![](/screenshots/9ef3ec6d-b40c-4916-b72b-ad2d60dd93a2.png)
securac.cz
Open in
urlscan Pro
2001:1528:123:123::d151
Malicious Activity!
Public Scan
Effective URL: https://securac.cz/wp-content/themes/kunden/cembra/web-tag/index.php?userID=b0bd0a2667c494b1a5d058b68beb10db&ue=ef3...
Submission: On January 10 via automatic, source phishtank — Scanned from DE
Summary
TLS certificate: Issued by R3 on January 8th 2024. Valid for: 3 months.
This is the only time securac.cz was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Cembra (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 8 | 2001:1528:123... 2001:1528:123:123::d151 | 15685 (CASABLANC...) (CASABLANCA-AS Internet & Collocation Provider) | |
7 | 1 |
ASN15685 (CASABLANCA-AS Internet & Collocation Provider, CZ)
securac.cz |
Apex Domain Subdomains |
Transfer | |
---|---|---|
8 |
securac.cz
1 redirects
securac.cz |
96 KB |
7 | 1 |
Domain | Requested by | |
---|---|---|
8 | securac.cz |
1 redirects
securac.cz
|
7 | 1 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
securac.cz R3 |
2024-01-08 - 2024-04-07 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://securac.cz/wp-content/themes/kunden/cembra/web-tag/index.php?userID=b0bd0a2667c494b1a5d058b68beb10db&ue=ef3a4e0ce104bd4ac8bf2d850e927a1e
Frame ID: 1AC4592703CC1571348BD6BD2498F80D
Requests: 7 HTTP requests in this frame
Screenshot
![](/screenshots/9ef3ec6d-b40c-4916-b72b-ad2d60dd93a2.png)
Page Title
Cembra Money BankPage URL History Show full URLs
-
https://securac.cz/wp-content/themes/kunden/cembra/
HTTP 302
https://securac.cz/wp-content/themes/kunden/cembra/web-tag/index.php?userID=b0bd0a2667c494b1a5d... Page URL
Detected technologies
Detected patterns
- /wp-(?:content|includes)/
Detected patterns
- \.php(?:$|\?)
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://securac.cz/wp-content/themes/kunden/cembra/
HTTP 302
https://securac.cz/wp-content/themes/kunden/cembra/web-tag/index.php?userID=b0bd0a2667c494b1a5d058b68beb10db&ue=ef3a4e0ce104bd4ac8bf2d850e927a1e Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
7 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
index.php
securac.cz/wp-content/themes/kunden/cembra/web-tag/ Redirect Chain
|
3 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
zwa9.css
securac.cz/wp-content/themes/kunden/cembra/web-tag/files/css/ |
10 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
loading.gif
securac.cz/wp-content/themes/kunden/cembra/web-tag/files/media/ |
771 B 827 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cembra-money-bank.jpg
securac.cz/wp-content/themes/kunden/cembra/web-tag/files/media/ |
16 KB 16 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
haraka.js
securac.cz/wp-content/themes/kunden/cembra/web-tag/files/js/ |
2 KB 967 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
eservice-login-background.jpg
securac.cz/wp-content/themes/kunden/cembra/web-tag/files/media/ |
34 KB 34 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
vistasansbook.ttf
securac.cz/wp-content/themes/kunden/cembra/web-tag/files/fonts/ |
41 KB 41 KB |
Font
font/ttf |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Cembra (Banking)4 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| documentPictureInPicture function| maxLengthCheck function| addSlashes function| cardspace0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
securac.cz
2001:1528:123:123::d151
11c40bb68547fd1327303034cd0734ac6dc4d93ce529a5298297384674e3b9a6
1447584f52e94daf8c2beda31c3ba15c573e437e0130c46ffebf1aeb620c3164
2cdf7b714b400e42976e625112e79c0b280551dcb7317859ece57f30608f3209
81a161d5793ac2a33f02ddcd64fb0dc2d028616dac084e4f64e77f4898b0c4e4
906f39bd7d9a664f71de950adcc666ff37ae3461a30e2de30abb9d5aad0295a2
e6f817cf29a8944353918f33a69cf1c0cb1ea5d19b885035e0c53b23244ab95d
ed5c4f940fbb29ad6ea580e52d696b5badd28efa17ef068f0dda1f5c4026ca45