urlscan.io logo urlscan.io
SecurityTrails logo

www.owczagora.pl Open in urlscan Pro
185.123.161.210  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://go.sparkpostmail1.com/f/a/a7kBemNMKMbbhn8ouq7Viw~~/AAMbmAA~/RgRcSlMgP0RPaHR0cDovL3d3dy5nZXJyaXRtZXRob3V0Lm5sLy9jb21wb2...
Effective URL: http://www.owczagora.pl/components/com_contact/layouts/fields//mynetflex-ukpi000/p0GXSIIcohJk3ld/
Submission: On January 24 via manual from CA
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 3 countries across 3 domains to perform 5 HTTP transactions. The main IP is 185.123.161.210, located in Poland and belongs to INTEN-AS, PL. The main domain is www.owczagora.pl.
This is the only time www.owczagora.pl was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Netflix (Online)

Domain & IP information

IP Address AS Autonomous System
1 1 52.34.63.236 16509 (AMAZON-02)
1 185.182.56.31 48635 (ASTRALUS)
1 5 185.123.161.210 43962 (INTEN-AS)
5 2
Apex Domain
Subdomains		 Transfer
5 owczagora.pl
www.owczagora.pl
225 KB
1 gerritmethout.nl
www.gerritmethout.nl
594 B
1 sparkpostmail1.com
go.sparkpostmail1.com
250 B
5 3
Domain Requested by
5 www.owczagora.pl 1 redirects www.owczagora.pl
1 www.gerritmethout.nl
1 go.sparkpostmail1.com 1 redirects
5 3

This site contains no links.

Subject Issuer Validity Valid

This page contains 1 frames:

Primary Page: http://www.owczagora.pl/components/com_contact/layouts/fields//mynetflex-ukpi000/p0GXSIIcohJk3ld/
Frame ID: (D430C924C7D01127D96540505EBD486)
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. http://go.sparkpostmail1.com/f/a/a7kBemNMKMbbhn8ouq7Viw~~/AAMbmAA~/RgRcSlMgP0RPaHR0cDovL3d3dy5nZXJyaXRtZX... HTTP 302
    http://www.gerritmethout.nl//components/com_content/helpers/yaskothokmaskar.php Page URL
  2. http://www.owczagora.pl//components/com_contact/layouts/fields//mynetflex-ukpi000/ Page URL
  3. http://www.owczagora.pl//components/com_contact/layouts/fields//mynetflex-ukpi000/p0GXSIIcohJk3ld HTTP 301
    http://www.owczagora.pl/components/com_contact/layouts/fields//mynetflex-ukpi000/p0GXSIIcohJk3ld/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

Page Statistics

5
Requests

0 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

2
IPs

3
Countries

225 kB
Transfer

224 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://go.sparkpostmail1.com/f/a/a7kBemNMKMbbhn8ouq7Viw~~/AAMbmAA~/RgRcSlMgP0RPaHR0cDovL3d3dy5nZXJyaXRtZXRob3V0Lm5sLy9jb21wb25lbnRzL2NvbV9jb250ZW50L2hlbHBlcnMveWFza290aG9rbWFza2FyLnBocFcDc3BjWAQAAAAAQgoACM_OZ1oF3HPg HTTP 302
    http://www.gerritmethout.nl//components/com_content/helpers/yaskothokmaskar.php Page URL
  2. http://www.owczagora.pl//components/com_contact/layouts/fields//mynetflex-ukpi000/ Page URL
  3. http://www.owczagora.pl//components/com_contact/layouts/fields//mynetflex-ukpi000/p0GXSIIcohJk3ld HTTP 301
    http://www.owczagora.pl/components/com_contact/layouts/fields//mynetflex-ukpi000/p0GXSIIcohJk3ld/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • http://go.sparkpostmail1.com/f/a/a7kBemNMKMbbhn8ouq7Viw~~/AAMbmAA~/RgRcSlMgP0RPaHR0cDovL3d3dy5nZXJyaXRtZXRob3V0Lm5sLy9jb21wb25lbnRzL2NvbV9jb250ZW50L2hlbHBlcnMveWFza290aG9rbWFza2FyLnBocFcDc3BjWAQAAAAAQgoACM_OZ1oF3HPg HTTP 302
  • http://www.gerritmethout.nl//components/com_content/helpers/yaskothokmaskar.php

5 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
yaskothokmaskar.php
www.gerritmethout.nl//components/com_content/helpers/
Redirect Chain
  • http://go.sparkpostmail1.com/f/a/a7kBemNMKMbbhn8ouq7Viw~~/AAMbmAA~/RgRcSlMgP0RPaHR0cDovL3d3dy5nZXJyaXRtZXRob3V0Lm5sLy9jb21wb25lbnRzL2NvbV9jb250ZW50L2hlbHBlcnMveWFza290aG9rbWFza2FyLnBocFcDc3BjWAQAAA...
  • http://www.gerritmethout.nl//components/com_content/helpers/yaskothokmaskar.php
334 B
594 B 		Document
General
Check archive.org
Download Go to
Full URL
http://www.gerritmethout.nl//components/com_content/helpers/yaskothokmaskar.php
Protocol
HTTP/1.1
Server
185.182.56.31 , Netherlands, ASN48635 (ASTRALUS, NL),
Reverse DNS
vserver143.axc.nl
Software
Apache/2 /
Resource Hash
a573ae1085ec53fee76e224ca82bd9651c43cccb3ddf184f55aaae4fec39e208

Request headers

Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Connection
keep-alive
Accept-Encoding
gzip, deflate
Host
www.gerritmethout.nl
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Wed, 24 Jan 2018 20:28:31 GMT
Content-Encoding
gzip
Server
Apache/2
Vary
Accept-Encoding,User-Agent
Upgrade
h2,h2c
Connection
Upgrade, Keep-Alive
Content-Type
text/html
Keep-Alive
timeout=2, max=100
Content-Length
232

Redirect headers

Location
http://www.gerritmethout.nl//components/com_content/helpers/yaskothokmaskar.php
Date
Wed, 24 Jan 2018 20:28:31 GMT
Server
msys-http
Connection
keep-alive
Content-Length
0
Content-Type
text/plain
/
www.owczagora.pl//components/com_contact/layouts/fields//mynetflex-ukpi000/ 		62 B
268 B 		Document
General
Check archive.org
Download Go to
Full URL
http://www.owczagora.pl//components/com_contact/layouts/fields//mynetflex-ukpi000/
Protocol
HTTP/1.1
Server
185.123.161.210 , Poland, ASN43962 (INTEN-AS, PL),
Reverse DNS
node
Software
Apache /
Resource Hash
b37f7b1c7657de8428b6740aa6d41992585907f42621baaec4b82b05fd7a4a05

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
www.owczagora.pl
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer
http://www.gerritmethout.nl//components/com_content/helpers/yaskothokmaskar.php
Connection
keep-alive
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
Referer
http://www.gerritmethout.nl//components/com_content/helpers/yaskothokmaskar.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Wed, 24 Jan 2018 20:28:32 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Server
Apache
Connection
close
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
Primary Request /
www.owczagora.pl/components/com_contact/layouts/fields//mynetflex-ukpi000/p0GXSIIcohJk3ld/
Redirect Chain
  • http://www.owczagora.pl//components/com_contact/layouts/fields//mynetflex-ukpi000/p0GXSIIcohJk3ld
  • http://www.owczagora.pl/components/com_contact/layouts/fields//mynetflex-ukpi000/p0GXSIIcohJk3ld/
1 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://www.owczagora.pl/components/com_contact/layouts/fields//mynetflex-ukpi000/p0GXSIIcohJk3ld/
Protocol
HTTP/1.1
Server
185.123.161.210 , Poland, ASN43962 (INTEN-AS, PL),
Reverse DNS
node
Software
Apache /
Resource Hash
ad70dee4d613f9b81acf3414d3faaba70f67c8c7bd423ee7e7fee713662882fb

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
www.owczagora.pl
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer
http://www.owczagora.pl//components/com_contact/layouts/fields//mynetflex-ukpi000/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.owczagora.pl//components/com_contact/layouts/fields//mynetflex-ukpi000/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Wed, 24 Jan 2018 20:28:32 GMT
Content-Encoding
gzip
Last-Modified
Wed, 24 Jan 2018 20:28:32 GMT
Server
Apache
ETag
W/"5ad-5638b81c6481d-gzip"
Vary
Accept-Encoding,User-Agent
Content-Type
text/html
Connection
close
Accept-Ranges
bytes
Content-Length
649

Redirect headers

Location
http://www.owczagora.pl/components/com_contact/layouts/fields//mynetflex-ukpi000/p0GXSIIcohJk3ld/
Date
Wed, 24 Jan 2018 20:28:32 GMT
Server
Apache
Connection
close
Content-Length
305
Content-Type
text/html; charset=iso-8859-1
btn.jpg
www.owczagora.pl/components/com_contact/layouts/fields//mynetflex-ukpi000/p0GXSIIcohJk3ld/img/ 		5 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://www.owczagora.pl/components/com_contact/layouts/fields//mynetflex-ukpi000/p0GXSIIcohJk3ld/img/btn.jpg
Requested by
Host: www.owczagora.pl
URL: http://www.owczagora.pl/components/com_contact/layouts/fields//mynetflex-ukpi000/p0GXSIIcohJk3ld/
Protocol
HTTP/1.1
Server
185.123.161.210 , Poland, ASN43962 (INTEN-AS, PL),
Reverse DNS
node
Software
Apache /
Resource Hash
0094a3de822abf00627c6bf12283900cc6de816a1884ef56115f08b579c79ca6

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
www.owczagora.pl
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
http://www.owczagora.pl/components/com_contact/layouts/fields//mynetflex-ukpi000/p0GXSIIcohJk3ld/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.owczagora.pl/components/com_contact/layouts/fields//mynetflex-ukpi000/p0GXSIIcohJk3ld/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Wed, 24 Jan 2018 20:28:32 GMT
Last-Modified
Wed, 24 Jan 2018 20:28:32 GMT
Server
Apache
ETag
W/"15da-5638b81c6b57d"
Vary
User-Agent
Content-Type
image/jpeg
Connection
close
Accept-Ranges
bytes
Content-Length
5594
back1.jpg
www.owczagora.pl/components/com_contact/layouts/fields//mynetflex-ukpi000/p0GXSIIcohJk3ld/img/ 		217 KB
217 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://www.owczagora.pl/components/com_contact/layouts/fields//mynetflex-ukpi000/p0GXSIIcohJk3ld/img/back1.jpg
Requested by
Host: www.owczagora.pl
URL: http://www.owczagora.pl/components/com_contact/layouts/fields//mynetflex-ukpi000/p0GXSIIcohJk3ld/
Protocol
HTTP/1.1
Server
185.123.161.210 , Poland, ASN43962 (INTEN-AS, PL),
Reverse DNS
node
Software
Apache /
Resource Hash
5911c07c8f37009c26697403b7e3b62132deffbf5845ea479595f076ecc0dc84

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
www.owczagora.pl
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
http://www.owczagora.pl/components/com_contact/layouts/fields//mynetflex-ukpi000/p0GXSIIcohJk3ld/
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.owczagora.pl/components/com_contact/layouts/fields//mynetflex-ukpi000/p0GXSIIcohJk3ld/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date
Wed, 24 Jan 2018 20:28:32 GMT
Last-Modified
Wed, 24 Jan 2018 20:28:32 GMT
Server
Apache
ETag
W/"362e1-5638b81c676fd"
Vary
User-Agent
Content-Type
image/jpeg
Connection
close
Accept-Ranges
bytes
Content-Length
221921

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Netflix (Online)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies