This is a fake sex/dating website, which is promoted by:
bots on Twitter/X DMing links to people
Images
those links redirect to mysuperdatingforyou.life
which redirects to chat-o-live.com
which guides users through a sign up process to create an account on 40PlusShag
during this process, a popup from some subdomain of fundatingquest.fun will open. This popup resembles a chat window and requests the user grant the website access to notifications. The window is otherwise nonfunctional and always has the same image.
users are emailed a confirmation link & redirected to 40PlusShag
every few minutes, the user will be sent a fake DM from a supposed user of the site
These DMs are generic, with the user's username and location added in
These "users" will claim to be located near the user
The location of these users changes depending on where the user said they live. Two accounts may receive the same DM from the same user, claiming to live in two different places. All other details for the supposed user remain the same (age, profile picture)
The profile picture and other images are stolen from porn sites
Replying to these messages requires providing payment information - the site uses a service named Whitelabel Payments
See the following sandbox analysises for more information
Warning: tria.ge is behind CloudFlare. Proceed with caution
This is a fake sex/dating website, which is promoted by:
bots on Twitter/X DMing links to people
Images
those links redirect to
mysuperdatingforyou.life
which redirects to
chat-o-live.com
which guides users through a sign up process to create an account on 40PlusShag
during this process, a popup from some subdomain of
fundatingquest.fun
will open. This popup resembles a chat window and requests the user grant the website access to notifications. The window is otherwise nonfunctional and always has the same image.users are emailed a confirmation link & redirected to 40PlusShag
every few minutes, the user will be sent a fake DM from a supposed user of the site
These DMs are generic, with the user's username and location added in
These "users" will claim to be located near the user
The location of these users changes depending on where the user said they live. Two accounts may receive the same DM from the same user, claiming to live in two different places. All other details for the supposed user remain the same (age, profile picture)
The profile picture and other images are stolen from porn sites
Replying to these messages requires providing payment information - the site uses a service named Whitelabel Payments
See the following sandbox analysises for more information Warning: tria.ge is behind CloudFlare. Proceed with caution
All related domains:
I can provide more information if needed. Thank you