ktkvisokoddustecaju.com.ba
Open in
urlscan Pro
80.65.85.142
Malicious Activity!
Public Scan
Submitted URL: https://cutt.ly/swHGuuYl
Effective URL: https://ktkvisokoddustecaju.com.ba/ipko/
Submission: On January 08 via manual from PL — Scanned from PL
Effective URL: https://ktkvisokoddustecaju.com.ba/ipko/
Submission: On January 08 via manual from PL — Scanned from PL
Summary
This website contacted 6 IPs
in 4 countries
across 6 domains to perform 18 HTTP transactions.
The main IP is 80.65.85.142, located in
Sarajevo, Bosnia & Herzegovina and
belongs to BIHNET BIHNET Autonomus System, BA.
The main domain is ktkvisokoddustecaju.com.ba.
TLS certificate: Issued by R3 on January 7th 2024. Valid for: 3 months.
This is the only time ktkvisokoddustecaju.com.ba was scanned on urlscan.io!
TLS certificate: Issued by R3 on January 7th 2024. Valid for: 3 months.
This is the only time ktkvisokoddustecaju.com.ba was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: PKO Bank Polski (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 1 | 172.67.8.238 172.67.8.238 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
| 1 | 162.240.229.250 162.240.229.250 | 46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1) | |
| 12 | 80.65.85.142 80.65.85.142 | 9146 (BIHNET BI...) (BIHNET BIHNET Autonomus System) | |
| 2 | 193.109.225.70 193.109.225.70 | 21344 (INTELIGO) (INTELIGO) | |
| 1 | 149.154.167.220 149.154.167.220 | 62041 (TELEGRAM) (TELEGRAM) | |
| 2 | 193.109.225.100 193.109.225.100 | 21344 (INTELIGO) (INTELIGO) | |
| 18 | 6 |
1
162.240.229.250
(United States)
ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: vps-10188914.bilhetepremium.com
ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: vps-10188914.bilhetepremium.com
| bilhetepremium.com |
12
80.65.85.142
(Sarajevo, Bosnia & Herzegovina)
ASN9146 (BIHNET BIHNET Autonomus System, BA)
PTR: web02.hosting.bhtelecom.ba
ASN9146 (BIHNET BIHNET Autonomus System, BA)
PTR: web02.hosting.bhtelecom.ba
| ktkvisokoddustecaju.com.ba |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 12 |
ktkvisokoddustecaju.com.ba
ktkvisokoddustecaju.com.ba |
433 KB |
| 2 |
pkobp.pl
www.pkobp.pl — Cisco Umbrella Rank: 256889 |
38 KB |
| 2 |
ipko.pl
www.ipko.pl — Cisco Umbrella Rank: 444848 |
24 KB |
| 1 |
telegram.org
api.telegram.org — Cisco Umbrella Rank: 22535 |
|
| 1 |
bilhetepremium.com
bilhetepremium.com |
335 B |
| 1 |
cutt.ly
1 redirects
cutt.ly — Cisco Umbrella Rank: 43080 |
398 B |
| 18 | 6 |
| Domain | Requested by | |
|---|---|---|
| 12 | ktkvisokoddustecaju.com.ba |
ktkvisokoddustecaju.com.ba
|
| 2 | www.pkobp.pl |
ktkvisokoddustecaju.com.ba
|
| 2 | www.ipko.pl |
ktkvisokoddustecaju.com.ba
|
| 1 | api.telegram.org |
ktkvisokoddustecaju.com.ba
|
| 1 | bilhetepremium.com | |
| 1 | cutt.ly | 1 redirects |
| 18 | 6 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| iko.pkobp.pl |
| www.pkobp.pl |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| bilhetepremium.com cPanel, Inc. Certification Authority |
2023-12-05 - 2024-03-04 |
3 months | crt.sh |
| ktkvisokoddustecaju.com.ba R3 |
2024-01-07 - 2024-04-06 |
3 months | crt.sh |
| ipko.pl Certum Extended Validation CA SHA2 |
2023-08-11 - 2024-08-10 |
a year | crt.sh |
| api.telegram.org Go Daddy Secure Certificate Authority - G2 |
2023-03-26 - 2024-04-26 |
a year | crt.sh |
| pkobp.pl Certum Extended Validation CA SHA2 |
2023-12-28 - 2024-12-27 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://ktkvisokoddustecaju.com.ba/ipko/
Frame ID: FC5C6361E83F43828BCC048ACD325440
Requests: 20 HTTP requests in this frame
Screenshot
Page Title
Strona logowania | iPKO - bankowość elektroniczna PKO Banku PolskiegoPage URL History Show full URLs
-
https://cutt.ly/swHGuuYl
HTTP 301
https://bilhetepremium.com/ipko.html Page URL
- https://ktkvisokoddustecaju.com.ba/ipko/ Page URL
Page Statistics
11 Outgoing links
These are links going to different origins than the main page.
URL: http://iko.pkobp.pl/
Title: Open in new tab Pobierz darmową aplikację IKO
Title: Open in new tab Pobierz darmową aplikację IKO
Search URL Search Domain Scan URL
URL: https://www.pkobp.pl/klienci-indywidualni/konta/konta-osobiste/zostan-naszym-klientem/
Title: Open in new tab Nie masz konta?
Title: Open in new tab Nie masz konta?
Search URL Search Domain Scan URL
URL: https://www.pkobp.pl/klient-indywidualny/uslugi-zakupy/karty-podarunkowe
Title: Open in new tab Więcej
Title: Open in new tab Więcej
Search URL Search Domain Scan URL
URL: https://www.pkobp.pl/aktualnosci/bezpieczenstwo/just-imagine-that-electronic-banking-is-like-your-wallet/
Title: Open in new tab Otwórz w nowej karcie Odwiedź stronę banku
Title: Open in new tab Otwórz w nowej karcie Odwiedź stronę banku
Search URL Search Domain Scan URL
URL: https://www.pkobp.pl/aktualnosci/bezpieczenstwo/po-co-mi-powiadomienia-od-banku/
Title: Otwórz w nowej karcie Więcej
Title: Otwórz w nowej karcie Więcej
Search URL Search Domain Scan URL
URL: https://www.pkobp.pl/
Title: Open in new tab © 2023 PKO Bank Polski
Title: Open in new tab © 2023 PKO Bank Polski
Search URL Search Domain Scan URL
URL: https://www.pkobp.pl/klienci-indywidualni/operacje-zagraniczne/bic-swift-i-iban/
Title: Open in new tab BIC Code (Swift): BPKOPLPW
Title: Open in new tab BIC Code (Swift): BPKOPLPW
Search URL Search Domain Scan URL
URL: https://www.pkobp.pl/polityka-prywatnosci/
Title: Open in new tab Polityka prywatności
Title: Open in new tab Polityka prywatności
Search URL Search Domain Scan URL
URL: https://www.pkobp.pl/klienci-indywidualni/bankowosc-elektroniczna/bezpieczenstwo/
Title: Open in new tab Safety
Title: Open in new tab Safety
Search URL Search Domain Scan URL
URL: https://www.pkobp.pl/klienci-indywidualni/bankowosc-elektroniczna/zacznij-korzystac/
Title: Open in new tab Help
Title: Open in new tab Help
Search URL Search Domain Scan URL
URL: https://www.pkobp.pl/klienci-indywidualni/bankowosc-elektroniczna/serwis-telefoniczny/
Title: Open in new tab Kontakt
Title: Open in new tab Kontakt
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://cutt.ly/swHGuuYl
HTTP 301
https://bilhetepremium.com/ipko.html Page URL
- https://ktkvisokoddustecaju.com.ba/ipko/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://cutt.ly/swHGuuYl HTTP 301
- https://bilhetepremium.com/ipko.html
18 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
ipko.html
bilhetepremium.com/ Redirect Chain
|
94 B 335 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
Primary Request
/
ktkvisokoddustecaju.com.ba/ipko/ |
2 MB 298 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
/
www.ipko.pl/nudatasecurity/2.2/w/w-573441/init/js/ |
537 B 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
/
www.ipko.pl/nudatasecurity/2.2/w/w-573441/sync/js/ |
52 KB 23 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
sendMessage
api.telegram.org/bot6573290325:AAEvelVpIrt8xdhrjrnKW64CrJhhUAdobyU/ |
0 0 |
Image
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
_62247748.svg
www.pkobp.pl/media_files/CiCCh/iPKO/ |
1 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
17022-17041-KV-kasa_swieta-570x570px_CjYi3Ls_208_208.png
www.pkobp.pl/media_files/CiCCh/iPKO/ |
37 KB 37 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
3725.d665aefa1f0ca28e2746.js
ktkvisokoddustecaju.com.ba/ipko/ |
111 KB 36 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
common.297bc6fcd5611b1b0bce.js
ktkvisokoddustecaju.com.ba/ipko/ |
2 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
login.969ad21781ae70c71a91.js
ktkvisokoddustecaju.com.ba/ipko/ |
301 B 311 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
830 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
3 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
PKOBankPolski-Regular.woff
ktkvisokoddustecaju.com.ba/ipko/ipko/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
PKOBankPolski-Light.woff
ktkvisokoddustecaju.com.ba/ipko/ipko/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
PKOBankPolski-Bold.woff
ktkvisokoddustecaju.com.ba/ipko/ipko/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
PKOBankPolski-Regular.ttf
ktkvisokoddustecaju.com.ba/ipko/ipko/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
PKOBankPolski-Light.ttf
ktkvisokoddustecaju.com.ba/ipko/ipko/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
PKOBankPolski-Bold.ttf
ktkvisokoddustecaju.com.ba/ipko/ipko/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
aimgs.json
ktkvisokoddustecaju.com.ba/ikd_scripts/skins/ipko/ |
66 KB 66 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
PKOBankPolski-Regular.woff
ktkvisokoddustecaju.com.ba/ipko/ |
31 KB 31 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: PKO Bank Polski (Banking)119 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| documentPictureInPicture string| ndjsStaticVersion object| nslyyidtyi function| nsbopifkz object| nslgf function| nsgukkeb boolean| nsdwhx number| nsviymjoy function| getEnabledEvents number| nsbopifk object| nsbopi function| nsgukkebkh function| nscavjydje object| nsgukk object| nscav object| nsgukkebk object| nsviymjoyg object| nslyyidt function| nseyqlyr boolean| nsfkgjo string| nscavjy object| nscavj object| nslyyid object| nds object| nsdwhxu number| numQueries function| attachEventListener function| nsyohyfq object| returned string| version string| ndsWidgetVersion undefined| nsviym function| nspkx function| nstuky string| nsviy function| nstnagvv string| nsfkgjoq string| nsdwhxurq string| nsfkgjoqr string| nsdwhxur string| nsfkgj object| nsdwhxurqd object| nslgfnp function| nsguk function| nstna function| nsgukke function| nslyyi function| nseyqlyrf function| nstuk function| nsejsnf function| nsuksw function| validateSessionIdCookie function| nsyohy function| nstnagv function| nstukyivzx function| nsamh function| HashUtil function| nsyohyf function| nsuksww function| nsamhnfk function| nstnag function| nsejsn function| nsyohyfqp function| nsejsnfwm function| nsukswwaaw function| nstnagvvl function| nstukyiv function| nsyoh object| nsbopifkzi string| nslyyidty string| NDS_LISTEN_FOCUS string| NDS_LISTEN_TOUCH string| NDS_LISTEN_KEYBOARD string| NDS_LISTEN_DEVICE_MOTION_SENSORS string| NDS_LISTEN_MOUSE string| NDS_LISTEN_FORM string| NDS_LISTEN_ALL string| NDS_LISTEN_NONE function| nsuks string| nslgfnpyxj function| nstnagvvln string| nsviymjo string| nslgfn function| nseyq string| nslgfnpyx function| nsamhnfki string| nscavjyd function| nseyql string| nsfkg string| nsfkgjoqrf string| nslyy string| nsbop function| nsukswwa string| nslgfnpy string| nsviymj string| nsdwh object| nsbopif function| nsejsnfwmi function| ndoIsKeyIncluded function| ndoIsModifierKey function| nstukyivz function| ndoIsNavigationKey function| ndoIsEditingKey function| nsyohyfqpw object| KEYBOARD_LOCATION object| KEY_TYPE_AND_LOCATION function| nseyqlyrfu function| ndoGetKeyboardLocation function| ndoGetKeyTypeAndLocationIndicator function| ndoGetObjectKeys function| nsejsnfw function| ndwti boolean| nscavjydj function| nstukyi function| nspkxyn function| nsukswwaa function| ndwts object| ndsapi object| webpackChunkipko2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| cutt.ly/ | Name: PHPSESSID Value: 47t9lei6lltoasgtdrj9q5dm0v |
|
| www.ipko.pl/ | Name: ndcd Value: wc1.1.w-729460.1.2.AchrgL0ttiTh13lzSV_Qyw%252C%252C.6sWUCxRyc93NNoRNiRd24mNreGoUUei3XgJJAwB1WNg_-GRvT_oHBpYY6JNmulUzRFgFryi1xmOeFQES6kAY3iyZvdVwQE99qxQOwnmE8krC0scujyTIRCNLSn7NUcNjyzVrm2Xa1QcL1hpVEs6xUKjIzNd8kUH0PvPG_bE4nNrqiutuHvHhl2KLnhn78t0e |
7 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
api.telegram.org
bilhetepremium.com
cutt.ly
ktkvisokoddustecaju.com.ba
www.ipko.pl
www.pkobp.pl
149.154.167.220
162.240.229.250
172.67.8.238
193.109.225.100
193.109.225.70
80.65.85.142
0381c266ce035d23496500e9e23472ed69591d37410f8b878857580fb1ea7b39
03d8b8909735354fedec1b686509d05533e4eac3e7c9993cb29804c557e1a359
08e8695cc1177aba498bb4f0e97d406ab707ea76594495a0835708a120cf46ea
29ece7b2e689f637d125e4049a960fd9d5a5a71ead05cb4a89660221bd671038
376746c4617eecd9cec806ae380b57e9164f94167fe69c88a7455d091493cd95
6d371646f5fdf11110e7550388cb39b7533b0fe729192adbff255a24629ea461
830c51b7b727300cc2c08870800f300ccabd41eb95be16fc3768092922b36f88
83b1c861f448ddaca0c252f1fa51603ddee7fd3a08ff3b70eeabfa49661cdaf9
8e7e79dafc4a6d6e89355dabefa7f2694d807de72306ced7c3d020639943c9e8
c85ddecf645041ecb286c8a758c1c82dedf99a6922cf6ffdad454d0f5f6db48f
cf01af45fa0ca8aa5245bf855d17010e6828a95e380e0521955138f799f9aa5b
d4a6be2a57f320225168cceff70cac3b4ef69257d6350f930e11a329e6c35c8c
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ebcbebf307c1f1798a72831711d015d550a13698d6469f4c71da79eeb525b626