sklep.etnocafe.pl Open in urlscan Pro
104.21.9.117 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://sklep.etnocafe.pl/WPS/so/paga.php
Submission Tags: 6951176
Submission: On February 04 via api (February 4th 2021, 7:21:52 am UTC) from NL

Summary HTTP 9 Redirects Links 3 Behaviour Indicators

Summary

This website contacted 5 IPs in 2 countries across 4 domains to perform 9 HTTP transactions. The main IP is 104.21.9.117, located in United States and belongs to CLOUDFLARENET, US. The main domain is sklep.etnocafe.pl.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on August 4th 2020. Valid for: a year.

This is the only time sklep.etnocafe.pl was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Swiss Post (Transportation)

Domain & IP information

	IP Address	AS Autonomous System
3	104.21.9.117 104.21.9.117	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2600:9000:210... 2600:9000:2104:4e00:15:285b:5440:93a1	16509 (AMAZON-02) (AMAZON-02)
1	194.41.149.22 194.41.149.22	12511 (CH-POSTNE...) (CH-POSTNETZ Post CH AG)
1	2606:4700::68... 2606:4700::6810:a823	13335 (CLOUDFLAR...) (CLOUDFLARENET)
9	5

3 104.21.9.117 (United States)

ASN13335 (CLOUDFLARENET, US)

sklep.etnocafe.pl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2600:9000:2104:4e00:15:285b:5440:93a1 (United States)

ASN16509 (AMAZON-02, US)

assets.pay2.secured-by-ingenico.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 194.41.149.22 (Switzerland)

ASN12511 (CH-POSTNETZ Post CH AG, CH)

www.evoting.ch	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:a823 (United States)

ASN13335 (CLOUDFLARENET, US)

ajax.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	secured-by-ingenico.com assets.pay2.secured-by-ingenico.com	126 KB
3	etnocafe.pl sklep.etnocafe.pl	19 KB
1	cloudflare.com ajax.cloudflare.com	5 KB
1	evoting.ch www.evoting.ch	27 KB
9	4

	Domain	Requested by
4	assets.pay2.secured-by-ingenico.com	sklep.etnocafe.pl ajax.cloudflare.com assets.pay2.secured-by-ingenico.com
3	sklep.etnocafe.pl	ajax.cloudflare.com
1	ajax.cloudflare.com	sklep.etnocafe.pl
1	www.evoting.ch	sklep.etnocafe.pl
9	4

This site contains links to these domains. Also see Links.

Domain
www.merchantname.com

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-08-04` - `2021-08-04`	a year	crt.sh
assets.secured-by-ingenico.com Amazon	`2020-11-18` - `2021-12-17`	a year	crt.sh
www.evoting.ch SwissSign Server Gold CA 2014 - G22	`2019-08-14` - `2021-08-14`	2 years	crt.sh
ajax.cloudflare.com DigiCert ECC Secure Server CA	`2020-08-11` - `2022-08-16`	2 years	crt.sh

This page contains 1 frames:

Primary Page: https://sklep.etnocafe.pl/WPS/so/paga.php
Frame ID: 58A8B360066203AFC5D2CC89182B4DBE
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

IBM WebSphere Portal (CMS) Expand

Overall confidence: 100%
Detected patterns

url /\/wps\//i

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

Java (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\/wps\//i

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Page Statistics

9
Requests

100 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

5
IPs

2
Countries

177 kB
Transfer

603 kB
Size

1
Cookies

3 Outgoing links

These are links going to different origins than the main page.

URL: http://www.merchantname.com/
Title: Pagina iniziale

Search URL Search Domain Scan URL

URL: http://www.merchantname.com/termsofuse
Title: Condizioni d'uso

Search URL Search Domain Scan URL

URL: http://www.merchantname.com/faq
Title: Domande frequenti

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
3 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request paga.php Show response
sklep.etnocafe.pl/WPS/so/ 54 KB
19 KB 216ms
155ms Document
text/html 104.21.9.117
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://sklep.etnocafe.pl/WPS/so/paga.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.21.9.117 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a79629b1e709636731e775bbcb8dac9f0887e567325e26cafc52071a099950ef

Request headers

:method: GET
:authority: sklep.etnocafe.pl
:scheme: https
:path: /WPS/so/paga.php
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 04 Feb 2021 07:21:33 GMT
content-type: text/html; charset=UTF-8
set-cookie: __cfduid=db3b9c9b22d0ea87b2bbd0377908f92131612423293; expires=Sat, 06-Mar-21 07:21:33 GMT; path=/; domain=.etnocafe.pl; HttpOnly; SameSite=Lax; Secure
vary: Accept-Encoding
cf-cache-status: DYNAMIC
cf-request-id: 080d8401e20000d8c9da0ca000000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=gkYFOM%2FUUMWZW65d9%2F3RYLU2f4GRrLG0WuJQt8Ze24ul%2B5SpNUhXuphmwHiIRVRmbysobaCvkPlJFF4rkd2KZfT4XjgrJJyyXjoj2Vy0zz5NFg%3D%3D"}],"group":"cf-nel"}
nel: {"max_age":604800,"report_to":"cf-nel"}
server: cloudflare
cf-ray: 61c2a2afcebfd8c9-AMS
content-encoding: br

GET
H2 200 html-header.css
assets.pay2.secured-by-ingenico.com/templates/generic/responsive/wro/ 91 KB
17 KB 82ms
14ms Stylesheet
text/css 2600:9000:2104:4e00:15:285b:5440:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.pay2.secured-by-ingenico.com/templates/generic/responsive/wro/html-header.css?hash=87c85728b6403e92aeac04b0d65aac6a1e0048f6
Requested by: Host: sklep.etnocafe.pl
URL: https://sklep.etnocafe.pl/WPS/so/paga.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2104:4e00:15:285b:5440:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Apache/2.4.39 (Unix) OpenSSL/1.1.1c /
Resource Hash: 467873eb5bdd68b2a4c284d80bed7a2428492c768b6177f7e3d0d24eb7393168

Request headers

Referer: https://sklep.etnocafe.pl/WPS/so/paga.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 01 Feb 2021 15:23:34 GMT
content-encoding: gzip
last-modified: Mon, 01 Feb 2021 13:56:13 GMT
server: Apache/2.4.39 (Unix) OpenSSL/1.1.1c
age: 230279
etag: "c49b7dd3e000c94223aaddec55e3dc29268daf33"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/css;charset=UTF-8
via: 1.1 ed3a324a0ea0d1dfe339969855915050.cloudfront.net (CloudFront)
cache-control: public, max-age=315360000
x-amz-cf-pop: AMS1-C1
content-length: 16679
x-amz-cf-id: 2KT7RHCdzGcWPpYwIMxFeJs78yqGkOj79mvtz9a4iKK7pCl08Nq6iw==
expires: Tue, 01 Feb 2022 13:56:13 GMT

GET
H/1.1 200
OK logo.en.png
www.evoting.ch/img/ 26 KB
27 KB 124ms
36ms Image
image/png 194.41.149.22
CH-POSTNETZ Post ...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.evoting.ch/img/logo.en.png

Requested by

Host: sklep.etnocafe.pl
URL: https://sklep.etnocafe.pl/WPS/so/paga.php

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

194.41.149.22 , Switzerland, ASN12511 (CH-POSTNETZ Post CH AG, CH),

Reverse DNS

Software

Apache (proxied) /

Resource Hash

cd9102eea22852ca068d38cccb676a169e6402567e5475c879f2d78781823b24

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; script-src 'self' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self'; connect-src 'self'; child-src 'self'; font-src 'self'; base-uri 'self'; frame-ancestors 'none'; form-action 'none'
Strict-Transport-Security	max-age=63072000;includeSubDomains;preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://sklep.etnocafe.pl/WPS/so/paga.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 04 Feb 2021 07:21:33 GMT
X-Content-Type-Options: nosniff
X-Forwarded-For: 185.212.171.67
Strict-Transport-Security: max-age=63072000;includeSubDomains;preload
Content-Length: 26714
X-Xss-Protection: 1; mode=block
Referrer-Policy: no-referrer
Last-Modified: Mon, 18 Jan 2021 14:42:46 GMT
Server: Apache (proxied)
Cache-Control: no-cache
X-Frame-Options: DENY
ETag: "685a-5b92dbc3ee720"
Vary: Accept-Encoding
Content-Type: image/png
Connection: Keep-Alive
Feature-Policy: microphone 'none'; geolocation 'none'
Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self'; connect-src 'self'; child-src 'self'; font-src 'self'; base-uri 'self'; frame-ancestors 'none'; form-action 'none'
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100

GET
DATA 200
OK truncated
/ 3 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 65d212e6fdad69835e39d2ffd7bd334c1a7f5c04fd1c58e78cab4b0a82207407

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 rocket-loader.min.js Show response
ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/ 12 KB
5 KB 25ms
10ms Script
application/javascript 2606:4700::6810:a823
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/rocket-loader.min.js

Requested by

Host: sklep.etnocafe.pl
URL: https://sklep.etnocafe.pl/WPS/so/paga.php

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:a823 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b08cdbc2d30e656a86b20f8342428d5863f70f4b30135b4f4061f754ce932f5e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://sklep.etnocafe.pl/WPS/so/paga.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 04 Feb 2021 07:21:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
nel: {"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
cf-request-id: 080d8402a200001f259b0d4000000001
last-modified: Mon, 25 Jan 2021 17:22:41 GMT
server: cloudflare
x-frame-options: DENY
etag: W/"600efe61-3016"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000; includeSubDomains
report-to: {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=0wQHW5qaXpweHi%2FCM6fTP9vcgVtv3QsJObDdOAXCC7eyqKL8VznjH%2FoK0jDuILvHAdolL8cf64HkzsZFMV7GLFW906se0mCOiUMcRq0skyVronngsvoXaG3j2nX%2FWw%2Bs"}],"max_age":604800}
content-type: application/javascript
cache-control: max-age=172800, public
cf-ray: 61c2a2b10a721f25-FRA
expires: Sat, 06 Feb 2021 07:21:33 GMT

GET
DATA 200
OK truncated
/ 5 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e543dc00a143cd3fd077da005c3fa2e8564aad9f712e45e826959f29f36bb383

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 4 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7b43ca5781a67ad4c94aef6dab18af2c786bffde0cdce930c283f730c4819933

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 html-footer.js Show response
assets.pay2.secured-by-ingenico.com/templates/generic/responsive/wro/ 323 KB
85 KB 36ms
27ms Script
text/javascript 2600:9000:2104:4e00:15:285b:5440:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.pay2.secured-by-ingenico.com/templates/generic/responsive/wro/html-footer.js?hash=87c85728b6403e92aeac04b0d65aac6a1e0048f6
Requested by: Host: ajax.cloudflare.com
URL: https://ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/rocket-loader.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2104:4e00:15:285b:5440:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Apache/2.4.39 (Unix) OpenSSL/1.1.1c /
Resource Hash: a93e762b2b4f4467624976b17efdbbb61b1a45240efd8364235805116d6a67bc

Request headers

Referer: https://sklep.etnocafe.pl/WPS/so/paga.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 03 Feb 2021 13:32:22 GMT
content-encoding: gzip
last-modified: Mon, 01 Feb 2021 13:47:47 GMT
server: Apache/2.4.39 (Unix) OpenSSL/1.1.1c
age: 64151
etag: "132d9a7f42bd080b735f457f522c6ffc72f5a446"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript;charset=UTF-8
via: 1.1 ed3a324a0ea0d1dfe339969855915050.cloudfront.net (CloudFront)
cache-control: public, max-age=315360000
x-amz-cf-pop: AMS1-C1
content-length: 86695
x-amz-cf-id: URWPP69rg0dWvIgyFDLZ4Vkq_n4fguZXBiHvgLztJZu5bTB2gkvTBA==
expires: Tue, 01 Feb 2022 13:47:47 GMT

GET
H2 200 com.globalcollect.sdk.js Show response
assets.pay2.secured-by-ingenico.com/templates/master/wro/ 77 KB
15 KB 38ms
29ms Script
text/javascript 2600:9000:2104:4e00:15:285b:5440:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.pay2.secured-by-ingenico.com/templates/master/wro/com.globalcollect.sdk.js?hash=7c2e6b52d81888847885d8744c615740623278cf
Requested by: Host: ajax.cloudflare.com
URL: https://ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/rocket-loader.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2104:4e00:15:285b:5440:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Apache/2.4.39 (Unix) OpenSSL/1.1.1c /
Resource Hash: 9236a1049f1d6ff5fedabceaf3f7ee9e749b32503a02a7c6f9bc7990216fb98b

Request headers

Referer: https://sklep.etnocafe.pl/WPS/so/paga.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 03 Feb 2021 13:32:22 GMT
content-encoding: gzip
last-modified: Mon, 01 Feb 2021 13:47:47 GMT
server: Apache/2.4.39 (Unix) OpenSSL/1.1.1c
age: 64151
etag: "99ca3b990023109baa8575ab3d56570e265ff9e4"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript;charset=UTF-8
via: 1.1 ed3a324a0ea0d1dfe339969855915050.cloudfront.net (CloudFront)
cache-control: public, max-age=315360000
x-amz-cf-pop: AMS1-C1
content-length: 15116
x-amz-cf-id: nXHlSmqlHO3F-ThfloxD1pFT6onvFntsN3lk35_VJ7ay0PeeTNvYPg==
expires: Tue, 01 Feb 2022 13:47:47 GMT

GET
H2 404 ruxitagentjs_ICA2SVfqrux_10175190917092722.js
sklep.etnocafe.pl/ 0
0 53ms
53ms Script
text/html 104.21.9.117
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://sklep.etnocafe.pl/ruxitagentjs_ICA2SVfqrux_10175190917092722.js
Requested by: Host: ajax.cloudflare.com
URL: https://ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/rocket-loader.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.21.9.117 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Referer: https://sklep.etnocafe.pl/WPS/so/paga.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 04 Feb 2021 07:21:33 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"max_age":604800,"report_to":"cf-nel"}
age: 116
p3p: CP="IDC DSP COR CURa ADMa OUR IND PHY ONL COM STA"
status: 404 Not Found
powered-by: PrestaShop
cf-request-id: 080d8402b90000d8c9ceb24000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=FvNei3zbsqkfFgcIm%2B%2BdHAm0eA%2BzGA8GTkD94exzIOqUBjjgG5j5XHYGiU959dJeoolbEcL5Qd%2F07C6tiBK8YtPzRme1U9VjQJksTcvNo5AC1A%3D%3D"}],"group":"cf-nel"}
content-type: text/html; charset=utf-8
cache-control: max-age=14400
cf-ray: 61c2a2b129d7d8c9-AMS

GET
H2 200 icons.woff
assets.pay2.secured-by-ingenico.com/templates/generic/responsive/global/fonts/icons/ 9 KB
9 KB 56ms
23ms Font
application/font-woff 2600:9000:2104:4e00:15:285b:5440:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.pay2.secured-by-ingenico.com/templates/generic/responsive/global/fonts/icons/icons.woff?mn9aw4
Requested by: Host: assets.pay2.secured-by-ingenico.com
URL: https://assets.pay2.secured-by-ingenico.com/templates/generic/responsive/wro/html-header.css?hash=87c85728b6403e92aeac04b0d65aac6a1e0048f6
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2104:4e00:15:285b:5440:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Apache/2.4.39 (Unix) OpenSSL/1.1.1c /
Resource Hash: 97fbe33023fe314b0f76128757e5cb818dee430cd0985e4c418b6bb4b93df78b

Request headers

Origin: https://sklep.etnocafe.pl
Referer: https://assets.pay2.secured-by-ingenico.com/templates/generic/responsive/wro/html-header.css?hash=87c85728b6403e92aeac04b0d65aac6a1e0048f6
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 03 Feb 2021 13:32:24 GMT
via: 1.1 0186e9c41d0aebb13c1398b95b7f4757.cloudfront.net (CloudFront)
last-modified: Wed, 06 Jan 2021 09:02:08 GMT
server: Apache/2.4.39 (Unix) OpenSSL/1.1.1c
age: 64149
etag: W/"+1yoEtZ+vAQBZ5CUhtM0LA=="
vary: Origin
x-cache: Hit from cloudfront
content-type: application/font-woff
access-control-allow-origin: https://sklep.etnocafe.pl
cache-control: public, max-age=31536000000
access-control-allow-credentials: true
x-amz-cf-pop: AMS1-C1
x-amz-cf-id: Ekz1ciSeS_02EnEEezZjEZO86GFkIL_fQbsLLg6bor0BTDgLXpnCDA==
expires: Thu, 03 Feb 2022 13:32:24 GMT

GET
H2 404 ruxitagentjs_ICA2SVfqrux_10175190917092722.js
sklep.etnocafe.pl/ 0
0 29ms
29ms Script
text/html 104.21.9.117
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://sklep.etnocafe.pl/ruxitagentjs_ICA2SVfqrux_10175190917092722.js
Requested by: Host: ajax.cloudflare.com
URL: https://ajax.cloudflare.com/cdn-cgi/scripts/7089c43e/cloudflare-static/rocket-loader.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.21.9.117 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Referer: https://sklep.etnocafe.pl/WPS/so/paga.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 04 Feb 2021 07:21:33 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"max_age":604800,"report_to":"cf-nel"}
age: 116
p3p: CP="IDC DSP COR CURa ADMa OUR IND PHY ONL COM STA"
status: 404 Not Found
powered-by: PrestaShop
cf-request-id: 080d8403130000d8c911bbe000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=GvAg%2FtBhNRNiG5wAbXz2Zue8HdOPWM9Lgerx1HKOGPRILz42ySnAXQkzoEuSGw%2B5ASPeulIkyJXOYNZ%2FA8b6udSEtZe6B4VQxVbSGuIiAT9gYg%3D%3D"}],"group":"cf-nel"}
content-type: text/html; charset=utf-8
cache-control: max-age=14400
cf-ray: 61c2a2b1bb00d8c9-AMS

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Swiss Post (Transportation)

27 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.etnocafe.pl/	1970-01-19 16:36:55	Name: __cfduid Value: db3b9c9b22d0ea87b2bbd0377908f92131612423293

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.cloudflare.com
assets.pay2.secured-by-ingenico.com
sklep.etnocafe.pl
www.evoting.ch
104.21.9.117
194.41.149.22
2600:9000:2104:4e00:15:285b:5440:93a1
2606:4700::6810:a823
467873eb5bdd68b2a4c284d80bed7a2428492c768b6177f7e3d0d24eb7393168
65d212e6fdad69835e39d2ffd7bd334c1a7f5c04fd1c58e78cab4b0a82207407
7b43ca5781a67ad4c94aef6dab18af2c786bffde0cdce930c283f730c4819933
9236a1049f1d6ff5fedabceaf3f7ee9e749b32503a02a7c6f9bc7990216fb98b
97fbe33023fe314b0f76128757e5cb818dee430cd0985e4c418b6bb4b93df78b
a79629b1e709636731e775bbcb8dac9f0887e567325e26cafc52071a099950ef
a93e762b2b4f4467624976b17efdbbb61b1a45240efd8364235805116d6a67bc
b08cdbc2d30e656a86b20f8342428d5863f70f4b30135b4f4061f754ce932f5e
cd9102eea22852ca068d38cccb676a169e6402567e5475c879f2d78781823b24
e543dc00a143cd3fd077da005c3fa2e8564aad9f712e45e826959f29f36bb383

sklep.etnocafe.pl Open in urlscan Pro 104.21.9.117 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

9 Requests

100 %HTTPS

50 %IPv6

4 Domains

4 Subdomains

5 IPs

2 Countries

177 kBTransfer

603 kBSize

1 Cookies

3 Outgoing links

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 3 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

27 JavaScript Global Variables

1 Cookies

Indicators

sklep.etnocafe.pl Open in urlscan Pro
104.21.9.117 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

100 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

5
IPs

2
Countries

177 kB
Transfer

603 kB
Size

1
Cookies

9 HTTP transactions
3 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!