serwer2255313.home.pl
Open in
urlscan Pro
46.242.239.179
Malicious Activity!
Public Scan
Effective URL: https://serwer2255313.home.pl/finan/finan/auth/login.php
Submission: On September 12 via api from BY — Scanned from PL
Summary
TLS certificate: Issued by Certyfikat SSL on May 22nd 2024. Valid for: a year.
This is the only time serwer2255313.home.pl was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: PostFinance (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 24 | 46.242.239.179 46.242.239.179 | 12824 (HOMEPL-AS) (HOMEPL-AS) | |
6 | 151.101.129.229 151.101.129.229 | 54113 (FASTLY) (FASTLY) | |
29 | 2 |
ASN12824 (HOMEPL-AS, PL)
PTR: cloudserver3192889-3192920.home.pl
serwer2255313.home.pl |
Apex Domain Subdomains |
Transfer | |
---|---|---|
24 |
home.pl
1 redirects
serwer2255313.home.pl |
197 KB |
6 |
jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 410 |
149 KB |
29 | 2 |
Domain | Requested by | |
---|---|---|
24 | serwer2255313.home.pl |
1 redirects
serwer2255313.home.pl
|
6 | cdn.jsdelivr.net |
serwer2255313.home.pl
cdn.jsdelivr.net |
29 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.home.pl Certyfikat SSL |
2024-05-22 - 2025-06-21 |
a year | crt.sh |
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2024 Q3 |
2024-07-30 - 2025-08-31 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://serwer2255313.home.pl/finan/finan/auth/login.php
Frame ID: E942A23DD4F78F89752424BCF4FC9EFA
Requests: 29 HTTP requests in this frame
Screenshot
Page Title
PostFinance - E-FinancePage URL History Show full URLs
-
http://serwer2255313.home.pl/finan/finan/
HTTP 307
https://serwer2255313.home.pl/finan/finan/ HTTP 302
https://serwer2255313.home.pl/finan/finan/auth/login.php Page URL
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- \.php(?:$|\?)
Bootstrap (Web Frameworks) Expand
Detected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Font Awesome (Font Scripts) Expand
Detected patterns
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
jsDelivr (CDN) Expand
Detected patterns
- <link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
- //cdn\.jsdelivr\.net/
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://serwer2255313.home.pl/finan/finan/
HTTP 307
https://serwer2255313.home.pl/finan/finan/ HTTP 302
https://serwer2255313.home.pl/finan/finan/auth/login.php Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
29 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
login.php
serwer2255313.home.pl/finan/finan/auth/ Redirect Chain
|
11 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
all.css
cdn.jsdelivr.net/gh/hung1001/font-awesome-pro@4cac1a6/css/ |
363 KB 46 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@5.2.3/dist/css/ |
190 KB 30 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
login.css
serwer2255313.home.pl/finan/finan/auth/themes/css/ |
93 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo.png
serwer2255313.home.pl/finan/finan/auth/assets/images/ |
42 KB 42 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.js
cdn.jsdelivr.net/npm/bootstrap@5.2.3/dist/js/ |
59 KB 17 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.bundle.min.js
cdn.jsdelivr.net/npm/bootstrap@5.2.3/dist/js/ |
79 KB 24 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jq.js
serwer2255313.home.pl/finan/finan/auth/res/ |
87 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jq.js
serwer2255313.home.pl/finan/finan/panel/res/ |
87 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
FrutigerNeueLTW06-Light.23770ae90a0ac3d5.woff2
serwer2255313.home.pl/finan/finan/auth/themes/font/ |
42 KB 42 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pro-fa-solid-900-5.0.0.woff2
cdn.jsdelivr.net/gh/hung1001/font-awesome-pro@4cac1a6/webfonts/ |
19 KB 19 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
FrutigerNeueLTW05-Medium.58a0ff866e7c76b1.woff2
serwer2255313.home.pl/finan/finan/auth/themes/font/ |
41 KB 41 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pro-fa-light-300-5.7.0.woff2
cdn.jsdelivr.net/gh/hung1001/font-awesome-pro@4cac1a6/webfonts/ |
12 KB 12 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
spy.php
serwer2255313.home.pl/finan/finan/auth/ |
0 208 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
processor.php
serwer2255313.home.pl/finan/finan/panel/classes/ |
0 208 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
processor.php
serwer2255313.home.pl/finan/finan/panel/classes/ |
0 208 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
processor.php
serwer2255313.home.pl/finan/finan/panel/classes/ |
1 B 210 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
processor.php
serwer2255313.home.pl/finan/finan/panel/classes/ |
0 208 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
processor.php
serwer2255313.home.pl/finan/finan/panel/classes/ |
1 B 210 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
processor.php
serwer2255313.home.pl/finan/finan/panel/classes/ |
0 208 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
processor.php
serwer2255313.home.pl/finan/finan/panel/classes/ |
1 B 210 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
processor.php
serwer2255313.home.pl/finan/finan/panel/classes/ |
0 208 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
processor.php
serwer2255313.home.pl/finan/finan/panel/classes/ |
1 B 210 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
processor.php
serwer2255313.home.pl/finan/finan/panel/classes/ |
0 208 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
processor.php
serwer2255313.home.pl/finan/finan/panel/classes/ |
1 B 210 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
processor.php
serwer2255313.home.pl/finan/finan/panel/classes/ |
0 208 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
processor.php
serwer2255313.home.pl/finan/finan/panel/classes/ |
1 B 210 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
processor.php
serwer2255313.home.pl/finan/finan/panel/classes/ |
0 208 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
processor.php
serwer2255313.home.pl/finan/finan/panel/classes/ |
1 B 210 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: PostFinance (Banking)9 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| togglePassword object| passwordInput number| uidEvent object| bootstrap function| $ function| jQuery object| targets string| redirect function| clearRedirections1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
serwer2255313.home.pl/ | Name: PHPSESSID Value: hlv9b3l87j6deu8m2k6sr9vs6f |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn.jsdelivr.net
serwer2255313.home.pl
151.101.129.229
46.242.239.179
1b50aa1d36ea249991fb44f8f6ad2aa74fe360df9cc04c564b5edf3b053b739c
5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
6c9b88da6d6c32d8f376e3b03f31af197cc9d36b7c0d03bad68694b60fc799a9
6e2c6e0f05cb0c2378bad3e1afd9b4c61aa3b8d03ec8cc8003ea483baa31892f
8e0f3eee973f0a72d3960e29b95ba4247f8e41d0fd2afba81ff63a2560e6149e
9520018fa5d81f4e4dc9d06afb576f90cbbaba209cfcc6cb60e1464647f7890b
9a2723c21fb1b7dff0e2aa5dc6be24a9670220a17ae21f70fdbc602d1f8acd38
9bcd4d0f29dc6556ebeeff44eaa0965f0c7f7308ee58394708cce2f698cca1b0
c0bcf7898fdc3b87babca678cd19a8e3ef570e931c80a3afbffcc453738c951a
c4772e97742bb0756ab29709b59debdfbca546b640277ff1f86935b0a72eca7f
d57f0454f106eff11c18b45792a1be05ca0cd79ea653a201a37939e8235eff73
ddcf221f9ba32ec5d0bd05ad2207e370e7d399e7dd348ea1fee2c0e7c1135c0d
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ea801dfca41781ad06f025543ae1710fdd715dc60b463a9c38bbf55bf91de902
ee11e902416a1d896f538103110337b39a0e2e2606bc1faf5cd0652914891127