konta-rldlce-gov-cz.eu Open in urlscan Pro
2a00:7a60:0:109a::1 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://konta-rldlce-gov-cz.eu/
Submission: On August 28 via manual (August 28th 2024, 8:57:00 am UTC) from CZ — Scanned from US

Summary HTTP 8 Redirects Links 12 Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 8 HTTP transactions. The main IP is 2a00:7a60:0:109a::1, located in Ukraine and belongs to UKRAINE-AS, UA. The main domain is konta-rldlce-gov-cz.eu.
TLS certificate: Issued by R11 on August 26th 2024. Valid for: 3 months.

This is the only time konta-rldlce-gov-cz.eu was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Czech Government (Government)

Domain & IP information

	IP Address	AS Autonomous System
7	2a00:7a60:0:1... 2a00:7a60:0:109a::1	200000 (UKRAINE-AS) (UKRAINE-AS)
1	185.17.215.70 185.17.215.70	48298 (GOV) (GOV)
8	2

7 2a00:7a60:0:109a::1 (Ukraine)

ASN200000 (UKRAINE-AS, UA)

konta-rldlce-gov-cz.eu	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.17.215.70 (Prague, Czech Republic)

ASN48298 (GOV, CZ)

gov.cz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	konta-rldlce-gov-cz.eu konta-rldlce-gov-cz.eu	74 KB
1	gov.cz gov.cz — Cisco Umbrella Rank: 334854	15 KB
8	2

	Domain	Requested by
7	konta-rldlce-gov-cz.eu	konta-rldlce-gov-cz.eu
1	gov.cz
8	2

This site contains links to these domains. Also see Links.

Domain
gov.cz
pruvodce.gov.cz
portalobcana.gov.cz
obcan.portal.gov.cz
www.mdcr.cz
www.facebook.com
x.com
www.youtube.com

Subject Issuer	Validity	Valid
www.konta-rldlce-gov-cz.eu R11	`2024-08-26` - `2024-11-24`	3 months	crt.sh
gov.cz GeoTrust EV RSA CA G2	`2024-06-06` - `2025-06-05`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://konta-rldlce-gov-cz.eu/
Frame ID: D5F0C548AA567B6FF870F5442B946F06
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Výpis z bodového konta řidiče - gov.cz

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

8
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

89 kB
Transfer

411 kB
Size

1
Cookies

12 Outgoing links

These are links going to different origins than the main page.

URL: https://gov.cz/
Title: Úvod

Search URL Search Domain Scan URL

URL: https://gov.cz/sluzby-verejne-spravy/
Title: Služby veřejné správy

Search URL Search Domain Scan URL

URL: https://pruvodce.gov.cz/?utm_source=pvs&utm_medium=primarymenu&utm_campaign=pvs
Title: Životní události

Search URL Search Domain Scan URL

URL: https://gov.cz/o-zivote-v-cr/
Title: O životě v ČR

Search URL Search Domain Scan URL

URL: https://gov.cz/kam-dal/
Title: Kam dál

Search URL Search Domain Scan URL

URL: https://portalobcana.gov.cz/
Title: Co je portál občana

Search URL Search Domain Scan URL

URL: https://obcan.portal.gov.cz/
Title: Přihlásit se do portálu občana

Search URL Search Domain Scan URL

URL: https://www.mdcr.cz/Zivotni-situace/Ridicske-prukazy/bodovy_system?returl=/Zivotni-situace/Ridicske-prukazy
Title: https://www.mdcr.cz/Zivotni-situace/Ridicske-prukazy/bodovy_system

Search URL Search Domain Scan URL

URL: https://www.mdcr.cz/Zivotni-situace/Ridicske-prukazy/jak-zjistit-body?returl=/Zivotni-situace/Ridicske-prukazy
Title: https://www.mdcr.cz/Zivotni-situace/Ridicske-prukazy/jak-zjistit-body

Search URL Search Domain Scan URL

URL: https://www.facebook.com/cz.eGovernment/

Search URL Search Domain Scan URL

URL: https://x.com/gov_cz

Search URL Search Domain Scan URL

URL: https://www.youtube.com/channel/UCCEISjcwdeqghfa4Z2mWMOg

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response konta-rldlce-gov-cz.eu/	96 KB 13 KB	1718ms 493ms	Document text/html	2a00:7a60:0:109a::1 UKRAINE-AS
General Check archive.org Show headers Download Go to Full URL https://konta-rldlce-gov-cz.eu/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a00:7a60:0:109a::1 , Ukraine, ASN200000 (UKRAINE-AS, UA), Reverse DNS Software nginx / Resource Hash `a9b4d554a5e1fd9aac23a0f02d20591da592f2d2b4eb01163f527033abb2537b` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers cache-control no-store, no-cache, must-revalidate content-encoding br content-type text/html; charset=UTF-8 date Wed, 28 Aug 2024 08:56:54 GMT expires Thu, 19 Nov 1981 08:52:00 GMT pragma no-cache server nginx x-ray wnp32812:0.020/wn32812:0.000/wa32812:D=8900
GET H2	200	styles.min.css konta-rldlce-gov-cz.eu/grim/	181 KB 21 KB	967ms 965ms	Stylesheet text/css	2a00:7a60:0:109a::1 UKRAINE-AS
General Check archive.org Show headers Download Go to Full URL https://konta-rldlce-gov-cz.eu/grim/styles.min.css Requested by Host: konta-rldlce-gov-cz.eu URL: https://konta-rldlce-gov-cz.eu/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a00:7a60:0:109a::1 , Ukraine, ASN200000 (UKRAINE-AS, UA), Reverse DNS Software nginx / Resource Hash `3fcb6d391961424ad955e24e1af1af28e4c8994af2b09ba116e9859ac86ffce6` Request headers Referer https://konta-rldlce-gov-cz.eu/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers date Wed, 28 Aug 2024 08:56:54 GMT x-ray wnp32812:0.000/wn32812:0.000/ content-encoding br last-modified Mon, 15 Jul 2024 16:43:10 GMT server nginx etag W/"6695519e-2d319" content-type text/css
GET H2	200	print.min.css konta-rldlce-gov-cz.eu/grim/	6 KB 2 KB	726ms 724ms	Stylesheet text/css	2a00:7a60:0:109a::1 UKRAINE-AS
General Check archive.org Show headers Download Go to Full URL https://konta-rldlce-gov-cz.eu/grim/print.min.css Requested by Host: konta-rldlce-gov-cz.eu URL: https://konta-rldlce-gov-cz.eu/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a00:7a60:0:109a::1 , Ukraine, ASN200000 (UKRAINE-AS, UA), Reverse DNS Software nginx / Resource Hash `2662dc50fa8010be3a110fa6c89ae0f9d4fbd7d47fe3c0fbc4d85d0043d99b94` Request headers Referer https://konta-rldlce-gov-cz.eu/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers date Wed, 28 Aug 2024 08:56:54 GMT x-ray wnp32812:0.000/wn32812:0.000/ content-encoding br last-modified Mon, 15 Jul 2024 16:43:10 GMT server nginx etag W/"6695519e-1830" content-type text/css
GET H2	200	pvs.css konta-rldlce-gov-cz.eu/grim/	8 KB 2 KB	726ms 724ms	Stylesheet text/css	2a00:7a60:0:109a::1 UKRAINE-AS
General Check archive.org Show headers Download Go to Full URL https://konta-rldlce-gov-cz.eu/grim/pvs.css Requested by Host: konta-rldlce-gov-cz.eu URL: https://konta-rldlce-gov-cz.eu/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a00:7a60:0:109a::1 , Ukraine, ASN200000 (UKRAINE-AS, UA), Reverse DNS Software nginx / Resource Hash `5af90dcaa5001a5f13644a1b7e83e0712c0e0cbb29d96d59459819902b2fe034` Request headers Referer https://konta-rldlce-gov-cz.eu/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers date Wed, 28 Aug 2024 08:56:54 GMT x-ray wnp32812:0.000/wn32812:0.000/ content-encoding br last-modified Mon, 15 Jul 2024 16:43:10 GMT server nginx etag W/"6695519e-209a" content-type text/css
GET H2	200	forms.css konta-rldlce-gov-cz.eu/grim/	13 KB 2 KB	725ms 725ms	Stylesheet text/css	2a00:7a60:0:109a::1 UKRAINE-AS
General Check archive.org Show headers Download Go to Full URL https://konta-rldlce-gov-cz.eu/grim/forms.css Requested by Host: konta-rldlce-gov-cz.eu URL: https://konta-rldlce-gov-cz.eu/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a00:7a60:0:109a::1 , Ukraine, ASN200000 (UKRAINE-AS, UA), Reverse DNS Software nginx / Resource Hash `96185ffe2652c6b0c8c608fa521d5eb29f28964ab72b18506a6d5dccde23e5ab` Request headers Referer https://konta-rldlce-gov-cz.eu/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers date Wed, 28 Aug 2024 08:56:54 GMT x-ray wnp32812:0.000/wn32812:0.000/ content-encoding br last-modified Mon, 15 Jul 2024 16:43:10 GMT server nginx etag W/"6695519e-333d" content-type text/css
GET H2	200	jquery-3.6.0.min.js Show response konta-rldlce-gov-cz.eu/libs/jquery/	87 KB 30 KB	484ms 483ms	Script application/javascript	2a00:7a60:0:109a::1 UKRAINE-AS
General Check archive.org Show headers Download Go to Full URL https://konta-rldlce-gov-cz.eu/libs/jquery/jquery-3.6.0.min.js Requested by Host: konta-rldlce-gov-cz.eu URL: https://konta-rldlce-gov-cz.eu/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a00:7a60:0:109a::1 , Ukraine, ASN200000 (UKRAINE-AS, UA), Reverse DNS Software nginx / Resource Hash `ee11e902416a1d896f538103110337b39a0e2e2606bc1faf5cd0652914891127` Request headers Referer https://konta-rldlce-gov-cz.eu/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers date Wed, 28 Aug 2024 08:56:54 GMT x-ray wnp32812:0.000/wn32812:0.000/ content-encoding br last-modified Tue, 02 Aug 2022 10:28:54 GMT server nginx etag W/"62e8fc66-15d9d" content-type application/javascript
GET H2	200	gov-basic-icons.woff2 konta-rldlce-gov-cz.eu/assets/fonts/icons/	5 KB 5 KB	243ms 242ms	Font font/woff2	2a00:7a60:0:109a::1 UKRAINE-AS
General Check archive.org Show headers Download Go to Full URL https://konta-rldlce-gov-cz.eu/assets/fonts/icons/gov-basic-icons.woff2?v=v3.4.0 Requested by Host: konta-rldlce-gov-cz.eu URL: https://konta-rldlce-gov-cz.eu/grim/styles.min.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a00:7a60:0:109a::1 , Ukraine, ASN200000 (UKRAINE-AS, UA), Reverse DNS Software nginx / Resource Hash `312e240d4ac2b4f1ad9bc3301c8025fdf37ad6fe1e9f9bda2137bfcc4d8cc8f2` Request headers Referer https://konta-rldlce-gov-cz.eu/grim/styles.min.css Origin https://konta-rldlce-gov-cz.eu User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers date Wed, 28 Aug 2024 08:56:55 GMT x-ray wnp32812:0.000/wn32812:0.000/ last-modified Mon, 15 Jul 2024 16:54:04 GMT server nginx etag "6695542c-148c" content-type font/woff2 accept-ranges bytes content-length 5260
GET H2	200	favicon.ico gov.cz/static/images/meta/	15 KB 15 KB	1386ms 266ms	Other image/vnd.microsoft.icon	185.17.215.70 GOV
General Check archive.org Show headers Download Go to Full URL https://gov.cz/static/images/meta/favicon.ico?v=knceasdft Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 185.17.215.70 Prague, Czech Republic, ASN48298 (GOV, CZ), Reverse DNS Software / Resource Hash `8daa97f8b2726bb78c3d037c5e00427eb4821d45336707ed2c4b089294d961ae` Request headers Referer https://konta-rldlce-gov-cz.eu/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers date Wed, 28 Aug 2024 08:56:56 GMT cache-control no-cache last-modified Wed, 24 Jul 2024 10:47:57 GMT content-disposition inline; filename=favicon.ico content-length 15086 content-type image/vnd.microsoft.icon

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Czech Government (Government)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			konta-rldlce-gov-cz.eu/	1969-12-31 23:59:59	Name: PHPSESSID Value: a3834d614ab89fb68793425726e3aa11

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

gov.cz
konta-rldlce-gov-cz.eu
185.17.215.70
2a00:7a60:0:109a::1
2662dc50fa8010be3a110fa6c89ae0f9d4fbd7d47fe3c0fbc4d85d0043d99b94
312e240d4ac2b4f1ad9bc3301c8025fdf37ad6fe1e9f9bda2137bfcc4d8cc8f2
3fcb6d391961424ad955e24e1af1af28e4c8994af2b09ba116e9859ac86ffce6
5af90dcaa5001a5f13644a1b7e83e0712c0e0cbb29d96d59459819902b2fe034
8daa97f8b2726bb78c3d037c5e00427eb4821d45336707ed2c4b089294d961ae
96185ffe2652c6b0c8c608fa521d5eb29f28964ab72b18506a6d5dccde23e5ab
a9b4d554a5e1fd9aac23a0f02d20591da592f2d2b4eb01163f527033abb2537b
ee11e902416a1d896f538103110337b39a0e2e2606bc1faf5cd0652914891127

konta-rldlce-gov-cz.eu Open in urlscan Pro 2a00:7a60:0:109a::1 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

8 Requests

100 %HTTPS

50 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

89 kBTransfer

411 kBSize

1 Cookies

12 Outgoing links

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

1 Cookies

Indicators

konta-rldlce-gov-cz.eu Open in urlscan Pro
2a00:7a60:0:109a::1 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

89 kB
Transfer

411 kB
Size

1
Cookies

8 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!