finansowa-gov-pl.online Open in urlscan Pro
185.68.16.188  Malicious Activity! Public Scan

URL: https://finansowa-gov-pl.online/mil/index.php
Submission: On March 27 via api from US — Scanned from PL

Summary

This website contacted 3 IPs in 3 countries across 3 domains to perform 12 HTTP transactions. The main IP is 185.68.16.188, located in Ukraine and belongs to UKRAINE-AS, UA. The main domain is finansowa-gov-pl.online.
TLS certificate: Issued by R3 on March 27th 2023. Valid for: 3 months.
This is the only time finansowa-gov-pl.online was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Bank Millenium (Banking)

Domain & IP information

IP Address AS Autonomous System
10 185.68.16.188 200000 (UKRAINE-AS)
1 188.114.98.0 13335 (CLOUDFLAR...)
1 142.250.186.170 15169 (GOOGLE)
12 3
Apex Domain
Subdomains
Transfer
10 finansowa-gov-pl.online
finansowa-gov-pl.online
124 KB
1 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 31
1 KB
1 cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 194
17 KB
12 3
Domain Requested by
10 finansowa-gov-pl.online finansowa-gov-pl.online
1 fonts.googleapis.com finansowa-gov-pl.online
1 cdnjs.cloudflare.com finansowa-gov-pl.online
12 3

This site contains no links.

Subject Issuer Validity Valid
finansowa-gov-pl.online
R3
2023-03-27 -
2023-06-25
3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2022-08-03 -
2023-08-02
a year crt.sh
upload.video.google.com
GTS CA 1C3
2023-03-06 -
2023-05-29
3 months crt.sh

This page contains 1 frames:

Primary Page: https://finansowa-gov-pl.online/mil/index.php
Frame ID: 4FCE79C6269DE9E111BDDD5E43B3873A
Requests: 12 HTTP requests in this frame

Screenshot

Page Title

Bank Millennium

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

12
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

143 kB
Transfer

310 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request index.php
finansowa-gov-pl.online/mil/
2 KB
1 KB
Document
General
Full URL
https://finansowa-gov-pl.online/mil/index.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.68.16.188 , Ukraine, ASN200000 (UKRAINE-AS, UA),
Reverse DNS
web410.default-host.net
Software
nginx /
Resource Hash
d8cda8a8242ade1a56b3b4da0b595492936a3f277ed8cff46ec6df622453b72f

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1
accept-language
pl-PL,pl;q=0.9

Response headers

content-encoding
br
content-type
text/html; charset=UTF-8
date
Mon, 27 Mar 2023 17:28:58 GMT
server
nginx
x-ray
p999:0.006/wn32655:0.010/wa32655:D=4399
main.css
finansowa-gov-pl.online/mil/css/
7 KB
2 KB
Stylesheet
General
Full URL
https://finansowa-gov-pl.online/mil/css/main.css
Requested by
Host: finansowa-gov-pl.online
URL: https://finansowa-gov-pl.online/mil/index.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.68.16.188 , Ukraine, ASN200000 (UKRAINE-AS, UA),
Reverse DNS
web410.default-host.net
Software
nginx /
Resource Hash
d64e7c157c543844c63dffb79767d27dd0f24ddb45759b9f7b3120a131f684d7

Request headers

accept-language
pl-PL,pl;q=0.9
Referer
https://finansowa-gov-pl.online/mil/index.php
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date
Mon, 27 Mar 2023 17:28:58 GMT
x-ray
p999:0.010/wn32655:0.000/
content-encoding
br
last-modified
Sun, 04 Dec 2022 14:29:52 GMT
server
nginx
etag
W/"638caee0-1beb"
content-type
text/css
media.css
finansowa-gov-pl.online/mil/css/
330 B
493 B
Stylesheet
General
Full URL
https://finansowa-gov-pl.online/mil/css/media.css
Requested by
Host: finansowa-gov-pl.online
URL: https://finansowa-gov-pl.online/mil/index.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.68.16.188 , Ukraine, ASN200000 (UKRAINE-AS, UA),
Reverse DNS
web410.default-host.net
Software
nginx /
Resource Hash
c9d5cca50f26f81c7e5efb2af59ed946a792b4e2377adef56f8370009d9a46c1

Request headers

accept-language
pl-PL,pl;q=0.9
Referer
https://finansowa-gov-pl.online/mil/index.php
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date
Mon, 27 Mar 2023 17:28:58 GMT
x-ray
p999:0.010/wn32655:0.000/
last-modified
Tue, 05 Jul 2022 21:31:42 GMT
server
nginx
etag
"62c4adbe-14a"
content-type
text/css
accept-ranges
bytes
content-length
330
all.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/6.1.1/css/
98 KB
17 KB
Stylesheet
General
Full URL
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.1.1/css/all.min.css
Requested by
Host: finansowa-gov-pl.online
URL: https://finansowa-gov-pl.online/mil/index.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
188.114.98.0 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0df5a33710e433de1f5415b1d47e4130ca7466aee5b81955f1045c4844bbb3ed
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

Referer
Origin
https://finansowa-gov-pl.online
accept-language
pl-PL,pl;q=0.9
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date
Mon, 27 Mar 2023 17:28:58 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
411906
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
17041
last-modified
Tue, 22 Mar 2022 17:32:26 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"623a082a-4291"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PtDD268eiL7wE2sYbUjEH%2BuRPVnqSZ%2BgvgMIoAXnlVRvMRMat9wcb8XYICXLmCNwtTPAk6hWIp1FEzrYuNhgnJ6Cvwf07WndhxM6S4PadglBvBuFkEEa%2Bi9dWhnS20nUeAh%2FGyct"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
7ae95a55697d350f-WAW
expires
Sat, 16 Mar 2024 17:28:58 GMT
Logo@2x.png
finansowa-gov-pl.online/mil/img/
8 KB
8 KB
Image
General
Full URL
https://finansowa-gov-pl.online/mil/img/Logo@2x.png
Requested by
Host: finansowa-gov-pl.online
URL: https://finansowa-gov-pl.online/mil/index.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.68.16.188 , Ukraine, ASN200000 (UKRAINE-AS, UA),
Reverse DNS
web410.default-host.net
Software
nginx /
Resource Hash
436609738417e32a22105cf07cadebabde9df366054b20540e135eb6599ef144

Request headers

accept-language
pl-PL,pl;q=0.9
Referer
https://finansowa-gov-pl.online/mil/index.php
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date
Mon, 27 Mar 2023 17:28:58 GMT
x-ray
p999:0.003/wn32655:0.000/
last-modified
Sun, 04 Dec 2022 14:06:32 GMT
server
nginx
etag
"638ca968-1e2d"
content-type
image/png
accept-ranges
bytes
content-length
7725
tooltip-icon.svg
finansowa-gov-pl.online/mil/img/
812 B
980 B
Image
General
Full URL
https://finansowa-gov-pl.online/mil/img/tooltip-icon.svg
Requested by
Host: finansowa-gov-pl.online
URL: https://finansowa-gov-pl.online/mil/index.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.68.16.188 , Ukraine, ASN200000 (UKRAINE-AS, UA),
Reverse DNS
web410.default-host.net
Software
nginx /
Resource Hash
659e35fe01fe92a78acaf421a4e4cc599ecbf9e618bf358eee433d46d5c97004

Request headers

accept-language
pl-PL,pl;q=0.9
Referer
https://finansowa-gov-pl.online/mil/index.php
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date
Mon, 27 Mar 2023 17:28:58 GMT
x-ray
p999:0.000/wn32655:0.000/
last-modified
Sun, 04 Dec 2022 14:17:28 GMT
server
nginx
etag
"638cabf8-32c"
content-type
image/svg+xml
accept-ranges
bytes
content-length
812
mediaImage.jpg
finansowa-gov-pl.online/mil/img/
56 KB
56 KB
Image
General
Full URL
https://finansowa-gov-pl.online/mil/img/mediaImage.jpg
Requested by
Host: finansowa-gov-pl.online
URL: https://finansowa-gov-pl.online/mil/index.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.68.16.188 , Ukraine, ASN200000 (UKRAINE-AS, UA),
Reverse DNS
web410.default-host.net
Software
nginx /
Resource Hash
0596ca189c67556024ae233194bfd5c5333a2ff5b0e010c9f5387d974f378ce8

Request headers

accept-language
pl-PL,pl;q=0.9
Referer
https://finansowa-gov-pl.online/mil/index.php
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date
Mon, 27 Mar 2023 17:28:58 GMT
x-ray
p999:0.001/wn32655:0.000/
last-modified
Sun, 04 Dec 2022 14:25:54 GMT
server
nginx
etag
"638cadf2-e049"
content-type
image/jpeg
accept-ranges
bytes
content-length
57417
jquery-3.6.0.min.js
finansowa-gov-pl.online/mil/libs/jquery/
87 KB
30 KB
Script
General
Full URL
https://finansowa-gov-pl.online/mil/libs/jquery/jquery-3.6.0.min.js
Requested by
Host: finansowa-gov-pl.online
URL: https://finansowa-gov-pl.online/mil/index.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.68.16.188 , Ukraine, ASN200000 (UKRAINE-AS, UA),
Reverse DNS
web410.default-host.net
Software
nginx /
Resource Hash
80f04717f32ea0320c5e8618fbacedd1fee3a8775ad8292140a6113551d4b5b0

Request headers

accept-language
pl-PL,pl;q=0.9
Referer
https://finansowa-gov-pl.online/mil/index.php
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date
Mon, 27 Mar 2023 17:28:58 GMT
x-ray
p999:0.003/wn32655:0.000/
content-encoding
br
last-modified
Thu, 21 Oct 2021 07:27:38 GMT
server
nginx
etag
W/"6171166a-15d9c"
content-type
application/javascript
common.js
finansowa-gov-pl.online/mil/js/
85 B
257 B
Script
General
Full URL
https://finansowa-gov-pl.online/mil/js/common.js
Requested by
Host: finansowa-gov-pl.online
URL: https://finansowa-gov-pl.online/mil/index.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.68.16.188 , Ukraine, ASN200000 (UKRAINE-AS, UA),
Reverse DNS
web410.default-host.net
Software
nginx /
Resource Hash
7d3ec6256da336daba96cc91eaa6132634aca6ac1c7798ec1fe3bd0bf16329a5

Request headers

accept-language
pl-PL,pl;q=0.9
Referer
https://finansowa-gov-pl.online/mil/index.php
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date
Mon, 27 Mar 2023 17:28:58 GMT
x-ray
p999:0.000/wn32655:0.000/
last-modified
Thu, 21 Oct 2021 07:27:38 GMT
server
nginx
etag
"6171166a-55"
content-type
application/javascript
accept-ranges
bytes
content-length
85
css2
fonts.googleapis.com/
24 KB
1 KB
Stylesheet
General
Full URL
https://fonts.googleapis.com/css2?family=Nunito+Sans:ital,wght@0,200;0,300;0,400;0,600;0,700;0,800;0,900;1,200;1,300;1,400;1,600;1,700;1,800;1,900&display=swap
Requested by
Host: finansowa-gov-pl.online
URL: https://finansowa-gov-pl.online/mil/css/main.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.170 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s08-in-f10.1e100.net
Software
ESF /
Resource Hash
2dcc46d3ed4a0114447e4a5b68264e31b4072bd5aa032f773ff31f1d88c8b0ec
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
pl-PL,pl;q=0.9
Referer
https://finansowa-gov-pl.online/
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

strict-transport-security
max-age=31536000
date
Mon, 27 Mar 2023 17:28:58 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
ESF
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
expires
Mon, 27 Mar 2023 17:28:58 GMT
28CB28_0_0.woff2
finansowa-gov-pl.online/mil/fonts/
0
0
Font
General
Full URL
https://finansowa-gov-pl.online/mil/fonts/28CB28_0_0.woff2
Requested by
Host: finansowa-gov-pl.online
URL: https://finansowa-gov-pl.online/mil/css/main.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.68.16.188 , Ukraine, ASN200000 (UKRAINE-AS, UA),
Reverse DNS
web410.default-host.net
Software
nginx /
Resource Hash

Request headers

Referer
https://finansowa-gov-pl.online/mil/css/main.css
Origin
https://finansowa-gov-pl.online
accept-language
pl-PL,pl;q=0.9
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date
Mon, 27 Mar 2023 17:28:58 GMT
x-ray
p999:0.000/wn32655:0.000/wa32655:D=1316
server
nginx
content-length
196
content-type
text/html; charset=iso-8859-1
Centrale_Sans_Regular-webfont.woff
finansowa-gov-pl.online/mil/fonts/
25 KB
25 KB
Font
General
Full URL
https://finansowa-gov-pl.online/mil/fonts/Centrale_Sans_Regular-webfont.woff
Requested by
Host: finansowa-gov-pl.online
URL: https://finansowa-gov-pl.online/mil/css/main.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.68.16.188 , Ukraine, ASN200000 (UKRAINE-AS, UA),
Reverse DNS
web410.default-host.net
Software
nginx /
Resource Hash
275bc1d8236196770e3813e269f49185a7a7c6c28c4366cf501543c363e1cd7a

Request headers

Referer
https://finansowa-gov-pl.online/mil/css/main.css
Origin
https://finansowa-gov-pl.online
accept-language
pl-PL,pl;q=0.9
User-Agent
Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date
Mon, 27 Mar 2023 17:28:58 GMT
x-ray
p999:0.000/wn32655:0.000/
last-modified
Fri, 04 Nov 2022 12:48:42 GMT
server
nginx
etag
"63650a2a-6520"
content-type
font/woff
accept-ranges
bytes
content-length
25888

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Bank Millenium (Banking)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless function| $ function| jQuery

0 Cookies

1 Console Messages

Source Level URL
Text
network error URL: https://finansowa-gov-pl.online/mil/fonts/28CB28_0_0.woff2
Message:
Failed to load resource: the server responded with a status of 404 ()