befjajh.offerdate.link
Open in
urlscan Pro
176.123.10.32
Malicious Activity!
Public Scan
Effective URL: https://befjajh.offerdate.link/s/62cf1c2250951?track=looker3
Submission: On May 05 via api from US — Scanned from FR
Summary
TLS certificate: Issued by R3 on April 25th 2024. Valid for: 3 months.
This is the only time befjajh.offerdate.link was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Porn Scam (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 2001:41d0:301... 2001:41d0:301:3::30 | 16276 (OVH) (OVH) | |
2 | 88.214.27.56 88.214.27.56 | 209272 (AS-ALVIVA) (AS-ALVIVA) | |
1 | 54.230.228.94 54.230.228.94 | 16509 (AMAZON-02) (AMAZON-02) | |
11 | 176.123.10.32 176.123.10.32 | 200019 (ALEXHOST) (ALEXHOST) | |
1 | 2a00:1450:400... 2a00:1450:4001:81c::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:80e::2003 | 15169 (GOOGLE) (GOOGLE) | |
18 | 7 |
ASN16509 (AMAZON-02, US)
PTR: server-54-230-228-94.muc50.r.cloudfront.net
openfpcdn.io |
Apex Domain Subdomains |
Transfer | |
---|---|---|
11 |
offerdate.link
befjajh.offerdate.link |
189 KB |
2 |
blueredapple.com
blueredapple.com |
2 KB |
1 |
gstatic.com
fonts.gstatic.com |
24 KB |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 33 |
779 B |
1 |
openfpcdn.io
openfpcdn.io — Cisco Umbrella Rank: 17607 |
5 KB |
1 |
construction-renovation-lyon.com
construction-renovation-lyon.com |
249 B |
18 | 6 |
Domain | Requested by | |
---|---|---|
11 | befjajh.offerdate.link |
blueredapple.com
befjajh.offerdate.link |
2 | blueredapple.com | |
1 | fonts.gstatic.com |
fonts.googleapis.com
|
1 | fonts.googleapis.com |
befjajh.offerdate.link
|
1 | openfpcdn.io |
blueredapple.com
|
1 | construction-renovation-lyon.com | |
18 | 6 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
www.construction-renovation-lyon.com R3 |
2024-02-18 - 2024-05-18 |
3 months | crt.sh |
localhost localhost |
2019-11-05 - 2047-03-22 |
27 years | crt.sh |
openfpcdn.io Amazon RSA 2048 M02 |
2023-12-27 - 2025-01-25 |
a year | crt.sh |
offerdate.link R3 |
2024-04-25 - 2024-07-24 |
3 months | crt.sh |
upload.video.google.com GTS CA 1C3 |
2024-04-16 - 2024-07-09 |
3 months | crt.sh |
*.gstatic.com GTS CA 1C3 |
2024-04-16 - 2024-07-09 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://befjajh.offerdate.link/s/62cf1c2250951?track=looker3
Frame ID: 05FDED480DB9CD143613E53D5CA7C119
Requests: 18 HTTP requests in this frame
Screenshot
Page Title
Le site de rencontres le plus populaire de ce mois-ciPage URL History Show full URLs
-
http://construction-renovation-lyon.com/wp-content/plugins/auxin-the-news/nig/slothfulness_micropterygious.html?oxnu...
HTTP 307
https://construction-renovation-lyon.com/wp-content/plugins/auxin-the-news/nig/slothfulness_micropterygious.html?oxnu... Page URL
-
http://blueredapple.com/ams/index.html
HTTP 307
https://blueredapple.com/ams/index.html Page URL
- https://befjajh.offerdate.link/s/62cf1c2250951?track=looker3 Page URL
Detected technologies
WordPress (CMS) ExpandDetected patterns
- /wp-(?:content|includes)/
animate.css (Web Frameworks) Expand
Detected patterns
- <link [^>]+(?:/([\d.]+)/)?animate\.(?:min\.)?css
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://construction-renovation-lyon.com/wp-content/plugins/auxin-the-news/nig/slothfulness_micropterygious.html?oxnu=3031u
HTTP 307
https://construction-renovation-lyon.com/wp-content/plugins/auxin-the-news/nig/slothfulness_micropterygious.html?oxnu=3031u Page URL
-
http://blueredapple.com/ams/index.html
HTTP 307
https://blueredapple.com/ams/index.html Page URL
- https://befjajh.offerdate.link/s/62cf1c2250951?track=looker3 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://construction-renovation-lyon.com/wp-content/plugins/auxin-the-news/nig/slothfulness_micropterygious.html?oxnu=3031u HTTP 307
- https://construction-renovation-lyon.com/wp-content/plugins/auxin-the-news/nig/slothfulness_micropterygious.html?oxnu=3031u
- http://blueredapple.com/ams/index.html HTTP 307
- https://blueredapple.com/ams/index.html
18 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
slothfulness_micropterygious.html
construction-renovation-lyon.com/wp-content/plugins/auxin-the-news/nig/ Redirect Chain
|
110 B 249 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
index.html
blueredapple.com/ams/ Redirect Chain
|
2 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
favicon.ico
construction-renovation-lyon.com/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
v1
openfpcdn.io/botd/ |
15 KB 5 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
favicon.ico
blueredapple.com/ |
483 B 462 B |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
62cf1c2250951
befjajh.offerdate.link/s/ |
42 KB 17 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
animate.min.css
befjajh.offerdate.link/bundle/16/assets/css/ |
52 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
style.css
befjajh.offerdate.link/bundle/16/assets/css/ |
15 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-2.2.4.min.js
befjajh.offerdate.link/bundle/16/assets/js/ |
84 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
script.min.js
befjajh.offerdate.link/bundle/16/assets/js/ |
252 KB 77 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ |
717 B 779 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
no.png
befjajh.offerdate.link/bundle/16/assets/img/ |
322 B 662 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
yes.png
befjajh.offerdate.link/bundle/16/assets/img/ |
594 B 934 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
1.jpg
befjajh.offerdate.link/bundle/16/assets/img/ |
55 KB 55 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
pattern.png
befjajh.offerdate.link/bundle/16/assets/img/ |
100 B 439 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
S6uyw4BMUTPHjx4wXg.woff2
fonts.gstatic.com/s/lato/v24/ |
23 KB 24 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
track.php
befjajh.offerdate.link/ |
0 277 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
favicon.ico
befjajh.offerdate.link/ |
0 116 B |
Other
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- construction-renovation-lyon.com
- URL
- https://construction-renovation-lyon.com/favicon.ico
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Porn Scam (Online)16 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery string| cf boolean| exitPopunder string| fpDataEncoded function| sendTrack function| Fingerprint2 function| fingerprintGo function| collectTrackParams function| closingConfirm function| handleError function| getParameterByName function| collectParams function| checkRequired function| setLeadInfo function| setCF2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.offerdate.link/ | Name: s Value: fKK3WEPHiu4stW0X13uTp%2BLBNhGEYv%2FZfoFF%2BDLbQea2o1lYQUJDdV3nJme%2Btw8%2BAi7wau2Wl2VrCIfeHb%2BvqCB%2B3vkRH6NV%2FTdQQiJzDdElh%2BqeR7aw3ZvN9c0G6gz43GDgZqBon4aXYtjVcNH0qYXXWkQnTbrmD6cG%2BBdDUP8tzIUrFF2g3WuG%2BPMqSvi5IsBvQhaETX%2FbZsxdRsa0MDxAJ1pVS1g%2B8JKu%2B5%2BZ1s5iSsfkVWWz14vs0R7ivFa4Fb2E8Hro5rJhESmaPV%2FsfnhKGf1oYOIAgZS4bHb0BeUVePw46FXLFBTAqq89wP9pj%2BinDK9hkctajpMGcZhceQZWuay4YZLtzVWI%2BxhdOYtby%2Bd6cYjoIs7%2BIDW%2BB77kNzm00JNGqgtJ%2FhF4mgXPxzTi3jPaHnhA5YiYWYey4M7RpNW9RLeLWKlOSrVQDJYV%2BPl%2FJ%2Bafz6MMyJx6ullm0qc%2FBUkna6aifHtIqijJbtqDwHGffkYKbrumn1YKGdv6gS%2B382UP6g%2BC9P4nsSoI%2Bi%2FM39dPTy53lh9duDU4dTocF4bk02cSTUJ6fi4PHW24eJK0hR5H%2BUC9MN9GyN7Cu6dVjpmmmwI4dQDZhwnUvkIqO5okeKa3bAIuTZ2kV0gZPPDHzrtPYtqVHVxAtkceD4qSi2xy73XDGrfh66L6HRq5OQgmBpuVDUQM9P65JIZzyBB2enn3DRgpmBzO0ZGoO0dSfqAdVvTInZB5VZCsHAow5J%2BhtWYiPCDnFs2QglUl8STDn3kWmfMZEvaXNKnh6a93M%2FiGuiExZjIYYuqFpqMXGgcVE9U0DdxkLvxscKRqLBmpf9CqfjkvgS0HssxwyOT19nQaaXoD2%2FDWXU5jq6RXLI5UUi%2BCYDNYR6itLh9s4WaWe6PD5DogEN%2F6a0%2B0gKkxkejoJe0FHex18RIacXK2xufpzYNmFSKv5I2UV5mx37kdCSb95qFvsLTn0YsnrzdrV%2FIkkHTYvrEbeHSz%2FfymghiiEYparxpIu8fTm1Q0J9IBF%2FEg9NhP2t1h0RsZCLIOWoJ5FQHbrku7%2Bzn0uzvjHTePUZUvkGV2epC2BBoNnCOyHutboWtB5d8MC9hF4HDAvODAButfqOljgJvPzB%2FNFyVNBWIRssJtIRmktf6zb6%2BJ0%2BsURO%2BVP2MO4d%2Bc%2B8dG1O9Zy7VqqEyXQrvr4vjCLT5JbpznT5YtfjDa8fgS5UkHwt2qwENFeKO0Aj0vClpQcQnlKUXnjhrBn0agiD%2BrU5TVJK9WGCbdRUd9QUwCTggkk1rC6WvWbX2SavyZOEhbh8ltsVy1RV5i9f9QKUGV4fqmUXb1%2BDCyE11tiAC3hH6FThRj3hHH5yjWDokq5syHWH1%2F4ODQniIcDmH%2BXpbnVD%2FvDFDq5hq508Y4p4dSXGAV2MW%2Fmmj%2F37%2BGQeQzePU7%2FCOo5ePkQd22j9O6d4u1YD3Tw097bNFOWpob3hV35zL4gtY%2FT8zleRUB1L6FqlgWgbQhrARkAybGLt6fKXaxk5pbyPOUsPyRoEwVCcRwcfN1J5w%2B7IXzjZCyewltjLHrndpXPhKtz6KOF%2FWLXBQwiiuNhgwkoWiUtC6WLQsXnBQQcbK2UMdC22RUwlmE19Ok%2Bgp%2FDYwiaJsg1WdyuEO8mNiwGtaGbl2ivAPTmkAc1NZ%2F4SeXeaNccQiHvlt8J%2FbVHC0lcE5%2BasRCj%2B3YzeMB5MS7EdVhrADxILY0buWCTEcyL8w6Mgbkbywu3cUXQHyjSrAOQ%2BDdDxnRgiur0sMPz9RJOwn8fL7SGWHn3kjwcT29DtDmbmnxN6izrhaRPMBB5BPudwAp2PL2Ta%2FxtxGaaLdV2m6OxpN3ST%2FmhfOF |
|
befjajh.offerdate.link/ | Name: CF Value: 1FnHbVEYucJu2kMfRO/LUA__ |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
befjajh.offerdate.link
blueredapple.com
construction-renovation-lyon.com
fonts.googleapis.com
fonts.gstatic.com
openfpcdn.io
construction-renovation-lyon.com
176.123.10.32
2001:41d0:301:3::30
2a00:1450:4001:80e::2003
2a00:1450:4001:81c::200a
54.230.228.94
88.214.27.56
009a8645427f1e1b5ada711e78da2f4d905069b7e8e913c98874cb197358c7eb
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
13de289b7d770632c2b87d7019cdb10416061bcdb50f07cadcc5e4c6cdf33a36
28366947858d3f44b6c20fd9ec96a0b9c04780027c7d6fc155672c4bf25801af
29cb26e06f2a4a877f1134a46480d9b78f8b6e0e6f9b0fe67e34307c312b5a89
32e7c65b901ce74ed7be6625d156bd12562c04f1413716ac08996e918087e525
3e80058e1e64f3e5085e47096d373ae6b74987d494aec75b3f67872706569ef4
3fa7cbd6ccb0e62abc11ba89609c6cdd73aaa458973ae65b7d590830475ff261
76d703389c75e3c1e9946072b1e18f6d61842f77eac3f03cfb366baba8035850
77d9907ca853ab885fd7a35a29faaf4206b8fe47347cd9c12391d64451ad6f37
855f62c34d296773b690bcd61d702db042b6085294928d1f7064c022b47d2695
8caec8fd649aa4490220685f8a8571491e1029a6400a5ef790375107c15001d5
8fe3fa119255adb5e0c12479331f9e092e85bcff56ab6ecc0510bfa2056b898d
918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537
a88f88462c0343bc65173e05743424a0894478ce81f27d1a02af664b278f9700
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855