Report - babesroulette.com/landers/18d/

Report Overview

Submitted URL
babesroulette.com/landers/18d/
IP
104.21.72.186
ASN
#13335 CLOUDFLARENET
Submitted
2023-05-02 18:22:01
Access
public
Website Title
Final URL
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
2

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
babesroulette.com	281754	unknown	2013-07-17	2023-04-25	2.2 kB	718 kB	104.21.72.186
ocsp.pki.goog	175	2016-06-13	2018-07-01	2023-05-02	1.3 kB	2.8 kB	142.250.74.131
fonts.googleapis.com	8877	2005-01-25	2013-06-10	2023-05-02	491 B	2.2 kB	142.250.74.106
fonts.gstatic.com	unknown	2008-02-11	2014-09-09	2023-05-02	1.0 kB	33 kB	216.58.207.227
deefauph.com	135892	unknown	2021-03-12	2023-05-01	909 B	15 kB	139.45.197.251
dratingmaject.com	821761	unknown	2021-08-30	2023-04-25	488 B	414 B	18.195.149.11

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

OpenPhish

No alerts detected

PhishTank

No alerts detected

Fortinet's Web Filter

Scan Date	Severity	Indicator	Alert
2023-05-02	medium	babesroulette.com/landers/18d/

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (3)

	URL	Size	First Seen	Last Seen
	babesroulette.com/landers/18d/	711 B	2023-04-07	2023-05-09
Pretty URL babesroulette.com/landers/18d/ IP 104.21.72.186 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2023-04-07 17:29:49 Last Seen2023-05-09 16:32:57 Times Seen9 Hash 67bdbba89485f8faa24c909b7643d945 fae1024c34241cc6f4d0a14f8223e5f4ef20980d f3b5092b398289946576eb62126606e3467ff03f0b89aa32f178769173a2631a Loading...

	babesroulette.com/landers/18d/	1.5 kB	2023-04-07	2023-05-09
Pretty URL babesroulette.com/landers/18d/ IP 104.21.72.186 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2023-04-07 17:29:49 Last Seen2023-05-09 16:32:57 Times Seen9 Hash d806ac2c576836ef918b87da58ea4aa1 0e0395dd4abc0966c66809f679d1f6e0d0207666 cc22234cbfe996c8150f004401c3ec5a082a442eb68fe39c640614c5eaa05427 Loading...

	deefauph.com/pfe/current/micro.tag.min.js?z=4740019&ymid=null&var=null&sw=/sw-check-permissions-2e801.js	42 kB	2023-04-19	2023-05-09
Pretty URL deefauph.com/pfe/current/micro.tag.min.js?z=4740019&ymid=null&var=null&sw=/sw-check-permissions-2e801.js IP 139.45.197.251 ASN #9002 RETN Limited Introduced by scriptElement Embedded in HTML false Observations First Seen2023-04-19 14:48:59 Last Seen2023-05-09 12:55:42 Times Seen1622 Hash 5afe3646f268f49bd2a063f9ec0efd4f d12d96d586b34fa522ad118c26ac6701c4700ca2 c734274419dbd49612802b50ef522945bd1bdf8a9ee8cd5ced9de248dadbcac7 Loading...

HTTP Transactions (16)

URL IP Response Size

babesroulette.com/landers/18d/

104.21.72.186

200 OK

1.7 kB

URL User Request GET HTTP/1.1
babesroulette.com/landers/18d/
IP
104.21.72.186:80
ASN
#13335 CLOUDFLARENET

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (757), with CRLF line terminators
Size
1.7 kB (1740 bytes)
Hash
a667b1783db48ff2737b711f5536ac61
95bb2ce57d86f06c7bdf25dae3edf4f0efa64a09
05be816435f432204176125bb0a5b49e2bab02bc894772c2e1ee65e04a31ec3c

Detections

Analyzer	Verdict	Alert
fortinet	Malware

HTTP Headers

GET /landers/18d/ HTTP/1.1
Host: babesroulette.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Tue, 02 May 2023 18:21:46 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Wed, 18 May 2022 21:38:41 GMT
X-Powered-By: PleskLin
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PS1DwMRhoKjQecYTAjt%2FfgOQR0V42bV3nx%2Bvi1TON%2FUo2%2FzAcJ4kHIFUoH0lAy3gZx1uCK6vQT%2FlIUAfQogw%2Fo9Z5wKd51HBjhaP5f25Tf3RPLCDcBOtBtgdNrzuOtzW%2Bjs1GQ%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 7c12492b4c2c0b65-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60

babesroulette.com/landers/18d/css/badoinkvr9.min.css

104.21.72.186

200 OK

27 kB

URL GET HTTP/1.1
babesroulette.com/landers/18d/css/badoinkvr9.min.css
IP
104.21.72.186:80
ASN
#13335 CLOUDFLARENET

Requested by
http://babesroulette.com/landers/18d/

File type
Unicode text, UTF-8 text, with very long lines (65534), with no line terminators
Size
27 kB (26940 bytes)
Hash
4950f70da48afabf4b90da8e773284a0
e7d585a5b42e48315f9151a9f1aaa6c83f77b60c
d7beee7185ab6ee8c58c0a335fbdd0ea6dcc8fcc5258d856023078f4eecb559d

HTTP Headers

GET /landers/18d/css/badoinkvr9.min.css HTTP/1.1
Host: babesroulette.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://babesroulette.com/landers/18d/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Tue, 02 May 2023 18:21:46 GMT
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Wed, 18 May 2022 21:38:36 GMT
ETag: W/"6285675c-2e0f9"
X-Powered-By: PleskLin
Cache-Control: max-age=14400
CF-Cache-Status: REVALIDATED
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dYRfVYjjKBj1EMb1BOHUnNfZvXkQgUpFlsc9C76GQzC32wvUPFf%2BvEkDbOtpzlQXk5g6bpGMLx%2F%2BCAh%2FlbPhzAukTnT%2F4s0gOqX5f0Z6g0XGQtjRQ7ilu7irMz7uh9NkFj%2B0AQ%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 7c12492d6e940b65-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60

ocsp.pki.goog/gts1c3

142.250.74.131

472 B

URL
ocsp.pki.goog/gts1c3
IP
142.250.74.131:0
ASN
#15169 GOOGLE

File type
data
Size
472 B (472 bytes)
Hash
12ba8eaf8df351c1b04c5aa90a1654ca
89c8ed3f837bd937b60d8b6862af6e81510a41f5
6b2c88a08976f9b12290abc6f4e7a6cffd00698f8853f3d7bd0a87974c354bfb

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 02 May 2023 18:21:46 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

babesroulette.com/landers/18d/img/18.png

104.21.72.186

200 OK

1.9 kB

URL GET HTTP/1.1
babesroulette.com/landers/18d/img/18.png
IP
104.21.72.186:80
ASN
#13335 CLOUDFLARENET

Requested by
http://babesroulette.com/landers/18d/

File type
PNG image data, 214 x 214, 8-bit colormap, non-interlaced\012- data
Size
1.9 kB (1927 bytes)
Hash
3067aae7c6d439721665640c796d0627
f16e50134fd77611c03445043fc2d2258b596e6b
a6aa34cf719d74da2951f38c12554418ed0c6d0a9d49218eec21c109aa88f20f

HTTP Headers

GET /landers/18d/img/18.png HTTP/1.1
Host: babesroulette.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://babesroulette.com/landers/18d/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Tue, 02 May 2023 18:21:46 GMT
Content-Type: image/png
Content-Length: 1927
Connection: keep-alive
Last-Modified: Wed, 18 May 2022 21:38:40 GMT
ETag: "62856760-787"
X-Powered-By: PleskLin
Cache-Control: max-age=14400
CF-Cache-Status: REVALIDATED
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=45fGO1n9un3wpXSGXaG38JRswje2kAGoid5KszichAlBpG2fGpsAOaMjclbbo8rii3yKzOLF7aB7w4s3a%2BwjrrEelTXz%2Bd1fxp3jI4orvhILaDh7%2BY4bTMFK277eh%2BQ8cnuG5Q%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 7c12492edd89b511-OSL
alt-svc: h2=":443"; ma=60

fonts.googleapis.com/css?family=Roboto:100,100italic,300,400,400italic,300italic,500,500italic,700,700italic

142.250.74.106

200 OK

1.6 kB

URL GET HTTP/2
fonts.googleapis.com/css?family=Roboto:100,100italic,300,400,400italic,300italic,500,500italic,700,700italic
IP
142.250.74.106:443
ASN
#15169 GOOGLE

Requested by
http://babesroulette.com/landers/18d/
Certificate
IssuerGoogle Trust Services LLC
Subjectupload.video.google.com
Fingerprint78:8B:BB:40:DD:1D:5B:E9:7B:AA:CC:94:45:44:7F:FD:56:6E:E4:60
ValidityMon, 03 Apr 2023 08:24:24 GMT - Mon, 26 Jun 2023 08:24:23 GMT

File type
data
Size
1.6 kB (1553 bytes)
Hash
6795b2d1aa16e1b944c97547ead553e4
cf459bc3191a3e885cdac6b8842e4a8a5c085cb4
72cf9db16b7b52e8ef6fa70fd1669a7717eb761e2771f12f4640f28b14ddf095

HTTP Headers

GET /css?family=Roboto:100,100italic,300,400,400italic,300italic,500,500italic,700,700italic HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://babesroulette.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Tue, 02 May 2023 18:21:46 GMT
date: Tue, 02 May 2023 18:21:46 GMT
cache-control: private, max-age=86400
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

ocsp.pki.goog/gts1c3

142.250.74.131

471 B

URL
ocsp.pki.goog/gts1c3
IP
142.250.74.131:0
ASN
#15169 GOOGLE

File type
data
Size
471 B (471 bytes)
Hash
2ce978767c05692aa24c6454c05de9fc
2daae46f8a6cc154414210a7fa409479f51991e6
2f804b51a4f9a047a1d9de696906484b648e1f6e052a1fc85f3e29a8f0309e2d

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 02 May 2023 18:21:46 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

ocsp.pki.goog/gts1c3

142.250.74.131

471 B

URL
ocsp.pki.goog/gts1c3
IP
142.250.74.131:0
ASN
#15169 GOOGLE

File type
data
Size
471 B (471 bytes)
Hash
2ce978767c05692aa24c6454c05de9fc
2daae46f8a6cc154414210a7fa409479f51991e6
2f804b51a4f9a047a1d9de696906484b648e1f6e052a1fc85f3e29a8f0309e2d

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 02 May 2023 18:21:47 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

216.58.207.227

200 OK

16 kB

URL GET HTTP/2
fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2
IP
216.58.207.227:443
ASN
#15169 GOOGLE

Requested by
http://babesroulette.com/landers/18d/
Certificate
IssuerGoogle Trust Services LLC
Subject*.gstatic.com
Fingerprint34:5A:0A:3B:4F:02:F9:C6:C9:D7:3F:CA:9D:17:0D:40:27:05:05:0A
ValidityMon, 03 Apr 2023 08:24:23 GMT - Mon, 26 Jun 2023 08:24:22 GMT

File type
Web Open Font Format (Version 2), TrueType, length 15744, version 1.0\012- data
Size
16 kB (15744 bytes)
Hash
15d9f621c3bd1599f0169dcf0bd5e63e
7ca9c5967f3bb8bffeab24b639b49c1e7d03fa52
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

HTTP Headers

GET /s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: http://babesroulette.com
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15744
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sat, 29 Apr 2023 07:44:41 GMT
expires: Sun, 28 Apr 2024 07:44:41 GMT
cache-control: public, max-age=31536000
age: 297426
last-modified: Wed, 11 May 2022 19:24:48 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

216.58.207.227

200 OK

16 kB

URL GET HTTP/2
fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2
IP
216.58.207.227:443
ASN
#15169 GOOGLE

Requested by
http://babesroulette.com/landers/18d/
Certificate
IssuerGoogle Trust Services LLC
Subject*.gstatic.com
Fingerprint34:5A:0A:3B:4F:02:F9:C6:C9:D7:3F:CA:9D:17:0D:40:27:05:05:0A
ValidityMon, 03 Apr 2023 08:24:23 GMT - Mon, 26 Jun 2023 08:24:22 GMT

File type
Web Open Font Format (Version 2), TrueType, length 15860, version 1.0\012- data
Size
16 kB (15860 bytes)
Hash
e9f5aaf547f165386cd313b995dddd8e
acdef5603c2387b0e5bffd744b679a24a8bc1968
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860

HTTP Headers

GET /s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: http://babesroulette.com
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15860
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sat, 29 Apr 2023 03:11:48 GMT
expires: Sun, 28 Apr 2024 03:11:48 GMT
cache-control: public, max-age=31536000
age: 313799
last-modified: Wed, 11 May 2022 19:24:42 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

deefauph.com/pfe/current/micro.tag.min.js?z=4740019&ymid=null&var=null&sw=/sw-check-permissions-2e801.js

139.45.197.251

200 OK

15 kB

URL GET HTTP/1.1
deefauph.com/pfe/current/micro.tag.min.js?z=4740019&ymid=null&var=null&sw=/sw-check-permissions-2e801.js
IP
139.45.197.251:80
ASN
#9002 RETN Limited

Requested by
http://babesroulette.com/landers/18d/

File type
C source, ASCII text, with very long lines (41570), with no line terminators
Size
15 kB (14673 bytes)
Hash
e6c1f52bcd703fadf509ddb6e77229b8
176f072e58f24fb121ac98bada94f3a6c1539671
4b80acfbf45fa57684de4575ae03dacb4019b2415c73ee1fc00d58a873c0523a

HTTP Headers

GET /pfe/current/micro.tag.min.js?z=4740019&ymid=null&var=null&sw=/sw-check-permissions-2e801.js HTTP/1.1
Host: deefauph.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://babesroulette.com/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 02 May 2023 18:21:46 GMT
Content-Type: application/javascript
Last-Modified: Fri, 28 Apr 2023 10:39:52 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"644ba278-a262"
Access-Control-Allow-Credentials: true
Cache-Control: no-cache
Pragma: no-cache
Content-Encoding: gzip

dratingmaject.com/d/.js?lpref=&lpurl=http%3A%2F%2Fbabesroulette.com%2Flanders%2F18d%2F&lpt=Title%20here&t=1683051712345

18.195.149.11

400 Bad Request

152 B

URL GET HTTP/2
dratingmaject.com/d/.js?lpref=&lpurl=http%3A%2F%2Fbabesroulette.com%2Flanders%2F18d%2F&lpt=Title%20here&t=1683051712345
IP
18.195.149.11:443
ASN
#16509 AMAZON-02

Requested by
http://babesroulette.com/landers/18d/
Certificate
IssuerLet's Encrypt
Subjectdratingmaject.com
FingerprintFD:D5:5B:A8:07:16:D0:B8:25:D7:A8:EE:3E:66:B4:A6:36:C4:84:26
ValidityTue, 18 Apr 2023 05:48:30 GMT - Mon, 17 Jul 2023 05:48:29 GMT

File type
HTML document text\012- HTML document text\012- HTML document, ASCII text, with no line terminators
Size
152 B (152 bytes)
Hash
d9bacc468aa23334526933389545e120
e26288b4bada404ce340ca72989f9f1193dc649c
0605685efb44dd3decd77517436c575731b61f807247587de67080c579ffa2d4

HTTP Headers

GET /d/.js?lpref=&lpurl=http%3A%2F%2Fbabesroulette.com%2Flanders%2F18d%2F&lpt=Title%20here&t=1683051712345 HTTP/1.1
Host: dratingmaject.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://babesroulette.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 400 Bad Request
server: nginx
date: Tue, 02 May 2023 18:21:47 GMT
content-type: text/html
content-length: 152
cache-control: no-store, no-cache, pre-check=0, post-check=0
expires: Thu, 01 Jan 1970 00:00:00 GMT
pragma: no-cache
X-Firefox-Spdy: h2

ocsp.pki.goog/gts1c3

142.250.74.131

471 B

URL
ocsp.pki.goog/gts1c3
IP
142.250.74.131:0
ASN
#15169 GOOGLE

File type
data
Size
471 B (471 bytes)
Hash
2ce978767c05692aa24c6454c05de9fc
2daae46f8a6cc154414210a7fa409479f51991e6
2f804b51a4f9a047a1d9de696906484b648e1f6e052a1fc85f3e29a8f0309e2d

HTTP Headers

POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Tue, 02 May 2023 18:21:47 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

babesroulette.com/favicon.ico

104.21.72.186

200 OK

119 B

URL GET HTTP/1.1
babesroulette.com/favicon.ico
IP
104.21.72.186:80
ASN
#13335 CLOUDFLARENET

Requested by
http://babesroulette.com/landers/18d/

File type
MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel\012- data
Size
119 B (119 bytes)
Hash
e886cbbbe912fe1755f12618ef14a7a1
4688047532f4220515f0a0f903d5e6ce47e22deb
61328bb8a50501704c0648342a4658e940396d4c4f92c012ec23b21d55680b12

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: babesroulette.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://babesroulette.com/landers/18d/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Tue, 02 May 2023 18:21:47 GMT
Content-Type: image/vnd.microsoft.icon
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Tue, 28 Sep 2021 18:43:11 GMT
ETag: W/"6153623f-47e"
X-Powered-By: PleskLin
Cache-Control: max-age=14400
CF-Cache-Status: HIT
Age: 4967
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0RABYc8v0THM8cqoF45qkwUVfQj221vGeGleaz%2BR2lTsqPh3HOkvcjdMrMPdSbZvAViTMDvw55tfbi0YcUv55qOqe%2B8dR%2BT%2BFpfLZACW%2FdRn4JBPnEu0cOm3StRtXuHsH1I%2BWA%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 7c124931cc770b65-OSL
Content-Encoding: gzip
alt-svc: h2=":443"; ma=60

babesroulette.com/landers/18d/css/9.jpg

104.21.72.186

200 OK

682 kB

URL GET HTTP/1.1
babesroulette.com/landers/18d/css/9.jpg
IP
104.21.72.186:80
ASN
#13335 CLOUDFLARENET

Requested by
http://babesroulette.com/landers/18d/

File type
JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 23.3 (Windows), datetime=2022:05:12 19:28:53], baseline, precision 8, 1080x1080, components 3\012- data
Size
682 kB (682416 bytes)
Hash
35240535a15b01fed24b8f5a0d8bb012
72c6b3fdd37efc156d9564ef2953feeeeb946b86
56c847b0117b1c51c8c76d527388f69509731f5e7b77921cf22d57eaa99a4c8e

HTTP Headers

GET /landers/18d/css/9.jpg HTTP/1.1
Host: babesroulette.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://babesroulette.com/landers/18d/css/badoinkvr9.min.css
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Tue, 02 May 2023 18:21:47 GMT
Content-Type: image/jpeg
Content-Length: 682416
Connection: keep-alive
Last-Modified: Wed, 18 May 2022 21:39:57 GMT
ETag: "628567ad-a69b0"
X-Powered-By: PleskLin
Cache-Control: max-age=14400
CF-Cache-Status: REVALIDATED
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gRaQUexmNEYP9roxC%2FboHbozpRgVjjQIkXlovECehizYMYo10uHhdP0lhtzhC515DWr0w7SvEJq8ZYJfcGGp93dIr1lZ7s%2Bo%2FQMxv3V83FRkjh9JVvTIDMhFIgUqbK9VPFxnOA%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 7c1249306ff4b511-OSL
alt-svc: h2=":443"; ma=60

deefauph.com/zone?&pub=0&zone_id=4740019&is_mobile=false&domain=babesroulette.com&var=null&ymid=null&var_3=&var_4=&dsig=&action=prerequest

139.45.197.251

200 OK

0 B

URL POST HTTP/2
deefauph.com/zone?&pub=0&zone_id=4740019&is_mobile=false&domain=babesroulette.com&var=null&ymid=null&var_3=&var_4=&dsig=&action=prerequest
IP
139.45.197.251:443
ASN
#9002 RETN Limited

Requested by
http://babesroulette.com/landers/18d/
Certificate
IssuerLet's Encrypt
Subjectdeefauph.com
Fingerprint60:C6:D8:6D:EE:19:03:8F:4B:76:3E:56:1D:55:FC:0F:5E:AD:BF:23
ValidityThu, 02 Mar 2023 05:16:03 GMT - Wed, 31 May 2023 05:16:02 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

POST /zone?&pub=0&zone_id=4740019&is_mobile=false&domain=babesroulette.com&var=null&ymid=null&var_3=&var_4=&dsig=&action=prerequest HTTP/1.1
Host: deefauph.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://babesroulette.com
Connection: keep-alive
Referer: http://babesroulette.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Content-Length: 0

HTTP/2 200 OK
server: nginx
date: Tue, 02 May 2023 18:21:47 GMT
content-length: 0
x-trace-id: cd562542bd038caa50d291ed415b161a
access-control-allow-origin: http://babesroulette.com
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
strict-transport-security: max-age=1
x-content-type-options: nosniff
X-Firefox-Spdy: h2

babesroulette.com/sw-check-permissions-2e801.js?var=null&ymid=null

104.21.72.186

200 OK

293 B

URL GET HTTP/1.1
babesroulette.com/sw-check-permissions-2e801.js?var=null&ymid=null
IP
104.21.72.186:80
ASN
#13335 CLOUDFLARENET

Requested by
http://babesroulette.com/landers/18d/

File type
Java source, ASCII text
Size
293 B (293 bytes)
Hash
e63b6d093728d14bd3c8f740e577ce0c
bda54691855b7039dec48cf35eb1e59ec5271e14
7698a549058a31ff354c6ddc5a6ab8870dd807aeb30cc6858fc3fec2177261f7

HTTP Headers

GET /sw-check-permissions-2e801.js?var=null&ymid=null HTTP/1.1
Host: babesroulette.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Moz: prefetch
Connection: keep-alive
Referer: http://babesroulette.com/landers/18d/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Tue, 02 May 2023 18:21:47 GMT
Content-Type: application/javascript
Content-Length: 293
Connection: keep-alive
X-Accel-Version: 0.01
Last-Modified: Mon, 20 Dec 2021 20:09:25 GMT
ETag: "236-5d3997720a8d0-gzip"
Vary: Accept-Encoding
Content-Encoding: gzip
X-Powered-By: PleskLin
Cache-Control: max-age=14400
CF-Cache-Status: MISS
Accept-Ranges: bytes
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EQmuHNFmsNuLiUcZOR3XHRHUqTns2ArlusKplshNGpvk9BkXr%2BL8bsrOQM4vFxg9tbeggbiu7hK1oeoXX3trXXmiB2JT%2Baiy%2F1qBqjL9xkBb8CvRoEL2bTShqELRvkXmkkWW5A%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 7c1249324b1ab511-OSL
alt-svc: h2=":443"; ma=60

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (3)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (16)

URL User Request GET HTTP/1.1

IP

ASN

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

File type

Size

Hash

HTTP Headers

URL GET HTTP/2