poczta-onet.netlify.app
2600:1f18:16e:df01::259  Malicious Activity! Public Scan Open in urlscan Pro

Internal
urlscan.io (IP) urlscan.io (Domain)
Effective Hostname
VirusTotal SecurityTrails crt.sh
Submitted URL
Google Safe Browsing Archive.org
Effective URL Pivot
Google Safe Browsing Archive.org
Effective IP
VirusTotal SecurityTrails Domaintools Censys
Go To Rescan
Add Verdict Report
Submitted URL:
http://poczta-onet.netlify.app/ 3mo old
Effective URL:
https://poczta-onet.netlify.app/ 3mo old
Submission: On August 13 via api (August 13th 2026, 6:55:30 am UTC) from US — Scanned from AT Go Pro

Only in urlscan Pro

  • Select different country locations for Private Scans.
  • Use a global network of additional scanning locations and residential IPs for scanning.
  • Interact with pages while you are scanning them.
  • Download files from remote websites.
  • Scan websites on the Tor Network.
Click for more information
Free trials of urlscan Pro are available.
Summary HTTP 7 Redirects Links 4  Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 6 IPs in 3 countries across 5 domains to perform 7 HTTP transactions. The main IP is 2600:1f18:16e:df01::259, located in Ashburn, United States and belongs to AMAZON-AES - Amazon.com, Inc., US. The main domain is poczta-onet.netlify.app. 3mo old
TLS certificate: Issued by DigiCert Global G2 TLS RSA SHA256 202... on February 16th 2026. Valid for: 1yr.
This is the only time poczta-onet.netlify.app was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: 2dehands (E-commerce)

Domain & IP information

IP Address AS Autonomous System
1 2600:1f18:16e... 2600:1f18:16e:df01::259 14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
1 65.9.130.100 65.9.130.100 16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1 3.174.46.34 3.174.46.34 16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1 104.26.12.205 104.26.12.205 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1 3.171.214.35 3.171.214.35 16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
2 2001:67c:4e8:... 2001:67c:4e8:f004::9 62041 (Telegram ...) (Telegram Telegram Messenger Inc)
7 6
1    2600:1f18:16e:df01::259 (Ashburn, United States)
IP Lookup
urlscan.io SecurityTrails VirusTotal AbuseIPDB Censys Domaintools ipinfo.io Shodan
ASN Lookup
urlscan.io CAIDA Rank ipinfo.io CIRCL BGP Ranking

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
poczta-onet.netlify.app 3mo old
VirusTotal SecurityTrails crt.sh Domaintools
1    65.9.130.100 (United States)
IP Lookup
urlscan.io SecurityTrails VirusTotal AbuseIPDB Censys Domaintools ipinfo.io Shodan
ASN Lookup
urlscan.io CAIDA Rank ipinfo.io CIRCL BGP Ranking

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-65-9-130-100.fra60.r.cloudfront.net
static-konto.onet.pl 3yr old
VirusTotal SecurityTrails crt.sh Domaintools
1    3.174.46.34 (United States)
IP Lookup
urlscan.io SecurityTrails VirusTotal AbuseIPDB Censys Domaintools ipinfo.io Shodan
ASN Lookup
urlscan.io CAIDA Rank ipinfo.io CIRCL BGP Ranking

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-3-174-46-34.fra60.r.cloudfront.net
account-platform-static.ocdn.eu 5yr old
VirusTotal SecurityTrails crt.sh Domaintools
1    104.26.12.205 (Ascension Island)
IP Lookup
urlscan.io SecurityTrails VirusTotal AbuseIPDB Censys Domaintools ipinfo.io Shodan
ASN Lookup
urlscan.io CAIDA Rank ipinfo.io CIRCL BGP Ranking

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
api.ipify.org 12yr old
VirusTotal SecurityTrails crt.sh Domaintools
1    3.171.214.35 (United States)
IP Lookup
urlscan.io SecurityTrails VirusTotal AbuseIPDB Censys Domaintools ipinfo.io Shodan
ASN Lookup
urlscan.io CAIDA Rank ipinfo.io CIRCL BGP Ranking

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-3-171-214-35.fra50.r.cloudfront.net
www.onet.pl 10yr old
VirusTotal SecurityTrails crt.sh Domaintools
2    2001:67c:4e8:f004::9 (Amsterdam, Netherlands)
IP Lookup
urlscan.io SecurityTrails VirusTotal AbuseIPDB Censys Domaintools ipinfo.io Shodan
ASN Lookup
urlscan.io CAIDA Rank ipinfo.io CIRCL BGP Ranking

ASN62041 (Telegram Telegram Messenger Inc, VG)
api.telegram.org 11yr old
VirusTotal SecurityTrails crt.sh Domaintools
Apex Domain
Subdomains		 Transfer
2 telegram.org
api.telegram.org — Cisco Umbrella Rank: 44330 11yr old
277 B
2 onet.pl
static-konto.onet.pl — Cisco Umbrella Rank: 549154 3yr old
www.onet.pl — Cisco Umbrella Rank: 119879 10yr old
12 KB
1 ipify.org
api.ipify.org — Cisco Umbrella Rank: 980 12yr old
156 B
1 ocdn.eu
account-platform-static.ocdn.eu 5yr old
57 KB
1 netlify.app
poczta-onet.netlify.app 3mo old
3 KB
7 5
Domain Requested by
2 api.telegram.org poczta-onet.netlify.app
1 www.onet.pl
1 api.ipify.org poczta-onet.netlify.app
1 account-platform-static.ocdn.eu poczta-onet.netlify.app
1 static-konto.onet.pl poczta-onet.netlify.app
1 poczta-onet.netlify.app
7 6

This site contains links to these domains. Also see Links.

Domain
polityka-prywatnosci.onet.pl
pomoc.poczta.onet.pl
policies.google.com
Subject Issuer Validity Valid
*.netlify.app
DigiCert Global G2 TLS RSA SHA256 2020 CA1		 2026-02-16 -
2027-03-19		 1yr crt.sh
*.onet.pl
GeoTrust TLS RSA CA G1		 2026-04-21 -
2026-11-05		 7mo crt.sh
*.ocdn.eu
GeoTrust TLS RSA CA G1		 2025-12-04 -
2026-12-03		 1yr crt.sh
ipify.org
WE1		 2026-06-28 -
2026-09-26		 3mo crt.sh
api.telegram.org
Go Daddy Secure Certificate Authority - G2		 2025-11-11 -
2026-12-13		 1yr crt.sh

This page contains 1 frames:

Primary Page: https://poczta-onet.netlify.app/
Frame ID: 511A1671AABCDEA233D3AB619DA584CB
Requests: 6 HTTP requests in this frame

Screenshot Go Pro

Only in urlscan Pro

Use the Visual Search feature to find pages with visually similar screenshots.
Click for more information
Free trials of urlscan Pro are available.
Full Image

Page Title

Poczta Onet – potwierdzenie danych

Page URL History Go Pro

Only in urlscan Pro

Search our real-time database of newly observed domains and hostnames. Pivot on different attributes, and setup keyword alerts for newly observed domains.
Click for more information
Free trials of urlscan Pro are available.
 Show full URLs

  1. http://poczta-onet.netlify.app/ HTTP 307
    https://poczta-onet.netlify.app/ Page URL

Detected technologies

(PaaS)
Overall confidence: 100%
Detected patterns
  • ^https?://[^/]+\.netlify\.(?:com|app)/
(Geolocation)
Overall confidence: 100%
Detected patterns
  • \.ipify\.org

Page Statistics

7
Requests

100 %
HTTPS

33 %
IPv6

5
Domains

6
Subdomains

6
IPs

3
Countries

73 kB
Transfer

79 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://poczta-onet.netlify.app/ HTTP 307
    https://poczta-onet.netlify.app/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions Go Pro

Only in urlscan Pro

Inspect WebSocket connections, examine POST data effortlessly, and track overlap counts in real time. Features live search and filtering across all HTTP output, complete with full response metadata for deep analysis.
Click for more information
Free trials of urlscan Pro are available.
0 data transactions

Method
Protocol		 Status Resource
Path		 Size
x-fer		 Time
Latency		 Type
MIME-Type		 IP
Location
GET
H2 		200
 Primary Request / Show response
poczta-onet.netlify.app/
Redirect Chain
  • http://poczta-onet.netlify.app/
  • https://poczta-onet.netlify.app/
12 KB
3 KB 		409ms
129ms 		Document
text/html		 2600:1f18:16e:df01::259
Amazon.com
General
Check archive.org
Download Go to
Full URL
https://poczta-onet.netlify.app/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:1f18:16e:df01::259 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
Software
Netlify /
Resource Hash
8d8ace14e43486011fd5cd53cebc6c382d7e654ff0cdfbb2bf83d14e49ef222c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36

Response headers

accept-ranges
bytes
age
7622
cache-control
public,max-age=0,must-revalidate
cache-status
"Netlify Edge"; hit; ttl=31528378
content-encoding
br
content-length
3015
content-type
text/html; charset=UTF-8
date
Thu, 13 Aug 2026 06:55:30 GMT
etag
"6ce1a286170b55065bb3cf5a8652ec0d-ssl-df"
server
Netlify
strict-transport-security
max-age=31536000; includeSubDomains; preload
vary
Accept-Encoding
x-nf-request-id
01KZWYF49B7EFHPS0FF164W6B1

Redirect headers

Cross-Origin-Resource-Policy
Cross-Origin
Location
https://poczta-onet.netlify.app/
Non-Authoritative-Reason
HSTS
GET
H2 		200
 OnetPoczta.png
static-konto.onet.pl/assets/logos/ 		8 KB
9 KB 		103ms
33ms 		Image
image/png		 65.9.130.100
Amazon.com
General
Check archive.org
Download Go to Show image
Full URL
https://static-konto.onet.pl/assets/logos/OnetPoczta.png
Requested by
Host: poczta-onet.netlify.app
URL: https://poczta-onet.netlify.app/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.130.100 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-65-9-130-100.fra60.r.cloudfront.net
Software
Ring Publishing - Accelerator /
Resource Hash
6891a9f6a1739486d7139639ffe564b79ffecdf4622132a51ad7c5f5c7624ef4

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://poczta-onet.netlify.app/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="151", "Google Chrome";v="151", "Not=A?Brand";v="99"
sec-ch-ua-mobile
?0

Response headers

x-amz-version-id
0RgX0FwCcDun7U34QXfOJpiTa1XvtGQY
etag
"2b123117064ce7f092c7bbe2a2ebc7df"
age
33
alt-svc
h3=":443"; ma=86400
x-cache
Hit from cloudfront
x-amz-cf-id
G38tsZJAq6-W4oKeLGY0h61BO0wXGiWjz2o75bj9V5v1k3Ky5hulHw==
date
Thu, 13 Aug 2026 06:54:57 GMT
content-type
image/png
last-modified
Thu, 11 Dec 2025 14:06:19 GMT
cache-control
max-age=604800
via
1.1 476fd70bdb0e3f01a7cdbc322ceae0d8.cloudfront.net (CloudFront)
accept-ranges
bytes
access-control-allow-origin
https://konto.onet.pl
content-length
8386
x-amz-cf-pop
FRA60-P14
server
Ring Publishing - Accelerator
x-amz-server-side-encryption
AES256
GET
H2 		200
 poland.png
account-platform-static.ocdn.eu/new_account_app/favicons/languages/ 		57 KB
57 KB 		107ms
35ms 		Image
image/png		 3.174.46.34
Amazon.com
General
Check archive.org
Download Go to Show image
Full URL
https://account-platform-static.ocdn.eu/new_account_app/favicons/languages/poland.png
Requested by
Host: poczta-onet.netlify.app
URL: https://poczta-onet.netlify.app/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.174.46.34 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-3-174-46-34.fra60.r.cloudfront.net
Software
Ring Publishing - Accelerator /
Resource Hash
72a990e37eb7dd8c353162cc903ad7452f4c8f938c49f6e446343a683e5336a6

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://poczta-onet.netlify.app/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="151", "Google Chrome";v="151", "Not=A?Brand";v="99"
sec-ch-ua-mobile
?0

Response headers

etag
"2f00ce30b3afe7b15df7a9cc760b6a49"
age
188
x-amz-meta-public-width
120
alt-svc
h3=":443"; ma=86400
x-cache
Hit from cloudfront
x-amz-cf-id
P3Y2g0GS4RdLfBxzbFPOJvPUKzALR6xIHmT6MRHVmxpdW6UXb1ZltQ==
date
Thu, 13 Aug 2026 06:52:22 GMT
content-type
image/png
last-modified
Mon, 07 Mar 2022 14:04:49 GMT
x-amz-meta-md5
2f00ce30b3afe7b15df7a9cc760b6a49
cache-control
max-age=604800, public
via
1.1 1ff7b3dffc71b149c2f0fa89757c1bd6.cloudfront.net (CloudFront)
accept-ranges
bytes
x-amz-meta-public-height
120
content-length
57935
x-amz-cf-pop
FRA60-P12
server
Ring Publishing - Accelerator
GET
H2 		200
 / Show response
api.ipify.org/ 		23 B
156 B 		185ms
117ms 		Fetch
application/json		 104.26.12.205
Cloudflare
General
Check archive.org
Download Go to
Full URL
https://api.ipify.org/?format=json
Requested by
Host: poczta-onet.netlify.app
URL: https://poczta-onet.netlify.app/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.12.205 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
5f80f7cdc7363adb94886affaec4358454f5034262d9edf031cf26eb4f7194d9

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://poczta-onet.netlify.app/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="151", "Google Chrome";v="151", "Not=A?Brand";v="99"
sec-ch-ua-mobile
?0

Response headers

cf-cache-status
DYNAMIC
cf-ray
a2a5d0896c913383-FRA
access-control-allow-origin
*
content-length
23
date
Thu, 13 Aug 2026 06:55:30 GMT
content-type
application/json
vary
Origin
server
cloudflare
GET
H2 		200
 favicon.ico
www.onet.pl/ 		3 KB
3 KB 		102ms
33ms 		Other
image/png		 3.171.214.35
Amazon.com
General
Check archive.org
Download Go to
Full URL
https://www.onet.pl/favicon.ico
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.171.214.35 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-3-171-214-35.fra50.r.cloudfront.net
Software
Ring Publishing - Accelerator /
Resource Hash
786287f345a979166aa9ebe88c7fb22a90c3ee477ef32ddaa386fbed4075ae58

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://poczta-onet.netlify.app/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="151", "Google Chrome";v="151", "Not=A?Brand";v="99"
sec-ch-ua-mobile
?0

Response headers

etag
"7c2a07c25618e631019f6535f0321362"
x-amz-meta-public-width
96
x-amz-meta-cb-modifiedtime
Tue, 11 Jun 2019 11:21:29 GMT
alt-svc
h3=":443"; ma=86400
x-cache
Miss from cloudfront
x-amz-cf-id
ycKvwASXz9ZlXgdyY_bqgZeQnP-VkYELpQwliSg4n87s66DHGkWKZg==
date
Thu, 13 Aug 2026 06:55:30 GMT
content-type
image/png
last-modified
Tue, 10 Dec 2019 12:37:40 GMT
x-amz-meta-md5
7c2a07c25618e631019f6535f0321362
cache-control
s-maxage=0,max-age=604800,stale-if-error=0
via
1.1 f71e1afcd5c7f0fbd1e8e23183dee70c.cloudfront.net (CloudFront)
accept-ranges
bytes
x-amz-meta-public-height
96
content-length
2623
x-amz-cf-pop
FRA50-P1
server
Ring Publishing - Accelerator
POST
H2 		401
 sendMessage Show response
api.telegram.org/bot8952065832:AAEGN9WFzT0l6VH_VsjEf2FUVeyPOU4zyew/ 		58 B
277 B 		37ms
36ms 		Fetch
application/json		 2001:67c:4e8:f004::9
Telegram Telegram...
General
Check archive.org
Download Go to
Full URL
https://api.telegram.org/bot8952065832:AAEGN9WFzT0l6VH_VsjEf2FUVeyPOU4zyew/sendMessage
Requested by
Host: poczta-onet.netlify.app
URL: https://poczta-onet.netlify.app/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2001:67c:4e8:f004::9 Amsterdam, Netherlands, ASN62041 (Telegram Telegram Messenger Inc, VG),
Reverse DNS
Software
nginx/1.30.1 /
Resource Hash
5b8cd38cfdf83e8d0a46af7c34ecb2962621aa69f6eb8458e7c86ac7a66a2948
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://poczta-onet.netlify.app/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="151", "Google Chrome";v="151", "Not=A?Brand";v="99"
Content-Type
application/json
sec-ch-ua-mobile
?0

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
access-control-allow-origin
*
access-control-expose-headers
Content-Length,Content-Type,Date,Server,Connection
content-length
58
date
Thu, 13 Aug 2026 06:55:31 GMT
content-type
application/json
server
nginx/1.30.1
OPTIONS
H2 		204
 sendMessage
api.telegram.org/bot8952065832:AAEGN9WFzT0l6VH_VsjEf2FUVeyPOU4zyew/ 		0
0 		114ms
35ms 		Preflight
2001:67c:4e8:f004::9
Telegram Telegram...
General
Check archive.org
Download Go to
Full URL
https://api.telegram.org/bot8952065832:AAEGN9WFzT0l6VH_VsjEf2FUVeyPOU4zyew/sendMessage
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2001:67c:4e8:f004::9 Amsterdam, Netherlands, ASN62041 (Telegram Telegram Messenger Inc, VG),
Reverse DNS
Software
nginx/1.30.1 /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://poczta-onet.netlify.app
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36

Response headers

access-control-allow-headers
content-type
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-origin
*
access-control-expose-headers
Content-Length,Content-Type,Date,Server,Connection
access-control-max-age
86400
date
Thu, 13 Aug 2026 06:55:30 GMT
server
nginx/1.30.1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: 2dehands (E-commerce) Go Pro

Only in urlscan Pro

Use our Phishing URL feed to retrieve phishing pages targeting 3000+ brands in real-time. Set up monitoring and alerts. Use maliciousness scores and AI-powered brand name recognition to hunt for brand impersonation.
Click for more information
Free trials of urlscan Pro are available.

8 JavaScript Window variables Go Pro

Only in urlscan Pro

Inspect and pivot on JavaScript variables, identifiers, and other key site metadata data with urlscan Pro. Reveal and search on client-side frameworks, runtime variables, and custom values.
Click for more information
Free trials of urlscan Pro are available.

These are the non-standard variables defined on the window object. These include var declarations and global functions and can be helpful in identifying possible client-side frameworks and code.

object| oncommand object| onanimationcancel object| fence object| onscrollsnapchange object| onscrollsnapchanging object| ongamepadconnected object| ongamepaddisconnected function| sendToTelegram

2 Cookies Go Pro

Only in urlscan Pro

Review, search, and pivot on browser cookies and persistence site data to see how a site tracks users and keeps sessions alive across visits.
Click for more information
Free trials of urlscan Pro are available.

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path Expires Name / Value
www.onet.pl/ 1970-01-22
01:02:20 		Name: acc_segment
Value: 97
www.onet.pl/ 1970-01-22
01:02:20 		Name: acc_segment_ver
Value: 3

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source Level URL
Text
recommendation verbose URL: https://poczta-onet.netlify.app/
Message:
[DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o
network error URL: https://api.telegram.org/bot8952065832:AAEGN9WFzT0l6VH_VsjEf2FUVeyPOU4zyew/sendMessage
Message:
Failed to load resource: the server responded with a status of 401 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload