poczta-onet.netlify.app
35.157.26.135  Malicious Activity! Public Scan Open in urlscan Pro

4 Outgoing links Go Pro

Only in urlscan Pro

Effortlessly use any on-page link as a pivot to discover other pages pointing to the exact same destination. Seamlessly trace both specific URLs and broader domains to uncover hidden connection networks and map out backlink relationships with ease.

Click for more information

Free trials of urlscan Pro are available.

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions Go Pro

Only in urlscan Pro

Inspect WebSocket connections, examine POST data effortlessly, and track overlap counts in real time. Features live search and filtering across all HTTP output, complete with full response metadata for deep analysis.

Click for more information

Free trials of urlscan Pro are available.

Everything HTML Script Fetch XHR CSS Image Font Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response poczta-onet.netlify.app/	12 KB 3 KB	251ms 82ms	Document text/html	35.157.26.135 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://poczta-onet.netlify.app/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 35.157.26.135 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-35-157-26-135.eu-central-1.compute.amazonaws.com Software Netlify / Resource Hash 8d8ace14e43486011fd5cd53cebc6c382d7e654ff0cdfbb2bf83d14e49ef222c Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 sec-ch-ua "Chromium";v="151", "Google Chrome";v="151", "Not=A?Brand";v="99" sec-ch-ua-mobile ?0 sec-ch-ua-platform "Linux" Response headers accept-ranges bytes age 3729 cache-control public,max-age=0,must-revalidate cache-status "Netlify Edge"; hit; ttl=31532271 content-encoding br content-length 3012 content-type text/html; charset=UTF-8 date Thu, 13 Aug 2026 01:02:12 GMT etag "6ce1a286170b55065bb3cf5a8652ec0d-ssl-df" server Netlify strict-transport-security max-age=31536000; includeSubDomains; preload vary Accept-Encoding x-nf-request-id 01KZWA87902DS8VYPGD7XWX9WA
GET H2	200	OnetPoczta.png static-konto.onet.pl/assets/logos/	8 KB 9 KB	260ms 88ms	Image image/png	65.9.130.31 Amazon.com
General Check archive.org Show headers Download Go to Show image Full URL https://static-konto.onet.pl/assets/logos/OnetPoczta.png Requested by Host: poczta-onet.netlify.app URL: https://poczta-onet.netlify.app/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 65.9.130.31 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS server-65-9-130-31.fra60.r.cloudfront.net Software Ring Publishing - Accelerator / Resource Hash 6891a9f6a1739486d7139639ffe564b79ffecdf4622132a51ad7c5f5c7624ef4 Request headers sec-ch-ua-platform "Linux" Referer https://poczta-onet.netlify.app/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 sec-ch-ua "Chromium";v="151", "Google Chrome";v="151", "Not=A?Brand";v="99" sec-ch-ua-mobile ?0 Response headers x-amz-version-id 0RgX0FwCcDun7U34QXfOJpiTa1XvtGQY etag "2b123117064ce7f092c7bbe2a2ebc7df" age 385 alt-svc h3=":443"; ma=86400 x-cache Hit from cloudfront x-amz-cf-id dbVnbOIRoYOhwHjxUjYPcaITV0UvXE0Z7bBSFNbNXD9_DcauAOl8MA== date Thu, 13 Aug 2026 00:55:48 GMT content-type image/png last-modified Thu, 11 Dec 2025 14:06:19 GMT cache-control max-age=604800 via 1.1 def78bd9f6b4ff6109111fdb39be66f6.cloudfront.net (CloudFront) accept-ranges bytes access-control-allow-origin https://konto.onet.pl content-length 8386 x-amz-cf-pop FRA60-P14 server Ring Publishing - Accelerator x-amz-server-side-encryption AES256
GET H2	200	poland.png account-platform-static.ocdn.eu/new_account_app/favicons/languages/	57 KB 57 KB	268ms 98ms	Image image/png	3.174.46.47 Amazon.com
General Check archive.org Show headers Download Go to Show image Full URL https://account-platform-static.ocdn.eu/new_account_app/favicons/languages/poland.png Requested by Host: poczta-onet.netlify.app URL: https://poczta-onet.netlify.app/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.174.46.47 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS server-3-174-46-47.fra60.r.cloudfront.net Software Ring Publishing - Accelerator / Resource Hash 72a990e37eb7dd8c353162cc903ad7452f4c8f938c49f6e446343a683e5336a6 Request headers sec-ch-ua-platform "Linux" Referer https://poczta-onet.netlify.app/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 sec-ch-ua "Chromium";v="151", "Google Chrome";v="151", "Not=A?Brand";v="99" sec-ch-ua-mobile ?0 Response headers etag "2f00ce30b3afe7b15df7a9cc760b6a49" age 274 x-amz-meta-public-width 120 alt-svc h3=":443"; ma=86400 x-cache Hit from cloudfront x-amz-cf-id arZLFqAFWZ4sYpDoAPhhMaNfPUAyFytIODhGrop4GPlDYAJI3LWyIQ== date Thu, 13 Aug 2026 00:57:39 GMT content-type image/png last-modified Mon, 07 Mar 2022 14:04:49 GMT x-amz-meta-md5 2f00ce30b3afe7b15df7a9cc760b6a49 cache-control max-age=604800, public via 1.1 d9ded362658a71bc4f5c03fb78a1085c.cloudfront.net (CloudFront) accept-ranges bytes x-amz-meta-public-height 120 content-length 57935 x-amz-cf-pop FRA60-P12 server Ring Publishing - Accelerator
GET H2	200	/ Show response api.ipify.org/	23 B 155 B	249ms 157ms	Fetch application/json	172.67.74.152 Cloudflare
General Check archive.org Show headers Download Go to Full URL https://api.ipify.org/?format=json Requested by Host: poczta-onet.netlify.app URL: https://poczta-onet.netlify.app/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.67.74.152 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash d4c02a1c25587b2a8ffca1a3be6eb5ff3f1e5bc84dfe6244194cfefa01ecf7a4 Request headers sec-ch-ua-platform "Linux" Referer https://poczta-onet.netlify.app/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 sec-ch-ua "Chromium";v="151", "Google Chrome";v="151", "Not=A?Brand";v="99" sec-ch-ua-mobile ?0 Response headers cf-cache-status DYNAMIC cf-ray a2a3cb02dbc2aa28-LIS access-control-allow-origin * content-length 23 date Thu, 13 Aug 2026 01:02:13 GMT content-type application/json vary Origin server cloudflare
POST H2	401	sendMessage Show response api.telegram.org/bot8952065832:AAEGN9WFzT0l6VH_VsjEf2FUVeyPOU4zyew/	58 B 277 B	81ms 80ms	Fetch application/json	149.154.166.110 Telegram Telegram...
General Check archive.org Show headers Download Go to Full URL https://api.telegram.org/bot8952065832:AAEGN9WFzT0l6VH_VsjEf2FUVeyPOU4zyew/sendMessage Requested by Host: poczta-onet.netlify.app URL: https://poczta-onet.netlify.app/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 149.154.166.110 Amsterdam, Netherlands, ASN62041 (Telegram Telegram Messenger Inc, VG), Reverse DNS Software nginx/1.30.1 / Resource Hash 5b8cd38cfdf83e8d0a46af7c34ecb2962621aa69f6eb8458e7c86ac7a66a2948 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers sec-ch-ua-platform "Linux" Referer https://poczta-onet.netlify.app/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 sec-ch-ua "Chromium";v="151", "Google Chrome";v="151", "Not=A?Brand";v="99" Content-Type application/json sec-ch-ua-mobile ?0 Response headers strict-transport-security max-age=31536000; includeSubDomains; preload access-control-allow-origin * access-control-expose-headers Content-Length,Content-Type,Date,Server,Connection content-length 58 date Thu, 13 Aug 2026 01:02:13 GMT content-type application/json server nginx/1.30.1
OPTIONS H2	204	sendMessage api.telegram.org/bot8952065832:AAEGN9WFzT0l6VH_VsjEf2FUVeyPOU4zyew/	0 0	243ms 79ms	Preflight	149.154.166.110 Telegram Telegram...
General Check archive.org Show headers Download Go to Full URL https://api.telegram.org/bot8952065832:AAEGN9WFzT0l6VH_VsjEf2FUVeyPOU4zyew/sendMessage Protocol H2 Security TLS 1.3, , AES_256_GCM Server 149.154.166.110 Amsterdam, Netherlands, ASN62041 (Telegram Telegram Messenger Inc, VG), Reverse DNS Software nginx/1.30.1 / Resource Hash Request headers Accept */* Access-Control-Request-Headers content-type Access-Control-Request-Method POST Origin https://poczta-onet.netlify.app Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 Response headers access-control-allow-headers content-type access-control-allow-methods GET, POST, OPTIONS access-control-allow-origin * access-control-expose-headers Content-Length,Content-Type,Date,Server,Connection access-control-max-age 86400 date Thu, 13 Aug 2026 01:02:13 GMT server nginx/1.30.1
GET H2	200	favicon.ico www.onet.pl/	3 KB 3 KB	276ms 91ms	Other image/png	3.171.214.35 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://www.onet.pl/favicon.ico Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.171.214.35 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS server-3-171-214-35.fra50.r.cloudfront.net Software Ring Publishing - Accelerator / Resource Hash 786287f345a979166aa9ebe88c7fb22a90c3ee477ef32ddaa386fbed4075ae58 Request headers sec-ch-ua-platform "Linux" Referer https://poczta-onet.netlify.app/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 sec-ch-ua "Chromium";v="151", "Google Chrome";v="151", "Not=A?Brand";v="99" sec-ch-ua-mobile ?0 Response headers etag "7c2a07c25618e631019f6535f0321362" x-amz-meta-public-width 96 x-amz-meta-cb-modifiedtime Tue, 11 Jun 2019 11:21:29 GMT alt-svc h3=":443"; ma=86400 x-cache Miss from cloudfront x-amz-cf-id vNnpHQXfVUu0pLi3iQuRzlF4f9Ss-sprow3kaxZHzTBF1JgYR4TiGQ== date Thu, 13 Aug 2026 01:02:13 GMT content-type image/png last-modified Tue, 10 Dec 2019 12:37:40 GMT x-amz-meta-md5 7c2a07c25618e631019f6535f0321362 cache-control s-maxage=0,max-age=604800,stale-if-error=0 via 1.1 0263e7e10b506a4542a1515f73f15568.cloudfront.net (CloudFront) accept-ranges bytes x-amz-meta-public-height 96 content-length 2623 x-amz-cf-pop FRA50-P1 server Ring Publishing - Accelerator

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: 2dehands (E-commerce) Go Pro

Only in urlscan Pro

Use our Phishing URL feed to retrieve phishing pages targeting 3000+ brands in real-time. Set up monitoring and alerts. Use maliciousness scores and AI-powered brand name recognition to hunt for brand impersonation.

Click for more information

Free trials of urlscan Pro are available.

8 JavaScript Window variables Go Pro

Only in urlscan Pro

Inspect and pivot on JavaScript variables, identifiers, and other key site metadata data with urlscan Pro. Reveal and search on client-side frameworks, runtime variables, and custom values.

Click for more information

Free trials of urlscan Pro are available.

These are the non-standard variables defined on the window object. These include var declarations and global functions and can be helpful in identifying possible client-side frameworks and code.

object| oncommand object| onanimationcancel object| fence object| onscrollsnapchange object| onscrollsnapchanging object| ongamepadconnected object| ongamepaddisconnected function| sendToTelegram

2 Cookies Go Pro

Only in urlscan Pro

Review, search, and pivot on browser cookies and persistence site data to see how a site tracks users and keeps sessions alive across visits.

Click for more information

Free trials of urlscan Pro are available.

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.onet.pl/	1970-01-22 01:01:58	Name: acc_segment Value: 96
			www.onet.pl/	1970-01-22 01:01:58	Name: acc_segment_ver Value: 3

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	verbose	URL: https://poczta-onet.netlify.app/ Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o
network	error	URL: https://api.telegram.org/bot8952065832:AAEGN9WFzT0l6VH_VsjEf2FUVeyPOU4zyew/sendMessage Message: Failed to load resource: the server responded with a status of 401 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

account-platform-static.ocdn.eu
api.ipify.org
api.telegram.org
poczta-onet.netlify.app
static-konto.onet.pl
www.onet.pl
149.154.166.110
172.67.74.152
3.171.214.35
3.174.46.47
35.157.26.135
65.9.130.31
5b8cd38cfdf83e8d0a46af7c34ecb2962621aa69f6eb8458e7c86ac7a66a2948
6891a9f6a1739486d7139639ffe564b79ffecdf4622132a51ad7c5f5c7624ef4
72a990e37eb7dd8c353162cc903ad7452f4c8f938c49f6e446343a683e5336a6
786287f345a979166aa9ebe88c7fb22a90c3ee477ef32ddaa386fbed4075ae58
8d8ace14e43486011fd5cd53cebc6c382d7e654ff0cdfbb2bf83d14e49ef222c
d4c02a1c25587b2a8ffca1a3be6eb5ff3f1e5bc84dfe6244194cfefa01ecf7a4