sbernyvuz.cz
Open in
urlscan Pro
81.30.228.247
Malicious Activity!
Public Scan
Submitted URL: http://bitly.com/38pQtKt
Effective URL: http://sbernyvuz.cz/app/tmp/cache/persistent/admin_search_ip/safety.lib/index_bak/loancalc/produs_alerta/contact.php...
Submission: On February 17 via api from FR
Effective URL: http://sbernyvuz.cz/app/tmp/cache/persistent/admin_search_ip/safety.lib/index_bak/loancalc/produs_alerta/contact.php...
Submission: On February 17 via api from FR
Summary
This website contacted 4 IPs
in 3 countries
across 4 domains to perform 4 HTTP transactions.
The main IP is 81.30.228.247, located in
Opava, Czech Republic and
belongs to HA-VEL-LOCAL-AS Czech republic, CZ.
The main domain is sbernyvuz.cz.
This is the only time sbernyvuz.cz was scanned on urlscan.io!
This is the only time sbernyvuz.cz was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Lion's Den Scam (Online)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 1 | 67.199.248.14 67.199.248.14 | 396982 (GOOGLE-PR...) (GOOGLE-PRIVATE-CLOUD) | |
| 2 | 81.30.228.247 81.30.228.247 | 15935 (HA-VEL-LO...) (HA-VEL-LOCAL-AS Czech republic) | |
| 1 | 2a00:1450:400... 2a00:1450:4001:808::200a | 15169 (GOOGLE) (GOOGLE) | |
| 1 | 2606:4700::68... 2606:4700::6811:4104 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
| 4 | 4 |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 2 |
sbernyvuz.cz
sbernyvuz.cz |
466 KB |
| 1 |
cloudflare.com
cdnjs.cloudflare.com |
30 KB |
| 1 |
googleapis.com
fonts.googleapis.com |
|
| 1 |
bitly.com
1 redirects
bitly.com |
464 B |
| 4 | 4 |
| Domain | Requested by | |
|---|---|---|
| 2 | sbernyvuz.cz |
sbernyvuz.cz
|
| 1 | cdnjs.cloudflare.com |
sbernyvuz.cz
|
| 1 | fonts.googleapis.com |
sbernyvuz.cz
|
| 1 | bitly.com | 1 redirects |
| 4 | 4 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| smartpixel.pro |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| cloudflare.com CloudFlare Inc ECC CA-2 |
2020-01-07 - 2020-10-09 |
9 months | crt.sh |
This page contains 1 frames:
Primary Page:
http://sbernyvuz.cz/app/tmp/cache/persistent/admin_search_ip/safety.lib/index_bak/loancalc/produs_alerta/contact.php/rpxsu/cbv/?9n9y9s9h0
Frame ID: 46FC3F9AE24D031B182057C06905AC9A
Requests: 18 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://bitly.com/38pQtKt
HTTP 301
http://sbernyvuz.cz/app/tmp/cache/persistent/admin_search_ip/safety.lib/index_bak/loancalc/produ... Page URL
- http://sbernyvuz.cz/app/tmp/cache/persistent/admin_search_ip/safety.lib/index_bak/loancalc/produ... Page URL
Detected technologies
Debian
(Operating Systems)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /Debian/i
Apache
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
URL: http://smartpixel.pro/4P8pXjRU
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://bitly.com/38pQtKt
HTTP 301
http://sbernyvuz.cz/app/tmp/cache/persistent/admin_search_ip/safety.lib/index_bak/loancalc/produs_alerta/contact.php/pxhbh/ywnt/?bear=1wa0gy7ph7ck7 Page URL
- http://sbernyvuz.cz/app/tmp/cache/persistent/admin_search_ip/safety.lib/index_bak/loancalc/produs_alerta/contact.php/rpxsu/cbv/?9n9y9s9h0 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://bitly.com/38pQtKt HTTP 301
- http://sbernyvuz.cz/app/tmp/cache/persistent/admin_search_ip/safety.lib/index_bak/loancalc/produs_alerta/contact.php/pxhbh/ywnt/?bear=1wa0gy7ph7ck7
- http://cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/jquery.min.js HTTP 307
- https://cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/jquery.min.js
4 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
/
sbernyvuz.cz/app/tmp/cache/persistent/admin_search_ip/safety.lib/index_bak/loancalc/produs_alerta/contact.php/pxhbh/ywnt/ Redirect Chain
|
3 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
Primary Request
/
sbernyvuz.cz/app/tmp/cache/persistent/admin_search_ip/safety.lib/index_bak/loancalc/produs_alerta/contact.php/rpxsu/cbv/ |
670 KB 464 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
css
fonts.googleapis.com/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery.min.js
cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/ Redirect Chain
|
86 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
22 KB 0 |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
7 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
97 KB 0 |
Image
image/jpg |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
107 KB 0 |
Image
image/jpg |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
162 KB 0 |
Image
image/jpg |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/jpg |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/jpg |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/jpg |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
3 KB 0 |
Image
image/jpg |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/jpg |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
3 KB 0 |
Image
image/jpg |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
438 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
34 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Lion's Den Scam (Online)7 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate function| $ function| jQuery object| dayNames object| monthNames object| now0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
bitly.com
cdnjs.cloudflare.com
fonts.googleapis.com
sbernyvuz.cz
2606:4700::6811:4104
2a00:1450:4001:808::200a
67.199.248.14
81.30.228.247
081856038806245dd2c351b84de03dbc72fbca0ce9ac9eb52ff61e91e4c61a27
085d4ea157dc30d2446b98590635dc737e525d21a8666bb17efed1f9d592a5df
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
115f83dfacf7b7b207342d414e7672b20188f2893a7f545234529dc4d535d0bf
13e35d13441f93819e6a81a126e7ae579714dbd3906cb36a315a97c7a32f140d
174b36365b28889d733a748f9b96673bd0ffee2c1f18850dc7a247601fae68ba
21a3d4a1b63016c5e79673d44274c4a8fe99d31fd44ff7454646562f470dbf36
46a89ecc3570b858566c942da7032adb980b009a88115c2eeeabbfe3b23230fb
55341b758de91a0f5041e03e29be19dc66a0abb91517a46a62da55597ff889c5
6b418ab94e19e5b0791fa042f5e898786dc6e183c3379cf7066b962e9ab6a793
7cda9d1b78b4967ab31e7a43226ab1e96160af7f0531a89f10766fa3a5f7bfcf
80949c34a9d21a0682b332add8f47ea3830d49734709bf6288c0ecf06cfbd2d0
982c90477b31d4d280246da28b100cd1973f44b404c5bb304775c9d3d814b1ca
ab24fcbfb9cc39115d532ef87129505b35bfdba22457748d7546e1fadcd9f776
ce5d4809bd2717e1785dd82eb29999afc008373457d6204365deb0e7285aff1d
ed3441c8120cffbe0a6d8171308ce25fcfa517847f83d74c3244186e0f6242c8
f542f91fd3fc5e9d26c2ffc505b665f56a58874bf9928396b835078e4840dbaf