URL: https://ipk-secure.com/verify324.php
Submission: On March 23 via api from PL — Scanned from PL

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 7 HTTP transactions. The main IP is 94.156.66.84, located in Bulgaria and belongs to LIMENET, US. The main domain is ipk-secure.com.
TLS certificate: Issued by R3 on March 21st 2024. Valid for: 3 months.
This is the only time ipk-secure.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: PKO Bank Polski (Banking)

Domain & IP information

IP Address AS Autonomous System
6 94.156.66.84 394711 (LIMENET)
1 193.109.225.100 21344 (INTELIGO)
7 3
Apex Domain
Subdomains
Transfer
6 ipk-secure.com
ipk-secure.com
328 KB
1 pkobp.pl
www.pkobp.pl — Cisco Umbrella Rank: 266309
1 KB
7 2
Domain Requested by
6 ipk-secure.com ipk-secure.com
1 www.pkobp.pl ipk-secure.com
7 2

This site contains no links.

Subject Issuer Validity Valid
ipk-secure.com
R3
2024-03-21 -
2024-06-19
3 months crt.sh
pkobp.pl
Certum Extended Validation CA SHA2
2023-12-28 -
2024-12-27
a year crt.sh

This page contains 1 frames:

Primary Page: https://ipk-secure.com/verify324.php
Frame ID: 9B2628358E5840BBF8B0D48027B29D6E
Requests: 9 HTTP requests in this frame

Screenshot

Page Title

Problem z kontem osobistym

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Page Statistics

7
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

329 kB
Transfer

2902 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request verify324.php
ipk-secure.com/
3 MB
312 KB
Document
General
Full URL
https://ipk-secure.com/verify324.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
94.156.66.84 , Bulgaria, ASN394711 (LIMENET, US),
Reverse DNS
Software
Apache /
Resource Hash
c8b06d2116b8ffd5750209f043a401d2c19b999cac62f65d665840fe666a82f1

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36
accept-language
pl-PL,pl;q=0.9

Response headers

content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Sat, 23 Mar 2024 16:34:20 GMT
server
Apache
vary
Accept-Encoding
loading.png
ipk-secure.com/VerificationUid=39495023/Confirmation23901id/assets/
16 KB
16 KB
Image
General
Full URL
https://ipk-secure.com/VerificationUid=39495023/Confirmation23901id/assets/loading.png
Requested by
Host: ipk-secure.com
URL: https://ipk-secure.com/verify324.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
94.156.66.84 , Bulgaria, ASN394711 (LIMENET, US),
Reverse DNS
Software
Apache /
Resource Hash
b1d3eefeb179636112d46b073538683a7846fd3f39e9d696f806152c663f0492

Request headers

accept-language
pl-PL,pl;q=0.9
Referer
https://ipk-secure.com/verify324.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date
Sat, 23 Mar 2024 16:34:20 GMT
last-modified
Tue, 12 Mar 2024 10:26:58 GMT
server
Apache
accept-ranges
bytes
etag
"3e69-613741911e080"
content-length
15977
content-type
image/png
logo-iko-simple-64.svg
www.pkobp.pl/media_files/CiCCh/iPKO/
1 KB
1 KB
Image
General
Full URL
https://www.pkobp.pl/media_files/CiCCh/iPKO/logo-iko-simple-64.svg
Requested by
Host: ipk-secure.com
URL: https://ipk-secure.com/verify324.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
193.109.225.100 , Poland, ASN21344 (INTELIGO, PL),
Reverse DNS
www.pkobp.pl
Software
/
Resource Hash
6d371646f5fdf11110e7550388cb39b7533b0fe729192adbff255a24629ea461
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

accept-language
pl-PL,pl;q=0.9
Referer
https://ipk-secure.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Encoding
gzip
Date
Sat, 23 Mar 2024 16:34:21 GMT
last-modified
śro, 25 paź 2023, 20:42:53
x-cacheable
YES
Age
48
x-frame-options
SAMEORIGIN
vary
Accept-Encoding
content-type
image/svg+xml
cache-control
max-age=7200, public, must-revalidate, proxy-revalidate
Connection
Keep-Alive
accept-ranges
bytes
Content-Length
860
x-ua-compatible
IE=edge
truncated
/
830 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
cf01af45fa0ca8aa5245bf855d17010e6828a95e380e0521955138f799f9aa5b

Request headers

accept-language
pl-PL,pl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/
3 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
29ece7b2e689f637d125e4049a960fd9d5a5a71ead05cb4a89660221bd671038

Request headers

accept-language
pl-PL,pl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

Content-Type
image/svg+xml
PKOBankPolski-Regular.woff
ipk-secure.com/secure/ikd3/gfx/
0
0
Font
General
Full URL
https://ipk-secure.com/secure/ikd3/gfx/PKOBankPolski-Regular.woff
Requested by
Host: ipk-secure.com
URL: https://ipk-secure.com/verify324.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
94.156.66.84 , Bulgaria, ASN394711 (LIMENET, US),
Reverse DNS
Software
Apache /
Resource Hash

Request headers

Referer
https://ipk-secure.com/verify324.php
Origin
https://ipk-secure.com
accept-language
pl-PL,pl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date
Sat, 23 Mar 2024 16:34:20 GMT
server
Apache
content-length
261
content-type
text/html; charset=iso-8859-1
PKOBankPolski-Light.woff
ipk-secure.com/secure/ikd3/gfx/
0
0
Font
General
Full URL
https://ipk-secure.com/secure/ikd3/gfx/PKOBankPolski-Light.woff
Requested by
Host: ipk-secure.com
URL: https://ipk-secure.com/verify324.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
94.156.66.84 , Bulgaria, ASN394711 (LIMENET, US),
Reverse DNS
Software
Apache /
Resource Hash

Request headers

Referer
https://ipk-secure.com/verify324.php
Origin
https://ipk-secure.com
accept-language
pl-PL,pl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date
Sat, 23 Mar 2024 16:34:20 GMT
server
Apache
content-length
261
content-type
text/html; charset=iso-8859-1
PKOBankPolski-Regular.ttf
ipk-secure.com/secure/ikd3/gfx/
0
0
Font
General
Full URL
https://ipk-secure.com/secure/ikd3/gfx/PKOBankPolski-Regular.ttf
Requested by
Host: ipk-secure.com
URL: https://ipk-secure.com/verify324.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
94.156.66.84 , Bulgaria, ASN394711 (LIMENET, US),
Reverse DNS
Software
Apache /
Resource Hash

Request headers

Referer
https://ipk-secure.com/verify324.php
Origin
https://ipk-secure.com
accept-language
pl-PL,pl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date
Sat, 23 Mar 2024 16:34:21 GMT
server
Apache
content-length
261
content-type
text/html; charset=iso-8859-1
PKOBankPolski-Light.ttf
ipk-secure.com/secure/ikd3/gfx/
0
0
Font
General
Full URL
https://ipk-secure.com/secure/ikd3/gfx/PKOBankPolski-Light.ttf
Requested by
Host: ipk-secure.com
URL: https://ipk-secure.com/verify324.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
94.156.66.84 , Bulgaria, ASN394711 (LIMENET, US),
Reverse DNS
Software
Apache /
Resource Hash

Request headers

Referer
https://ipk-secure.com/verify324.php
Origin
https://ipk-secure.com
accept-language
pl-PL,pl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date
Sat, 23 Mar 2024 16:34:21 GMT
server
Apache
content-length
261
content-type
text/html; charset=iso-8859-1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: PKO Bank Polski (Banking)

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| _0x51d63e function| _0x8e94 function| _0x5dd6 function| _0x355d5b function| _0x458b function| _0x3e37

0 Cookies

4 Console Messages

Source Level URL
Text
network error URL: https://ipk-secure.com/secure/ikd3/gfx/PKOBankPolski-Regular.woff
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://ipk-secure.com/secure/ikd3/gfx/PKOBankPolski-Light.woff
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://ipk-secure.com/secure/ikd3/gfx/PKOBankPolski-Regular.ttf
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://ipk-secure.com/secure/ikd3/gfx/PKOBankPolski-Light.ttf
Message:
Failed to load resource: the server responded with a status of 404 ()