www.itincorpora.com
Open in
urlscan Pro
178.238.224.11
Malicious Activity!
Public Scan
URL:
https://www.itincorpora.com/ipko/index.html
Submission: On July 27 via api from PL — Scanned from PL
Submission: On July 27 via api from PL — Scanned from PL
Summary
This website contacted 4 IPs
in 2 countries
across 4 domains to perform 18 HTTP transactions.
The main IP is 178.238.224.11, located in
Germany and
belongs to CONTABO, DE.
The main domain is www.itincorpora.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on May 22nd 2024. Valid for: 3 months.
This is the only time www.itincorpora.com was scanned on urlscan.io!
TLS certificate: Issued by cPanel, Inc. Certification Authority on May 22nd 2024. Valid for: 3 months.
This is the only time www.itincorpora.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: PKO Bank Polski (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 13 | 178.238.224.11 178.238.224.11 | 51167 (CONTABO) (CONTABO) | |
| 2 | 193.109.225.70 193.109.225.70 | 21344 (INTELIGO) (INTELIGO) | |
| 2 | 193.109.225.100 193.109.225.100 | 21344 (INTELIGO) (INTELIGO) | |
| 18 | 4 |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 13 |
itincorpora.com
www.itincorpora.com |
2 MB |
| 2 |
pkobp.pl
www.pkobp.pl — Cisco Umbrella Rank: 678103 |
53 KB |
| 2 |
ipko.pl
www.ipko.pl — Cisco Umbrella Rank: 770783 |
24 KB |
| 0 |
telegram.org
Failed
api.telegram.org Failed |
|
| 18 | 4 |
| Domain | Requested by | |
|---|---|---|
| 13 | www.itincorpora.com |
www.itincorpora.com
|
| 2 | www.pkobp.pl |
www.itincorpora.com
|
| 2 | www.ipko.pl |
www.itincorpora.com
|
| 0 | api.telegram.org Failed |
www.itincorpora.com
|
| 18 | 4 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| iko.pkobp.pl |
| www.pkobp.pl |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| itincorpora.com cPanel, Inc. Certification Authority |
2024-05-22 - 2024-08-20 |
3 months | crt.sh |
| ipko.pl Certum Extended Validation CA SHA2 |
2023-08-11 - 2024-08-10 |
a year | crt.sh |
| pkobp.pl Certum Extended Validation CA SHA2 |
2023-12-28 - 2024-12-27 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://www.itincorpora.com/ipko/index.html
Frame ID: B23B580667DEA1625BB5583B51E8E618
Requests: 20 HTTP requests in this frame
Screenshot
Page Title
Strona logowania | iPKO - bankowość elektroniczna PKO Banku PolskiegoPage Statistics
11 Outgoing links
These are links going to different origins than the main page.
URL: http://iko.pkobp.pl/
Title: Open in new tab Pobierz darmową aplikację IKO
Title: Open in new tab Pobierz darmową aplikację IKO
Search URL Search Domain Scan URL
URL: https://www.pkobp.pl/klienci-indywidualni/konta/konta-osobiste/zostan-naszym-klientem/
Title: Open in new tab Nie masz konta?
Title: Open in new tab Nie masz konta?
Search URL Search Domain Scan URL
URL: https://www.pkobp.pl/klient-indywidualny/uslugi-zakupy/karty-podarunkowe
Title: Open in new tab Więcej
Title: Open in new tab Więcej
Search URL Search Domain Scan URL
URL: https://www.pkobp.pl/aktualnosci/bezpieczenstwo/just-imagine-that-electronic-banking-is-like-your-wallet/
Title: Open in new tab Otwórz w nowej karcie Odwiedź stronę banku
Title: Open in new tab Otwórz w nowej karcie Odwiedź stronę banku
Search URL Search Domain Scan URL
URL: https://www.pkobp.pl/aktualnosci/bezpieczenstwo/po-co-mi-powiadomienia-od-banku/
Title: Otwórz w nowej karcie Więcej
Title: Otwórz w nowej karcie Więcej
Search URL Search Domain Scan URL
URL: https://www.pkobp.pl/
Title: Open in new tab © 2023 PKO Bank Polski
Title: Open in new tab © 2023 PKO Bank Polski
Search URL Search Domain Scan URL
URL: https://www.pkobp.pl/klienci-indywidualni/operacje-zagraniczne/bic-swift-i-iban/
Title: Open in new tab BIC Code (Swift): BPKOPLPW
Title: Open in new tab BIC Code (Swift): BPKOPLPW
Search URL Search Domain Scan URL
URL: https://www.pkobp.pl/polityka-prywatnosci/
Title: Open in new tab Polityka prywatności
Title: Open in new tab Polityka prywatności
Search URL Search Domain Scan URL
URL: https://www.pkobp.pl/klienci-indywidualni/bankowosc-elektroniczna/bezpieczenstwo/
Title: Open in new tab Safety
Title: Open in new tab Safety
Search URL Search Domain Scan URL
URL: https://www.pkobp.pl/klienci-indywidualni/bankowosc-elektroniczna/zacznij-korzystac/
Title: Open in new tab Help
Title: Open in new tab Help
Search URL Search Domain Scan URL
URL: https://www.pkobp.pl/klienci-indywidualni/bankowosc-elektroniczna/serwis-telefoniczny/
Title: Open in new tab Kontakt
Title: Open in new tab Kontakt
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
18 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
index.html
www.itincorpora.com/ipko/ |
2 MB 2 MB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
/
www.ipko.pl/nudatasecurity/2.2/w/w-573441/init/js/ |
537 B 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
/
www.ipko.pl/nudatasecurity/2.2/w/w-573441/sync/js/ |
52 KB 23 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
_62247748.svg
www.pkobp.pl/media_files/CiCCh/iPKO/ |
1 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
sendMessage
api.telegram.org/bot7365686424:AAEYEI7fZIiVIkG6sG1GsZr0-CHUEruAT58/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
570-570_1Ea8hwe_208_208.png
www.pkobp.pl/media_files/CiCCh/iPKO/ |
52 KB 52 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
3725.d665aefa1f0ca28e2746.js
www.itincorpora.com/ipko/ |
111 KB 111 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
common.297bc6fcd5611b1b0bce.js
www.itincorpora.com/ipko/ |
2 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
login.969ad21781ae70c71a91.js
www.itincorpora.com/ipko/ |
301 B 555 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
604 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
3 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
PKOBankPolski-Regular.woff
www.itincorpora.com/ipko/ipko/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
PKOBankPolski-Light.woff
www.itincorpora.com/ipko/ipko/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
PKOBankPolski-Bold.woff
www.itincorpora.com/ipko/ipko/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
PKOBankPolski-Regular.ttf
www.itincorpora.com/ipko/ipko/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
PKOBankPolski-Light.ttf
www.itincorpora.com/ipko/ipko/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
PKOBankPolski-Bold.ttf
www.itincorpora.com/ipko/ipko/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
PKOBankPolski-Regular.woff
www.itincorpora.com/ipko/ |
31 KB 31 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
favicon.ico
www.itincorpora.com/ipko/gfx/ |
315 B 515 B |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
aimgs.json
www.itincorpora.com/ikd_scripts/skins/ipko/ |
315 B 515 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- api.telegram.org
- URL
- https://api.telegram.org/bot7365686424:AAEYEI7fZIiVIkG6sG1GsZr0-CHUEruAT58/sendMessage?chat_id=-1002161047303&text=CLICK%20SG23
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: PKO Bank Polski (Banking)111 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
string| ndjsStaticVersion object| nslyyidtyi function| nsbopifkz object| nslgf function| nsgukkeb boolean| nsdwhx number| nsviymjoy function| getEnabledEvents number| nsbopifk object| nsbopi function| nsgukkebkh function| nscavjydje object| nsgukk object| nscav object| nsgukkebk object| nsviymjoyg object| nslyyidt function| nseyqlyr string| nscavjy object| nds function| attachEventListener function| nsyohyfq object| returned string| version string| ndsWidgetVersion function| nspkx function| nstuky string| nsviy function| nstnagvv string| nsfkgjoq string| nsdwhxurq string| nsfkgjoqr string| nsdwhxur string| nsfkgj object| nsdwhxurqd object| nslgfnp function| nsguk function| nstna function| nsgukke function| nslyyi function| nseyqlyrf function| nstuk function| nsejsnf function| nsuksw function| validateSessionIdCookie function| nsyohy function| nstnagv function| nstukyivzx function| nsamh function| HashUtil function| nsyohyf function| nsuksww function| nsamhnfk function| nstnag function| nsejsn function| nsyohyfqp function| nsejsnfwm function| nsukswwaaw function| nstnagvvl function| nstukyiv function| nsyoh object| nsbopifkzi string| nslyyidty string| NDS_LISTEN_FOCUS string| NDS_LISTEN_TOUCH string| NDS_LISTEN_KEYBOARD string| NDS_LISTEN_DEVICE_MOTION_SENSORS string| NDS_LISTEN_MOUSE string| NDS_LISTEN_FORM string| NDS_LISTEN_ALL string| NDS_LISTEN_NONE function| nsuks string| nslgfnpyxj function| nstnagvvln string| nsviymjo string| nslgfn function| nseyq string| nslgfnpyx function| nsamhnfki string| nscavjyd function| nseyql string| nsfkg string| nsfkgjoqrf string| nslyy string| nsbop function| nsukswwa string| nslgfnpy string| nsviymj string| nsdwh object| nsbopif function| nsejsnfwmi function| ndoIsKeyIncluded function| ndoIsModifierKey function| nstukyivz function| ndoIsNavigationKey function| ndoIsEditingKey function| nsyohyfqpw object| KEYBOARD_LOCATION object| KEY_TYPE_AND_LOCATION function| nseyqlyrfu function| ndoGetKeyboardLocation function| ndoGetKeyTypeAndLocationIndicator function| ndoGetObjectKeys function| nsejsnfw function| ndwti function| nstukyi function| nspkxyn function| nsukswwaa function| ndwts object| ndsapi object| webpackChunkipko1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| www.ipko.pl/ | Name: ndcd Value: wc1.1.w-729460.1.2.e_6uh1cRHpxZz65AuW_8YQ%252C%252C.znn47sSMGaeNch8gmYeaN_8h8w8a7qHSIICxnCAIBgJI1Uzyj14AahJK7Qu2ORYEgUYsoZn79ei_oi5gxWQCNyxo_Cf99JSEKupSb4WkgtjtqMjwe1UaGAeeXrc20bmVGogBlKvpQOXF-c3N7JokymfRodGwd1cFxTrjAtKABroWO4dgpYFYE0SR4jYfS5Mz |
8 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
api.telegram.org
www.ipko.pl
www.itincorpora.com
www.pkobp.pl
api.telegram.org
178.238.224.11
193.109.225.100
193.109.225.70
07293379d2eefb7712b45ec9ff1f1d7327375744bd4d2d694cc51cef1fab7277
08e8695cc1177aba498bb4f0e97d406ab707ea76594495a0835708a120cf46ea
29ece7b2e689f637d125e4049a960fd9d5a5a71ead05cb4a89660221bd671038
376746c4617eecd9cec806ae380b57e9164f94167fe69c88a7455d091493cd95
6d371646f5fdf11110e7550388cb39b7533b0fe729192adbff255a24629ea461
830c51b7b727300cc2c08870800f300ccabd41eb95be16fc3768092922b36f88
83b1c861f448ddaca0c252f1fa51603ddee7fd3a08ff3b70eeabfa49661cdaf9
896dbccd0637d027ec8375d61a625e6dbbc4bee4e824a1dd08bc4f7f46025ed2
8e7e79dafc4a6d6e89355dabefa7f2694d807de72306ced7c3d020639943c9e8
b8d8c2d09388a98c4e4ea79b1d2ee83d37457aaad9e5001556119fe22c6bc031
cc2e7e0e6712f9ca4650d066bdb9300fc43324d3afbb615374f1e53bed7bd1a9
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3