Popup - Hot Dates
Registered via NameSilo on December 30, 2024 - Whois meetflirtpartner.com
The popup redirects users to https://rabbitsmeet.com/, a NameCheap domain operated by Skyloop Digital, Ltd, who claim to operate out of 125 Wood St., London, England, EC2V 7AW
The scammers have been previously reported for operating the fake dating platform “FlingPals”
Associated Email Addresses:
Was analysing this website (was also pretending to be the target demographic for this site) and here’s what I found - I am new to analysing websites, and I won’t include anything that may not be useful:
The advertisements on the dating part of the website link to a similar form, which then eventually linked me to ‘Swingmyfling’, which has the exact same layout as ‘Flirvia’. They also showed the exact same messages and dating history.
(redacted the pornographic adverts with inspect element and have censored anything sexually suggestive)
Eventually the paywall is presented when one of the ‘users’ sends you a nude picture, which you are then redirected to me.jucydate .com, which redirects to hookupparadise .com
In this case, the payment will fail as I am using Stripe’s test card.
Once the victim enters their card details in, the site makes requests to various APIs.
One of which is bp-pay .com (which the card details are sent to):
It then sends a GET request to brilliantpay .io, which returns onProcessApp.css and onProcessApp.js.
I think brilliantpay .io and api.shift4 .com are used to simulate the 3D-Secure part of the payment process.
It seems like some sort of validation of the card details occurs as well, as a request is sent to api.securionpay .com
Then it eventually sends another GET request to brilliantpay .io, presumably stating that the payment has failed:
It also fetches a JSON file called common.json, which includes the following:
WebSocket messages are also sent to
ws.hookupparadise .com/connection/websocket, which helps track the status of payments (e.g. how many times a user has attempted a payment):
When loading onto hookupparadise .com at the beginning, another WebSocket connection was initiated, which transmits information related to notifications, messages, and new likes (and maybe more). The same WebSocket URL is used.
A GET request is sent to
api.hookupparadise .com/init?from=ref&ft=(numbers here), which returns the information about the user and some of the other domains they use:
