secura.stronazen.pl - urlscan.io

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 6 HTTP transactions. The main IP is 128.204.216.201, located in Poland and belongs to ECO-ATMAN-PL ECO-ATMAN-, PL. The main domain is secura.stronazen.pl.
TLS certificate: Issued by Let's Encrypt Authority X3 on July 14th 2019. Valid for: 3 months.

This is the only time secura.stronazen.pl was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
1	213.186.33.176 213.186.33.176	16276 (OVH) (OVH)
1 6	128.204.216.201 128.204.216.201	57367 (ECO-ATMAN...) (ECO-ATMAN-PL ECO-ATMAN-)
6	2

1 213.186.33.176 (France)

ASN16276 (OVH, FR)
PTR: full-cdn-01.cluster020.hosting.ovh.net

cibleblanche.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 128.204.216.201 (Poland) 1 redirects

ASN57367 (ECO-ATMAN-PL ECO-ATMAN-, PL)
PTR: s22.zenbox.pl

secura.stronazen.pl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	stronazen.pl 1 redirects secura.stronazen.pl	329 KB
1	cibleblanche.com cibleblanche.com	334 B
6	2

	Domain	Requested by
6	secura.stronazen.pl	1 redirects secura.stronazen.pl
1	cibleblanche.com
6	2

This site contains no links.

Subject Issuer	Validity	Valid
cibleblanche.com Let's Encrypt Authority X3	`2019-06-07` - `2019-09-05`	3 months	crt.sh
secura.stronazen.pl Let's Encrypt Authority X3	`2019-07-14` - `2019-10-12`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://secura.stronazen.pl/wp/wp/6nefbxcfe4czge3sczgz6q3h.php?FDFGC31563205109a6b4e485be59397c948d34eebc33af17a6b4e485be59397c948d34eebc33af17a6b4e485be59397c948d34eebc33af17a6b4e485be59397c948d34eebc33af17a6b4e485be59397c948d34eebc33af17&AP___=&error=
Frame ID: 912EEA98D59FFB692EB22B11E1F2AA3E
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://cibleblanche.com/wp-content/plugins/wp-smushit/smushit.html Page URL
https://secura.stronazen.pl/wp/wp/ HTTP 302
https://secura.stronazen.pl/wp/wp/6nefbxcfe4czge3sczgz6q3h.php?FDFGC31563205109a6b4e485be59397c948d34eeb... Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

6
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

329 kB
Transfer

396 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://cibleblanche.com/wp-content/plugins/wp-smushit/smushit.html Page URL
https://secura.stronazen.pl/wp/wp/ HTTP 302
https://secura.stronazen.pl/wp/wp/6nefbxcfe4czge3sczgz6q3h.php?FDFGC31563205109a6b4e485be59397c948d34eebc33af17a6b4e485be59397c948d34eebc33af17a6b4e485be59397c948d34eebc33af17a6b4e485be59397c948d34eebc33af17a6b4e485be59397c948d34eebc33af17&AP___=&error= Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	smushit.html Show response cibleblanche.com/wp-content/plugins/wp-smushit/	115 B 334 B	98ms 56ms	Document text/html	213.186.33.176 OVH
General Check archive.org Show headers Download Go to Full URL https://cibleblanche.com/wp-content/plugins/wp-smushit/smushit.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 213.186.33.176 , France, ASN16276 (OVH, FR), Reverse DNS full-cdn-01.cluster020.hosting.ovh.net Software / Resource Hash `7713e38e9d316709066158eccdb3310fb8bc8e002aaa865db091b9b4054ec80e` Request headers :method GET :authority cibleblanche.com :scheme https :path /wp-content/plugins/wp-smushit/smushit.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3 accept-encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers status 200 date Mon, 15 Jul 2019 15:38:28 GMT content-type text/html set-cookie SERVERID567=204055; path=/; max-age=900 vary Accept-Encoding x-request-id a3ba93153b59d1ec7c54b6e44b3927ff content-encoding br x-cdn-pop rbx1 x-cdn-pop-ip 51.254.41.192/26 x-cacheable Cacheable accept-ranges bytes
GET H2	200	Primary Request 6nefbxcfe4czge3sczgz6q3h.php Show response secura.stronazen.pl/wp/wp/ Redirect Chain https://secura.stronazen.pl/wp/wp/ https://secura.stronazen.pl/wp/wp/6nefbxcfe4czge3sczgz6q3h.php?FDFGC31563205109a6b4e485be59397c948d34eebc33af17a6b4e485be59397c948d34eebc33af17a6b4e485be59397c948d34eebc33af17a6b4e485be59397c948d34...	3 KB 1 KB	49ms 49ms	Document text/html	128.204.216.201 ECO-ATMAN-PL ECO-...
General Check archive.org Show headers Download Go to Full URL https://secura.stronazen.pl/wp/wp/6nefbxcfe4czge3sczgz6q3h.php?FDFGC31563205109a6b4e485be59397c948d34eebc33af17a6b4e485be59397c948d34eebc33af17a6b4e485be59397c948d34eebc33af17a6b4e485be59397c948d34eebc33af17a6b4e485be59397c948d34eebc33af17&AP___=&error= Protocol H2 Security TLS 1.3, , AES_128_GCM Server 128.204.216.201 , Poland, ASN57367 (ECO-ATMAN-PL ECO-ATMAN-, PL), Reverse DNS s22.zenbox.pl Software LiteSpeed / Resource Hash `d966c4b6a1aa5fd6188563be849e57044a6fb10d8d898d691edc11bb8e4eb26d` Request headers :method GET :authority secura.stronazen.pl :scheme https :path /wp/wp/6nefbxcfe4czge3sczgz6q3h.php?FDFGC31563205109a6b4e485be59397c948d34eebc33af17a6b4e485be59397c948d34eebc33af17a6b4e485be59397c948d34eebc33af17a6b4e485be59397c948d34eebc33af17a6b4e485be59397c948d34eebc33af17&AP___=&error= pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3 referer https://cibleblanche.com/wp-content/plugins/wp-smushit/smushit.html accept-encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer https://cibleblanche.com/wp-content/plugins/wp-smushit/smushit.html Response headers status 200 content-type text/html; charset=UTF-8 cache-control public, max-age=2592000 expires Wed, 14 Aug 2019 15:38:29 GMT content-length 952 content-encoding br vary Accept-Encoding,User-Agent date Mon, 15 Jul 2019 15:38:29 GMT server LiteSpeed alt-svc quic=":443"; ma=2592000; v="35,39,43,44" Redirect headers status 302 location 6nefbxcfe4czge3sczgz6q3h.php?FDFGC31563205109a6b4e485be59397c948d34eebc33af17a6b4e485be59397c948d34eebc33af17a6b4e485be59397c948d34eebc33af17a6b4e485be59397c948d34eebc33af17a6b4e485be59397c948d34eebc33af17&AP___=&error= content-type text/html; charset=UTF-8 cache-control no-cache, no-store, must-revalidate, max-age=0 expires Wed, 14 Aug 2019 15:38:29 GMT content-length 0 date Mon, 15 Jul 2019 15:38:29 GMT server LiteSpeed vary User-Agent alt-svc quic=":443"; ma=2592000; v="35,39,43,44"
GET H2	200	style.css secura.stronazen.pl/wp/wp/	6 KB 2 KB	42ms 41ms	Stylesheet text/css	128.204.216.201 ECO-ATMAN-PL ECO-...
General Check archive.org Show headers Download Go to Full URL https://secura.stronazen.pl/wp/wp/style.css Requested by Host: secura.stronazen.pl URL: https://secura.stronazen.pl/wp/wp/6nefbxcfe4czge3sczgz6q3h.php?FDFGC31563205109a6b4e485be59397c948d34eebc33af17a6b4e485be59397c948d34eebc33af17a6b4e485be59397c948d34eebc33af17a6b4e485be59397c948d34eebc33af17a6b4e485be59397c948d34eebc33af17&AP___=&error= Protocol H2 Security TLS 1.3, , AES_128_GCM Server 128.204.216.201 , Poland, ASN57367 (ECO-ATMAN-PL ECO-ATMAN-, PL), Reverse DNS s22.zenbox.pl Software LiteSpeed / Resource Hash `f3a3435dd1e14ea7ec192be880befce0c60c18a1dd6161f3a66cb82e9b358002` Request headers Referer https://secura.stronazen.pl/wp/wp/6nefbxcfe4czge3sczgz6q3h.php?FDFGC31563205109a6b4e485be59397c948d34eebc33af17a6b4e485be59397c948d34eebc33af17a6b4e485be59397c948d34eebc33af17a6b4e485be59397c948d34eebc33af17a6b4e485be59397c948d34eebc33af17&AP___=&error= User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 15 Jul 2019 15:38:29 GMT content-encoding br last-modified Mon, 15 Jul 2019 14:10:02 GMT server LiteSpeed access-control-allow-origin * etag "1778-5d2c893a-291dc891c6e5ddc6;br" vary Accept-Encoding,User-Agent content-type text/css; charset=UTF-8 status 200 cache-control public, max-age=2592000 accept-ranges bytes alt-svc quic=":443"; ma=2592000; v="35,39,43,44" content-length 1573 expires Wed, 14 Aug 2019 15:38:29 GMT
GET H2	200	jquery.js Show response secura.stronazen.pl/wp/wp/js/	94 KB 32 KB	42ms 42ms	Script application/javascript	128.204.216.201 ECO-ATMAN-PL ECO-...
General Check archive.org Show headers Download Go to Full URL https://secura.stronazen.pl/wp/wp/js/jquery.js Requested by Host: secura.stronazen.pl URL: https://secura.stronazen.pl/wp/wp/6nefbxcfe4czge3sczgz6q3h.php?FDFGC31563205109a6b4e485be59397c948d34eebc33af17a6b4e485be59397c948d34eebc33af17a6b4e485be59397c948d34eebc33af17a6b4e485be59397c948d34eebc33af17a6b4e485be59397c948d34eebc33af17&AP___=&error= Protocol H2 Security TLS 1.3, , AES_128_GCM Server 128.204.216.201 , Poland, ASN57367 (ECO-ATMAN-PL ECO-ATMAN-, PL), Reverse DNS s22.zenbox.pl Software LiteSpeed / Resource Hash `91222f96f34735ebc88df208017e54d4329b9202e3e52367fb8b149698a1a5ef` Request headers Referer https://secura.stronazen.pl/wp/wp/6nefbxcfe4czge3sczgz6q3h.php?FDFGC31563205109a6b4e485be59397c948d34eebc33af17a6b4e485be59397c948d34eebc33af17a6b4e485be59397c948d34eebc33af17a6b4e485be59397c948d34eebc33af17a6b4e485be59397c948d34eebc33af17&AP___=&error= User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 15 Jul 2019 15:38:29 GMT content-encoding br last-modified Mon, 15 Jul 2019 14:10:02 GMT server LiteSpeed access-control-allow-origin * etag "1762e-5d2c893a-655d620893d5c876;br" vary Accept-Encoding,User-Agent content-type application/javascript status 200 cache-control public, max-age=2592000 accept-ranges bytes alt-svc quic=":443"; ma=2592000; v="35,39,43,44" content-length 32146 expires Wed, 14 Aug 2019 15:38:29 GMT
GET H2	200	ms-logo-v2.jpg secura.stronazen.pl/wp/wp/images/	3 KB 3 KB	42ms 42ms	Image image/jpeg	128.204.216.201 ECO-ATMAN-PL ECO-...
General Check archive.org Show headers Download Go to Show image Full URL https://secura.stronazen.pl/wp/wp/images/ms-logo-v2.jpg Requested by Host: secura.stronazen.pl URL: https://secura.stronazen.pl/wp/wp/6nefbxcfe4czge3sczgz6q3h.php?FDFGC31563205109a6b4e485be59397c948d34eebc33af17a6b4e485be59397c948d34eebc33af17a6b4e485be59397c948d34eebc33af17a6b4e485be59397c948d34eebc33af17a6b4e485be59397c948d34eebc33af17&AP___=&error= Protocol H2 Security TLS 1.3, , AES_128_GCM Server 128.204.216.201 , Poland, ASN57367 (ECO-ATMAN-PL ECO-ATMAN-, PL), Reverse DNS s22.zenbox.pl Software LiteSpeed / Resource Hash `bc2b16b51738b77d94ed7591ad1033fa804297ca9faaa35222aa65773f749164` Request headers Referer https://secura.stronazen.pl/wp/wp/6nefbxcfe4czge3sczgz6q3h.php?FDFGC31563205109a6b4e485be59397c948d34eebc33af17a6b4e485be59397c948d34eebc33af17a6b4e485be59397c948d34eebc33af17a6b4e485be59397c948d34eebc33af17a6b4e485be59397c948d34eebc33af17&AP___=&error= User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 15 Jul 2019 15:38:29 GMT last-modified Mon, 15 Jul 2019 14:10:02 GMT server LiteSpeed etag "aed-5d2c893a-f761db115253a31f;;;" vary User-Agent content-type image/jpeg status 200 cache-control public, max-age=31536000 accept-ranges bytes alt-svc quic=":443"; ma=2592000; v="35,39,43,44" content-length 2797 expires Tue, 14 Jul 2020 15:38:29 GMT
GET H2	200	0.jpg secura.stronazen.pl/wp/wp/images/	291 KB 291 KB	41ms 41ms	Image image/jpeg	128.204.216.201 ECO-ATMAN-PL ECO-...
General Check archive.org Show headers Download Go to Show image Full URL https://secura.stronazen.pl/wp/wp/images/0.jpg Requested by Host: secura.stronazen.pl URL: https://secura.stronazen.pl/wp/wp/js/jquery.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 128.204.216.201 , Poland, ASN57367 (ECO-ATMAN-PL ECO-ATMAN-, PL), Reverse DNS s22.zenbox.pl Software LiteSpeed / Resource Hash `62faab60433070e2ea52c235f0f18db228759f2a08bb6f9e5711630df8321214` Request headers Referer https://secura.stronazen.pl/wp/wp/style.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 15 Jul 2019 15:38:29 GMT last-modified Mon, 15 Jul 2019 14:10:02 GMT server LiteSpeed etag "48c79-5d2c893a-8649fafdbc63b997;;;" vary User-Agent content-type image/jpeg status 200 cache-control public, max-age=31536000 accept-ranges bytes alt-svc quic=":443"; ma=2592000; v="35,39,43,44" content-length 298105 expires Tue, 14 Jul 2020 15:38:29 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cibleblanche.com
secura.stronazen.pl
128.204.216.201
213.186.33.176
62faab60433070e2ea52c235f0f18db228759f2a08bb6f9e5711630df8321214
7713e38e9d316709066158eccdb3310fb8bc8e002aaa865db091b9b4054ec80e
91222f96f34735ebc88df208017e54d4329b9202e3e52367fb8b149698a1a5ef
bc2b16b51738b77d94ed7591ad1033fa804297ca9faaa35222aa65773f749164
d966c4b6a1aa5fd6188563be849e57044a6fb10d8d898d691edc11bb8e4eb26d
f3a3435dd1e14ea7ec192be880befce0c60c18a1dd6161f3a66cb82e9b358002

secura.stronazen.pl Open in urlscan Pro 128.204.216.201 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

6 Requests

100 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

329 kBTransfer

396 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

6 JavaScript Global Variables

0 Cookies

Indicators

secura.stronazen.pl Open in urlscan Pro
128.204.216.201 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

6
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

329 kB
Transfer

396 kB
Size

0
Cookies

6 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!