koronaleaks.cz Open in urlscan Pro
185.199.111.153 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://koronaleaks.cz/
Effective URL:
https://koronaleaks.cz/
Submission: On April 06 via api (April 6th 2020, 5:29:33 pm UTC) from US

Summary HTTP 6 Redirects Links 1 Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 6 HTTP transactions. The main IP is 185.199.111.153, located in United States and belongs to FASTLY, US. The main domain is koronaleaks.cz.
TLS certificate: Issued by Let's Encrypt Authority X3 on April 3rd 2020. Valid for: 3 months.

This is the only time koronaleaks.cz was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address		AS Autonomous System
1 6	185.199.111.153 185.199.111.153		54113 (FASTLY) (FASTLY)
1	2001:4de0:ac1... 2001:4de0:ac19::1:b:1a		20446 (HIGHWINDS3) (HIGHWINDS3)
6	2

6 185.199.111.153 (United States) 1 redirects

ASN54113 (FASTLY, US)

koronaleaks.cz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac19::1:b:1a (Netherlands)

ASN20446 (HIGHWINDS3, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	koronaleaks.cz 1 redirects koronaleaks.cz	44 KB
1	jquery.com code.jquery.com	24 KB
6	2

	Domain	Requested by
6	koronaleaks.cz	1 redirects koronaleaks.cz
1	code.jquery.com	koronaleaks.cz
6	2

This site contains links to these domains. Also see Links.

Domain
oznameni.koronaleaks.cz

Subject Issuer	Validity	Valid
koronaleaks.cz Let's Encrypt Authority X3	`2020-04-03` - `2020-07-02`	3 months	crt.sh
jquery.org COMODO RSA Domain Validation Secure Server CA	`2018-10-17` - `2020-10-16`	2 years	crt.sh

This page contains 1 frames:

Primary Page: https://koronaleaks.cz/
Frame ID: 52DD20976E169BD525465022189A6E85
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://koronaleaks.cz/ HTTP 301
https://koronaleaks.cz/ Page URL

Detected technologies

Ruby (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

headers server /^GitHub\.com$/i

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i

Varnish (Cache Tools) Expand

Overall confidence: 100%
Detected patterns

headers via /varnish(?: \(Varnish\/([\d.]+)\))?/i

Ruby on Rails (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

headers server /^GitHub\.com$/i

GitHub Pages (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^GitHub\.com$/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery[.-]([\d.]*\d)[^/]*\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

6
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

67 kB
Transfer

280 kB
Size

0
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://oznameni.koronaleaks.cz/submission
Title: Vložit oznámení

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://koronaleaks.cz/ HTTP 301
https://koronaleaks.cz/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response koronaleaks.cz/ Redirect Chain http://koronaleaks.cz/ https://koronaleaks.cz/	4 KB 2 KB	208ms 164ms	Document text/html	185.199.111.153 FASTLY
General Check archive.org Show headers Download Go to Full URL https://koronaleaks.cz/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.199.111.153 , United States, ASN54113 (FASTLY, US), Reverse DNS Software GitHub.com / Resource Hash `66bef4518652bf888b53a1df1df8a55cc7b998b75383d08caa16b9f13fafda8f` Request headers :method GET :authority koronaleaks.cz :scheme https :path / pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers status 200 server GitHub.com content-type text/html; charset=utf-8 last-modified Fri, 03 Apr 2020 21:38:29 GMT etag W/"5e87acd5-10b0" access-control-allow-origin * expires Mon, 06 Apr 2020 17:39:12 GMT cache-control max-age=600 content-encoding gzip x-proxy-cache MISS x-github-request-id DD8A:5FA9:2844B:32BAD:5E8B66E8 accept-ranges bytes date Mon, 06 Apr 2020 17:29:12 GMT via 1.1 varnish age 0 x-served-by cache-hhn4069-HHN x-cache MISS x-cache-hits 0 x-timer S1586194152.339886,VS0,VE144 vary Accept-Encoding x-fastly-request-id b7d179295394e24753996a42dc6b98cb1ab7da67 content-length 1728 Redirect headers Server GitHub.com Content-Type text/html Location https://koronaleaks.cz/ X-GitHub-Request-Id CC9C:1E46:57AD1:6D0BA:5E8B66E7 Content-Length 162 Accept-Ranges bytes Date Mon, 06 Apr 2020 17:29:12 GMT Via 1.1 varnish Age 0 Connection keep-alive X-Served-By cache-hhn4033-HHN X-Cache MISS X-Cache-Hits 0 X-Timer S1586194152.137054,VS0,VE138 Vary Accept-Encoding X-Fastly-Request-ID 32792c4f3b6fc7e8e6726a82251faf623dbe6168
GET H2	200	bootstrap.min.css koronaleaks.cz/	141 KB 21 KB	123ms 122ms	Stylesheet text/css	185.199.111.153 FASTLY
General Check archive.org Show headers Download Go to Full URL https://koronaleaks.cz/bootstrap.min.css Requested by Host: koronaleaks.cz URL: https://koronaleaks.cz/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.199.111.153 , United States, ASN54113 (FASTLY, US), Reverse DNS Software GitHub.com / Resource Hash `2c0f3dcfe93d7e380c290fe4ab838ed8cadff1596d62697f5444be460d1f876d` Request headers Referer https://koronaleaks.cz/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest style Response headers x-fastly-request-id 73533d322903e36ac6ef94e989e713adf319455f date Mon, 06 Apr 2020 17:29:12 GMT content-encoding gzip age 0 x-cache MISS status 200 content-length 21144 x-served-by cache-hhn4069-HHN access-control-allow-origin * last-modified Fri, 03 Apr 2020 21:38:29 GMT server GitHub.com x-github-request-id FA88:24FB:12BDA:17E22:5E8B66E8 x-timer S1586194153.509707,VS0,VE100 etag W/"5e87acd5-235ed" vary Accept-Encoding content-type text/css; charset=utf-8 via 1.1 varnish expires Mon, 06 Apr 2020 17:39:12 GMT cache-control max-age=600 accept-ranges bytes x-proxy-cache MISS x-cache-hits 0
GET H2	200	jumbotron.css koronaleaks.cz/	107 B 243 B	402ms 401ms	Stylesheet text/css	185.199.111.153 FASTLY
General Check archive.org Show headers Download Go to Full URL https://koronaleaks.cz/jumbotron.css Requested by Host: koronaleaks.cz URL: https://koronaleaks.cz/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.199.111.153 , United States, ASN54113 (FASTLY, US), Reverse DNS Software GitHub.com / Resource Hash `add38baca7bbcce0bcb6a9afd59ac12f68d5075d3cf4745efd627a365c2f4129` Request headers Referer https://koronaleaks.cz/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest style Response headers x-fastly-request-id 9f99d29d03f03a78646a1e51aa10aa9fbd121d44 date Mon, 06 Apr 2020 17:29:12 GMT via 1.1 varnish age 0 x-cache MISS status 200 content-length 107 x-served-by cache-hhn4069-HHN last-modified Fri, 03 Apr 2020 21:38:29 GMT server GitHub.com x-github-request-id B8C2:559E:145A8:19EF5:5E8B66E8 x-timer S1586194153.509720,VS0,VE380 etag "5e87acd5-6b" vary Accept-Encoding content-type text/css; charset=utf-8 access-control-allow-origin * expires Mon, 06 Apr 2020 17:39:12 GMT cache-control max-age=600 accept-ranges bytes x-proxy-cache MISS x-cache-hits 0
GET H/1.1	200 OK	jquery-3.2.1.slim.min.js Show response code.jquery.com/	68 KB 24 KB	21ms 7ms	Script application/javascript	2001:4de0:ac19::1:b:1a HIGHWINDS3
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.2.1.slim.min.js Requested by Host: koronaleaks.cz URL: https://koronaleaks.cz/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2001:4de0:ac19::1:b:1a , Netherlands, ASN20446 (HIGHWINDS3, US), Reverse DNS Software nginx / Resource Hash `9365920887b11b33a3dc4ba28a0f93951f200341263e3b9cefd384798e4be398` Request headers Referer https://koronaleaks.cz/ Origin https://koronaleaks.cz Sec-Fetch-Dest script User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Mon, 06 Apr 2020 17:29:12 GMT Content-Encoding gzip Last-Modified Mon, 20 Mar 2017 19:01:15 GMT Server nginx ETag W/"58d026fb-10fdd" Vary Accept-Encoding X-HW 1586194152.dop103.fr8.shc,1586194152.dop103.fr8.t,1586194152.cds007.fr8.c Content-Type application/javascript; charset=utf-8 Access-Control-Allow-Origin * Cache-Control max-age=315360000, public Connection Keep-Alive Accept-Ranges bytes Content-Length 23856
GET H2	200	popper.min.js Show response koronaleaks.cz/	19 KB 7 KB	147ms 146ms	Script application/javascript	185.199.111.153 FASTLY
General Check archive.org Show headers Download Go to Full URL https://koronaleaks.cz/popper.min.js Requested by Host: koronaleaks.cz URL: https://koronaleaks.cz/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.199.111.153 , United States, ASN54113 (FASTLY, US), Reverse DNS Software GitHub.com / Resource Hash `a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66` Request headers Referer https://koronaleaks.cz/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers x-fastly-request-id db7a83089f621ab6648a330943e626185117710c date Mon, 06 Apr 2020 17:29:12 GMT content-encoding gzip age 0 x-cache MISS status 200 content-length 6927 x-served-by cache-hhn4069-HHN access-control-allow-origin * last-modified Fri, 03 Apr 2020 21:38:29 GMT server GitHub.com x-github-request-id AC26:312C:5601E:6B80C:5E8B66E3 x-timer S1586194153.509667,VS0,VE124 etag W/"5e87acd5-4af4" vary Accept-Encoding content-type application/javascript; charset=utf-8 via 1.1 varnish expires Mon, 06 Apr 2020 17:39:12 GMT cache-control max-age=600 accept-ranges bytes x-proxy-cache MISS x-cache-hits 0
GET H2	200	bootstrap.min.js Show response koronaleaks.cz/	48 KB 13 KB	500ms 500ms	Script application/javascript	185.199.111.153 FASTLY
General Check archive.org Show headers Download Go to Full URL https://koronaleaks.cz/bootstrap.min.js Requested by Host: koronaleaks.cz URL: https://koronaleaks.cz/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.199.111.153 , United States, ASN54113 (FASTLY, US), Reverse DNS Software GitHub.com / Resource Hash `e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b` Request headers Referer https://koronaleaks.cz/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers x-fastly-request-id 4978a1aa2ed56b1f5a9d6ebce9e3eceeab78efcf date Mon, 06 Apr 2020 17:29:12 GMT content-encoding gzip age 0 x-cache MISS status 200 content-length 13216 x-served-by cache-hhn4069-HHN access-control-allow-origin * last-modified Fri, 03 Apr 2020 21:38:29 GMT server GitHub.com x-github-request-id B110:55A0:540FD:696CC:5E8B66E8 x-timer S1586194153.509664,VS0,VE478 etag W/"5e87acd5-bf30" vary Accept-Encoding content-type application/javascript; charset=utf-8 via 1.1 varnish expires Mon, 06 Apr 2020 17:39:12 GMT cache-control max-age=600 accept-ranges bytes x-proxy-cache MISS x-cache-hits 0

Verdicts & Comments Add Verdict or Comment

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate function| $ function| jQuery function| Popper object| bootstrap

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

code.jquery.com
koronaleaks.cz
185.199.111.153
2001:4de0:ac19::1:b:1a
2c0f3dcfe93d7e380c290fe4ab838ed8cadff1596d62697f5444be460d1f876d
66bef4518652bf888b53a1df1df8a55cc7b998b75383d08caa16b9f13fafda8f
9365920887b11b33a3dc4ba28a0f93951f200341263e3b9cefd384798e4be398
a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66
add38baca7bbcce0bcb6a9afd59ac12f68d5075d3cf4745efd627a365c2f4129
e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b