olx-poland.cf
Open in
urlscan Pro
2a04:5200:fff8::eef
Malicious Activity!
Public Scan
Submission: On October 30 via api from PL
Summary
TLS certificate: Issued by Let's Encrypt Authority X3 on October 29th 2020. Valid for: 3 months.
This is the only time olx-poland.cf was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: OLX Group (E-commerce)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
14 | 2a04:5200:fff... 2a04:5200:fff8::eef | 50113 (SUPERSERV...) (SUPERSERVERSDATACENTER) | |
1 | 176.126.172.116 176.126.172.116 | 5588 (GTSCE GTS...) (GTSCE GTS Central Europe / Antel Germany) | |
3 | 151.101.112.193 151.101.112.193 | 54113 (FASTLY) (FASTLY) | |
1 | 194.99.117.15 194.99.117.15 | 48565 (POCZTAPOL...) (POCZTAPOLSKA-AS) | |
19 | 4 |
ASN5588 (GTSCE GTS Central Europe / Antel Germany, CZ)
PTR: cw176-abf-agb116.romania-webhosting.com
www.romaniajournal.ro |
ASN48565 (POCZTAPOLSKA-AS, PL)
PTR: www.poczta-polska.pl
www.poczta-polska.pl |
Apex Domain Subdomains |
Transfer | |
---|---|---|
14 |
olx-poland.cf
olx-poland.cf |
688 KB |
3 |
imgur.com
i.imgur.com |
81 KB |
1 |
poczta-polska.pl
www.poczta-polska.pl |
2 KB |
1 |
romaniajournal.ro
www.romaniajournal.ro |
36 KB |
19 | 4 |
Domain | Requested by | |
---|---|---|
14 | olx-poland.cf |
olx-poland.cf
|
3 | i.imgur.com |
olx-poland.cf
|
1 | www.poczta-polska.pl |
olx-poland.cf
|
1 | www.romaniajournal.ro |
olx-poland.cf
|
19 | 4 |
This site contains links to these domains. Also see Links.
Domain |
---|
kufar.by |
www.poczta-polska.pl |
novaposhta.ua |
Subject Issuer | Validity | Valid | |
---|---|---|---|
olx-poland.cf Let's Encrypt Authority X3 |
2020-10-29 - 2021-01-27 |
3 months | crt.sh |
www.romaniajournal.ro Sectigo RSA Domain Validation Secure Server CA |
2019-02-26 - 2021-02-25 |
2 years | crt.sh |
*.imgur.com DigiCert SHA2 Secure Server CA |
2020-01-15 - 2022-03-16 |
2 years | crt.sh |
*.poczta-polska.pl Certum Organization Validation CA SHA2 |
2020-10-13 - 2021-10-13 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://olx-poland.cf/get/?id=10007311
Frame ID: D139A09396F5EB00506CE81DCBB48481
Requests: 19 HTTP requests in this frame
3 Outgoing links
These are links going to different origins than the main page.
Title:
Search URL Search Domain Scan URL
Title: Zgoda użytkownika
Search URL Search Domain Scan URL
Title: Umowy sprzedaży
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
19 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
olx-poland.cf/get/ |
16 KB 16 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
css
olx-poland.cf/get/index_files/ |
26 KB 26 KB |
Stylesheet
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ultra.css
olx-poland.cf/get/index_files/ |
500 KB 500 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
OLX_Rebranding.png
www.romaniajournal.ro/wp-content/uploads/2020/04/ |
35 KB 36 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
0rAIKhD.jpg
i.imgur.com/ |
53 KB 53 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
AivRlby.png
i.imgur.com/ |
759 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo.png
www.poczta-polska.pl/hermes/themes/poczta-polska/skin/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
client.js.%D0%91%D0%B5%D0%B7%20%D0%BD%D0%B0%D0%B7%D0%B2%D0%B0%D0%BD%D0%B8%D1%8F
olx-poland.cf/get/index_files/ |
3 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-1.9.1.js.%D0%91%D0%B5%D0%B7%20%D0%BD%D0%B0%D0%B7%D0%B2%D0%B0%D0%BD%D0%B8%D1%8F
olx-poland.cf/get/index_files/ |
142 KB 142 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
secure.62a90a.svg
olx-poland.cf/build/images/ |
228 B 228 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ac83mcP.png
i.imgur.com/ |
27 KB 28 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
opensans-bold.8dd1fb.woff
olx-poland.cf/build/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
opensans-regular.552ea4.woff
olx-poland.cf/build/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
opensans-semibold.1d8cbd.woff
olx-poland.cf/build/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
opensans-bold.f5331c.ttf
olx-poland.cf/build/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
opensans-semibold.e1c83f.ttf
olx-poland.cf/build/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
opensans-regular.d7d5d4.ttf
olx-poland.cf/build/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
firasans-regular.200d5e.woff
olx-poland.cf/build/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
firasans-regular.b0aa19.ttf
olx-poland.cf/build/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: OLX Group (E-commerce)7 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes object| replainSettings function| $ function| jQuery0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
i.imgur.com
olx-poland.cf
www.poczta-polska.pl
www.romaniajournal.ro
151.101.112.193
176.126.172.116
194.99.117.15
2a04:5200:fff8::eef
2c3d150dcc38b57e953789481ffd4b7e8eb4ca531f8091f8a2a600aaff20a057
376d7167fc8be8c9744b35b7133e9f64c9de89dee3761ce0057587ce50e9ae55
428efb37de2e20be923b92190c12f3f6169af7e3a93453e34a4fa23dcd1d71e6
486b6fe4741a60429594937cc1f923a177f38ca166f82c3b7d97289db8b3e724
54b2ef01c2b30155748b646dd443d4abdd1e85a9bb0a3ce26235fbfa032cdfda
73fefeda7c37a26f7ffa5b3581875ab9cf2566558e2186b16a9fec8df37a3479
749d9c91b6b74f674f092084776992be8adc19c89056a10bdbc5112bacfef41d
9f8852076421b4aefd9d9f903e8bc6cfbb855200b45e5f52970e7a604e4bdd4b
bffc353fcd98b8c3fd77fad0117dc6ce41ab85a046a60989f27b6d3d6bc63036
c7eacdb2a7083676da919493906be8eadd1dc505b8d8d714b4a885af113bf9a5
e829c9c81e8ac1d318bc697e5daa970bdcb65e6cddcada3c66f26547510ec4a1