admitel.pl Open in urlscan Pro
85.222.66.166 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://admitel.pl/wordpress/wp-content/store/
Effective URL:
http://admitel.pl/wordpress/wp-content/store/verification/9BN9A47373DDE880EEB9/index.php?country.x=NL-Netherlands&...
Submission: On April 14 via manual (April 14th 2021, 2:12:54 pm UTC) from US

Summary HTTP 1 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 1 HTTP transactions. The main IP is 85.222.66.166, located in Kielce, Poland and belongs to LIBERTYGLOBAL Liberty Global (formerly UPC Broadband Holding, aka AORTA), NL. The main domain is admitel.pl.

This is the only time admitel.pl was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Shopify (Online)

Domain & IP information

	IP Address		AS Autonomous System
1 2	85.222.66.166 85.222.66.166		6830 (LIBERTYGL...) (LIBERTYGLOBAL Liberty Global (formerly UPC Broadband Holding)
1	2

2 85.222.66.166 (Kielce, Poland) 1 redirects

ASN6830 (LIBERTYGLOBAL Liberty Global (formerly UPC Broadband Holding, aka AORTA), NL)
PTR: mail.admitel.pl

admitel.pl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	admitel.pl 1 redirects admitel.pl	153 KB
1	1

	Domain	Requested by
2	admitel.pl	1 redirects
1	1

This site contains no links.

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://admitel.pl/wordpress/wp-content/store/verification/9BN9A47373DDE880EEB9/index.php?country.x=NL-Netherlands&lang.x=en
Frame ID: 9DA2C8A461A8430657C3E96DBACAE261
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://admitel.pl/wordpress/wp-content/store/ HTTP 302
http://admitel.pl/wordpress/wp-content/store/verification/9BN9A47373DDE880EEB9/index.php?count... Page URL

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

1
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

189 kB
Transfer

645 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://admitel.pl/wordpress/wp-content/store/ HTTP 302
http://admitel.pl/wordpress/wp-content/store/verification/9BN9A47373DDE880EEB9/index.php?country.x=NL-Netherlands&lang.x=en Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

1 HTTP transactions
2 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request index.php Show response admitel.pl/wordpress/wp-content/store/verification/9BN9A47373DDE880EEB9/ Redirect Chain http://admitel.pl/wordpress/wp-content/store/ http://admitel.pl/wordpress/wp-content/store/verification/9BN9A47373DDE880EEB9/index.php?country.x=NL-Netherlands&lang.x=en	606 KB 152 KB	57ms 56ms	Document text/html	85.222.66.166 LIBERTYGLOBAL Lib...
General Check archive.org Show headers Download Go to Full URL http://admitel.pl/wordpress/wp-content/store/verification/9BN9A47373DDE880EEB9/index.php?country.x=NL-Netherlands&lang.x=en Protocol HTTP/1.1 Server 85.222.66.166 Kielce, Poland, ASN6830 (LIBERTYGLOBAL Liberty Global (formerly UPC Broadband Holding, aka AORTA), NL), Reverse DNS mail.admitel.pl Software nginx / Resource Hash `2f08a7449af331ff5251c186eaf1167e988b74a2206fb5d29eb759ff56706473` Request headers Host admitel.pl Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Accept-Language en-US Cookie PHPSESSID=08fbf33e88c59c94301ba2a5ce9f135e Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Server nginx Date Wed, 14 Apr 2021 14:12:23 GMT Content-Type text/html; charset=UTF-8 Transfer-Encoding chunked Connection keep-alive Keep-Alive timeout=20 Vary Accept-Encoding Content-Encoding gzip Redirect headers Server nginx Date Wed, 14 Apr 2021 14:12:23 GMT Content-Type text/html; charset=UTF-8 Transfer-Encoding chunked Connection keep-alive Keep-Alive timeout=20 Set-Cookie PHPSESSID=08fbf33e88c59c94301ba2a5ce9f135e; path=/ Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate Pragma no-cache location ./verification/9BN9A47373DDE880EEB9/index.php?country.x=NL-Netherlands&lang.x=en Vary Accept-Encoding Content-Encoding gzip
GET DATA	200 OK	truncated /	3 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `31218e858c0c19e74e2c504640631d96bdc143a47314a39c2e9e20cc908f00b8` Request headers Referer http://admitel.pl/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	37 KB 37 KB		Font font/woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `7cdcb8dafd2f35ec642986935ed106e2c36f93e2a3143297a98cdcf00351744b` Request headers Origin http://admitel.pl Referer http://admitel.pl/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type font/woff2

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Shopify (Online)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			admitel.pl/	1969-12-31 23:59:59	Name: PHPSESSID Value: 08fbf33e88c59c94301ba2a5ce9f135e

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

admitel.pl
85.222.66.166
2f08a7449af331ff5251c186eaf1167e988b74a2206fb5d29eb759ff56706473
31218e858c0c19e74e2c504640631d96bdc143a47314a39c2e9e20cc908f00b8
7cdcb8dafd2f35ec642986935ed106e2c36f93e2a3143297a98cdcf00351744b

admitel.pl Open in urlscan Pro 85.222.66.166 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

1 Requests

0 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

2 IPs

1 Countries

189 kBTransfer

645 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

1 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

5 JavaScript Global Variables

1 Cookies

Indicators

admitel.pl Open in urlscan Pro
85.222.66.166 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

1
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

189 kB
Transfer

645 kB
Size

1
Cookies

1 HTTP transactions
2 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!