--- title: 'What the e-babis.cz Domain Tells Us' url: 'https://www.ondrejsramek.cz/en/blog/co-nam-rikaji-informace-o-domene-e-babis-cz' markdown: 'https://www.ondrejsramek.cz/en/blog/co-nam-rikaji-informace-o-domene-e-babis-cz.md' lang: en date: '2020-04-07' description: "DNS is a good source In the Prime Minister's Sunday address (5 April 2020) someone noticed the back of the paper he was reading from. There was an email addressed to him, subsequently forwarded to a third party (working for the company Imoba). I was curious about which email domain the Prime Minist…" taxonomy: category: - 'informační technologie' - IT tag: - bezpečnost - e-mail - vláda - OSINT '': - '' archives_year: - '2020' --- # DNS is a good source In the Prime Minister's Sunday address (5 April 2020) someone noticed the back of the paper he was reading from. There was an email addressed to him, subsequently forwarded to a third party (working for the company Imoba). I was curious about which email domain the Prime Minister uses. With a little OSINT I managed to find it — the domain is **e-babis.cz**. Let's go step by step — what does DNS tell us about this domain? The A record points to Active24, as no website exists. The interesting part is the MX records — servers **slunce10** and **slunce20**.e-babis.cz are worth investigating further. !\[DNS record for e-babis.cz\](Screenshot 2020-04-07 at 17.50.33.png) The subdomains are also interesting — specifically those managed by O2. !\[Subdomains of e-babis.cz\](Screenshot 2020-04-07 at 17.54.35.png) **MX records slunce10 and slunce20.e-babis.cz** Looking at what's behind these addresses reveals that they are mail servers belonging to Agrofert. !\[slunce10\](Screenshot 2020-04-07 at 17.59.11.png) !\[slunce20\](Screenshot 2020-04-07 at 17.58.59.png) The next images show that these are servers **mail30** and **mail40.agrofert.cz** **!\[mail30\](Screenshot 2020-04-07 at 17.59.21.png) !\[mail40\](Screenshot 2020-04-07 at 17.58.50.png)** According to historical DNS data this situation has been in place since at least 27 October 2018. **!\[DNS history for slunce10\](Screenshot 2020-04-07 at 18.07.33.png)** **Subdomain ms1.e-babis.cz** Looking at the IP address behind this domain leads straight to Agrofert — its own IP range. !\[Agrofert IP range\](Screenshot 2020-04-07 at 18.09.56.png) **What does it all mean?** When an email arrives to , because mail for this domain is handled by Agrofert's servers, that email ends up there. Agrofert is effectively acting as the Prime Minister's email "provider". Or more precisely, everything points to all things connected to the domain **e-babis.cz** being managed by Agrofert. [ Previous Post](https://www.ondrejsramek.cz/en/blog/kurz-zakladni-pripravy-az) [Next Post ](https://www.ondrejsramek.cz/en/blog/ubiquiti-unifi-dream-machine) #### Other Related Posts: [ bezpečnost ](https://www.ondrejsramek.cz/en/blog/tag:bezpe%C4%8Dnost#blog_list) [ internet ](https://www.ondrejsramek.cz/en/blog/tag:internet#blog_list) [ knihovna ](https://www.ondrejsramek.cz/en/blog/tag:knihovna#blog_list) [ přednáška ](https://www.ondrejsramek.cz/en/blog/tag:p%C5%99edn%C3%A1%C5%A1ka#blog_list) [ hrozby ](https://www.ondrejsramek.cz/en/blog/tag:hrozby#blog_list) [ socialní sítě ](https://www.ondrejsramek.cz/en/blog/tag:socialn%C3%AD%20s%C3%ADt%C4%9B#blog_list) ### Lecture [Lecture](https://www.ondrejsramek.cz/en/blog/prvni-prednaska) # For a primary school In November I was contacted by the Municipal Library in Cheb asking whether I could introduce their readers to the hazards of the internet. Cheb is far away, but the journey is pretty manageable — you can work on the train — so I accepted and started thinking about the content... 4th Feb 2025 [ bezpečnost ](https://www.ondrejsramek.cz/en/blog/tag:bezpe%C4%8Dnost#blog_list) [ Threat Intelligence ](https://www.ondrejsramek.cz/en/blog/tag:Threat%20Intelligence#blog_list) [ Threat Hunting ](https://www.ondrejsramek.cz/en/blog/tag:Threat%20Hunting#blog_list) ### Safe Internet Festival [Safe Internet Festival](https://www.ondrejsramek.cz/en/blog/festival-bezpecneho-internetu) # An interview as part of the festival programme Through a former colleague, [Martin](https://www.linkedin.com/in/konecnymartin1/), another former colleague, [Ondra](https://www.linkedin.com/in/ondrejrojcik/), and I were invited onto his podcast. I represented experience with Threat Hunting, while the other Ondra covered Cyber Threat Intelligence. The whole event took place under the a... 9th Oct 2023 - [Intro](https://www.ondrejsramek.cz/en) - [Projects](https://www.ondrejsramek.cz/en/projects) - [Portfolio](https://www.ondrejsramek.cz/en/portfolio) - [Pricing](https://www.ondrejsramek.cz/en/pricing) - [Blog](https://www.ondrejsramek.cz/en/blog) - English - [Čeština](https://www.ondrejsramek.cz/cs/blog/co-nam-rikaji-informace-o-domene-e-babis-cz) --- ## Navigation - Parent: [Blog](https://www.ondrejsramek.cz/en/blog.md) - Previous: [Ubiquiti UniFi Dream Machine](https://www.ondrejsramek.cz/en/blog/ubiquiti-unifi-dream-machine.md) - Next: [Basic Training Course (AZ)](https://www.ondrejsramek.cz/en/blog/kurz-zakladni-pripravy-az.md)