Submitted URL: http://transbankorder.xyz/
Effective URL: https://queryitem.buzz/banking/
Submission: On September 18 via api from US

Summary

This website contacted 2 IPs in 4 countries across 4 domains to perform 28 HTTP transactions. The main IP is 190.115.18.246, located in Belize and belongs to DDOS-GUARD CORP., BZ. The main domain is queryitem.buzz.
TLS certificate: Issued by Let's Encrypt Authority X3 on September 17th 2020. Valid for: 3 months.
This is the only time queryitem.buzz was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Banking (Banking)

Domain & IP information

IP Address AS Autonomous System
1 1 192.64.119.22 22612 (NAMECHEAP...)
1 1 176.119.30.22 30860 (YURTEH-AS)
1 27 190.115.18.246 262254 (DDOS-GUAR...)
2 185.129.100.100 57724 (DDOS-GUARD)
28 2
Apex Domain
Subdomains
Transfer
27 queryitem.buzz
queryitem.buzz
386 KB
2 ddos-guard.net
check.ddos-guard.net
767 B
1 paymentcassa.xyz
paymentcassa.xyz
570 B
1 transbankorder.xyz
transbankorder.xyz
292 B
28 4
Domain Requested by
27 queryitem.buzz 1 redirects queryitem.buzz
2 check.ddos-guard.net queryitem.buzz
1 paymentcassa.xyz 1 redirects
1 transbankorder.xyz 1 redirects
28 4

This site contains no links.

Subject Issuer Validity Valid
queryitem.buzz
Let's Encrypt Authority X3
2020-09-17 -
2020-12-16
3 months crt.sh
*.ddos-guard.net
Sectigo RSA Domain Validation Secure Server CA
2019-07-03 -
2021-07-02
2 years crt.sh

This page contains 1 frames:

Primary Page: https://queryitem.buzz/banking/
Frame ID: 1444EF42080303225868D2285B3739DE
Requests: 28 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. http://transbankorder.xyz/ HTTP 302
    https://paymentcassa.xyz/catalog?userId=15969746427171083&productId=15954098002106839 HTTP 301
    https://queryitem.buzz/banking HTTP 301
    http://queryitem.buzz/banking/ HTTP 307
    https://queryitem.buzz/banking/ Page URL

Page Statistics

28
Requests

100 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

2
IPs

4
Countries

386 kB
Transfer

485 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://transbankorder.xyz/ HTTP 302
    https://paymentcassa.xyz/catalog?userId=15969746427171083&productId=15954098002106839 HTTP 301
    https://queryitem.buzz/banking HTTP 301
    http://queryitem.buzz/banking/ HTTP 307
    https://queryitem.buzz/banking/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

28 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
queryitem.buzz/banking/
Redirect Chain
  • http://transbankorder.xyz/
  • https://paymentcassa.xyz/catalog?userId=15969746427171083&productId=15954098002106839
  • https://queryitem.buzz/banking
  • http://queryitem.buzz/banking/
  • https://queryitem.buzz/banking/
8 KB
3 KB
Document
General
Full URL
https://queryitem.buzz/banking/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
190.115.18.246 , Belize, ASN262254 (DDOS-GUARD CORP., BZ),
Reverse DNS
owner.bityoung.net
Software
ddos-guard /
Resource Hash
f9962cdd7000f1faf4ac777134caa7068dc850053f1f7a47d89402ff12b2f402
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
Strict-Transport-Security max-age=2628000

Request headers

:method
GET
:authority
queryitem.buzz
:scheme
https
:path
/banking/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
__ddg1=rfdtBzYMyUAXEdAWtPQs
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
200
server
ddos-guard
strict-transport-security
max-age=2628000
content-security-policy
upgrade-insecure-requests;
date
Fri, 18 Sep 2020 09:48:57 GMT
last-modified
Sun, 09 Aug 2020 00:09:36 GMT
etag
W/"1ebe-5ac66a73e4b52"
accept-ranges
bytes
content-type
text/html; charset=UTF-8
content-encoding
br
vary
Accept-Encoding

Redirect headers

Location
https://queryitem.buzz/banking/
Non-Authoritative-Reason
HSTS
trustuniEPbnk.css
queryitem.buzz/banking/
4 KB
776 B
Stylesheet
General
Full URL
https://queryitem.buzz/banking/trustuniEPbnk.css
Requested by
Host: queryitem.buzz
URL: https://queryitem.buzz/banking/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
190.115.18.246 , Belize, ASN262254 (DDOS-GUARD CORP., BZ),
Reverse DNS
owner.bityoung.net
Software
ddos-guard /
Resource Hash
f175f0beee2c45e190e07d8171e5bca9f96d14ea154440b3da82d4ba2a64fd91
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
Strict-Transport-Security max-age=2628000

Request headers

Referer
https://queryitem.buzz/banking/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=2628000
content-encoding
br
last-modified
Sun, 09 Aug 2020 00:09:36 GMT
server
ddos-guard
etag
W/"e4f-5ac66a73e89d2"
vary
Accept-Encoding
content-type
text/css
status
200
date
Fri, 18 Sep 2020 09:48:57 GMT
content-security-policy
upgrade-insecure-requests;
accept-ranges
bytes
index.css
queryitem.buzz/banking/
91 KB
8 KB
Stylesheet
General
Full URL
https://queryitem.buzz/banking/index.css
Requested by
Host: queryitem.buzz
URL: https://queryitem.buzz/banking/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
190.115.18.246 , Belize, ASN262254 (DDOS-GUARD CORP., BZ),
Reverse DNS
owner.bityoung.net
Software
ddos-guard /
Resource Hash
0ff0448cc3005328fd2365cf91c03b10f451e15f5718bebdae34c48174261bd3
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
Strict-Transport-Security max-age=2628000

Request headers

Referer
https://queryitem.buzz/banking/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=2628000
content-encoding
br
last-modified
Sun, 09 Aug 2020 00:09:36 GMT
server
ddos-guard
etag
W/"16c37-5ac66a73dda0a"
vary
Accept-Encoding
content-type
text/css
status
200
date
Fri, 18 Sep 2020 09:48:57 GMT
content-security-policy
upgrade-insecure-requests;
accept-ranges
bytes
check.js
check.ddos-guard.net/
152 B
491 B
Script
General
Full URL
https://check.ddos-guard.net/check.js
Requested by
Host: queryitem.buzz
URL: https://queryitem.buzz/banking/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
185.129.100.100 , Russian Federation, ASN57724 (DDOS-GUARD, RU),
Reverse DNS
ddos-guard.net
Software
ddos-guard /
Resource Hash
c6fac8fcb88c71e005137ea6d30e5a0791d44692e960c32833aa5b552f32c969

Request headers

Referer
https://queryitem.buzz/banking/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Fri, 18 Sep 2020 09:48:57 GMT
last-modified
Thu, 01 Jan 1970 00:00:00 GMT
server
ddos-guard
etag
7DYyG4ugmjIunbvc
p3p
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
status
200
cache-control
private, s-maxage=0, max-age=31536000
content-type
application/javascript
content-length
152
expires
Sat, 18 Sep 2021 09:48:57 GMT
11.png
queryitem.buzz/banking/images/
33 KB
34 KB
Image
General
Full URL
https://queryitem.buzz/banking/images/11.png
Requested by
Host: queryitem.buzz
URL: https://queryitem.buzz/banking/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
190.115.18.246 , Belize, ASN262254 (DDOS-GUARD CORP., BZ),
Reverse DNS
owner.bityoung.net
Software
ddos-guard /
Resource Hash
0075174bdf083d22b69003025b3f6caeb9b3efe2526767c21d2ffb789bf48109
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
Strict-Transport-Security max-age=2628000

Request headers

Referer
https://queryitem.buzz/banking/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=2628000
last-modified
Sun, 09 Aug 2020 00:09:35 GMT
server
ddos-guard
etag
"85a2-5ac66a73b3643"
content-type
image/png
status
200
date
Fri, 18 Sep 2020 09:48:58 GMT
content-security-policy
upgrade-insecure-requests;
accept-ranges
bytes
content-length
34210
n1.png
queryitem.buzz/banking/images/
867 B
917 B
Image
General
Full URL
https://queryitem.buzz/banking/images/n1.png
Requested by
Host: queryitem.buzz
URL: https://queryitem.buzz/banking/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
190.115.18.246 , Belize, ASN262254 (DDOS-GUARD CORP., BZ),
Reverse DNS
owner.bityoung.net
Software
ddos-guard /
Resource Hash
7743b93bfe418d7c0daaf0911fb442de1e50ae11d8048864fa25db7a147edf6b
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
Strict-Transport-Security max-age=2628000

Request headers

Referer
https://queryitem.buzz/banking/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=2628000
last-modified
Sun, 09 Aug 2020 00:09:35 GMT
server
ddos-guard
etag
"363-5ac66a73ab943"
content-type
image/png
status
200
date
Fri, 18 Sep 2020 09:48:58 GMT
content-security-policy
upgrade-insecure-requests;
accept-ranges
bytes
content-length
867
ftr8899.png
queryitem.buzz/banking/images/
9 KB
10 KB
Image
General
Full URL
https://queryitem.buzz/banking/images/ftr8899.png
Requested by
Host: queryitem.buzz
URL: https://queryitem.buzz/banking/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
190.115.18.246 , Belize, ASN262254 (DDOS-GUARD CORP., BZ),
Reverse DNS
owner.bityoung.net
Software
ddos-guard /
Resource Hash
41d82061b87b8339aaf1aef9dd32c3dbb8c1994bcaaf0716fdb8451b47b20a1f
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
Strict-Transport-Security max-age=2628000

Request headers

Referer
https://queryitem.buzz/banking/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=2628000
last-modified
Sun, 09 Aug 2020 00:09:35 GMT
server
ddos-guard
etag
"25db-5ac66a73d2272"
content-type
image/png
status
200
date
Fri, 18 Sep 2020 09:48:57 GMT
content-security-policy
upgrade-insecure-requests;
accept-ranges
bytes
content-length
9691
1291-201904181109032.gif
queryitem.buzz/banking/images/
88 KB
88 KB
Image
General
Full URL
https://queryitem.buzz/banking/images/1291-201904181109032.gif
Requested by
Host: queryitem.buzz
URL: https://queryitem.buzz/banking/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
190.115.18.246 , Belize, ASN262254 (DDOS-GUARD CORP., BZ),
Reverse DNS
owner.bityoung.net
Software
ddos-guard /
Resource Hash
01334268dcf9acf9cf06d013256802ac5ae71c8c8dd3102eb39bc1e89a307d29
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
Strict-Transport-Security max-age=2628000

Request headers

Referer
https://queryitem.buzz/banking/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=2628000
last-modified
Sun, 09 Aug 2020 00:09:35 GMT
server
ddos-guard
etag
"160d2-5ac66a73a961b"
content-type
image/gif
status
200
date
Fri, 18 Sep 2020 09:48:57 GMT
content-security-policy
upgrade-insecure-requests;
accept-ranges
bytes
content-length
90322
verified-by-visa-logo.svg
queryitem.buzz/banking/
3 KB
2 KB
Image
General
Full URL
https://queryitem.buzz/banking/verified-by-visa-logo.svg
Requested by
Host: queryitem.buzz
URL: https://queryitem.buzz/banking/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
190.115.18.246 , Belize, ASN262254 (DDOS-GUARD CORP., BZ),
Reverse DNS
owner.bityoung.net
Software
ddos-guard /
Resource Hash
9212a8bed1938a6109be0258dfbcb60931d60b0259d399e249b6a34c13696bdd
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
Strict-Transport-Security max-age=2628000

Request headers

Referer
https://queryitem.buzz/banking/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=2628000
content-encoding
br
last-modified
Sun, 09 Aug 2020 00:09:36 GMT
server
ddos-guard
etag
W/"dc6-5ac66a73ed7f2"
vary
Accept-Encoding
content-type
image/svg+xml
status
200
date
Fri, 18 Sep 2020 09:48:58 GMT
content-security-policy
upgrade-insecure-requests;
accept-ranges
bytes
mastercard-secure-code-2016.svg
queryitem.buzz/banking/
13 KB
5 KB
Image
General
Full URL
https://queryitem.buzz/banking/mastercard-secure-code-2016.svg
Requested by
Host: queryitem.buzz
URL: https://queryitem.buzz/banking/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
190.115.18.246 , Belize, ASN262254 (DDOS-GUARD CORP., BZ),
Reverse DNS
owner.bityoung.net
Software
ddos-guard /
Resource Hash
2ce089b517a8559f8ed0aa90caea5e1707650add0f73f6a8154daa842d5d7ed6
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
Strict-Transport-Security max-age=2628000

Request headers

Referer
https://queryitem.buzz/banking/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=2628000
content-encoding
br
last-modified
Sun, 09 Aug 2020 00:09:36 GMT
server
ddos-guard
etag
W/"3586-5ac66a73dbeb2"
vary
Accept-Encoding
content-type
image/svg+xml
status
200
date
Fri, 18 Sep 2020 09:48:57 GMT
content-security-policy
upgrade-insecure-requests;
accept-ranges
bytes
fca-regulated.png
queryitem.buzz/banking/images/
3 KB
3 KB
Image
General
Full URL
https://queryitem.buzz/banking/images/fca-regulated.png
Requested by
Host: queryitem.buzz
URL: https://queryitem.buzz/banking/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
190.115.18.246 , Belize, ASN262254 (DDOS-GUARD CORP., BZ),
Reverse DNS
owner.bityoung.net
Software
ddos-guard /
Resource Hash
ea0b1c5dc1558c5461a8ea624ec765aeaaa940a9ab993511764482113046b517
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
Strict-Transport-Security max-age=2628000

Request headers

Referer
https://queryitem.buzz/banking/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=2628000
last-modified
Sun, 09 Aug 2020 00:09:35 GMT
server
ddos-guard
etag
"db5-5ac66a73b45e3"
content-type
image/png
status
200
date
Fri, 18 Sep 2020 09:48:57 GMT
content-security-policy
upgrade-insecure-requests;
accept-ranges
bytes
content-length
3509
bltick.png
queryitem.buzz/banking/images/
2 KB
2 KB
Image
General
Full URL
https://queryitem.buzz/banking/images/bltick.png
Requested by
Host: queryitem.buzz
URL: https://queryitem.buzz/banking/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
190.115.18.246 , Belize, ASN262254 (DDOS-GUARD CORP., BZ),
Reverse DNS
owner.bityoung.net
Software
ddos-guard /
Resource Hash
c5ebdf18386412cab54216d97a4b908d467b0710dccc137661030c5488795f04
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
Strict-Transport-Security max-age=2628000

Request headers

Referer
https://queryitem.buzz/banking/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=2628000
last-modified
Sun, 09 Aug 2020 00:09:35 GMT
server
ddos-guard
etag
"6af-5ac66a73ca572"
content-type
image/png
status
200
date
Fri, 18 Sep 2020 09:48:57 GMT
content-security-policy
upgrade-insecure-requests;
accept-ranges
bytes
content-length
1711
img0009.png
queryitem.buzz/banking/images/
282 B
330 B
Image
General
Full URL
https://queryitem.buzz/banking/images/img0009.png
Requested by
Host: queryitem.buzz
URL: https://queryitem.buzz/banking/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
190.115.18.246 , Belize, ASN262254 (DDOS-GUARD CORP., BZ),
Reverse DNS
owner.bityoung.net
Software
ddos-guard /
Resource Hash
5d436540aa29aff5d390c9835d4b567f2fb1592b6d6fe7617c773fa9932846e1
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
Strict-Transport-Security max-age=2628000

Request headers

Referer
https://queryitem.buzz/banking/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=2628000
last-modified
Sun, 09 Aug 2020 00:09:35 GMT
server
ddos-guard
etag
"11a-5ac66a73ccc82"
content-type
image/png
status
200
date
Fri, 18 Sep 2020 09:48:58 GMT
content-security-policy
upgrade-insecure-requests;
accept-ranges
bytes
content-length
282
113.png
queryitem.buzz/banking/images/
5 KB
5 KB
Image
General
Full URL
https://queryitem.buzz/banking/images/113.png
Requested by
Host: queryitem.buzz
URL: https://queryitem.buzz/banking/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
190.115.18.246 , Belize, ASN262254 (DDOS-GUARD CORP., BZ),
Reverse DNS
owner.bityoung.net
Software
ddos-guard /
Resource Hash
4835f303e137faa6cabdfec2ce6528d277f5978e5a8928fac4630ecb909e59a2
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
Strict-Transport-Security max-age=2628000

Request headers

Referer
https://queryitem.buzz/banking/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=2628000
last-modified
Sun, 09 Aug 2020 00:09:35 GMT
server
ddos-guard
etag
"13e0-5ac66a73bf992"
content-type
image/png
status
200
date
Fri, 18 Sep 2020 09:48:59 GMT
content-security-policy
upgrade-insecure-requests;
accept-ranges
bytes
content-length
5088
img0014.png
queryitem.buzz/banking/images/
2 KB
2 KB
Image
General
Full URL
https://queryitem.buzz/banking/images/img0014.png
Requested by
Host: queryitem.buzz
URL: https://queryitem.buzz/banking/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
190.115.18.246 , Belize, ASN262254 (DDOS-GUARD CORP., BZ),
Reverse DNS
owner.bityoung.net
Software
ddos-guard /
Resource Hash
d3fb4bc8dc0f390a225e831b13eb87f1269cc6bc8a75f6faa488d629255a1701
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
Strict-Transport-Security max-age=2628000

Request headers

Referer
https://queryitem.buzz/banking/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=2628000
last-modified
Sun, 09 Aug 2020 00:09:35 GMT
server
ddos-guard
etag
"6f7-5ac66a73ca18a"
content-type
image/png
status
200
date
Fri, 18 Sep 2020 09:48:59 GMT
content-security-policy
upgrade-insecure-requests;
accept-ranges
bytes
content-length
1783
logo_blue.png
queryitem.buzz/banking/images/
605 B
655 B
Image
General
Full URL
https://queryitem.buzz/banking/images/logo_blue.png
Requested by
Host: queryitem.buzz
URL: https://queryitem.buzz/banking/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
190.115.18.246 , Belize, ASN262254 (DDOS-GUARD CORP., BZ),
Reverse DNS
owner.bityoung.net
Software
ddos-guard /
Resource Hash
c0620157eaca321164b33c0879a350c4fb38ed05f6857677a21f9fb4d28b202f
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
Strict-Transport-Security max-age=2628000

Request headers

Referer
https://queryitem.buzz/banking/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=2628000
last-modified
Sun, 09 Aug 2020 00:09:35 GMT
server
ddos-guard
etag
"25d-5ac66a73a4413"
content-type
image/png
status
200
date
Fri, 18 Sep 2020 09:48:59 GMT
content-security-policy
upgrade-insecure-requests;
accept-ranges
bytes
content-length
605
img0006.png
queryitem.buzz/banking/images/
233 B
282 B
Image
General
Full URL
https://queryitem.buzz/banking/images/img0006.png
Requested by
Host: queryitem.buzz
URL: https://queryitem.buzz/banking/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
190.115.18.246 , Belize, ASN262254 (DDOS-GUARD CORP., BZ),
Reverse DNS
owner.bityoung.net
Software
ddos-guard /
Resource Hash
2b37a9cfae3aec838fd20b03d76ed964cd6690d7e2b07ea6e3c15ed042231b39
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
Strict-Transport-Security max-age=2628000

Request headers

Referer
https://queryitem.buzz/banking/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=2628000
last-modified
Sun, 09 Aug 2020 00:09:35 GMT
server
ddos-guard
etag
"e9-5ac66a73bedda"
content-type
image/png
status
200
date
Fri, 18 Sep 2020 09:48:59 GMT
content-security-policy
upgrade-insecure-requests;
accept-ranges
bytes
content-length
233
img0001.png
queryitem.buzz/banking/images/
2 KB
2 KB
Image
General
Full URL
https://queryitem.buzz/banking/images/img0001.png
Requested by
Host: queryitem.buzz
URL: https://queryitem.buzz/banking/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
190.115.18.246 , Belize, ASN262254 (DDOS-GUARD CORP., BZ),
Reverse DNS
owner.bityoung.net
Software
ddos-guard /
Resource Hash
7e32f5c5c2eac447529192b5eb32029283b2cb45f1f3ad6f54d2ea8342935b5a
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
Strict-Transport-Security max-age=2628000

Request headers

Referer
https://queryitem.buzz/banking/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=2628000
last-modified
Sun, 09 Aug 2020 00:09:35 GMT
server
ddos-guard
etag
"8d7-5ac66a73b1703"
content-type
image/png
status
200
date
Fri, 18 Sep 2020 09:48:59 GMT
content-security-policy
upgrade-insecure-requests;
accept-ranges
bytes
content-length
2263
img0013.png
queryitem.buzz/banking/images/
3 KB
3 KB
Image
General
Full URL
https://queryitem.buzz/banking/images/img0013.png
Requested by
Host: queryitem.buzz
URL: https://queryitem.buzz/banking/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
190.115.18.246 , Belize, ASN262254 (DDOS-GUARD CORP., BZ),
Reverse DNS
owner.bityoung.net
Software
ddos-guard /
Resource Hash
4b3809a80be876bdefd4eb66252e55e193499c5c77aae1a4dd8e9c687448f1e8
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
Strict-Transport-Security max-age=2628000

Request headers

Referer
https://queryitem.buzz/banking/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=2628000
last-modified
Sun, 09 Aug 2020 00:09:35 GMT
server
ddos-guard
etag
"a96-5ac66a73b4db3"
content-type
image/png
status
200
date
Fri, 18 Sep 2020 09:48:59 GMT
content-security-policy
upgrade-insecure-requests;
accept-ranges
bytes
content-length
2710
B7Qh_OGIgAMzeE9.png%20large.png
queryitem.buzz/banking/images/
44 KB
44 KB
Image
General
Full URL
https://queryitem.buzz/banking/images/B7Qh_OGIgAMzeE9.png%20large.png
Requested by
Host: queryitem.buzz
URL: https://queryitem.buzz/banking/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
190.115.18.246 , Belize, ASN262254 (DDOS-GUARD CORP., BZ),
Reverse DNS
owner.bityoung.net
Software
ddos-guard /
Resource Hash
1a51271a2e4ed6f1022f323e14d7d254c6580485db901f26a30f3cfefbcdea9b
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
Strict-Transport-Security max-age=2628000

Request headers

Referer
https://queryitem.buzz/banking/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=2628000
last-modified
Sun, 09 Aug 2020 00:09:35 GMT
server
ddos-guard
etag
"afa6-5ac66a73a7ac3"
content-type
image/png
status
200
date
Fri, 18 Sep 2020 09:48:59 GMT
content-security-policy
upgrade-insecure-requests;
accept-ranges
bytes
content-length
44966
MSR-1110231784.png
queryitem.buzz/banking/images/
39 KB
39 KB
Image
General
Full URL
https://queryitem.buzz/banking/images/MSR-1110231784.png
Requested by
Host: queryitem.buzz
URL: https://queryitem.buzz/banking/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
190.115.18.246 , Belize, ASN262254 (DDOS-GUARD CORP., BZ),
Reverse DNS
owner.bityoung.net
Software
ddos-guard /
Resource Hash
6d94ffea9556956578b07c893020c98cd5fc9d134c14f7f072c461eb94149f22
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
Strict-Transport-Security max-age=2628000

Request headers

Referer
https://queryitem.buzz/banking/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=2628000
last-modified
Sun, 09 Aug 2020 00:09:35 GMT
server
ddos-guard
etag
"9a4a-5ac66a73d0332"
content-type
image/png
status
200
date
Fri, 18 Sep 2020 09:48:59 GMT
content-security-policy
upgrade-insecure-requests;
accept-ranges
bytes
content-length
39498
img0010.png
queryitem.buzz/banking/images/
233 B
282 B
Image
General
Full URL
https://queryitem.buzz/banking/images/img0010.png
Requested by
Host: queryitem.buzz
URL: https://queryitem.buzz/banking/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
190.115.18.246 , Belize, ASN262254 (DDOS-GUARD CORP., BZ),
Reverse DNS
owner.bityoung.net
Software
ddos-guard /
Resource Hash
2b37a9cfae3aec838fd20b03d76ed964cd6690d7e2b07ea6e3c15ed042231b39
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
Strict-Transport-Security max-age=2628000

Request headers

Referer
https://queryitem.buzz/banking/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=2628000
last-modified
Sun, 09 Aug 2020 00:09:35 GMT
server
ddos-guard
etag
"e9-5ac66a73c3bfa"
content-type
image/png
status
200
date
Fri, 18 Sep 2020 09:48:59 GMT
content-security-policy
upgrade-insecure-requests;
accept-ranges
bytes
content-length
233
7DYyG4ugmjIunbvc
queryitem.buzz/.well-known/ddos-guard/id/
68 B
232 B
Image
General
Full URL
https://queryitem.buzz/.well-known/ddos-guard/id/7DYyG4ugmjIunbvc
Requested by
Host: queryitem.buzz
URL: https://queryitem.buzz/banking/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
190.115.18.246 , Belize, ASN262254 (DDOS-GUARD CORP., BZ),
Reverse DNS
owner.bityoung.net
Software
ddos-guard /
Resource Hash
f309b7c03d9cae63a9bedbee6ed655f3dbcdb194132943639344dead5f3b9710

Request headers

Referer
https://queryitem.buzz/banking/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
200
date
Fri, 18 Sep 2020 09:48:58 GMT
cache-control
no-cache
server
ddos-guard
content-type
image/png
content-length
68
expires
Thu, 01 Jan 1970 00:00:00 GMT
7DYyG4ugmjIunbvc
check.ddos-guard.net/set/id/
68 B
276 B
Image
General
Full URL
https://check.ddos-guard.net/set/id/7DYyG4ugmjIunbvc
Requested by
Host: queryitem.buzz
URL: https://queryitem.buzz/banking/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
185.129.100.100 , Russian Federation, ASN57724 (DDOS-GUARD, RU),
Reverse DNS
ddos-guard.net
Software
ddos-guard /
Resource Hash
f309b7c03d9cae63a9bedbee6ed655f3dbcdb194132943639344dead5f3b9710

Request headers

Referer
https://queryitem.buzz/banking/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Sep 2020 09:48:58 GMT
server
ddos-guard
p3p
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
status
200
cache-control
no-cache
content-type
image/png
content-length
68
expires
Thu, 01 Jan 1970 00:00:00 GMT
GothamPro-Light.html
queryitem.buzz/banking/
14 KB
14 KB
Font
General
Full URL
https://queryitem.buzz/banking/GothamPro-Light.html
Requested by
Host: queryitem.buzz
URL: https://queryitem.buzz/banking/trustuniEPbnk.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
190.115.18.246 , Belize, ASN262254 (DDOS-GUARD CORP., BZ),
Reverse DNS
owner.bityoung.net
Software
ddos-guard /
Resource Hash
033429cef726a2bdb5d4220d3bb73e5623c5dda76af43a6779959f6bf83ee8b1
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
Strict-Transport-Security max-age=2628000

Request headers

Origin
https://queryitem.buzz
Referer
https://queryitem.buzz/banking/trustuniEPbnk.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=2628000
content-encoding
br
last-modified
Sun, 09 Aug 2020 00:09:36 GMT
server
ddos-guard
etag
W/"387c-5ac66a740898a"
vary
Accept-Encoding
content-type
text/html; charset=UTF-8
status
200
date
Fri, 18 Sep 2020 09:48:58 GMT
content-security-policy
upgrade-insecure-requests;
accept-ranges
bytes
MicraDi.html
queryitem.buzz/banking/
10 KB
10 KB
Font
General
Full URL
https://queryitem.buzz/banking/MicraDi.html
Requested by
Host: queryitem.buzz
URL: https://queryitem.buzz/banking/trustuniEPbnk.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
190.115.18.246 , Belize, ASN262254 (DDOS-GUARD CORP., BZ),
Reverse DNS
owner.bityoung.net
Software
ddos-guard /
Resource Hash
e7ac2871db7d8a7d1f925d66bed0d09ac0ec43103c827b8f51ca24afb71dd1c0
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
Strict-Transport-Security max-age=2628000

Request headers

Origin
https://queryitem.buzz
Referer
https://queryitem.buzz/banking/trustuniEPbnk.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=2628000
content-encoding
br
last-modified
Sun, 09 Aug 2020 00:09:35 GMT
server
ddos-guard
etag
W/"2758-5ac66a7396953"
vary
Accept-Encoding
content-type
text/html; charset=UTF-8
status
200
date
Fri, 18 Sep 2020 09:48:58 GMT
content-security-policy
upgrade-insecure-requests;
accept-ranges
bytes
DroidSans.html
queryitem.buzz/banking/
49 KB
49 KB
Font
General
Full URL
https://queryitem.buzz/banking/DroidSans.html
Requested by
Host: queryitem.buzz
URL: https://queryitem.buzz/banking/trustuniEPbnk.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
190.115.18.246 , Belize, ASN262254 (DDOS-GUARD CORP., BZ),
Reverse DNS
owner.bityoung.net
Software
ddos-guard /
Resource Hash
3fb6886ffcbc6d9aebe1eaa823cabf26b07f8adc8d2898f17fd8ea8f8873c021
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
Strict-Transport-Security max-age=2628000

Request headers

Origin
https://queryitem.buzz
Referer
https://queryitem.buzz/banking/trustuniEPbnk.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=2628000
content-encoding
br
last-modified
Sun, 09 Aug 2020 00:09:35 GMT
server
ddos-guard
etag
W/"c378-5ac66a7394dfb"
vary
Accept-Encoding
content-type
text/html; charset=UTF-8
status
200
date
Fri, 18 Sep 2020 09:48:58 GMT
content-security-policy
upgrade-insecure-requests;
accept-ranges
bytes
DroidSans-2.html
queryitem.buzz/banking/
60 KB
60 KB
Font
General
Full URL
https://queryitem.buzz/banking/DroidSans-2.html
Requested by
Host: queryitem.buzz
URL: https://queryitem.buzz/banking/trustuniEPbnk.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
190.115.18.246 , Belize, ASN262254 (DDOS-GUARD CORP., BZ),
Reverse DNS
owner.bityoung.net
Software
ddos-guard /
Resource Hash
259a4fd22ac41c1952ea9af76ca4db91a164cdda8e17500f651228f4293336a0
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests;
Strict-Transport-Security max-age=2628000

Request headers

Origin
https://queryitem.buzz
Referer
https://queryitem.buzz/banking/trustuniEPbnk.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=2628000
content-encoding
br
last-modified
Sun, 09 Aug 2020 00:09:36 GMT
server
ddos-guard
etag
W/"f174-5ac66a73e3f9a"
vary
Accept-Encoding
content-type
text/html; charset=UTF-8
status
200
date
Fri, 18 Sep 2020 09:48:58 GMT
content-security-policy
upgrade-insecure-requests;
accept-ranges
bytes

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Banking (Banking)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| trustedTypes function| get_cookie undefined| url function| noselect

2 Cookies

Domain/Path Name / Value
.queryitem.buzz/ Name: __ddg2
Value: 7DYyG4ugmjIunbvc
.queryitem.buzz/ Name: __ddg1
Value: rfdtBzYMyUAXEdAWtPQs

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy upgrade-insecure-requests;
Strict-Transport-Security max-age=2628000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

check.ddos-guard.net
paymentcassa.xyz
queryitem.buzz
transbankorder.xyz
176.119.30.22
185.129.100.100
190.115.18.246
192.64.119.22
0075174bdf083d22b69003025b3f6caeb9b3efe2526767c21d2ffb789bf48109
01334268dcf9acf9cf06d013256802ac5ae71c8c8dd3102eb39bc1e89a307d29
033429cef726a2bdb5d4220d3bb73e5623c5dda76af43a6779959f6bf83ee8b1
0ff0448cc3005328fd2365cf91c03b10f451e15f5718bebdae34c48174261bd3
1a51271a2e4ed6f1022f323e14d7d254c6580485db901f26a30f3cfefbcdea9b
259a4fd22ac41c1952ea9af76ca4db91a164cdda8e17500f651228f4293336a0
2b37a9cfae3aec838fd20b03d76ed964cd6690d7e2b07ea6e3c15ed042231b39
2ce089b517a8559f8ed0aa90caea5e1707650add0f73f6a8154daa842d5d7ed6
3fb6886ffcbc6d9aebe1eaa823cabf26b07f8adc8d2898f17fd8ea8f8873c021
41d82061b87b8339aaf1aef9dd32c3dbb8c1994bcaaf0716fdb8451b47b20a1f
4835f303e137faa6cabdfec2ce6528d277f5978e5a8928fac4630ecb909e59a2
4b3809a80be876bdefd4eb66252e55e193499c5c77aae1a4dd8e9c687448f1e8
5d436540aa29aff5d390c9835d4b567f2fb1592b6d6fe7617c773fa9932846e1
6d94ffea9556956578b07c893020c98cd5fc9d134c14f7f072c461eb94149f22
7743b93bfe418d7c0daaf0911fb442de1e50ae11d8048864fa25db7a147edf6b
7e32f5c5c2eac447529192b5eb32029283b2cb45f1f3ad6f54d2ea8342935b5a
9212a8bed1938a6109be0258dfbcb60931d60b0259d399e249b6a34c13696bdd
c0620157eaca321164b33c0879a350c4fb38ed05f6857677a21f9fb4d28b202f
c5ebdf18386412cab54216d97a4b908d467b0710dccc137661030c5488795f04
c6fac8fcb88c71e005137ea6d30e5a0791d44692e960c32833aa5b552f32c969
d3fb4bc8dc0f390a225e831b13eb87f1269cc6bc8a75f6faa488d629255a1701
e7ac2871db7d8a7d1f925d66bed0d09ac0ec43103c827b8f51ca24afb71dd1c0
ea0b1c5dc1558c5461a8ea624ec765aeaaa940a9ab993511764482113046b517
f175f0beee2c45e190e07d8171e5bca9f96d14ea154440b3da82d4ba2a64fd91
f309b7c03d9cae63a9bedbee6ed655f3dbcdb194132943639344dead5f3b9710
f9962cdd7000f1faf4ac777134caa7068dc850053f1f7a47d89402ff12b2f402