URL: http://www.autokosnar.cz/admin/anketa/N_v1/Netflix523/
Submission Tags: falconsandbox
Submission: On May 10 via api from US

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 9 HTTP transactions. The main IP is 185.59.3.33, located in Mladá Boleslav, Czech Republic and belongs to VALVERA, CZ. The main domain is www.autokosnar.cz.
This is the only time www.autokosnar.cz was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Netflix (Online)

Domain & IP information

IP Address AS Autonomous System
8 185.59.3.33 60086 (VALVERA)
1 2606:4700:20:... 13335 (CLOUDFLAR...)
9 2
Apex Domain
Subdomains
Transfer
8 autokosnar.cz
www.autokosnar.cz
513 KB
1 ipapi.co
ipapi.co
891 B
9 2
Domain Requested by
8 www.autokosnar.cz www.autokosnar.cz
1 ipapi.co www.autokosnar.cz
9 2

This site contains no links.

Subject Issuer Validity Valid
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2020-07-17 -
2021-07-17
a year crt.sh

This page contains 1 frames:

Primary Page: http://www.autokosnar.cz/admin/anketa/N_v1/Netflix523/
Frame ID: 5762D45D8506B85D0C8D3913E3BD3563
Requests: 9 HTTP requests in this frame

Screenshot


Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Overall confidence: 100%
Detected patterns
  • script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

9
Requests

11 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

514 kB
Transfer

532 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request Cookie set /
www.autokosnar.cz/admin/anketa/N_v1/Netflix523/
5 KB
2 KB
Document
General
Full URL
http://www.autokosnar.cz/admin/anketa/N_v1/Netflix523/
Protocol
HTTP/1.1
Server
185.59.3.33 Mladá Boleslav, Czech Republic, ASN60086 (VALVERA, CZ),
Reverse DNS
www.clweb.cz
Software
Apache / PHP/5.4.16
Resource Hash
af8b5b61f2e08267636fa455d0749fc7ab1c177b882c79773c2269caf7a73881

Request headers

Host
www.autokosnar.cz
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding
gzip, deflate
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 10 May 2021 17:02:28 GMT
Server
Apache
X-Powered-By
PHP/5.4.16
Set-Cookie
PHPSESSID=2u03ov69h3lputhad0jpvrg3e5; path=/
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma
no-cache
Vary
Accept-Encoding
Content-Encoding
gzip
Content-Length
2077
Keep-Alive
timeout=5, max=100
Connection
Keep-Alive
Content-Type
text/html
style.css
www.autokosnar.cz/admin/anketa/N_v1/Netflix523/css/
21 KB
4 KB
Stylesheet
General
Full URL
http://www.autokosnar.cz/admin/anketa/N_v1/Netflix523/css/style.css
Requested by
Host: www.autokosnar.cz
URL: http://www.autokosnar.cz/admin/anketa/N_v1/Netflix523/
Protocol
HTTP/1.1
Server
185.59.3.33 Mladá Boleslav, Czech Republic, ASN60086 (VALVERA, CZ),
Reverse DNS
www.clweb.cz
Software
Apache /
Resource Hash
2f085a84cb00b9b35b5125231a1accae74aba455992b2b21c28380345ba52c53

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
www.autokosnar.cz
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
http://www.autokosnar.cz/admin/anketa/N_v1/Netflix523/
Cookie
PHPSESSID=2u03ov69h3lputhad0jpvrg3e5
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.autokosnar.cz/admin/anketa/N_v1/Netflix523/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 10 May 2021 17:02:30 GMT
Content-Encoding
gzip
Last-Modified
Mon, 10 May 2021 16:59:02 GMT
Server
Apache
ETag
"5283-5c1fcb1caaf38-gzip"
Vary
Accept-Encoding
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
4162
app.css
www.autokosnar.cz/admin/anketa/N_v1/Netflix523/css/
2 KB
990 B
Stylesheet
General
Full URL
http://www.autokosnar.cz/admin/anketa/N_v1/Netflix523/css/app.css
Requested by
Host: www.autokosnar.cz
URL: http://www.autokosnar.cz/admin/anketa/N_v1/Netflix523/
Protocol
HTTP/1.1
Server
185.59.3.33 Mladá Boleslav, Czech Republic, ASN60086 (VALVERA, CZ),
Reverse DNS
www.clweb.cz
Software
Apache /
Resource Hash
5efb393cf10db7ee157dcd3109179e7619633c7e8d17c5ab3eab1ea1278f6dd1

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
www.autokosnar.cz
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
http://www.autokosnar.cz/admin/anketa/N_v1/Netflix523/
Cookie
PHPSESSID=2u03ov69h3lputhad0jpvrg3e5
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.autokosnar.cz/admin/anketa/N_v1/Netflix523/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 10 May 2021 17:02:30 GMT
Content-Encoding
gzip
Last-Modified
Mon, 10 May 2021 16:59:02 GMT
Server
Apache
ETag
"9e2-5c1fcb1caaf38-gzip"
Vary
Accept-Encoding
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
670
jquery.min.js
www.autokosnar.cz/admin/anketa/N_v1/Netflix523/js/
152 KB
153 KB
Script
General
Full URL
http://www.autokosnar.cz/admin/anketa/N_v1/Netflix523/js/jquery.min.js
Requested by
Host: www.autokosnar.cz
URL: http://www.autokosnar.cz/admin/anketa/N_v1/Netflix523/
Protocol
HTTP/1.1
Server
185.59.3.33 Mladá Boleslav, Czech Republic, ASN60086 (VALVERA, CZ),
Reverse DNS
www.clweb.cz
Software
Apache /
Resource Hash
7aa387f2db11236e0a3d6e4124c33bbf9f588dff926a1454a92ce694fc84c620

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
www.autokosnar.cz
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
*/*
Referer
http://www.autokosnar.cz/admin/anketa/N_v1/Netflix523/
Cookie
PHPSESSID=2u03ov69h3lputhad0jpvrg3e5
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.autokosnar.cz/admin/anketa/N_v1/Netflix523/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 10 May 2021 17:02:30 GMT
Last-Modified
Mon, 10 May 2021 16:59:02 GMT
Server
Apache
ETag
"261cf-5c1fcb1ca9f98"
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
156111
validet.js
www.autokosnar.cz/admin/anketa/N_v1/Netflix523/js/
7 KB
7 KB
Script
General
Full URL
http://www.autokosnar.cz/admin/anketa/N_v1/Netflix523/js/validet.js
Requested by
Host: www.autokosnar.cz
URL: http://www.autokosnar.cz/admin/anketa/N_v1/Netflix523/
Protocol
HTTP/1.1
Server
185.59.3.33 Mladá Boleslav, Czech Republic, ASN60086 (VALVERA, CZ),
Reverse DNS
www.clweb.cz
Software
Apache /
Resource Hash
3668352cee7c03431751e26e34aebf496fe874ae28a8b96c4481dc129b502822

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
www.autokosnar.cz
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
*/*
Referer
http://www.autokosnar.cz/admin/anketa/N_v1/Netflix523/
Cookie
PHPSESSID=2u03ov69h3lputhad0jpvrg3e5
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.autokosnar.cz/admin/anketa/N_v1/Netflix523/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 10 May 2021 17:02:30 GMT
Last-Modified
Mon, 10 May 2021 16:59:02 GMT
Server
Apache
ETag
"1c52-5c1fcb1ca9f98"
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
7250
bg-login-large.jpg
www.autokosnar.cz/admin/anketa/N_v1/Netflix523/img/
342 KB
342 KB
Image
General
Full URL
http://www.autokosnar.cz/admin/anketa/N_v1/Netflix523/img/bg-login-large.jpg
Requested by
Host: www.autokosnar.cz
URL: http://www.autokosnar.cz/admin/anketa/N_v1/Netflix523/
Protocol
HTTP/1.1
Server
185.59.3.33 Mladá Boleslav, Czech Republic, ASN60086 (VALVERA, CZ),
Reverse DNS
www.clweb.cz
Software
Apache /
Resource Hash
68a140f407da7acc8b00ae9eb2be5a09df4b046277a3bfe03881417a068da7e4

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
www.autokosnar.cz
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Referer
http://www.autokosnar.cz/admin/anketa/N_v1/Netflix523/
Cookie
PHPSESSID=2u03ov69h3lputhad0jpvrg3e5
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.autokosnar.cz/admin/anketa/N_v1/Netflix523/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 10 May 2021 17:02:31 GMT
Last-Modified
Mon, 10 May 2021 16:59:02 GMT
Server
Apache
ETag
"55787-5c1fcb1ca8c10"
Content-Type
image/jpeg
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
350087
FB-logo.png
www.autokosnar.cz/admin/anketa/N_v1/Netflix523/img/
1 KB
2 KB
Image
General
Full URL
http://www.autokosnar.cz/admin/anketa/N_v1/Netflix523/img/FB-logo.png
Requested by
Host: www.autokosnar.cz
URL: http://www.autokosnar.cz/admin/anketa/N_v1/Netflix523/
Protocol
HTTP/1.1
Server
185.59.3.33 Mladá Boleslav, Czech Republic, ASN60086 (VALVERA, CZ),
Reverse DNS
www.clweb.cz
Software
Apache /
Resource Hash
3e49d9dc43267590184389ab3da0cb9f7308c9c848667dab109a0f7c73450ece

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
www.autokosnar.cz
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Referer
http://www.autokosnar.cz/admin/anketa/N_v1/Netflix523/
Cookie
PHPSESSID=2u03ov69h3lputhad0jpvrg3e5
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.autokosnar.cz/admin/anketa/N_v1/Netflix523/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 10 May 2021 17:02:31 GMT
Last-Modified
Mon, 10 May 2021 16:59:02 GMT
Server
Apache
ETag
"5af-5c1fcb1ca9bb0"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
1455
glob.png
www.autokosnar.cz/admin/anketa/N_v1/Netflix523/img/
842 B
1 KB
Image
General
Full URL
http://www.autokosnar.cz/admin/anketa/N_v1/Netflix523/img/glob.png
Requested by
Host: www.autokosnar.cz
URL: http://www.autokosnar.cz/admin/anketa/N_v1/Netflix523/
Protocol
HTTP/1.1
Server
185.59.3.33 Mladá Boleslav, Czech Republic, ASN60086 (VALVERA, CZ),
Reverse DNS
www.clweb.cz
Software
Apache /
Resource Hash
4f8072ca4cdc4412083462c38eebc18bb5a0b919fb4bb63ec98769f0b644306e

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
www.autokosnar.cz
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Referer
http://www.autokosnar.cz/admin/anketa/N_v1/Netflix523/
Cookie
PHPSESSID=2u03ov69h3lputhad0jpvrg3e5
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.autokosnar.cz/admin/anketa/N_v1/Netflix523/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 10 May 2021 17:02:31 GMT
Last-Modified
Mon, 10 May 2021 16:59:02 GMT
Server
Apache
ETag
"34a-5c1fcb1ca8ff8"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
842
/
ipapi.co/json/
718 B
891 B
XHR
General
Full URL
https://ipapi.co/json/
Requested by
Host: www.autokosnar.cz
URL: http://www.autokosnar.cz/admin/anketa/N_v1/Netflix523/js/jquery.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:20::681a:92c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
bc2e66480868f6bf8ff91af1fdbd573285da474d1ea9d53b077aad9fe46695b8
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Accept
*/*
Referer
http://www.autokosnar.cz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 10 May 2021 17:05:17 GMT
content-encoding
br
allow
OPTIONS, POST, GET, HEAD, OPTIONS
cf-cache-status
DYNAMIC
nel
{"report_to":"cf-nel","max_age":604800}
server
cloudflare
x-frame-options
SAMEORIGIN
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Host, Origin
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=PvfkeTS6ymGyNbf7AKI4tIT8aoDH0EtQSEWji1r2%2FXsnpvPbqHomxN3nmmyivryoWdpQRgXaZy8Yb93lo7e%2BxVP69pWERH%2Bql9b15wZc%2FpLLHt0enQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/json
access-control-allow-origin
http://www.autokosnar.cz
cf-ray
64d4c0606d404a92-FRA
cf-request-id
09f8d6904400004a92300da000000001

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Netflix (Online)

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery function| ipLookUp

1 Cookies

Domain/Path Name / Value
www.autokosnar.cz/ Name: PHPSESSID
Value: 2u03ov69h3lputhad0jpvrg3e5