server375674.nazwa.pl Open in urlscan Pro
85.128.188.191 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://server375674.nazwa.pl/weryfikacja/mobile/
Submission Tags: @ipnigh
Submission: On April 15 via api (April 15th 2020, 1:34:16 pm UTC) from GB

Summary HTTP 17 Redirects Behaviour Indicators

Summary

This website contacted 6 IPs in 3 countries across 6 domains to perform 17 HTTP transactions. The main IP is 85.128.188.191, located in Poland and belongs to NAZWA, PL. The main domain is server375674.nazwa.pl.

This is the only time server375674.nazwa.pl was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

	IP Address	AS Autonomous System
3	85.128.188.191 85.128.188.191	15967 (NAZWA) (NAZWA)
1 4	89.161.254.183 89.161.254.183	12824 (HOMEPL-AS) (HOMEPL-AS)
6	138.201.161.134 138.201.161.134	24940 (HETZNER-AS) (HETZNER-AS)
2	138.201.227.223 138.201.227.223	24940 (HETZNER-AS) (HETZNER-AS)
1	185.33.223.200 185.33.223.200	29990 (ASN-APPNEX) (ASN-APPNEX)
2	188.40.17.96 188.40.17.96	24940 (HETZNER-AS) (HETZNER-AS)
17	6

3 85.128.188.191 (Poland)

ASN15967 (NAZWA, PL)
PTR: shared-amf191.rev.nazwa.pl

server375674.nazwa.pl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 89.161.254.183 (Poland) 1 redirects

ASN12824 (HOMEPL-AS, PL)
PTR: cloudserver2082475.home.pl

www.licznikodwiedzin.pl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.deszczowce.pl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 138.201.161.134 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: 2-beer.funcadr.net

adsearch.adkontekst.pl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 138.201.227.223 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: 5-beer.funcadr.net

prd-header-biding.vda.netsprint.pl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.33.223.200 (Netherlands)

ASN29990 (ASN-APPNEX, US)
PTR: 308.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 188.40.17.96 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: 4-beer.funcadr.net

prd-dib-logger-service.vda.netsprint.pl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	adkontekst.pl adsearch.adkontekst.pl	134 KB
4	netsprint.pl prd-header-biding.vda.netsprint.pl prd-dib-logger-service.vda.netsprint.pl	64 KB
3	nazwa.pl server375674.nazwa.pl	9 KB
2	deszczowce.pl 1 redirects www.deszczowce.pl	1 KB
2	licznikodwiedzin.pl www.licznikodwiedzin.pl	1 KB
1	adnxs.com ib.adnxs.com
17	6

	Domain	Requested by
6	adsearch.adkontekst.pl	www.licznikodwiedzin.pl adsearch.adkontekst.pl prd-header-biding.vda.netsprint.pl
3	server375674.nazwa.pl	server375674.nazwa.pl
2	prd-dib-logger-service.vda.netsprint.pl	prd-header-biding.vda.netsprint.pl
2	prd-header-biding.vda.netsprint.pl	adsearch.adkontekst.pl prd-header-biding.vda.netsprint.pl
2	www.deszczowce.pl	1 redirects server375674.nazwa.pl
2	www.licznikodwiedzin.pl	server375674.nazwa.pl www.licznikodwiedzin.pl
1	ib.adnxs.com	prd-header-biding.vda.netsprint.pl
17	7

This site contains no links.

Subject Issuer	Validity	Valid
*.adsearch.adkontekst.pl nazwaSSL	`2019-11-21` - `2020-11-20`	a year	crt.sh
www.deszczowce.pl Certyfikat SSL	`2020-01-08` - `2021-01-07`	a year	crt.sh
*.vda.netsprint.pl nazwaSSL	`2020-02-12` - `2021-02-11`	a year	crt.sh

This page contains 3 frames:

Primary Page: http://server375674.nazwa.pl/weryfikacja/mobile/
Frame ID: C5E2AA4E1761E7474A03F53BAA07333C
Requests: 14 HTTP requests in this frame

Frame: http://www.licznikodwiedzin.pl/cnt/cnt.php?key=157910342&minDigits=7
Frame ID: A252481E0E1610683F3AEA88B6EB4A96
Requests: 1 HTTP requests in this frame

Frame: http://prd-header-biding.vda.netsprint.pl/js/tools.js
Frame ID: 2FD09FE0EB2B04E5BDF9BBCC1CDA15FF
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

17
Requests

59 %
HTTPS

0 %
IPv6

6
Domains

7
Subdomains

6
IPs

3
Countries

209 kB
Transfer

707 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 5

http://www.deszczowce.pl/app/webroot/img/bannery/adkontekst/xx.gif HTTP 301
https://www.deszczowce.pl/app/webroot/img/bannery/adkontekst/xx.gif

17 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
server375674.nazwa.pl/weryfikacja/mobile/ 6 KB
3 KB 175ms
133ms Document
text/html 85.128.188.191
NAZWA

General

Check archive.org

Show headers Download Go to

Full URL: http://server375674.nazwa.pl/weryfikacja/mobile/
Protocol: HTTP/1.1
Server: 85.128.188.191 , Poland, ASN15967 (NAZWA, PL),
Reverse DNS: shared-amf191.rev.nazwa.pl
Software: Apache/2 /
Resource Hash: e6a9cc5fdb8d50995fc9e4aa0f3cc37c29cc683263222f1f20660d0f1a42ea56

Request headers

Host: server375674.nazwa.pl
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 15 Apr 2020 13:33:53 GMT
Content-Type: text/html
Content-Length: 2518
Connection: keep-alive
Last-Modified: Tue, 14 Apr 2020 14:34:35 GMT
ETag: "18fd-5a3411941b8bd-gzip"
Vary: Accept-Encoding
Content-Encoding: gzip
Server: Apache/2
Accept-Ranges: bytes

GET
H/1.1 200
OK style.css
server375674.nazwa.pl/weryfikacja/mobile/ 8 KB
3 KB 85ms
84ms Stylesheet
text/css 85.128.188.191
NAZWA

General

Check archive.org

Show headers Download Go to

Full URL: http://server375674.nazwa.pl/weryfikacja/mobile/style.css
Requested by: Host: server375674.nazwa.pl
URL: http://server375674.nazwa.pl/weryfikacja/mobile/
Protocol: HTTP/1.1
Server: 85.128.188.191 , Poland, ASN15967 (NAZWA, PL),
Reverse DNS: shared-amf191.rev.nazwa.pl
Software: Apache/2 /
Resource Hash: 088280f06562d54d71b1546d84fd25c5db8950cd9b3c3034872dfd25980691f8

Request headers

Referer: http://server375674.nazwa.pl/weryfikacja/mobile/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 15 Apr 2020 13:33:53 GMT
Content-Encoding: gzip
Last-Modified: Tue, 14 Apr 2020 14:34:35 GMT
Server: Apache/2
ETag: "2090-5a34119489a2a-gzip"
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: max-age=50, public
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2372

GET
H/1.1 200
OK fb.png
server375674.nazwa.pl/weryfikacja/mobile/ 3 KB
3 KB 166ms
132ms Image
image/png 85.128.188.191
NAZWA

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://server375674.nazwa.pl/weryfikacja/mobile/fb.png
Requested by: Host: server375674.nazwa.pl
URL: http://server375674.nazwa.pl/weryfikacja/mobile/
Protocol: HTTP/1.1
Server: 85.128.188.191 , Poland, ASN15967 (NAZWA, PL),
Reverse DNS: shared-amf191.rev.nazwa.pl
Software: Apache/2 /
Resource Hash: 148ef0e73a0308b65567fd63db22784cd43003925f59182b555c84be131cc4e4

Request headers

Referer: http://server375674.nazwa.pl/weryfikacja/mobile/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 15 Apr 2020 13:33:53 GMT
Last-Modified: Tue, 14 Apr 2020 14:34:35 GMT
Server: Apache/2
ETag: "bc8-5a341193b292d"
Content-Type: image/png
Cache-Control: max-age=50, public
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3016

GET
H/1.1 200
OK start.php Show response
www.licznikodwiedzin.pl/cnt/ 2 KB
1 KB 214ms
125ms Script
text/html 89.161.254.183
HOMEPL-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://www.licznikodwiedzin.pl/cnt/start.php?key=157910342
Requested by: Host: server375674.nazwa.pl
URL: http://server375674.nazwa.pl/weryfikacja/mobile/
Protocol: HTTP/1.1
Server: 89.161.254.183 , Poland, ASN12824 (HOMEPL-AS, PL),
Reverse DNS: cloudserver2082475.home.pl
Software: IdeaWebServer/0.83.415 /
Resource Hash: c5d15cbcc683069c646ec02c46e679d52e522fb54177e9ad6c2fc218d7983b7e

Request headers

Referer: http://server375674.nazwa.pl/weryfikacja/mobile/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 15 Apr 2020 13:33:53 GMT
Content-Encoding: gzip
Server: IdeaWebServer/0.83.415
Connection: keep-alive
Transfer-Encoding: chunked
Content-Type: text/html

GET
H/1.1 200
OK Cookie set cnt.php
www.licznikodwiedzin.pl/cnt/ Frame A252 0
0 89ms
88ms Document
text/html 89.161.254.183
HOMEPL-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://www.licznikodwiedzin.pl/cnt/cnt.php?key=157910342&minDigits=7
Requested by: Host: www.licznikodwiedzin.pl
URL: http://www.licznikodwiedzin.pl/cnt/start.php?key=157910342
Protocol: HTTP/1.1
Server: 89.161.254.183 , Poland, ASN12824 (HOMEPL-AS, PL),
Reverse DNS: cloudserver2082475.home.pl
Software: IdeaWebServer/0.83.415 /
Resource Hash

Request headers

Host: www.licznikodwiedzin.pl
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://server375674.nazwa.pl/weryfikacja/mobile/
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: http://server375674.nazwa.pl/weryfikacja/mobile/

Response headers

Date: Wed, 15 Apr 2020 13:33:53 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
p3p: CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
Server: IdeaWebServer/0.83.415
Set-Cookie: daily_157910342=1; expires=Thu, 16-Apr-2020 13:33:53 GMT; path=/
Content-Encoding: gzip

GET
H/1.1 200 / Show response
adsearch.adkontekst.pl/_/ads2/ 22 KB
7 KB 226ms
80ms Script
application/javascript 138.201.161.134
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://adsearch.adkontekst.pl/_/ads2/?QAPS_AKPL=0777479e274c03f3865ef57852a7c607

Requested by

Host: www.licznikodwiedzin.pl
URL: http://www.licznikodwiedzin.pl/cnt/start.php?key=157910342

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

138.201.161.134 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

2-beer.funcadr.net

Software

nginx /

Resource Hash

5958e5112a01563bfde70f17d5db8a77b7f0bbdcf100bf3f252c4d8584dde0e3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: http://server375674.nazwa.pl/weryfikacja/mobile/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 15 Apr 2020 13:33:53 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: nginx
X-Frame-Options: DENY
Content-Language: en-US
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Transfer-Encoding: chunked
Connection: keep-alive
Content-Type: application/javascript;charset=UTF-8
Vary: Accept-Encoding
X-XSS-Protection: 1; mode=block
X-Application-Context: dispatcher-service-tao:dispatcher-run:8532
Expires: 0

GET
H2

200

xx.gif
www.deszczowce.pl/app/webroot/img/bannery/adkontekst/
Redirect Chain

http://www.deszczowce.pl/app/webroot/img/bannery/adkontekst/xx.gif
https://www.deszczowce.pl/app/webroot/img/bannery/adkontekst/xx.gif

836 B
992 B

296ms
100ms

Image
image/gif

89.161.254.183
HOMEPL-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.deszczowce.pl/app/webroot/img/bannery/adkontekst/xx.gif
Requested by: Host: server375674.nazwa.pl
URL: http://server375674.nazwa.pl/weryfikacja/mobile/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 89.161.254.183 , Poland, ASN12824 (HOMEPL-AS, PL),
Reverse DNS: cloudserver2082475.home.pl
Software: IdeaWebServer/0.83.415 /
Resource Hash: 038f95f1b5770bd0f9a3e0b63fd15aefc33f15194ee9aabbea57aea9c48b0010

Request headers

Referer: http://server375674.nazwa.pl/weryfikacja/mobile/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 200
date: Wed, 15 Apr 2020 13:33:53 GMT
last-modified: Thu, 04 Oct 2018 02:40:25 GMT
server: IdeaWebServer/0.83.415
content-type: image/gif
content-length: 836
expires: Wed, 27 May 2020 05:33:54 GMT

Redirect headers

Date: Wed, 15 Apr 2020 13:33:53 GMT
Last-Modified: Thu, 04 Oct 2018 02:40:25 GMT
Server: IdeaWebServer/0.83.415
Content-Type: text/html
Location: https://www.deszczowce.pl/app/webroot/img/bannery/adkontekst/xx.gif
Connection: keep-alive
Content-Length: 223
Expires: Wed, 27 May 2020 05:33:54 GMT

POST
H/1.1 200 status Show response
adsearch.adkontekst.pl/_/cmp/ 2 B
516 B 90ms
68ms XHR
text/plain 138.201.161.134
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://adsearch.adkontekst.pl/_/cmp/status?own=false

Requested by

Host: adsearch.adkontekst.pl
URL: https://adsearch.adkontekst.pl/_/ads2/?QAPS_AKPL=0777479e274c03f3865ef57852a7c607

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

138.201.161.134 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

2-beer.funcadr.net

Software

nginx /

Resource Hash

565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: http://server375674.nazwa.pl/weryfikacja/mobile/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/json;charset=UTF-8

Response headers

Pragma: no-cache
Date: Wed, 15 Apr 2020 13:33:53 GMT
X-Content-Type-Options: nosniff
Server: nginx
X-Frame-Options: DENY
Content-Type: text/plain;charset=UTF-8
Access-Control-Allow-Origin: http://server375674.nazwa.pl
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Vary: Origin
Content-Length: 2
X-XSS-Protection: 1; mode=block
X-Application-Context: dispatcher-service-tao:dispatcher-run:8532
Expires: 0

GET
H/1.1 200
OK 0777479e274c03f3865ef57852a7c607 Show response
prd-header-biding.vda.netsprint.pl/units/ 9 KB
4 KB 217ms
79ms Script
text/javascript 138.201.227.223
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://prd-header-biding.vda.netsprint.pl/units/0777479e274c03f3865ef57852a7c607?mobile=false&cpmValue=0.17&adTagId=QAPS_AKPL_0777479e274c03f3865ef57852a7c607&cpmCurrency=PLN&nsEmiterSource=AK&nsEmiterPlacementEmissionUrl=https%3A%2F%2Fadsearch.adkontekst.pl%2F_%2Fads2%2F%3Fstrict%3Dtrue%26QAPS_AKPL%3D0777479e274c03f3865ef57852a7c607%26dispatched%3Dtrue%26useBehavioralTargeting%3Dtrue&gdprEnable=false

Requested by

Host: adsearch.adkontekst.pl
URL: https://adsearch.adkontekst.pl/_/ads2/?QAPS_AKPL=0777479e274c03f3865ef57852a7c607

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

138.201.227.223 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

5-beer.funcadr.net

Software

nginx /

Resource Hash

5b5828e61a4eec03d70de9e6951fd245ab04f738ded6f11b9e6b0c51ca72ee01

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: http://server375674.nazwa.pl/weryfikacja/mobile/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 15 Apr 2020 13:33:55 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: nginx
X-Frame-Options: DENY
Vary: Accept-Encoding
Content-Language: en-US
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Transfer-Encoding: chunked
Connection: keep-alive
Content-Type: text/javascript;charset=UTF-8
X-Xss-Protection: 1; mode=block
X-Application-Context: header-bidding-service
Expires: 0

GET
H/1.1 200
OK tools.js Show response
prd-header-biding.vda.netsprint.pl/js/ Frame 2FD0 186 KB
59 KB 143ms
109ms Script
application/javascript 138.201.227.223
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://prd-header-biding.vda.netsprint.pl/js/tools.js
Requested by: Host: prd-header-biding.vda.netsprint.pl
URL: https://prd-header-biding.vda.netsprint.pl/units/0777479e274c03f3865ef57852a7c607?mobile=false&cpmValue=0.17&adTagId=QAPS_AKPL_0777479e274c03f3865ef57852a7c607&cpmCurrency=PLN&nsEmiterSource=AK&nsEmiterPlacementEmissionUrl=https%3A%2F%2Fadsearch.adkontekst.pl%2F_%2Fads2%2F%3Fstrict%3Dtrue%26QAPS_AKPL%3D0777479e274c03f3865ef57852a7c607%26dispatched%3Dtrue%26useBehavioralTargeting%3Dtrue&gdprEnable=false
Protocol: HTTP/1.1
Server: 138.201.227.223 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: 5-beer.funcadr.net
Software: nginx /
Resource Hash: fb1bddda0518b2b9969441cdbdae6404ad3916fa51999581b0099645c35b5758

Request headers

Referer: http://server375674.nazwa.pl/weryfikacja/mobile/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 15 Apr 2020 13:33:55 GMT
Content-Encoding: gzip
Last-Modified: Tue, 07 Apr 2020 12:27:43 GMT
Server: nginx
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=300
Transfer-Encoding: chunked
Connection: keep-alive
Accept-Ranges: bytes
X-Application-Context: header-bidding-service

POST
H/1.1 200
OK prebid
ib.adnxs.com/ut/v3/ Frame 2FD0 19 B
0 124ms
89ms XHR
application/json 185.33.223.200
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

http://ib.adnxs.com/ut/v3/prebid

Requested by

Host: prd-header-biding.vda.netsprint.pl
URL: http://prd-header-biding.vda.netsprint.pl/js/tools.js

Protocol

HTTP/1.1

Server

185.33.223.200 , Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

308.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.13.4 /

Resource Hash

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: http://server375674.nazwa.pl/weryfikacja/mobile/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Wed, 15 Apr 2020 13:33:58 GMT
X-Proxy-Origin: 196.196.244.4; 196.196.244.4; 308.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.223.45:80
AN-X-Request-Uuid: ebc8877b-8e6c-449d-af93-b6d6ff6612bf
Server: nginx/1.13.4
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: http://server375674.nazwa.pl
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 19
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK / Show response
adsearch.adkontekst.pl/_/ads2/ 7 KB
2 KB 79ms
74ms Script
text/javascript 138.201.161.134
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://adsearch.adkontekst.pl/_/ads2/?strict=true&QAPS_AKPL=0777479e274c03f3865ef57852a7c607&dispatched=true&useBehavioralTargeting=true
Requested by: Host: prd-header-biding.vda.netsprint.pl
URL: https://prd-header-biding.vda.netsprint.pl/units/0777479e274c03f3865ef57852a7c607?mobile=false&cpmValue=0.17&adTagId=QAPS_AKPL_0777479e274c03f3865ef57852a7c607&cpmCurrency=PLN&nsEmiterSource=AK&nsEmiterPlacementEmissionUrl=https%3A%2F%2Fadsearch.adkontekst.pl%2F_%2Fads2%2F%3Fstrict%3Dtrue%26QAPS_AKPL%3D0777479e274c03f3865ef57852a7c607%26dispatched%3Dtrue%26useBehavioralTargeting%3Dtrue&gdprEnable=false
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 138.201.161.134 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: 2-beer.funcadr.net
Software: nginx /
Resource Hash: fdb2a37bb58c93c40b76b372766fb3bea6c78e1141fc92afc886e99459c6d15d

Request headers

Referer: http://server375674.nazwa.pl/weryfikacja/mobile/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 15 Apr 2020 13:33:56 GMT
Content-Encoding: gzip
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked
Content-Type: text/javascript; charset=UTF-8

POST
H/1.1 200
OK dibs Show response
prd-dib-logger-service.vda.netsprint.pl/loggers/ 2 B
312 B 70ms
70ms XHR
text/plain 188.40.17.96
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://prd-dib-logger-service.vda.netsprint.pl/loggers/dibs
Requested by: Host: prd-header-biding.vda.netsprint.pl
URL: https://prd-header-biding.vda.netsprint.pl/units/0777479e274c03f3865ef57852a7c607?mobile=false&cpmValue=0.17&adTagId=QAPS_AKPL_0777479e274c03f3865ef57852a7c607&cpmCurrency=PLN&nsEmiterSource=AK&nsEmiterPlacementEmissionUrl=https%3A%2F%2Fadsearch.adkontekst.pl%2F_%2Fads2%2F%3Fstrict%3Dtrue%26QAPS_AKPL%3D0777479e274c03f3865ef57852a7c607%26dispatched%3Dtrue%26useBehavioralTargeting%3Dtrue&gdprEnable=false
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 188.40.17.96 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: 4-beer.funcadr.net
Software: nginx /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

Referer: http://server375674.nazwa.pl/weryfikacja/mobile/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/json; charset=UTF-8

Response headers

Date: Wed, 15 Apr 2020 13:33:56 GMT
Server: nginx
Vary: Origin
Content-Type: text/plain;charset=UTF-8
Access-Control-Allow-Origin: http://server375674.nazwa.pl
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 2
X-Application-Context: dib-logger-service

POST
H/1.1 200
OK times Show response
prd-dib-logger-service.vda.netsprint.pl/loggers/ 2 B
312 B 72ms
72ms XHR
text/plain 188.40.17.96
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://prd-dib-logger-service.vda.netsprint.pl/loggers/times
Requested by: Host: prd-header-biding.vda.netsprint.pl
URL: https://prd-header-biding.vda.netsprint.pl/units/0777479e274c03f3865ef57852a7c607?mobile=false&cpmValue=0.17&adTagId=QAPS_AKPL_0777479e274c03f3865ef57852a7c607&cpmCurrency=PLN&nsEmiterSource=AK&nsEmiterPlacementEmissionUrl=https%3A%2F%2Fadsearch.adkontekst.pl%2F_%2Fads2%2F%3Fstrict%3Dtrue%26QAPS_AKPL%3D0777479e274c03f3865ef57852a7c607%26dispatched%3Dtrue%26useBehavioralTargeting%3Dtrue&gdprEnable=false
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 188.40.17.96 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: 4-beer.funcadr.net
Software: nginx /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

Referer: http://server375674.nazwa.pl/weryfikacja/mobile/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/json; charset=UTF-8

Response headers

Date: Wed, 15 Apr 2020 13:33:56 GMT
Server: nginx
Vary: Origin
Content-Type: text/plain;charset=UTF-8
Access-Control-Allow-Origin: http://server375674.nazwa.pl
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 2
X-Application-Context: dib-logger-service

GET
H/1.1 200
OK / Show response
adsearch.adkontekst.pl/quad/spliter/ 6 KB
2 KB 72ms
70ms Script
text/javascript 138.201.161.134
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://adsearch.adkontekst.pl/quad/spliter/?prefix=akon&prid=0&caid=0&plh=0777479e274c03f3865ef57852a7c607&plid=0&namespace=qa_akon&nc=1586957636311&qss=true&nc2=207388780&dispatched=false&adblock=false&useBehavioralTargeting=true&type=K1&ref=http%3A%2F%2Fserver375674.nazwa.pl%2Fweryfikacja%2Fmobile%2F
Requested by: Host: adsearch.adkontekst.pl
URL: https://adsearch.adkontekst.pl/_/ads2/?strict=true&QAPS_AKPL=0777479e274c03f3865ef57852a7c607&dispatched=true&useBehavioralTargeting=true
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 138.201.161.134 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: 2-beer.funcadr.net
Software: nginx /
Resource Hash: 61c7990c2b80d1995037a0ebd7fca9269f21ab6804cbc90283698ba37b3fb2cb

Request headers

Referer: http://server375674.nazwa.pl/weryfikacja/mobile/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 15 Apr 2020 13:33:56 GMT
Content-Encoding: gzip
Server: nginx
Transfer-Encoding: chunked
P3P: CP="NOI DSP COR NID CUR OUR NOR"
Cache-Control: no-cache
Connection: keep-alive
Content-Type: text/javascript; charset=UTF-8

GET
H/1.1 200
OK / Show response
adsearch.adkontekst.pl/_/both/ 456 KB
121 KB 94ms
93ms Script
text/javascript 138.201.161.134
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://adsearch.adkontekst.pl/_/both/?prefix=akon&namespace=qa_akon&nc=0&browser=safari&dispatched=false&adblock=false
Requested by: Host: adsearch.adkontekst.pl
URL: https://adsearch.adkontekst.pl/_/ads2/?strict=true&QAPS_AKPL=0777479e274c03f3865ef57852a7c607&dispatched=true&useBehavioralTargeting=true
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 138.201.161.134 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: 2-beer.funcadr.net
Software: nginx /
Resource Hash: 3cd032aa5d6907b6ca592281e68ebdd4034d38f32454eb9896a438a86da54a31

Request headers

Referer: http://server375674.nazwa.pl/weryfikacja/mobile/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Wed, 15 Apr 2020 13:33:56 GMT
Content-Encoding: gzip
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked
Content-Type: text/javascript; charset=UTF-8

GET
H/1.1 200
OK / Show response
adsearch.adkontekst.pl/quad/spliter/ 2 KB
1 KB 71ms
70ms Script
text/javascript 138.201.161.134
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://adsearch.adkontekst.pl/quad/spliter/?prid=944&caid=103713&nc=1586957636616&cc=3&form=507626:3:Q1:R1:G1:S1:V1:A3;&content=_512+facebooka+_256+zaloguj+_128+znasz+znajomymi+zaczac+udostepniac+rzeczy+rozne+rodzina+ludzmi+laczyc&qnr=0&without=&extra=&w=160&h=600&qss=true&flash=false&iid=8599860440169814&prefix=akon&namespace=qa_akon&type=2&dispatched=true&useBehavioralTargeting=true&ref=http%3A%2F%2Fserver375674.nazwa.pl%2Fweryfikacja%2Fmobile%2F
Requested by: Host: adsearch.adkontekst.pl
URL: https://adsearch.adkontekst.pl/_/ads2/?strict=true&QAPS_AKPL=0777479e274c03f3865ef57852a7c607&dispatched=true&useBehavioralTargeting=true
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 138.201.161.134 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: 2-beer.funcadr.net
Software: nginx /
Resource Hash: 6f622b39793a65bd3d806a8b72c34ba92557b5ed5fb8c3d2cba4b8e4c7e99311

Request headers

Referer: http://server375674.nazwa.pl/weryfikacja/mobile/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 15 Apr 2020 13:33:56 GMT
Content-Encoding: gzip
Server: nginx
Transfer-Encoding: chunked
P3P: CP="NOI DSP COR NID CUR OUR NOR"
Cache-Control: no-cache
Connection: keep-alive
Content-Type: text/javascript; charset=UTF-8

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

45 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.licznikodwiedzin.pl/	1970-01-19 08:50:44	Name: daily_157910342 Value: 1

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://prd-header-biding.vda.netsprint.pl/units/0777479e274c03f3865ef57852a7c607?mobile=false&cpmValue=0.17&adTagId=QAPS_AKPL_0777479e274c03f3865ef57852a7c607&cpmCurrency=PLN&nsEmiterSource=AK&nsEmiterPlacementEmissionUrl=https%3A%2F%2Fadsearch.adkontekst.pl%2F_%2Fads2%2F%3Fstrict%3Dtrue%26QAPS_AKPL%3D0777479e274c03f3865ef57852a7c607%26dispatched%3Dtrue%26useBehavioralTargeting%3Dtrue&gdprEnable=false(Line 1) Message: emCpm: 0.17
console-api	log	URL: https://prd-header-biding.vda.netsprint.pl/units/0777479e274c03f3865ef57852a7c607?mobile=false&cpmValue=0.17&adTagId=QAPS_AKPL_0777479e274c03f3865ef57852a7c607&cpmCurrency=PLN&nsEmiterSource=AK&nsEmiterPlacementEmissionUrl=https%3A%2F%2Fadsearch.adkontekst.pl%2F_%2Fads2%2F%3Fstrict%3Dtrue%26QAPS_AKPL%3D0777479e274c03f3865ef57852a7c607%26dispatched%3Dtrue%26useBehavioralTargeting%3Dtrue&gdprEnable=false(Line 1) Message: currency: PLN
console-api	log	URL: https://prd-header-biding.vda.netsprint.pl/units/0777479e274c03f3865ef57852a7c607?mobile=false&cpmValue=0.17&adTagId=QAPS_AKPL_0777479e274c03f3865ef57852a7c607&cpmCurrency=PLN&nsEmiterSource=AK&nsEmiterPlacementEmissionUrl=https%3A%2F%2Fadsearch.adkontekst.pl%2F_%2Fads2%2F%3Fstrict%3Dtrue%26QAPS_AKPL%3D0777479e274c03f3865ef57852a7c607%26dispatched%3Dtrue%26useBehavioralTargeting%3Dtrue&gdprEnable=false(Line 1) Message: executing emiter
console-api	log	URL: https://prd-header-biding.vda.netsprint.pl/units/0777479e274c03f3865ef57852a7c607?mobile=false&cpmValue=0.17&adTagId=QAPS_AKPL_0777479e274c03f3865ef57852a7c607&cpmCurrency=PLN&nsEmiterSource=AK&nsEmiterPlacementEmissionUrl=https%3A%2F%2Fadsearch.adkontekst.pl%2F_%2Fads2%2F%3Fstrict%3Dtrue%26QAPS_AKPL%3D0777479e274c03f3865ef57852a7c607%26dispatched%3Dtrue%26useBehavioralTargeting%3Dtrue&gdprEnable=false(Line 1) Message: [object Object]

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

adsearch.adkontekst.pl
ib.adnxs.com
prd-dib-logger-service.vda.netsprint.pl
prd-header-biding.vda.netsprint.pl
server375674.nazwa.pl
www.deszczowce.pl
www.licznikodwiedzin.pl
138.201.161.134
138.201.227.223
185.33.223.200
188.40.17.96
85.128.188.191
89.161.254.183
038f95f1b5770bd0f9a3e0b63fd15aefc33f15194ee9aabbea57aea9c48b0010
088280f06562d54d71b1546d84fd25c5db8950cd9b3c3034872dfd25980691f8
148ef0e73a0308b65567fd63db22784cd43003925f59182b555c84be131cc4e4
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
3cd032aa5d6907b6ca592281e68ebdd4034d38f32454eb9896a438a86da54a31
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
5958e5112a01563bfde70f17d5db8a77b7f0bbdcf100bf3f252c4d8584dde0e3
5b5828e61a4eec03d70de9e6951fd245ab04f738ded6f11b9e6b0c51ca72ee01
61c7990c2b80d1995037a0ebd7fca9269f21ab6804cbc90283698ba37b3fb2cb
6f622b39793a65bd3d806a8b72c34ba92557b5ed5fb8c3d2cba4b8e4c7e99311
c5d15cbcc683069c646ec02c46e679d52e522fb54177e9ad6c2fc218d7983b7e
e6a9cc5fdb8d50995fc9e4aa0f3cc37c29cc683263222f1f20660d0f1a42ea56
fb1bddda0518b2b9969441cdbdae6404ad3916fa51999581b0099645c35b5758
fdb2a37bb58c93c40b76b372766fb3bea6c78e1141fc92afc886e99459c6d15d

server375674.nazwa.pl Open in urlscan Pro 85.128.188.191 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

17 Requests

59 %HTTPS

0 %IPv6

6 Domains

7 Subdomains

6 IPs

3 Countries

209 kBTransfer

707 kBSize

1 Cookies

0 Outgoing links

Redirected requests

17 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

45 JavaScript Global Variables

1 Cookies

4 Console Messages

Indicators

server375674.nazwa.pl Open in urlscan Pro
85.128.188.191 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

17
Requests

59 %
HTTPS

0 %
IPv6

6
Domains

7
Subdomains

6
IPs

3
Countries

209 kB
Transfer

707 kB
Size

1
Cookies

17 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!