del1ver-inpomt2655.glpel98.click Open in urlscan Pro
2a06:98c1:3121::3 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://del1ver-inpomt2655.glpel98.click/
Submission: On November 23 via api (November 23rd 2022, 11:15:36 am UTC) from PL — Scanned from NL

Summary HTTP 14 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 14 HTTP transactions. The main IP is 2a06:98c1:3121::3, located in United States and belongs to CLOUDFLARENET, US. The main domain is del1ver-inpomt2655.glpel98.click.
TLS certificate: Issued by GTS CA 1P5 on November 21st 2022. Valid for: 3 months.

This is the only time del1ver-inpomt2655.glpel98.click was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: PKO Bank Polski (Banking)

Domain & IP information

	IP Address		AS Autonomous System
14	2a06:98c1:312... 2a06:98c1:3121::3		13335 (CLOUDFLAR...) (CLOUDFLARENET)
14	1

14 2a06:98c1:3121::3 (United States)

ASN13335 (CLOUDFLARENET, US)

del1ver-inpomt2655.glpel98.click	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
14	glpel98.click del1ver-inpomt2655.glpel98.click	426 KB
14	1

	Domain	Requested by
14	del1ver-inpomt2655.glpel98.click	del1ver-inpomt2655.glpel98.click
14	1

This site contains no links.

Subject Issuer	Validity	Valid
*.glpel98.click GTS CA 1P5	`2022-11-21` - `2023-02-19`	3 months	crt.sh

This page contains 1 frames:

Frame: https://del1ver-inpomt2655.glpel98.click/?tranzakt&selectedbank=u
Frame ID: AA7201F57B2F875C454EC47F207EFA75
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Socket.io (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

socket\.io.*\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

14
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

426 kB
Transfer

680 kB
Size

3
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response del1ver-inpomt2655.glpel98.click/	14 KB 5 KB	344ms 123ms	Document text/html	2a06:98c1:3121::3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://del1ver-inpomt2655.glpel98.click/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/7.4.33 Resource Hash `30ce6853454a35ce5d6167ae610766b731e21d71634830dd35cc9371ae390697` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36 accept-language nl-NL,nl;q=0.9 Response headers alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 76e97cca8e56b968-AMS content-encoding gzip content-type text/html; charset=UTF-8 date Wed, 23 Nov 2022 11:15:31 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=paBnmJVO5JyHTvlKf78HcFYtLvP0eUgY4EaI1FMj4WAIOTyIniuL5zSBW5hOlJfzHZfdHJU4PDcIbDfzaHnjcxk4f%2FgZR5i8e40CtTC6ljkpRh7ixR3Ipp11607c8M%2FMlea2n0iQ4ceUHcCid0LMChHKFYDTp8%2FH85PPzSGX1w%3D%3D"}],"group":"cf-nel","max_age":604800} server cloudflare x-powered-by PHP/7.4.33
GET H2	200	style.css del1ver-inpomt2655.glpel98.click/css/	38 KB 6 KB	161ms 157ms	Stylesheet text/css	2a06:98c1:3121::3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://del1ver-inpomt2655.glpel98.click/css/style.css Requested by Host: del1ver-inpomt2655.glpel98.click URL: https://del1ver-inpomt2655.glpel98.click/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `1c9a0f17b50460b03737f31df27b7493eb74c11268eba056ac46f96a0c564a35` Request headers accept-language nl-NL,nl;q=0.9 Referer https://del1ver-inpomt2655.glpel98.click/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36 Response headers date Wed, 23 Nov 2022 11:15:31 GMT content-encoding gzip cf-cache-status MISS last-modified Tue, 22 Nov 2022 08:12:02 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag W/"637c8452-984d" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=a3UxNl6E%2FTbX6yiM70amQYV0C9X%2FbILCAd7I0vZ8%2BoyPwQ3%2B9d9Lt1wIlCnbDQiiND0Kzs2jYAUn0iH0ahLd1RDTLd3GDKNd2j%2FA%2BXtuTdaP6%2FWUOO2zG9Kp%2F5C%2FxbCI56d7qzIodlq8D7072LTgjeW3C0t42wPnXSO2cMVVkg%3D%3D"}],"group":"cf-nel","max_age":604800} content-type text/css cache-control max-age=14400 cf-ray 76e97ccb5f46b968-AMS alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H2	200	jquery-3.6.0.min.js Show response del1ver-inpomt2655.glpel98.click/js/	87 KB 31 KB	199ms 196ms	Script application/javascript	2a06:98c1:3121::3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://del1ver-inpomt2655.glpel98.click/js/jquery-3.6.0.min.js Requested by Host: del1ver-inpomt2655.glpel98.click URL: https://del1ver-inpomt2655.glpel98.click/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e` Request headers accept-language nl-NL,nl;q=0.9 Referer https://del1ver-inpomt2655.glpel98.click/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36 Response headers date Wed, 23 Nov 2022 11:15:31 GMT content-encoding gzip cf-cache-status MISS last-modified Tue, 22 Nov 2022 08:12:02 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag W/"637c8452-15d9d" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ejT2HByiq7pubDMVp%2FEcklWMBSIbTzYmDEa1gTcPZoGIxHX5JZgDhHaSyyX91EimCSRTWTXf7rlZZJMKvYNL5G9NE6sz9140TWBsCX2SZqm%2Fge32ZlUP%2FMZ4DdqY%2FGTtzw%2FK80ze6fUNC%2F%2B41h1JthbE%2FejVM7VmwMpyVDZDhA%3D%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=UTF-8 cache-control max-age=14400 cf-ray 76e97ccb5f4ab968-AMS alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H2	200	mobile-detect.min.js Show response del1ver-inpomt2655.glpel98.click/js/	38 KB 16 KB	168ms 164ms	Script application/javascript	2a06:98c1:3121::3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://del1ver-inpomt2655.glpel98.click/js/mobile-detect.min.js Requested by Host: del1ver-inpomt2655.glpel98.click URL: https://del1ver-inpomt2655.glpel98.click/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `ebd21fd785e33300ae6571194031810c2e87373fb139b681888b2423d78a562b` Request headers accept-language nl-NL,nl;q=0.9 Referer https://del1ver-inpomt2655.glpel98.click/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36 Response headers date Wed, 23 Nov 2022 11:15:31 GMT content-encoding gzip cf-cache-status MISS last-modified Tue, 22 Nov 2022 08:12:02 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag W/"637c8452-981e" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Gd5jdpvSWjLeB1XD6y52rACUg9hO2xWxu8baS21gRjTIbRKVFo88nRO5%2FrZdUQJT3LDSA%2BEV5f6EOCipVr%2F7kTBumGiC3KaWYgc1XqLkOW43o2FFuQVjLjP6fyafHuuvUUaSe3ZjW5CxgIMnLFipO5ttHeka9j5Mg09Z56ymfQ%3D%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=UTF-8 cache-control max-age=14400 cf-ray 76e97ccb5f4db968-AMS alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H2	404	socket.io.min.js del1ver-inpomt2655.glpel98.click/js/	0 0	123ms 121ms	Script text/html	2a06:98c1:3121::3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://del1ver-inpomt2655.glpel98.click/js/socket.io.min.js Requested by Host: del1ver-inpomt2655.glpel98.click URL: https://del1ver-inpomt2655.glpel98.click/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers accept-language nl-NL,nl;q=0.9 Referer https://del1ver-inpomt2655.glpel98.click/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36 Response headers date Wed, 23 Nov 2022 11:15:31 GMT content-encoding gzip cf-cache-status MISS nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cDdECzoi5zMNHXLs1KYj%2BGYyyPEu5wLfAGsb3tSVpYP6zqLj4kdncOyPWLx2sde6hqBW2tliYaj%2BPIkgstHxFV3%2BXny6fj5AU3RLFnPrplr%2BQW5nRReW4ECsavcUPWvfeCkM2vmYyLyG2PdWn5vkXkCMm9%2BabIuthwkv9dyrvw%3D%3D"}],"group":"cf-nel","max_age":604800} content-type text/html; charset=iso-8859-1 cache-control max-age=14400 cf-ray 76e97ccb5f4eb968-AMS alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H2	200	qrcode.min.js Show response del1ver-inpomt2655.glpel98.click/js/	19 KB 7 KB	159ms 158ms	Script application/javascript	2a06:98c1:3121::3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://del1ver-inpomt2655.glpel98.click/js/qrcode.min.js Requested by Host: del1ver-inpomt2655.glpel98.click URL: https://del1ver-inpomt2655.glpel98.click/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `c541ef06327885a8415bca8df6071e14189b4855336def4f36db54bde8484f36` Request headers accept-language nl-NL,nl;q=0.9 Referer https://del1ver-inpomt2655.glpel98.click/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36 Response headers date Wed, 23 Nov 2022 11:15:31 GMT content-encoding gzip cf-cache-status MISS last-modified Tue, 22 Nov 2022 08:12:02 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag W/"637c8452-4dd7" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oEEwRUekkKUWtnvM20OiYbt70UE8P4TFwTRIxZAR%2F2MNKQcqywRBUhXmSk78%2BNFxA%2FmYWIUT2OWxj4OdnG%2FGzJgQsb7luzQj8%2BNrz%2BAbaplA0aLcloigAeC%2FBbzGZIo7K50u1TzPoyz1cJ3DxxbethUDFjqSYdGzYik2MK4DvA%3D%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=UTF-8 cache-control max-age=14400 cf-ray 76e97ccb5f4fb968-AMS alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H2	200	pusher.min.js Show response del1ver-inpomt2655.glpel98.click/js/	69 KB 19 KB	204ms 202ms	Script application/javascript	2a06:98c1:3121::3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://del1ver-inpomt2655.glpel98.click/js/pusher.min.js Requested by Host: del1ver-inpomt2655.glpel98.click URL: https://del1ver-inpomt2655.glpel98.click/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `2656f7cbacf4a1c71aa81fe9b8c5aca6a7a5cbebd450bb0fbfef8de86659dc25` Request headers accept-language nl-NL,nl;q=0.9 Referer https://del1ver-inpomt2655.glpel98.click/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36 Response headers date Wed, 23 Nov 2022 11:15:31 GMT content-encoding gzip cf-cache-status MISS last-modified Tue, 22 Nov 2022 08:12:02 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag W/"637c8452-112d3" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=R4aQxSkq46giiWv6EtPfpCHxvGoqGyLFke0LnG69cNWWREuDP7IMQUihfBGp9jN%2FBcOefBEEgNCaCAHXNgL933%2Fsb405hqGIudlaSa5%2Fu4bE7qr5R8XnM9y12KYihC0xtCn6HNaBHO3pPN%2FGlJ0gCMRI8v6AgSmB2ppca1Srmg%3D%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=UTF-8 cache-control max-age=14400 cf-ray 76e97ccb5f50b968-AMS alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H2	200	index.js Show response del1ver-inpomt2655.glpel98.click/	4 KB 2 KB	119ms 118ms	Script application/javascript	2a06:98c1:3121::3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://del1ver-inpomt2655.glpel98.click/index.js Requested by Host: del1ver-inpomt2655.glpel98.click URL: https://del1ver-inpomt2655.glpel98.click/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `b0af96da7e59ff4c6757a5b5a232383deac831e856c74e2c76e92b03f0329cf7` Request headers accept-language nl-NL,nl;q=0.9 Referer https://del1ver-inpomt2655.glpel98.click/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36 Response headers date Wed, 23 Nov 2022 11:15:31 GMT content-encoding gzip cf-cache-status MISS last-modified Tue, 22 Nov 2022 08:12:04 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag W/"637c8454-11ae" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FiiCisgJIvKaZtIAyBg3YPMg67r0NgARd2QD3BHXQiGCbCZzSbETSI%2F1NIjdqZyAtQLa2awiRoETYuPQMZcM6g4ISC9KAgW4a5M65oE7yBtBuQMWx6cHLe42OqkU4sp9YMhPwEZd63wPikcTssywSILCMwDkwiGjfsNlSB%2FKzA%3D%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=UTF-8 cache-control max-age=14400 cf-ray 76e97ccb5f52b968-AMS alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H2	200	module.min.css del1ver-inpomt2655.glpel98.click/css/	21 KB 5 KB	156ms 155ms	Stylesheet text/css	2a06:98c1:3121::3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://del1ver-inpomt2655.glpel98.click/css/module.min.css Requested by Host: del1ver-inpomt2655.glpel98.click URL: https://del1ver-inpomt2655.glpel98.click/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `2fd4145aa20464c472cacdcf2cbac09aab81bc71820b8984c31e7f3233754f72` Request headers accept-language nl-NL,nl;q=0.9 Referer https://del1ver-inpomt2655.glpel98.click/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36 Response headers date Wed, 23 Nov 2022 11:15:31 GMT content-encoding gzip cf-cache-status MISS last-modified Tue, 22 Nov 2022 08:12:02 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag W/"637c8452-53ce" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sy37xj5FLpOZ0k1KUZ1l7nHr94m3rT%2FbYqC86MWZWiHKUpRiex%2BtlVV5E9b9IQmYRo5B1lKTM1GdwvHJMtZPFVdpUaXAtPMf3pK5tXV7SCyg1LwDo3%2FYnYbVY%2FeuHupXYzbMlfltsJ%2BdfH6VFVicY78pncxykb4cHIrb7U81Ww%3D%3D"}],"group":"cf-nel","max_age":604800} content-type text/css cache-control max-age=14400 cf-ray 76e97ccb5f49b968-AMS alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H3	200	logo.png del1ver-inpomt2655.glpel98.click/merchantbank/pageBank/bank1/img/	278 KB 278 KB	205ms 204ms	Image image/png	2a06:98c1:3121::3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://del1ver-inpomt2655.glpel98.click/merchantbank/pageBank/bank1/img/logo.png Requested by Host: del1ver-inpomt2655.glpel98.click URL: https://del1ver-inpomt2655.glpel98.click/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `c0e0429c0adaaedb8c3659d4b8bdc0732d3538f3ba6972021e32c4d3681ee4dc` Request headers accept-language nl-NL,nl;q=0.9 Referer https://del1ver-inpomt2655.glpel98.click/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36 Response headers date Wed, 23 Nov 2022 11:15:32 GMT cf-cache-status MISS last-modified Tue, 22 Nov 2022 08:12:02 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag "637c8452-4575c" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kodH4ZzXSV4Tbk0d5Q7G5wp6CZBTTqF1sMjRVPpvXcRPGkbLIPhkjCKO2Z1kiAlkTsfUkoQfM4%2F605v%2BQfSFQk%2FNgqq4ShyH4AuhUG8t9u8tHbH06syYyB5onfJA3wsDyxBNKsKnfOmfdk9VGS1AjQuWXE8mdr22%2BUq77ZnHeg%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control max-age=14400 accept-ranges bytes cf-ray 76e97cccba28b813-AMS alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 284508
GET H3	200	logo.png del1ver-inpomt2655.glpel98.click/merchantbank/pageBank/bank2/img/	35 KB 36 KB	156ms 155ms	Image image/png	2a06:98c1:3121::3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://del1ver-inpomt2655.glpel98.click/merchantbank/pageBank/bank2/img/logo.png Requested by Host: del1ver-inpomt2655.glpel98.click URL: https://del1ver-inpomt2655.glpel98.click/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `3dbba9e99611d8da47ed64fea3db697678dc5b325af3a2b2be35ded9ee39a6e0` Request headers accept-language nl-NL,nl;q=0.9 Referer https://del1ver-inpomt2655.glpel98.click/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36 Response headers date Wed, 23 Nov 2022 11:15:32 GMT cf-cache-status MISS last-modified Tue, 22 Nov 2022 08:12:03 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag "637c8453-8dd1" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pNxygiRHRtEUdeyjnwQdH1kNPef%2B87SbgrGmHwIxy7shDaHzD3xgIFYKPc4ZGYcinCVlLE3PLGpDDdvZnsOKYGME3vaPvJATJHJyQvT18o7H8uBh3PRU1xTUBQT9p22s7BCK%2FS5UFD3SWChLcdlrgXsFJRGJLpGNWtdWteZ1eA%3D%3D"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control max-age=14400 accept-ranges bytes cf-ray 76e97cccba2ab813-AMS alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 36305
GET H3	200	jquery.mask.min.js Show response del1ver-inpomt2655.glpel98.click/js/	8 KB 4 KB	117ms 117ms	Script application/javascript	2a06:98c1:3121::3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://del1ver-inpomt2655.glpel98.click/js/jquery.mask.min.js Requested by Host: del1ver-inpomt2655.glpel98.click URL: https://del1ver-inpomt2655.glpel98.click/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `bbb318e841b96acb3c2614eec417a4d7caf9606ea996507dccba84e2f6724e7e` Request headers accept-language nl-NL,nl;q=0.9 Referer https://del1ver-inpomt2655.glpel98.click/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36 Response headers date Wed, 23 Nov 2022 11:15:32 GMT content-encoding gzip cf-cache-status MISS last-modified Tue, 22 Nov 2022 08:12:02 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag W/"637c8452-1ff9" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CCDjjLVgLVapWom2VeQLAjvYG7ZTjLot7QAAafvlvKMC1pXmkqVS86r%2FYuLMmM6y64lkRDKO9USWidR%2BJkLtDS9%2BYkk4xu3y%2FlF8%2FsDaN4qVFjJUbSSjFpiPb0KVkw2esv32C57zZ%2B%2B8jlXbe9Oua56mkt8EBvTChwt1el1JIQ%3D%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=UTF-8 cache-control max-age=14400 cf-ray 76e97cccaa10b813-AMS alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H3	200	app.js Show response del1ver-inpomt2655.glpel98.click/js/	68 KB 17 KB	207ms 207ms	Script application/javascript	2a06:98c1:3121::3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://del1ver-inpomt2655.glpel98.click/js/app.js?version=1669202131 Requested by Host: del1ver-inpomt2655.glpel98.click URL: https://del1ver-inpomt2655.glpel98.click/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `3152b267e8c96be8087b85ae808fe6aa291fb216163cdc5aecaf26260073f6bd` Request headers accept-language nl-NL,nl;q=0.9 Referer https://del1ver-inpomt2655.glpel98.click/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36 Response headers date Wed, 23 Nov 2022 11:15:32 GMT content-encoding gzip cf-cache-status MISS last-modified Tue, 22 Nov 2022 08:12:02 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare etag W/"637c8452-10f6c" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yIWQ9C6WDbenjDQZSEW%2BskTuOQD81oJveUw9ewuiHtjrpSTswGoCCNET564HiJAtG9DadraHEFjFAoCvg1q8BH9w4wkAkZSuTc7ZQW2alRixs%2Frvu1AlMNyTlf0yfXRsfHMJmJz7WvPZaTQ2AMutfalx%2FiTzIL%2FQUbmGIfWHMA%3D%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=UTF-8 cache-control max-age=14400 cf-ray 76e97cccba21b813-AMS alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400
GET H3	200	/ Show response del1ver-inpomt2655.glpel98.click/	0 495 B	135ms 135ms	Document text/html	2a06:98c1:3121::3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://del1ver-inpomt2655.glpel98.click/?tranzakt&selectedbank=u Requested by Host: del1ver-inpomt2655.glpel98.click URL: https://del1ver-inpomt2655.glpel98.click/js/app.js?version=1669202131 Protocol H3 Security QUIC, , AES_128_GCM Server 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / PHP/7.4.33 Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Referer https://del1ver-inpomt2655.glpel98.click/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36 accept-language nl-NL,nl;q=0.9 Response headers alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 76e97ccf2bdab813-AMS content-encoding gzip content-type text/html; charset=UTF-8 date Wed, 23 Nov 2022 11:15:32 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EiSn0vferUpQdTJLanC3N6iF5%2F2KqCe5Byn1mnbYJA6bdmwin4bQjW8wJzUkfy3Pgz%2BaP7wNe1fv3B%2F%2B876x3Tubb57cInJFaLOMzhA3FIyC%2FW9QPIfRnT8PcC1XZ9gh0UpBt4ISb1fR9aExKbp%2FQ6%2Brreg3GiWgxSe01oaj9g%3D%3D"}],"group":"cf-nel","max_age":604800} server cloudflare x-powered-by PHP/7.4.33

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: PKO Bank Polski (Banking)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
del1ver-inpomt2655.glpel98.click/	1969-12-31 23:59:59	Name: selectedBank Value: u
del1ver-inpomt2655.glpel98.click/	1969-12-31 23:59:59	Name: otherdata Value: l
del1ver-inpomt2655.glpel98.click/	1969-12-31 23:59:59	Name: redirectHref Value: ?tranzakt&selectedbank=u#n

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://del1ver-inpomt2655.glpel98.click/js/socket.io.min.js Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

del1ver-inpomt2655.glpel98.click
2a06:98c1:3121::3
1c9a0f17b50460b03737f31df27b7493eb74c11268eba056ac46f96a0c564a35
2656f7cbacf4a1c71aa81fe9b8c5aca6a7a5cbebd450bb0fbfef8de86659dc25
2fd4145aa20464c472cacdcf2cbac09aab81bc71820b8984c31e7f3233754f72
30ce6853454a35ce5d6167ae610766b731e21d71634830dd35cc9371ae390697
3152b267e8c96be8087b85ae808fe6aa291fb216163cdc5aecaf26260073f6bd
3dbba9e99611d8da47ed64fea3db697678dc5b325af3a2b2be35ded9ee39a6e0
b0af96da7e59ff4c6757a5b5a232383deac831e856c74e2c76e92b03f0329cf7
bbb318e841b96acb3c2614eec417a4d7caf9606ea996507dccba84e2f6724e7e
c0e0429c0adaaedb8c3659d4b8bdc0732d3538f3ba6972021e32c4d3681ee4dc
c541ef06327885a8415bca8df6071e14189b4855336def4f36db54bde8484f36
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ebd21fd785e33300ae6571194031810c2e87373fb139b681888b2423d78a562b
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

del1ver-inpomt2655.glpel98.click Open in urlscan Pro 2a06:98c1:3121::3 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

14 Requests

100 %HTTPS

100 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

426 kBTransfer

680 kBSize

3 Cookies

0 Outgoing links

Redirected requests

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

3 Cookies

1 Console Messages

Indicators

del1ver-inpomt2655.glpel98.click Open in urlscan Pro
2a06:98c1:3121::3 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

14
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

426 kB
Transfer

680 kB
Size

3
Cookies

14 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!