olxpayment.link
Open in
urlscan Pro
2606:4700:3033::ac43:d17f
Malicious Activity!
Public Scan
Submission: On February 23 via manual from PL
Summary
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on February 22nd 2021. Valid for: a year.
This is the only time olxpayment.link was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: OLX Group (E-commerce)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
8 | 2606:4700:303... 2606:4700:3033::ac43:d17f | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a00:1450:400... 2a00:1450:4001:829::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 2001:4de0:ac1... 2001:4de0:ac19::1:b:2a | 20446 (HIGHWINDS3) (HIGHWINDS3) | |
3 | 51.91.31.155 51.91.31.155 | 16276 (OVH) (OVH) | |
1 | 151.101.12.193 151.101.12.193 | 54113 (FASTLY) (FASTLY) | |
14 | 6 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
8 |
olxpayment.link
olxpayment.link |
440 KB |
3 |
user.com
k5gaedcez4gnj2qb.user.com |
230 KB |
1 |
imgur.com
i.imgur.com |
50 KB |
1 |
jquery.com
code.jquery.com |
30 KB |
1 |
googleapis.com
fonts.googleapis.com |
716 B |
14 | 5 |
Domain | Requested by | |
---|---|---|
8 | olxpayment.link |
olxpayment.link
|
3 | k5gaedcez4gnj2qb.user.com |
olxpayment.link
k5gaedcez4gnj2qb.user.com |
1 | i.imgur.com |
olxpayment.link
|
1 | code.jquery.com |
olxpayment.link
|
1 | fonts.googleapis.com |
olxpayment.link
|
14 | 5 |
This site contains links to these domains. Also see Links.
Domain |
---|
help.olx.pl |
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2021-02-22 - 2022-02-21 |
a year | crt.sh |
upload.video.google.com GTS CA 1O1 |
2021-01-26 - 2021-04-20 |
3 months | crt.sh |
jquery.org Sectigo RSA Domain Validation Secure Server CA |
2020-10-06 - 2021-10-16 |
a year | crt.sh |
*.user.com Certum Domain Validation CA SHA2 |
2020-10-26 - 2021-10-26 |
a year | crt.sh |
*.imgur.com DigiCert SHA2 Secure Server CA |
2020-01-15 - 2022-03-16 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
https://olxpayment.link/track?id=562323124
Frame ID: F9F11E9AD58BCBEB1DE8C77F05808643
Requests: 14 HTTP requests in this frame
Screenshot
Detected technologies
CloudFlare (CDN) ExpandDetected patterns
- headers server /^cloudflare$/i
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: Umowy sprzedaży
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
14 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
track
olxpayment.link/ |
24 KB 6 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
common.css
olxpayment.link/assets/css/ |
404 KB 64 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
payments.css
olxpayment.link/assets/css/ |
39 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css2
fonts.googleapis.com/ |
4 KB 716 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.5.1.min.js
code.jquery.com/ |
87 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
widget.js
k5gaedcez4gnj2qb.user.com/ |
815 KB 227 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
upbvQeD.jpg
i.imgur.com/ |
50 KB 50 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
secure.62a90a.svg
olxpayment.link/assets/img/ |
1 KB 866 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
shipping.0b7110.svg
olxpayment.link/assets/img/ |
725 B 713 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
firasans-medium.6d0873.woff
olxpayment.link/assets/fonts/ |
225 KB 225 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
4 KB 4 KB |
Font
font/truetype |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
opensans-regular.552ea4.woff
olxpayment.link/assets/fonts/ |
66 KB 66 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
opensans-bold.8dd1fb.woff
olxpayment.link/assets/fonts/ |
68 KB 69 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H/1.1 |
/
k5gaedcez4gnj2qb.user.com/api/user-chatping/ |
0 0 |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
/
k5gaedcez4gnj2qb.user.com/api/user-chatping/ |
2 KB 3 KB |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: OLX Group (E-commerce)20 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery object| civchat function| ueJsonp object| __core-js_shared__ object| core object| regeneratorRuntime function| setImmediate function| clearImmediate object| UE function| userengage2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.olxpayment.link/ | Name: __ddg1 Value: dx3g8XhKX1guzUStPFrr |
|
.olxpayment.link/ | Name: __cfduid Value: d7a5fcecd71f6e55c9bdfa8cf9d4f78a51614081421 |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
code.jquery.com
fonts.googleapis.com
i.imgur.com
k5gaedcez4gnj2qb.user.com
olxpayment.link
151.101.12.193
2001:4de0:ac19::1:b:2a
2606:4700:3033::ac43:d17f
2a00:1450:4001:829::200a
51.91.31.155
0ecbc9da79495a5b0460d0cfca200aa6064528d86b749576c18d083386f9a8f0
19601dc9c8c99a0e227d86ca446759bd98dff95910e474fea5a9b4e16f5b34e9
1b725f674b3b9f763dbd7400f898e3abb5c49e038f816ba268778536f3fe4bda
2dac82c181db29f567f8c6a98cb9dfc7cede1f4972031d27e374eb50cb6c23b6
3bdbebe8dcdcdcc3bcd63b11f927e0a5dd0b30ef0234e33669ea5225dee2e7d5
77c9ad3564385296b65d301baeba5481a18e971ecae73a95da373c5ce62c57bf
ad95259dfdc0cb300ef8b9caa28b6ffe49bdb1590d18e69cd68e5f7188bbd97e
b3eef1a27fddc5cdb1e308c5417b692a43fabda5e6cd40bb9794d3e09c069fc8
cd04ce248f0a1d303d7db8b445d40428c1d231979d2400625767010dea77d524
de5e0262a3af6391ee01b776b710c5ca359321c44000ccf98a13ee10aa1586ba
df5e45059f6c911de7354f75a333030909b668a3c2b48663100d8281bce6bdbe
e89c6bb76c3c48ca4bbc5aabd73f1a5e52a20194a860cb30e619eb4cfac2ea7a
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
fa6ecbd0d617501c0282338390f79e319c2a443098bdfc37d0d77eddfb8c2e60