bazar.sofiariders.com Open in urlscan Pro
2606:4700:3037::ac43:c9ba Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://bazar.sofiariders.com/wp-admin/css/colors/coffee/MandT
Effective URL:
https://bazar.sofiariders.com/wp-admin/css/colors/coffee/MandT/
Submission: On June 14 via api (June 14th 2023, 2:35:25 pm UTC) from US — Scanned from US

Summary HTTP 9 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 9 HTTP transactions. The main IP is 2606:4700:3037::ac43:c9ba, located in United States and belongs to CLOUDFLARENET, US. The main domain is bazar.sofiariders.com.
TLS certificate: Issued by GTS CA 1P5 on June 9th 2023. Valid for: 3 months.

This is the only time bazar.sofiariders.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: M&T Bank (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1 1	2606:4700:303... 2606:4700:3034::6815:5d02	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 10	2606:4700:303... 2606:4700:3037::ac43:c9ba	13335 (CLOUDFLAR...) (CLOUDFLARENET)
9	1

1 2606:4700:3034::6815:5d02 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

bazar.sofiariders.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2606:4700:3037::ac43:c9ba (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

bazar.sofiariders.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	sofiariders.com 2 redirects bazar.sofiariders.com	43 KB
9	1

	Domain	Requested by
11	bazar.sofiariders.com	2 redirects bazar.sofiariders.com
9	1

This site contains no links.

Subject Issuer	Validity	Valid
sofiariders.com GTS CA 1P5	`2023-06-09` - `2023-09-07`	3 months	crt.sh

This page contains 2 frames:

Primary Page: https://bazar.sofiariders.com/wp-admin/css/colors/coffee/MandT/
Frame ID: EBFD790A7326D1B099BBBF3970C629B5
Requests: 8 HTTP requests in this frame

Frame: https://bazar.sofiariders.com/wp-admin/css/colors/coffee/MandT/pixel_d_KAE.htm
Frame ID: 192AE197757F7FA3C37E885DF2C48060
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Welcome to Online Banking | M&T Bank

Page URL History Show full URLs

http://bazar.sofiariders.com/wp-admin/css/colors/coffee/MandT HTTP 301
https://bazar.sofiariders.com/wp-admin/css/colors/coffee/MandT HTTP 301
https://bazar.sofiariders.com/wp-admin/css/colors/coffee/MandT/ Page URL

Page Statistics

9
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

42 kB
Transfer

269 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://bazar.sofiariders.com/wp-admin/css/colors/coffee/MandT HTTP 301
https://bazar.sofiariders.com/wp-admin/css/colors/coffee/MandT HTTP 301
https://bazar.sofiariders.com/wp-admin/css/colors/coffee/MandT/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response bazar.sofiariders.com/wp-admin/css/colors/coffee/MandT/ Redirect Chain http://bazar.sofiariders.com/wp-admin/css/colors/coffee/MandT https://bazar.sofiariders.com/wp-admin/css/colors/coffee/MandT https://bazar.sofiariders.com/wp-admin/css/colors/coffee/MandT/	5 KB 2 KB	138ms 137ms	Document text/html	2606:4700:3037::ac43:c9ba CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://bazar.sofiariders.com/wp-admin/css/colors/coffee/MandT/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3037::ac43:c9ba , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `37e539d012fcf3b1a1f74acfebd59dfaf651c24d0e85f68f86ee9ef551b4fe12` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36 accept-language en-US,en;q=0.9 Response headers alt-svc h3=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 7d734c8a6efe0102-ORD content-encoding br content-type text/html date Wed, 14 Jun 2023 14:35:17 GMT last-modified Wed, 24 Nov 2021 01:28:42 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MHsMSsCiaH3IVJ7B3CHiRNEOL8OHTeSpFDTZ8mLt4MlQS68%2FuxBkXx6yyvZI1t1MilHHPKL2JKiPe3OWHf0Linwbb2YaKtrAXfRFLXVINgxTEq9juzzzzHcTx%2BmG5DKWg5LqqA9f82SFkUZbEITSCUNRZhs%3D"}],"group":"cf-nel","max_age":604800} server cloudflare Redirect headers alt-svc h3=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 7d734c883c110102-ORD content-type text/html; charset=iso-8859-1 date Wed, 14 Jun 2023 14:35:17 GMT location https://bazar.sofiariders.com/wp-admin/css/colors/coffee/MandT/ nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SVpiZ7NO94r5G0v%2FANXAOEQtwuCNfxKHCNoJkKB8EyC6Hk8CPxwqLxVMqvKDr135sm8EUE6OAG5v808gl0JCHEAnqhxddAUbdhXb53Wqe%2BXUg7n8QgmDrJO0GNdgVQAgLdNI3N6ryjIli8dd%2Ft35hW%2BjZ4I%3D"}],"group":"cf-nel","max_age":604800} server cloudflare
GET H3	200	css.mtb_v_092.css bazar.sofiariders.com/wp-admin/css/colors/coffee/MandT/	252 KB 29 KB	43ms 43ms	Stylesheet text/css	2606:4700:3037::ac43:c9ba CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://bazar.sofiariders.com/wp-admin/css/colors/coffee/MandT/css.mtb_v_092.css Requested by Host: bazar.sofiariders.com URL: https://bazar.sofiariders.com/wp-admin/css/colors/coffee/MandT/ Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3037::ac43:c9ba , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `24e543f31a830ab5db5354d9ff3c8b2a6f6a6d5a447ed22c799aa49908e7fbea` Request headers accept-language en-US,en;q=0.9 Referer https://bazar.sofiariders.com/wp-admin/css/colors/coffee/MandT/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36 Response headers date Wed, 14 Jun 2023 14:35:17 GMT content-encoding br cf-cache-status HIT last-modified Wed, 24 Nov 2021 01:11:54 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare age 6597 vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NkcQATbaEdp%2FIWoXEA%2FDA2ESfbI5Y%2F5TrHcIwkoWh0RGNb6IBrbqS41ZqOKJBv5Vx9XTw2DhL62j6U80RZYqVlqTMVWrNgur1PqURmJZPJ%2FjOHIU6crGkMjthROlRHI2kr%2FjS1%2Fik77Y9gMogfLlttG3edg%3D"}],"group":"cf-nel","max_age":604800} content-type text/css cache-control max-age=691200 cf-ray 7d734c8b4fb7290d-ORD alt-svc h3=":443"; ma=86400
GET H3	200	mtb-logo.svg bazar.sofiariders.com/wp-admin/css/colors/coffee/MandT/	2 KB 2 KB	40ms 40ms	Image image/svg+xml	2606:4700:3037::ac43:c9ba CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://bazar.sofiariders.com/wp-admin/css/colors/coffee/MandT/mtb-logo.svg Requested by Host: bazar.sofiariders.com URL: https://bazar.sofiariders.com/wp-admin/css/colors/coffee/MandT/ Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3037::ac43:c9ba , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `27a81e17fd91c1e2eb41d01828857c2c6f9af64bc885790775ab11a82bbcde6c` Request headers accept-language en-US,en;q=0.9 Referer https://bazar.sofiariders.com/wp-admin/css/colors/coffee/MandT/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36 Response headers date Wed, 14 Jun 2023 14:35:17 GMT content-encoding br cf-cache-status HIT last-modified Wed, 24 Nov 2021 01:11:54 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare age 6596 vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Fz75%2BYIWl8UzmV1E%2BoUTixUJNgTOyaAtlYvv5lXn7LgOWjFYH1XgpmkE9sMhydiam7539cthZJ2v4cS5wJO%2Fx%2FVXBosWbhMRwIFUkq84cyn2P3wUsCx88pTlZW3WBqB%2FsPzy%2BSrFW303YWQOE20AXTiFbhI%3D"}],"group":"cf-nel","max_age":604800} content-type image/svg+xml cache-control max-age=691200 cf-ray 7d734c8b4fb9290d-ORD alt-svc h3=":443"; ma=86400
GET H3	200	cont_btn.jpg bazar.sofiariders.com/wp-admin/css/colors/coffee/MandT/	3 KB 4 KB	565ms 563ms	Image image/jpeg	2606:4700:3037::ac43:c9ba CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://bazar.sofiariders.com/wp-admin/css/colors/coffee/MandT/cont_btn.jpg Requested by Host: bazar.sofiariders.com URL: https://bazar.sofiariders.com/wp-admin/css/colors/coffee/MandT/ Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3037::ac43:c9ba , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `b141864cb5ffe4bdd1ee5854600023c4b778000c107c6fedd0fb337082e54dda` Request headers accept-language en-US,en;q=0.9 Referer https://bazar.sofiariders.com/wp-admin/css/colors/coffee/MandT/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36 Response headers date Wed, 14 Jun 2023 14:35:17 GMT cf-cache-status REVALIDATED last-modified Wed, 24 Nov 2021 01:24:10 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cfGnd8Rtgr2ar%2BsFH%2FE2o7LV4Wc7kCfvZFROKgoueLvuhgprzmMZitFRRgewjvvD56%2BUjA8VNMdJx16GWFxDUn3JD9sWvQu2Go4n4nLuD43K7NoU7r7FXbQjiOwVBXXMBjIRHs9XRo%2FVionLGWmzamFrDII%3D"}],"group":"cf-nel","max_age":604800} content-type image/jpeg cache-control max-age=691200 accept-ranges bytes cf-ray 7d734c8b5fbb290d-ORD alt-svc h3=":443"; ma=86400 content-length 3534
GET H3	200	mtb-equalhousinglender.svg bazar.sofiariders.com/wp-admin/css/colors/coffee/MandT/	232 B 641 B	40ms 39ms	Image image/svg+xml	2606:4700:3037::ac43:c9ba CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://bazar.sofiariders.com/wp-admin/css/colors/coffee/MandT/mtb-equalhousinglender.svg Requested by Host: bazar.sofiariders.com URL: https://bazar.sofiariders.com/wp-admin/css/colors/coffee/MandT/ Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3037::ac43:c9ba , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `eee0da57c92aa55f7fe3cf856bdbf6ef408e3999845c4445fc630231844254ae` Request headers accept-language en-US,en;q=0.9 Referer https://bazar.sofiariders.com/wp-admin/css/colors/coffee/MandT/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36 Response headers date Wed, 14 Jun 2023 14:35:17 GMT content-encoding br cf-cache-status HIT last-modified Wed, 24 Nov 2021 01:11:54 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare age 2879 vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eXswT5eaFZl0OMDGL%2FWsKNRn9Rn7wMjyBUBo0UCs1VPINUm6rAnOnw2r6MW6N5ofozYY9TTpy4mQHOpb1pxMMGIbJULyu81S1aBYN5Vgrh4Ox9ZcMfgDgqzClYZ3Sj5yzoRdTes%2B9DlBglwe6fn%2BpBHlKKY%3D"}],"group":"cf-nel","max_age":604800} content-type image/svg+xml cache-control max-age=691200 cf-ray 7d734c8b5fbd290d-ORD alt-svc h3=":443"; ma=86400
GET H3	200	mtb-entrust.svg bazar.sofiariders.com/wp-admin/css/colors/coffee/MandT/	1 KB 1 KB	72ms 71ms	Image image/svg+xml	2606:4700:3037::ac43:c9ba CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://bazar.sofiariders.com/wp-admin/css/colors/coffee/MandT/mtb-entrust.svg Requested by Host: bazar.sofiariders.com URL: https://bazar.sofiariders.com/wp-admin/css/colors/coffee/MandT/ Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3037::ac43:c9ba , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `ca027bac41d409ace5f89bc6a681dcd50a117ea1ffd595d1d0d50706d12be5df` Request headers accept-language en-US,en;q=0.9 Referer https://bazar.sofiariders.com/wp-admin/css/colors/coffee/MandT/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36 Response headers date Wed, 14 Jun 2023 14:35:17 GMT content-encoding br cf-cache-status HIT last-modified Wed, 24 Nov 2021 01:11:54 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare age 1157 vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GGGvDt4kONK4pznqVMsT9P4WSmfMMjZkTk%2BPu069qihf2MR6Yk5IJndtkR3FUD0Kp%2FSC2ah7B0kpAkgil4K9fVjo%2Bw6cu3LpGZHBcUlGzhRMar%2BxALS89PpRuOsoMIsrqWou1OVZhiyKzOmWk9nkeGSWQ7s%3D"}],"group":"cf-nel","max_age":604800} content-type image/svg+xml cache-control max-age=691200 cf-ray 7d734c8b5fbf290d-ORD alt-svc h3=":443"; ma=86400
GET H3	200	pixel_d_KAE.htm Show response bazar.sofiariders.com/wp-admin/css/colors/coffee/MandT/ Frame 192A	108 B 506 B	358ms 356ms	Document text/html	2606:4700:3037::ac43:c9ba CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://bazar.sofiariders.com/wp-admin/css/colors/coffee/MandT/pixel_d_KAE.htm Requested by Host: bazar.sofiariders.com URL: https://bazar.sofiariders.com/wp-admin/css/colors/coffee/MandT/ Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3037::ac43:c9ba , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `05f4aeb49d4e12bb487ba6ff40ea3371dbae2e39e9150f3761ac237e76869b4f` Request headers Referer https://bazar.sofiariders.com/wp-admin/css/colors/coffee/MandT/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36 accept-language en-US,en;q=0.9 Response headers alt-svc h3=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 7d734c8ca905290d-ORD content-encoding br content-type text/html date Wed, 14 Jun 2023 14:35:18 GMT last-modified Wed, 24 Nov 2021 01:11:54 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KKj%2BW0k0LmUhGA3ERhUPcWB73FhlZR%2Bwt23SirJIJVrsy4bDqPQSMtvgMNUSuF%2F7skK0yB9e4VIi%2BJlYmnu0DBi%2FUwAO4D21Y%2BC%2BtRiZwskzKijRrlHaRRzqYVBJJlSYUwchfZTE11tZhiKHRFExZKARGDo%3D"}],"group":"cf-nel","max_age":604800} server cloudflare
GET H3	200	mandtbaltoweb-book.woff bazar.sofiariders.com/assets/fonts/	3 KB 1 KB	583ms 582ms	Font text/html	2606:4700:3037::ac43:c9ba CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://bazar.sofiariders.com/assets/fonts/mandtbaltoweb-book.woff Requested by Host: bazar.sofiariders.com URL: https://bazar.sofiariders.com/wp-admin/css/colors/coffee/MandT/css.mtb_v_092.css Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3037::ac43:c9ba , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `94af11bdf0cdd4a5bf7ac542e3e48b85fa29d339d0b3b8413e9059f242afe1ee` Request headers Referer https://bazar.sofiariders.com/wp-admin/css/colors/coffee/MandT/css.mtb_v_092.css Origin https://bazar.sofiariders.com accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36 Response headers date Wed, 14 Jun 2023 14:35:18 GMT content-encoding br cf-cache-status EXPIRED last-modified Wed, 14 Jun 2023 06:45:58 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FtFu4hvNqkMQFsc8fK9fYF8FI9Q9yvURvjisADnYIN5VHb1jc%2BK84l5tmKdqIk8%2FTvdy%2Bhh7qwn8FafQtwfwsi%2BlMtWODqjpZ5lDWo3PXD2QchawgZVoha0CjCTxF%2B04OyrLK2%2F2uknFMtq%2FY9qt76e%2B7H4%3D"}],"group":"cf-nel","max_age":604800} content-type text/html; charset=utf-8 cache-control max-age=691200 cf-ray 7d734c8bf861290d-ORD alt-svc h3=":443"; ma=86400
GET H3	200	mandtpg-iconfont.woff bazar.sofiariders.com/assets/fonts/	3 KB 1 KB	572ms 572ms	Font text/html	2606:4700:3037::ac43:c9ba CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://bazar.sofiariders.com/assets/fonts/mandtpg-iconfont.woff Requested by Host: bazar.sofiariders.com URL: https://bazar.sofiariders.com/wp-admin/css/colors/coffee/MandT/css.mtb_v_092.css Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3037::ac43:c9ba , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `94af11bdf0cdd4a5bf7ac542e3e48b85fa29d339d0b3b8413e9059f242afe1ee` Request headers Referer https://bazar.sofiariders.com/wp-admin/css/colors/coffee/MandT/css.mtb_v_092.css Origin https://bazar.sofiariders.com accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36 Response headers date Wed, 14 Jun 2023 14:35:18 GMT content-encoding br cf-cache-status MISS last-modified Wed, 14 Jun 2023 14:35:18 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ttRuYkE4pOdvSEH5IIW%2BahYW%2FYz5pwrJh0iw7edMa3YmQOUJaPrNVrBMM9Ri22SG2TxhnRQzIpjSbn394JEtaNrR5gGphhHSLU3NJ8HHCy1T1V819pEgW7Ot3d8wDImEV9S85IBXIxPCdKVMF9Qb1pVmViY%3D"}],"group":"cf-nel","max_age":604800} content-type text/html; charset=utf-8 cache-control max-age=691200 cf-ray 7d734c8bf863290d-ORD alt-svc h3=":443"; ma=86400

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: M&T Bank (Banking)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 boolean| credentialless object| onbeforetoggle object| onscrollend

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	URL: https://bazar.sofiariders.com/wp-admin/css/colors/coffee/MandT/ Message: Failed to decode downloaded font: https://bazar.sofiariders.com/assets/fonts/mandtpg-iconfont.woff
other	warning	URL: https://bazar.sofiariders.com/wp-admin/css/colors/coffee/MandT/ Message: OTS parsing error: invalid sfntVersion: 1013213558
other	warning	URL: https://bazar.sofiariders.com/wp-admin/css/colors/coffee/MandT/ Message: Failed to decode downloaded font: https://bazar.sofiariders.com/assets/fonts/mandtbaltoweb-book.woff
other	warning	URL: https://bazar.sofiariders.com/wp-admin/css/colors/coffee/MandT/ Message: OTS parsing error: invalid sfntVersion: 1013213558

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bazar.sofiariders.com
2606:4700:3034::6815:5d02
2606:4700:3037::ac43:c9ba
05f4aeb49d4e12bb487ba6ff40ea3371dbae2e39e9150f3761ac237e76869b4f
24e543f31a830ab5db5354d9ff3c8b2a6f6a6d5a447ed22c799aa49908e7fbea
27a81e17fd91c1e2eb41d01828857c2c6f9af64bc885790775ab11a82bbcde6c
37e539d012fcf3b1a1f74acfebd59dfaf651c24d0e85f68f86ee9ef551b4fe12
94af11bdf0cdd4a5bf7ac542e3e48b85fa29d339d0b3b8413e9059f242afe1ee
b141864cb5ffe4bdd1ee5854600023c4b778000c107c6fedd0fb337082e54dda
ca027bac41d409ace5f89bc6a681dcd50a117ea1ffd595d1d0d50706d12be5df
eee0da57c92aa55f7fe3cf856bdbf6ef408e3999845c4445fc630231844254ae

bazar.sofiariders.com Open in urlscan Pro 2606:4700:3037::ac43:c9ba Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

9 Requests

100 %HTTPS

100 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

42 kBTransfer

269 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

0 Cookies

4 Console Messages

Indicators

bazar.sofiariders.com Open in urlscan Pro
2606:4700:3037::ac43:c9ba Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

42 kB
Transfer

269 kB
Size

0
Cookies

9 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!