mfr4vta5znjrc2dzo2npznkgvm8xmje5agw3ulnisevzngnknk1jng.buytheway.shop Open in urlscan Pro
2606:4700:3034::ac43:af9d Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://mfr4vta5znjrc2dzo2npznkgvm8xmje5agw3ulnisevzngnknk1jng.buytheway.shop/hKFo2SA3QjNIcWI5bmhPdlR1SU9ibzFxMGlRc0x0Ul83clZSa6Fur3VuaXZlcnNhbC1sb2dpbqN0aWTZIFZFWDIzQVV0aThV...
Submission: On October 23 via api (October 23rd 2024, 1:53:26 pm UTC) from US — Scanned from US

Summary HTTP 12 Redirects Links 2 Behaviour Indicators

Summary

This website contacted 6 IPs in 1 countries across 5 domains to perform 12 HTTP transactions. The main IP is 2606:4700:3034::ac43:af9d, located in United States and belongs to CLOUDFLARENET, US. The main domain is mfr4vta5znjrc2dzo2npznkgvm8xmje5agw3ulnisevzngnknk1jng.buytheway.shop.
TLS certificate: Issued by WE1 on October 21st 2024. Valid for: 3 months.

This is the only time mfr4vta5znjrc2dzo2npznkgvm8xmje5agw3ulnisevzngnknk1jng.buytheway.shop was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Cloudflare (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 7	2606:4700:303... 2606:4700:3034::ac43:af9d	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2607:f8b0:400... 2607:f8b0:400d:c0c::5f	15169 (GOOGLE) (GOOGLE)
2	2600:9000:21b... 2600:9000:21b8:3c00:10:474e:104a:2961	16509 (AMAZON-02) (AMAZON-02)
2	2607:f8b0:400... 2607:f8b0:400d:c0b::5e	15169 (GOOGLE) (GOOGLE)
1	2606:4700:440... 2606:4700:4400::6812:2614	13335 (CLOUDFLAR...) (CLOUDFLARENET)
12	6

7 2606:4700:3034::ac43:af9d (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

mfr4vta5znjrc2dzo2npznkgvm8xmje5agw3ulnisevzngnknk1jng.buytheway.shop	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:400d:c0c::5f (Morganton, United States)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:21b8:3c00:10:474e:104a:2961 (United States)

ASN16509 (AMAZON-02, US)

cdn.auth0.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:400d:c0b::5e (Morganton, United States)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::6812:2614 (United States)

ASN13335 (CLOUDFLARENET, US)

swissmarketplace.group	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	buytheway.shop 1 redirects mfr4vta5znjrc2dzo2npznkgvm8xmje5agw3ulnisevzngnknk1jng.buytheway.shop	26 KB
2	gstatic.com fonts.gstatic.com	63 KB
2	auth0.com cdn.auth0.com — Cisco Umbrella Rank: 6411	65 KB
1	swissmarketplace.group swissmarketplace.group — Cisco Umbrella Rank: 418824	2 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 30	1 KB
12	5

	Domain	Requested by
7	mfr4vta5znjrc2dzo2npznkgvm8xmje5agw3ulnisevzngnknk1jng.buytheway.shop	1 redirects mfr4vta5znjrc2dzo2npznkgvm8xmje5agw3ulnisevzngnknk1jng.buytheway.shop
2	fonts.gstatic.com	fonts.googleapis.com
2	cdn.auth0.com	mfr4vta5znjrc2dzo2npznkgvm8xmje5agw3ulnisevzngnknk1jng.buytheway.shop
1	swissmarketplace.group
1	fonts.googleapis.com	mfr4vta5znjrc2dzo2npznkgvm8xmje5agw3ulnisevzngnknk1jng.buytheway.shop
12	5

This site contains links to these domains. Also see Links.

Domain
re.swissmarketplace.group

Subject Issuer	Validity	Valid
buytheway.shop WE1	`2024-10-21` - `2025-01-19`	3 months	crt.sh
upload.video.google.com WR2	`2024-09-30` - `2024-12-23`	3 months	crt.sh
*.auth0.com Amazon RSA 2048 M03	`2024-01-25` - `2025-02-22`	a year	crt.sh
*.gstatic.com WR2	`2024-09-30` - `2024-12-23`	3 months	crt.sh
swissmarketplace.group WE1	`2024-10-18` - `2025-01-16`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://mfr4vta5znjrc2dzo2npznkgvm8xmje5agw3ulnisevzngnknk1jng.buytheway.shop/hKFo2SA3QjNIcWI5bmhPdlR1SU9ibzFxMGlRc0x0Ul83clZSa6Fur3VuaXZlcnNhbC1sb2dpbqN0aWTZIFZFWDIzQVV0aThVOEdkVkpKMmRBMFR4VTA5ZnJRc2dzo2NpZNkgVm8xMjE5aGw3UlNiSEVzNGNkNk1JNG8yMVMwYmx5SXE/login.php
Frame ID: 7A2AAC4FE68FE3735C2D985C46A6D00C
Requests: 15 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Login | swissmarketplace.group

Page URL History Show full URLs

https://mfr4vta5znjrc2dzo2npznkgvm8xmje5agw3ulnisevzngnknk1jng.buytheway.shop/hKFo2SA3QjNIcWI5bmhPdlR1SU9ibzFxMGlRc0x0Ul83clZSa6Fur3VuaXZlcnNhbC1sb2dpbqN0... Page URL
https://mfr4vta5znjrc2dzo2npznkgvm8xmje5agw3ulnisevzngnknk1jng.buytheway.shop/cdn-cgi/phish-bypass?atok=v9EJAJzUhYT5QeeAg9ghsDwJZx1FiH1bNr0Uj6Ow.vM-172969... HTTP 301
https://mfr4vta5znjrc2dzo2npznkgvm8xmje5agw3ulnisevzngnknk1jng.buytheway.shop/hKFo2SA3QjNIcWI5bmhPdlR1SU9ibzFxMGlRc0x0Ul83clZSa6Fur3VuaXZlcnNhbC1sb2dpbqN0... Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Page Statistics

12
Requests

100 %
HTTPS

100 %
IPv6

5
Domains

5
Subdomains

6
IPs

1
Countries

157 kB
Transfer

425 kB
Size

2
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://re.swissmarketplace.group/en/ubm
Title: .cls-1 { fill: #46a5a5; stroke-width: 0px; }

Search URL Search Domain Scan URL

URL: https://re.swissmarketplace.group/de/help-center/
Title: FAQ

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://mfr4vta5znjrc2dzo2npznkgvm8xmje5agw3ulnisevzngnknk1jng.buytheway.shop/hKFo2SA3QjNIcWI5bmhPdlR1SU9ibzFxMGlRc0x0Ul83clZSa6Fur3VuaXZlcnNhbC1sb2dpbqN0aWTZIFZFWDIzQVV0aThVOEdkVkpKMmRBMFR4VTA5ZnJRc2dzo2NpZNkgVm8xMjE5aGw3UlNiSEVzNGNkNk1JNG8yMVMwYmx5SXE/login.php Page URL
https://mfr4vta5znjrc2dzo2npznkgvm8xmje5agw3ulnisevzngnknk1jng.buytheway.shop/cdn-cgi/phish-bypass?atok=v9EJAJzUhYT5QeeAg9ghsDwJZx1FiH1bNr0Uj6Ow.vM-1729691597-0.0.1.1-%2FhKFo2SA3QjNIcWI5bmhPdlR1SU9ibzFxMGlRc0x0Ul83clZSa6Fur3VuaXZlcnNhbC1sb2dpbqN0aWTZIFZFWDIzQVV0aThVOEdkVkpKMmRBMFR4VTA5ZnJRc2dzo2NpZNkgVm8xMjE5aGw3UlNiSEVzNGNkNk1JNG8yMVMwYmx5SXE%2Flogin.php HTTP 301
https://mfr4vta5znjrc2dzo2npznkgvm8xmje5agw3ulnisevzngnknk1jng.buytheway.shop/hKFo2SA3QjNIcWI5bmhPdlR1SU9ibzFxMGlRc0x0Ul83clZSa6Fur3VuaXZlcnNhbC1sb2dpbqN0aWTZIFZFWDIzQVV0aThVOEdkVkpKMmRBMFR4VTA5ZnJRc2dzo2NpZNkgVm8xMjE5aGw3UlNiSEVzNGNkNk1JNG8yMVMwYmx5SXE/login.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions
3 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3 403 login.php Show response
mfr4vta5znjrc2dzo2npznkgvm8xmje5agw3ulnisevzngnknk1jng.buytheway.shop/hKFo2SA3QjNIcWI5bmhPdlR1SU9ibzFxMGlRc0x0Ul83clZSa6Fur3VuaXZlcnNhbC1sb2dpbqN0aWTZIFZFWDIzQVV0aThVOEdkVkpKMmRBMFR4VTA5ZnJRc2dzo2N... 5 KB
2 KB 91ms
14ms Document
text/html 2606:4700:3034::ac43:af9d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://mfr4vta5znjrc2dzo2npznkgvm8xmje5agw3ulnisevzngnknk1jng.buytheway.shop/hKFo2SA3QjNIcWI5bmhPdlR1SU9ibzFxMGlRc0x0Ul83clZSa6Fur3VuaXZlcnNhbC1sb2dpbqN0aWTZIFZFWDIzQVV0aThVOEdkVkpKMmRBMFR4VTA5ZnJRc2dzo2NpZNkgVm8xMjE5aGw3UlNiSEVzNGNkNk1JNG8yMVMwYmx5SXE/login.php

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3034::ac43:af9d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5f69ea556228be3f0ec886e9f334cc397602a8fe13f03cbaf420f6080f701995

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

cf-ray: 8d723661eff378d3-EWR
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Wed, 23 Oct 2024 13:53:17 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FnI9BC9ojgl%2BcubQ2lGbFcTIm%2FvMc6R54XBrYUZ%2Fv6LM8ANBZwJxHfQ6tRO2QxfB0vrI13idZVsb81q3xFkCVm0EbgdsSBERkaAcRDFt4LqBmOLq7o019jfcTMYCjBfTN1pYB62j2xwnicNnvzqHpPfGC9EPzNev%2B3qtpsOTP8IRgdvV4ar88LypZsd4bPa6VN5foj4%2BaK0FyXzRK05SJOs84EE%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
x-frame-options: SAMEORIGIN

GET
H3 200 cf.errors.css
mfr4vta5znjrc2dzo2npznkgvm8xmje5agw3ulnisevzngnknk1jng.buytheway.shop/cdn-cgi/styles/ 23 KB
5 KB 12ms
11ms Stylesheet
text/css 2606:4700:3034::ac43:af9d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://mfr4vta5znjrc2dzo2npznkgvm8xmje5agw3ulnisevzngnknk1jng.buytheway.shop/cdn-cgi/styles/cf.errors.css

Requested by

Host: mfr4vta5znjrc2dzo2npznkgvm8xmje5agw3ulnisevzngnknk1jng.buytheway.shop
URL: https://mfr4vta5znjrc2dzo2npznkgvm8xmje5agw3ulnisevzngnknk1jng.buytheway.shop/hKFo2SA3QjNIcWI5bmhPdlR1SU9ibzFxMGlRc0x0Ul83clZSa6Fur3VuaXZlcnNhbC1sb2dpbqN0aWTZIFZFWDIzQVV0aThVOEdkVkpKMmRBMFR4VTA5ZnJRc2dzo2NpZNkgVm8xMjE5aGw3UlNiSEVzNGNkNk1JNG8yMVMwYmx5SXE/login.php

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3034::ac43:af9d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

84e3c77025ace5af143972b4a40fc834dcdfd4e449d4b36a57e62326f16b3091

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://mfr4vta5znjrc2dzo2npznkgvm8xmje5agw3ulnisevzngnknk1jng.buytheway.shop/hKFo2SA3QjNIcWI5bmhPdlR1SU9ibzFxMGlRc0x0Ul83clZSa6Fur3VuaXZlcnNhbC1sb2dpbqN0aWTZIFZFWDIzQVV0aThVOEdkVkpKMmRBMFR4VTA5ZnJRc2dzo2NpZNkgVm8xMjE5aGw3UlNiSEVzNGNkNk1JNG8yMVMwYmx5SXE/login.php

Response headers

vary: Accept-Encoding
cache-control: max-age=7200, public
content-encoding: gzip
etag: W/"6712b228-5df3"
x-content-type-options: nosniff
cf-ray: 8d723662081478d3-EWR
expires: Wed, 23 Oct 2024 15:53:17 GMT
date: Wed, 23 Oct 2024 13:53:17 GMT
content-type: text/css
last-modified: Fri, 18 Oct 2024 19:08:24 GMT
server: cloudflare
x-frame-options: DENY

GET
H3 200 icon-exclamation.png
mfr4vta5znjrc2dzo2npznkgvm8xmje5agw3ulnisevzngnknk1jng.buytheway.shop/cdn-cgi/images/ 452 B
634 B 10ms
10ms Image
image/png 2606:4700:3034::ac43:af9d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mfr4vta5znjrc2dzo2npznkgvm8xmje5agw3ulnisevzngnknk1jng.buytheway.shop/cdn-cgi/images/icon-exclamation.png?1376755637

Requested by

Host: mfr4vta5znjrc2dzo2npznkgvm8xmje5agw3ulnisevzngnknk1jng.buytheway.shop
URL: https://mfr4vta5znjrc2dzo2npznkgvm8xmje5agw3ulnisevzngnknk1jng.buytheway.shop/cdn-cgi/styles/cf.errors.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3034::ac43:af9d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://mfr4vta5znjrc2dzo2npznkgvm8xmje5agw3ulnisevzngnknk1jng.buytheway.shop/cdn-cgi/styles/cf.errors.css

Response headers

vary: Accept-Encoding
cache-control: max-age=7200, public
etag: "6712b228-1c4"
x-content-type-options: nosniff
cf-ray: 8d723662284978d3-EWR
expires: Wed, 23 Oct 2024 15:53:17 GMT
accept-ranges: bytes
content-length: 452
date: Wed, 23 Oct 2024 13:53:17 GMT
content-type: image/png
last-modified: Fri, 18 Oct 2024 19:08:24 GMT
server: cloudflare
x-frame-options: DENY

GET
H3 404 favicon.ico
mfr4vta5znjrc2dzo2npznkgvm8xmje5agw3ulnisevzngnknk1jng.buytheway.shop/ 331 B
992 B 252ms
252ms Other
text/html 2606:4700:3034::ac43:af9d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://mfr4vta5znjrc2dzo2npznkgvm8xmje5agw3ulnisevzngnknk1jng.buytheway.shop/favicon.ico
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3034::ac43:af9d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fe933a4f635a538ce956996c180010ef56c42372d24f1c240f1c452f1bbb088f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://mfr4vta5znjrc2dzo2npznkgvm8xmje5agw3ulnisevzngnknk1jng.buytheway.shop/hKFo2SA3QjNIcWI5bmhPdlR1SU9ibzFxMGlRc0x0Ul83clZSa6Fur3VuaXZlcnNhbC1sb2dpbqN0aWTZIFZFWDIzQVV0aThVOEdkVkpKMmRBMFR4VTA5ZnJRc2dzo2NpZNkgVm8xMjE5aGw3UlNiSEVzNGNkNk1JNG8yMVMwYmx5SXE/login.php

Response headers

cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: zstd
cf-cache-status: EXPIRED
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Zrp13sbAEI0hDZi32SPKzYINmAQBLN3k8Wx%2FEbf9jI69SYL7tMBeYkLPz83PL3PysPC8y4kIW%2BWOA7Z2DeX8XuPfzNv1Mb39Vau50DPzoMFyl6j57wAhOZMMAcFGt9pNFSWv6Q2pUUWgxNjXf0LojJmDirsNwg%2FSnWMJev1dxdYMZ7hMyUeFIfEbDCPVFKSPQwqCm6S5QLeBnMnZCLyj4XXQ3fA%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8d723662588478d3-EWR
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=8432&sent=24&recv=17&lost=0&retrans=0&sent_bytes=12287&recv_bytes=6384&delivery_rate=31588&cwnd=12000&unsent_bytes=0&cid=2fc6bd646173ef59&ts=327&x=1", cfExtPri, cfHdrFlush;dur=0
date: Wed, 23 Oct 2024 13:53:17 GMT
content-type: text/html; charset=iso-8859-1
vary: Accept-Encoding
server: cloudflare
priority: u=1,i

GET
H3

200

Primary Request login.php Show response
mfr4vta5znjrc2dzo2npznkgvm8xmje5agw3ulnisevzngnknk1jng.buytheway.shop/hKFo2SA3QjNIcWI5bmhPdlR1SU9ibzFxMGlRc0x0Ul83clZSa6Fur3VuaXZlcnNhbC1sb2dpbqN0aWTZIFZFWDIzQVV0aThVOEdkVkpKMmRBMFR4VTA5ZnJRc2dzo2N...
Redirect Chain

https://mfr4vta5znjrc2dzo2npznkgvm8xmje5agw3ulnisevzngnknk1jng.buytheway.shop/cdn-cgi/phish-bypass?atok=v9EJAJzUhYT5QeeAg9ghsDwJZx1FiH1bNr0Uj6Ow.vM-1729691597-0.0.1.1-%2FhKFo2SA3QjNIcWI5bmhPdlR1SU9...
https://mfr4vta5znjrc2dzo2npznkgvm8xmje5agw3ulnisevzngnknk1jng.buytheway.shop/hKFo2SA3QjNIcWI5bmhPdlR1SU9ibzFxMGlRc0x0Ul83clZSa6Fur3VuaXZlcnNhbC1sb2dpbqN0aWTZIFZFWDIzQVV0aThVOEdkVkpKMmRBMFR4VTA5ZnJ...

53 KB
16 KB

247ms
246ms

Document
text/html

2606:4700:3034::ac43:af9d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://mfr4vta5znjrc2dzo2npznkgvm8xmje5agw3ulnisevzngnknk1jng.buytheway.shop/hKFo2SA3QjNIcWI5bmhPdlR1SU9ibzFxMGlRc0x0Ul83clZSa6Fur3VuaXZlcnNhbC1sb2dpbqN0aWTZIFZFWDIzQVV0aThVOEdkVkpKMmRBMFR4VTA5ZnJRc2dzo2NpZNkgVm8xMjE5aGw3UlNiSEVzNGNkNk1JNG8yMVMwYmx5SXE/login.php
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3034::ac43:af9d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 24904e5dbb5ce723a3b2b80b61035bfdc4f7603b7b39afbd7d3ef2110d131460

Request headers

Referer: https://mfr4vta5znjrc2dzo2npznkgvm8xmje5agw3ulnisevzngnknk1jng.buytheway.shop/hKFo2SA3QjNIcWI5bmhPdlR1SU9ibzFxMGlRc0x0Ul83clZSa6Fur3VuaXZlcnNhbC1sb2dpbqN0aWTZIFZFWDIzQVV0aThVOEdkVkpKMmRBMFR4VTA5ZnJRc2dzo2NpZNkgVm8xMjE5aGw3UlNiSEVzNGNkNk1JNG8yMVMwYmx5SXE/login.php
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8d723681b86f78d3-EWR
content-encoding: zstd
content-type: text/html; charset=UTF-8
date: Wed, 23 Oct 2024 13:53:22 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
priority: u=0,i
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=x%2BQ6g0uOot9QTWq5x6RNNtu0HBJUOML24S3JaI4jzK8cWlBWn89eK8%2FJYRXK5%2BpJy%2BeYoG1F1fO5HTu%2FRjGKiP3MgEj%2BdLEyXtStmo%2FpBayUzuDpwk%2BNdHwHEXyspGB%2BpeLXbSMnKqWV0UuOYsM%2FLzr02qfIg7aW3TMzkAh0c%2F3mXJPsURH%2FMBtsaCcTIha6wjwU5v6C0wddVXCc%2BsG%2Fld5CnP4%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
server-timing: cfL4;desc="?proto=QUIC&rtt=8949&sent=29&recv=22&lost=0&retrans=0&sent_bytes=14177&recv_bytes=8360&delivery_rate=891&cwnd=12000&unsent_bytes=0&cid=2fc6bd646173ef59&ts=5350&x=1" cfExtPri cfHdrFlush;dur=0
vary: Accept-Encoding

Redirect headers

cache-control: private, no-cache
cf-ray: 8d723681a86278d3-EWR
content-length: 167
content-type: text/html
date: Wed, 23 Oct 2024 13:53:22 GMT
location: https://mfr4vta5znjrc2dzo2npznkgvm8xmje5agw3ulnisevzngnknk1jng.buytheway.shop/hKFo2SA3QjNIcWI5bmhPdlR1SU9ibzFxMGlRc0x0Ul83clZSa6Fur3VuaXZlcnNhbC1sb2dpbqN0aWTZIFZFWDIzQVV0aThVOEdkVkpKMmRBMFR4VTA5ZnJRc2dzo2NpZNkgVm8xMjE5aGw3UlNiSEVzNGNkNk1JNG8yMVMwYmx5SXE/login.php
server: cloudflare
x-content-type-options: nosniff
x-frame-options: DENY

GET
H2 200 css2
fonts.googleapis.com/ 4 KB
1 KB 78ms
31ms Stylesheet
text/css 2607:f8b0:400d:c0c::5f
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Ubuntu:wght@400;700&display=swap

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:400d:c0c::5f Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

925352670807b63128f00ca857d582fe549ac2cbe5370c5cb9d9e10c9524e01f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://mfr4vta5znjrc2dzo2npznkgvm8xmje5agw3ulnisevzngnknk1jng.buytheway.shop/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Wed, 23 Oct 2024 13:53:22 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 23 Oct 2024 13:53:22 GMT
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified: Wed, 23 Oct 2024 12:16:05 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H2 200 main.cdn.min.css
cdn.auth0.com/ulp/react-components/1.86.8/css/ 271 KB
63 KB 152ms
11ms Stylesheet
text/css 2600:9000:21b8:3c00:10:474e:104a:2961
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.auth0.com/ulp/react-components/1.86.8/css/main.cdn.min.css

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:21b8:3c00:10:474e:104a:2961 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

f31224e5a5b3a5b203782e74fe9cd5fee0e773944204d71961007b918dc8f831

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://mfr4vta5znjrc2dzo2npznkgvm8xmje5agw3ulnisevzngnknk1jng.buytheway.shop/

Response headers

x-robots-tag: noindex
content-encoding: gzip
x-amz-version-id: bsPs2VOfA8R_iNbJY78cdmusrZ7u_0Rl
etag: W/"39ff391ce4ba6d1f4b177d83d47943f4"
age: 24947
x-content-type-options: nosniff
x-cache: Hit from cloudfront
x-amz-cf-id: P3ofT4fSVQ_oJ3jQZVsnxWPQ5UgZKqqrgBuDIj1dE1X3lhdInlIpFg==
date: Wed, 23 Oct 2024 11:08:47 GMT
content-type: text/css
vary: Accept-Encoding
last-modified: Fri, 01 Mar 2024 07:56:10 GMT
strict-transport-security: max-age=63072000; includeSubDomains
x-amz-replication-status: FAILED
cache-control: max-age=86400
via: 1.1 9b0814f74b20835098fe6c38b6ceeac4.cloudfront.net (CloudFront)
x-amz-cf-pop: JFK52-P9
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 badge.png
cdn.auth0.com/styleguide/components/1.0.8/media/logos/img/ 2 KB
2 KB 52ms
9ms Image
image/png 2600:9000:21b8:3c00:10:474e:104a:2961
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.auth0.com/styleguide/components/1.0.8/media/logos/img/badge.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:21b8:3c00:10:474e:104a:2961 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

33fb88f606a3f32f2f218df25dcc69283d9a555a0f8e253f2092f3af53404c11

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://mfr4vta5znjrc2dzo2npznkgvm8xmje5agw3ulnisevzngnknk1jng.buytheway.shop/

Response headers

x-robots-tag: noindex
x-amz-version-id: CghttMoXpqZBzj9pIZwTb7OuGonBat5c
etag: "e3842ac36d4fbd8d4e31a39999c0eba6"
age: 22353
x-content-type-options: nosniff
x-cache: Hit from cloudfront
x-amz-cf-id: yJ-l0peDvZssAx26VjggZIPB5qFPXoTkMGgg8JvZXMbnhwpanl6_BA==
date: Wed, 23 Oct 2024 07:40:50 GMT
content-type: image/png
last-modified: Thu, 04 May 2017 21:37:11 GMT
vary: Accept-Encoding
strict-transport-security: max-age=63072000; includeSubDomains
x-amz-replication-status: COMPLETED
cache-control: max-age=2628000,public
via: 1.1 9b0814f74b20835098fe6c38b6ceeac4.cloudfront.net (CloudFront)
accept-ranges: bytes
content-length: 1591
x-amz-cf-pop: JFK52-P9
server: AmazonS3

GET
H3 200 email-decode.min.js Show response
mfr4vta5znjrc2dzo2npznkgvm8xmje5agw3ulnisevzngnknk1jng.buytheway.shop/cdn-cgi/scripts/5c5dd728/cloudflare-static/ 1 KB
1 KB 11ms
11ms Script
application/javascript 2606:4700:3034::ac43:af9d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://mfr4vta5znjrc2dzo2npznkgvm8xmje5agw3ulnisevzngnknk1jng.buytheway.shop/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3034::ac43:af9d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://mfr4vta5znjrc2dzo2npznkgvm8xmje5agw3ulnisevzngnknk1jng.buytheway.shop/hKFo2SA3QjNIcWI5bmhPdlR1SU9ibzFxMGlRc0x0Ul83clZSa6Fur3VuaXZlcnNhbC1sb2dpbqN0aWTZIFZFWDIzQVV0aThVOEdkVkpKMmRBMFR4VTA5ZnJRc2dzo2NpZNkgVm8xMjE5aGw3UlNiSEVzNGNkNk1JNG8yMVMwYmx5SXE/login.php

Response headers

x-frame-options: DENY
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cache-control: max-age=172800, public
content-encoding: gzip
etag: W/"6712b248-4d7"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LRIlorAN8%2BQsbOP%2B63ieC6JUREaFpzV73rXVPGZtMM5jsYndRWLMS%2B5PtI6p3vQhF2W4LfwgrX7SOWdH3PXPGFhiTDYzOAiibaqsPfRl%2BbgSA5xBdqHmdvrJ7q2%2FpIKY6bZXUSiu%2Fes%2FUf%2FQTfRd%2F0GhKmu0z0ugOUMUsXGwhjFqYaQLbiuu5atdXSJ9fXmDaNz%2BSg2rq7BNn1ukdZFSIkPCRBo%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
cf-ray: 8d723683fa7278d3-EWR
expires: Fri, 25 Oct 2024 13:53:22 GMT
date: Wed, 23 Oct 2024 13:53:22 GMT
content-type: application/javascript
last-modified: Fri, 18 Oct 2024 19:08:56 GMT
server: cloudflare
vary: Accept-Encoding

GET
DATA 200
OK truncated
/ 688 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: fd0c91dae3964654557348546b167581cdac13a2e00555b3c5b73e0981d4b165

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
DATA 200
OK truncated
/ 463 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b4734c8cd4c52f37e397ba0b21555effee5e7e69c840b1d6e31abc171c687897

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
DATA 200
OK truncated
/ 227 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bffa8868ec1b685d9f0442f30636f2f70c5040b059c75ec6ad8c4f3c0aa14eb5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
H3 200 4iCv6KVjbNBYlgoCxCvjsGyN.woff2
fonts.gstatic.com/s/ubuntu/v20/ 29 KB
29 KB 52ms
25ms Font
font/woff2 2607:f8b0:400d:c0b::5e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/ubuntu/v20/4iCv6KVjbNBYlgoCxCvjsGyN.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Ubuntu:wght@400;700&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c0b::5e Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7c00752ce82d6abaed0b9766d35b906b16675facdbe24115b410d1fab975effa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://mfr4vta5znjrc2dzo2npznkgvm8xmje5agw3ulnisevzngnknk1jng.buytheway.shop
Referer: https://fonts.googleapis.com/

Response headers

age: 47152
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Thu, 23 Oct 2025 00:47:30 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 23 Oct 2024 00:47:30 GMT
last-modified: Wed, 27 Apr 2022 17:05:11 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 29752
x-xss-protection: 0
server: sffe

GET
H3 200 4iCs6KVjbNBYlgoKfw72.woff2
fonts.gstatic.com/s/ubuntu/v20/ 34 KB
34 KB 49ms
22ms Font
font/woff2 2607:f8b0:400d:c0b::5e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/ubuntu/v20/4iCs6KVjbNBYlgoKfw72.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Ubuntu:wght@400;700&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:400d:c0b::5e Morganton, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7f653b3ce9d3277457fc6da4edb246ae2f6c913f088c42dcb8cd2e96267aa21a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Origin: https://mfr4vta5znjrc2dzo2npznkgvm8xmje5agw3ulnisevzngnknk1jng.buytheway.shop
Referer: https://fonts.googleapis.com/

Response headers

age: 99585
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Wed, 22 Oct 2025 10:13:37 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 22 Oct 2024 10:13:37 GMT
last-modified: Wed, 27 Apr 2022 16:31:23 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 34852
x-xss-protection: 0
server: sffe

GET
H3 200 cropped-favicon-32x32.png
swissmarketplace.group/wp-content/uploads/2021/11/ 1 KB
2 KB 406ms
304ms Other
image/png 2606:4700:4400::6812:2614
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://swissmarketplace.group/wp-content/uploads/2021/11/cropped-favicon-32x32.png
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:4400::6812:2614 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fae78744b9fece8084bfc98341a4e773a2f527c0288b5834ce90e5cfbebb1961

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Referer: https://mfr4vta5znjrc2dzo2npznkgvm8xmje5agw3ulnisevzngnknk1jng.buytheway.shop/

Response headers

cache-control: public
cf-cache-status: DYNAMIC
cf-ray: 8d723685be4e72a5-EWR
accept-ranges: bytes
alt-svc: h3=":443"; ma=86400
content-length: 1514
date: Wed, 23 Oct 2024 13:53:23 GMT
content-type: image/png
last-modified: Mon, 18 Jul 2022 11:17:11 GMT
vary: Accept-Encoding
server: cloudflare

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Cloudflare (Online)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.mfr4vta5znjrc2dzo2npznkgvm8xmje5agw3ulnisevzngnknk1jng.buytheway.shop/	1970-01-21 00:29:38	Name: __cf_mw_byp Value: v9EJAJzUhYT5QeeAg9ghsDwJZx1FiH1bNr0Uj6Ow.vM-1729691597-0.0.1.1-/hKFo2SA3QjNIcWI5bmhPdlR1SU9ibzFxMGlRc0x0Ul83clZSa6Fur3VuaXZlcnNhbC1sb2dpbqN0aWTZIFZFWDIzQVV0aThVOEdkVkpKMmRBMFR4VTA5ZnJRc2dzo2NpZNkgVm8xMjE5aGw3UlNiSEVzNGNkNk1JNG8yMVMwYmx5SXE/login.php
			.swissmarketplace.group/	1970-01-21 00:28:13	Name: __cf_bm Value: KrepsVGDLTb3dPq4g4rtCPT6ir1ar_3HwVq7gl3dsC4-1729691603-1.0.1.1-Q6wye5A7MmYhUTp8BPDVf1jvyKV.sR7FGqcl6RcrbKQcHJdP1kcOTcm6O5Jcp1v3NSYh9yaCtv1eK92AQTMKPw

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://mfr4vta5znjrc2dzo2npznkgvm8xmje5agw3ulnisevzngnknk1jng.buytheway.shop/hKFo2SA3QjNIcWI5bmhPdlR1SU9ibzFxMGlRc0x0Ul83clZSa6Fur3VuaXZlcnNhbC1sb2dpbqN0aWTZIFZFWDIzQVV0aThVOEdkVkpKMmRBMFR4VTA5ZnJRc2dzo2NpZNkgVm8xMjE5aGw3UlNiSEVzNGNkNk1JNG8yMVMwYmx5SXE/login.php Message: Failed to load resource: the server responded with a status of 403 ()
network	error	URL: https://mfr4vta5znjrc2dzo2npznkgvm8xmje5agw3ulnisevzngnknk1jng.buytheway.shop/favicon.ico Message: Failed to load resource: the server responded with a status of 404 ()
recommendation	verbose	URL: https://mfr4vta5znjrc2dzo2npznkgvm8xmje5agw3ulnisevzngnknk1jng.buytheway.shop/hKFo2SA3QjNIcWI5bmhPdlR1SU9ibzFxMGlRc0x0Ul83clZSa6Fur3VuaXZlcnNhbC1sb2dpbqN0aWTZIFZFWDIzQVV0aThVOEdkVkpKMmRBMFR4VTA5ZnJRc2dzo2NpZNkgVm8xMjE5aGw3UlNiSEVzNGNkNk1JNG8yMVMwYmx5SXE/login.php Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.auth0.com
fonts.googleapis.com
fonts.gstatic.com
mfr4vta5znjrc2dzo2npznkgvm8xmje5agw3ulnisevzngnknk1jng.buytheway.shop
swissmarketplace.group
2600:9000:21b8:3c00:10:474e:104a:2961
2606:4700:3034::ac43:af9d
2606:4700:4400::6812:2614
2607:f8b0:400d:c0b::5e
2607:f8b0:400d:c0c::5f
24904e5dbb5ce723a3b2b80b61035bfdc4f7603b7b39afbd7d3ef2110d131460
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
33fb88f606a3f32f2f218df25dcc69283d9a555a0f8e253f2092f3af53404c11
5f69ea556228be3f0ec886e9f334cc397602a8fe13f03cbaf420f6080f701995
7c00752ce82d6abaed0b9766d35b906b16675facdbe24115b410d1fab975effa
7f653b3ce9d3277457fc6da4edb246ae2f6c913f088c42dcb8cd2e96267aa21a
84e3c77025ace5af143972b4a40fc834dcdfd4e449d4b36a57e62326f16b3091
925352670807b63128f00ca857d582fe549ac2cbe5370c5cb9d9e10c9524e01f
b4734c8cd4c52f37e397ba0b21555effee5e7e69c840b1d6e31abc171c687897
bffa8868ec1b685d9f0442f30636f2f70c5040b059c75ec6ad8c4f3c0aa14eb5
f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016
f31224e5a5b3a5b203782e74fe9cd5fee0e773944204d71961007b918dc8f831
fae78744b9fece8084bfc98341a4e773a2f527c0288b5834ce90e5cfbebb1961
fd0c91dae3964654557348546b167581cdac13a2e00555b3c5b73e0981d4b165
fe933a4f635a538ce956996c180010ef56c42372d24f1c240f1c452f1bbb088f

mfr4vta5znjrc2dzo2npznkgvm8xmje5agw3ulnisevzngnknk1jng.buytheway.shop Open in urlscan Pro 2606:4700:3034::ac43:af9d Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

12 Requests

100 %HTTPS

100 %IPv6

5 Domains

5 Subdomains

6 IPs

1 Countries

157 kBTransfer

425 kBSize

2 Cookies

2 Outgoing links

Page URL History

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 3 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

2 Cookies

3 Console Messages

Security Headers

Indicators

mfr4vta5znjrc2dzo2npznkgvm8xmje5agw3ulnisevzngnknk1jng.buytheway.shop Open in urlscan Pro
2606:4700:3034::ac43:af9d Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

100 %
HTTPS

100 %
IPv6

5
Domains

5
Subdomains

6
IPs

1
Countries

157 kB
Transfer

425 kB
Size

2
Cookies

12 HTTP transactions
3 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!