dwall.mzf.cz - urlscan.io

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 5 HTTP transactions. The main IP is 2a01:28:ca:63:120:160::, located in Czech Republic and belongs to SUPERNETWORK (^_^)/, CZ. The main domain is dwall.mzf.cz.

This is the only time dwall.mzf.cz was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Postmaster (Online)

Domain & IP information

	IP Address	AS Autonomous System
3	54.209.177.203 54.209.177.203	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
1	2a01:28:ca:63... 2a01:28:ca:63:120:160::	39392 (SUPERNETW...) (SUPERNETWORK (^_^)/)
1	192.254.234.204 192.254.234.204	46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1 - Unified Layer)
5	3

3 54.209.177.203 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-54-209-177-203.compute-1.amazonaws.com

bou.nz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a01:28:ca:63:120:160:: (Czech Republic)

ASN39392 (SUPERNETWORK (^_^)/, CZ)

dwall.mzf.cz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.254.234.204 (Houston, United States)

ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US)

fajr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	bou.nz bou.nz	2 KB
1	fajr.com fajr.com	6 KB
1	mzf.cz dwall.mzf.cz	1 KB
5	3

	Domain	Requested by
3	bou.nz	bou.nz
1	fajr.com	dwall.mzf.cz
1	dwall.mzf.cz	bou.nz
5	3

This site contains no links.

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://dwall.mzf.cz/
Frame ID: 90B5854540A44424E1FC52A1D5D57955
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://bou.nz/9MDe9 Page URL
http://dwall.mzf.cz/ Page URL

Detected technologies

Ubuntu (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /Ubuntu/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

5
Requests

0 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

9 kB
Transfer

10 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://bou.nz/9MDe9 Page URL
http://dwall.mzf.cz/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Cookie set 9MDe9 Show response
bou.nz/ 2 KB
1 KB 286ms
162ms Document
text/html 54.209.177.203
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: http://bou.nz/9MDe9
Protocol: HTTP/1.1
Server: 54.209.177.203 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-54-209-177-203.compute-1.amazonaws.com
Software: nginx/1.4.6 (Ubuntu) / Express
Resource Hash: 6c4158cb2bf673c3dea9bdc7f65129856131e004fd4d228cb85b36e79f8c9dfd

Request headers

Host: bou.nz
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Server: nginx/1.4.6 (Ubuntu)
Date: Thu, 10 Jan 2019 13:00:33 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: Express
Set-Cookie: __bounziddev=25a28GlrCpfhKKuNNTIaY0YYdrV9eX3z3AaxYg; Path=/
ETag: W/"/vOEGhg2AQU3YZAJwlfaOA=="
Vary: Accept-Encoding
Content-Encoding: gzip

GET
H/1.1 200
OK 235SjrsSs4hCDEL2N620320143564.png
bou.nz/assets/session/ 68 B
373 B 108ms
106ms Image
image/png 54.209.177.203
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://bou.nz/assets/session/235SjrsSs4hCDEL2N620320143564.png?v=1547125233573
Requested by: Host: bou.nz
URL: http://bou.nz/9MDe9
Protocol: HTTP/1.1
Server: 54.209.177.203 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS: ec2-54-209-177-203.compute-1.amazonaws.com
Software: nginx/1.4.6 (Ubuntu) / Express
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: bou.nz
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://bou.nz/9MDe9
Cookie: __bounziddev=25a28GlrCpfhKKuNNTIaY0YYdrV9eX3z3AaxYg
Connection: keep-alive
Cache-Control: no-cache
Referer: http://bou.nz/9MDe9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Thu, 10 Jan 2019 13:00:33 GMT
Last-Modified: Thu, 22 Sep 2016 16:43:52 GMT
Server: nginx/1.4.6 (Ubuntu)
X-Powered-By: Express
ETag: W/"44-1474490438"
Content-Type: image/png
Cache-Control: public, max-age=0
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 68

POST
H/1.1 200
OK 235SjrsSs4hCDEL2N620320143564.json
bou.nz/assets/session/ 22 B
278 B 109ms
105ms XHR
application/json 54.209.177.203
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

http://bou.nz/assets/session/235SjrsSs4hCDEL2N620320143564.json

Requested by

Host: bou.nz
URL: http://bou.nz/9MDe9

Protocol

HTTP/1.1

Server

54.209.177.203 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-54-209-177-203.compute-1.amazonaws.com

Software

nginx/1.4.6 (Ubuntu) / Express

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Pragma: no-cache
Origin: http://bou.nz
Accept-Encoding: gzip, deflate
Host: bou.nz
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-type: application/json
Accept: */*
Cache-Control: no-cache
Referer: http://bou.nz/9MDe9
Cookie: __bounziddev=25a28GlrCpfhKKuNNTIaY0YYdrV9eX3z3AaxYg
Connection: keep-alive
Content-Length: 23
Referer: http://bou.nz/9MDe9
Origin: http://bou.nz
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-type: application/json

Response headers

Date: Thu, 10 Jan 2019 13:00:33 GMT
X-Content-Type-Options: nosniff
Server: nginx/1.4.6 (Ubuntu)
X-Powered-By: Express
Vary: Accept-Encoding
Content-Type: application/json; charset=utf-8
Connection: keep-alive
Content-Length: 22

GET
H/1.1 200
OK Primary Request / Show response
dwall.mzf.cz/ 3 KB
1 KB 227ms
27ms Document
text/html 2a01:28:ca:63:120:160::
SUPERNETWORK (^_^)/

General

Check archive.org

Show headers Download Go to

Full URL: http://dwall.mzf.cz/
Requested by: Host: bou.nz
URL: http://bou.nz/9MDe9
Protocol: HTTP/1.1
Server: 2a01:28:ca:63:120:160:: , Czech Republic, ASN39392 (SUPERNETWORK (^_^)/, CZ),
Reverse DNS
Software: nginx /
Resource Hash: 3bbc03456a3284779708833d8a9fdf9f9c8d29fd7bd1790bfb93939cde83aaa9

Request headers

Host: dwall.mzf.cz
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: http://bou.nz/9MDe9
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: http://bou.nz/9MDe9

Response headers

Server: nginx
Date: Thu, 10 Jan 2019 13:14:38 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: close
Last-Modified: Wed, 09 Jan 2019 08:45:04 GMT
ETag: W/"c87-57f027a7367f5"
Content-Encoding: gzip

GET
H/1.1 200
OK postmaster.png
fajr.com/ 5 KB
6 KB 592ms
235ms Image
image/png 192.254.234.204
Unified Layer

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://fajr.com/postmaster.png
Requested by: Host: dwall.mzf.cz
URL: http://dwall.mzf.cz/
Protocol: HTTP/1.1
Server: 192.254.234.204 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US),
Reverse DNS
Software: nginx/1.14.1 /
Resource Hash: 9241453e99644ed913735907d62b2ce5c6ef51c18f0780e95857fc345ba511d3

Request headers

Referer: http://dwall.mzf.cz/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Thu, 10 Jan 2019 13:14:39 GMT
Last-Modified: Sun, 06 Jan 2019 22:50:20 GMT
Server: nginx/1.14.1
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 5496
Content-Type: image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Postmaster (Online)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bou.nz
dwall.mzf.cz
fajr.com
192.254.234.204
2a01:28:ca:63:120:160::
54.209.177.203
2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11
3bbc03456a3284779708833d8a9fdf9f9c8d29fd7bd1790bfb93939cde83aaa9
6c4158cb2bf673c3dea9bdc7f65129856131e004fd4d228cb85b36e79f8c9dfd
9241453e99644ed913735907d62b2ce5c6ef51c18f0780e95857fc345ba511d3

dwall.mzf.cz Open in urlscan Pro 2a01:28:ca:63:120:160:: Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

5 Requests

0 %HTTPS

33 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

9 kBTransfer

10 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

0 Cookies

Indicators

dwall.mzf.cz Open in urlscan Pro
2a01:28:ca:63:120:160:: Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

0 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

9 kB
Transfer

10 kB
Size

0
Cookies

5 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!