olka.ie Open in urlscan Pro
192.185.164.98  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response olka.ie/img/we/wetransfer/	2 KB 1 KB	687ms 249ms	Document text/html	192.185.164.98 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Full URL https://olka.ie/img/we/wetransfer/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.185.164.98 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS 192-185-164-98.unifiedlayer.com Software Apache / Resource Hash e5b79617dd359865709c8846a8f028b24fcbc51ee45d09da95ccfbfd65329c72 Request headers :method GET :authority olka.ie :scheme https :path /img/we/wetransfer/ pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Tue, 29 Jun 2021 08:40:10 GMT server Apache vary Accept-Encoding content-encoding gzip content-length 1109 content-type text/html; charset=UTF-8
GET H2	200	bootstrap.min.css maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/	141 KB 18 KB	26ms 25ms	Stylesheet text/css	2606:4700::6812:bcf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/bootstrap.min.css Requested by Host: olka.ie URL: https://olka.ie/img/we/wetransfer/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2c0f3dcfe93d7e380c290fe4ab838ed8cadff1596d62697f5444be460d1f876d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://olka.ie/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Tue, 29 Jun 2021 08:40:11 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT cdn-edgestorageid 601, 718 age 8508898 cdn-cachedat 2021-03-11 11:57:51 cdn-pullzone 252412 cross-origin-resource-policy cross-origin alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 cf-request-id 0af8861a2f00003140a0a6c000000001 timing-allow-origin * access-control-allow-origin * last-modified Mon, 25 Jan 2021 22:04:04 GMT server cloudflare cdn-requestpullcode 200 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/css; charset=utf-8 cdn-cache HIT vary Accept-Encoding cache-control public, max-age=31919000 cdn-uid b1941f61-b576-4f40-80de-5677acb38f74 cdn-requestid 9994d37ab047f74537c0eb44926c02cd cf-ray 666dd93d1c2b3140-FRA cdn-requestcountrycode DE cdn-requestpullsuccess True
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/3.3.1/	85 KB 30 KB	7ms 6ms	Script text/javascript	2a00:1450:4001:811::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js Requested by Host: olka.ie URL: https://olka.ie/img/we/wetransfer/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:811::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://olka.ie/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Tue, 29 Jun 2021 08:38:08 GMT content-encoding gzip x-content-type-options nosniff age 123 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 30399 x-xss-protection 0 last-modified Tue, 03 Mar 2020 19:15:00 GMT server sffe vary Accept-Encoding content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Wed, 29 Jun 2022 08:38:08 GMT
GET H2	200	popper.min.js Show response cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/	19 KB 7 KB	23ms 23ms	Script application/javascript	2606:4700::6810:135e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js Requested by Host: olka.ie URL: https://olka.ie/img/we/wetransfer/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66 Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Referer https://olka.ie/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Tue, 29 Jun 2021 08:40:11 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 2898862 cross-origin-resource-policy cross-origin alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 content-length 6157 cf-request-id 0af8861a2c0000beec6b02b000000001 timing-allow-origin * last-modified Mon, 04 May 2020 16:15:37 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "5eb03fa9-4af4" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=C%2Bwp4SXIMdiR6tgbwjpHzC00pF2P5nVY1oaGlCRI2UcWuQxkr7ChJYlId6%2B8rXFuxvDUJYZmOdZJnC8g6xOqB9Aa0YcAiFDCsJj9H6y08bO4JKGSXAEFHFgXwDhqOm6p5%2B%2FkIZbntKv34SBJXQ%3D%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=30672000 accept-ranges bytes cf-ray 666dd93d18e4beec-FRA expires Sun, 19 Jun 2022 08:40:11 GMT
GET H2	200	2.jpg olka.ie/img/we/wetransfer/img/	7 KB 7 KB	150ms 150ms	Image image/jpeg	192.185.164.98 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Show image Full URL https://olka.ie/img/we/wetransfer/img/2.jpg Requested by Host: olka.ie URL: https://olka.ie/img/we/wetransfer/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.185.164.98 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS 192-185-164-98.unifiedlayer.com Software Apache / Resource Hash f8caf3207186e803510b7c02c6de2818abda8d0720f2764cb4e720a35a4d991e Request headers :path /img/we/wetransfer/img/2.jpg pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority olka.ie referer https://olka.ie/img/we/wetransfer/ :scheme https sec-fetch-site same-origin :method GET Referer https://olka.ie/img/we/wetransfer/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Tue, 29 Jun 2021 08:40:11 GMT last-modified Fri, 17 Apr 2020 12:51:26 GMT server Apache accept-ranges bytes content-length 6929 content-type image/jpeg
GET H2	200	1.jpg olka.ie/img/we/wetransfer/img/	97 KB 98 KB	248ms 248ms	Image image/jpeg	192.185.164.98 UNIFIEDLAYER-AS-1
General Check archive.org Show headers Download Go to Show image Full URL https://olka.ie/img/we/wetransfer/img/1.jpg Requested by Host: olka.ie URL: https://olka.ie/img/we/wetransfer/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.185.164.98 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US), Reverse DNS 192-185-164-98.unifiedlayer.com Software Apache / Resource Hash e9736d366c3a5f328fe7af6de7fc31d0ec79e3227dedb5763a8a95fe9f8489dd Request headers :path /img/we/wetransfer/img/1.jpg pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority olka.ie referer https://olka.ie/img/we/wetransfer/ :scheme https sec-fetch-site same-origin :method GET Referer https://olka.ie/img/we/wetransfer/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Tue, 29 Jun 2021 08:40:11 GMT last-modified Mon, 22 Jun 2020 04:42:58 GMT server Apache accept-ranges bytes content-length 99523 content-type image/jpeg

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: WeTransfer (Online)

14 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery function| Popper

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
cdnjs.cloudflare.com
maxcdn.bootstrapcdn.com
olka.ie
192.185.164.98
2606:4700::6810:135e
2606:4700::6812:bcf
2a00:1450:4001:811::200a
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
2c0f3dcfe93d7e380c290fe4ab838ed8cadff1596d62697f5444be460d1f876d
a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66
e5b79617dd359865709c8846a8f028b24fcbc51ee45d09da95ccfbfd65329c72
e9736d366c3a5f328fe7af6de7fc31d0ec79e3227dedb5763a8a95fe9f8489dd
f8caf3207186e803510b7c02c6de2818abda8d0720f2764cb4e720a35a4d991e