s765359.ha003.t.justns.ru
Open in
urlscan Pro
91.229.90.158
Malicious Activity!
Public Scan
URL:
https://s765359.ha003.t.justns.ru/ipko/
Submission: On January 10 via manual from PL — Scanned from PL
Submission: On January 10 via manual from PL — Scanned from PL
Summary
This website contacted 5 IPs
in 3 countries
across 4 domains to perform 17 HTTP transactions.
The main IP is 91.229.90.158, located in
St Petersburg, Russian Federation and
belongs to ASBAXET, RU.
The main domain is s765359.ha003.t.justns.ru.
TLS certificate: Issued by R3 on December 10th 2023. Valid for: 3 months.
This is the only time s765359.ha003.t.justns.ru was scanned on urlscan.io!
TLS certificate: Issued by R3 on December 10th 2023. Valid for: 3 months.
This is the only time s765359.ha003.t.justns.ru was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: PKO Bank Polski (Banking)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 12 | 91.229.90.158 91.229.90.158 | 51659 (ASBAXET) (ASBAXET) | |
| 2 | 193.109.225.70 193.109.225.70 | 21344 (INTELIGO) (INTELIGO) | |
| 1 | 149.154.167.220 149.154.167.220 | 62041 (TELEGRAM) (TELEGRAM) | |
| 2 | 193.109.225.100 193.109.225.100 | 21344 (INTELIGO) (INTELIGO) | |
| 17 | 5 |
12
91.229.90.158
(St Petersburg, Russian Federation)
ASN51659 (ASBAXET, RU)
PTR: ha003.justhost.ru
ASN51659 (ASBAXET, RU)
PTR: ha003.justhost.ru
| s765359.ha003.t.justns.ru |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 12 |
justns.ru
s765359.ha003.t.justns.ru |
698 KB |
| 2 |
pkobp.pl
www.pkobp.pl — Cisco Umbrella Rank: 256889 |
1 KB |
| 2 |
ipko.pl
www.ipko.pl — Cisco Umbrella Rank: 444848 |
24 KB |
| 1 |
telegram.org
api.telegram.org — Cisco Umbrella Rank: 22535 |
|
| 17 | 4 |
| Domain | Requested by | |
|---|---|---|
| 12 | s765359.ha003.t.justns.ru |
s765359.ha003.t.justns.ru
|
| 2 | www.pkobp.pl |
s765359.ha003.t.justns.ru
|
| 2 | www.ipko.pl |
s765359.ha003.t.justns.ru
|
| 1 | api.telegram.org |
s765359.ha003.t.justns.ru
|
| 17 | 4 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| iko.pkobp.pl |
| www.pkobp.pl |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| s765359.ha003.t.justns.ru R3 |
2023-12-10 - 2024-03-09 |
3 months | crt.sh |
| ipko.pl Certum Extended Validation CA SHA2 |
2023-08-11 - 2024-08-10 |
a year | crt.sh |
| api.telegram.org Go Daddy Secure Certificate Authority - G2 |
2023-03-26 - 2024-04-26 |
a year | crt.sh |
| pkobp.pl Certum Extended Validation CA SHA2 |
2023-12-28 - 2024-12-27 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://s765359.ha003.t.justns.ru/ipko/
Frame ID: F80DEB807152A6B05EADE75FBB5F0ED0
Requests: 19 HTTP requests in this frame
Screenshot
Page Title
Strona logowania | iPKO - bankowość elektroniczna PKO Banku PolskiegoPage Statistics
11 Outgoing links
These are links going to different origins than the main page.
URL: http://iko.pkobp.pl/
Title: Open in new tab Pobierz darmową aplikację IKO
Title: Open in new tab Pobierz darmową aplikację IKO
Search URL Search Domain Scan URL
URL: https://www.pkobp.pl/klienci-indywidualni/konta/konta-osobiste/zostan-naszym-klientem/
Title: Open in new tab Nie masz konta?
Title: Open in new tab Nie masz konta?
Search URL Search Domain Scan URL
URL: https://www.pkobp.pl/klient-indywidualny/uslugi-zakupy/karty-podarunkowe
Title: Open in new tab Więcej
Title: Open in new tab Więcej
Search URL Search Domain Scan URL
URL: https://www.pkobp.pl/aktualnosci/bezpieczenstwo/just-imagine-that-electronic-banking-is-like-your-wallet/
Title: Open in new tab Otwórz w nowej karcie Odwiedź stronę banku
Title: Open in new tab Otwórz w nowej karcie Odwiedź stronę banku
Search URL Search Domain Scan URL
URL: https://www.pkobp.pl/aktualnosci/bezpieczenstwo/po-co-mi-powiadomienia-od-banku/
Title: Otwórz w nowej karcie Więcej
Title: Otwórz w nowej karcie Więcej
Search URL Search Domain Scan URL
URL: https://www.pkobp.pl/
Title: Open in new tab © 2023 PKO Bank Polski
Title: Open in new tab © 2023 PKO Bank Polski
Search URL Search Domain Scan URL
URL: https://www.pkobp.pl/klienci-indywidualni/operacje-zagraniczne/bic-swift-i-iban/
Title: Open in new tab BIC Code (Swift): BPKOPLPW
Title: Open in new tab BIC Code (Swift): BPKOPLPW
Search URL Search Domain Scan URL
URL: https://www.pkobp.pl/polityka-prywatnosci/
Title: Open in new tab Polityka prywatności
Title: Open in new tab Polityka prywatności
Search URL Search Domain Scan URL
URL: https://www.pkobp.pl/klienci-indywidualni/bankowosc-elektroniczna/bezpieczenstwo/
Title: Open in new tab Safety
Title: Open in new tab Safety
Search URL Search Domain Scan URL
URL: https://www.pkobp.pl/klienci-indywidualni/bankowosc-elektroniczna/zacznij-korzystac/
Title: Open in new tab Help
Title: Open in new tab Help
Search URL Search Domain Scan URL
URL: https://www.pkobp.pl/klienci-indywidualni/bankowosc-elektroniczna/serwis-telefoniczny/
Title: Open in new tab Kontakt
Title: Open in new tab Kontakt
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
17 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
/
s765359.ha003.t.justns.ru/ipko/ |
2 MB 617 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
/
www.ipko.pl/nudatasecurity/2.2/w/w-573441/init/js/ |
537 B 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
/
www.ipko.pl/nudatasecurity/2.2/w/w-573441/sync/js/ |
52 KB 23 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
sendMessage
api.telegram.org/bot6573290325:AAEvelVpIrt8xdhrjrnKW64CrJhhUAdobyU/ |
0 0 |
Image
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
_62247748.svg
www.pkobp.pl/media_files/CiCCh/iPKO/ |
1 KB 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
17022-17041-KV-kasa_swieta-570x570px_CjYi3Ls_208_208.png
www.pkobp.pl/media_files/CiCCh/iPKO/ |
0 0 |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
3725.d665aefa1f0ca28e2746.js
s765359.ha003.t.justns.ru/ipko/ |
111 KB 48 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
common.297bc6fcd5611b1b0bce.js
s765359.ha003.t.justns.ru/ipko/ |
2 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
login.969ad21781ae70c71a91.js
s765359.ha003.t.justns.ru/ipko/ |
301 B 320 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
830 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
3 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
PKOBankPolski-Regular.woff
s765359.ha003.t.justns.ru/ipko/ipko/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
PKOBankPolski-Light.woff
s765359.ha003.t.justns.ru/ipko/ipko/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
PKOBankPolski-Bold.woff
s765359.ha003.t.justns.ru/ipko/ipko/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
PKOBankPolski-Regular.ttf
s765359.ha003.t.justns.ru/ipko/ipko/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
PKOBankPolski-Light.ttf
s765359.ha003.t.justns.ru/ipko/ipko/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
PKOBankPolski-Bold.ttf
s765359.ha003.t.justns.ru/ipko/ipko/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
PKOBankPolski-Regular.woff
s765359.ha003.t.justns.ru/ipko/ |
31 KB 31 KB |
Font
application/x-font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
aimgs.json
s765359.ha003.t.justns.ru/ikd_scripts/skins/ipko/ |
669 B 545 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: PKO Bank Polski (Banking)119 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| documentPictureInPicture string| ndjsStaticVersion object| nslyyidtyi function| nsbopifkz object| nslgf function| nsgukkeb boolean| nsdwhx number| nsviymjoy function| getEnabledEvents number| nsbopifk object| nsbopi function| nsgukkebkh function| nscavjydje object| nsgukk object| nscav object| nsgukkebk object| nsviymjoyg object| nslyyidt function| nseyqlyr boolean| nsfkgjo string| nscavjy object| nscavj object| nslyyid object| nds object| nsdwhxu number| numQueries function| attachEventListener function| nsyohyfq object| returned string| version string| ndsWidgetVersion undefined| nsviym function| nspkx function| nstuky string| nsviy function| nstnagvv string| nsfkgjoq string| nsdwhxurq string| nsfkgjoqr string| nsdwhxur string| nsfkgj object| nsdwhxurqd object| nslgfnp function| nsguk function| nstna function| nsgukke function| nslyyi function| nseyqlyrf function| nstuk function| nsejsnf function| nsuksw function| validateSessionIdCookie function| nsyohy function| nstnagv function| nstukyivzx function| nsamh function| HashUtil function| nsyohyf function| nsuksww function| nsamhnfk function| nstnag function| nsejsn function| nsyohyfqp function| nsejsnfwm function| nsukswwaaw function| nstnagvvl function| nstukyiv function| nsyoh object| nsbopifkzi string| nslyyidty string| NDS_LISTEN_FOCUS string| NDS_LISTEN_TOUCH string| NDS_LISTEN_KEYBOARD string| NDS_LISTEN_DEVICE_MOTION_SENSORS string| NDS_LISTEN_MOUSE string| NDS_LISTEN_FORM string| NDS_LISTEN_ALL string| NDS_LISTEN_NONE function| nsuks string| nslgfnpyxj function| nstnagvvln string| nsviymjo string| nslgfn function| nseyq string| nslgfnpyx function| nsamhnfki string| nscavjyd function| nseyql string| nsfkg string| nsfkgjoqrf string| nslyy string| nsbop function| nsukswwa string| nslgfnpy string| nsviymj string| nsdwh object| nsbopif function| nsejsnfwmi function| ndoIsKeyIncluded function| ndoIsModifierKey function| nstukyivz function| ndoIsNavigationKey function| ndoIsEditingKey function| nsyohyfqpw object| KEYBOARD_LOCATION object| KEY_TYPE_AND_LOCATION function| nseyqlyrfu function| ndoGetKeyboardLocation function| ndoGetKeyTypeAndLocationIndicator function| ndoGetObjectKeys function| nsejsnfw function| ndwti boolean| nscavjydj function| nstukyi function| nspkxyn function| nsukswwaa function| ndwts object| ndsapi object| webpackChunkipko1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| www.ipko.pl/ | Name: ndcd Value: wc1.1.w-729460.1.2.XozDUqn2k3WsgM3KT6NAog%252C%252C.H_utR2hTIgMPtjwDGr9VTmQQMCu1nNhPXzo-OTrwpsuoclV3niNk_8G7ztnwVjmbu9CmsDaSCs_QCargFWvSOhcMvmowk4993L-K4yLQRK4FKq0V7nPAyJqL9gWMFSRVRPOcPrFTMfMUL8GUEaQzBp92RPbs0OOAUaajvp_rFyo9DuM-Yx8ygatTy86s-9Qx |
9 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
api.telegram.org
s765359.ha003.t.justns.ru
www.ipko.pl
www.pkobp.pl
149.154.167.220
193.109.225.100
193.109.225.70
91.229.90.158
08e8695cc1177aba498bb4f0e97d406ab707ea76594495a0835708a120cf46ea
29ece7b2e689f637d125e4049a960fd9d5a5a71ead05cb4a89660221bd671038
376746c4617eecd9cec806ae380b57e9164f94167fe69c88a7455d091493cd95
48205078d970c3e710784925e5f861bb5959fc96b60a5ff86d609b95aaca785c
6d371646f5fdf11110e7550388cb39b7533b0fe729192adbff255a24629ea461
830c51b7b727300cc2c08870800f300ccabd41eb95be16fc3768092922b36f88
83b1c861f448ddaca0c252f1fa51603ddee7fd3a08ff3b70eeabfa49661cdaf9
8e7e79dafc4a6d6e89355dabefa7f2694d807de72306ced7c3d020639943c9e8
c85ddecf645041ecb286c8a758c1c82dedf99a6922cf6ffdad454d0f5f6db48f
cf01af45fa0ca8aa5245bf855d17010e6828a95e380e0521955138f799f9aa5b
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f9a67195d6b6c1c9ba09349e525670d784857a3dc6168edae0f4a8e815f92153