h1221190.domeny.host

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 7 HTTP transactions. The main IP is 94.152.11.30, located in Poland and belongs to CF-KRK, PL. The main domain is h1221190.domeny.host.
TLS certificate: Issued by DOMENY SSL DV Certification Authority on January 19th 2023. Valid for: a year.

This is the only time h1221190.domeny.host was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Banque Populaire (Banking)

Domain & IP information

	IP Address		AS Autonomous System
7	94.152.11.30 94.152.11.30		29522 (CF-KRK) (CF-KRK)
7	1

7 94.152.11.30 (Poland)

ASN29522 (CF-KRK, PL)
PTR: genesis.rev.domeny.host

h1221190.domeny.host	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	domeny.host h1221190.domeny.host	454 KB
7	1

	Domain	Requested by
7	h1221190.domeny.host	h1221190.domeny.host
7	1

This site contains no links.

Subject Issuer	Validity	Valid
*.domeny.host DOMENY SSL DV Certification Authority	`2023-01-19` - `2024-01-19`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://h1221190.domeny.host/abe6e4fff72aa03/
Frame ID: 0ECCA047FDD46BFFBBCBE4DEA6B187AC
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Bienvenue

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css

Page Statistics

7
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

454 kB
Transfer

634 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response h1221190.domeny.host/abe6e4fff72aa03/	2 KB 732 B	228ms 98ms	Document text/html	94.152.11.30 CF-KRK
General Check archive.org Show headers Download Go to Full URL https://h1221190.domeny.host/abe6e4fff72aa03/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 94.152.11.30 , Poland, ASN29522 (CF-KRK, PL), Reverse DNS genesis.rev.domeny.host Software nginx / Resource Hash `fb4a13d8989526ba10c5120b0bbed11d9a44e59f226160b0b69df7e6e425c1e0` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36 accept-language pl-PL,pl;q=0.9 Response headers cache-control no-store, no-cache, must-revalidate content-encoding br content-type text/html; charset=UTF-8 date Thu, 15 Jun 2023 08:15:28 GMT expires Thu, 19 Nov 1981 08:52:00 GMT pragma no-cache server nginx vary Accept-Encoding
GET H2	200	bootstrap.min.css h1221190.domeny.host/assets/css/	152 KB 20 KB	74ms 73ms	Stylesheet text/css	94.152.11.30 CF-KRK
General Check archive.org Show headers Download Go to Full URL https://h1221190.domeny.host/assets/css/bootstrap.min.css Requested by Host: h1221190.domeny.host URL: https://h1221190.domeny.host/abe6e4fff72aa03/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 94.152.11.30 , Poland, ASN29522 (CF-KRK, PL), Reverse DNS genesis.rev.domeny.host Software nginx / Resource Hash `60b19e5da6a9234ff9220668a5ec1125c157a268513256188ee80f2d2c8d8d36` Request headers accept-language pl-PL,pl;q=0.9 Referer https://h1221190.domeny.host/abe6e4fff72aa03/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36 Response headers date Thu, 15 Jun 2023 08:15:28 GMT content-encoding br last-modified Thu, 15 Jun 2023 01:32:34 GMT server nginx etag W/"34155f-2606e-5fe210af00a09" vary Accept-Encoding content-type text/css
GET H2	200	helpers.css h1221190.domeny.host/assets/css/	41 KB 3 KB	140ms 139ms	Stylesheet text/css	94.152.11.30 CF-KRK
General Check archive.org Show headers Download Go to Full URL https://h1221190.domeny.host/assets/css/helpers.css Requested by Host: h1221190.domeny.host URL: https://h1221190.domeny.host/abe6e4fff72aa03/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 94.152.11.30 , Poland, ASN29522 (CF-KRK, PL), Reverse DNS genesis.rev.domeny.host Software nginx / Resource Hash `4f170247e1768f40ceb39a7e08a9250b3e0d1fe5d85e9ac437b6fba12ccf61ba` Request headers accept-language pl-PL,pl;q=0.9 Referer https://h1221190.domeny.host/abe6e4fff72aa03/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36 Response headers date Thu, 15 Jun 2023 08:15:28 GMT content-encoding br last-modified Thu, 15 Jun 2023 01:32:34 GMT server nginx etag W/"341560-a317-5fe210af837c9" vary Accept-Encoding content-type text/css
GET H2	200	fonts.css h1221190.domeny.host/assets/css/	4 KB 466 B	84ms 84ms	Stylesheet text/css	94.152.11.30 CF-KRK
General Check archive.org Show headers Download Go to Full URL https://h1221190.domeny.host/assets/css/fonts.css Requested by Host: h1221190.domeny.host URL: https://h1221190.domeny.host/abe6e4fff72aa03/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 94.152.11.30 , Poland, ASN29522 (CF-KRK, PL), Reverse DNS genesis.rev.domeny.host Software nginx / Resource Hash `34033ffe8b5d88ef59cc47c49e55e1a293128d34e5996ade5e40ec298634ad87` Request headers accept-language pl-PL,pl;q=0.9 Referer https://h1221190.domeny.host/abe6e4fff72aa03/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36 Response headers date Thu, 15 Jun 2023 08:15:28 GMT content-encoding br last-modified Thu, 15 Jun 2023 01:32:33 GMT server nginx etag W/"340deb-e46-5fe210ae81ac9" vary Accept-Encoding content-type text/css
GET H2	200	main.css h1221190.domeny.host/assets/css/	7 KB 2 KB	85ms 84ms	Stylesheet text/css	94.152.11.30 CF-KRK
General Check archive.org Show headers Download Go to Full URL https://h1221190.domeny.host/assets/css/main.css Requested by Host: h1221190.domeny.host URL: https://h1221190.domeny.host/abe6e4fff72aa03/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 94.152.11.30 , Poland, ASN29522 (CF-KRK, PL), Reverse DNS genesis.rev.domeny.host Software nginx / Resource Hash `4fe5824f6c21673f26dc3ab81386af2d154bebd51c26a19d3d4b6f83e36acbf1` Request headers accept-language pl-PL,pl;q=0.9 Referer https://h1221190.domeny.host/abe6e4fff72aa03/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36 Response headers date Thu, 15 Jun 2023 08:15:28 GMT content-encoding br last-modified Thu, 15 Jun 2023 01:32:35 GMT server nginx etag W/"341e10-1be0-5fe210afdb221" vary Accept-Encoding content-type text/css
GET H2	200	map2.png h1221190.domeny.host/assets/images/	83 KB 83 KB	105ms 105ms	Image image/png	94.152.11.30 CF-KRK
General Check archive.org Show headers Download Go to Show image Full URL https://h1221190.domeny.host/assets/images/map2.png Requested by Host: h1221190.domeny.host URL: https://h1221190.domeny.host/abe6e4fff72aa03/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 94.152.11.30 , Poland, ASN29522 (CF-KRK, PL), Reverse DNS genesis.rev.domeny.host Software nginx / Resource Hash `acf13c1c119be75e277b152d8019d37a2b7be92244ffb3dd943cc7f6f34ba708` Request headers accept-language pl-PL,pl;q=0.9 Referer https://h1221190.domeny.host/abe6e4fff72aa03/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36 Response headers date Thu, 15 Jun 2023 08:15:28 GMT last-modified Thu, 15 Jun 2023 01:32:54 GMT server nginx accept-ranges bytes etag "341d9a-14acd-5fe210c269609" content-length 84685 content-type image/png
GET H2	200	bg.png h1221190.domeny.host/assets/images/	345 KB 346 KB	35ms 35ms	Image image/png	94.152.11.30 CF-KRK
General Check archive.org Show headers Download Go to Show image Full URL https://h1221190.domeny.host/assets/images/bg.png Requested by Host: h1221190.domeny.host URL: https://h1221190.domeny.host/assets/css/main.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 94.152.11.30 , Poland, ASN29522 (CF-KRK, PL), Reverse DNS genesis.rev.domeny.host Software nginx / Resource Hash `76e408d18e8c8c9647888e66c5373b79151ee1b328ef2973178dc8cb3a688060` Request headers accept-language pl-PL,pl;q=0.9 Referer https://h1221190.domeny.host/assets/css/main.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36 Response headers date Thu, 15 Jun 2023 08:15:28 GMT last-modified Thu, 15 Jun 2023 01:32:50 GMT server nginx accept-ranges bytes etag "341d97-565c0-5fe210be1d861" content-length 353728 content-type image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Banque Populaire (Banking)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| onbeforetoggle object| onscrollend

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			h1221190.domeny.host/	1969-12-31 23:59:59	Name: PHPSESSID Value: 1642aa29dd5142646db1419844916bd4

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

h1221190.domeny.host
94.152.11.30
34033ffe8b5d88ef59cc47c49e55e1a293128d34e5996ade5e40ec298634ad87
4f170247e1768f40ceb39a7e08a9250b3e0d1fe5d85e9ac437b6fba12ccf61ba
4fe5824f6c21673f26dc3ab81386af2d154bebd51c26a19d3d4b6f83e36acbf1
60b19e5da6a9234ff9220668a5ec1125c157a268513256188ee80f2d2c8d8d36
76e408d18e8c8c9647888e66c5373b79151ee1b328ef2973178dc8cb3a688060
acf13c1c119be75e277b152d8019d37a2b7be92244ffb3dd943cc7f6f34ba708
fb4a13d8989526ba10c5120b0bbed11d9a44e59f226160b0b69df7e6e425c1e0

h1221190.domeny.host Open in urlscan Pro 94.152.11.30 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

7 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

454 kBTransfer

634 kBSize

1 Cookies

0 Outgoing links

Redirected requests

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

1 Cookies

Indicators

h1221190.domeny.host Open in urlscan Pro
94.152.11.30 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

7
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

454 kB
Transfer

634 kB
Size

1
Cookies

7 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!