serwis24.netlify.app
2a05:d014:58f:6200::258  Malicious Activity! Public Scan Open in urlscan Pro

Summary

This website contacted 5 IPs in 4 countries across 4 domains to perform 8 HTTP transactions. The main IP is 2a05:d014:58f:6200::258, located in Frankfurt am Main, Germany and belongs to AMAZON-02 - Amazon.com, Inc., US. The main domain is serwis24.netlify.app. 1mo old
TLS certificate: Issued by DigiCert Global G2 TLS RSA SHA256 202... on February 16th 2026. Valid for: 1yr.
This is the only time serwis24.netlify.app was scanned on urlscan.io!
Targeting these brands: Onet.pl (Online)

Domain & IP information

IP Address AS Autonomous System
2 2a05:d014:58f... 2a05:d014:58f:6200::258 16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
2 65.9.130.118 65.9.130.118 16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1 104.26.13.205 104.26.13.205 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1 3.171.214.86 3.171.214.86 16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
2 2001:67c:4e8:... 2001:67c:4e8:f004::9 62041 (Telegram ...) (Telegram Telegram Messenger Inc)
8 5
Apex Domain
Subdomains
Transfer
3 onet.pl
static-konto.onet.pl — Cisco Umbrella Rank: 532742 3yr old
www.onet.pl — Cisco Umbrella Rank: 125306 10yr old
69 KB
2 telegram.org
api.telegram.org — Cisco Umbrella Rank: 47017 11yr old
910 B
2 netlify.app
serwis24.netlify.app 1mo old
15 KB
1 ipify.org
api.ipify.org — Cisco Umbrella Rank: 1063 12yr old
155 B
8 4
Domain Requested by
2 api.telegram.org serwis24.netlify.app
2 static-konto.onet.pl serwis24.netlify.app
2 serwis24.netlify.app serwis24.netlify.app
1 www.onet.pl
1 api.ipify.org serwis24.netlify.app
8 5
Subject Issuer Validity Valid
*.netlify.app
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2026-02-16 -
2027-03-19
1yr crt.sh
*.onet.pl
GeoTrust TLS RSA CA G1
2026-04-21 -
2026-11-05
7mo crt.sh
ipify.org
WE1
2026-08-26 -
2026-11-24
3mo crt.sh
api.telegram.org
Go Daddy Secure Certificate Authority - G2
2025-11-11 -
2026-12-13
1yr crt.sh

This page contains 1 frames:

Primary Page: https://serwis24.netlify.app/
Frame ID: 44EA58BB624F9A5A504874837425F653
Requests: 7 HTTP requests in this frame

Screenshot Go Pro

Only in urlscan Pro

Use the Visual Search feature to find pages with visually similar screenshots.
Click for more information
Free trials of urlscan Pro are available.

Page Title

Poczta Onet – logowanie

Page URL History Go Pro

Only in urlscan Pro

Search our real-time database of newly observed domains and hostnames. Pivot on different attributes, and setup keyword alerts for newly observed domains.
Click for more information
Free trials of urlscan Pro are available.
Show full URLs

  1. http://serwis24.netlify.app/ HTTP 307
    https://serwis24.netlify.app/ Page URL

Detected technologies

(PaaS)
Overall confidence: 100%
Detected patterns
  • ^https?://[^/]+\.netlify\.(?:com|app)/

(Geolocation)
Overall confidence: 100%
Detected patterns
  • \.ipify\.org

Page Statistics

8
Requests

100 %
HTTPS

40 %
IPv6

4
Domains

5
Subdomains

5
IPs

4
Countries

85 kB
Transfer

124 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://serwis24.netlify.app/ HTTP 307
    https://serwis24.netlify.app/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions Go Pro

Only in urlscan Pro

Inspect WebSocket connections, examine POST data effortlessly, and track overlap counts in real time. Features live search and filtering across all HTTP output, complete with full response metadata for deep analysis.
Click for more information
Free trials of urlscan Pro are available.

0 data transactions

Method
Protocol
Status Resource
Path
Size
x-fer
Time
Latency
Type
MIME-Type
IP
Location
GET
H2
200
Primary Request / Show response
serwis24.netlify.app/
Redirect Chain
  • http://serwis24.netlify.app/
  • https://serwis24.netlify.app/
23 KB
5 KB
59ms
17ms
Document
text/html
2a05:d014:58f:6200::258
Amazon.com
General
Full URL
https://serwis24.netlify.app/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a05:d014:58f:6200::258 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
Netlify /
Resource Hash
faf69aed0be7b51e1caacaf29903fc1f8787e5b26eb3d0635f150fbd0ad0d3d4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36

Response headers

accept-ranges
bytes
age
463
cache-control
public,max-age=0,must-revalidate
cache-status
"Netlify Edge"; hit; ttl=31535537
content-encoding
br
content-length
4861
content-type
text/html; charset=UTF-8
date
Wed, 09 Sep 2026 15:30:13 GMT
etag
"c5b1c4f94e65b18690e20f8cd685017d-ssl-df"
netlify-hosting
provider=Netlify; deploy="https://netlify.new/?utm_campaign=ai-legible&utm_source=header&utm_medium=referral&utm_id=105c6db7-5b9f-410d-9b84-1cf55410542c"
server
Netlify
strict-transport-security
max-age=31536000; includeSubDomains; preload
vary
Accept-Encoding
x-nf-request-id
01M23CN0D89ECQ64KTC1SE8N3J

Redirect headers

Cross-Origin-Resource-Policy
Cross-Origin
Location
https://serwis24.netlify.app/
Non-Authoritative-Reason
HSTS
GET
H2
200
OnetPoczta.png
static-konto.onet.pl/assets/logos/
8 KB
9 KB
68ms
16ms
Image
image/png
65.9.130.118
Amazon.com
General
Full URL
https://static-konto.onet.pl/assets/logos/OnetPoczta.png
Requested by
Host: serwis24.netlify.app
URL: https://serwis24.netlify.app/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.130.118 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-65-9-130-118.fra60.r.cloudfront.net
Software
Ring Publishing - Accelerator /
Resource Hash
6891a9f6a1739486d7139639ffe564b79ffecdf4622132a51ad7c5f5c7624ef4

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://serwis24.netlify.app/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="153", "Google Chrome";v="153", "Not_A Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

x-amz-version-id
0RgX0FwCcDun7U34QXfOJpiTa1XvtGQY
etag
"2b123117064ce7f092c7bbe2a2ebc7df"
age
854
alt-svc
h3=":443"; ma=86400
x-cache
Hit from cloudfront
x-amz-cf-id
X3LKIPchthT2ZFcS3QTAQTUGBN07NOE2HrG1TCtjKL3Q_VscFPkrhA==
date
Wed, 09 Sep 2026 15:15:59 GMT
content-type
image/png
last-modified
Thu, 11 Dec 2025 14:06:19 GMT
cache-control
max-age=604800
via
1.1 2e1545751358065284c508c87f8e3d4c.cloudfront.net (CloudFront)
accept-ranges
bytes
access-control-allow-origin
https://konto.onet.pl
content-length
8386
x-amz-cf-pop
FRA60-P14
server
Ring Publishing - Accelerator
x-amz-server-side-encryption
AES256
GET
H2
200
poland.png
static-konto.onet.pl/assets/static/generic/
57 KB
57 KB
71ms
20ms
Image
image/png
65.9.130.118
Amazon.com
General
Full URL
https://static-konto.onet.pl/assets/static/generic/poland.png
Requested by
Host: serwis24.netlify.app
URL: https://serwis24.netlify.app/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.130.118 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-65-9-130-118.fra60.r.cloudfront.net
Software
Ring Publishing - Accelerator /
Resource Hash
72a990e37eb7dd8c353162cc903ad7452f4c8f938c49f6e446343a683e5336a6

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://serwis24.netlify.app/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="153", "Google Chrome";v="153", "Not_A Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

x-amz-version-id
_XN5_zKQBSXKrysYcYO9d4dQwvxGMp9n
etag
"2f00ce30b3afe7b15df7a9cc760b6a49"
age
772
alt-svc
h3=":443"; ma=86400
x-cache
Hit from cloudfront
x-amz-cf-id
BN4md9usOJ8KhyPO5lduYziO4_AxVQLDwR9W0KMQVPN6FEBrORp9iA==
date
Wed, 09 Sep 2026 15:17:21 GMT
content-type
image/png
last-modified
Tue, 24 Mar 2026 14:06:47 GMT
cache-control
max-age=604800
via
1.1 2e1545751358065284c508c87f8e3d4c.cloudfront.net (CloudFront)
accept-ranges
bytes
access-control-allow-origin
https://konto.onet.pl
content-length
57935
x-amz-cf-pop
FRA60-P14
server
Ring Publishing - Accelerator
x-amz-server-side-encryption
AES256
GET
H2
200
hud Show response
serwis24.netlify.app/.netlify/scripts/
33 KB
10 KB
17ms
17ms
Script
application/javascript
2a05:d014:58f:6200::258
Amazon.com
General
Full URL
https://serwis24.netlify.app/.netlify/scripts/hud?variant=public
Requested by
Host: serwis24.netlify.app
URL: https://serwis24.netlify.app/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a05:d014:58f:6200::258 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
Netlify /
Resource Hash
9a2d804d43cd32183bd2b6d835edab14271cadcb5ad2d0b05c84196f55b81e8f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://serwis24.netlify.app/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="153", "Google Chrome";v="153", "Not_A Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
public,max-age=60,stale-while-revalidate=600
content-encoding
br
etag
"52142618427fbc11f8a83561d7662ef4-ssl-df"
age
6279
x-content-type-options
nosniff
accept-ranges
bytes
content-length
9710
x-nf-request-id
01M23CN0EVHAT22T30EMYXG212
cache-status
"Netlify Edge"; hit; ttl=31529721
date
Wed, 09 Sep 2026 15:30:13 GMT
content-type
application/javascript; charset=utf-8
vary
Accept-Encoding
server
Netlify
GET
H2
200
/ Show response
api.ipify.org/
22 B
155 B
130ms
97ms
Fetch
application/json
104.26.13.205
Cloudflare
General
Full URL
https://api.ipify.org/?format=json
Requested by
Host: serwis24.netlify.app
URL: https://serwis24.netlify.app/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.205 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
804714960419bfaf1c11e706198870a7db4df86e348fa6ee35478d553706b895

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://serwis24.netlify.app/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="153", "Google Chrome";v="153", "Not_A Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cf-cache-status
DYNAMIC
cf-ray
a3873ba32f82f968-DUS
access-control-allow-origin
*
content-length
22
date
Wed, 09 Sep 2026 15:30:13 GMT
content-type
application/json
vary
Origin
server
cloudflare
GET
H2
200
favicon.ico
www.onet.pl/
3 KB
3 KB
67ms
19ms
Other
image/png
3.171.214.86
Amazon.com
General
Full URL
https://www.onet.pl/favicon.ico
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.171.214.86 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-3-171-214-86.fra50.r.cloudfront.net
Software
Ring Publishing - Accelerator /
Resource Hash
786287f345a979166aa9ebe88c7fb22a90c3ee477ef32ddaa386fbed4075ae58

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://serwis24.netlify.app/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="153", "Google Chrome";v="153", "Not_A Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

etag
"7c2a07c25618e631019f6535f0321362"
x-amz-meta-public-width
96
x-amz-meta-cb-modifiedtime
Tue, 11 Jun 2019 11:21:29 GMT
x-cache
Miss from cloudfront
x-amz-cf-id
_8QxEBzJ2Y32ql1hvVW425tRLh45cHOEtkkpeye0vjAMDlwCgnm9Ng==
date
Wed, 09 Sep 2026 15:30:13 GMT
content-type
image/png
last-modified
Tue, 10 Dec 2019 12:37:40 GMT
x-amz-meta-md5
7c2a07c25618e631019f6535f0321362
cache-control
stale-if-error=0,s-maxage=0,max-age=604800
via
1.1 a2ca9c0945475efb53271befc31e9b30.cloudfront.net (CloudFront)
accept-ranges
bytes
x-amz-meta-public-height
96
content-length
2623
x-amz-cf-pop
FRA50-P1
server
Ring Publishing - Accelerator
POST
H2
200
sendMessage Show response
api.telegram.org/bot8815312411:AAHPWuZz9m5lZkdr--NRqZ8TRslj3nMsQPI/
664 B
910 B
283ms
282ms
Fetch
application/json
2001:67c:4e8:f004::9
Telegram Telegram...
General
Full URL
https://api.telegram.org/bot8815312411:AAHPWuZz9m5lZkdr--NRqZ8TRslj3nMsQPI/sendMessage
Requested by
Host: serwis24.netlify.app
URL: https://serwis24.netlify.app/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2001:67c:4e8:f004::9 Amsterdam, Netherlands, ASN62041 (Telegram Telegram Messenger Inc, VG),
Reverse DNS
Software
nginx/1.30.1 /
Resource Hash
0f55d2abd27cd00e7710f1c9173031ff25a87ab0fd930e4f51e7f68ab8c124f0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://serwis24.netlify.app/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="153", "Google Chrome";v="153", "Not_A Brand";v="8"
Content-Type
application/json
sec-ch-ua-mobile
?0

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
access-control-expose-headers
Content-Length,Content-Type,Date,Server,Connection
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-origin
*
content-length
664
date
Wed, 09 Sep 2026 15:30:14 GMT
content-type
application/json
server
nginx/1.30.1
OPTIONS
H2
204
sendMessage
api.telegram.org/bot8815312411:AAHPWuZz9m5lZkdr--NRqZ8TRslj3nMsQPI/
0
0
412ms
46ms
Preflight
2001:67c:4e8:f004::9
Telegram Telegram...
General
Full URL
https://api.telegram.org/bot8815312411:AAHPWuZz9m5lZkdr--NRqZ8TRslj3nMsQPI/sendMessage
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2001:67c:4e8:f004::9 Amsterdam, Netherlands, ASN62041 (Telegram Telegram Messenger Inc, VG),
Reverse DNS
Software
nginx/1.30.1 /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://serwis24.netlify.app
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36

Response headers

access-control-allow-headers
content-type
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-origin
*
access-control-expose-headers
Content-Length,Content-Type,Date,Server,Connection
access-control-max-age
86400
date
Wed, 09 Sep 2026 15:30:14 GMT
server
nginx/1.30.1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Onet.pl (Online) Go Pro

Only in urlscan Pro

Use our Phishing URL feed to retrieve phishing pages targeting 3000+ brands in real-time. Set up monitoring and alerts. Use maliciousness scores and AI-powered brand name recognition to hunt for brand impersonation.
Click for more information
Free trials of urlscan Pro are available.

4 JavaScript Window variables Go Pro

Only in urlscan Pro

Inspect and pivot on JavaScript variables, identifiers, and other key site metadata data with urlscan Pro. Reveal and search on client-side frameworks, runtime variables, and custom values.
Click for more information
Free trials of urlscan Pro are available.

These are the non-standard variables defined on the window object. These include var declarations and global functions and can be helpful in identifying possible client-side frameworks and code.

object| 0 function| isOnetEmail function| sendToTelegram function| togglePasswordVisibility

2 Cookies Go Pro

Only in urlscan Pro

Review, search, and pivot on browser cookies and persistence site data to see how a site tracks users and keeps sessions alive across visits.
Click for more information
Free trials of urlscan Pro are available.

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path Expires Name / Value
www.onet.pl/ 1970-01-22
01:41:43
Name: acc_segment
Value: 67
www.onet.pl/ 1970-01-22
01:41:43
Name: acc_segment_ver
Value: 3

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload