Scan report · 2 days agoPublic

acmaturaky.cz

46.28.105.156AS197019 · CZ

Submittedhttps://acmaturaky.cz

Landed onhttps://acmaturaky.cz/

page copied a hidden mshta command to the visitor's clipboard (ClickFix)

Clipboard command reachesx.open

Full command shown, with a warning, under findings

Engine tags

Verdict

2 of 7 enginesMaliciousAutomated

Own this site?

What happened

Step by step, from what the scanner recorded.

Load 14.4 s · 1 requests

01 · Visitor opensacmaturaky.cz

02 · Page shown

Verification Required

03 · Clipboard seeded · hiddenA command the visitor never seesmshtaThe text is under findings, behind a warning. It was never run.

04 · OutcomeThe visitor runs the payload themselvesPaste, Enter — no download and no login form for a filter to catch.

Dangerous — confirmed threat

Automated

We found strong evidence that this site is malicious — for example a phishing page, a scam, or hostile code. Treat anything it asked for (passwords, card details, codes) as exposed.

What to do

Do not enter any information or download anything. If you already did, change those passwords now and contact your bank if payment details were involved. Block or report the link to your team.

This reflects the evidence found at the time of the scan. If you believe it is a mistake, you can escalate it for analyst review.

Findings

Strongest first

Suspicious fileSuspicious content in the downloaded file

0bc40656-700a-4e24-a663-f4e16ff61f55.html

Our Content Inspection engine downloaded the file this URL serves and analyzed it. The payload shows traits commonly seen in malware. Treat it as unsafe until verified.

Success

SHA-256 19325cb8a8201b3f6e9f647395d361ffeb7b085ecc5d2b682b62a2a1d9820705

ClickFixClickFix: a HIDDEN command was copied to the clipboardmshta

The page never showed this command to the visitor — it silently placed it on their clipboard and instructed them to paste and run something they could not read. The victim executes the attacker's payload themselves; no download or login form is needed.

Live attacker command — do not run this

This is the exact text the page silently placed on a visitor's clipboard. Pasting it into the Windows Run dialog (Win+R), PowerShell, or any terminal will execute the attacker's payload on your machine. Urlyze captured it inside an isolated browser and never executed it.

The command below was found ON THE CLIPBOARD at the end of the render. This scan did not observe the page writing it — the write hooks saw nothing — so treat it as evidence about the machine's clipboard, not yet proof about this page.

What the victim is shown after clicking Verify (captured on a throwaway copy).

Analyst noteTreat the copied command as the payload — read it for the download URL, the dead-drop (Telegram/blockchain) and the execution method. It never runs in our sandbox; nothing was executed.

Infrastructure

IP: 46.28.105.156WEDOS - WEDOS Internet, a.s., CZ · AS197019CZ
TLS: CN=YR2, O=Let's Encrypt, C=US · expires Nov 17, 2026
Redirects: 0 hops · / → /

WHOIS

Created: Mar 25, 2022
Expires: Mar 24, 2027
Nameservers: ns.wedos.comns.wedos.czns.wedos.euns.wedos.net

25 malicious4 suspicious

Hashes & fingerprints

Page Hash0049ac01b98e8a1651103894b8a84b8dc2e3229f471f771cb8fe6b977ce4fdd2 Favicon Hash19325cb8a8201b3f6e9f647395d361ffeb7b085ecc5d2b682b62a2a1d9820705 DOM Hashb81362b325133bacda71f7790907224887e485ba4b6ebff290551b60e4de7334 Screenshot pHashdb0064af9baccea1 JARM15d2ad16d29d29d00015d2ad15d29dceaddcd30c33e19cab56d5b80afc0ff3 JA4Xa373a9f83c6b_7022c563de38_2e3757343cb0 Cert Thumbprint790780BF2FE3B4AE6966ECAA0E72472D04817F6C Cert IssuerCN=YR2, O=Let's Encrypt, C=US

Page capture

Live

Title “Verification Required”

Visit Site

Engines

7 · time to verdict