40PlusShag.com (NSFW)

[iam-py-test]

This is a fake sex/dating website, which is promoted by:

• bots on Twitter/X DMing links to people

Images

• those links redirect to mysuperdatingforyou.life
• which redirects to chat-o-live.com
• which guides users through a sign up process to create an account on 40PlusShag
• during this process, a popup from some subdomain of fundatingquest.fun will open. This popup resembles a chat window and requests the user grant the website access to notifications. The window is otherwise nonfunctional and always has the same image.
• users are emailed a confirmation link & redirected to 40PlusShag
• every few minutes, the user will be sent a fake DM from a supposed user of the site

• These DMs are generic, with the user's username and location added in
• These "users" will claim to be located near the user
• The location of these users changes depending on where the user said they live. Two accounts may receive the same DM from the same user, claiming to live in two different places. All other details for the supposed user remain the same (age, profile picture)
• The profile picture and other images are stolen from porn sites
• Replying to these messages requires providing payment information - the site uses a service named Whitelabel Payments

See the following sandbox analysises for more information
Warning: tria.ge is behind CloudFlare. Proceed with caution

• https://tria.ge/240224-zxewqafc9v/behavioral1
• https://tria.ge/240224-1ygx5sgc8v/behavioral1
• https://tria.ge/240224-2lmtasgh3v/behavioral1

All related domains:

i.fundatingquest.fun
b.fundatingquest.fun
a.fundatingquest.fun
sharlalias.click
mysuperdatingforyou.life
chat-o-live.com
rozaholshouser.cfd
eshaalfawson.shop

I can provide more information if needed.
Thank you

[durablenapkin]

Thank you for all the info, all domains will be added to the next nightly update.