parkpilates.sk - urlscan.io

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 7 HTTP transactions. The main IP is 37.9.175.132, located in Slovakia and belongs to WEBSUPPORT-SRO-SK-AS, SK. The main domain is parkpilates.sk.
TLS certificate: Issued by R10 on September 13th 2024. Valid for: 3 months.

This is the only time parkpilates.sk was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Chase (Banking)

Domain & IP information

	IP Address		AS Autonomous System
1 7	37.9.175.132 37.9.175.132		51013 (WEBSUPPOR...) (WEBSUPPORT-SRO-SK-AS)
7	2

7 37.9.175.132 (Slovakia) 1 redirects

ASN51013 (WEBSUPPORT-SRO-SK-AS, SK)
PTR: ing.r1.websupport.sk

parkpilates.sk	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	parkpilates.sk 1 redirects parkpilates.sk	334 KB
0	duckdns.org Failed telegrambotcheck.duckdns.org Failed
7	2

	Domain	Requested by
7	parkpilates.sk	1 redirects parkpilates.sk
0	telegrambotcheck.duckdns.org Failed	parkpilates.sk
7	2

This site contains no links.

Subject Issuer	Validity	Valid
parkpilates.sk R10	`2024-09-13` - `2024-12-12`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://parkpilates.sk/wp-includes/certificates/loginno/login.php
Frame ID: 5AB3FC5F3B2ED6428F6829D96D258436
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

chase

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

7
Requests

71 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

334 kB
Transfer

664 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 5

https://parkpilates.sk/favicon.ico HTTP 302
https://parkpilates.sk/wp-content/uploads/2020/11/cropped-fav_icon-32x32.png

7 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request login.php Show response parkpilates.sk/wp-includes/certificates/loginno/	1 KB 592 B	134ms 39ms	Document text/html	37.9.175.132 WEBSUPPORT-SRO-SK-AS
General Check archive.org Show headers Download Go to Full URL https://parkpilates.sk/wp-includes/certificates/loginno/login.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 37.9.175.132 , Slovakia, ASN51013 (WEBSUPPORT-SRO-SK-AS, SK), Reverse DNS ing.r1.websupport.sk Software openresty / Resource Hash `2cfc91cce8ac6055e0e1b7194c0578aa5d6a009da0c78638aa8b4013118f8599` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Response headers alt-svc h3=":443"; ma=86400 content-encoding br content-type text/html; charset=UTF-8 date Wed, 06 Nov 2024 01:07:33 GMT server openresty vary Accept-Encoding
GET H2	200	chase.css parkpilates.sk/wp-includes/certificates/loginno/res/css/	2 KB 657 B	81ms 79ms	Stylesheet text/css	37.9.175.132 WEBSUPPORT-SRO-SK-AS
General Check archive.org Show headers Download Go to Full URL https://parkpilates.sk/wp-includes/certificates/loginno/res/css/chase.css Requested by Host: parkpilates.sk URL: https://parkpilates.sk/wp-includes/certificates/loginno/login.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 37.9.175.132 , Slovakia, ASN51013 (WEBSUPPORT-SRO-SK-AS, SK), Reverse DNS ing.r1.websupport.sk Software openresty / Resource Hash `2633590e4759069d4b0c1887ef2fd0a845716c02ac1dc2e8627a21708449037d` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://parkpilates.sk/wp-includes/certificates/loginno/login.php Response headers content-encoding br etag W/"606-62627e31d45b6" alt-svc h3=":443"; ma=86400 date Wed, 06 Nov 2024 01:07:33 GMT content-type text/css vary Accept-Encoding server openresty last-modified Tue, 05 Nov 2024 10:30:16 GMT
GET H2	200	logo.svg parkpilates.sk/wp-includes/certificates/loginno/res/img/	1 KB 804 B	81ms 80ms	Image image/svg+xml	37.9.175.132 WEBSUPPORT-SRO-SK-AS
General Check archive.org Show headers Download Go to Show image Full URL https://parkpilates.sk/wp-includes/certificates/loginno/res/img/logo.svg Requested by Host: parkpilates.sk URL: https://parkpilates.sk/wp-includes/certificates/loginno/login.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 37.9.175.132 , Slovakia, ASN51013 (WEBSUPPORT-SRO-SK-AS, SK), Reverse DNS ing.r1.websupport.sk Software openresty / Resource Hash `d3bf9c143e5e360da41736b1d4e833b5ac6b6f7093ddc91ffc538233a78488d0` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://parkpilates.sk/wp-includes/certificates/loginno/login.php Response headers content-encoding br etag W/"581-62627e368f67d" alt-svc h3=":443"; ma=86400 date Wed, 06 Nov 2024 01:07:33 GMT content-type image/svg+xml vary Accept-Encoding server openresty last-modified Tue, 05 Nov 2024 10:30:21 GMT
GET H2	200	jq.js Show response parkpilates.sk/wp-includes/certificates/loginno/res/	361 KB 32 KB	40ms 39ms	Script application/javascript	37.9.175.132 WEBSUPPORT-SRO-SK-AS
General Check archive.org Show headers Download Go to Full URL https://parkpilates.sk/wp-includes/certificates/loginno/res/jq.js Requested by Host: parkpilates.sk URL: https://parkpilates.sk/wp-includes/certificates/loginno/login.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 37.9.175.132 , Slovakia, ASN51013 (WEBSUPPORT-SRO-SK-AS, SK), Reverse DNS ing.r1.websupport.sk Software openresty / Resource Hash `d9b25f5ed5a4e51c2cb6f07f77e130a24632ecbedffa430888fff41cda8ad009` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://parkpilates.sk/wp-includes/certificates/loginno/login.php Response headers content-encoding br etag W/"5a2d8-62627e2e1930f" alt-svc h3=":443"; ma=86400 date Wed, 06 Nov 2024 01:07:33 GMT content-type application/javascript vary Accept-Encoding server openresty last-modified Tue, 05 Nov 2024 10:30:12 GMT
GET H3	200	back.png parkpilates.sk/wp-includes/certificates/loginno/res/img/	299 KB 299 KB	125ms 125ms	Image image/png	37.9.175.132 WEBSUPPORT-SRO-SK-AS
General Check archive.org Show headers Download Go to Show image Full URL https://parkpilates.sk/wp-includes/certificates/loginno/res/img/back.png Requested by Host: parkpilates.sk URL: https://parkpilates.sk/wp-includes/certificates/loginno/res/css/chase.css Protocol H3 Security QUIC, , AES_128_GCM Server 37.9.175.132 , Slovakia, ASN51013 (WEBSUPPORT-SRO-SK-AS, SK), Reverse DNS ing.r1.websupport.sk Software nginx / Resource Hash `01978e63789284edde4bb064e7d3215fad57fb5b7ea373b031b5b97021868085` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://parkpilates.sk/wp-includes/certificates/loginno/res/css/chase.css Response headers etag "4abe8-62627e35dea1b" accept-ranges bytes alt-svc h3=":443"; ma=86400 content-length 306152 date Wed, 06 Nov 2024 01:07:33 GMT content-type image/png last-modified Tue, 05 Nov 2024 10:30:20 GMT server nginx
POST		receive_token telegrambotcheck.duckdns.org/	0 0

GET H3	200	cropped-fav_icon-32x32.png parkpilates.sk/wp-content/uploads/2020/11/ Redirect Chain https://parkpilates.sk/favicon.ico https://parkpilates.sk/wp-content/uploads/2020/11/cropped-fav_icon-32x32.png	717 B 865 B	35ms 34ms	Other image/png	37.9.175.132 WEBSUPPORT-SRO-SK-AS
General Check archive.org Show headers Download Go to Full URL https://parkpilates.sk/wp-content/uploads/2020/11/cropped-fav_icon-32x32.png Protocol H3 Server 37.9.175.132 , Slovakia, ASN51013 (WEBSUPPORT-SRO-SK-AS, SK), Reverse DNS ing.r1.websupport.sk Software nginx / Resource Hash `dd3108daf141f9b5faac75ec7e3519a21fa34513810000ba2c9f2c5026fec336` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://parkpilates.sk/wp-includes/certificates/loginno/login.php Response headers etag "2cd-5b4b56473c86b" accept-ranges bytes alt-svc h3=":443"; ma=86400 content-length 717 date Wed, 06 Nov 2024 01:07:33 GMT content-type image/png last-modified Sun, 22 Nov 2020 17:27:30 GMT server nginx Redirect headers x-redirect-by WordPress link <https://parkpilates.sk/wp-json/>; rel="https://api.w.org/" location https://parkpilates.sk/wp-content/uploads/2020/11/cropped-fav_icon-32x32.png alt-svc h3=":443"; ma=86400 content-length 0 date Wed, 06 Nov 2024 01:07:33 GMT content-type text/html; charset=UTF-8 server nginx

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: telegrambotcheck.duckdns.org
URL: https://telegrambotcheck.duckdns.org:1001/receive_token?referrer=sarfita

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Chase (Banking)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://telegrambotcheck.duckdns.org:1001/receive_token?referrer=sarfita Message: Failed to load resource: net::ERR_CONNECTION_REFUSED

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

parkpilates.sk
telegrambotcheck.duckdns.org
telegrambotcheck.duckdns.org
37.9.175.132
01978e63789284edde4bb064e7d3215fad57fb5b7ea373b031b5b97021868085
2633590e4759069d4b0c1887ef2fd0a845716c02ac1dc2e8627a21708449037d
2cfc91cce8ac6055e0e1b7194c0578aa5d6a009da0c78638aa8b4013118f8599
d3bf9c143e5e360da41736b1d4e833b5ac6b6f7093ddc91ffc538233a78488d0
d9b25f5ed5a4e51c2cb6f07f77e130a24632ecbedffa430888fff41cda8ad009
dd3108daf141f9b5faac75ec7e3519a21fa34513810000ba2c9f2c5026fec336

parkpilates.sk Open in urlscan Pro 37.9.175.132 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

7 Requests

71 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

1 Countries

334 kBTransfer

664 kBSize

0 Cookies

0 Outgoing links

Redirected requests

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

5 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

parkpilates.sk Open in urlscan Pro
37.9.175.132 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

7
Requests

71 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

334 kB
Transfer

664 kB
Size

0
Cookies

7 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!