securac.cz - urlscan.io

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 7 HTTP transactions. The main IP is 2001:1528:123:123::d151, located in Czech Republic and belongs to CASABLANCA-AS Internet & Collocation Provider, CZ. The main domain is securac.cz.
TLS certificate: Issued by R3 on January 8th 2024. Valid for: 3 months.

This is the only time securac.cz was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Cembra (Banking)

Domain & IP information

	IP Address		AS Autonomous System
1 8	2001:1528:123... 2001:1528:123:123::d151		15685 (CASABLANC...) (CASABLANCA-AS Internet & Collocation Provider)
7	1

8 2001:1528:123:123::d151 (Czech Republic) 1 redirects

ASN15685 (CASABLANCA-AS Internet & Collocation Provider, CZ)

securac.cz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	securac.cz 1 redirects securac.cz	96 KB
7	1

	Domain	Requested by
8	securac.cz	1 redirects securac.cz
7	1

This site contains no links.

Subject Issuer	Validity	Valid
securac.cz R3	`2024-01-08` - `2024-04-07`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://securac.cz/wp-content/themes/kunden/cembra/web-tag/index.php?userID=b0bd0a2667c494b1a5d058b68beb10db&ue=ef3a4e0ce104bd4ac8bf2d850e927a1e
Frame ID: 1AC4592703CC1571348BD6BD2498F80D
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Cembra Money Bank

Page URL History Show full URLs

https://securac.cz/wp-content/themes/kunden/cembra/ HTTP 302
https://securac.cz/wp-content/themes/kunden/cembra/web-tag/index.php?userID=b0bd0a2667c494b1a5d... Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

7
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

96 kB
Transfer

107 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://securac.cz/wp-content/themes/kunden/cembra/ HTTP 302
https://securac.cz/wp-content/themes/kunden/cembra/web-tag/index.php?userID=b0bd0a2667c494b1a5d058b68beb10db&ue=ef3a4e0ce104bd4ac8bf2d850e927a1e Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request index.php Show response securac.cz/wp-content/themes/kunden/cembra/web-tag/ Redirect Chain https://securac.cz/wp-content/themes/kunden/cembra/ https://securac.cz/wp-content/themes/kunden/cembra/web-tag/index.php?userID=b0bd0a2667c494b1a5d058b68beb10db&ue=ef3a4e0ce104bd4ac8bf2d850e927a1e	3 KB 1 KB	163ms 163ms	Document text/html	2001:1528:123:123::d151 CASABLANCA-AS Int...
General Check archive.org Show headers Download Go to Full URL https://securac.cz/wp-content/themes/kunden/cembra/web-tag/index.php?userID=b0bd0a2667c494b1a5d058b68beb10db&ue=ef3a4e0ce104bd4ac8bf2d850e927a1e Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:1528:123:123::d151 , Czech Republic, ASN15685 (CASABLANCA-AS Internet & Collocation Provider, CZ), Reverse DNS Software Apache / Resource Hash `1447584f52e94daf8c2beda31c3ba15c573e437e0130c46ffebf1aeb620c3164` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers content-encoding gzip content-length 1071 content-type text/html; charset=UTF-8 date Wed, 10 Jan 2024 21:08:31 GMT server Apache vary Accept-Encoding Redirect headers content-length 0 content-type text/html; charset=UTF-8 date Wed, 10 Jan 2024 21:08:30 GMT location web-tag/index.php?userID=b0bd0a2667c494b1a5d058b68beb10db&ue=ef3a4e0ce104bd4ac8bf2d850e927a1e server Apache
GET H2	200	zwa9.css securac.cz/wp-content/themes/kunden/cembra/web-tag/files/css/	10 KB 2 KB	57ms 56ms	Stylesheet text/css	2001:1528:123:123::d151 CASABLANCA-AS Int...
General Check archive.org Show headers Download Go to Full URL https://securac.cz/wp-content/themes/kunden/cembra/web-tag/files/css/zwa9.css Requested by Host: securac.cz URL: https://securac.cz/wp-content/themes/kunden/cembra/web-tag/index.php?userID=b0bd0a2667c494b1a5d058b68beb10db&ue=ef3a4e0ce104bd4ac8bf2d850e927a1e Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:1528:123:123::d151 , Czech Republic, ASN15685 (CASABLANCA-AS Internet & Collocation Provider, CZ), Reverse DNS Software Apache / Resource Hash `906f39bd7d9a664f71de950adcc666ff37ae3461a30e2de30abb9d5aad0295a2` Request headers accept-language de-DE,de;q=0.9 Referer https://securac.cz/wp-content/themes/kunden/cembra/web-tag/index.php?userID=b0bd0a2667c494b1a5d058b68beb10db&ue=ef3a4e0ce104bd4ac8bf2d850e927a1e User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers date Wed, 10 Jan 2024 21:08:31 GMT content-encoding gzip last-modified Wed, 10 Jan 2024 17:48:51 GMT server Apache etag "2961-60e9b0b3a5e16-gzip" vary Accept-Encoding content-type text/css accept-ranges bytes content-length 2438
GET H2	200	loading.gif securac.cz/wp-content/themes/kunden/cembra/web-tag/files/media/	771 B 827 B	55ms 54ms	Image image/gif	2001:1528:123:123::d151 CASABLANCA-AS Int...
General Check archive.org Show headers Download Go to Show image Full URL https://securac.cz/wp-content/themes/kunden/cembra/web-tag/files/media/loading.gif Requested by Host: securac.cz URL: https://securac.cz/wp-content/themes/kunden/cembra/web-tag/index.php?userID=b0bd0a2667c494b1a5d058b68beb10db&ue=ef3a4e0ce104bd4ac8bf2d850e927a1e Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:1528:123:123::d151 , Czech Republic, ASN15685 (CASABLANCA-AS Internet & Collocation Provider, CZ), Reverse DNS Software Apache / Resource Hash `81a161d5793ac2a33f02ddcd64fb0dc2d028616dac084e4f64e77f4898b0c4e4` Request headers accept-language de-DE,de;q=0.9 Referer https://securac.cz/wp-content/themes/kunden/cembra/web-tag/index.php?userID=b0bd0a2667c494b1a5d058b68beb10db&ue=ef3a4e0ce104bd4ac8bf2d850e927a1e User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers date Wed, 10 Jan 2024 21:08:31 GMT last-modified Wed, 10 Jan 2024 17:48:51 GMT server Apache accept-ranges bytes etag "303-60e9b0b3a3ed6" content-length 771 content-type image/gif
GET H2	200	cembra-money-bank.jpg securac.cz/wp-content/themes/kunden/cembra/web-tag/files/media/	16 KB 16 KB	54ms 53ms	Image image/jpeg	2001:1528:123:123::d151 CASABLANCA-AS Int...
General Check archive.org Show headers Download Go to Show image Full URL https://securac.cz/wp-content/themes/kunden/cembra/web-tag/files/media/cembra-money-bank.jpg Requested by Host: securac.cz URL: https://securac.cz/wp-content/themes/kunden/cembra/web-tag/index.php?userID=b0bd0a2667c494b1a5d058b68beb10db&ue=ef3a4e0ce104bd4ac8bf2d850e927a1e Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:1528:123:123::d151 , Czech Republic, ASN15685 (CASABLANCA-AS Internet & Collocation Provider, CZ), Reverse DNS Software Apache / Resource Hash `11c40bb68547fd1327303034cd0734ac6dc4d93ce529a5298297384674e3b9a6` Request headers accept-language de-DE,de;q=0.9 Referer https://securac.cz/wp-content/themes/kunden/cembra/web-tag/index.php?userID=b0bd0a2667c494b1a5d058b68beb10db&ue=ef3a4e0ce104bd4ac8bf2d850e927a1e User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers date Wed, 10 Jan 2024 21:08:31 GMT last-modified Wed, 10 Jan 2024 17:48:51 GMT server Apache accept-ranges bytes etag "3e4b-60e9b0b3a4e76" content-length 15947 content-type image/jpeg
GET H2	200	haraka.js Show response securac.cz/wp-content/themes/kunden/cembra/web-tag/files/js/	2 KB 967 B	55ms 55ms	Script application/javascript	2001:1528:123:123::d151 CASABLANCA-AS Int...
General Check archive.org Show headers Download Go to Full URL https://securac.cz/wp-content/themes/kunden/cembra/web-tag/files/js/haraka.js Requested by Host: securac.cz URL: https://securac.cz/wp-content/themes/kunden/cembra/web-tag/index.php?userID=b0bd0a2667c494b1a5d058b68beb10db&ue=ef3a4e0ce104bd4ac8bf2d850e927a1e Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:1528:123:123::d151 , Czech Republic, ASN15685 (CASABLANCA-AS Internet & Collocation Provider, CZ), Reverse DNS Software Apache / Resource Hash `e6f817cf29a8944353918f33a69cf1c0cb1ea5d19b885035e0c53b23244ab95d` Request headers accept-language de-DE,de;q=0.9 Referer https://securac.cz/wp-content/themes/kunden/cembra/web-tag/index.php?userID=b0bd0a2667c494b1a5d058b68beb10db&ue=ef3a4e0ce104bd4ac8bf2d850e927a1e User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers date Wed, 10 Jan 2024 21:08:31 GMT content-encoding gzip last-modified Wed, 10 Jan 2024 17:48:51 GMT server Apache etag "949-60e9b0b3a3ed6-gzip" vary Accept-Encoding content-type application/javascript accept-ranges bytes content-length 896
GET H2	200	eservice-login-background.jpg securac.cz/wp-content/themes/kunden/cembra/web-tag/files/media/	34 KB 34 KB	27ms 27ms	Image image/jpeg	2001:1528:123:123::d151 CASABLANCA-AS Int...
General Check archive.org Show headers Download Go to Show image Full URL https://securac.cz/wp-content/themes/kunden/cembra/web-tag/files/media/eservice-login-background.jpg Requested by Host: securac.cz URL: https://securac.cz/wp-content/themes/kunden/cembra/web-tag/files/css/zwa9.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:1528:123:123::d151 , Czech Republic, ASN15685 (CASABLANCA-AS Internet & Collocation Provider, CZ), Reverse DNS Software Apache / Resource Hash `ed5c4f940fbb29ad6ea580e52d696b5badd28efa17ef068f0dda1f5c4026ca45` Request headers accept-language de-DE,de;q=0.9 Referer https://securac.cz/wp-content/themes/kunden/cembra/web-tag/files/css/zwa9.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers date Wed, 10 Jan 2024 21:08:31 GMT last-modified Wed, 10 Jan 2024 17:48:51 GMT server Apache accept-ranges bytes etag "88e5-60e9b0b3a4e76" content-length 35045 content-type image/jpeg
GET H2	200	vistasansbook.ttf securac.cz/wp-content/themes/kunden/cembra/web-tag/files/fonts/	41 KB 41 KB	54ms 54ms	Font font/ttf	2001:1528:123:123::d151 CASABLANCA-AS Int...
General Check archive.org Show headers Download Go to Full URL https://securac.cz/wp-content/themes/kunden/cembra/web-tag/files/fonts/vistasansbook.ttf Requested by Host: securac.cz URL: https://securac.cz/wp-content/themes/kunden/cembra/web-tag/files/css/zwa9.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:1528:123:123::d151 , Czech Republic, ASN15685 (CASABLANCA-AS Internet & Collocation Provider, CZ), Reverse DNS Software Apache / Resource Hash `2cdf7b714b400e42976e625112e79c0b280551dcb7317859ece57f30608f3209` Request headers Referer https://securac.cz/wp-content/themes/kunden/cembra/web-tag/files/css/zwa9.css Origin https://securac.cz accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36 Response headers date Wed, 10 Jan 2024 21:08:31 GMT last-modified Wed, 10 Jan 2024 17:48:51 GMT server Apache accept-ranges bytes etag "a37c-60e9b0b3a4e76" content-length 41852 content-type font/ttf

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Cembra (Banking)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture function| maxLengthCheck function| addSlashes function| cardspace

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

securac.cz
2001:1528:123:123::d151
11c40bb68547fd1327303034cd0734ac6dc4d93ce529a5298297384674e3b9a6
1447584f52e94daf8c2beda31c3ba15c573e437e0130c46ffebf1aeb620c3164
2cdf7b714b400e42976e625112e79c0b280551dcb7317859ece57f30608f3209
81a161d5793ac2a33f02ddcd64fb0dc2d028616dac084e4f64e77f4898b0c4e4
906f39bd7d9a664f71de950adcc666ff37ae3461a30e2de30abb9d5aad0295a2
e6f817cf29a8944353918f33a69cf1c0cb1ea5d19b885035e0c53b23244ab95d
ed5c4f940fbb29ad6ea580e52d696b5badd28efa17ef068f0dda1f5c4026ca45

securac.cz Open in urlscan Pro 2001:1528:123:123::d151 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

7 Requests

100 %HTTPS

100 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

96 kBTransfer

107 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

0 Cookies

Indicators

securac.cz Open in urlscan Pro
2001:1528:123:123::d151 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

7
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

96 kB
Transfer

107 kB
Size

0
Cookies

7 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!