGrt59+8B+iLKwJesMrpA"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=597729, s-maxage=11282
x-amz-cf-id: PD6GPNs-kXiVo1V-kYzYwPH4DqTqLztBgPsEUjhxXKLJmxvFzSOP8g==

GET
H/1.1 404
Not Found favicon.ico
blueredapple.com/ 483 B
462 B 168ms
167ms Other
text/html 88.214.27.56
AS-ALVIVA

General

Check archive.org

Show headers Download Go to

Full URL: https://blueredapple.com/favicon.ico
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 88.214.27.56 , Germany, ASN209272 (AS-ALVIVA, SC),
Reverse DNS
Software: Apache/2 /
Resource Hash: 8caec8fd649aa4490220685f8a8571491e1029a6400a5ef790375107c15001d5

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://blueredapple.com/mk/index.html
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Thu, 16 May 2024 22:42:46 GMT
Content-Encoding: gzip
Server: Apache/2
Vary: Accept-Encoding,User-Agent
Content-Type: text/html
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=99
Content-Length: 200

GET
H/1.1 200
OK Primary Request 62cf1c2250951 Show response
befjajh.offerdate.link/s/ 42 KB
17 KB 1303ms
609ms Document
text/html 176.123.10.32

General

Check archive.org

Show headers Download Go to

Full URL: https://befjajh.offerdate.link/s/62cf1c2250951?track=looker3
Requested by: Host: blueredapple.com
URL: https://blueredapple.com/mk/index.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 176.123.10.32 -, , ASN (),
Reverse DNS
Software: openresty/1.19.3.1 /
Resource Hash: 95d72a57b984a9acb52ed9a8dc0a18227b0a208bbcc874a581d26f65f9d25595

Request headers

Accept-Language: he-IL,he;q=0.9;q=0.9
Referer: https://blueredapple.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html; charset=UTF-8
Date: Thu, 16 May 2024 22:42:48 GMT
Expires: 0
Pragma: no-cache
Server: openresty/1.19.3.1
Transfer-Encoding: chunked
Vary: Accept-Encoding Accept-Encoding

GET
H/1.1 200
OK animate.min.css
befjajh.offerdate.link/bundle/16/assets/css/ 52 KB
4 KB 161ms
157ms Stylesheet
text/css 176.123.10.32

General

Check archive.org

Show headers Download Go to

Full URL: https://befjajh.offerdate.link/bundle/16/assets/css/animate.min.css
Requested by: Host: befjajh.offerdate.link
URL: https://befjajh.offerdate.link/s/62cf1c2250951?track=looker3
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 176.123.10.32 -, , ASN (),
Reverse DNS
Software: openresty/1.19.3.1 /
Resource Hash: 8fe3fa119255adb5e0c12479331f9e092e85bcff56ab6ecc0510bfa2056b898d

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://befjajh.offerdate.link/s/62cf1c2250951?track=looker3
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Thu, 16 May 2024 22:42:49 GMT
Content-Encoding: gzip
Last-Modified: Wed, 28 Mar 2018 09:30:46 GMT
Server: openresty/1.19.3.1
ETag: W/"5abb60c6-ce35"
Transfer-Encoding: chunked
Vary: Accept-Encoding, Accept-Encoding
Content-Type: text/css
Cache-Control: max-age=2592000, private
Connection: keep-alive
Expires: Sat, 15 Jun 2024 22:42:49 GMT

GET
H/1.1 200
OK style.css
befjajh.offerdate.link/bundle/16/assets/css/ 15 KB
3 KB 331ms
170ms Stylesheet
text/css 176.123.10.32

General

Check archive.org

Show headers Download Go to

Full URL: https://befjajh.offerdate.link/bundle/16/assets/css/style.css
Requested by: Host: befjajh.offerdate.link
URL: https://befjajh.offerdate.link/s/62cf1c2250951?track=looker3
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 176.123.10.32 -, , ASN (),
Reverse DNS
Software: openresty/1.19.3.1 /
Resource Hash: 3fa7cbd6ccb0e62abc11ba89609c6cdd73aaa458973ae65b7d590830475ff261

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://befjajh.offerdate.link/s/62cf1c2250951?track=looker3
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Thu, 16 May 2024 22:42:49 GMT
Content-Encoding: gzip
Last-Modified: Wed, 28 Mar 2018 09:30:46 GMT
Server: openresty/1.19.3.1
ETag: W/"5abb60c6-3a04"
Transfer-Encoding: chunked
Vary: Accept-Encoding, Accept-Encoding
Content-Type: text/css
Cache-Control: max-age=2592000, private
Connection: keep-alive
Expires: Sat, 15 Jun 2024 22:42:49 GMT

GET
H/1.1 200
OK jquery-2.2.4.min.js Show response
befjajh.offerdate.link/bundle/16/assets/js/ 84 KB
30 KB 517ms
234ms Script
application/javascript 176.123.10.32

General

Check archive.org

Show headers Download Go to

Full URL: https://befjajh.offerdate.link/bundle/16/assets/js/jquery-2.2.4.min.js
Requested by: Host: befjajh.offerdate.link
URL: https://befjajh.offerdate.link/s/62cf1c2250951?track=looker3
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 176.123.10.32 -, , ASN (),
Reverse DNS
Software: openresty/1.19.3.1 /
Resource Hash: 05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://befjajh.offerdate.link/s/62cf1c2250951?track=looker3
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Thu, 16 May 2024 22:42:49 GMT
Content-Encoding: gzip
Last-Modified: Wed, 28 Mar 2018 09:30:46 GMT
Server: openresty/1.19.3.1
ETag: W/"5abb60c6-14e4a"
Transfer-Encoding: chunked
Vary: Accept-Encoding, Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=2592000, private
Connection: keep-alive
Expires: Sat, 15 Jun 2024 22:42:49 GMT

GET
H/1.1 200
OK script.min.js Show response
befjajh.offerdate.link/bundle/16/assets/js/ 252 KB
77 KB 529ms
239ms Script
application/javascript 176.123.10.32

General

Check archive.org

Show headers Download Go to

Full URL: https://befjajh.offerdate.link/bundle/16/assets/js/script.min.js
Requested by: Host: befjajh.offerdate.link
URL: https://befjajh.offerdate.link/s/62cf1c2250951?track=looker3
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 176.123.10.32 -, , ASN (),
Reverse DNS
Software: openresty/1.19.3.1 /
Resource Hash: 76d703389c75e3c1e9946072b1e18f6d61842f77eac3f03cfb366baba8035850

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://befjajh.offerdate.link/s/62cf1c2250951?track=looker3
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Thu, 16 May 2024 22:42:49 GMT
Content-Encoding: gzip
Last-Modified: Wed, 28 Mar 2018 09:30:46 GMT
Server: openresty/1.19.3.1
ETag: W/"5abb60c6-3f0a5"
Transfer-Encoding: chunked
Vary: Accept-Encoding, Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=2592000, private
Connection: keep-alive
Expires: Sat, 15 Jun 2024 22:42:49 GMT

GET
H2 200 css
fonts.googleapis.com/ 717 B
779 B 354ms
122ms Stylesheet
text/css 142.250.186.74

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Lato&subset=latin-ext

Requested by

Host: befjajh.offerdate.link
URL: https://befjajh.offerdate.link/bundle/16/assets/css/style.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.74 -, , ASN (),

Reverse DNS

Software

ESF /

Resource Hash

77d9907ca853ab885fd7a35a29faaf4206b8fe47347cd9c12391d64451ad6f37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://befjajh.offerdate.link/
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000
date: Thu, 16 May 2024 22:42:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 16 May 2024 22:42:49 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 16 May 2024 22:42:49 GMT

GET
H/1.1 200
OK no.png
befjajh.offerdate.link/bundle/16/assets/img/ 322 B
662 B 178ms
178ms Image
image/png 176.123.10.32

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://befjajh.offerdate.link/bundle/16/assets/img/no.png
Requested by: Host: befjajh.offerdate.link
URL: https://befjajh.offerdate.link/bundle/16/assets/css/style.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 176.123.10.32 -, , ASN (),
Reverse DNS
Software: openresty/1.19.3.1 /
Resource Hash: 855f62c34d296773b690bcd61d702db042b6085294928d1f7064c022b47d2695

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://befjajh.offerdate.link/bundle/16/assets/css/style.css
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Thu, 16 May 2024 22:42:49 GMT
Last-Modified: Wed, 28 Mar 2018 09:30:46 GMT
Server: openresty/1.19.3.1
ETag: "5abb60c6-142"
Content-Type: image/png
Cache-Control: max-age=2592000, private
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 322
Expires: Sat, 15 Jun 2024 22:42:49 GMT

GET
H/1.1 200
OK yes.png
befjajh.offerdate.link/bundle/16/assets/img/ 594 B
934 B 177ms
176ms Image
image/png 176.123.10.32

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://befjajh.offerdate.link/bundle/16/assets/img/yes.png
Requested by: Host: befjajh.offerdate.link
URL: https://befjajh.offerdate.link/bundle/16/assets/css/style.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 176.123.10.32 -, , ASN (),
Reverse DNS
Software: openresty/1.19.3.1 /
Resource Hash: 3e80058e1e64f3e5085e47096d373ae6b74987d494aec75b3f67872706569ef4

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://befjajh.offerdate.link/bundle/16/assets/css/style.css
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Thu, 16 May 2024 22:42:49 GMT
Last-Modified: Wed, 28 Mar 2018 09:30:46 GMT
Server: openresty/1.19.3.1
ETag: "5abb60c6-252"
Content-Type: image/png
Cache-Control: max-age=2592000, private
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 594
Expires: Sat, 15 Jun 2024 22:42:49 GMT

GET
H/1.1 200
OK 1.jpg
befjajh.offerdate.link/bundle/16/assets/img/ 55 KB
55 KB 283ms
282ms Image
image/jpeg 176.123.10.32

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://befjajh.offerdate.link/bundle/16/assets/img/1.jpg
Requested by: Host: befjajh.offerdate.link
URL: https://befjajh.offerdate.link/bundle/16/assets/css/style.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 176.123.10.32 -, , ASN (),
Reverse DNS
Software: openresty/1.19.3.1 /
Resource Hash: a88f88462c0343bc65173e05743424a0894478ce81f27d1a02af664b278f9700

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://befjajh.offerdate.link/bundle/16/assets/css/style.css
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Thu, 16 May 2024 22:42:49 GMT
Last-Modified: Wed, 28 Mar 2018 09:30:46 GMT
Server: openresty/1.19.3.1
ETag: "5abb60c6-dbde"
Content-Type: image/jpeg
Cache-Control: max-age=2592000, private
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 56286
Expires: Sat, 15 Jun 2024 22:42:49 GMT

GET
H/1.1 200
OK pattern.png
befjajh.offerdate.link/bundle/16/assets/img/ 100 B
439 B 185ms
185ms Image
image/png 176.123.10.32

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://befjajh.offerdate.link/bundle/16/assets/img/pattern.png
Requested by: Host: befjajh.offerdate.link
URL: https://befjajh.offerdate.link/bundle/16/assets/css/style.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 176.123.10.32 -, , ASN (),
Reverse DNS
Software: openresty/1.19.3.1 /
Resource Hash: 13de289b7d770632c2b87d7019cdb10416061bcdb50f07cadcc5e4c6cdf33a36

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://befjajh.offerdate.link/bundle/16/assets/css/style.css
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Thu, 16 May 2024 22:42:49 GMT
Last-Modified: Wed, 28 Mar 2018 09:30:46 GMT
Server: openresty/1.19.3.1
ETag: "5abb60c6-64"
Content-Type: image/png
Cache-Control: max-age=2592000, private
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 100
Expires: Sat, 15 Jun 2024 22:42:49 GMT

GET
H2 200 S6uyw4BMUTPHjx4wXg.woff2
fonts.gstatic.com/s/lato/v24/ 23 KB
24 KB 355ms
114ms Font
font/woff2 142.250.181.227

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v24/S6uyw4BMUTPHjx4wXg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Lato&subset=latin-ext

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.227 -, , ASN (),

Reverse DNS

Software

sffe /

Resource Hash

918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://fonts.googleapis.com/
Origin: https://befjajh.offerdate.link
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 08:02:21 GMT
x-content-type-options: nosniff
age: 225629
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23580
x-xss-protection: 0
last-modified: Tue, 02 May 2023 15:17:22 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 14 May 2025 08:02:21 GMT

POST
H/1.1 200
OK track.php Show response
befjajh.offerdate.link/ 0
277 B 273ms
242ms XHR
text/html 176.123.10.32

General

Check archive.org

Show headers Download Go to

Full URL: https://befjajh.offerdate.link/track.php
Requested by: Host: befjajh.offerdate.link
URL: https://befjajh.offerdate.link/bundle/16/assets/js/script.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 176.123.10.32 -, , ASN (),
Reverse DNS
Software: openresty/1.19.3.1 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Accept: */*
Referer: https://befjajh.offerdate.link/s/62cf1c2250951?track=looker3
X-Requested-With: XMLHttpRequest
sec-ch-ua-platform: "Win32"

Response headers

Date: Thu, 16 May 2024 22:42:50 GMT
Content-Encoding: gzip
Server: openresty/1.19.3.1
Connection: keep-alive
Transfer-Encoding: chunked
Vary: Accept-Encoding, Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H/1.1 204
No Content favicon.ico
befjajh.offerdate.link/ 0
116 B 170ms
170ms Other
text/plain 176.123.10.32

General

Check archive.org

Show headers Download Go to

Full URL: https://befjajh.offerdate.link/favicon.ico
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 176.123.10.32 -, , ASN (),
Reverse DNS
Software: openresty/1.19.3.1 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://befjajh.offerdate.link/s/62cf1c2250951?track=looker3
Accept-Language: he-IL,he;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Connection: keep-alive
Date: Thu, 16 May 2024 22:42:50 GMT
Server: openresty/1.19.3.1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Porn Scam (Online)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://blueredapple.com/favicon.ico Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

befjajh.offerdate.link
blueredapple.com
fonts.googleapis.com
fonts.gstatic.com
openfpcdn.io
www.e-way.co.il
13.32.99.118
142.250.181.227
142.250.186.74
176.123.10.32
192.114.144.106
88.214.27.56
009a8645427f1e1b5ada711e78da2f4d905069b7e8e913c98874cb197358c7eb
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
086e0dea879b2f0c14f765e3061b0ffd7bb25465e68040127191d311fe8075d1
13de289b7d770632c2b87d7019cdb10416061bcdb50f07cadcc5e4c6cdf33a36
29cb26e06f2a4a877f1134a46480d9b78f8b6e0e6f9b0fe67e34307c312b5a89
3e80058e1e64f3e5085e47096d373ae6b74987d494aec75b3f67872706569ef4
3fa7cbd6ccb0e62abc11ba89609c6cdd73aaa458973ae65b7d590830475ff261
76d703389c75e3c1e9946072b1e18f6d61842f77eac3f03cfb366baba8035850
77d9907ca853ab885fd7a35a29faaf4206b8fe47347cd9c12391d64451ad6f37
855f62c34d296773b690bcd61d702db042b6085294928d1f7064c022b47d2695
8caec8fd649aa4490220685f8a8571491e1029a6400a5ef790375107c15001d5
8fe3fa119255adb5e0c12479331f9e092e85bcff56ab6ecc0510bfa2056b898d
918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537
95d72a57b984a9acb52ed9a8dc0a18227b0a208bbcc874a581d26f65f9d25595
a88f88462c0343bc65173e05743424a0894478ce81f27d1a02af664b278f9700
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

befjajh.offerdate.link Open in urlscan Pro 176.123.10.32 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

18 Requests

89 %HTTPS

0 %IPv6

6 Domains

6 Subdomains

6 IPs

3 Countries

235 kBTransfer

555 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

18 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

befjajh.offerdate.link Open in urlscan Pro
176.123.10.32 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

18
Requests

89 %
HTTPS

0 %
IPv6

6
Domains

6
Subdomains

6
IPs

3
Countries

235 kB
Transfer

555 kB
Size

0
Cookies

18 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!