olx.pl-otrymac.info Open in urlscan Pro
45.147.197.70 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://olx.pl-otrymac.info/order/?id=641797595
Submission: On November 19 via api (November 19th 2020, 10:14:21 pm UTC) from PL

Summary HTTP 18 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 3 countries across 4 domains to perform 18 HTTP transactions. The main IP is 45.147.197.70, located in and belongs to ON-LINE-DATA Server location - Netherlands, Dronten, NL. The main domain is olx.pl-otrymac.info.
TLS certificate: Issued by Let's Encrypt Authority X3 on November 18th 2020. Valid for: 3 months.

This is the only time olx.pl-otrymac.info was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Visa (Financial)

Domain & IP information

	IP Address	AS Autonomous System
8	45.147.197.70 45.147.197.70	204601 (ON-LINE-D...) (ON-LINE-DATA Server location - Netherlands)
1	2a00:1450:400... 2a00:1450:4001:814::200a	15169 (GOOGLE) (GOOGLE)
3	23.111.9.35 23.111.9.35	33438 (HIGHWINDS2) (HIGHWINDS2)
6	2a00:1450:400... 2a00:1450:4001:814::2003	15169 (GOOGLE) (GOOGLE)
18	4

8 45.147.197.70 (None, )

ASN204601 (ON-LINE-DATA Server location - Netherlands, Dronten, NL)
PTR: s21.server-panel.net

olx.pl-otrymac.info	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:814::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 23.111.9.35 (Phoenix, United States)

ASN33438 (HIGHWINDS2, US)

use.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:814::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	pl-otrymac.info olx.pl-otrymac.info	69 KB
6	gstatic.com fonts.gstatic.com	56 KB
3	fontawesome.com use.fontawesome.com	100 KB
1	googleapis.com fonts.googleapis.com	772 B
18	4

	Domain	Requested by
8	olx.pl-otrymac.info	olx.pl-otrymac.info
6	fonts.gstatic.com	fonts.googleapis.com
3	use.fontawesome.com	olx.pl-otrymac.info use.fontawesome.com
1	fonts.googleapis.com	olx.pl-otrymac.info
18	4

This site contains no links.

Subject Issuer	Validity	Valid
olx.pl-otrymac.info Let's Encrypt Authority X3	`2020-11-18` - `2021-02-16`	3 months	crt.sh
upload.video.google.com GTS CA 1O1	`2020-11-03` - `2021-01-26`	3 months	crt.sh
*.fontawesome.com DigiCert TLS RSA SHA256 2020 CA1	`2020-11-13` - `2021-12-14`	a year	crt.sh
*.gstatic.com GTS CA 1O1	`2020-10-28` - `2021-01-20`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://olx.pl-otrymac.info/order/?id=641797595
Frame ID: AC319784CAF0CB7BF69E0AAE24DAE892
Requests: 18 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i
script /(?:\/([\d.]+))?(?:\/js)?\/bootstrap(?:\.min)?\.js/i

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href="https:\/\/use\.fontawesome\.com\/releases\/v([^>]+)\/css\//i

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

18
Requests

100 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

226 kB
Transfer

480 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

18 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
olx.pl-otrymac.info/order/ 4 KB
2 KB 812ms
692ms Document
text/html 45.147.197.70
Netherlands

General

Check archive.org

Show headers Download Go to

Full URL: https://olx.pl-otrymac.info/order/?id=641797595
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 45.147.197.70 -, , ASN204601 (ON-LINE-DATA Server location - Netherlands, Dronten, NL),
Reverse DNS: s21.server-panel.net
Software: ddos-guard / PHP/5.6.40
Resource Hash: 741ff35382698799509706df5993745b95700a0c4ff24e4ada87aa572ff947d2

Request headers

:method: GET
:authority: olx.pl-otrymac.info
:scheme: https
:path: /order/?id=641797595
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

server: ddos-guard
set-cookie: __ddg1=H1H3SM3fxPQXWFNQzHSd; Domain=.pl-otrymac.info; HttpOnly; Path=/; Expires=Fri, 19-Nov-2021 22:14:04 GMT
date: Thu, 19 Nov 2020 22:14:05 GMT
content-type: text/html; charset=UTF-8
x-powered-by: PHP/5.6.40
content-encoding: br
vary: Accept-Encoding

GET
H2 200 css
fonts.googleapis.com/ 6 KB
772 B 16ms
15ms Stylesheet
text/css 2a00:1450:4001:814::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:400,500,700&subset=cyrillic

Requested by

Host: olx.pl-otrymac.info
URL: https://olx.pl-otrymac.info/order/?id=641797595

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

8d94ed7d8a6c7ebc74ee7f0c9484e3ea0d2574a2c45eaa151e2e2bc67b9c9b25

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://olx.pl-otrymac.info/order/?id=641797595
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 19 Nov 2020 22:14:05 GMT
server: ESF
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
date: Thu, 19 Nov 2020 22:14:05 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
expires: Thu, 19 Nov 2020 22:14:05 GMT

GET
H2 200 all.css
use.fontawesome.com/releases/v5.8.1/css/ 54 KB
14 KB 155ms
48ms Stylesheet
text/css 23.111.9.35
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/releases/v5.8.1/css/all.css
Requested by: Host: olx.pl-otrymac.info
URL: https://olx.pl-otrymac.info/order/?id=641797595
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.111.9.35 Phoenix, United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: eeb17a45a48aca1d7adbcf04de155dcd0b47cb36ad036310446bb471fea9aaa3

Request headers

Referer: https://olx.pl-otrymac.info/order/?id=641797595
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 19 Nov 2020 22:14:05 GMT
content-encoding: gzip
last-modified: Thu, 21 Mar 2019 21:31:35 GMT
server: NetDNA-cache/2.2
etag: W/"e4c542a7f6bf6f74fdd8cdf6e8096396"
vary: Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
access-control-allow-methods: GET
content-type: text/css
access-control-allow-origin: *
access-control-max-age: 3000
cache-control: max-age=31556926
x-cache: HIT

GET
H2 200 bootstrap.css
olx.pl-otrymac.info/order/css/ 142 KB
22 KB 129ms
128ms Stylesheet
text/css 45.147.197.70
Netherlands

General

Check archive.org

Show headers Download Go to

Full URL: https://olx.pl-otrymac.info/order/css/bootstrap.css
Requested by: Host: olx.pl-otrymac.info
URL: https://olx.pl-otrymac.info/order/?id=641797595
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 45.147.197.70 -, , ASN204601 (ON-LINE-DATA Server location - Netherlands, Dronten, NL),
Reverse DNS: s21.server-panel.net
Software: ddos-guard /
Resource Hash: 86c78a4682afb82a85699cf93eecf7dd79da0be2c0ebdc1356b51b5473481109

Request headers

Referer: https://olx.pl-otrymac.info/order/?id=641797595
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 19 Nov 2020 22:14:05 GMT
content-encoding: br
last-modified: Wed, 18 Nov 2020 14:54:07 GMT
server: ddos-guard
etag: W/"5fb5358f-2372e"
vary: Accept-Encoding
content-type: text/css
accept-ranges: bytes

GET
H2 200 common.css
olx.pl-otrymac.info/order/css/ 5 KB
1 KB 246ms
245ms Stylesheet
text/css 45.147.197.70
Netherlands

General

Check archive.org

Show headers Download Go to

Full URL: https://olx.pl-otrymac.info/order/css/common.css
Requested by: Host: olx.pl-otrymac.info
URL: https://olx.pl-otrymac.info/order/?id=641797595
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 45.147.197.70 -, , ASN204601 (ON-LINE-DATA Server location - Netherlands, Dronten, NL),
Reverse DNS: s21.server-panel.net
Software: ddos-guard /
Resource Hash: 73093cfee16f96b540773a1c776671704c1f6a2b9e867cce6adaa31e4e115bac

Request headers

Referer: https://olx.pl-otrymac.info/order/?id=641797595
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 19 Nov 2020 22:14:05 GMT
content-encoding: br
last-modified: Wed, 18 Nov 2020 14:54:07 GMT
server: ddos-guard
etag: W/"5fb5358f-1278"
vary: Accept-Encoding
content-type: text/css
accept-ranges: bytes

GET
H2 200 jquery.js Show response
olx.pl-otrymac.info/order/js/ 86 KB
31 KB 290ms
289ms Script
application/javascript 45.147.197.70
Netherlands

General

Check archive.org

Show headers Download Go to

Full URL: https://olx.pl-otrymac.info/order/js/jquery.js
Requested by: Host: olx.pl-otrymac.info
URL: https://olx.pl-otrymac.info/order/?id=641797595
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 45.147.197.70 -, , ASN204601 (ON-LINE-DATA Server location - Netherlands, Dronten, NL),
Reverse DNS: s21.server-panel.net
Software: ddos-guard /
Resource Hash: 0497a8d2a9bde7db8c0466fae73e347a3258192811ed1108e3e096d5f34ac0e8

Request headers

Referer: https://olx.pl-otrymac.info/order/?id=641797595
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 19 Nov 2020 22:14:05 GMT
content-encoding: br
last-modified: Wed, 18 Nov 2020 14:54:07 GMT
server: ddos-guard
etag: W/"5fb5358f-15857"
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes

GET
H2 200 bootstrap.js Show response
olx.pl-otrymac.info/order/js/ 36 KB
10 KB 284ms
283ms Script
application/javascript 45.147.197.70
Netherlands

General

Check archive.org

Show headers Download Go to

Full URL: https://olx.pl-otrymac.info/order/js/bootstrap.js
Requested by: Host: olx.pl-otrymac.info
URL: https://olx.pl-otrymac.info/order/?id=641797595
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 45.147.197.70 -, , ASN204601 (ON-LINE-DATA Server location - Netherlands, Dronten, NL),
Reverse DNS: s21.server-panel.net
Software: ddos-guard /
Resource Hash: 53964478a7c634e8dad34ecc303dd8048d00dce4993906de1bacf67f663486ef

Request headers

Referer: https://olx.pl-otrymac.info/order/?id=641797595
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 19 Nov 2020 22:14:05 GMT
content-encoding: br
last-modified: Wed, 18 Nov 2020 14:54:07 GMT
server: ddos-guard
etag: W/"5fb5358f-90b5"
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes

GET
H2 200 common.js Show response
olx.pl-otrymac.info/order/js/ 3 KB
962 B 237ms
237ms Script
application/javascript 45.147.197.70
Netherlands

General

Check archive.org

Show headers Download Go to

Full URL: https://olx.pl-otrymac.info/order/js/common.js
Requested by: Host: olx.pl-otrymac.info
URL: https://olx.pl-otrymac.info/order/?id=641797595
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 45.147.197.70 -, , ASN204601 (ON-LINE-DATA Server location - Netherlands, Dronten, NL),
Reverse DNS: s21.server-panel.net
Software: ddos-guard /
Resource Hash: 8f2a1cc30f864f47e53a7f03aa711893d678dfc60f1f4aee0090a9df9df53d6e

Request headers

Referer: https://olx.pl-otrymac.info/order/?id=641797595
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 19 Nov 2020 22:14:05 GMT
content-encoding: br
last-modified: Wed, 18 Nov 2020 14:54:07 GMT
server: ddos-guard
etag: W/"5fb5358f-aff"
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes

GET
H2 200 logo-card.svg
olx.pl-otrymac.info/order/img/ 2 KB
1008 B 93ms
93ms Image
image/svg+xml 45.147.197.70
Netherlands

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://olx.pl-otrymac.info/order/img/logo-card.svg
Requested by: Host: olx.pl-otrymac.info
URL: https://olx.pl-otrymac.info/order/?id=641797595
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 45.147.197.70 -, , ASN204601 (ON-LINE-DATA Server location - Netherlands, Dronten, NL),
Reverse DNS: s21.server-panel.net
Software: ddos-guard /
Resource Hash: d979cc02922db332ce81875fa360d731dec46c99d4adb315f417cd13eaabf5ba

Request headers

Referer: https://olx.pl-otrymac.info/order/?id=641797595
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 19 Nov 2020 22:14:05 GMT
content-encoding: br
last-modified: Wed, 18 Nov 2020 14:54:07 GMT
server: ddos-guard
etag: W/"5fb5358f-74b"
vary: Accept-Encoding
content-type: image/svg+xml
accept-ranges: bytes

GET
H2 200 logo-other.svg
olx.pl-otrymac.info/order/img/ 775 B
452 B 92ms
92ms Image
image/svg+xml 45.147.197.70
Netherlands

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://olx.pl-otrymac.info/order/img/logo-other.svg
Requested by: Host: olx.pl-otrymac.info
URL: https://olx.pl-otrymac.info/order/?id=641797595
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 45.147.197.70 -, , ASN204601 (ON-LINE-DATA Server location - Netherlands, Dronten, NL),
Reverse DNS: s21.server-panel.net
Software: ddos-guard /
Resource Hash: a9954ffa9526509890a72a7e5e9747ff1aca3c85338eba536af5ee85c1403335

Request headers

Referer: https://olx.pl-otrymac.info/order/?id=641797595
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 19 Nov 2020 22:14:05 GMT
content-encoding: br
last-modified: Wed, 18 Nov 2020 14:54:07 GMT
server: ddos-guard
etag: W/"5fb5358f-307"
vary: Accept-Encoding
content-type: image/svg+xml
accept-ranges: bytes

GET
H2 200 KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2
fonts.gstatic.com/s/roboto/v20/ 11 KB
11 KB 9ms
8ms Font
font/woff2 2a00:1450:4001:814::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,500,700&subset=cyrillic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ce897833ac6e362df7c91ac8223fe511c6defcf33964928a81004600a2dd4c2e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://olx.pl-otrymac.info
Referer: https://fonts.googleapis.com/css?family=Roboto:400,500,700&subset=cyrillic
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 17 Nov 2020 11:20:36 GMT
x-content-type-options: nosniff
last-modified: Wed, 24 Jul 2019 01:18:48 GMT
server: sffe
age: 212009
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11056
x-xss-protection: 0
expires: Wed, 17 Nov 2021 11:20:36 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
fonts.gstatic.com/s/roboto/v20/ 11 KB
11 KB 8ms
7ms Font
font/woff2 2a00:1450:4001:814::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,500,700&subset=cyrillic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://olx.pl-otrymac.info
Referer: https://fonts.googleapis.com/css?family=Roboto:400,500,700&subset=cyrillic
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 15 Nov 2020 11:20:35 GMT
x-content-type-options: nosniff
last-modified: Wed, 24 Jul 2019 01:18:50 GMT
server: sffe
age: 384810
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11016
x-xss-protection: 0
expires: Mon, 15 Nov 2021 11:20:35 GMT

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2
fonts.gstatic.com/s/roboto/v20/ 11 KB
11 KB 7ms
6ms Font
font/woff2 2a00:1450:4001:814::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmWUlfBBc4AMP6lQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,500,700&subset=cyrillic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0d9fd7ccabde9b202de45ee6b65878ce9594975d8e8810b0878d3f3fa3637d0e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://olx.pl-otrymac.info
Referer: https://fonts.googleapis.com/css?family=Roboto:400,500,700&subset=cyrillic
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 15 Nov 2020 20:01:10 GMT
x-content-type-options: nosniff
last-modified: Wed, 24 Jul 2019 01:18:58 GMT
server: sffe
age: 353575
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11020
x-xss-protection: 0
expires: Mon, 15 Nov 2021 20:01:10 GMT

GET
H2 200 fa-regular-400.woff2
use.fontawesome.com/releases/v5.8.1/webfonts/ 13 KB
14 KB 156ms
44ms Font
font/woff2 23.111.9.35
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/releases/v5.8.1/webfonts/fa-regular-400.woff2
Requested by: Host: use.fontawesome.com
URL: https://use.fontawesome.com/releases/v5.8.1/css/all.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.111.9.35 Phoenix, United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: ccf4db1eeb68c96e05e74f8ebfa75cc60c3a0fed862dae6b0ad85d4e1b5b4e4f

Request headers

Origin: https://olx.pl-otrymac.info
Referer: https://use.fontawesome.com/releases/v5.8.1/css/all.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 19 Nov 2020 22:14:05 GMT
last-modified: Thu, 21 Mar 2019 21:32:15 GMT
server: NetDNA-cache/2.2
etag: "e6257a726a0cf6ec8c6fec22821c055f"
vary: Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
access-control-allow-methods: GET
content-type: font/woff2
access-control-allow-origin: *
access-control-max-age: 3000
cache-control: max-age=31556926
x-cache: HIT
accept-ranges: bytes
content-length: 13552

GET
H2 200 fa-solid-900.woff2
use.fontawesome.com/releases/v5.8.1/webfonts/ 73 KB
73 KB 187ms
75ms Font
font/woff2 23.111.9.35
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/releases/v5.8.1/webfonts/fa-solid-900.woff2
Requested by: Host: use.fontawesome.com
URL: https://use.fontawesome.com/releases/v5.8.1/css/all.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.111.9.35 Phoenix, United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: f18c486a80175cf02fee0e05c2b4acd86c04cdbaecec61c1ef91f920509b5efe

Request headers

Origin: https://olx.pl-otrymac.info
Referer: https://use.fontawesome.com/releases/v5.8.1/css/all.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 19 Nov 2020 22:14:05 GMT
last-modified: Thu, 21 Mar 2019 21:32:28 GMT
server: NetDNA-cache/2.2
etag: "418dad87601f9c8abd0e5798c0dc1feb"
vary: Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
access-control-allow-methods: GET
content-type: font/woff2
access-control-allow-origin: *
access-control-max-age: 3000
cache-control: max-age=31556926
x-cache: HIT
accept-ranges: bytes
content-length: 74256

GET
H3-Q050 200 KFOlCnqEu92Fr1MmEU9fChc4AMP6lbBP.woff2
fonts.gstatic.com/s/roboto/v20/ 8 KB
8 KB 37ms
22ms Font
font/woff2 2a00:1450:4001:814::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmEU9fChc4AMP6lbBP.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,500,700&subset=cyrillic

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ac4f45c63e7192b1c9fb64be19be7a03084e16dc33b4dcfedabb44cb390c25a2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://olx.pl-otrymac.info
Referer: https://fonts.googleapis.com/css?family=Roboto:400,500,700&subset=cyrillic
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 17 Nov 2020 11:20:38 GMT
x-content-type-options: nosniff
last-modified: Wed, 24 Jul 2019 01:18:45 GMT
server: sffe
age: 212007
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7924
x-xss-protection: 0
expires: Wed, 17 Nov 2021 11:20:38 GMT

GET
H3-Q050 200 KFOmCnqEu92Fr1Mu7GxKKTU1Kvnz.woff2
fonts.gstatic.com/s/roboto/v20/ 8 KB
8 KB 33ms
22ms Font
font/woff2 2a00:1450:4001:814::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu7GxKKTU1Kvnz.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,500,700&subset=cyrillic

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f36d71c69bcec4ce625d2923d36a4b1f64bbc2e5691c99cf8a4f3b0f79d1edb4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://olx.pl-otrymac.info
Referer: https://fonts.googleapis.com/css?family=Roboto:400,500,700&subset=cyrillic
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 13 Nov 2020 08:34:24 GMT
x-content-type-options: nosniff
last-modified: Wed, 24 Jul 2019 01:18:46 GMT
server: sffe
age: 567581
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8024
x-xss-protection: 0
expires: Sat, 13 Nov 2021 08:34:24 GMT

GET
H3-Q050 200 KFOlCnqEu92Fr1MmWUlfChc4AMP6lbBP.woff2
fonts.gstatic.com/s/roboto/v20/ 8 KB
8 KB 23ms
23ms Font
font/woff2 2a00:1450:4001:814::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmWUlfChc4AMP6lbBP.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,500,700&subset=cyrillic

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:814::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d4a0134009f70c36d82c43c77b2a6f0ee48a57beb8d4f9e9ff7c3dd3887212bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://olx.pl-otrymac.info
Referer: https://fonts.googleapis.com/css?family=Roboto:400,500,700&subset=cyrillic
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 15 Nov 2020 16:54:57 GMT
x-content-type-options: nosniff
last-modified: Wed, 24 Jul 2019 01:18:58 GMT
server: sffe
age: 364748
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7924
x-xss-protection: 0
expires: Mon, 15 Nov 2021 16:54:57 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Visa (Financial)

12 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.pl-otrymac.info/	1970-01-19 22:49:20	Name: __ddg1 Value: H1H3SM3fxPQXWFNQzHSd

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.googleapis.com
fonts.gstatic.com
olx.pl-otrymac.info
use.fontawesome.com
23.111.9.35
2a00:1450:4001:814::2003
2a00:1450:4001:814::200a
45.147.197.70
0497a8d2a9bde7db8c0466fae73e347a3258192811ed1108e3e096d5f34ac0e8
0d9fd7ccabde9b202de45ee6b65878ce9594975d8e8810b0878d3f3fa3637d0e
53964478a7c634e8dad34ecc303dd8048d00dce4993906de1bacf67f663486ef
5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479
73093cfee16f96b540773a1c776671704c1f6a2b9e867cce6adaa31e4e115bac
741ff35382698799509706df5993745b95700a0c4ff24e4ada87aa572ff947d2
86c78a4682afb82a85699cf93eecf7dd79da0be2c0ebdc1356b51b5473481109
8d94ed7d8a6c7ebc74ee7f0c9484e3ea0d2574a2c45eaa151e2e2bc67b9c9b25
8f2a1cc30f864f47e53a7f03aa711893d678dfc60f1f4aee0090a9df9df53d6e
a9954ffa9526509890a72a7e5e9747ff1aca3c85338eba536af5ee85c1403335
ac4f45c63e7192b1c9fb64be19be7a03084e16dc33b4dcfedabb44cb390c25a2
ccf4db1eeb68c96e05e74f8ebfa75cc60c3a0fed862dae6b0ad85d4e1b5b4e4f
ce897833ac6e362df7c91ac8223fe511c6defcf33964928a81004600a2dd4c2e
d4a0134009f70c36d82c43c77b2a6f0ee48a57beb8d4f9e9ff7c3dd3887212bc
d979cc02922db332ce81875fa360d731dec46c99d4adb315f417cd13eaabf5ba
eeb17a45a48aca1d7adbcf04de155dcd0b47cb36ad036310446bb471fea9aaa3
f18c486a80175cf02fee0e05c2b4acd86c04cdbaecec61c1ef91f920509b5efe
f36d71c69bcec4ce625d2923d36a4b1f64bbc2e5691c99cf8a4f3b0f79d1edb4

olx.pl-otrymac.info Open in urlscan Pro 45.147.197.70 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

18 Requests

100 %HTTPS

50 %IPv6

4 Domains

4 Subdomains

4 IPs

3 Countries

226 kBTransfer

480 kBSize

1 Cookies

0 Outgoing links

Redirected requests

18 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

12 JavaScript Global Variables

1 Cookies

Indicators

olx.pl-otrymac.info Open in urlscan Pro
45.147.197.70 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

18
Requests

100 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

226 kB
Transfer

480 kB
Size

1
Cookies

18 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!