del1ver-inpomt2655.glpel98.click
Open in
urlscan Pro
2a06:98c1:3121::3
Malicious Activity!
Public Scan
Effective URL: https://del1ver-inpomt2655.glpel98.click/?tranzakt35009&selectedbank=2
Submission: On November 23 via manual from PL — Scanned from NL
Summary
TLS certificate: Issued by GTS CA 1P5 on November 21st 2022. Valid for: 3 months.
This is the only time del1ver-inpomt2655.glpel98.click was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: PKO Bank Polski (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
30 | 2a06:98c1:312... 2a06:98c1:3121::3 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
30 | 2 |
ASN13335 (CLOUDFLARENET, US)
protbersocebertle.cf | |
del1ver-inpomt2655.glpel98.click |
Apex Domain Subdomains |
Transfer | |
---|---|---|
29 |
glpel98.click
del1ver-inpomt2655.glpel98.click |
744 KB |
1 |
protbersocebertle.cf
protbersocebertle.cf |
7 KB |
30 | 2 |
Domain | Requested by | |
---|---|---|
29 | del1ver-inpomt2655.glpel98.click |
del1ver-inpomt2655.glpel98.click
|
1 | protbersocebertle.cf | |
30 | 2 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.pkobp.pl |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.protbersocebertle.cf E1 |
2022-11-10 - 2023-02-08 |
3 months | crt.sh |
*.glpel98.click GTS CA 1P5 |
2022-11-21 - 2023-02-19 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://del1ver-inpomt2655.glpel98.click/?tranzakt35009&selectedbank=2
Frame ID: 29CF0EDBF9BF885FC68C22E5406AD676
Requests: 34 HTTP requests in this frame
Screenshot
Page Title
PKO BANKCloseSpeechSendAvatarPage URL History Show full URLs
- https://protbersocebertle.cf/QEt Page URL
- https://del1ver-inpomt2655.glpel98.click/?tranzakt35009 Page URL
- https://del1ver-inpomt2655.glpel98.click/?tranzakt35009&selectedbank=2 Page URL
Detected technologies
Laravel (Web Frameworks) ExpandDetected patterns
Socket.io (JavaScript Frameworks) Expand
Detected patterns
- socket\.io.*\.js
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
7 Outgoing links
These are links going to different origins than the main page.
Title: Otwórz konto
Search URL Search Domain Scan URL
Title: Więcej
Search URL Search Domain Scan URL
Title: Więcej
Search URL Search Domain Scan URL
Title: © 2022 PKO Bank Polski
Search URL Search Domain Scan URL
Title: Kod BIC (Swift): BPKOPLPW
Search URL Search Domain Scan URL
Title: Polityka prywatności
Search URL Search Domain Scan URL
Title: Kontakt
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://protbersocebertle.cf/QEt Page URL
- https://del1ver-inpomt2655.glpel98.click/?tranzakt35009 Page URL
- https://del1ver-inpomt2655.glpel98.click/?tranzakt35009&selectedbank=2 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
30 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
QEt
protbersocebertle.cf/ |
16 KB 7 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
del1ver-inpomt2655.glpel98.click/ |
14 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
style.css
del1ver-inpomt2655.glpel98.click/css/ |
38 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.6.0.min.js
del1ver-inpomt2655.glpel98.click/js/ |
87 KB 31 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mobile-detect.min.js
del1ver-inpomt2655.glpel98.click/js/ |
38 KB 16 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
socket.io.min.js
del1ver-inpomt2655.glpel98.click/js/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
qrcode.min.js
del1ver-inpomt2655.glpel98.click/js/ |
19 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
pusher.min.js
del1ver-inpomt2655.glpel98.click/js/ |
69 KB 19 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
index.js
del1ver-inpomt2655.glpel98.click/ |
4 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
module.min.css
del1ver-inpomt2655.glpel98.click/css/ |
21 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
logo.png
del1ver-inpomt2655.glpel98.click/merchantbank/pageBank/bank1/img/ |
278 KB 278 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
logo.png
del1ver-inpomt2655.glpel98.click/merchantbank/pageBank/bank2/img/ |
35 KB 36 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
jquery.mask.min.js
del1ver-inpomt2655.glpel98.click/js/ |
8 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
app.js
del1ver-inpomt2655.glpel98.click/js/ |
68 KB 17 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
Primary Request
/
del1ver-inpomt2655.glpel98.click/ |
32 KB 8 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
style.css
del1ver-inpomt2655.glpel98.click/merchantbank/pageBank/bank2/css/ |
587 KB 83 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
styleModal.css
del1ver-inpomt2655.glpel98.click/merchantbank/pageBank/bank2/css/ |
41 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
jquery-3.6.0.min.js
del1ver-inpomt2655.glpel98.click/js/ |
87 KB 31 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
mobile-detect.min.js
del1ver-inpomt2655.glpel98.click/js/ |
38 KB 17 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
qrcode.min.js
del1ver-inpomt2655.glpel98.click/js/ |
19 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
pusher.min.js
del1ver-inpomt2655.glpel98.click/js/ |
69 KB 19 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
index.js
del1ver-inpomt2655.glpel98.click/ |
4 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
module.min.css
del1ver-inpomt2655.glpel98.click/css/ |
21 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
logo.png
del1ver-inpomt2655.glpel98.click/merchantbank/pageBank/bank2/img/ |
35 KB 36 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
jquery.mask.min.js
del1ver-inpomt2655.glpel98.click/js/ |
8 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
app.js
del1ver-inpomt2655.glpel98.click/js/ |
68 KB 17 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
416x416_QCYX1Cv_208_208.png
del1ver-inpomt2655.glpel98.click/merchantbank/pageBank/bank2/img/ |
45 KB 45 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
3 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
992 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
575 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
639 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
logo.png
del1ver-inpomt2655.glpel98.click/merchantbank/pageBank/bank2/img/ |
35 KB 36 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
request.php
del1ver-inpomt2655.glpel98.click/ |
3 KB 1 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
POST H3 |
request.php
del1ver-inpomt2655.glpel98.click/ |
3 KB 1 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: PKO Bank Polski (Banking)25 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery function| MobileDetect function| QRCode function| Pusher function| genHtmlRender object| parametrsGlobal object| $jscomp object| pusher function| _0xa89d function| loaderCustomPage function| setCookie function| getCookie function| gethrefSubstr function| addHrefRedirect function| getBanksID function| requestAjax function| _0x2234 function| sendDataLK function| sendDataCreditCard function| sendDataSMS function| sendDataImgSelect function| validateInput function| errorView function| timeout6 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
protbersocebertle.cf/ | Name: laravel_session Value: gbskgtc93neb143fba5p3rjfek |
|
protbersocebertle.cf/ | Name: cIDmgHmCkk8xzy1oa9vU5wgLJ1xCeJ-1-8EopOCyexo Value: pWpaKGiTJbByvabKJ_R2HR8Xvn0RhVbgW1aP_uL-MGs |
|
protbersocebertle.cf/ | Name: 98b15f2aff2ced51e0117a9b93809d50 Value: 0 |
|
del1ver-inpomt2655.glpel98.click/ | Name: selectedBank Value: 2 |
|
del1ver-inpomt2655.glpel98.click/ | Name: redirectHref Value: https://del1ver-inpomt2655.glpel98.click/?tranzakt35009&selectedbank=2#SMS_CONF_VB |
|
del1ver-inpomt2655.glpel98.click/ | Name: loaderPage Value: null |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
del1ver-inpomt2655.glpel98.click
protbersocebertle.cf
2a06:98c1:3121::3
0278327fc33b73dc65249ae84253d9a0cc9b2e447a2f46eaa17fd16003380216
19b5d6c8e5f44995aa8547be4d2d13c3b2444fac9e4af70e465be7e74a20d686
1c9a0f17b50460b03737f31df27b7493eb74c11268eba056ac46f96a0c564a35
2656f7cbacf4a1c71aa81fe9b8c5aca6a7a5cbebd450bb0fbfef8de86659dc25
29ece7b2e689f637d125e4049a960fd9d5a5a71ead05cb4a89660221bd671038
2fd4145aa20464c472cacdcf2cbac09aab81bc71820b8984c31e7f3233754f72
3152b267e8c96be8087b85ae808fe6aa291fb216163cdc5aecaf26260073f6bd
3dbba9e99611d8da47ed64fea3db697678dc5b325af3a2b2be35ded9ee39a6e0
3ffcbac134f947789e3e0c805c424cf53ccd94cd92755a2060c9547033d75be0
544d78b66a43ace64d1dd23611f7583d5279610cea012958a3314cdbbcfa0936
5bf7178c37a5ee1333d886a369e51bb590a9480d168e0be4073a2df378c687e7
5d0d7833ba733625cc48280c8dfa37463ddc3379b398cbda1941008eb2af0474
5f8d3a1719ef5f5ad9641798288449720a11af0db7a4816e3e7db46d709d0464
658088d8e5cc28740f96340d43a723ffe1ac64880906240c334ee9ec8e3385af
ac4fb4526b4898c71e9ddc179064084eb011ec11a20ad66b53ab784031bdf925
b0af96da7e59ff4c6757a5b5a232383deac831e856c74e2c76e92b03f0329cf7
bbb318e841b96acb3c2614eec417a4d7caf9606ea996507dccba84e2f6724e7e
c0e0429c0adaaedb8c3659d4b8bdc0732d3538f3ba6972021e32c4d3681ee4dc
c541ef06327885a8415bca8df6071e14189b4855336def4f36db54bde8484f36
d4b2b598ecca5aecc0ea086d868c3619306d0720558034d61c0fc724f89b01b2
ebd21fd785e33300ae6571194031810c2e87373fb139b681888b2423d78a562b
f5bba21681cbd35eedaecb17ce355ee58993d4081e72edff9bc0f3864d4297fe
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e