Report - hookupgirlsclub.com/

Report Overview

Submitted URL
hookupgirlsclub.com/
IP
172.67.173.86
ASN
#13335 CLOUDFLARENET
Submitted
2024-04-27 04:11:58
Access
public
Website Title
WhatsApp Group Invite
Final URL
wa.privategirlocation.com/
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
22

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
wa.privategirlocation.com	unknown	2023-05-27	2023-09-05	2023-11-05	3.9 kB	451 kB	172.67.175.190
hzr0dm28m17c.com	269459	2020-06-29	2020-08-28	2024-04-20	443 B	12 kB	192.243.61.227
proftrafficcounter.com	unknown	2023-11-16	2023-11-21	2024-04-25	451 B	432 B	18.194.72.95
hoardjan.com	unknown	2024-04-23	2024-04-23	2024-04-25	2.4 kB	3.3 kB	192.243.59.13
hookupgirlsclub.com	unknown	2023-05-27	2023-09-23	2024-03-19	476 B	10 kB	104.21.80.24

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

Scan Date	Severity	Indicator	Alert
2024-04-25	medium	wa.privategirlocation.com/	WhatsApp
2024-04-25	medium	wa.privategirlocation.com/	WhatsApp
2024-04-25	medium	wa.privategirlocation.com/	WhatsApp
2024-04-25	medium	wa.privategirlocation.com/	WhatsApp
2024-04-25	medium	wa.privategirlocation.com/	WhatsApp
2024-04-25	medium	wa.privategirlocation.com/	WhatsApp
2024-04-26	medium	hookupgirlsclub.com/	WhatsApp
2024-04-25	medium	wa.privategirlocation.com/	WhatsApp
2024-04-25	medium	wa.privategirlocation.com/	WhatsApp

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-04-27	medium	hoardjan.com	Sinkholed
2024-04-27	medium	hoardjan.com	Sinkholed

ThreatFox

No alerts detected

JavaScript (7)

	URL	Size	First Seen	Last Seen
	unknown	145 B	2023-10-20	2024-04-27
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-10-20 14:51:55 Last Seen2024-04-27 06:13:33 Times Seen9 Hash 02ba3e9834b60d80904c24968b9ab641 c38b9de12421583a1434f02355011e1d0b15790e 74a85926e5468ca7758a8ec622ebccb47281ea4a6e763f97222a9d10ca467477 Loading...

	wa.privategirlocation.com/npm/backoffer.js	618 B	2023-03-07	2024-05-02
Pretty URL wa.privategirlocation.com/npm/backoffer.js IP 172.67.175.190 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 12:57:37 Last Seen2024-05-02 10:16:26 Times Seen257 Hash 4e39716b4d4469996fc6e68265fa8830 c8b24994e71f4e58170e639124107fd25757f755 3cc4cdc7b3421264503656474f5b10db20bc711493bfe2df0680da0b7c81a72c Loading...

	wa.privategirlocation.com/	0 B	2023-03-07	2024-05-08
Pretty URL wa.privategirlocation.com/ IP 172.67.175.190 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 01:01:59 Last Seen2024-05-08 13:56:14 Times Seen37437561 Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Loading...

	unknown	392 B	2023-10-20	2024-04-27
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-10-20 14:51:55 Last Seen2024-04-27 06:13:33 Times Seen9 Hash 7bb4cdbe9a30b3915025350ee878c82a 92e891f15dabf35d321da98b561cca69c0fe8bdb 787bb633dba8640f1e5456c264bc31a5747f14723445f4378cccefbcff523670 Loading...

	hzr0dm28m17c.com/345e1621a507b6fbaf713c8b5e94fb13/invoke.js	31 kB	2024-04-27	2024-04-27
Pretty URL hzr0dm28m17c.com/345e1621a507b6fbaf713c8b5e94fb13/invoke.js IP 192.243.61.227 ASN #39572 DataWeb Global Group B.V. Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-27 06:12:01 Last Seen2024-04-27 06:12:01 Times Seen2 Hash b7560fc440c08b7b87acd4fcc0785d25 f90d510400f02a1b183e861ef8e69c158ab1425c 2de41ff52df085752ff23b3c20132104c2e9ef2eb1bea6300b3139bbb66cd148 Loading...

		Size	First Seen	Last Seen
	#1 Write - 78b14f4e54dc3a4696efe024ba12a49a	318 B	2023-10-20	2024-04-27
Pretty Observations First Seen2023-10-20 14:51:55 Last Seen2024-04-27 06:13:33 Times Seen9 Hash 78b14f4e54dc3a4696efe024ba12a49a 43312f7ab0aa3b26084760560844c286483f5a86 8cf6a73edc2c9feff2820aeb000b02cce81e039722a5c3cfe0e44bdfc82d92ac Loading...

	#2 Write - 31459d70a588537efe347fdbb4125ecb	108 B	2023-10-20	2024-04-27
Pretty Observations First Seen2023-10-20 14:51:55 Last Seen2024-04-27 06:13:33 Times Seen9 Hash 31459d70a588537efe347fdbb4125ecb bc87a0662fc8b127be9ddd9e3aae5a4b146aa586 0e044b141ffb37973cb725686b56e12080d37dbe9d6eade7ee56568e88e19908 Loading...

HTTP Transactions (13)

URL IP Response Size

wa.privategirlocation.com/img/logo-2.jpg

172.67.175.190

200 OK

77 kB

URL GET HTTP/3
wa.privategirlocation.com/img/logo-2.jpg
IP
172.67.175.190:443
ASN
#13335 CLOUDFLARENET

Requested by
https://wa.privategirlocation.com/
Certificate
IssuerLet's Encrypt
Subjectprivategirlocation.com
Fingerprint72:33:1C:94:89:E9:CE:A2:68:80:AA:3B:E2:EB:60:36:05:B4:D8:EB
ValiditySun, 17 Mar 2024 22:25:37 GMT - Sat, 15 Jun 2024 22:25:36 GMT

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 675x900, components 3
Size
77 kB (77421 bytes)
Hash
5252a6f2558062d891ba358607d41047
93e648f2dcfee2a8e4c6a0592d960f6767170068
ff9e2a898cad8c5d5fe310af13dfb2c82caba237d0a546e9dcc52997c7c55a56

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	WhatsApp

HTTP Headers

GET /img/logo-2.jpg HTTP/1.1
Host: wa.privategirlocation.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://wa.privategirlocation.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Sat, 27 Apr 2024 04:11:32 GMT
content-type: image/jpeg
content-length: 77421
cache-control: public, max-age=604800
expires: Sat, 04 May 2024 00:07:34 GMT
last-modified: Thu, 28 Sep 2023 07:09:05 GMT
x-turbo-charged-by: LiteSpeed
cf-cache-status: HIT
age: 14638
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=j2PNz6W19YtpBjrvPoxMbR6Lsb49d6xhY%2Be5pFT%2F%2BjQH6YUGtlVwdrxgreI6TRoWSQtt1ZA%2BRZquAVuf8BOOcDKML%2F5Kt6s6TzsiVwFkyfHtrA%2FA9Jxvzb4kVx1xSJW15ZkJBOrCtvWHh6Sz"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87abf8180e0b56a8-OSL
alt-svc: h3=":443"; ma=86400

wa.privategirlocation.com/img/wa-logo.svg

172.67.175.190

200 OK

11 kB

URL GET HTTP/3
wa.privategirlocation.com/img/wa-logo.svg
IP
172.67.175.190:443
ASN
#13335 CLOUDFLARENET

Requested by
https://wa.privategirlocation.com/
Certificate
IssuerLet's Encrypt
Subjectprivategirlocation.com
Fingerprint72:33:1C:94:89:E9:CE:A2:68:80:AA:3B:E2:EB:60:36:05:B4:D8:EB
ValiditySun, 17 Mar 2024 22:25:37 GMT - Sat, 15 Jun 2024 22:25:36 GMT

File type
SVG Scalable Vector Graphics image
Size
11 kB (10654 bytes)
Hash
6b3ee5e3877cc19d1154cbe98eea6f66
56d4b7556cebad6129ebb61a980d5964be476b4a
533ef6670e3d9c0e44718d0afa43f2edda11b58586e9da4e8f621145cf84d4d2

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	WhatsApp

HTTP Headers

GET /img/wa-logo.svg HTTP/1.1
Host: wa.privategirlocation.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://wa.privategirlocation.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Sat, 27 Apr 2024 04:11:32 GMT
content-type: image/svg+xml
cache-control: public, max-age=604800
expires: Sat, 04 May 2024 00:07:34 GMT
last-modified: Thu, 28 Sep 2023 07:09:05 GMT
vary: Accept-Encoding
x-turbo-charged-by: LiteSpeed
cf-cache-status: HIT
age: 14638
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BV9RFaU1N7fen5DKvw%2FHSOv%2BiNLxAZICwAn4w96tM7cAhyXZBwSmeTISopNKDUkpTvrhKshztOw9b%2B43EktmruM9KUVT7L9ZuWeG%2BjfVttRQtH6s5q2%2BB0sRCiZ2he8pgZaC%2FN6alAsYyoG9"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87abf8180e0a56a8-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

hzr0dm28m17c.com/345e1621a507b6fbaf713c8b5e94fb13/invoke.js

192.243.61.227

200 OK

12 kB

URL GET HTTP/1.1
hzr0dm28m17c.com/345e1621a507b6fbaf713c8b5e94fb13/invoke.js
IP
192.243.61.227:443
ASN
#39572 DataWeb Global Group B.V.

Requested by
https://wa.privategirlocation.com/
Certificate
IssuerLet's Encrypt
Subjecthzr0dm28m17c.com
Fingerprint9F:89:99:65:B2:6A:E8:8C:A8:61:55:B2:AC:E5:74:D2:72:2E:0F:F4
ValidityWed, 10 Apr 2024 07:04:16 GMT - Tue, 09 Jul 2024 07:04:15 GMT

File type
JavaScript source, ASCII text, with very long lines (31236), with no line terminators
Size
12 kB (11803 bytes)
Hash
b7560fc440c08b7b87acd4fcc0785d25
f90d510400f02a1b183e861ef8e69c158ab1425c
2de41ff52df085752ff23b3c20132104c2e9ef2eb1bea6300b3139bbb66cd148

HTTP Headers

GET /345e1621a507b6fbaf713c8b5e94fb13/invoke.js HTTP/1.1
Host: hzr0dm28m17c.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://wa.privategirlocation.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.21.6
Date: Sat, 27 Apr 2024 04:11:33 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: *
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 4782dd0bba0f30b7af1ec41406440cf9
Strict-Transport-Security: max-age=0; includeSubdomains
Content-Encoding: gzip

wa.privategirlocation.com/npm/bootstrap-icons-1.8.1/font/fonts/bootstrap-icons.woff

172.67.175.190

200 OK

102 kB

URL GET HTTP/3
wa.privategirlocation.com/npm/bootstrap-icons-1.8.1/font/fonts/bootstrap-icons.woff
IP
172.67.175.190:443
ASN
#13335 CLOUDFLARENET

Requested by
https://wa.privategirlocation.com/
Certificate
IssuerLet's Encrypt
Subjectprivategirlocation.com
Fingerprint72:33:1C:94:89:E9:CE:A2:68:80:AA:3B:E2:EB:60:36:05:B4:D8:EB
ValiditySun, 17 Mar 2024 22:25:37 GMT - Sat, 15 Jun 2024 22:25:36 GMT

File type
Web Open Font Format (Version 2), TrueType, length 102536, version 1.0
Size
102 kB (102536 bytes)
Hash
1ed478a6b265d4b4f5c26bb063203588
1ca5e8c7d2fb8e9d60ad1a1feb2a46e98c248a3d
c874e14c63db86c4c5318c77cb557fce7036645edc7d690dcc1d23b389631b13

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	WhatsApp

HTTP Headers

GET /npm/bootstrap-icons-1.8.1/font/fonts/bootstrap-icons.woff HTTP/1.1
Host: wa.privategirlocation.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
DNT: 1
Connection: keep-alive
Referer: https://wa.privategirlocation.com/npm/bootstrap-icons-1.8.1/font/bootstrap-icons.css
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Sat, 27 Apr 2024 04:11:33 GMT
content-type: font/woff
content-length: 102536
cache-control: public, max-age=604800
expires: Sat, 04 May 2024 04:11:33 GMT
last-modified: Thu, 28 Sep 2023 07:09:05 GMT
x-turbo-charged-by: LiteSpeed
cf-cache-status: MISS
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=l3jPCVfI71dGt0SDKJi%2B5xwyl2dJDZ4ZmjZggAeXope7rH3F2HqaDIxLYF6Vk%2Bh14PURu8WNYurO6jNbTWyQLpO%2F5ikzEDkXtTms4II5XSOGfH1QGd27JDnvE6M%2FOLkl6P6nlAc%2FeUP8jUg7"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87abf81a8f2e56a8-OSL
alt-svc: h3=":443"; ma=86400

proftrafficcounter.com/stats

18.194.72.95

200 OK

40 B

URL GET HTTP/2
proftrafficcounter.com/stats
IP
18.194.72.95:443
ASN
#16509 AMAZON-02

Requested by
https://wa.privategirlocation.com/
Certificate
IssuerAmazon
Subjectproftrafficcounter.com
FingerprintE3:9F:79:6F:80:C0:BF:F8:C4:EB:45:F3:E9:0F:A7:41:F6:0C:05:E6
ValidityTue, 21 Nov 2023 00:00:00 GMT - Thu, 19 Dec 2024 23:59:59 GMT

File type
ASCII text, with no line terminators
Size
40 B (40 bytes)
Hash
084752a5c74ca8039b9f1284dbf55272
241e328d2f7f4b08f294623432a3f87b3fa129d4
b24d85939f48962c71ae72b1a343d92bb5ba7e35b95793fb65382b46371d2816

HTTP Headers

GET /stats HTTP/1.1
Host: proftrafficcounter.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://wa.privategirlocation.com
DNT: 1
Connection: keep-alive
Referer: https://wa.privategirlocation.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Sat, 27 Apr 2024 04:11:33 GMT
content-type: text/html; charset=UTF-8
content-length: 40
server: fasthttp
access-control-allow-origin: https://wa.privategirlocation.com
vary: Origin
access-control-allow-credentials: true
set-cookie: uid_id2=33024f84-63f1-439d-af37-f197d01fd4aa:2:1; expires=Tue, 25 Apr 2034 04:11:33 GMT; secure; SameSite=None
X-Firefox-Spdy: h2

hoardjan.com/watch.638215143119.js?key=345e1621a507b6fbaf713c8b5e94fb13&kw=%5B%22whatsapp%22%2C%22group%22%2C%22invite%22%5D&refer=https%3A%2F%2Fwa.privategirlocation.com%2F&tz=0&dev=e&res=14.2071&uuid=33024f84-63f1-439d-af37-f197d01fd4aa%3A2%3A1

192.243.59.13

307 Temporary Redirect

0 B

URL GET HTTP/1.1
hoardjan.com/watch.638215143119.js?key=345e1621a507b6fbaf713c8b5e94fb13&kw=%5B%22whatsapp%22%2C%22group%22%2C%22invite%22%5D&refer=https%3A%2F%2Fwa.privategirlocation.com%2F&tz=0&dev=e&res=14.2071&uuid=33024f84-63f1-439d-af37-f197d01fd4aa%3A2%3A1
IP
192.243.59.13:443
ASN
#39572 DataWeb Global Group B.V.

Requested by
https://wa.privategirlocation.com/
Certificate
IssuerLet's Encrypt
Subjecthoardjan.com
Fingerprint31:96:61:1B:2B:0A:A1:39:64:A1:39:00:A0:92:69:0E:FE:AD:08:39
ValidityTue, 23 Apr 2024 10:48:41 GMT - Mon, 22 Jul 2024 10:48:40 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /watch.638215143119.js?key=345e1621a507b6fbaf713c8b5e94fb13&kw=%5B%22whatsapp%22%2C%22group%22%2C%22invite%22%5D&refer=https%3A%2F%2Fwa.privategirlocation.com%2F&tz=0&dev=e&res=14.2071&uuid=33024f84-63f1-439d-af37-f197d01fd4aa%3A2%3A1 HTTP/1.1
Host: hoardjan.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://wa.privategirlocation.com
DNT: 1
Connection: keep-alive
Referer: https://wa.privategirlocation.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 307 Temporary Redirect
Server: nginx/1.19.5
Date: Sat, 27 Apr 2024 04:11:34 GMT
Content-Type: text/html
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Custom-Referer: https://wa.privategirlocation.com
Access-Control-Allow-Origin: https://wa.privategirlocation.com
Access-Control-Allow-Credentials: true
Location: https://hoardjan.com/watch.638215143119.js?dev=e&key=345e1621a507b6fbaf713c8b5e94fb13&kw=%5B%22whatsapp%22%2C%22group%22%2C%22invite%22%5D&pst=1714191154&refer=https%3A%2F%2Fwa.privategirlocation.com%2F&res=14.2071&rmtc=t&shu=bb46ab6e193c90457bb647e323b8715ad484155207e4e004071acea95023a792a9f5e91d803b0e3dc80204138e8c6d971f9bb759475bcdbe8ad060985cb8dbeba23f2a7db54e38ec876642b48feb3f0b0773fa1320ec7a5644767f66ef036e&tz=0&uuid=33024f84-63f1-439d-af37-f197d01fd4aa%3A2%3A1
Set-Cookie: u_pl=20909317; expires=Sun, 28 Apr 2024 04:11:34 GMT; secure; SameSite=None
ain=eyJhbGciOiJIUzI1NiJ9.eyJwIjp7ImlkIjoyMDkwOTMxNywiayI6IjM0NWUxNjIxYTUwN2I2ZmJhZjcxM2M4YjVlOTRmYjEzIiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjozMDc5NzYzLCJwaWQiOjg5MzkyLCJhbiI6dHJ1ZSwibGFuIjp0cnVlLCJjaWQiOjE2LCJhaWQiOjI3LCJwdCI6NCwicGsiOiJycXVpdjhqbSIsInQiOjF9LCJ1Ijp7InUiOjEsImF1IjoxLCJkIjp7ImlkIjo3OTk1NDE5NiwiaWRzIjoiIiwiaWMiOmZhbHNlLCJuIjoiRGVza3RvcCxFbXVsYXRvciIsInYiOiJVbmtub3duIiwibSI6IlVua25vd24iLCJmIjoxLCJmbiI6IkRlc2t0b3AiLCJvaWQiOjE4MTEwLCJvbiI6IkxpbnV4Iiwib3YiOiJVbmtub3duIiwiYmlkIjoxMTY2NzAsImJuIjoiRmlyZWZveCIsImJ2IjoiOTYuMCIsInd2IjpmYWxzZSwiZSI6dHJ1ZSwiYWIiOmZhbHNlfSwiYyI6eyJpZCI6MTYyLCJjIjoiTk8iLCJuIjoiTm9yd2F5In0sImEiOmZhbHNlLCJjciI6eyJuIjoiQmxpeCBTb2x1dGlvbnMifSwieGYiOiIiLCJpeGYiOmZhbHNlLCJpZ3hmIjpmYWxzZSwidXAiOnRydWUsInIiOiJodHRwczovL3dhLnByaXZhdGVnaXJsb2NhdGlvbi5jb20vIiwiYXIiOltdfX0.D81-y4yDcrcYSDmhLtjgOvd1_e3unk77LJqEj2sGa0k; expires=Sat, 27 Apr 2024 04:12:34 GMT; secure; SameSite=None
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: a75f5b7032a2acafaf47e9520a5f2ea7
Strict-Transport-Security: max-age=0; includeSubdomains

hoardjan.com/watch.638215143119.js?dev=e&key=345e1621a507b6fbaf713c8b5e94fb13&kw=%5B%22whatsapp%22%2C%22group%22%2C%22invite%22%5D&pst=1714191154&refer=https%3A%2F%2Fwa.privategirlocation.com%2F&res=14.2071&rmtc=t&shu=bb46ab6e193c90457bb647e323b8715ad484155207e4e004071acea95023a792a9f5e91d803b0e3dc80204138e8c6d971f9bb759475bcdbe8ad060985cb8dbeba23f2a7db54e38ec876642b48feb3f0b0773fa1320ec7a5644767f66ef036e&tz=0&uuid=33024f84-63f1-439d-af37-f197d01fd4aa%3A2%3A1

192.243.59.13

200 OK

0 B

URL GET HTTP/1.1
hoardjan.com/watch.638215143119.js?dev=e&key=345e1621a507b6fbaf713c8b5e94fb13&kw=%5B%22whatsapp%22%2C%22group%22%2C%22invite%22%5D&pst=1714191154&refer=https%3A%2F%2Fwa.privategirlocation.com%2F&res=14.2071&rmtc=t&shu=bb46ab6e193c90457bb647e323b8715ad484155207e4e004071acea95023a792a9f5e91d803b0e3dc80204138e8c6d971f9bb759475bcdbe8ad060985cb8dbeba23f2a7db54e38ec876642b48feb3f0b0773fa1320ec7a5644767f66ef036e&tz=0&uuid=33024f84-63f1-439d-af37-f197d01fd4aa%3A2%3A1
IP
192.243.59.13:443
ASN
#39572 DataWeb Global Group B.V.

Requested by
https://wa.privategirlocation.com/
Certificate
IssuerLet's Encrypt
Subjecthoardjan.com
Fingerprint31:96:61:1B:2B:0A:A1:39:64:A1:39:00:A0:92:69:0E:FE:AD:08:39
ValidityTue, 23 Apr 2024 10:48:41 GMT - Mon, 22 Jul 2024 10:48:40 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /watch.638215143119.js?dev=e&key=345e1621a507b6fbaf713c8b5e94fb13&kw=%5B%22whatsapp%22%2C%22group%22%2C%22invite%22%5D&pst=1714191154&refer=https%3A%2F%2Fwa.privategirlocation.com%2F&res=14.2071&rmtc=t&shu=bb46ab6e193c90457bb647e323b8715ad484155207e4e004071acea95023a792a9f5e91d803b0e3dc80204138e8c6d971f9bb759475bcdbe8ad060985cb8dbeba23f2a7db54e38ec876642b48feb3f0b0773fa1320ec7a5644767f66ef036e&tz=0&uuid=33024f84-63f1-439d-af37-f197d01fd4aa%3A2%3A1 HTTP/1.1
Host: hoardjan.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://wa.privategirlocation.com
Referer: https://wa.privategirlocation.com/
DNT: 1
Connection: keep-alive
Cookie: u_pl=20909317; ain=eyJhbGciOiJIUzI1NiJ9.eyJwIjp7ImlkIjoyMDkwOTMxNywiayI6IjM0NWUxNjIxYTUwN2I2ZmJhZjcxM2M4YjVlOTRmYjEzIiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjozMDc5NzYzLCJwaWQiOjg5MzkyLCJhbiI6dHJ1ZSwibGFuIjp0cnVlLCJjaWQiOjE2LCJhaWQiOjI3LCJwdCI6NCwicGsiOiJycXVpdjhqbSIsInQiOjF9LCJ1Ijp7InUiOjEsImF1IjoxLCJkIjp7ImlkIjo3OTk1NDE5NiwiaWRzIjoiIiwiaWMiOmZhbHNlLCJuIjoiRGVza3RvcCxFbXVsYXRvciIsInYiOiJVbmtub3duIiwibSI6IlVua25vd24iLCJmIjoxLCJmbiI6IkRlc2t0b3AiLCJvaWQiOjE4MTEwLCJvbiI6IkxpbnV4Iiwib3YiOiJVbmtub3duIiwiYmlkIjoxMTY2NzAsImJuIjoiRmlyZWZveCIsImJ2IjoiOTYuMCIsInd2IjpmYWxzZSwiZSI6dHJ1ZSwiYWIiOmZhbHNlfSwiYyI6eyJpZCI6MTYyLCJjIjoiTk8iLCJuIjoiTm9yd2F5In0sImEiOmZhbHNlLCJjciI6eyJuIjoiQmxpeCBTb2x1dGlvbnMifSwieGYiOiIiLCJpeGYiOmZhbHNlLCJpZ3hmIjpmYWxzZSwidXAiOnRydWUsInIiOiJodHRwczovL3dhLnByaXZhdGVnaXJsb2NhdGlvbi5jb20vIiwiYXIiOltdfX0.D81-y4yDcrcYSDmhLtjgOvd1_e3unk77LJqEj2sGa0k
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.19.5
Date: Sat, 27 Apr 2024 04:11:34 GMT
Content-Type: text/html
Content-Length: 0
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Accept-CH: Device-Stock-UA,Sec-CH-UA,Sec-CH-UA-Full-Version,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-PlatformUser-Agent,User-Agent,X-Device-User-Agent,X-OperaMini-Phone-UA,X-UCBrowser-Device-UA
Custom-Referer: https://wa.privategirlocation.com
Access-Control-Allow-Origin: https://wa.privategirlocation.com
Access-Control-Allow-Credentials: true
Set-Cookie: uid_id2=33024f84-63f1-439d-af37-f197d01fd4aa:2:1; expires=Sat, 04 May 2024 04:11:34 GMT; secure; SameSite=None
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Cache-Control: no-cache
X-Request-ID: 352371159bb997d93d5417a36c414d61
Strict-Transport-Security: max-age=0; includeSubdomains

wa.privategirlocation.com/

172.67.175.190

200 OK

8.4 kB

URL User Request GET HTTP/2
wa.privategirlocation.com/
IP
172.67.175.190:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerLet's Encrypt
Subjectprivategirlocation.com
Fingerprint72:33:1C:94:89:E9:CE:A2:68:80:AA:3B:E2:EB:60:36:05:B4:D8:EB
ValiditySun, 17 Mar 2024 22:25:37 GMT - Sat, 15 Jun 2024 22:25:36 GMT

File type
HTML document, Unicode text, UTF-8 text, with very long lines (8700), with no line terminators
Size
8.4 kB (8373 bytes)
Hash
759b4420d2620bab98389f8d0fbe8d9c
2aa7b13b71d04151e315864f18d24d62238ebd1b
e2222031c162ac32ceacd75921917718b55195108b0e5fdfe6f3a03e45147282

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	WhatsApp

HTTP Headers

GET / HTTP/1.1
Host: wa.privategirlocation.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Sat, 27 Apr 2024 04:11:32 GMT
content-type: text/html
last-modified: Wed, 18 Oct 2023 23:48:39 GMT
vary: Accept-Encoding
x-turbo-charged-by: LiteSpeed
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QCJPsnmcoCfAH05wuXgMK%2FIrS7p2x5ejD5EdKKrXb4KS5R2YY4I0X3MegYWJJRqNheSUE4Urk7lrLmKHi6LQVl6w9LKFmutUhJVFtqTR9l7kQdWXfoUs8g%2F3ldNX9pOA6ebRHb0YFeGHaDw%2F"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87abf8147b62b50b-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

wa.privategirlocation.com/npm/backoffer.js

172.67.175.190

200 OK

618 B

URL GET HTTP/3
wa.privategirlocation.com/npm/backoffer.js
IP
172.67.175.190:443
ASN
#13335 CLOUDFLARENET

Requested by
https://wa.privategirlocation.com/
Certificate
IssuerLet's Encrypt
Subjectprivategirlocation.com
Fingerprint72:33:1C:94:89:E9:CE:A2:68:80:AA:3B:E2:EB:60:36:05:B4:D8:EB
ValiditySun, 17 Mar 2024 22:25:37 GMT - Sat, 15 Jun 2024 22:25:36 GMT

File type
JavaScript source, ASCII text, with very long lines (660), with no line terminators
Size
618 B (618 bytes)
Hash
8cf2a5cfd9470a52383147ef8be6b821
7a95a743c954686e308253cadea2e54affd96855
1a5222e7b8e321da6f06943175db4f43f017d501e2ad29f48d10eb5e95bc0a0a

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	WhatsApp

HTTP Headers

GET /npm/backoffer.js HTTP/1.1
Host: wa.privategirlocation.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://wa.privategirlocation.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Sat, 27 Apr 2024 04:11:32 GMT
content-type: text/javascript
last-modified: Thu, 28 Sep 2023 07:09:05 GMT
vary: Accept-Encoding
x-turbo-charged-by: LiteSpeed
cache-control: max-age=14400
cf-cache-status: REVALIDATED
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SFs2qgiRbWWWtwR5hbmFhIVKGxypeba3ldMzj7MCZ76rzUykf6KT2AsMFb4tX6fGddtVEFhZ%2BhCO80FeGQwpqZFihdS2oxQ2d0x3PDxuWwwwYtKwHM9h5n%2FqU7SrOD1ltE9%2FIkaca%2BN6KOP5"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87abf817fe0956a8-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

wa.privategirlocation.com/npm/bootstrap-5.1.3/dist/css/bootstrap.min.css

172.67.175.190

200 OK

164 kB

URL GET HTTP/3
wa.privategirlocation.com/npm/bootstrap-5.1.3/dist/css/bootstrap.min.css
IP
172.67.175.190:443
ASN
#13335 CLOUDFLARENET

Requested by
https://wa.privategirlocation.com/
Certificate
IssuerLet's Encrypt
Subjectprivategirlocation.com
Fingerprint72:33:1C:94:89:E9:CE:A2:68:80:AA:3B:E2:EB:60:36:05:B4:D8:EB
ValiditySun, 17 Mar 2024 22:25:37 GMT - Sat, 15 Jun 2024 22:25:36 GMT

File type

Size
164 kB (163887 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	WhatsApp

HTTP Headers

GET /npm/bootstrap-5.1.3/dist/css/bootstrap.min.css HTTP/1.1
Host: wa.privategirlocation.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://wa.privategirlocation.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Sat, 27 Apr 2024 04:11:32 GMT
content-type: text/css
cache-control: public, max-age=604800
expires: Tue, 30 Apr 2024 10:04:33 GMT
last-modified: Thu, 28 Sep 2023 07:09:05 GMT
vary: Accept-Encoding
x-turbo-charged-by: LiteSpeed
cf-cache-status: HIT
age: 324419
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bU0mX5OfzJQxgW2hI5Z2uqs3Zhuicz5H221Jx0wdNu1nabdbHdgxi2LgZLAsymEOOy%2FYlACCbmhb6f5F4yzQrePeTeho87%2FHHT3cB2q4PBAxEqbAEt5nqhuB29Y%2FNAIiyMtsj8PVhg7ItOaA"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87abf817fe0856a8-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

hookupgirlsclub.com/

104.21.80.24

301 Moved Permanently

8.4 kB

URL User Request GET HTTP/2
hookupgirlsclub.com/
IP
104.21.80.24:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerGoogle Trust Services LLC
Subjecthookupgirlsclub.com
Fingerprint7C:E0:2D:E8:36:8A:B9:3D:C0:94:03:5B:EA:FC:A1:B5:C0:6F:88:38
ValidityMon, 18 Mar 2024 11:28:56 GMT - Sun, 16 Jun 2024 11:28:55 GMT

File type

Size
8.4 kB (8373 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	WhatsApp

HTTP Headers

GET / HTTP/1.1
Host: hookupgirlsclub.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 301 Moved Permanently
date: Sat, 27 Apr 2024 04:11:31 GMT
content-type: text/html; charset=UTF-8
location: https://wa.privategirlocation.com
x-powered-by: PHP/8.1.28
cache-control: must-revalidate, no-cache, no-store, private
set-cookie: XSRF-TOKEN=eyJpdiI6ImczSnJiVGp0OXJ5WDkyQWtPdEVJUkE9PSIsInZhbHVlIjoiVmRYUHVWTVNveE02Yk10MVV5WEJLRk1mRmFHb0lKMjBYMlBSWU5LaWJkenF3TFMyTVpzNVh5dG9MeU5iY3cwZ3dZMGpQaDJWd3R3ek1ZYnZLRjdHcXVraVg2dGI0KzVLRTNidlFnWnhJYktPaVJhWWFzMkQzbEtpUVRSOWo2WG8iLCJtYWMiOiIyYzA3ZDg4OWRlYzY5MTI1NTA0ODQwYjRhODMzZDVjNzI5NWZiNjkyOWYzZjQxOGRmOTAzMzk3YzhjMGE2ZWRmIiwidGFnIjoiIn0%3D; expires=Sat, 27-Apr-2024 06:11:31 GMT; Max-Age=7200; path=/; secure
phpshort_session=eyJpdiI6Inp4SzNOTWFsUGdWb2J4eXBJdlhNbmc9PSIsInZhbHVlIjoidE1seWt3MUJuaUNvNUNIcXZMVTJrVmlvNlY1WXd6UlBaSXpUQ1d0cDBsbHR2SXNYQVBtT1hxc3pBMm9BMlJIOEhZOWhoVjBuWW9VQmc0Q1pkNXlNTjVDU0QvMU0vK0oyUTAyR3hub3d2VU5nMlArTWNYQVBpR0VtTWdFL0FxK3IiLCJtYWMiOiJkYjNiMDBhNGY2NDIwMGRiMzE5OGY4OWFhZGVhMDljZGM3ZjYyZWJhMWQxYmYzNjViYjBiMGNhYmMwNGVmZmU2IiwidGFnIjoiIn0%3D; expires=Sat, 27-Apr-2024 06:11:31 GMT; Max-Age=7200; path=/; httponly; secure
vary: Accept-Encoding
x-turbo-charged-by: LiteSpeed
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=U4kIWFyjLBJdMbra8tvMRHUopyO4%2FPciaBlXm0WVveNxOqFbO8R35pe1UMMcR5Ex6A0r4mPAunIFT3JOtTRGnrJvAxO3Wc7oNdsgsIxSZ9wz0akghWTosuN8fd4lSAr9ej4VxmTJ"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87abf8115f7256ae-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

wa.privategirlocation.com/npm/bootstrap-icons-1.8.1/font/bootstrap-icons.css

172.67.175.190

200 OK

80 kB

URL GET HTTP/3
wa.privategirlocation.com/npm/bootstrap-icons-1.8.1/font/bootstrap-icons.css
IP
172.67.175.190:443
ASN
#13335 CLOUDFLARENET

Requested by
https://wa.privategirlocation.com/
Certificate
IssuerLet's Encrypt
Subjectprivategirlocation.com
Fingerprint72:33:1C:94:89:E9:CE:A2:68:80:AA:3B:E2:EB:60:36:05:B4:D8:EB
ValiditySun, 17 Mar 2024 22:25:37 GMT - Sat, 15 Jun 2024 22:25:36 GMT

File type
ASCII text
Size
80 kB (80439 bytes)
Hash
f483f87a3c57f292bd5eb4c343003b01
5f2b1fa8de5b4d52ea2b04941aa508529e6994c9
f93ce1072054f40abfa1889d47d29d227a8af86231a073ccf678f7ab8841d6f3

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	WhatsApp

HTTP Headers

GET /npm/bootstrap-icons-1.8.1/font/bootstrap-icons.css HTTP/1.1
Host: wa.privategirlocation.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://wa.privategirlocation.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Sat, 27 Apr 2024 04:11:32 GMT
content-type: text/css
cache-control: public, max-age=604800
expires: Tue, 30 Apr 2024 10:04:33 GMT
last-modified: Thu, 28 Sep 2023 07:09:05 GMT
vary: Accept-Encoding
x-turbo-charged-by: LiteSpeed
cf-cache-status: HIT
age: 324419
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2F6IJiV6wj6pBt6Lt7KqGq%2FHxW9tC9i%2FYqbnYSLTWpJoIKUAIRPnmZ7hT2GZ4Im9YIeOsCaOy%2BF9oSToUH7%2B20gbwdfUcENMtPlUvj4uDeZFB9kiR0NPfHkqa8ECCGoJ4cO23lyttHNQkopN0"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87abf817fe0756a8-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

wa.privategirlocation.com/favicon.ico

172.67.175.190

404 Not Found

1.3 kB

URL GET HTTP/3
wa.privategirlocation.com/favicon.ico
IP
172.67.175.190:443
ASN
#13335 CLOUDFLARENET

Requested by
https://wa.privategirlocation.com/
Certificate
IssuerLet's Encrypt
Subjectprivategirlocation.com
Fingerprint72:33:1C:94:89:E9:CE:A2:68:80:AA:3B:E2:EB:60:36:05:B4:D8:EB
ValiditySun, 17 Mar 2024 22:25:37 GMT - Sat, 15 Jun 2024 22:25:36 GMT

File type
HTML document, ASCII text, with very long lines (1285), with no line terminators
Size
1.3 kB (1251 bytes)
Hash
94f08a3a6562f7f079c4f5a67b7260e2
cc5d03e17c41ee6bb2ebf0d26d4354a486ca1823
44ea069d9a3f7dcea953ac173384578b6185f4b2ece05a6f4513b9fda29c4c29

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	WhatsApp

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: wa.privategirlocation.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://wa.privategirlocation.com/
Cookie: dom3ic8zudi28v8lr6fgphwffqoz0j6c=33024f84-63f1-439d-af37-f197d01fd4aa%3A2%3A1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 404 Not Found
date: Sat, 27 Apr 2024 04:11:34 GMT
content-type: text/html
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
pragma: no-cache
x-turbo-charged-by: LiteSpeed
cf-cache-status: BYPASS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uNPXSBhDz6%2FtbFrn4a%2FU5O4bPGvFMC5fh%2B2qYX4TVh5xfV7J94M6AM%2F6uqsWfy8w8G%2FaqJYpmJS3y4k8bRn5khc6gbqNY5gyL4FOTwzph0s0n8nLmoRflWDsmtjFiD7W7l0e%2BbaGh6Y96t0h"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87abf82129ca56a8-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (7)

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Observations

Hash

Observations

Hash

HTTP Transactions (13)

URL GET HTTP/3

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/3

IP

ASN

Requested by

Certificate

File type

Size

Hash

Detections

HTTP Headers