# PhishDestroy domain threat record: serwer2677314.hosting-home.pl

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/serwer2677314.hosting-home.pl/
Machine-readable companion: https://phishdestroy.io/domain/serwer2677314.hosting-home.pl/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-09-21 13:32:29 UTC
- Last availability or vendor check: 2026-10-22 10:06:34 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 6/91
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 46.242.240.140
- Registrar in stored WHOIS data: home.pl S.A.
- Registrar country in stored WHOIS data: PL
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2024-04-03 09:41:00 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a0c42a-441b-733e-8839-8dae596214be/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/serwer2677314.hosting-home.pl
- Certificate Transparency search: https://crt.sh/?q=%25.serwer2677314.hosting-home.pl
- Web Archive lookup: https://web.archive.org/web/*/https://serwer2677314.hosting-home.pl/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
serwer2677314.hosting-home.pl is an impersonation phishing page that urlscan.io links to the Spanish bank Sabadell. It targets Sabadell customers who are lured to a page posing as their bank. PhishDestroy first flagged it on 2026-09-21, and as of 2026-10-19 the site was still online and serving content. The page title reads "Strona w przygotowaniu", Polish for "page under construction", while our classification is impersonation phishing.

How the scam works
Bank impersonation pages usually reach victims through SMS or email warnings about a blocked account, a suspicious payment or a required verification. The link opens a copy of the bank's login screen. Anything typed there goes to the operators, including usernames, passwords, card details and one-time codes. With those, criminals can log in to the real account, approve transfers or add their own device before the victim notices.

Evidence
urlscan.io rated the page malicious and identified the impersonated brand as Sabadell. On VirusTotal, 6 of 91 engines flagged it when checked on 2026-10-01: alphaMountain.ai, CRDF, Forcepoint ThreatSeeker, LevelBlue, SOCRadar and desenmascara.me. That is a modest count, so many browsers and security tools may still let it load without a warning. Among blocklists, PhishDestroy currently lists it.

Infrastructure
The address is not a lookalike domain. It is a generic server hostname on a Polish shared-hosting platform, registered through home.pl S.A. on 2024-04-03, roughly two and a half years before PhishDestroy detected it. The server sits on the HOMEPL-AS network of home.pl sp. z o.o. in Poland. Its certificate is the host's standard domain-validated one issued by home.pl, so the padlock in the browser says nothing about whether the page belongs to Sabadell.

What to do
If you entered credentials on this page, contact Sabadell through the number on your card or the official app right away. Change your online banking password and ask the bank to block any cards you typed in. Review recent transactions and any newly registered devices. Expect follow-up calls or messages from people posing as bank staff, and never read out codes to anyone who contacts you. Defenders should block the hostname, search mail and SMS gateways for links to it, and report it to home.pl's abuse team and to Sabadell's fraud unit.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a0c42a-441b-733e-8839-8dae596214be/
VirusTotal report: https://www.virustotal.com/gui/domain/serwer2677314.hosting-home.pl
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=serwer2677314.hosting-home.pl
Archived copy: https://web.archive.org/web/20260921135543/https://serwer2677314.hosting-home.pl/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:37:21 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/M5769JMm/1f088b84f836.png
  Captured: 2026-09-21 13:32:29 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a0c42a-441b-733e-8839-8dae596214be.png
  Captured: 2026-09-21 13:32:29 UTC
  Source report: https://urlscan.io/result/01a0c42a-441b-733e-8839-8dae596214be/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/aecba0a3-62b6-40b5-9dd6-1a837f13877d.png
  Captured: 2026-09-21 14:06:16 UTC
  Source report: https://radar.cloudflare.com/scan/aecba0a3-62b6-40b5-9dd6-1a837f13877d
  SHA-256: b98105b72b5ef812ff12e45ddde68b13303d459ca14046240ad429e4159754f0
- URLScan · 2026-09-21: https://screenshots.phishdestroy.io/us/01a0c42b-fbf1-76c7-9f7e-5f531c529caa.png
  Captured: 2026-09-21 13:33:38 UTC
  Source report: https://urlscan.io/result/01a0c42b-fbf1-76c7-9f7e-5f531c529caa/
  SHA-256: fad0ee195513c239d1d0a76c817319ddd96536de128c44f853170c1f116541aa

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T22:21:07Z",
        "uuid": "01a0c42a-441b-733e-8839-8dae596214be",
        "scanned_at": "2026-09-21T13:31:45Z",
        "final_url": "https://serwer2677314.hosting-home.pl/bancsabedell/login.php",
        "status": 200,
        "ip": "46.242.240.140",
        "ptr": "cloudserver3199769-3199800.home.pl",
        "domains": [
            "cdn.jsdelivr.net",
            "fonts.googleapis.com",
            "code.jquery.com",
            "cdnjs.cloudflare.com"
        ],
        "ips": [
            "151.101.129.229",
            "2a00:1450:4001:c1f::5f",
            "2a04:4e42:400::411",
            "104.17.24.14",
            "2a04:4e42:400::485",
            "46.242.240.140"
        ],
        "asns": [
            "54113",
            "15169",
            "13335",
            "12824"
        ],
        "countries": [
            "US",
            "DE",
            "PL"
        ],
        "doc_hash": "3fbf2dc4a8452ef653ec50c4463e2fa3830efb0b3f383f37545bc15f5eb4ddb6",
        "script_hashes": [
            "21e25667897f65c44f41045b35d4fd9fa3036d12efc6600d0d2529b054eee176",
            "8e869f2e4a8100d34578e5d3192cc23c9f7980f951e859b49519f97f9b9ccea0"
        ],
        "globals": [
            "updateStatus",
            "uidEvent",
            "bootstrap",
            "$",
            "jQuery",
            "path_page"
        ],
        "tls": {
            "san": [
                "*.hosting-home.pl",
                "hosting-home.pl"
            ],
            "cipher": "AES_256_GCM",
            "issuer": "home pl DV TLS G2 R35 CA",
            "subject": "*.hosting-home.pl",
            "protocol": "TLS 1.3",
            "valid_to": "2027-02-15T12:52:33Z",
            "valid_from": "2026-01-16T12:52:34Z"
        },
        "domain_age_days": 0,
        "apex_age_days": 0,
        "tls_age_days": 248,
        "tls_valid_days": 394,
        "requests": 32,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 100,
                "malicious": true
            },
            "overall": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "sabadell"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            },
            "urlscan": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "Banco Sabadell"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            }
        },
        "headers": {
            "server": "Apache",
            "content-type": "text/html; charset=UTF-8"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T22:29:39Z",
        "uuid": "aecba0a3-62b6-40b5-9dd6-1a837f13877d",
        "scanned_at": "2026-09-21T14:06:16Z",
        "final_url": "https://serwer2677314.hosting-home.pl/",
        "status": 200,
        "history": [
            {
                "url": "https://serwer2677314.hosting-home.pl/",
                "status": 200
            }
        ],
        "dom_hash": "f358ccea47757813fd6c86c9fc5e55de238d2fc06119ba100328c4046fd2f41c",
        "doc_hash": "d02e3e32808fe0fa8ebd351d3a37ca54929a84ec790e7eab820a6807ce487deb",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "serwer2677314.hosting-home.pl",
                "type": "A",
                "value": "46.242.240.140"
            }
        ],
        "dnssec_valid": false,
        "ip": "46.242.240.140",
        "whois": {
            "registrar": "home.pl sp. z o.o.",
            "created": "2024-04-03T11:41:00Z",
            "updated": "2026-04-27T10:30:33Z",
            "expires": "2027-04-03T11:41:00Z",
            "nameservers": [
                "dns.home.pl",
                "dns2.home.pl",
                "dns3.home.pl"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-22T00:27:54Z",
        "analysis_at": "2026-10-11T21:55:44Z",
        "stats": {
            "timeout": 0,
            "harmless": 50,
            "malicious": 7,
            "suspicious": 1,
            "undetected": 34
        },
        "detections": {
            "CRDF": "malicious",
            "G-Data": "phishing",
            "SOCRadar": "phishing",
            "Gridinsoft": "suspicious",
            "BitDefender": "phishing",
            "desenmascara.me": "malicious",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "first_seen": "2026-09-19T12:54:02Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "SOA",
                "rname": "admin.home.pl",
                "value": "dns.home.pl"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "dns.home.pl"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "dns2.home.pl"
            },
            {
                "ttl": 3600,
                "type": "A",
                "value": "46.242.240.140"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "dns3.home.pl"
            },
            {
                "ttl": 3600,
                "type": "MX",
                "value": "serwer2677314.hosting-home.pl",
                "priority": 10
            },
            {
                "ttl": 3600,
                "type": "TXT",
                "value": "v=spf1 mx a -all"
            }
        ],
        "dns_at": "2026-10-11T21:56:03Z",
        "jarm": "2ad2ad16d2ad2ad00042d42d000000df133019600a83abfb096ff3e86cd79d",
        "cert": {
            "san": [
                "*.home.pl",
                "home.pl"
            ],
            "issuer": "home.pl S.A. / home pl DV TLS G2 R35 CA",
            "serial": "74e6c71bcbd4d5d3ae4cbab6deb6ebf",
            "sha256": "a223263c9d8d9ceec40405817bc2f93a3e4e3d3d2ddf25d9901939dd67b352e0",
            "subject": "*.home.pl",
            "valid_to": "2026-12-14T14:34:44Z",
            "valid_from": "2026-05-29T14:34:45Z"
        },
        "whois": {
            "dnssec": "Unsigned"
        }
    }
}
```