olxpayment.link Open in urlscan Pro
2606:4700:3033::ac43:d17f  Malicious Activity! Public Scan

1 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request track Show response olxpayment.link/	24 KB 6 KB	294ms 265ms	Document text/html	2606:4700:3033::ac43:d17f CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://olxpayment.link/track?id=562323124 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3033::ac43:d17f , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash df5e45059f6c911de7354f75a333030909b668a3c2b48663100d8281bce6bdbe Request headers :method GET :authority olxpayment.link :scheme https :path /track?id=562323124 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 23 Feb 2021 11:57:02 GMT content-type text/html; charset=UTF-8 set-cookie __cfduid=d7a5fcecd71f6e55c9bdfa8cf9d4f78a51614081421; expires=Thu, 25-Mar-21 11:57:01 GMT; path=/; domain=.olxpayment.link; HttpOnly; SameSite=Lax; Secure __ddg1=dx3g8XhKX1guzUStPFrr; Domain=.olxpayment.link; HttpOnly; Path=/; Expires=Wed, 23-Feb-2022 11:57:01 GMT vary Accept-Encoding cf-cache-status DYNAMIC cf-request-id 0870590aa200004eb620b14000000001 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" report-to {"max_age":604800,"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=TxkSNCEq5FGIuliYIelgaXzHnRZ9w1P5pqhpwRqD5glZ8erOHiBdWX6bwI6qlIPy9PAzC13jJG%2BR1eQFLaTmAw6OlB7TjtfCTVd3syJmzOymPJq%2FWm5VVql66iw%3D"}]} nel {"report_to":"cf-nel","max_age":604800} server cloudflare cf-ray 6260c45769c24eb6-FRA content-encoding br alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
GET H2	200	common.css olxpayment.link/assets/css/	404 KB 64 KB	25ms 24ms	Stylesheet text/css	2606:4700:3033::ac43:d17f CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://olxpayment.link/assets/css/common.css Requested by Host: olxpayment.link URL: https://olxpayment.link/track?id=562323124 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3033::ac43:d17f , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 1b725f674b3b9f763dbd7400f898e3abb5c49e038f816ba268778536f3fe4bda Request headers Referer https://olxpayment.link/track?id=562323124 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 23 Feb 2021 11:57:02 GMT content-encoding br cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 651 alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id 0870590bb000004eb6febfc000000001 last-modified Sat, 26 Dec 2020 21:23:32 GMT server cloudflare etag W/"65121-5b764a71f1d00-gzip" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"max_age":604800,"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=w3rZofqFWi%2FXPsG2T3r5QeO8dVbR2%2Bzv07s7KW16bJa6K92SWpGyFXbh7UI71VoN8MVsB3MpyR8DFfWe4agpS%2FI3jgxkw8eOMfoztcTLsw%2FTDZFoj75uVyrIeeI%3D"}]} content-type text/css cache-control max-age=14400 cf-ray 6260c4591d0c4eb6-FRA
GET H2	200	payments.css olxpayment.link/assets/css/	39 KB 8 KB	14ms 13ms	Stylesheet text/css	2606:4700:3033::ac43:d17f CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://olxpayment.link/assets/css/payments.css Requested by Host: olxpayment.link URL: https://olxpayment.link/track?id=562323124 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3033::ac43:d17f , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 19601dc9c8c99a0e227d86ca446759bd98dff95910e474fea5a9b4e16f5b34e9 Request headers Referer https://olxpayment.link/track?id=562323124 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 23 Feb 2021 11:57:02 GMT content-encoding br cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 651 alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id 0870590bb000004eb6f490a000000001 last-modified Sat, 26 Dec 2020 21:23:49 GMT server cloudflare etag W/"9a36-5b764a8228340-gzip" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"max_age":604800,"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=PBG%2BuJMnpRs6OoLwjSrtnUnBk98ho96TXSm%2BARycUwZzxpvtZBGwpOB%2FW8oW92bRL3LmFYOZ9zqm9uKf2%2Bf7bR3zGZdCXR2wojRwkPFAOotcVCpJKlwpvMeJEF8%3D"}]} content-type text/css cache-control max-age=14400 cf-ray 6260c4591d0f4eb6-FRA
GET H2	200	css2 fonts.googleapis.com/	4 KB 716 B	15ms 14ms	Stylesheet text/css	2a00:1450:4001:829::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap Requested by Host: olxpayment.link URL: https://olxpayment.link/track?id=562323124 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:829::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 2dac82c181db29f567f8c6a98cb9dfc7cede1f4972031d27e374eb50cb6c23b6 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Referer https://olxpayment.link/track?id=562323124 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Tue, 23 Feb 2021 11:05:53 GMT server ESF date Tue, 23 Feb 2021 11:57:02 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Tue, 23 Feb 2021 11:57:02 GMT
GET H2	200	jquery-3.5.1.min.js Show response code.jquery.com/	87 KB 30 KB	31ms 9ms	Script application/javascript	2001:4de0:ac19::1:b:2a HIGHWINDS3
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.5.1.min.js Requested by Host: olxpayment.link URL: https://olxpayment.link/track?id=562323124 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac19::1:b:2a , Netherlands, ASN20446 (HIGHWINDS3, US), Reverse DNS Software nginx / Resource Hash f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d Request headers Referer https://olxpayment.link/track?id=562323124 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 23 Feb 2021 11:57:02 GMT content-encoding gzip last-modified Mon, 04 May 2020 23:02:39 GMT server nginx etag W/"5eb09f0f-15d84" vary Accept-Encoding x-hw 1614081422.dop149.fr8.t,1614081422.cds288.fr8.hn,1614081422.cds142.fr8.c content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 30879
GET H/1.1	200 OK	widget.js Show response k5gaedcez4gnj2qb.user.com/	815 KB 227 KB	220ms 95ms	Script application/javascript	51.91.31.155 OVH
General Check archive.org Show headers Download Go to Full URL https://k5gaedcez4gnj2qb.user.com/widget.js Requested by Host: olxpayment.link URL: https://olxpayment.link/track?id=562323124 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 51.91.31.155 , France, ASN16276 (OVH, FR), Reverse DNS ns3151945.ip-51-91-31.eu Software nginx / Resource Hash ad95259dfdc0cb300ef8b9caa28b6ffe49bdb1590d18e69cd68e5f7188bbd97e Security Headers Name Value X-Frame-Options SAMEORIGIN Request headers Referer https://olxpayment.link/track?id=562323124 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 23 Feb 2021 11:57:02 GMT content-encoding gzip vary Cookie, Origin server nginx x-frame-options SAMEORIGIN content-type application/javascript; charset=utf-8 ue-backend tenants transfer-encoding chunked ue-node apinode1
GET H2	200	upbvQeD.jpg i.imgur.com/	50 KB 50 KB	194ms 125ms	Image image/jpeg	151.101.12.193 FASTLY
General Check archive.org Show headers Download Go to Show image Full URL https://i.imgur.com/upbvQeD.jpg Requested by Host: olxpayment.link URL: https://olxpayment.link/track?id=562323124 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.12.193 Frankfurt am Main, Germany, ASN54113 (FASTLY, US), Reverse DNS Software cat factory 1.0 / Resource Hash 77c9ad3564385296b65d301baeba5481a18e971ecae73a95da373c5ce62c57bf Security Headers Name Value Strict-Transport-Security max-age=300 X-Content-Type-Options nosniff Request headers Referer https://olxpayment.link/track?id=562323124 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 23 Feb 2021 11:57:02 GMT x-content-type-options nosniff age 63758 x-cache HIT, MISS content-length 51247 x-served-by cache-bwi5170-BWI, cache-fra19148-FRA last-modified Mon, 22 Feb 2021 18:14:24 GMT server cat factory 1.0 x-timer S1614081422.382687,VS0,VE95 etag "08dfe7de66da63a6224d5799db3c64b9" strict-transport-security max-age=300 access-control-allow-methods GET, OPTIONS content-type image/jpeg access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes x-cache-hits 1, 0
GET H2	200	secure.62a90a.svg olxpayment.link/assets/img/	1 KB 866 B	11ms 10ms	Image image/svg+xml	2606:4700:3033::ac43:d17f CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://olxpayment.link/assets/img/secure.62a90a.svg Requested by Host: olxpayment.link URL: https://olxpayment.link/assets/css/common.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3033::ac43:d17f , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0ecbc9da79495a5b0460d0cfca200aa6064528d86b749576c18d083386f9a8f0 Request headers Referer https://olxpayment.link/assets/css/common.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 23 Feb 2021 11:57:02 GMT content-encoding br cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 649 alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id 0870590bdd00004eb6e3319000000001 last-modified Sat, 26 Dec 2020 21:59:16 GMT server cloudflare etag W/"47a-5b76526e9f500" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"max_age":604800,"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=SXdMHEiw9CsqQIc4ekGmID%2F5dnLWfOzsrpFCeUFbZ95bdd9pw55P%2B%2F4bZ0KQSESEFt%2FZ14fDnIvp83WKhPwymBOgJPy7444KQu308CN%2FuhnGtMkz1tjU10WkKKg%3D"}]} content-type image/svg+xml cache-control max-age=14400 cf-ray 6260c4596dd04eb6-FRA
GET H2	200	shipping.0b7110.svg olxpayment.link/assets/img/	725 B 713 B	13ms 13ms	Image image/svg+xml	2606:4700:3033::ac43:d17f CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://olxpayment.link/assets/img/shipping.0b7110.svg Requested by Host: olxpayment.link URL: https://olxpayment.link/assets/css/common.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3033::ac43:d17f , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash b3eef1a27fddc5cdb1e308c5417b692a43fabda5e6cd40bb9794d3e09c069fc8 Request headers Referer https://olxpayment.link/assets/css/common.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 23 Feb 2021 11:57:02 GMT content-encoding br cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 649 alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id 0870590bde00004eb6b99c1000000001 last-modified Sat, 26 Dec 2020 21:59:42 GMT server cloudflare etag W/"2d5-5b7652876af80" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"max_age":604800,"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=zrWuSuHXdxnBUSDLUAf1Fta77BQtz53nRo5v0mylJ0czMv5VcAb3y%2FmSMvVv31ZyFEehTvImqjiD6vSHwwdO0AcACgRrgBkcSjWYIZ1jIi4XZAZpFszzvK5Lz5o%3D"}]} content-type image/svg+xml cache-control max-age=14400 cf-ray 6260c4596dd14eb6-FRA
GET H2	200	firasans-medium.6d0873.woff olxpayment.link/assets/fonts/	225 KB 225 KB	14ms 13ms	Font application/font-woff	2606:4700:3033::ac43:d17f CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://olxpayment.link/assets/fonts/firasans-medium.6d0873.woff Requested by Host: olxpayment.link URL: https://olxpayment.link/assets/css/common.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3033::ac43:d17f , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash de5e0262a3af6391ee01b776b710c5ca359321c44000ccf98a13ee10aa1586ba Request headers Origin https://olxpayment.link Referer https://olxpayment.link/assets/css/common.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 23 Feb 2021 11:57:02 GMT content-encoding br cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 487 alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id 0870590bde00004eb6d7362000000001 last-modified Sun, 27 Dec 2020 15:05:29 GMT server cloudflare etag W/"3844c-5b7737cf36040" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"max_age":604800,"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=CWpD1pK0slhPJR3TqN3SH4OL7nSbLS%2F9ZJ2vdc%2BKdSd79RI0S5PsjoXq19j8o7RNrbQa7ioxUYuAinapo4kS37RNnEPf6tljQztVdFBq15mOowWdIkUagZUo7b0%3D"}]} content-type application/font-woff cache-control max-age=14400 cf-ray 6260c4596dd54eb6-FRA
GET DATA	200 OK	truncated /	4 KB 4 KB		Font font/truetype
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 3bdbebe8dcdcdcc3bcd63b11f927e0a5dd0b30ef0234e33669ea5225dee2e7d5 Request headers Origin https://olxpayment.link Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type font/truetype
GET H2	200	opensans-regular.552ea4.woff olxpayment.link/assets/fonts/	66 KB 66 KB	11ms 10ms	Font application/font-woff	2606:4700:3033::ac43:d17f CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://olxpayment.link/assets/fonts/opensans-regular.552ea4.woff Requested by Host: olxpayment.link URL: https://olxpayment.link/assets/css/common.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3033::ac43:d17f , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash fa6ecbd0d617501c0282338390f79e319c2a443098bdfc37d0d77eddfb8c2e60 Request headers Origin https://olxpayment.link Referer https://olxpayment.link/assets/css/common.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 23 Feb 2021 11:57:02 GMT content-encoding br cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 487 alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id 0870590bde00004eb623091000000001 last-modified Sun, 27 Dec 2020 15:06:45 GMT server cloudflare etag W/"107a0-5b773817b0b40" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"max_age":604800,"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=oOygiscJ0LY6jzvZhHdN1GdxbRWcSI9XD1hgTisFZeza4EMnxwI5lG82BHadMtCFfmVb54XqHCpEviTiolapR4oY5lLb4GtsCmUVlZ4XWwr2XGCjPsHqSHblsmc%3D"}]} content-type application/font-woff cache-control max-age=14400 cf-ray 6260c4596dd64eb6-FRA
GET H2	200	opensans-bold.8dd1fb.woff olxpayment.link/assets/fonts/	68 KB 69 KB	17ms 17ms	Font application/font-woff	2606:4700:3033::ac43:d17f CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://olxpayment.link/assets/fonts/opensans-bold.8dd1fb.woff Requested by Host: olxpayment.link URL: https://olxpayment.link/assets/css/common.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3033::ac43:d17f , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e89c6bb76c3c48ca4bbc5aabd73f1a5e52a20194a860cb30e619eb4cfac2ea7a Request headers Origin https://olxpayment.link Referer https://olxpayment.link/assets/css/common.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 23 Feb 2021 11:57:02 GMT content-encoding br cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 487 alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 cf-request-id 0870590bdf00004eb61827a000000001 last-modified Mon, 28 Dec 2020 02:39:50 GMT server cloudflare etag W/"111e8-5b77d3023c980" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"max_age":604800,"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=C1iVfYbOwjuTLs90dnMAq2lclxufPZPcWkclHwR0RtDS%2FtQVsitz22OxAGbIgyhsfd7Kw4CeE8GHZ0IWkmYBagoh30pynVumHa6VMUXYFIhxfdiz5wMuEU2c6g0%3D"}]} content-type application/font-woff cache-control max-age=14400 cf-ray 6260c4596dd74eb6-FRA
OPTIONS H/1.1	200 OK	/ k5gaedcez4gnj2qb.user.com/api/user-chatping/	0 0	163ms 49ms	Other text/html	51.91.31.155 OVH
General Check archive.org Show headers Download Go to Full URL https://k5gaedcez4gnj2qb.user.com/api/user-chatping/ Protocol HTTP/1.1 Server 51.91.31.155 , France, ASN16276 (OVH, FR), Reverse DNS ns3151945.ip-51-91-31.eu Software nginx / Resource Hash Request headers Accept */* Access-Control-Request-Method POST Access-Control-Request-Headers content-type,x-requested-with Origin https://olxpayment.link User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Sec-Fetch-Mode cors Response headers server nginx date Tue, 23 Feb 2021 11:57:02 GMT content-type text/html; charset=utf-8 content-length 0 vary Origin access-control-allow-credentials true access-control-allow-origin https://olxpayment.link access-control-allow-headers accept, accept-encoding, authorization, content-type, dnt, origin, user-agent, x-csrftoken, x-requested-with, set-cookie, clientuser-key, convo-id access-control-allow-methods DELETE, GET, OPTIONS, PATCH, POST, PUT access-control-max-age 86400 ue-backend tenants ue-node apinode5
POST H/1.1	200 OK	/ Show response k5gaedcez4gnj2qb.user.com/api/user-chatping/	2 KB 3 KB	132ms 132ms	Fetch application/json	51.91.31.155 OVH
General Check archive.org Show headers Download Go to Full URL https://k5gaedcez4gnj2qb.user.com/api/user-chatping/ Requested by Host: k5gaedcez4gnj2qb.user.com URL: https://k5gaedcez4gnj2qb.user.com/widget.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 51.91.31.155 , France, ASN16276 (OVH, FR), Reverse DNS ns3151945.ip-51-91-31.eu Software nginx / Resource Hash cd04ce248f0a1d303d7db8b445d40428c1d231979d2400625767010dea77d524 Security Headers Name Value X-Frame-Options SAMEORIGIN Request headers Referer https://olxpayment.link/track?id=562323124 X-Requested-With XMLHttpRequest User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type application/json Response headers date Tue, 23 Feb 2021 11:57:02 GMT vary Cookie, Origin server nginx x-frame-options SAMEORIGIN allow POST, OPTIONS content-type application/json access-control-allow-origin https://olxpayment.link ue-backend tenants access-control-allow-credentials true ue-node apinode3 content-length 2256

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: OLX Group (E-commerce)

20 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery object| civchat function| ueJsonp object| __core-js_shared__ object| core object| regeneratorRuntime function| setImmediate function| clearImmediate object| UE function| userengage

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.olxpayment.link/	1970-01-20 01:06:57	Name: __ddg1 Value: dx3g8XhKX1guzUStPFrr
			.olxpayment.link/	1970-01-19 17:04:33	Name: __cfduid Value: d7a5fcecd71f6e55c9bdfa8cf9d4f78a51614081421

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	warning	URL: https://k5gaedcez4gnj2qb.user.com/widget.js(Line 16) Message: [UserEngage] TypeError: Cannot read property 'getItem' of null

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

code.jquery.com
fonts.googleapis.com
i.imgur.com
k5gaedcez4gnj2qb.user.com
olxpayment.link
151.101.12.193
2001:4de0:ac19::1:b:2a
2606:4700:3033::ac43:d17f
2a00:1450:4001:829::200a
51.91.31.155
0ecbc9da79495a5b0460d0cfca200aa6064528d86b749576c18d083386f9a8f0
19601dc9c8c99a0e227d86ca446759bd98dff95910e474fea5a9b4e16f5b34e9
1b725f674b3b9f763dbd7400f898e3abb5c49e038f816ba268778536f3fe4bda
2dac82c181db29f567f8c6a98cb9dfc7cede1f4972031d27e374eb50cb6c23b6
3bdbebe8dcdcdcc3bcd63b11f927e0a5dd0b30ef0234e33669ea5225dee2e7d5
77c9ad3564385296b65d301baeba5481a18e971ecae73a95da373c5ce62c57bf
ad95259dfdc0cb300ef8b9caa28b6ffe49bdb1590d18e69cd68e5f7188bbd97e
b3eef1a27fddc5cdb1e308c5417b692a43fabda5e6cd40bb9794d3e09c069fc8
cd04ce248f0a1d303d7db8b445d40428c1d231979d2400625767010dea77d524
de5e0262a3af6391ee01b776b710c5ca359321c44000ccf98a13ee10aa1586ba
df5e45059f6c911de7354f75a333030909b668a3c2b48663100d8281bce6bdbe
e89c6bb76c3c48ca4bbc5aabd73f1a5e52a20194a860cb30e619eb4cfac2ea7a
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
fa6ecbd0d617501c0282338390f79e319c2a443098bdfc37d0d77eddfb8c2e60