kurierwujek.com Open in urlscan Pro
8.208.11.18 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://kurierwujek.com/oplata425/
Submission: On July 22 via automatic, source phishtank (July 22nd 2019, 10:00:24 am UTC)

Summary HTTP 18 Redirects Links 2 Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 18 HTTP transactions. The main IP is 8.208.11.18, located in United Kingdom and belongs to CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd., CN. The main domain is kurierwujek.com.

This is the only time kurierwujek.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: PayU (Financial)

Domain & IP information

	IP Address	AS Autonomous System
14	8.208.11.18 8.208.11.18	45102 (CNNIC-ALI...) (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co.)
2	2a00:1450:400... 2a00:1450:4001:824::200a	15169 (GOOGLE) (GOOGLE - Google LLC)
2	2a00:1450:400... 2a00:1450:4001:815::2003	15169 (GOOGLE) (GOOGLE - Google LLC)
18	3

14 8.208.11.18 (United Kingdom)

ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd., CN)

kurierwujek.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:824::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:815::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
14	kurierwujek.com kurierwujek.com	713 KB
2	gstatic.com fonts.gstatic.com	16 KB
2	googleapis.com fonts.googleapis.com	1 KB
18	3

	Domain	Requested by
14	kurierwujek.com	kurierwujek.com
2	fonts.gstatic.com	kurierwujek.com
2	fonts.googleapis.com	kurierwujek.com
18	3

This site contains links to these domains. Also see Links.

Domain
static.payu.com

Subject Issuer	Validity	Valid
	`1970-01-01` - `1970-01-01`	a few seconds	crt.sh
*.googleapis.com Google Internet Authority G3	`2019-06-18` - `2019-09-10`	3 months	crt.sh
*.google.com Google Internet Authority G3	`2019-06-18` - `2019-09-10`	3 months	crt.sh

This page contains 1 frames:

Primary Page: http://kurierwujek.com/oplata425/
Frame ID: 4AB0D8654E02E90E1526784DAE647808
Requests: 18 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i
script /(?:\/([\d.]+))?(?:\/js)?\/bootstrap(?:\.min)?\.js/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

18
Requests

22 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

731 kB
Transfer

1058 kB
Size

0
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://static.payu.com/sites/terms/files/payu_privacy_policy_en_en.pdf
Title: Polityka prywatności

Search URL Search Domain Scan URL

URL: https://static.payu.com/sites/terms/files/PayU_cookies_policy.pdf
Title: Polityka plików cookie

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

18 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request Cookie set / Show response
kurierwujek.com/oplata425/ 11 KB
4 KB 316ms
148ms Document
text/html 8.208.11.18
CNNIC-ALIBABA-US-...

General

Check archive.org

Show headers Download Go to

Full URL

http://kurierwujek.com/oplata425/

Protocol

HTTP/1.1

Server

8.208.11.18 , United Kingdom, ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd., CN),

Reverse DNS

Software

nginx /

Resource Hash

e63c85a1695a2bcd0d94a1a12a03fe29efaac80c70961e62717427ac585e2bb8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Host: kurierwujek.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Server: nginx
Date: Mon, 22 Jul 2019 10:00:04 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding Accept-Encoding
Cache-Control: no-cache, private
Set-Cookie: XSRF-TOKEN=eyJpdiI6Ik04ckZ5TmZoRGdEN1FrYkhZeU90NUE9PSIsInZhbHVlIjoieHBQMkhaZ0VEb0NFUEVBZE5OcTBHWHF6MzRzbWlXOHhHOGtRXC94TGRUb1lxVDZBc3hxK0lqcTBVQkQ0eUI5OFciLCJtYWMiOiI0NGI4MWM4Yzk3YzI5ZGVjNjQ2N2E4MWVmMzVlNTUzZjI5NGY5N2NkYWVkMWRiNGQxNjZiM2VkZTVlY2IzZGVhIn0%3D; expires=Mon, 22-Jul-2019 11:55:28 GMT; Max-Age=7200; path=/ laravel_session=eyJpdiI6IjhiaVRGVnJJNEEyR3RSYjlnWTJBVkE9PSIsInZhbHVlIjoibVUzTk5PU0FyQ2cyNmw3SVByZFJQTHlEQ3ZVcWVCNCtGOVdGWW1XVWlRcHowT1ZHanUxcnpaaXZudFVsKzZlMSIsIm1hYyI6ImY4OGVmNTZlMGY1MTc2MDQ5YTJiOGViMTI1MmUyNjhkNzM1YjQxNmExNTgxNzM4NTA2ZWRhN2ViMzM0NTJjNDkifQ%3D%3D; expires=Mon, 22-Jul-2019 11:55:28 GMT; Max-Age=7200; path=/; httponly
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
X-Nginx-Cache-Status: UPDATING
X-Server-Powered-By: Engintron
Content-Encoding: gzip

GET
H/1.1 200
OK all.min.css
kurierwujek.com/oplata425/web%20assets/css/ 63 KB
13 KB 430ms
430ms Stylesheet
text/css 8.208.11.18
CNNIC-ALIBABA-US-...

General

Check archive.org

Show headers Download Go to

Full URL: http://kurierwujek.com/oplata425/web%20assets/css/all.min.css
Requested by: Host: kurierwujek.com
URL: http://kurierwujek.com/oplata425/
Protocol: HTTP/1.1
Security: , ,
Server: 8.208.11.18 , United Kingdom, ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd., CN),
Reverse DNS
Software: nginx /
Resource Hash: fe30f3816c32ad3738751780487d021dd1b1d30ed157d4d7e173b9bc51de559c

Request headers

Referer: http://kurierwujek.com/oplata425/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: public
Date: Mon, 22 Jul 2019 10:00:05 GMT
Content-Encoding: gzip
Last-Modified: Fri, 05 Apr 2019 08:22:38 GMT
Server: nginx
Vary: Accept-Encoding, Accept-Encoding
Content-Type: text/css
Cache-Control: max-age=2592000
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Wed, 21 Aug 2019 10:00:05 GMT

GET
H/1.1 200
OK bootstrap.min.css
kurierwujek.com/oplata425/web%20assets/css/ 118 KB
20 KB 733ms
717ms Stylesheet
text/css 8.208.11.18
CNNIC-ALIBABA-US-...

General

Check archive.org

Show headers Download Go to

Full URL: http://kurierwujek.com/oplata425/web%20assets/css/bootstrap.min.css
Requested by: Host: kurierwujek.com
URL: http://kurierwujek.com/oplata425/
Protocol: HTTP/1.1
Security: , ,
Server: 8.208.11.18 , United Kingdom, ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd., CN),
Reverse DNS
Software: nginx /
Resource Hash: 880de7665b1aaa840303313deca3352af257d55aed4584d5e17f0fbffe0fde01

Request headers

Referer: http://kurierwujek.com/oplata425/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: public
Date: Mon, 22 Jul 2019 10:00:05 GMT
Content-Encoding: gzip
Last-Modified: Fri, 05 Apr 2019 08:22:38 GMT
Server: nginx
Vary: Accept-Encoding, Accept-Encoding
Content-Type: text/css
Cache-Control: max-age=2592000
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Wed, 21 Aug 2019 10:00:05 GMT

GET
H2 200 css
fonts.googleapis.com/ 2 KB
564 B 17ms
16ms Stylesheet
text/css 2a00:1450:4001:824::200a
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans

Requested by

Host: kurierwujek.com
URL: http://kurierwujek.com/oplata425/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:824::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

44c4d4c588aa7b984e0ee91d211845cb588b0d17dbcd1f17bf01aa3f16f291a5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: http://kurierwujek.com/oplata425/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Mon, 22 Jul 2019 10:00:04 GMT
server: ESF
access-control-allow-origin: *
date: Mon, 22 Jul 2019 10:00:04 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
x-xss-protection: 0
expires: Mon, 22 Jul 2019 10:00:04 GMT

GET
H2 200 css
fonts.googleapis.com/ 1 KB
532 B 16ms
15ms Stylesheet
text/css 2a00:1450:4001:824::200a
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Caveat

Requested by

Host: kurierwujek.com
URL: http://kurierwujek.com/oplata425/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:824::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

9dd1496e09ce5d6d0c41d9ef99540aad691e2fd77c4eb6d72b6765919e92c337

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: http://kurierwujek.com/oplata425/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Mon, 22 Jul 2019 10:00:04 GMT
server: ESF
access-control-allow-origin: *
date: Mon, 22 Jul 2019 10:00:04 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
x-xss-protection: 0
expires: Mon, 22 Jul 2019 10:00:04 GMT

GET
H/1.1 200
OK style.css
kurierwujek.com/oplata425/web%20assets/css/ 95 KB
17 KB 992ms
538ms Stylesheet
text/css 8.208.11.18
CNNIC-ALIBABA-US-...

General

Check archive.org

Show headers Download Go to

Full URL: http://kurierwujek.com/oplata425/web%20assets/css/style.css
Requested by: Host: kurierwujek.com
URL: http://kurierwujek.com/oplata425/
Protocol: HTTP/1.1
Security: , ,
Server: 8.208.11.18 , United Kingdom, ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd., CN),
Reverse DNS
Software: nginx /
Resource Hash: 409cedb52a49078124ddbcdc0a29acd13d0bf8d61be04003d527a6482668d229

Request headers

Referer: http://kurierwujek.com/oplata425/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: public
Date: Mon, 22 Jul 2019 10:00:05 GMT
Content-Encoding: gzip
Last-Modified: Sat, 18 May 2019 14:55:28 GMT
Server: nginx
Vary: Accept-Encoding, Accept-Encoding
Content-Type: text/css
Cache-Control: max-age=2592000
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Wed, 21 Aug 2019 10:00:05 GMT

GET
H/1.1 200
OK responsive.css
kurierwujek.com/oplata425/web%20assets/css/ 8 KB
2 KB 925ms
166ms Stylesheet
text/css 8.208.11.18
CNNIC-ALIBABA-US-...

General

Check archive.org

Show headers Download Go to

Full URL: http://kurierwujek.com/oplata425/web%20assets/css/responsive.css
Requested by: Host: kurierwujek.com
URL: http://kurierwujek.com/oplata425/
Protocol: HTTP/1.1
Security: , ,
Server: 8.208.11.18 , United Kingdom, ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd., CN),
Reverse DNS
Software: nginx /
Resource Hash: d625ccc367b1a8a07d5372afe88fff41199ffd3ef7e7ab4f3f3cbd0502a69f7c

Request headers

Referer: http://kurierwujek.com/oplata425/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: public
Date: Mon, 22 Jul 2019 10:00:05 GMT
Content-Encoding: gzip
Last-Modified: Tue, 23 Apr 2019 22:50:42 GMT
Server: nginx
Vary: Accept-Encoding, Accept-Encoding
Content-Type: text/css
Cache-Control: max-age=2592000
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Wed, 21 Aug 2019 10:00:05 GMT

GET
H/1.1 200
OK bankTransfer.png
kurierwujek.com/oplata425/web%20assets/images/ 696 B
993 B 3684ms
135ms Image
image/png 8.208.11.18
CNNIC-ALIBABA-US-...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://kurierwujek.com/oplata425/web%20assets/images/bankTransfer.png
Requested by: Host: kurierwujek.com
URL: http://kurierwujek.com/oplata425/
Protocol: HTTP/1.1
Security: , ,
Server: 8.208.11.18 , United Kingdom, ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd., CN),
Reverse DNS
Software: nginx /
Resource Hash: 8f38c4190f0ae864a330f843e8245babeebe416fea081c4d1e36a68922be4b60

Request headers

Referer: http://kurierwujek.com/oplata425/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: public
Date: Mon, 22 Jul 2019 10:00:08 GMT
Last-Modified: Fri, 05 Apr 2019 08:22:38 GMT
Server: nginx
Content-Type: image/png
Cache-Control: max-age=5184000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 696
Expires: Fri, 20 Sep 2019 10:00:08 GMT

GET
H/1.1 200
OK paymentCard.png
kurierwujek.com/oplata425/web%20assets/images/ 527 B
824 B 3692ms
134ms Image
image/png 8.208.11.18
CNNIC-ALIBABA-US-...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://kurierwujek.com/oplata425/web%20assets/images/paymentCard.png
Requested by: Host: kurierwujek.com
URL: http://kurierwujek.com/oplata425/
Protocol: HTTP/1.1
Security: , ,
Server: 8.208.11.18 , United Kingdom, ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd., CN),
Reverse DNS
Software: nginx /
Resource Hash: 60024d754f22fa2fc3e6f293aa5b467ee47ee598d037869a46e0de4f040d00f1

Request headers

Referer: http://kurierwujek.com/oplata425/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: public
Date: Mon, 22 Jul 2019 10:00:08 GMT
Last-Modified: Fri, 05 Apr 2019 08:22:38 GMT
Server: nginx
Content-Type: image/png
Cache-Control: max-age=5184000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 527
Expires: Fri, 20 Sep 2019 10:00:08 GMT

GET
H/1.1 200
OK digitalWallets.png
kurierwujek.com/oplata425/web%20assets/images/ 575 B
872 B 2938ms
149ms Image
image/png 8.208.11.18
CNNIC-ALIBABA-US-...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://kurierwujek.com/oplata425/web%20assets/images/digitalWallets.png
Requested by: Host: kurierwujek.com
URL: http://kurierwujek.com/oplata425/
Protocol: HTTP/1.1
Security: , ,
Server: 8.208.11.18 , United Kingdom, ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd., CN),
Reverse DNS
Software: nginx /
Resource Hash: 5dbe6b30beed853fae48416d706bfdaba98b18c2259ad3f5ab804277b23d05ac

Request headers

Referer: http://kurierwujek.com/oplata425/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: public
Date: Mon, 22 Jul 2019 10:00:08 GMT
Last-Modified: Fri, 05 Apr 2019 08:22:38 GMT
Server: nginx
Content-Type: image/png
Cache-Control: max-age=5184000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 575
Expires: Fri, 20 Sep 2019 10:00:08 GMT

GET
H/1.1 200
OK jquery.min.js Show response
kurierwujek.com/oplata425/web%20assets/js/ 94 KB
33 KB 3122ms
443ms Script
application/javascript 8.208.11.18
CNNIC-ALIBABA-US-...

General

Check archive.org

Show headers Download Go to

Full URL: http://kurierwujek.com/oplata425/web%20assets/js/jquery.min.js
Requested by: Host: kurierwujek.com
URL: http://kurierwujek.com/oplata425/
Protocol: HTTP/1.1
Security: , ,
Server: 8.208.11.18 , United Kingdom, ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd., CN),
Reverse DNS
Software: nginx /
Resource Hash: 100a135d8e7d5ebf1fe83b0b16da1d8d8b2321acdc4d5c24a1f9a7df53b23cf1

Request headers

Referer: http://kurierwujek.com/oplata425/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: public
Date: Mon, 22 Jul 2019 10:00:07 GMT
Content-Encoding: gzip
Last-Modified: Fri, 05 Apr 2019 08:22:38 GMT
Server: nginx
Vary: Accept-Encoding, Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=2592000
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Wed, 21 Aug 2019 10:00:07 GMT

GET
H/1.1 200
OK bootstrap.min.js Show response
kurierwujek.com/oplata425/web%20assets/js/ 36 KB
10 KB 2798ms
252ms Script
application/javascript 8.208.11.18
CNNIC-ALIBABA-US-...

General

Check archive.org

Show headers Download Go to

Full URL: http://kurierwujek.com/oplata425/web%20assets/js/bootstrap.min.js
Requested by: Host: kurierwujek.com
URL: http://kurierwujek.com/oplata425/
Protocol: HTTP/1.1
Security: , ,
Server: 8.208.11.18 , United Kingdom, ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd., CN),
Reverse DNS
Software: nginx /
Resource Hash: 5a4a5359110a773bd154da94c48ffd6a6233a29dfd5a9314555f5ae6c3e47459

Request headers

Referer: http://kurierwujek.com/oplata425/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: public
Date: Mon, 22 Jul 2019 10:00:08 GMT
Content-Encoding: gzip
Last-Modified: Fri, 05 Apr 2019 08:22:38 GMT
Server: nginx
Vary: Accept-Encoding, Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=2592000
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Wed, 21 Aug 2019 10:00:08 GMT

GET
H/1.1 200
OK background_1680x1050.jpg
kurierwujek.com/oplata425/web%20assets/images/ 49 KB
49 KB 3066ms
269ms Image
image/jpeg 8.208.11.18
CNNIC-ALIBABA-US-...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://kurierwujek.com/oplata425/web%20assets/images/background_1680x1050.jpg
Requested by: Host: kurierwujek.com
URL: http://kurierwujek.com/oplata425/
Protocol: HTTP/1.1
Security: , ,
Server: 8.208.11.18 , United Kingdom, ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd., CN),
Reverse DNS
Software: nginx /
Resource Hash: 9a7d61f6076afd4717e83d0270460580510432e36f37faa9fad163f7aabd9820

Request headers

Referer: http://kurierwujek.com/oplata425/web%20assets/css/style.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: public
Date: Mon, 22 Jul 2019 10:00:08 GMT
Last-Modified: Fri, 05 Apr 2019 08:22:38 GMT
Server: nginx
Content-Type: image/jpeg
Cache-Control: max-age=5184000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 50049
Expires: Fri, 20 Sep 2019 10:00:08 GMT

GET
H/1.1 200
OK sprites.png
kurierwujek.com/oplata425/web%20assets/images/ 5 KB
5 KB 2248ms
175ms Image
image/png 8.208.11.18
CNNIC-ALIBABA-US-...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://kurierwujek.com/oplata425/web%20assets/images/sprites.png
Requested by: Host: kurierwujek.com
URL: http://kurierwujek.com/oplata425/
Protocol: HTTP/1.1
Security: , ,
Server: 8.208.11.18 , United Kingdom, ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd., CN),
Reverse DNS
Software: nginx /
Resource Hash: a0a33167458793b8d1107632f9fbeca224bf2160ca067ee99569923f7f6a99ba

Request headers

Referer: http://kurierwujek.com/oplata425/web%20assets/css/style.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: public
Date: Mon, 22 Jul 2019 10:00:08 GMT
Last-Modified: Fri, 05 Apr 2019 08:22:38 GMT
Server: nginx
Content-Type: image/png
Cache-Control: max-age=5184000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 5218
Expires: Fri, 20 Sep 2019 10:00:08 GMT

GET
H2 200 mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
fonts.gstatic.com/s/opensans/v16/ 9 KB
9 KB 7ms
6ms Font
font/woff2 2a00:1450:4001:815::2003
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v16/mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2

Requested by

Host: kurierwujek.com
URL: http://kurierwujek.com/oplata425/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Open+Sans
Origin: http://kurierwujek.com

Response headers

date: Tue, 18 Jun 2019 13:11:30 GMT
x-content-type-options: nosniff
last-modified: Mon, 25 Mar 2019 20:10:29 GMT
server: sffe
age: 2926115
content-type: font/woff2
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-origin: *
content-length: 9132
x-xss-protection: 0
expires: Wed, 17 Jun 2020 13:11:30 GMT

GET
H/1.1 200
OK PFBeauSansPro-Bold_35345.ttf
kurierwujek.com/oplata425/web%20assets/fonts/ 435 KB
436 KB 926ms
304ms Font
font/ttf 8.208.11.18
CNNIC-ALIBABA-US-...

General

Check archive.org

Show headers Download Go to

Full URL: http://kurierwujek.com/oplata425/web%20assets/fonts/PFBeauSansPro-Bold_35345.ttf
Requested by: Host: kurierwujek.com
URL: http://kurierwujek.com/oplata425/
Protocol: HTTP/1.1
Security: , ,
Server: 8.208.11.18 , United Kingdom, ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd., CN),
Reverse DNS
Software: nginx /
Resource Hash: e39d1943e700086e32740242cdd15b101580c58ff2f573d838e38bdd7e68f850

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: http://kurierwujek.com/oplata425/web%20assets/css/style.css
Origin: http://kurierwujek.com

Response headers

Pragma: public
Date: Mon, 22 Jul 2019 10:00:06 GMT
Last-Modified: Fri, 05 Apr 2019 08:22:38 GMT
Server: nginx
Content-Type: font/ttf
Cache-Control: max-age=5184000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 445872
Expires: Fri, 20 Sep 2019 10:00:06 GMT

GET
H/1.1 200
OK roboto-light.ttf
kurierwujek.com/oplata425/web%20assets/fonts/ 122 KB
122 KB 968ms
304ms Font
font/ttf 8.208.11.18
CNNIC-ALIBABA-US-...

General

Check archive.org

Show headers Download Go to

Full URL: http://kurierwujek.com/oplata425/web%20assets/fonts/roboto-light.ttf
Requested by: Host: kurierwujek.com
URL: http://kurierwujek.com/oplata425/
Protocol: HTTP/1.1
Security: , ,
Server: 8.208.11.18 , United Kingdom, ASN45102 (CNNIC-ALIBABA-US-NET-AP Alibaba (US) Technology Co., Ltd., CN),
Reverse DNS
Software: nginx /
Resource Hash: 25126db3c950b29ace3fa5c70371933a29454b4b993d3d6842cf68248e8246a9

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: http://kurierwujek.com/oplata425/web%20assets/css/style.css
Origin: http://kurierwujek.com

Response headers

Pragma: public
Date: Mon, 22 Jul 2019 10:00:06 GMT
Last-Modified: Fri, 05 Apr 2019 08:43:02 GMT
Server: nginx
Content-Type: font/ttf
Cache-Control: max-age=5184000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 124460
Expires: Fri, 20 Sep 2019 10:00:06 GMT

GET
H2 200 mem8YaGs126MiZpBA-UFW50bf8pkAp6a.woff2
fonts.gstatic.com/s/opensans/v16/ 7 KB
7 KB 7ms
6ms Font
font/woff2 2a00:1450:4001:815::2003
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v16/mem8YaGs126MiZpBA-UFW50bf8pkAp6a.woff2

Requested by

Host: kurierwujek.com
URL: http://kurierwujek.com/oplata425/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

6446b6826bb6136c8782e74d99a2ea78cc9cb508cf61f4020fee5415f108c7e1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Open+Sans
Origin: http://kurierwujek.com

Response headers

date: Sun, 02 Jun 2019 16:18:32 GMT
x-content-type-options: nosniff
last-modified: Mon, 25 Mar 2019 20:12:25 GMT
server: sffe
age: 4297293
content-type: font/woff2
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43,39"
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-origin: *
content-length: 7292
x-xss-protection: 0
expires: Mon, 01 Jun 2020 16:18:32 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: PayU (Financial)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.googleapis.com
fonts.gstatic.com
kurierwujek.com
2a00:1450:4001:815::2003
2a00:1450:4001:824::200a
8.208.11.18
100a135d8e7d5ebf1fe83b0b16da1d8d8b2321acdc4d5c24a1f9a7df53b23cf1
25126db3c950b29ace3fa5c70371933a29454b4b993d3d6842cf68248e8246a9
409cedb52a49078124ddbcdc0a29acd13d0bf8d61be04003d527a6482668d229
44c4d4c588aa7b984e0ee91d211845cb588b0d17dbcd1f17bf01aa3f16f291a5
54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775
5a4a5359110a773bd154da94c48ffd6a6233a29dfd5a9314555f5ae6c3e47459
5dbe6b30beed853fae48416d706bfdaba98b18c2259ad3f5ab804277b23d05ac
60024d754f22fa2fc3e6f293aa5b467ee47ee598d037869a46e0de4f040d00f1
6446b6826bb6136c8782e74d99a2ea78cc9cb508cf61f4020fee5415f108c7e1
880de7665b1aaa840303313deca3352af257d55aed4584d5e17f0fbffe0fde01
8f38c4190f0ae864a330f843e8245babeebe416fea081c4d1e36a68922be4b60
9a7d61f6076afd4717e83d0270460580510432e36f37faa9fad163f7aabd9820
9dd1496e09ce5d6d0c41d9ef99540aad691e2fd77c4eb6d72b6765919e92c337
a0a33167458793b8d1107632f9fbeca224bf2160ca067ee99569923f7f6a99ba
d625ccc367b1a8a07d5372afe88fff41199ffd3ef7e7ab4f3f3cbd0502a69f7c
e39d1943e700086e32740242cdd15b101580c58ff2f573d838e38bdd7e68f850
e63c85a1695a2bcd0d94a1a12a03fe29efaac80c70961e62717427ac585e2bb8
fe30f3816c32ad3738751780487d021dd1b1d30ed157d4d7e173b9bc51de559c

kurierwujek.com Open in urlscan Pro 8.208.11.18 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

18 Requests

22 %HTTPS

67 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

731 kBTransfer

1058 kBSize

0 Cookies

2 Outgoing links

Redirected requests

18 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

7 JavaScript Global Variables

0 Cookies

Security Headers

Indicators

kurierwujek.com Open in urlscan Pro
8.208.11.18 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

18
Requests

22 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

731 kB
Transfer

1058 kB
Size

0
Cookies

18 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!