www.ogsoft.cz Open in urlscan Pro
91.227.7.70 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://shmre.azureedge.net/
Effective URL:
https://www.ogsoft.cz/modules/mod_simplefileuploadv1.3/elements/shrme/verification/2MNC25AN1DN4BME24DM1/index.php?coun...
Submission Tags: https://phish.report @phish_report Search All
Submission: On September 22 via api (September 22nd 2022, 8:22:19 am UTC) from FI — Scanned from FI

Summary HTTP 1 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 1 HTTP transactions. The main IP is 91.227.7.70, located in Czech Republic and belongs to RESAL-AS, CZ. The main domain is www.ogsoft.cz.
TLS certificate: Issued by AlpiroSSL RSA DV CA on December 13th 2021. Valid for: a year.

This is the only time www.ogsoft.cz was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Shopify (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 1	2620:1ec:40::44 2620:1ec:40::44	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
4 5	91.227.7.70 91.227.7.70	56717 (RESAL-AS) (RESAL-AS)
1	2

1 2620:1ec:40::44 (United States) 1 redirects

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

shmre.azureedge.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 91.227.7.70 (Czech Republic) 4 redirects

ASN56717 (RESAL-AS, CZ)
PTR: 70-7-227-91.dc.resal.cz

ogsoft.cz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.ogsoft.cz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	ogsoft.cz 4 redirects ogsoft.cz www.ogsoft.cz	583 KB
1	azureedge.net 1 redirects shmre.azureedge.net	287 B
1	2

	Domain	Requested by
4	www.ogsoft.cz	3 redirects
1	ogsoft.cz	1 redirects
1	shmre.azureedge.net	1 redirects
1	3

This site contains no links.

Subject Issuer	Validity	Valid
www.ogsoft.cz AlpiroSSL RSA DV CA	`2021-12-13` - `2022-12-13`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://www.ogsoft.cz/modules/mod_simplefileuploadv1.3/elements/shrme/verification/2MNC25AN1DN4BME24DM1/index.php?country.x=FI-Finland&lang.x=en
Frame ID: 9C6ECA0426AAFBE79A290E724452A53F
Requests: 3 HTTP requests in this frame

Frame: data://truncated
Frame ID: 67A9502F35841E637ADD1DAF4293442D
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Shopify

Page URL History Show full URLs

http://shmre.azureedge.net/ HTTP 308
http://ogsoft.cz/modules/mod_simplefileuploadv1.3/elements/shrme HTTP 301
http://www.ogsoft.cz/modules/mod_simplefileuploadv1.3/elements/shrme HTTP 301
https://www.ogsoft.cz/modules/mod_simplefileuploadv1.3/elements/shrme HTTP 301
https://www.ogsoft.cz/modules/mod_simplefileuploadv1.3/elements/shrme/ HTTP 302
https://www.ogsoft.cz/modules/mod_simplefileuploadv1.3/elements/shrme/verification/2MNC25AN1DN4BME... Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

1
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

3
Subdomains

2
IPs

2
Countries

618 kB
Transfer

1626 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://shmre.azureedge.net/ HTTP 308
http://ogsoft.cz/modules/mod_simplefileuploadv1.3/elements/shrme HTTP 301
http://www.ogsoft.cz/modules/mod_simplefileuploadv1.3/elements/shrme HTTP 301
https://www.ogsoft.cz/modules/mod_simplefileuploadv1.3/elements/shrme HTTP 301
https://www.ogsoft.cz/modules/mod_simplefileuploadv1.3/elements/shrme/ HTTP 302
https://www.ogsoft.cz/modules/mod_simplefileuploadv1.3/elements/shrme/verification/2MNC25AN1DN4BME24DM1/index.php?country.x=FI-Finland&lang.x=en Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

1 HTTP transactions
4 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request index.php Show response www.ogsoft.cz/modules/mod_simplefileuploadv1.3/elements/shrme/verification/2MNC25AN1DN4BME24DM1/ Redirect Chain http://shmre.azureedge.net/ http://ogsoft.cz/modules/mod_simplefileuploadv1.3/elements/shrme http://www.ogsoft.cz/modules/mod_simplefileuploadv1.3/elements/shrme https://www.ogsoft.cz/modules/mod_simplefileuploadv1.3/elements/shrme https://www.ogsoft.cz/modules/mod_simplefileuploadv1.3/elements/shrme/ https://www.ogsoft.cz/modules/mod_simplefileuploadv1.3/elements/shrme/verification/2MNC25AN1DN4BME24DM1/index.php?country.x=FI-Finland&lang.x=en	2 MB 581 KB	104ms 104ms	Document text/html	91.227.7.70 RESAL-AS
General Check archive.org Show headers Download Go to Full URL https://www.ogsoft.cz/modules/mod_simplefileuploadv1.3/elements/shrme/verification/2MNC25AN1DN4BME24DM1/index.php?country.x=FI-Finland&lang.x=en Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 91.227.7.70 , Czech Republic, ASN56717 (RESAL-AS, CZ), Reverse DNS 70-7-227-91.dc.resal.cz Software Apache/2.4.10 (Debian) mod_fastcgi/mod_fastcgi-SNAP-0910052141 mod_fcgid/2.3.9 PHP/5.6.40-0+deb8u1 OpenSSL/1.0.1t / Resource Hash `7aaebe8d5642efbe8c80984a4aedbade3b01b73b052d2b2015312b0de47599bb` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 accept-language fi-FI,fi;q=0.9 Response headers Connection Keep-Alive Content-Encoding gzip Content-Language cs Content-Type text/html; charset=UTF-8 Date Thu, 22 Sep 2022 08:22:14 GMT Keep-Alive timeout=5, max=48 Server Apache/2.4.10 (Debian) mod_fastcgi/mod_fastcgi-SNAP-0910052141 mod_fcgid/2.3.9 PHP/5.6.40-0+deb8u1 OpenSSL/1.0.1t Transfer-Encoding chunked Vary Accept-Encoding Redirect headers Cache-Control no-store, no-cache, must-revalidate Connection Keep-Alive Content-Language cs Content-Type text/html; charset=UTF-8 Date Thu, 22 Sep 2022 08:22:14 GMT Expires Thu, 19 Nov 1981 08:52:00 GMT Keep-Alive timeout=5, max=49 Pragma no-cache Server Apache/2.4.10 (Debian) mod_fastcgi/mod_fastcgi-SNAP-0910052141 mod_fcgid/2.3.9 PHP/5.6.40-0+deb8u1 OpenSSL/1.0.1t Transfer-Encoding chunked location ./verification/2MNC25AN1DN4BME24DM1/index.php?country.x=FI-Finland&lang.x=en
GET DATA	200 OK	truncated /	3 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `31218e858c0c19e74e2c504640631d96bdc143a47314a39c2e9e20cc908f00b8` Request headers accept-language fi-FI,fi;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	37 KB 37 KB		Font font/woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `7cdcb8dafd2f35ec642986935ed106e2c36f93e2a3143297a98cdcf00351744b` Request headers Referer Origin https://www.ogsoft.cz accept-language fi-FI,fi;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers Content-Type font/woff2
GET DATA	200 OK	truncated / Frame 67A9	16 KB 0		Image image/jpeg
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `76d88b182de9fb2fc737373f07d88e8077a4cf241c24aa690d773aaa2c990607` Request headers accept-language fi-FI,fi;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers Content-Type image/jpeg
GET DATA	200 OK	truncated / Frame 67A9	4 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `25160d1a05da787452b5cb119049bcf4c734b41845b981ab80e0a5b9fb860bf7` Request headers accept-language fi-FI,fi;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers Content-Type image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Shopify (Online)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.ogsoft.cz/	1969-12-31 23:59:59	Name: PHPSESSID Value: ta0fo7busfg8rfaeeloh1cmvne

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ogsoft.cz
shmre.azureedge.net
www.ogsoft.cz
2620:1ec:40::44
91.227.7.70
25160d1a05da787452b5cb119049bcf4c734b41845b981ab80e0a5b9fb860bf7
31218e858c0c19e74e2c504640631d96bdc143a47314a39c2e9e20cc908f00b8
76d88b182de9fb2fc737373f07d88e8077a4cf241c24aa690d773aaa2c990607
7aaebe8d5642efbe8c80984a4aedbade3b01b73b052d2b2015312b0de47599bb
7cdcb8dafd2f35ec642986935ed106e2c36f93e2a3143297a98cdcf00351744b

www.ogsoft.cz Open in urlscan Pro 91.227.7.70 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

1 Requests

100 %HTTPS

50 %IPv6

2 Domains

3 Subdomains

2 IPs

2 Countries

618 kBTransfer

1626 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

1 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 4 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

11 JavaScript Global Variables

1 Cookies

Indicators

www.ogsoft.cz Open in urlscan Pro
91.227.7.70 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

1
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

3
Subdomains

2
IPs

2
Countries

618 kB
Transfer

1626 kB
Size

1
Cookies

1 HTTP transactions
4 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!