olx.pl-safeordered.work Open in urlscan Pro
94.154.129.50  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

16 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request 161194775 Show response olx.pl-safeordered.work/getpay/	524 KB 87 KB	209ms 145ms	Document text/html	94.154.129.50 LANDGARD-AS
General Check archive.org Show headers Download Go to Full URL https://olx.pl-safeordered.work/getpay/161194775 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 94.154.129.50 Victoria, Seychelles, ASN44015 (LANDGARD-AS, GB), Reverse DNS Software ddos-guard / Resource Hash bb54cf429530212b805ef50716c2ba05bcc6063b94f2a544b2b7cf504563e656 Request headers :method GET :authority olx.pl-safeordered.work :scheme https :path /getpay/161194775 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers server ddos-guard set-cookie __ddg1=9rOIEVltrNq1aP4A9Ot7; Domain=.pl-safeordered.work; HttpOnly; Path=/; Expires=Tue, 17-May-2022 14:00:00 GMT token=hTdCHufb8M; expires=Wed, 16-Jun-2021 14:00:00 GMT; Max-Age=2592000; path=/ date Mon, 17 May 2021 14:00:00 GMT content-type text/html; charset=UTF-8 content-encoding br vary Accept-Encoding
GET H2	200	bootstrap.min.css maxcdn.bootstrapcdn.com/bootstrap/4.5.2/css/	157 KB 21 KB	132ms 25ms	Stylesheet text/css	2606:4700::6812:bcf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://maxcdn.bootstrapcdn.com/bootstrap/4.5.2/css/bootstrap.min.css Requested by Host: olx.pl-safeordered.work URL: https://olx.pl-safeordered.work/getpay/161194775 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 5b0fbe5b7ad705f6a937c4998ad02f73d8f0d976fe231b74aef0ec996990c93a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://olx.pl-safeordered.work/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 17 May 2021 14:00:00 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT cdn-edgestorageid 601, 617 age 4797175 cdn-cachedat 2021-03-11 11:57:51 cdn-pullzone 252412 cross-origin-resource-policy cross-origin alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id 0a1c3975b600009ac83c9fe000000001 timing-allow-origin * access-control-allow-origin * last-modified Mon, 25 Jan 2021 22:04:11 GMT server cloudflare cdn-requestpullcode 200 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type text/css; charset=utf-8 cdn-cache HIT vary Accept-Encoding cache-control public, max-age=31919000 cdn-uid b1941f61-b576-4f40-80de-5677acb38f74 cdn-requestid 542e49561780812596250f098642438a cf-ray 650d5e9c5ec79ac8-FRA cdn-requestcountrycode DE cdn-requestpullsuccess True
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/3.5.1/	87 KB 31 KB	113ms 6ms	Script text/javascript	2a00:1450:4001:80f::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js Requested by Host: olx.pl-safeordered.work URL: https://olx.pl-safeordered.work/getpay/161194775 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://olx.pl-safeordered.work/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sun, 16 May 2021 11:10:41 GMT content-encoding gzip x-content-type-options nosniff age 96559 cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 31021 x-xss-protection 0 last-modified Fri, 08 May 2020 07:05:03 GMT server sffe vary Accept-Encoding content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Mon, 16 May 2022 11:10:41 GMT
GET H2	200	popper.min.js Show response cdnjs.cloudflare.com/ajax/libs/popper.js/1.16.0/umd/	21 KB 7 KB	127ms 20ms	Script application/javascript	2606:4700::6810:125e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.16.0/umd/popper.min.js Requested by Host: olx.pl-safeordered.work URL: https://olx.pl-safeordered.work/getpay/161194775 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash c776195ad46333c6c9a9fe3c74502ffea9a02faf122388ea3567922cc65a3060 Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Referer https://olx.pl-safeordered.work/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 17 May 2021 14:00:00 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 1017453 cross-origin-resource-policy cross-origin alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 6696 cf-request-id 0a1c3975b700002bf66aa1a000000001 timing-allow-origin * last-modified Mon, 04 May 2020 16:15:37 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "5eb03fa9-5309" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=YEWdEo%2Fma1hsJ2g900gruDybMRLaSEOVaVrUUElWE%2FH5ueawwg4fO56gKfDAoc%2BXoSMeUZFqtrP0yT4PHOJTb38MJH5IF%2FcyhxgJZr%2FQ5b0VroFfzg4fYLKJlY0QbBkLGw%3D%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=30672000 accept-ranges bytes cf-ray 650d5e9c59cd2bf6-FRA expires Sat, 07 May 2022 14:00:00 GMT
GET H2	200	bootstrap.min.js Show response maxcdn.bootstrapcdn.com/bootstrap/4.5.2/js/	59 KB 14 KB	137ms 30ms	Script application/javascript	2606:4700::6812:bcf CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://maxcdn.bootstrapcdn.com/bootstrap/4.5.2/js/bootstrap.min.js Requested by Host: olx.pl-safeordered.work URL: https://olx.pl-safeordered.work/getpay/161194775 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 79c599dd760cec0c1621a1af49d9a2a49da5d45e1b37d4575bace0a5e0226582 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://olx.pl-safeordered.work/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 17 May 2021 14:00:00 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT cdn-edgestorageid 601, 617 age 4792623 cdn-cachedat 2021-03-11 11:57:52 cdn-pullzone 252412 cross-origin-resource-policy cross-origin alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id 0a1c3975b600009ac83d31e000000001 timing-allow-origin * access-control-allow-origin * last-modified Mon, 25 Jan 2021 22:04:11 GMT server cloudflare cdn-requestpullcode 200 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/javascript; charset=utf-8 cdn-cache HIT vary Accept-Encoding cache-control public, max-age=31919000 cdn-uid b1941f61-b576-4f40-80de-5677acb38f74 cdn-requestid e455163fbf55c3689672495c4e904ae3 cf-ray 650d5e9c5ec89ac8-FRA cdn-requestcountrycode DE cdn-requestpullsuccess True
GET H2	200	logopl.png olx.pl-safeordered.work/	36 KB 36 KB	22ms 21ms	Image image/png	94.154.129.50 LANDGARD-AS
General Check archive.org Show headers Download Go to Show image Full URL https://olx.pl-safeordered.work/logopl.png Requested by Host: olx.pl-safeordered.work URL: https://olx.pl-safeordered.work/getpay/161194775 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 94.154.129.50 Victoria, Seychelles, ASN44015 (LANDGARD-AS, GB), Reverse DNS Software ddos-guard / Resource Hash fb0177173d8f93fcb350f13ad1a6ee742b53498ba68bc35285adfb5d6c06503f Request headers :path /logopl.png pragma no-cache cookie __ddg1=9rOIEVltrNq1aP4A9Ot7; token=hTdCHufb8M accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority olx.pl-safeordered.work referer https://olx.pl-safeordered.work/getpay/161194775 :scheme https sec-fetch-site same-origin :method GET Referer https://olx.pl-safeordered.work/getpay/161194775 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 17 May 2021 09:47:01 GMT last-modified Mon, 29 Mar 2021 16:11:08 GMT server ddos-guard age 15179 etag "6061fc1c-8fa3" content-type image/png accept-ranges bytes content-length 36771
GET H2	200	image;s=1500x2000 ireland.apollo.olxcdn.com/v1/files/m0ur79ccnofi-PL/	292 KB 292 KB	163ms 87ms	Image image/webp	13.224.95.124 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://ireland.apollo.olxcdn.com/v1/files/m0ur79ccnofi-PL/image;s=1500x2000 Requested by Host: olx.pl-safeordered.work URL: https://olx.pl-safeordered.work/getpay/161194775 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.224.95.124 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-224-95-124.zrh50.r.cloudfront.net Software / Resource Hash 77af0eb61d83a9d09ed47ceb4f6b4185ee9c8ebbdea579a1b53e69d61f693b4c Request headers Referer https://olx.pl-safeordered.work/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 17 May 2021 11:33:42 GMT via 1.1 697e9166a29142e018dae0e083c25f18.cloudfront.net (CloudFront) last-modified Mon, 17 May 2021 11:33:42 GMT age 8778 x-trace c046c630-b030-4497-b136-204b7ba5e64b etag "m0ur79ccnofi-PL" access-control-allow-methods GET, OPTIONS content-type image/webp access-control-allow-origin * cache-control public,max-age=604800 x-cache Hit from cloudfront x-amz-cf-pop ZRH50-C1 content-length 298530 x-amz-cf-id xi6hrWH1PwWfOXOJoA8BqDgAtopxpir5t7leezGK4o-GzBDikH3YpA==
GET H2	404	jquery-1.9.1.js olx.pl-safeordered.work/getpay/build/js/	0 0	30ms 30ms	Script text/html	94.154.129.50 LANDGARD-AS
General Check archive.org Show headers Download Go to Full URL https://olx.pl-safeordered.work/getpay/build/js/jquery-1.9.1.js Requested by Host: olx.pl-safeordered.work URL: https://olx.pl-safeordered.work/getpay/161194775 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 94.154.129.50 Victoria, Seychelles, ASN44015 (LANDGARD-AS, GB), Reverse DNS Software ddos-guard / Resource Hash Request headers :path /getpay/build/js/jquery-1.9.1.js pragma no-cache cookie __ddg1=9rOIEVltrNq1aP4A9Ot7; token=hTdCHufb8M accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept */* cache-control no-cache sec-fetch-dest script :authority olx.pl-safeordered.work referer https://olx.pl-safeordered.work/getpay/161194775 :scheme https sec-fetch-site same-origin :method GET Referer https://olx.pl-safeordered.work/getpay/161194775 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 17 May 2021 14:00:00 GMT content-encoding br server ddos-guard age 0 vary Accept-Encoding content-type text/html; charset=utf8
GET H2	200	btn.png olx.pl-safeordered.work/chat_src/	16 KB 16 KB	36ms 35ms	Image image/png	94.154.129.50 LANDGARD-AS
General Check archive.org Show headers Download Go to Show image Full URL https://olx.pl-safeordered.work/chat_src/btn.png Requested by Host: olx.pl-safeordered.work URL: https://olx.pl-safeordered.work/getpay/161194775 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 94.154.129.50 Victoria, Seychelles, ASN44015 (LANDGARD-AS, GB), Reverse DNS Software ddos-guard / Resource Hash 7c10dfff3076283122a46e43b2fd6c9725dbdc88da4958ef597966193839e9e8 Request headers :path /chat_src/btn.png pragma no-cache cookie __ddg1=9rOIEVltrNq1aP4A9Ot7; token=hTdCHufb8M accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority olx.pl-safeordered.work referer https://olx.pl-safeordered.work/getpay/161194775 :scheme https sec-fetch-site same-origin :method GET Referer https://olx.pl-safeordered.work/getpay/161194775 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 17 May 2021 09:48:16 GMT last-modified Mon, 29 Mar 2021 16:11:08 GMT server ddos-guard age 15104 etag "6061fc1c-3f1d" content-type image/png accept-ranges bytes content-length 16157
GET H2	404	secure.62a90a.svg olx.pl-safeordered.work/build/images/	644 B 644 B	35ms 35ms	Image text/html	94.154.129.50 LANDGARD-AS
General Check archive.org Show headers Download Go to Show image Full URL https://olx.pl-safeordered.work/build/images/secure.62a90a.svg Requested by Host: olx.pl-safeordered.work URL: https://olx.pl-safeordered.work/getpay/161194775 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 94.154.129.50 Victoria, Seychelles, ASN44015 (LANDGARD-AS, GB), Reverse DNS Software ddos-guard / Resource Hash 2e35deffd6cb950e2df39c40edf40dc073ab9652b2ebb64c332ae4cf8512bd3a Request headers :path /build/images/secure.62a90a.svg pragma no-cache cookie __ddg1=9rOIEVltrNq1aP4A9Ot7; token=hTdCHufb8M accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority olx.pl-safeordered.work referer https://olx.pl-safeordered.work/getpay/161194775 :scheme https sec-fetch-site same-origin :method GET Referer https://olx.pl-safeordered.work/getpay/161194775 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 17 May 2021 14:00:00 GMT content-encoding br server ddos-guard age 0 vary Accept-Encoding content-type text/html; charset=utf8
GET H2	200	ac83mcP.png i.imgur.com/	27 KB 28 KB	70ms 23ms	Image image/png	151.101.12.193 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://i.imgur.com/ac83mcP.png Requested by Host: olx.pl-safeordered.work URL: https://olx.pl-safeordered.work/getpay/161194775 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.12.193 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software cat factory 1.0 / Resource Hash 376d7167fc8be8c9744b35b7133e9f64c9de89dee3761ce0057587ce50e9ae55 Security Headers Name Value Strict-Transport-Security max-age=300 X-Content-Type-Options nosniff Request headers Referer https://olx.pl-safeordered.work/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 17 May 2021 14:00:00 GMT x-content-type-options nosniff age 969901 x-cache HIT, HIT content-length 28100 x-served-by cache-bwi5152-BWI, cache-fra19169-FRA last-modified Tue, 26 May 2020 09:21:53 GMT server cat factory 1.0 x-timer S1621260001.807362,VS0,VE1 etag "fc75541e0cc1e1009ea9138203bf0b95" strict-transport-security max-age=300 access-control-allow-methods GET, OPTIONS content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes x-cache-hits 1, 1
GET H2	404	firasans-medium.6d0873.woff olx.pl-safeordered.work/build/fonts/	0 0	35ms 34ms	Font text/html	94.154.129.50 LANDGARD-AS
General Check archive.org Show headers Download Go to Full URL https://olx.pl-safeordered.work/build/fonts/firasans-medium.6d0873.woff Requested by Host: olx.pl-safeordered.work URL: https://olx.pl-safeordered.work/getpay/161194775 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 94.154.129.50 Victoria, Seychelles, ASN44015 (LANDGARD-AS, GB), Reverse DNS Software ddos-guard / Resource Hash Request headers sec-fetch-mode cors origin https://olx.pl-safeordered.work accept-encoding gzip, deflate, br accept-language en-US sec-fetch-dest font cookie __ddg1=9rOIEVltrNq1aP4A9Ot7; token=hTdCHufb8M :path /build/fonts/firasans-medium.6d0873.woff pragma no-cache user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 accept */* cache-control no-cache :authority olx.pl-safeordered.work referer https://olx.pl-safeordered.work/getpay/161194775 :scheme https sec-fetch-site same-origin :method GET Origin https://olx.pl-safeordered.work Referer https://olx.pl-safeordered.work/getpay/161194775 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 17 May 2021 14:00:00 GMT content-encoding br server ddos-guard age 0 vary Accept-Encoding content-type text/html; charset=utf8
GET H2	404	firasans-medium.12a58b.ttf olx.pl-safeordered.work/build/fonts/	0 0	30ms 30ms	Font text/html	94.154.129.50 LANDGARD-AS
General Check archive.org Show headers Download Go to Full URL https://olx.pl-safeordered.work/build/fonts/firasans-medium.12a58b.ttf Requested by Host: olx.pl-safeordered.work URL: https://olx.pl-safeordered.work/getpay/161194775 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 94.154.129.50 Victoria, Seychelles, ASN44015 (LANDGARD-AS, GB), Reverse DNS Software ddos-guard / Resource Hash Request headers sec-fetch-mode cors origin https://olx.pl-safeordered.work accept-encoding gzip, deflate, br accept-language en-US sec-fetch-dest font cookie __ddg1=9rOIEVltrNq1aP4A9Ot7; token=hTdCHufb8M :path /build/fonts/firasans-medium.12a58b.ttf pragma no-cache user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 accept */* cache-control no-cache :authority olx.pl-safeordered.work referer https://olx.pl-safeordered.work/getpay/161194775 :scheme https sec-fetch-site same-origin :method GET Origin https://olx.pl-safeordered.work Referer https://olx.pl-safeordered.work/getpay/161194775 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 17 May 2021 14:00:00 GMT content-encoding br server ddos-guard age 0 vary Accept-Encoding content-type text/html; charset=utf8
POST H2	200	message.php Show response olx.pl-safeordered.work/chat_src/	2 B 30 B	97ms 97ms	XHR text/html	94.154.129.50 LANDGARD-AS
General Check archive.org Show headers Download Go to Full URL https://olx.pl-safeordered.work/chat_src/message.php Requested by Host: olx.pl-safeordered.work URL: https://olx.pl-safeordered.work/getpay/161194775 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 94.154.129.50 Victoria, Seychelles, ASN44015 (LANDGARD-AS, GB), Reverse DNS Software ddos-guard / Resource Hash 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945 Request headers sec-fetch-mode cors origin https://olx.pl-safeordered.work accept-encoding gzip, deflate, br accept-language en-US sec-fetch-dest empty cookie __ddg1=9rOIEVltrNq1aP4A9Ot7; token=hTdCHufb8M content-length 22 :path /chat_src/message.php pragma no-cache user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 content-type application/x-www-form-urlencoded accept */* cache-control no-cache :authority olx.pl-safeordered.work referer https://olx.pl-safeordered.work/getpay/161194775 :scheme https sec-fetch-site same-origin :method POST Referer https://olx.pl-safeordered.work/getpay/161194775 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Content-type application/x-www-form-urlencoded Response headers date Mon, 17 May 2021 14:00:00 GMT content-encoding br server ddos-guard vary Accept-Encoding content-type text/html; charset=UTF-8
GET H2	404	opensans-semibold.1d8cbd.woff olx.pl-safeordered.work/build/fonts/	0 0	30ms 29ms	Font text/html	94.154.129.50 LANDGARD-AS
General Check archive.org Show headers Download Go to Full URL https://olx.pl-safeordered.work/build/fonts/opensans-semibold.1d8cbd.woff Requested by Host: olx.pl-safeordered.work URL: https://olx.pl-safeordered.work/getpay/161194775 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 94.154.129.50 Victoria, Seychelles, ASN44015 (LANDGARD-AS, GB), Reverse DNS Software ddos-guard / Resource Hash Request headers sec-fetch-mode cors origin https://olx.pl-safeordered.work accept-encoding gzip, deflate, br accept-language en-US sec-fetch-dest font cookie __ddg1=9rOIEVltrNq1aP4A9Ot7; token=hTdCHufb8M :path /build/fonts/opensans-semibold.1d8cbd.woff pragma no-cache user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 accept */* cache-control no-cache :authority olx.pl-safeordered.work referer https://olx.pl-safeordered.work/getpay/161194775 :scheme https sec-fetch-site same-origin :method GET Origin https://olx.pl-safeordered.work Referer https://olx.pl-safeordered.work/getpay/161194775 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 17 May 2021 14:00:00 GMT content-encoding br server ddos-guard age 0 vary Accept-Encoding content-type text/html; charset=utf8
GET H2	404	opensans-semibold.e1c83f.ttf olx.pl-safeordered.work/build/fonts/	0 0	30ms 30ms	Font text/html	94.154.129.50 LANDGARD-AS
General Check archive.org Show headers Download Go to Full URL https://olx.pl-safeordered.work/build/fonts/opensans-semibold.e1c83f.ttf Requested by Host: olx.pl-safeordered.work URL: https://olx.pl-safeordered.work/getpay/161194775 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 94.154.129.50 Victoria, Seychelles, ASN44015 (LANDGARD-AS, GB), Reverse DNS Software ddos-guard / Resource Hash Request headers sec-fetch-mode cors origin https://olx.pl-safeordered.work accept-encoding gzip, deflate, br accept-language en-US sec-fetch-dest font cookie __ddg1=9rOIEVltrNq1aP4A9Ot7; token=hTdCHufb8M :path /build/fonts/opensans-semibold.e1c83f.ttf pragma no-cache user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 accept */* cache-control no-cache :authority olx.pl-safeordered.work referer https://olx.pl-safeordered.work/getpay/161194775 :scheme https sec-fetch-site same-origin :method GET Origin https://olx.pl-safeordered.work Referer https://olx.pl-safeordered.work/getpay/161194775 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 17 May 2021 14:00:00 GMT content-encoding br server ddos-guard age 0 vary Accept-Encoding content-type text/html; charset=utf8

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: OLX Group (E-commerce)

27 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery function| Popper object| bootstrap function| openChat function| sendMessage object| xhttp number| myVar function| updateChat function| getCurTime function| getTime function| getCookie function| setCookie function| openForm function| closeForm object| input

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			olx.pl-safeordered.work/	1970-01-19 19:04:12	Name: token Value: hTdCHufb8M
			.pl-safeordered.work/	1970-01-20 03:06:36	Name: __ddg1 Value: 9rOIEVltrNq1aP4A9Ot7

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
cdnjs.cloudflare.com
i.imgur.com
ireland.apollo.olxcdn.com
maxcdn.bootstrapcdn.com
olx.pl-safeordered.work
13.224.95.124
151.101.12.193
2606:4700::6810:125e
2606:4700::6812:bcf
2a00:1450:4001:80f::200a
94.154.129.50
2e35deffd6cb950e2df39c40edf40dc073ab9652b2ebb64c332ae4cf8512bd3a
376d7167fc8be8c9744b35b7133e9f64c9de89dee3761ce0057587ce50e9ae55
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
5b0fbe5b7ad705f6a937c4998ad02f73d8f0d976fe231b74aef0ec996990c93a
77af0eb61d83a9d09ed47ceb4f6b4185ee9c8ebbdea579a1b53e69d61f693b4c
79c599dd760cec0c1621a1af49d9a2a49da5d45e1b37d4575bace0a5e0226582
7c10dfff3076283122a46e43b2fd6c9725dbdc88da4958ef597966193839e9e8
bb54cf429530212b805ef50716c2ba05bcc6063b94f2a544b2b7cf504563e656
c776195ad46333c6c9a9fe3c74502ffea9a02faf122388ea3567922cc65a3060
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
fb0177173d8f93fcb350f13ad1a6ee742b53498ba68bc35285adfb5d6c06503f