![](/screenshots/b662ce15-3e3c-4cf1-ba7c-6564578b9977.png)
h1221190.domeny.host
Open in
urlscan Pro
94.152.11.30
Malicious Activity!
Public Scan
Submission: On June 15 via automatic, source links-suspicious — Scanned from PL
Summary
TLS certificate: Issued by DOMENY SSL DV Certification Authority on January 19th 2023. Valid for: a year.
This is the only time h1221190.domeny.host was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Banque Populaire (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
7 | 94.152.11.30 94.152.11.30 | 29522 (CF-KRK) (CF-KRK) | |
7 | 1 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
domeny.host
h1221190.domeny.host |
454 KB |
7 | 1 |
Domain | Requested by | |
---|---|---|
7 | h1221190.domeny.host |
h1221190.domeny.host
|
7 | 1 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.domeny.host DOMENY SSL DV Certification Authority |
2023-01-19 - 2024-01-19 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://h1221190.domeny.host/abe6e4fff72aa03/
Frame ID: 0ECCA047FDD46BFFBBCBE4DEA6B187AC
Requests: 7 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
7 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
h1221190.domeny.host/abe6e4fff72aa03/ |
2 KB 732 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
h1221190.domeny.host/assets/css/ |
152 KB 20 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
helpers.css
h1221190.domeny.host/assets/css/ |
41 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fonts.css
h1221190.domeny.host/assets/css/ |
4 KB 466 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.css
h1221190.domeny.host/assets/css/ |
7 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
map2.png
h1221190.domeny.host/assets/images/ |
83 KB 83 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bg.png
h1221190.domeny.host/assets/images/ |
345 KB 346 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Banque Populaire (Banking)3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless object| onbeforetoggle object| onscrollend1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
h1221190.domeny.host/ | Name: PHPSESSID Value: 1642aa29dd5142646db1419844916bd4 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
h1221190.domeny.host
94.152.11.30
34033ffe8b5d88ef59cc47c49e55e1a293128d34e5996ade5e40ec298634ad87
4f170247e1768f40ceb39a7e08a9250b3e0d1fe5d85e9ac437b6fba12ccf61ba
4fe5824f6c21673f26dc3ab81386af2d154bebd51c26a19d3d4b6f83e36acbf1
60b19e5da6a9234ff9220668a5ec1125c157a268513256188ee80f2d2c8d8d36
76e408d18e8c8c9647888e66c5373b79151ee1b328ef2973178dc8cb3a688060
acf13c1c119be75e277b152d8019d37a2b7be92244ffb3dd943cc7f6f34ba708
fb4a13d8989526ba10c5120b0bbed11d9a44e59f226160b0b69df7e6e425c1e0