Started from buyfakepassports.com re-directing to fakepassportsale.cc.
Hmmm. Country domain “cc” = Cocos Islands.
buyfakepassports.com whois registration date:
The sites are together in the same IPs with the FakeVimes rogues and other exploits and malware.
“For entertainment only…” Right.
Thanks Patrick Jordan