continue.4ekpng8v6g.buzz Open in urlscan Pro
216.128.129.154 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://t.co/yRitF480lh?signature=newsletter&trackingid=634192768393219
Effective URL:
https://continue.4ekpng8v6g.buzz/?return=&visitorId=65df6c94117d1fa42913bcb1
Submission: On February 28 via manual (February 28th 2024, 5:25:53 pm UTC) from US — Scanned from DE

Summary HTTP 12 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 3 domains to perform 12 HTTP transactions. The main IP is 216.128.129.154, located in Dallas, United States and belongs to AS-CHOOPA, US. The main domain is continue.4ekpng8v6g.buzz.
TLS certificate: Issued by R3 on February 28th 2024. Valid for: 3 months.

This is the only time continue.4ekpng8v6g.buzz was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Amazon Japan (Online) Amazon (Online)

Domain & IP information

	IP Address	AS Autonomous System
1	104.244.42.69 104.244.42.69	13414 (TWITTER) (TWITTER)
1 1	91.211.222.37 91.211.222.37	39566 (SMARTHOST...) (SMARTHOST-PL-AS)
11	216.128.129.154 216.128.129.154	20473 (AS-CHOOPA) (AS-CHOOPA)
12	2

1 104.244.42.69 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 91.211.222.37 (Częstochowa, Poland) 1 redirects

ASN39566 (SMARTHOST-PL-AS, PL)
PTR: static-ac37.rev.smarthost.pl

www.dworakowski.pl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 216.128.129.154 (Dallas, United States)

ASN20473 (AS-CHOOPA, US)
PTR: 216.128.129.154.vultrusercontent.com

continue.4ekpng8v6g.buzz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	4ekpng8v6g.buzz continue.4ekpng8v6g.buzz	544 KB
1	dworakowski.pl 1 redirects www.dworakowski.pl	369 B
1	t.co t.co — Cisco Umbrella Rank: 660	580 B
12	3

	Domain	Requested by
11	continue.4ekpng8v6g.buzz	t.co continue.4ekpng8v6g.buzz
1	www.dworakowski.pl	1 redirects
1	t.co
12	3

This site contains no links.

Subject Issuer	Validity	Valid
t.co DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-01-07` - `2025-01-06`	a year	crt.sh
continue.4ekpng8v6g.buzz R3	`2024-02-28` - `2024-05-28`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://continue.4ekpng8v6g.buzz/?return=&visitorId=65df6c94117d1fa42913bcb1
Frame ID: A9C7E0A230A20BDF3C61B896D6759BEA
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Amazon Sign-in

Page URL History Show full URLs

https://t.co/yRitF480lh?signature=newsletter&trackingid=634192768393219 Page URL
https://www.dworakowski.pl/templates/cassiopeia/lib.php?talk=coca HTTP 302
https://continue.4ekpng8v6g.buzz/?return=&visitorId=65df6c94117d1fa42913bcb1 Page URL

Page Statistics

12
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

2
IPs

2
Countries

545 kB
Transfer

538 kB
Size

3
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://t.co/yRitF480lh?signature=newsletter&trackingid=634192768393219 Page URL
https://www.dworakowski.pl/templates/cassiopeia/lib.php?talk=coca HTTP 302
https://continue.4ekpng8v6g.buzz/?return=&visitorId=65df6c94117d1fa42913bcb1 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 yRitF480lh
t.co/ 352 B
580 B 205ms
150ms Document
text/html 104.244.42.69
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://t.co/yRitF480lh?signature=newsletter&trackingid=634192768393219

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.69 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: private,max-age=300
content-encoding: gzip
content-length: 209
content-type: text/html; charset=utf-8
date: Wed, 28 Feb 2024 17:25:29 GMT
expires: Wed, 28 Feb 2024 17:30:29 GMT
perf: 7469935968
server: tsa_o
strict-transport-security: max-age=0
vary: Origin
x-connection-hash: da2c5f2993ef6916b545bab4f7fe64793abc858edba03cd663d81e88e6284de7
x-response-time: 128
x-transaction-id: 1344d21ee4d27ce0
x-xss-protection: 0

GET
H/1.1

200
OK

Primary Request / Show response
continue.4ekpng8v6g.buzz/
Redirect Chain

https://www.dworakowski.pl/templates/cassiopeia/lib.php?talk=coca
https://continue.4ekpng8v6g.buzz/?return=&visitorId=65df6c94117d1fa42913bcb1

3 KB
4 KB

1436ms
983ms

Document
text/html

216.128.129.154
AS-CHOOPA

General

Check archive.org

Show headers Download Go to

Full URL

https://continue.4ekpng8v6g.buzz/?return=&visitorId=65df6c94117d1fa42913bcb1

Requested by

Host: t.co
URL: https://t.co/yRitF480lh?signature=newsletter&trackingid=634192768393219

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

216.128.129.154 Dallas, United States, ASN20473 (AS-CHOOPA, US),

Reverse DNS

216.128.129.154.vultrusercontent.com

Software

Apache /

Resource Hash

70acaab80b073b9a6b05669891b3aae02a9dc8af830b46b61a1e65946b55255e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://t.co/yRitF480lh?signature=newsletter&trackingid=634192768393219
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
Access-Control-Allow-Methods: POST, OPTIONS, GET
Access-Control-Allow-Origin: *
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Date: Wed, 28 Feb 2024 17:25:46 GMT
Keep-Alive: timeout=5, max=100
Server: Apache
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Transfer-Encoding: chunked
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-XSS-Protection: 1; mode=block

Redirect headers

alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
cache-control: public
content-length: 0
content-type: text/html; charset=UTF-8
date: Wed, 28 Feb 2024 17:25:46 GMT
expires: Wed, 28 Feb 2024 18:25:46 GMT
location: https://continue.4ekpng8v6g.buzz/?return=&visitorId=65df6c94117d1fa42913bcb1
server: Smarthost
x-content-type-options: nosniff
x-frame-options: sameorigin
x-xss-protection: 1; mode=block

GET
H/1.1 200
OK main.5b4ecdfc.chunk.css
continue.4ekpng8v6g.buzz/static/css/ 103 KB
103 KB 180ms
180ms Stylesheet
text/css 216.128.129.154
AS-CHOOPA

General

Check archive.org

Show headers Download Go to

Full URL

https://continue.4ekpng8v6g.buzz/static/css/main.5b4ecdfc.chunk.css

Requested by

Host: continue.4ekpng8v6g.buzz
URL: https://continue.4ekpng8v6g.buzz/?return=&visitorId=65df6c94117d1fa42913bcb1

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

216.128.129.154 Dallas, United States, ASN20473 (AS-CHOOPA, US),

Reverse DNS

216.128.129.154.vultrusercontent.com

Software

Apache /

Resource Hash

e6d9deda828bf920da2ddb858f25ce0513e9187aaa23ac2dffbe015cd5fb5743

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://continue.4ekpng8v6g.buzz/?return=&visitorId=65df6c94117d1fa42913bcb1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

Date: Wed, 28 Feb 2024 17:25:47 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
Last-Modified: Wed, 28 Feb 2024 09:48:48 GMT
Server: Apache
X-Frame-Options: DENY
Access-Control-Allow-Methods: POST, OPTIONS, GET
Content-Type: text/css
Access-Control-Allow-Origin: *
Connection: Keep-Alive
Accept-Ranges: bytes
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
Content-Length: 105323
X-XSS-Protection: 1; mode=block
Keep-Alive: timeout=5, max=99

GET
H/1.1 200
OK 3.4ee97899.chunk.js Show response
continue.4ekpng8v6g.buzz/static/js/ 247 KB
248 KB 451ms
150ms Script
text/javascript 216.128.129.154
AS-CHOOPA

General

Check archive.org

Show headers Download Go to

Full URL

https://continue.4ekpng8v6g.buzz/static/js/3.4ee97899.chunk.js

Requested by

Host: continue.4ekpng8v6g.buzz
URL: https://continue.4ekpng8v6g.buzz/?return=&visitorId=65df6c94117d1fa42913bcb1

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

216.128.129.154 Dallas, United States, ASN20473 (AS-CHOOPA, US),

Reverse DNS

216.128.129.154.vultrusercontent.com

Software

Apache /

Resource Hash

d1e0c70e95d1bf5c1388030fab62d9313efd04eba5705ebbc3c2ebfdde2f5977

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://continue.4ekpng8v6g.buzz/?return=&visitorId=65df6c94117d1fa42913bcb1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

Date: Wed, 28 Feb 2024 17:25:48 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
Last-Modified: Wed, 28 Feb 2024 09:48:48 GMT
Server: Apache
X-Frame-Options: DENY
Access-Control-Allow-Methods: POST, OPTIONS, GET
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Connection: Keep-Alive
Accept-Ranges: bytes
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
Content-Length: 253097
X-XSS-Protection: 1; mode=block
Keep-Alive: timeout=5, max=100

GET
H/1.1 200
OK main.1082ca0f.chunk.js Show response
continue.4ekpng8v6g.buzz/static/js/ 55 KB
56 KB 698ms
158ms Script
text/javascript 216.128.129.154
AS-CHOOPA

General

Check archive.org

Show headers Download Go to

Full URL

https://continue.4ekpng8v6g.buzz/static/js/main.1082ca0f.chunk.js

Requested by

Host: continue.4ekpng8v6g.buzz
URL: https://continue.4ekpng8v6g.buzz/?return=&visitorId=65df6c94117d1fa42913bcb1

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

216.128.129.154 Dallas, United States, ASN20473 (AS-CHOOPA, US),

Reverse DNS

216.128.129.154.vultrusercontent.com

Software

Apache /

Resource Hash

4dbfaca3c561884c654f7edd2187e94892d6722ec73ee0f7d2ebdd6e9766cbb1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://continue.4ekpng8v6g.buzz/?return=&visitorId=65df6c94117d1fa42913bcb1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

Date: Wed, 28 Feb 2024 17:25:48 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
Last-Modified: Wed, 28 Feb 2024 09:48:48 GMT
Server: Apache
X-Frame-Options: DENY
Access-Control-Allow-Methods: POST, OPTIONS, GET
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Connection: Keep-Alive
Accept-Ranges: bytes
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
Content-Length: 56402
X-XSS-Protection: 1; mode=block
Keep-Alive: timeout=5, max=98

POST
H/1.1 200
OK supply Show response
continue.4ekpng8v6g.buzz/api/ 2 KB
2 KB 159ms
158ms XHR
text/html 216.128.129.154
AS-CHOOPA

General

Check archive.org

Show headers Download Go to

Full URL

https://continue.4ekpng8v6g.buzz/api/supply

Requested by

Host: continue.4ekpng8v6g.buzz
URL: https://continue.4ekpng8v6g.buzz/static/js/3.4ee97899.chunk.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

216.128.129.154 Dallas, United States, ASN20473 (AS-CHOOPA, US),

Reverse DNS

216.128.129.154.vultrusercontent.com

Software

Apache /

Resource Hash

f2671187f32fc632d82c708927c54a22f8d4c7cbe6d26e18281f04a44ac1fc58

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/plain, */*
Referer: https://continue.4ekpng8v6g.buzz/?return=&visitorId=65df6c94117d1fa42913bcb1
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

Date: Wed, 28 Feb 2024 17:25:48 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
Server: Apache
X-Frame-Options: DENY
Access-Control-Allow-Methods: POST, OPTIONS, GET
Content-Type: text/html; charset=UTF-8
Access-Control-Allow-Origin: *
Transfer-Encoding: chunked
Connection: Keep-Alive
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
Keep-Alive: timeout=5, max=99
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK pDxWAF1pBB0dzGB.2c1d70d6.woff2
continue.4ekpng8v6g.buzz/static/media/ 16 KB
17 KB 157ms
157ms Font
font/woff2 216.128.129.154
AS-CHOOPA

General

Check archive.org

Show headers Download Go to

Full URL

https://continue.4ekpng8v6g.buzz/static/media/pDxWAF1pBB0dzGB.2c1d70d6.woff2

Requested by

Host: continue.4ekpng8v6g.buzz
URL: https://continue.4ekpng8v6g.buzz/static/css/main.5b4ecdfc.chunk.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

216.128.129.154 Dallas, United States, ASN20473 (AS-CHOOPA, US),

Reverse DNS

216.128.129.154.vultrusercontent.com

Software

Apache /

Resource Hash

cded49f94fc16dc0a14923975e159fbf4b14844593e612c1342c9e34e2f96821

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://continue.4ekpng8v6g.buzz/static/css/main.5b4ecdfc.chunk.css
Origin: https://continue.4ekpng8v6g.buzz
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

Date: Wed, 28 Feb 2024 17:25:49 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
Last-Modified: Wed, 28 Feb 2024 09:48:48 GMT
Server: Apache
X-Frame-Options: DENY
Access-Control-Allow-Methods: POST, OPTIONS, GET
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Connection: Keep-Alive
Accept-Ranges: bytes
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
Content-Length: 16616
X-XSS-Protection: 1; mode=block
Keep-Alive: timeout=5, max=97

POST
H/1.1 200
OK ping Show response
continue.4ekpng8v6g.buzz/api/ 2 B
545 B 547ms
514ms XHR
text/html 216.128.129.154
AS-CHOOPA

General

Check archive.org

Show headers Download Go to

Full URL

https://continue.4ekpng8v6g.buzz/api/ping

Requested by

Host: continue.4ekpng8v6g.buzz
URL: https://continue.4ekpng8v6g.buzz/static/js/3.4ee97899.chunk.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

216.128.129.154 Dallas, United States, ASN20473 (AS-CHOOPA, US),

Reverse DNS

216.128.129.154.vultrusercontent.com

Software

Apache /

Resource Hash

565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/plain, */*
Referer: https://continue.4ekpng8v6g.buzz/ap/signin?session=2xzqcv0ky6zu9mxs8j3grr021o9mculg039dop566f1c9dbtede3y0l5h4ailmuc
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-Type: application/json

Response headers

Date: Wed, 28 Feb 2024 17:25:49 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
Server: Apache
X-Frame-Options: DENY
Access-Control-Allow-Methods: POST, OPTIONS, GET
Content-Type: text/html; charset=UTF-8
Access-Control-Allow-Origin: *
Transfer-Encoding: chunked
Connection: Keep-Alive
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
Keep-Alive: timeout=5, max=100
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK 0.c8f46ac8.chunk.js Show response
continue.4ekpng8v6g.buzz/static/js/ 22 KB
23 KB 264ms
152ms Script
text/javascript 216.128.129.154
AS-CHOOPA

General

Check archive.org

Show headers Download Go to

Full URL

https://continue.4ekpng8v6g.buzz/static/js/0.c8f46ac8.chunk.js

Requested by

Host: continue.4ekpng8v6g.buzz
URL: https://continue.4ekpng8v6g.buzz/?return=&visitorId=65df6c94117d1fa42913bcb1

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

216.128.129.154 Dallas, United States, ASN20473 (AS-CHOOPA, US),

Reverse DNS

216.128.129.154.vultrusercontent.com

Software

Apache /

Resource Hash

837de1f1b3dbccc49592de124651591d61b78c28e8bb7265140e2b51a9b2bb3a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://continue.4ekpng8v6g.buzz/ap/signin?session=2xzqcv0ky6zu9mxs8j3grr021o9mculg039dop566f1c9dbtede3y0l5h4ailmuc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

Date: Wed, 28 Feb 2024 17:25:49 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
Last-Modified: Wed, 28 Feb 2024 09:48:48 GMT
Server: Apache
X-Frame-Options: DENY
Access-Control-Allow-Methods: POST, OPTIONS, GET
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Connection: Keep-Alive
Accept-Ranges: bytes
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
Content-Length: 22750
X-XSS-Protection: 1; mode=block
Keep-Alive: timeout=5, max=98

GET
H/1.1 200
OK 13.d414ac36.chunk.js Show response
continue.4ekpng8v6g.buzz/static/js/ 13 KB
14 KB 293ms
157ms Script
text/javascript 216.128.129.154
AS-CHOOPA

General

Check archive.org

Show headers Download Go to

Full URL

https://continue.4ekpng8v6g.buzz/static/js/13.d414ac36.chunk.js

Requested by

Host: continue.4ekpng8v6g.buzz
URL: https://continue.4ekpng8v6g.buzz/?return=&visitorId=65df6c94117d1fa42913bcb1

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

216.128.129.154 Dallas, United States, ASN20473 (AS-CHOOPA, US),

Reverse DNS

216.128.129.154.vultrusercontent.com

Software

Apache /

Resource Hash

aa6a4157284eaa1f143324ed61117a871c8e523d7b3e945116f2c8f26dfdcb02

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://continue.4ekpng8v6g.buzz/ap/signin?session=2xzqcv0ky6zu9mxs8j3grr021o9mculg039dop566f1c9dbtede3y0l5h4ailmuc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

Date: Wed, 28 Feb 2024 17:25:49 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
Last-Modified: Wed, 28 Feb 2024 09:48:48 GMT
Server: Apache
X-Frame-Options: DENY
Access-Control-Allow-Methods: POST, OPTIONS, GET
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Connection: Keep-Alive
Accept-Ranges: bytes
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
Content-Length: 13782
X-XSS-Protection: 1; mode=block
Keep-Alive: timeout=5, max=96

GET
H/1.1 200
OK main.d33128ec.png
continue.4ekpng8v6g.buzz/static/media/ 60 KB
61 KB 159ms
159ms Image
image/png 216.128.129.154
AS-CHOOPA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://continue.4ekpng8v6g.buzz/static/media/main.d33128ec.png

Requested by

Host: continue.4ekpng8v6g.buzz
URL: https://continue.4ekpng8v6g.buzz/static/css/main.5b4ecdfc.chunk.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

216.128.129.154 Dallas, United States, ASN20473 (AS-CHOOPA, US),

Reverse DNS

216.128.129.154.vultrusercontent.com

Software

Apache /

Resource Hash

c5e829691be4103e8f645ee962bbc3de1ca51d083d147f1716fbf5d59f99c86a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://continue.4ekpng8v6g.buzz/static/css/main.5b4ecdfc.chunk.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

Date: Wed, 28 Feb 2024 17:25:49 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
Last-Modified: Wed, 28 Feb 2024 09:48:48 GMT
Server: Apache
X-Frame-Options: DENY
Access-Control-Allow-Methods: POST, OPTIONS, GET
Content-Type: image/png
Access-Control-Allow-Origin: *
Connection: Keep-Alive
Accept-Ranges: bytes
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
Content-Length: 61917
X-XSS-Protection: 1; mode=block
Keep-Alive: timeout=5, max=95

GET
H/1.1 200
OK KFPk-9IF4FqAqY-.4de52a40.woff2
continue.4ekpng8v6g.buzz/static/media/ 16 KB
17 KB 155ms
155ms Font
font/woff2 216.128.129.154
AS-CHOOPA

General

Check archive.org

Show headers Download Go to

Full URL

https://continue.4ekpng8v6g.buzz/static/media/KFPk-9IF4FqAqY-.4de52a40.woff2

Requested by

Host: continue.4ekpng8v6g.buzz
URL: https://continue.4ekpng8v6g.buzz/static/css/main.5b4ecdfc.chunk.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

216.128.129.154 Dallas, United States, ASN20473 (AS-CHOOPA, US),

Reverse DNS

216.128.129.154.vultrusercontent.com

Software

Apache /

Resource Hash

4065b43ba3db8da5390ba0708555889f78e86483fe0226ef79ea22d07c306b89

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://continue.4ekpng8v6g.buzz/static/css/main.5b4ecdfc.chunk.css
Origin: https://continue.4ekpng8v6g.buzz
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

Date: Wed, 28 Feb 2024 17:25:49 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
Last-Modified: Wed, 28 Feb 2024 09:48:48 GMT
Server: Apache
X-Frame-Options: DENY
Access-Control-Allow-Methods: POST, OPTIONS, GET
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Connection: Keep-Alive
Accept-Ranges: bytes
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
Content-Length: 16460
X-XSS-Protection: 1; mode=block
Keep-Alive: timeout=5, max=97

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Amazon Japan (Online) Amazon (Online)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| webpackJsonpa

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.t.co/	1970-01-21 04:15:55	Name: muc Value: ce891253-8e98-4889-bf5d-9c89429cbc9d
continue.4ekpng8v6g.buzz/	1970-01-20 18:45:44	Name: session Value: RP5kFpDcGKcq7RbbwZX0YkGGb6BKp60p
continue.4ekpng8v6g.buzz/	1970-01-20 18:45:44	Name: language Value: de

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
rendering	warning	URL: https://continue.4ekpng8v6g.buzz/static/js/main.1082ca0f.chunk.js Message: Canvas2D: Multiple readback operations using getImageData are faster with the willReadFrequently attribute set to true. See: https://html.spec.whatwg.org/multipage/canvas.html#concept-canvas-will-read-frequently

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=0
X-Xss-Protection	0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

continue.4ekpng8v6g.buzz
t.co
www.dworakowski.pl
104.244.42.69
216.128.129.154
91.211.222.37
4065b43ba3db8da5390ba0708555889f78e86483fe0226ef79ea22d07c306b89
4dbfaca3c561884c654f7edd2187e94892d6722ec73ee0f7d2ebdd6e9766cbb1
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
70acaab80b073b9a6b05669891b3aae02a9dc8af830b46b61a1e65946b55255e
837de1f1b3dbccc49592de124651591d61b78c28e8bb7265140e2b51a9b2bb3a
aa6a4157284eaa1f143324ed61117a871c8e523d7b3e945116f2c8f26dfdcb02
c5e829691be4103e8f645ee962bbc3de1ca51d083d147f1716fbf5d59f99c86a
cded49f94fc16dc0a14923975e159fbf4b14844593e612c1342c9e34e2f96821
d1e0c70e95d1bf5c1388030fab62d9313efd04eba5705ebbc3c2ebfdde2f5977
e6d9deda828bf920da2ddb858f25ce0513e9187aaa23ac2dffbe015cd5fb5743
f2671187f32fc632d82c708927c54a22f8d4c7cbe6d26e18281f04a44ac1fc58

continue.4ekpng8v6g.buzz Open in urlscan Pro 216.128.129.154 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

12 Requests

100 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

2 IPs

2 Countries

545 kBTransfer

538 kBSize

3 Cookies

0 Outgoing links

Page URL History

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

3 Cookies

1 Console Messages

Security Headers

Indicators

continue.4ekpng8v6g.buzz Open in urlscan Pro
216.128.129.154 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

2
IPs

2
Countries

545 kB
Transfer

538 kB
Size

3
Cookies

12 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!