Turns out it was snippets of an old leak that the scammer was using to direct traffic to their website where you could (wait for it) .. BUY the tools used to "do the hack"

Scammers all the way down