continue.4kjk5fjtew.buzz Open in urlscan Pro
216.128.129.154 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://t.co/1LEx7H7PzM
Effective URL:
https://continue.4kjk5fjtew.buzz/?return=&visitorId=65fd7cdacf433fa350d8d8a0
Submission: On March 22 via automatic, source phishtank (March 22nd 2024, 12:43:13 pm UTC) — Scanned from DE

Summary HTTP 12 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 3 domains to perform 12 HTTP transactions. The main IP is 216.128.129.154, located in Dallas, United States and belongs to AS-CHOOPA, US. The main domain is continue.4kjk5fjtew.buzz.
TLS certificate: Issued by R3 on March 11th 2024. Valid for: 3 months.

This is the only time continue.4kjk5fjtew.buzz was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Amazon Japan (Online) Amazon (Online)

Domain & IP information

	IP Address	AS Autonomous System
1	104.244.42.197 104.244.42.197	13414 (TWITTER) (TWITTER)
1 1	49.13.14.140 49.13.14.140	24940 (HETZNER-AS) (HETZNER-AS)
11	216.128.129.154 216.128.129.154	20473 (AS-CHOOPA) (AS-CHOOPA)
12	2

1 104.244.42.197 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 49.13.14.140 (Frankfurt am Main, Germany) 1 redirects

ASN24940 (HETZNER-AS, DE)
PTR: static.140.14.13.49.clients.your-server.de

agrisupp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 216.128.129.154 (Dallas, United States)

ASN20473 (AS-CHOOPA, US)
PTR: 216.128.129.154.vultrusercontent.com

continue.4kjk5fjtew.buzz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	4kjk5fjtew.buzz continue.4kjk5fjtew.buzz	544 KB
1	agrisupp.com 1 redirects agrisupp.com	286 B
1	t.co t.co — Cisco Umbrella Rank: 766	585 B
12	3

	Domain	Requested by
11	continue.4kjk5fjtew.buzz	t.co continue.4kjk5fjtew.buzz
1	agrisupp.com	1 redirects
1	t.co
12	3

This site contains no links.

Subject Issuer	Validity	Valid
t.co DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-01-07` - `2025-01-06`	a year	crt.sh
continue.4kjk5fjtew.buzz R3	`2024-03-11` - `2024-06-09`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://continue.4kjk5fjtew.buzz/?return=&visitorId=65fd7cdacf433fa350d8d8a0
Frame ID: ED5E688A96B0EB476E14B00E5103C2EE
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Amazon Sign-in

Page URL History Show full URLs

https://t.co/1LEx7H7PzM Page URL
https://agrisupp.com/storage/files/5594/library.php?talk=coca HTTP 302
https://continue.4kjk5fjtew.buzz/?return=&visitorId=65fd7cdacf433fa350d8d8a0 Page URL

Page Statistics

12
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

2
IPs

2
Countries

545 kB
Transfer

538 kB
Size

3
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://t.co/1LEx7H7PzM Page URL
https://agrisupp.com/storage/files/5594/library.php?talk=coca HTTP 302
https://continue.4kjk5fjtew.buzz/?return=&visitorId=65fd7cdacf433fa350d8d8a0 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 1LEx7H7PzM
t.co/ 341 B
585 B 259ms
159ms Document
text/html 104.244.42.197
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://t.co/1LEx7H7PzM

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.197 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: private,max-age=300
content-encoding: gzip
content-length: 214
content-type: text/html; charset=utf-8
date: Fri, 22 Mar 2024 12:43:04 GMT
expires: Fri, 22 Mar 2024 12:48:05 GMT
perf: 7469935968
server: tsa_o
strict-transport-security: max-age=0
vary: Origin
x-connection-hash: 2b1efa2371a87f4b16210cd8bdd3279f748fd4ebdf8b8d311af02bf8b854aae8
x-response-time: 119
x-transaction-id: 528fa31007b78f4a
x-xss-protection: 0

GET
H/1.1

200
OK

Primary Request / Show response
continue.4kjk5fjtew.buzz/
Redirect Chain

https://agrisupp.com/storage/files/5594/library.php?talk=coca
https://continue.4kjk5fjtew.buzz/?return=&visitorId=65fd7cdacf433fa350d8d8a0

3 KB
4 KB

1153ms
824ms

Document
text/html

216.128.129.154
AS-CHOOPA

General

Check archive.org

Show headers Download Go to

Full URL

https://continue.4kjk5fjtew.buzz/?return=&visitorId=65fd7cdacf433fa350d8d8a0

Requested by

Host: t.co
URL: https://t.co/1LEx7H7PzM

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

216.128.129.154 Dallas, United States, ASN20473 (AS-CHOOPA, US),

Reverse DNS

216.128.129.154.vultrusercontent.com

Software

Apache /

Resource Hash

70acaab80b073b9a6b05669891b3aae02a9dc8af830b46b61a1e65946b55255e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://t.co/1LEx7H7PzM
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
Access-Control-Allow-Methods: POST, OPTIONS, GET
Access-Control-Allow-Origin: *
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Date: Fri, 22 Mar 2024 12:43:06 GMT
Keep-Alive: timeout=5, max=100
Server: Apache
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Transfer-Encoding: chunked
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-XSS-Protection: 1; mode=block

Redirect headers

Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Date: Fri, 22 Mar 2024 12:43:06 GMT
LOCATION: https://continue.4kjk5fjtew.buzz/?return=&visitorId=65fd7cdacf433fa350d8d8a0
Server: nginx/1.22.1
Transfer-Encoding: chunked
X-Powered-By: PHP/8.2.5

GET
H/1.1 200
OK main.5b4ecdfc.chunk.css
continue.4kjk5fjtew.buzz/static/css/ 103 KB
103 KB 178ms
176ms Stylesheet
text/css 216.128.129.154
AS-CHOOPA

General

Check archive.org

Show headers Download Go to

Full URL

https://continue.4kjk5fjtew.buzz/static/css/main.5b4ecdfc.chunk.css

Requested by

Host: continue.4kjk5fjtew.buzz
URL: https://continue.4kjk5fjtew.buzz/?return=&visitorId=65fd7cdacf433fa350d8d8a0

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

216.128.129.154 Dallas, United States, ASN20473 (AS-CHOOPA, US),

Reverse DNS

216.128.129.154.vultrusercontent.com

Software

Apache /

Resource Hash

e6d9deda828bf920da2ddb858f25ce0513e9187aaa23ac2dffbe015cd5fb5743

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://continue.4kjk5fjtew.buzz/?return=&visitorId=65fd7cdacf433fa350d8d8a0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

Date: Fri, 22 Mar 2024 12:43:07 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
Last-Modified: Mon, 11 Mar 2024 14:07:52 GMT
Server: Apache
X-Frame-Options: DENY
Access-Control-Allow-Methods: POST, OPTIONS, GET
Content-Type: text/css
Access-Control-Allow-Origin: *
Connection: Keep-Alive
Accept-Ranges: bytes
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
Content-Length: 105323
X-XSS-Protection: 1; mode=block
Keep-Alive: timeout=5, max=99

GET
H/1.1 200
OK 3.4ee97899.chunk.js Show response
continue.4kjk5fjtew.buzz/static/js/ 247 KB
248 KB 848ms
160ms Script
text/javascript 216.128.129.154
AS-CHOOPA

General

Check archive.org

Show headers Download Go to

Full URL

https://continue.4kjk5fjtew.buzz/static/js/3.4ee97899.chunk.js

Requested by

Host: continue.4kjk5fjtew.buzz
URL: https://continue.4kjk5fjtew.buzz/?return=&visitorId=65fd7cdacf433fa350d8d8a0

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

216.128.129.154 Dallas, United States, ASN20473 (AS-CHOOPA, US),

Reverse DNS

216.128.129.154.vultrusercontent.com

Software

Apache /

Resource Hash

d1e0c70e95d1bf5c1388030fab62d9313efd04eba5705ebbc3c2ebfdde2f5977

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://continue.4kjk5fjtew.buzz/?return=&visitorId=65fd7cdacf433fa350d8d8a0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

Date: Fri, 22 Mar 2024 12:43:08 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
Last-Modified: Mon, 11 Mar 2024 14:07:52 GMT
Server: Apache
X-Frame-Options: DENY
Access-Control-Allow-Methods: POST, OPTIONS, GET
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Connection: Keep-Alive
Accept-Ranges: bytes
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
Content-Length: 253097
X-XSS-Protection: 1; mode=block
Keep-Alive: timeout=5, max=98

GET
H/1.1 200
OK main.1082ca0f.chunk.js Show response
continue.4kjk5fjtew.buzz/static/js/ 55 KB
56 KB 899ms
150ms Script
text/javascript 216.128.129.154
AS-CHOOPA

General

Check archive.org

Show headers Download Go to

Full URL

https://continue.4kjk5fjtew.buzz/static/js/main.1082ca0f.chunk.js

Requested by

Host: continue.4kjk5fjtew.buzz
URL: https://continue.4kjk5fjtew.buzz/?return=&visitorId=65fd7cdacf433fa350d8d8a0

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

216.128.129.154 Dallas, United States, ASN20473 (AS-CHOOPA, US),

Reverse DNS

216.128.129.154.vultrusercontent.com

Software

Apache /

Resource Hash

a06930fe64c7152d4cf39657e6d50778a9e8c98fe99855df7ce92b0d135078d7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://continue.4kjk5fjtew.buzz/?return=&visitorId=65fd7cdacf433fa350d8d8a0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

Date: Fri, 22 Mar 2024 12:43:08 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
Last-Modified: Mon, 11 Mar 2024 14:07:52 GMT
Server: Apache
X-Frame-Options: DENY
Access-Control-Allow-Methods: POST, OPTIONS, GET
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Connection: Keep-Alive
Accept-Ranges: bytes
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
Content-Length: 56402
X-XSS-Protection: 1; mode=block
Keep-Alive: timeout=5, max=100

POST
H/1.1 200
OK supply Show response
continue.4kjk5fjtew.buzz/api/ 2 KB
2 KB 158ms
157ms XHR
text/html 216.128.129.154
AS-CHOOPA

General

Check archive.org

Show headers Download Go to

Full URL

https://continue.4kjk5fjtew.buzz/api/supply

Requested by

Host: continue.4kjk5fjtew.buzz
URL: https://continue.4kjk5fjtew.buzz/static/js/3.4ee97899.chunk.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

216.128.129.154 Dallas, United States, ASN20473 (AS-CHOOPA, US),

Reverse DNS

216.128.129.154.vultrusercontent.com

Software

Apache /

Resource Hash

fe56f29dd66441c494e729bfb42f2c33da451e4025cf13a51d99c1ca9cac64be

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/plain, */*
Referer: https://continue.4kjk5fjtew.buzz/?return=&visitorId=65fd7cdacf433fa350d8d8a0
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

Date: Fri, 22 Mar 2024 12:43:09 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
Server: Apache
X-Frame-Options: DENY
Access-Control-Allow-Methods: POST, OPTIONS, GET
Content-Type: text/html; charset=UTF-8
Access-Control-Allow-Origin: *
Transfer-Encoding: chunked
Connection: Keep-Alive
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
Keep-Alive: timeout=5, max=99
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK pDxWAF1pBB0dzGB.2c1d70d6.woff2
continue.4kjk5fjtew.buzz/static/media/ 16 KB
17 KB 153ms
153ms Font
font/woff2 216.128.129.154
AS-CHOOPA

General

Check archive.org

Show headers Download Go to

Full URL

https://continue.4kjk5fjtew.buzz/static/media/pDxWAF1pBB0dzGB.2c1d70d6.woff2

Requested by

Host: continue.4kjk5fjtew.buzz
URL: https://continue.4kjk5fjtew.buzz/static/css/main.5b4ecdfc.chunk.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

216.128.129.154 Dallas, United States, ASN20473 (AS-CHOOPA, US),

Reverse DNS

216.128.129.154.vultrusercontent.com

Software

Apache /

Resource Hash

cded49f94fc16dc0a14923975e159fbf4b14844593e612c1342c9e34e2f96821

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://continue.4kjk5fjtew.buzz/static/css/main.5b4ecdfc.chunk.css
Origin: https://continue.4kjk5fjtew.buzz
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

Date: Fri, 22 Mar 2024 12:43:09 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
Last-Modified: Mon, 11 Mar 2024 14:07:52 GMT
Server: Apache
X-Frame-Options: DENY
Access-Control-Allow-Methods: POST, OPTIONS, GET
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Connection: Keep-Alive
Accept-Ranges: bytes
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
Content-Length: 16616
X-XSS-Protection: 1; mode=block
Keep-Alive: timeout=5, max=97

POST
H/1.1 200
OK ping Show response
continue.4kjk5fjtew.buzz/api/ 2 B
545 B 367ms
367ms XHR
text/html 216.128.129.154
AS-CHOOPA

General

Check archive.org

Show headers Download Go to

Full URL

https://continue.4kjk5fjtew.buzz/api/ping

Requested by

Host: continue.4kjk5fjtew.buzz
URL: https://continue.4kjk5fjtew.buzz/static/js/3.4ee97899.chunk.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

216.128.129.154 Dallas, United States, ASN20473 (AS-CHOOPA, US),

Reverse DNS

216.128.129.154.vultrusercontent.com

Software

Apache /

Resource Hash

565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/plain, */*
Referer: https://continue.4kjk5fjtew.buzz/ap/signin?session=zqcixy3sfzdjr10vdz0gkhp1t9nfigwkbhluwh0mba5ynw2lsju7vur2ywwv8l9u
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36
Content-Type: application/json

Response headers

Date: Fri, 22 Mar 2024 12:43:09 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
Server: Apache
X-Frame-Options: DENY
Access-Control-Allow-Methods: POST, OPTIONS, GET
Content-Type: text/html; charset=UTF-8
Access-Control-Allow-Origin: *
Transfer-Encoding: chunked
Connection: Keep-Alive
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
Keep-Alive: timeout=5, max=100
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK 0.c8f46ac8.chunk.js Show response
continue.4kjk5fjtew.buzz/static/js/ 22 KB
23 KB 210ms
162ms Script
text/javascript 216.128.129.154
AS-CHOOPA

General

Check archive.org

Show headers Download Go to

Full URL

https://continue.4kjk5fjtew.buzz/static/js/0.c8f46ac8.chunk.js

Requested by

Host: continue.4kjk5fjtew.buzz
URL: https://continue.4kjk5fjtew.buzz/?return=&visitorId=65fd7cdacf433fa350d8d8a0

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

216.128.129.154 Dallas, United States, ASN20473 (AS-CHOOPA, US),

Reverse DNS

216.128.129.154.vultrusercontent.com

Software

Apache /

Resource Hash

837de1f1b3dbccc49592de124651591d61b78c28e8bb7265140e2b51a9b2bb3a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://continue.4kjk5fjtew.buzz/ap/signin?session=zqcixy3sfzdjr10vdz0gkhp1t9nfigwkbhluwh0mba5ynw2lsju7vur2ywwv8l9u
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

Date: Fri, 22 Mar 2024 12:43:09 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
Last-Modified: Mon, 11 Mar 2024 14:07:52 GMT
Server: Apache
X-Frame-Options: DENY
Access-Control-Allow-Methods: POST, OPTIONS, GET
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Connection: Keep-Alive
Accept-Ranges: bytes
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
Content-Length: 22750
X-XSS-Protection: 1; mode=block
Keep-Alive: timeout=5, max=98

GET
H/1.1 200
OK 13.d414ac36.chunk.js Show response
continue.4kjk5fjtew.buzz/static/js/ 13 KB
14 KB 251ms
154ms Script
text/javascript 216.128.129.154
AS-CHOOPA

General

Check archive.org

Show headers Download Go to

Full URL

https://continue.4kjk5fjtew.buzz/static/js/13.d414ac36.chunk.js

Requested by

Host: continue.4kjk5fjtew.buzz
URL: https://continue.4kjk5fjtew.buzz/?return=&visitorId=65fd7cdacf433fa350d8d8a0

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

216.128.129.154 Dallas, United States, ASN20473 (AS-CHOOPA, US),

Reverse DNS

216.128.129.154.vultrusercontent.com

Software

Apache /

Resource Hash

aa6a4157284eaa1f143324ed61117a871c8e523d7b3e945116f2c8f26dfdcb02

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://continue.4kjk5fjtew.buzz/ap/signin?session=zqcixy3sfzdjr10vdz0gkhp1t9nfigwkbhluwh0mba5ynw2lsju7vur2ywwv8l9u
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

Date: Fri, 22 Mar 2024 12:43:09 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
Last-Modified: Mon, 11 Mar 2024 14:07:52 GMT
Server: Apache
X-Frame-Options: DENY
Access-Control-Allow-Methods: POST, OPTIONS, GET
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Connection: Keep-Alive
Accept-Ranges: bytes
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
Content-Length: 13782
X-XSS-Protection: 1; mode=block
Keep-Alive: timeout=5, max=96

GET
H/1.1 200
OK main.d33128ec.png
continue.4kjk5fjtew.buzz/static/media/ 60 KB
61 KB 154ms
153ms Image
image/png 216.128.129.154
AS-CHOOPA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://continue.4kjk5fjtew.buzz/static/media/main.d33128ec.png

Requested by

Host: continue.4kjk5fjtew.buzz
URL: https://continue.4kjk5fjtew.buzz/static/css/main.5b4ecdfc.chunk.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

216.128.129.154 Dallas, United States, ASN20473 (AS-CHOOPA, US),

Reverse DNS

216.128.129.154.vultrusercontent.com

Software

Apache /

Resource Hash

c5e829691be4103e8f645ee962bbc3de1ca51d083d147f1716fbf5d59f99c86a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://continue.4kjk5fjtew.buzz/static/css/main.5b4ecdfc.chunk.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

Date: Fri, 22 Mar 2024 12:43:09 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
Last-Modified: Mon, 11 Mar 2024 14:07:52 GMT
Server: Apache
X-Frame-Options: DENY
Access-Control-Allow-Methods: POST, OPTIONS, GET
Content-Type: image/png
Access-Control-Allow-Origin: *
Connection: Keep-Alive
Accept-Ranges: bytes
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
Content-Length: 61917
X-XSS-Protection: 1; mode=block
Keep-Alive: timeout=5, max=95

GET
H/1.1 200
OK KFPk-9IF4FqAqY-.4de52a40.woff2
continue.4kjk5fjtew.buzz/static/media/ 16 KB
17 KB 171ms
170ms Font
font/woff2 216.128.129.154
AS-CHOOPA

General

Check archive.org

Show headers Download Go to

Full URL

https://continue.4kjk5fjtew.buzz/static/media/KFPk-9IF4FqAqY-.4de52a40.woff2

Requested by

Host: continue.4kjk5fjtew.buzz
URL: https://continue.4kjk5fjtew.buzz/static/css/main.5b4ecdfc.chunk.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

216.128.129.154 Dallas, United States, ASN20473 (AS-CHOOPA, US),

Reverse DNS

216.128.129.154.vultrusercontent.com

Software

Apache /

Resource Hash

4065b43ba3db8da5390ba0708555889f78e86483fe0226ef79ea22d07c306b89

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://continue.4kjk5fjtew.buzz/static/css/main.5b4ecdfc.chunk.css
Origin: https://continue.4kjk5fjtew.buzz
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

Date: Fri, 22 Mar 2024 12:43:09 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
Last-Modified: Mon, 11 Mar 2024 14:07:52 GMT
Server: Apache
X-Frame-Options: DENY
Access-Control-Allow-Methods: POST, OPTIONS, GET
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Connection: Keep-Alive
Accept-Ranges: bytes
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
Content-Length: 16460
X-XSS-Protection: 1; mode=block
Keep-Alive: timeout=5, max=97

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Amazon Japan (Online) Amazon (Online)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| webpackJsonpa

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.t.co/	1970-01-21 04:48:45	Name: muc Value: 2ea0f15a-0fbe-4893-ad30-dc8722626e68
continue.4kjk5fjtew.buzz/	1970-01-20 19:18:34	Name: session Value: J0dBf8MMRErJZksuekzphC66SY9ThiYI
continue.4kjk5fjtew.buzz/	1970-01-20 19:18:34	Name: language Value: de

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
rendering	warning	URL: https://continue.4kjk5fjtew.buzz/static/js/main.1082ca0f.chunk.js Message: Canvas2D: Multiple readback operations using getImageData are faster with the willReadFrequently attribute set to true. See: https://html.spec.whatwg.org/multipage/canvas.html#concept-canvas-will-read-frequently

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=0
X-Xss-Protection	0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

agrisupp.com
continue.4kjk5fjtew.buzz
t.co
104.244.42.197
216.128.129.154
49.13.14.140
4065b43ba3db8da5390ba0708555889f78e86483fe0226ef79ea22d07c306b89
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
70acaab80b073b9a6b05669891b3aae02a9dc8af830b46b61a1e65946b55255e
837de1f1b3dbccc49592de124651591d61b78c28e8bb7265140e2b51a9b2bb3a
a06930fe64c7152d4cf39657e6d50778a9e8c98fe99855df7ce92b0d135078d7
aa6a4157284eaa1f143324ed61117a871c8e523d7b3e945116f2c8f26dfdcb02
c5e829691be4103e8f645ee962bbc3de1ca51d083d147f1716fbf5d59f99c86a
cded49f94fc16dc0a14923975e159fbf4b14844593e612c1342c9e34e2f96821
d1e0c70e95d1bf5c1388030fab62d9313efd04eba5705ebbc3c2ebfdde2f5977
e6d9deda828bf920da2ddb858f25ce0513e9187aaa23ac2dffbe015cd5fb5743
fe56f29dd66441c494e729bfb42f2c33da451e4025cf13a51d99c1ca9cac64be

continue.4kjk5fjtew.buzz Open in urlscan Pro 216.128.129.154 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

12 Requests

100 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

2 IPs

2 Countries

545 kBTransfer

538 kBSize

3 Cookies

0 Outgoing links

Page URL History

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

3 Cookies

1 Console Messages

Security Headers

Indicators

continue.4kjk5fjtew.buzz Open in urlscan Pro
216.128.129.154 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

2
IPs

2
Countries

545 kB
Transfer

538 kB
Size

3
Cookies

12 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!