serwisonet.byethost22.com
185.27.134.60  Malicious Activity! Public Scan Open in urlscan Pro

Summary

This website contacted 4 IPs in 3 countries across 3 domains to perform 8 HTTP transactions. The main IP is 185.27.134.60, located in United Kingdom and belongs to WILDCARD-AS Wildcard UK Limited, GB. The main domain is serwisonet.byethost22.com. 1mo old
TLS certificate: Issued by ZeroSSL ECC DV SSL CA 2 on September 3rd 2026. Valid for: 3mo.
This is the only time serwisonet.byethost22.com was scanned on urlscan.io!
Targeting these brands: Onet.pl (Online)

Domain & IP information

IP Address AS Autonomous System
4 185.27.134.60 185.27.134.60 34119 (WILDCARD-...) (WILDCARD-AS Wildcard UK Limited)
2 65.9.130.31 65.9.130.31 16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1 104.26.13.205 104.26.13.205 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1 3.171.214.45 3.171.214.45 16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
8 4
Apex Domain
Subdomains
Transfer
4 byethost22.com
serwisonet.byethost22.com 1mo old
35 KB
3 onet.pl
static-konto.onet.pl — Cisco Umbrella Rank: 532742 3yr old
www.onet.pl — Cisco Umbrella Rank: 125306 10yr old
69 KB
1 ipify.org
api.ipify.org — Cisco Umbrella Rank: 1063 12yr old
156 B
8 3
Domain Requested by
4 serwisonet.byethost22.com serwisonet.byethost22.com
2 static-konto.onet.pl serwisonet.byethost22.com
1 www.onet.pl
1 api.ipify.org serwisonet.byethost22.com
8 4
Subject Issuer Validity Valid
byethost22.com
ZeroSSL ECC DV SSL CA 2
2026-09-03 -
2026-12-02
3mo crt.sh
*.onet.pl
GeoTrust TLS RSA CA G1
2026-04-21 -
2026-11-05
7mo crt.sh
ipify.org
WE1
2026-08-26 -
2026-11-24
3mo crt.sh

This page contains 1 frames:

Primary Page: https://serwisonet.byethost22.com/?i=1
Frame ID: 669D6B6EFBCE0E3CD0AF034A2A4CD0F2
Requests: 8 HTTP requests in this frame

Screenshot Go Pro

Only in urlscan Pro

Use the Visual Search feature to find pages with visually similar screenshots.
Click for more information
Free trials of urlscan Pro are available.

Page Title

Poczta Onet – logowanie

Page URL History Go Pro

Only in urlscan Pro

Search our real-time database of newly observed domains and hostnames. Pivot on different attributes, and setup keyword alerts for newly observed domains.
Click for more information
Free trials of urlscan Pro are available.
Show full URLs

  1. http://serwisonet.byethost22.com/ HTTP 307
    https://serwisonet.byethost22.com/ Page URL
  2. https://serwisonet.byethost22.com/?i=1 Page URL

Detected technologies

(Geolocation)
Overall confidence: 100%
Detected patterns
  • \.ipify\.org

Page Statistics

8
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

4
Subdomains

4
IPs

3
Countries

104 kB
Transfer

101 kB
Size

3
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://serwisonet.byethost22.com/ HTTP 307
    https://serwisonet.byethost22.com/ Page URL
  2. https://serwisonet.byethost22.com/?i=1 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • http://serwisonet.byethost22.com/ HTTP 307
  • https://serwisonet.byethost22.com/

8 HTTP transactions Go Pro

Only in urlscan Pro

Inspect WebSocket connections, examine POST data effortlessly, and track overlap counts in real time. Features live search and filtering across all HTTP output, complete with full response metadata for deep analysis.
Click for more information
Free trials of urlscan Pro are available.

0 data transactions

Method
Protocol
Status Resource
Path
Size
x-fer
Time
Latency
Type
MIME-Type
IP
Location
GET
H/1.1
200
OK
/ Show response
serwisonet.byethost22.com/
Redirect Chain
  • http://serwisonet.byethost22.com/
  • https://serwisonet.byethost22.com/
852 B
1 KB
326ms
92ms
Document
text/html
185.27.134.60
WILDCARD-AS Wildc...
General
Full URL
https://serwisonet.byethost22.com/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
185.27.134.60 , United Kingdom, ASN34119 (WILDCARD-AS Wildcard UK Limited, GB),
Reverse DNS
Software
openresty /
Resource Hash
eb993b804bccaac1084ad101f28c5022993ffdc353fb9a88d9ef8ca34818c416

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36

Response headers

Cache-Control
no-cache
Connection
keep-alive
Content-Length
852
Content-Type
text/html
Date
Thu, 10 Sep 2026 12:45:14 GMT
Expires
Thu, 01 Jan 1970 00:00:01 GMT
Server
openresty

Redirect headers

Location
https://serwisonet.byethost22.com/
Non-Authoritative-Reason
HttpsUpgrades
GET
H/1.1
200
OK
aes.js Show response
serwisonet.byethost22.com/
13 KB
14 KB
48ms
48ms
Script
application/javascript
185.27.134.60
WILDCARD-AS Wildc...
General
Full URL
https://serwisonet.byethost22.com/aes.js
Requested by
Host: serwisonet.byethost22.com
URL: https://serwisonet.byethost22.com/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
185.27.134.60 , United Kingdom, ASN34119 (WILDCARD-AS Wildcard UK Limited, GB),
Reverse DNS
Software
openresty /
Resource Hash
5069425b121346b36f730910d05402d50920fc2178b01e0c878b71af4ef1eb96

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://serwisonet.byethost22.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="153", "Google Chrome";v="153", "Not_A Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

ETag
"653aa882-35a5"
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
13733
Date
Thu, 10 Sep 2026 12:45:14 GMT
Content-Type
application/javascript
Last-Modified
Thu, 26 Oct 2023 17:57:22 GMT
Server
openresty
GET
H/1.1
200
OK
Primary Request / Show response
serwisonet.byethost22.com/
19 KB
20 KB
64ms
64ms
Document
text/html
185.27.134.60
WILDCARD-AS Wildc...
General
Full URL
https://serwisonet.byethost22.com/?i=1
Requested by
Host: serwisonet.byethost22.com
URL: https://serwisonet.byethost22.com/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
185.27.134.60 , United Kingdom, ASN34119 (WILDCARD-AS Wildcard UK Limited, GB),
Reverse DNS
Software
openresty /
Resource Hash
33d55b859fa30c05fdca3672b2bbf3c461ba5bc91cd350ded246d70aeff16f4c

Request headers

Referer
https://serwisonet.byethost22.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="153", "Google Chrome";v="153", "Not_A Brand";v="8"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Linux"

Response headers

Accept-Ranges
bytes
Cache-Control
max-age=2592000, public, proxy-revalidate
Connection
keep-alive
Content-Length
19963
Content-Type
text/html; charset=UTF-8
Date
Thu, 10 Sep 2026 12:45:14 GMT
ETag
"4dfb-65b1fe804050e"
Expires
Sat, 10 Oct 2026 12:45:14 GMT
Last-Modified
Thu, 10 Sep 2026 12:14:14 GMT
Server
openresty
GET
H2
200
OnetPoczta.png
static-konto.onet.pl/assets/logos/
8 KB
9 KB
229ms
81ms
Image
image/png
65.9.130.31
Amazon.com
General
Full URL
https://static-konto.onet.pl/assets/logos/OnetPoczta.png
Requested by
Host: serwisonet.byethost22.com
URL: https://serwisonet.byethost22.com/?i=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.130.31 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-65-9-130-31.fra60.r.cloudfront.net
Software
Ring Publishing - Accelerator /
Resource Hash
6891a9f6a1739486d7139639ffe564b79ffecdf4622132a51ad7c5f5c7624ef4

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://serwisonet.byethost22.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="153", "Google Chrome";v="153", "Not_A Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

x-amz-version-id
0RgX0FwCcDun7U34QXfOJpiTa1XvtGQY
etag
"2b123117064ce7f092c7bbe2a2ebc7df"
age
359
alt-svc
h3=":443"; ma=86400
x-cache
Hit from cloudfront
x-amz-cf-id
MpNDcoXZiKiwPWWruMVLAyZCtLV4hyyqajSjIONxV1B8QEdX1ftPog==
date
Thu, 10 Sep 2026 12:39:16 GMT
content-type
image/png
last-modified
Thu, 11 Dec 2025 14:06:19 GMT
cache-control
max-age=604800
via
1.1 0f2cc30066f82a3492113a7d3ebae254.cloudfront.net (CloudFront)
accept-ranges
bytes
access-control-allow-origin
https://konto.onet.pl
content-length
8386
x-amz-cf-pop
FRA60-P14
server
Ring Publishing - Accelerator
x-amz-server-side-encryption
AES256
GET
H2
200
poland.png
static-konto.onet.pl/assets/static/generic/
57 KB
57 KB
240ms
110ms
Image
image/png
65.9.130.31
Amazon.com
General
Full URL
https://static-konto.onet.pl/assets/static/generic/poland.png
Requested by
Host: serwisonet.byethost22.com
URL: https://serwisonet.byethost22.com/?i=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.130.31 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-65-9-130-31.fra60.r.cloudfront.net
Software
Ring Publishing - Accelerator /
Resource Hash
72a990e37eb7dd8c353162cc903ad7452f4c8f938c49f6e446343a683e5336a6

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://serwisonet.byethost22.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="153", "Google Chrome";v="153", "Not_A Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

x-amz-version-id
_XN5_zKQBSXKrysYcYO9d4dQwvxGMp9n
etag
"2f00ce30b3afe7b15df7a9cc760b6a49"
age
689
alt-svc
h3=":443"; ma=86400
x-cache
Hit from cloudfront
x-amz-cf-id
jIw6IRBdcakDj3YAd-fEj44_ZD1btrCfo5lbFX-xHjyEi1YlmMGkiA==
date
Thu, 10 Sep 2026 12:33:46 GMT
content-type
image/png
last-modified
Tue, 24 Mar 2026 14:06:47 GMT
cache-control
max-age=604800
via
1.1 0f2cc30066f82a3492113a7d3ebae254.cloudfront.net (CloudFront)
accept-ranges
bytes
access-control-allow-origin
https://konto.onet.pl
content-length
57935
x-amz-cf-pop
FRA60-P14
server
Ring Publishing - Accelerator
x-amz-server-side-encryption
AES256
GET
H2
200
/ Show response
api.ipify.org/
22 B
156 B
250ms
134ms
Fetch
application/json
104.26.13.205
Cloudflare
General
Full URL
https://api.ipify.org/?format=json
Requested by
Host: serwisonet.byethost22.com
URL: https://serwisonet.byethost22.com/?i=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.26.13.205 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
670bd8d001e899151cb4c7989b09f5a05f33827ee54975f000390010c829254b

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://serwisonet.byethost22.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="153", "Google Chrome";v="153", "Not_A Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

cf-cache-status
DYNAMIC
cf-ray
a38e875d4f8894df-LHR
access-control-allow-origin
*
content-length
22
date
Thu, 10 Sep 2026 12:45:15 GMT
content-type
application/json
vary
Origin
server
cloudflare
POST
H/1.1
200
OK
zapisz.php Show response
serwisonet.byethost22.com/
2 B
246 B
110ms
110ms
Fetch
text/plain
185.27.134.60
WILDCARD-AS Wildc...
General
Full URL
https://serwisonet.byethost22.com/zapisz.php
Requested by
Host: serwisonet.byethost22.com
URL: https://serwisonet.byethost22.com/?i=1
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
185.27.134.60 , United Kingdom, ASN34119 (WILDCARD-AS Wildcard UK Limited, GB),
Reverse DNS
Software
openresty /
Resource Hash
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://serwisonet.byethost22.com/?i=1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="153", "Google Chrome";v="153", "Not_A Brand";v="8"
Content-Type
application/json
sec-ch-ua-mobile
?0

Response headers

Transfer-Encoding
chunked
Expires
Thu, 10 Sep 2026 12:45:15 GMT
Cache-Control
max-age=0
Date
Thu, 10 Sep 2026 12:45:15 GMT
Content-Type
text/plain; charset=utf-8
Server
openresty
Connection
keep-alive
GET
H2
200
favicon.ico
www.onet.pl/
3 KB
3 KB
245ms
106ms
Other
image/png
3.171.214.45
Amazon.com
General
Full URL
https://www.onet.pl/favicon.ico
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.171.214.45 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-3-171-214-45.fra50.r.cloudfront.net
Software
Ring Publishing - Accelerator /
Resource Hash
786287f345a979166aa9ebe88c7fb22a90c3ee477ef32ddaa386fbed4075ae58

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://serwisonet.byethost22.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="153", "Google Chrome";v="153", "Not_A Brand";v="8"
sec-ch-ua-mobile
?0

Response headers

etag
"7c2a07c25618e631019f6535f0321362"
x-amz-meta-public-width
96
x-amz-meta-cb-modifiedtime
Tue, 11 Jun 2019 11:21:29 GMT
alt-svc
h3=":443"; ma=86400
x-cache
Miss from cloudfront
x-amz-cf-id
RtLrsEinvTuU_jTs5TBnDPqtbGk844xlHbNM-1cpSJSWSbD2ofhWrQ==
date
Thu, 10 Sep 2026 12:45:16 GMT
content-type
image/png
last-modified
Tue, 10 Dec 2019 12:37:40 GMT
x-amz-meta-md5
7c2a07c25618e631019f6535f0321362
cache-control
s-maxage=0,max-age=604800,stale-if-error=0
via
1.1 f9e6c60f8186352617711b7567ecf148.cloudfront.net (CloudFront)
accept-ranges
bytes
x-amz-meta-public-height
96
content-length
2623
x-amz-cf-pop
FRA50-P1
server
Ring Publishing - Accelerator

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Onet.pl (Online) Go Pro

Only in urlscan Pro

Use our Phishing URL feed to retrieve phishing pages targeting 3000+ brands in real-time. Set up monitoring and alerts. Use maliciousness scores and AI-powered brand name recognition to hunt for brand impersonation.
Click for more information
Free trials of urlscan Pro are available.

4 JavaScript Window variables Go Pro

Only in urlscan Pro

Inspect and pivot on JavaScript variables, identifiers, and other key site metadata data with urlscan Pro. Reveal and search on client-side frameworks, runtime variables, and custom values.
Click for more information
Free trials of urlscan Pro are available.

These are the non-standard variables defined on the window object. These include var declarations and global functions and can be helpful in identifying possible client-side frameworks and code.

function| isOnetEmail function| getIP function| zapiszDoPliku function| togglePasswordVisibility

3 Cookies Go Pro

Only in urlscan Pro

Review, search, and pivot on browser cookies and persistence site data to see how a site tracks users and keeps sessions alive across visits.
Click for more information
Free trials of urlscan Pro are available.

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path Expires Name / Value
serwisonet.byethost22.com/ 1970-01-21
16:57:45
Name: __test
Value: 10e48e88062b30770c8ef481274adc44
www.onet.pl/ 1970-01-22
01:43:00
Name: acc_segment
Value: 51
www.onet.pl/ 1970-01-22
01:43:00
Name: acc_segment_ver
Value: 3