# tranultapack.site: Recorded page showing a Gazeta.pl news article | PhishDestroy Content language: English Canonical HTML report: https://phishdestroy.io/domain/tranultapack.site/ Machine-readable companion: https://phishdestroy.io/domain/tranultapack.site/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: Last known active - First observed by PhishDestroy: 2026-11-08 15:21:39 UTC - Selected availability observation: 2026-11-08T16:12:33Z - Stored record updated: 2026-11-08 16:31:42 UTC - VirusTotal detections in the stored snapshot: 17/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: checked_clean ## Stored infrastructure - Observed IP address: 188.114.96.3 - Registrar in stored WHOIS data: NAMECHEAP INC - Registrar country in stored WHOIS data: US - Last stored HTTP status: 200 (observed: 2026-11-08T16:12:33Z) - Registration date in stored WHOIS data: 2026-08-24 09:07:41 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a1bbec-f316-743e-811e-5d708c13dfaa/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/tranultapack.site - Certificate Transparency search: https://crt.sh/?q=%25.tranultapack.site - Web Archive lookup: https://web.archive.org/web/*/https://tranultapack.site/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Public report package PhishDestroy records that tranultapack.site displayed a Gazeta.pl news article page about a televised debate, as captured on 2026-11-08. On 2026-11-08, tranultapack.site displayed a page presenting itself as Wiadomości Gazeta.pl, a Polish news section. The visible page shows a news article under the Polska category with the headline "Okradacie miliony Polaków": jak Sławomir Mentzen zmiażdżył prezesa NBP na oczach całej Polski, credited to Natalia Pacholczyk and dated 11/7/2026. A large photo shows two men labeled as the head of Mentzen Kancelaria and the president of Narodowy Bank Polski. The article text describes an episode of the program "Kropka nad i" featuring Sławomir Mentzen and NBP president Adam Glapiński discussing inflation and Polish finances in 2026, ending with Glapiński leaving the studio. A sidebar lists popular and newest articles on topics such as passive income, investments, unemployment, stock valuation and banking regulation. Package revision: 2c945f3ecd979aa975b1ede0d29e87b010589ab59e8e71843919e9e4676531eb Text generated (not scan time): 2026-11-08 16:35:22 Reviewed evidence snapshot: {"domain":"tranultapack.site","screenshot_available":true,"capture_contract":"verified-capture-20261102","plain_text_contract":1,"capture_context":{"submitted_host":"tranultapack.site","final_host":"tranultapack.site","redirects":[],"captured_at":"2026-11-08T15:30:22Z","uuid":"97fceda1-578d-442c-ab70-1c5a89795115","report_url":"https://radar.cloudflare.com/scan/97fceda1-578d-442c-ab70-1c5a89795115","sha256":"c2f60b67316a94760ee45112de6f3723003e7909b4db68ec42d9f7d039aee0d4","relationship":"own_domain_page"},"redirect_text_policy":"explicit-redirect-v1","virustotal_public_summary":"","page_paragraph_target_characters":678} Source facts (timestamps as stored): {"record_id":1860486,"first_recorded_at":"2026-11-08 16:21:39","virustotal":{"source":"VirusTotal","scope":"unknown","result_state":"complete","numerator":17,"denominator":92,"malicious":14,"suspicious":3,"vendors":{"CRDF":"malicious","DNS8":"suspicious","ESET":"suspicious","VIPRE":"phishing","G-Data":"malware","Lionic":"phishing","Sophos":"phishing","CyRadar":"phishing","Webroot":"malicious","Fortinet":"phishing","SOCRadar":"phishing","Kaspersky":"phishing","Seclookup":"malicious","Gridinsoft":"suspicious","BitDefender":"phishing","alphaMountain.ai":"phishing","Forcepoint ThreatSeeker":"phishing"},"observed_at":"2026-11-01T12:43:31Z","checked_at":null,"fetched_at":"2026-11-08T15:58:50Z","time_basis":"UTC (provider ISO timestamps)","stored_summary":{"source":"VirusTotal","scope":"unknown","result_state":"observed","numerator":17,"denominator":92,"malicious":null,"suspicious":null,"vendors":["alphaMountain.ai","BitDefender","CRDF","CyRadar","DNS8","ESET","Forcepoint ThreatSeeker","Fortinet","G-Data","Gridinsoft","Kaspersky","Lionic","Seclookup","SOCRadar","Sophos","VIPRE","Webroot"],"observed_at":"2026-11-01 12:43:31","checked_at":"2026-11-08 16:58:50","fetched_at":"2026-11-08 15:58:51","time_basis":"as stored; legacy timezone not established"},"record_source":"phishdestroy.technologies.vt","vendor_labels":{"CRDF":"malicious","DNS8":"suspicious","ESET":"suspicious","VIPRE":"phishing","G-Data":"malware","Lionic":"phishing","Sophos":"phishing","CyRadar":"phishing","Webroot":"malicious","Fortinet":"phishing","SOCRadar":"phishing","Kaspersky":"phishing","Seclookup":"malicious","Gridinsoft":"suspicious","BitDefender":"phishing","alphaMountain.ai":"phishing","Forcepoint ThreatSeeker":"phishing"},"vendor_names":["CRDF","DNS8","ESET","VIPRE","G-Data","Lionic","Sophos","CyRadar","Webroot","Fortinet","SOCRadar","Kaspersky","Seclookup","Gridinsoft","BitDefender","alphaMountain.ai","Forcepoint ThreatSeeker"],"stats":{"timeout":0,"harmless":44,"malicious":14,"suspicious":3,"undetected":31}},"google_safe_browsing":{"source":"Google Safe Browsing","state":"checked_clean","verdict":0,"checked_at":"2026-11-08 16:59:11"},"spamhaus":{"source":"Spamhaus","verdict":null,"checked_at":"2026-11-08 16:31:10"},"availability":{"state":"alive","label_key":"availability.active","detail_key":"detail.latest_reachability","params":[],"source":"current_http_probe","record_id":1860486,"scope":"checked_url","observed_at":"2026-11-08T16:12:33Z","http_status":200,"http_observed_at":"2026-11-08T16:12:33Z","stored_http_code":200,"stored_http_observed_at":"2026-11-08T16:12:33Z","legacy_site_status":"alive","supports_outcome_badge":false,"content_classification":"unknown","content_classification_at":null,"registration_state":"unknown","policy":"20261102-dated-availability-v2"}} ## Stored page captures - URLScan · 2026-11-08: https://urlscan.io/screenshots/01a1bbec-f316-743e-811e-5d708c13dfaa.png Captured: 2026-11-08 16:10:49 UTC Source report: https://urlscan.io/result/01a1bbec-f316-743e-811e-5d708c13dfaa/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/97fceda1-578d-442c-ab70-1c5a89795115.png Captured: 2026-11-08 15:30:22 UTC Source report: https://radar.cloudflare.com/scan/97fceda1-578d-442c-ab70-1c5a89795115 SHA-256: c2f60b67316a94760ee45112de6f3723003e7909b4db68ec42d9f7d039aee0d4 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-11-08T16:13:36Z", "uuid": "01a1bbec-f316-743e-811e-5d708c13dfaa", "scanned_at": "2026-11-08T16:10:49Z", "final_url": "https://tranultapack.site/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://tranultapack.site/", "from": "http://tranultapack.site/", "status": 307 } ], "ip": "104.21.8.8", "domains": [ "www.google.com", "crm-aff.com", "cdn.jsdelivr.net", "www.google.ca", "ad.doubleclick.net", "googleads.g.doubleclick.net", "static.cloudflareinsights.com", "www.googletagmanager.com" ], "ips": [ "104.16.179.112", "142.250.217.3", "104.21.73.129", "142.251.211.70", "142.251.154.119", "142.250.190.226", "104.16.80.73", "142.250.217.8", "104.21.8.8" ], "asns": [ "13335", "15169" ], "countries": [ "US" ], "doc_hash": "22c5c12303535a8aacada65b20e98571dfa04917d35d7c04994987774a17634d", "script_hashes": [ "a3a89306395f6ac0622f77a30b546a5f4de7e495c6d3a7258678a8c3c8f72398", "1c618a47a5225d5fb8c380a6704cc78d6b50f65e019871f57533ca5d7f727631", "62354949d3701e7127b6a043e5e2f6d7177615173adef1673ff191ee612ac934", "ff94eb78e2ec319d87d64d00cfba10142167b185b3e53162cab15575bc84d125", "a8de5ead580c42d2e2b01a5752aa08da510852230971aa18554d67cd5de5775b", "1a89d0d73fb3e23968be54d7496a07eacc0ef57a7b2847a019dac0290126e677" ], "globals": [ "gtag", "dataLayer", "d", "google_tag_data", "google_tag_manager", "GooglebQhCsO", "_factory", "intlTelInput", "tracker", "FingerprintJS", "__fp", "__cfBeacon", "initForm", "languages", "pageLang", "lang", "forms", "phoneElements", "countryCode", "onlyCountries", "googleCode", "phoneInstances", "clearDigit", "clearChars", "isRequired", "isBetween", "isEmailValid", "isValidPhone", "isValidCountry", "showError", "showSuccess", "checkName", "checkEmail", "checkPhone", "BehaviorTracker" ], "cookies": [ "_gcl_au", "test_cookie" ], "storage_keys": [ "_gcl_ls", "__ds_t", "__ds_vid" ], "tls": { "san": [ "tranultapack.site", "*.tranultapack.site" ], "cipher": "AES_128_GCM", "issuer": "WE1", "subject": "tranultapack.site", "protocol": "QUIC", "valid_to": "2027-01-20T11:28:18Z", "valid_from": "2026-10-22T10:30:48Z" }, "domain_age_days": 76, "apex_age_days": 76, "tls_age_days": 17, "tls_valid_days": 90, "requests": 45, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-2aab354" ], "score": 99, "malicious": true }, "overall": { "tags": [ "phishing" ], "score": 100, "brands": [ "genericnews" ], "malicious": true, "categories": [ "phishing" ] }, "urlscan": { "tags": [ "phishing" ], "score": 100, "brands": [ "Generic News" ], "malicious": true, "categories": [ "phishing" ] } }, "headers": { "server": "cloudflare", "content-type": "text/html; charset=UTF-8", "priority": "u=0,i" } }, "cf": { "v": 1, "fetched_at": "2026-11-08T15:34:48Z", "uuid": "97fceda1-578d-442c-ab70-1c5a89795115", "scanned_at": "2026-11-08T15:30:22Z", "final_url": "https://tranultapack.site/", "status": 200, "history": [ { "url": "https://tranultapack.site/", "status": 200 } ], "dom_hash": "82b0a37a2efd8c5293a5cbb16e3097c8fad88287997229261cd1689b07642f2b", "doc_hash": "602cea89ce792aad998445c694dcc38e04591e401e864d8e117088730182c525", "phishing_v2": [ "phishing" ], "domain_risks": [ "Malware", "Security threats", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "tranultapack.site", "type": "A", "value": "188.114.97.0" }, { "name": "tranultapack.site", "type": "A", "value": "188.114.96.0" }, { "name": "tranultapack.site", "type": "AAAA", "value": "2a06:98c1:3120::" }, { "name": "tranultapack.site", "type": "AAAA", "value": "2a06:98c1:3121::" } ], "dnssec_valid": false, "ip": "127.0.1.3", "verdict": { "tags": [ "malware" ], "malicious": true, "categories": [ "malware" ] }, "whois": { "registrar": "NameCheap, Inc.", "created": "2026-08-24T11:07:41Z", "updated": "2026-08-29T11:08:47Z", "expires": "2027-08-24T11:07:41Z", "nameservers": [ "beau.ns.cloudflare.com", "tia.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-11-08T15:58:50Z", "analysis_at": "2026-11-01T12:43:31Z", "stats": { "timeout": 0, "harmless": 44, "malicious": 14, "suspicious": 3, "undetected": 31 }, "detections": { "CRDF": "malicious", "DNS8": "suspicious", "ESET": "suspicious", "VIPRE": "phishing", "G-Data": "malware", "Lionic": "phishing", "Sophos": "phishing", "CyRadar": "phishing", "Webroot": "malicious", "Fortinet": "phishing", "SOCRadar": "phishing", "Kaspersky": "phishing", "Seclookup": "malicious", "Gridinsoft": "suspicious", "BitDefender": "phishing", "alphaMountain.ai": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "registrar": "NameCheap, Inc.", "created": "2026-08-24T11:07:41Z", "expires": "2027-08-24T11:07:41Z", "updated": "2026-08-29T11:08:47Z", "first_seen": "2026-08-24T12:15:42Z", "dns": [ { "ttl": 300, "type": "A", "value": "172.67.156.153" }, { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "beau.ns.cloudflare.com" }, { "ttl": 300, "type": "A", "value": "104.21.8.8" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3037::6815:808" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3030::ac43:9c99" }, { "ttl": 21600, "type": "NS", "value": "tia.ns.cloudflare.com" }, { "ttl": 21600, "type": "NS", "value": "beau.ns.cloudflare.com" } ], "dns_at": "2026-11-01T15:24:09Z", "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c", "cert": { "san": [ "tranultapack.site", "*.tranultapack.site" ], "issuer": "Google Trust Services / WE1", "serial": "6294ff22dadba0a41363e260c2a8a703", "sha256": "6ebbd3a225538d2bbedc5ae77d42c33739ea6d478f1cc67a2dd5d2c837352bfd", "subject": "tranultapack.site", "valid_to": "2027-01-20T11:28:18Z", "valid_from": "2026-10-22T10:30:48Z" }, "whois": { "registrar": "NameCheap, Inc.", "registrar_iana_id": "1068", "registrar_url": "https://www.namecheap.com/", "created": "2026-08-24T11:07:41Z", "updated": "2026-08-29T11:08:47Z", "expires": "2027-08-24T11:07:41Z", "status": [ "clientTransferProhibited" ], "nameservers": [ "beau.ns.cloudflare.com", "tia.ns.cloudflare.com" ], "dnssec": "unsigned" }, "rdap": { "status": [ "client transfer prohibited" ], "events": { "registration": "2026-08-24T11:07:41Z", "registrar expiration": "2027-08-24T11:07:41Z", "last update of RDAP database": "2026-10-25T15:26:21Z" } } }, "webcheck": { "v": 1, "fetched_at": "2026-11-08T15:29:24Z", "mail_config": { "spf_lookups": 0 }, "block_lists": { "resolvers": 12, "blocked_by": [ "CloudFlare Family" ], "blocked_count": 1 }, "social_tags": { "title": "\"Okradacie miliony Polaków\": jak Sławomir Mentzen zmiażdżył prezesa NBP na oczach całej Polski" }, "trackers": { "requests": 38, "trackers": [ { "name": "Google", "company": "Google", "country": "US", "category": "Advertising", "requests": 2 }, { "name": "Google Dynamic Remarketing", "company": "Google", "country": "US", "category": "Advertising", "requests": 1 }, { "name": "Google Marketing Platform", "company": "Google", "country": "US", "category": "Advertising", "requests": 2 }, { "name": "Google Tag", "company": "Google", "country": "US", "category": "Advertising", "requests": 1 }, { "name": "jsDelivr", "company": "jsDelivr", "category": "Hosting", "requests": 1 } ] }, "mixed_content": { "no_sri": [ "https://www.googletagmanager.com/gtag/js" ], "third_party_scripts": 1 }, "status": { "up": true, "code": 200, "timings": { "dns": 2, "tls": 17, "wait": 55, "connect": 7, "download": 89 }, "response_ms": 170 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1", "TLSv1.1", "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443, 8080 ] }, "carbon": { "bytes": 291654, "co2_grams": 0.0107, "cleaner_than": 1 }, "dns_server": { "ns": [ { "ip": "173.245.58.229", "host": "tia.ns.cloudflare.com" }, { "ip": "173.245.59.73", "host": "beau.ns.cloudflare.com" } ], "zone": "tranultapack.site" }, "cookies": { "cookies": [ { "name": "_gcl_au" }, { "name": "test_cookie", "secure": true, "same_site": "None" } ] }, "location": { "ip": "2a06:98c1:3121::3", "asn": "13335", "org": "Cloudflare, Inc.", "city": "Washington", "country": "US" }, "ssl": { "issuer": "Google Trust Services / WE1", "subject": "tranultapack.site" }, "dns": { "A": [ "188.114.97.3", "188.114.96.3" ], "NS": [ "beau.ns.cloudflare.com", "tia.ns.cloudflare.com" ], "SOA": "{\"nsname\": \"beau.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2418154363, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}", "AAAA": [ "2a06:98c1:3120::3", "2a06:98c1:3121::3" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": false, "referrerPolicy": false, "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": false, "contentSecurityPolicy": false, "strictTransportPolicy": false, "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "firewall": { "waf": "Cloudflare", "has_waf": true }, "get_ip": { "ip": "2a06:98c1:3121::3", "family": 6 }, "redirects": { "chain": [ "https://tranultapack.site" ] }, "tech_stack": { "technologies": [ "Google Ads", "Google Analytics", "Google Ads Conversion Tracking", "FingerprintJS", "Cloudflare", "HTTP/3" ] }, "linked_pages": { "internal_count": 1 }, "whois": { "registrar": "NameCheap, Inc.", "created": "2026-08-24T11:07:41Z", "updated": "2026-08-29T11:08:47Z", "expires": "2027-08-24T11:07:41Z", "status": [ "clientTransferProhibited https://icann.org/epp" ], "nameservers": [ "beau.ns.cloudflare.com", "tia.ns.cloudflare.com" ] }, "headers": { "headers": { "server": "cloudflare", "content-type": "text/html; charset=UTF-8" } } } } ``` Capture recorded with this analysis (source URL, capture time and stored hash): {"url":"https://screenshots.phishdestroy.io/cf/97fceda1-578d-442c-ab70-1c5a89795115.png","source":"Cloudflare Radar","report_url":"https://radar.cloudflare.com/scan/97fceda1-578d-442c-ab70-1c5a89795115","captured_at":"2026-11-08T15:30:22Z","sha256":"c2f60b67316a94760ee45112de6f3723003e7909b4db68ec42d9f7d039aee0d4","model_image_sha256":"f7ad271bcda60f49899cbe2813b64b325e79c87205ed3dcda7111dcbd7fc0222","available":true,"content_status":null} ## Complete dated records Availability observations: https://phishdestroy.io/domain/tranultapack.site/records.json?source=availability&format=json Source observation history: https://phishdestroy.io/domain/tranultapack.site/records.json?source=detections&format=json PhishStats records: https://phishdestroy.io/domain/tranultapack.site/records.json?source=phishstats&format=json Sent report records: https://phishdestroy.io/domain/tranultapack.site/records.json?source=sent_reports&format=json Report history: https://phishdestroy.io/domain/tranultapack.site/records.json?source=report_history&format=json Repeat report records: https://phishdestroy.io/domain/tranultapack.site/records.json?source=rereports&format=json Follow-up records: https://phishdestroy.io/domain/tranultapack.site/records.json?source=followups&format=json Content observations: https://phishdestroy.io/domain/tranultapack.site/records.json?source=content&format=json ## Dated availability observation Latest stored reachability observation ```json { "state": "alive", "label_key": "availability.active", "detail_key": "detail.latest_reachability", "params": [], "source": "current_http_probe", "record_id": 1860486, "scope": "checked_url", "observed_at": "2026-11-08T16:12:33Z", "http_status": 200, "http_observed_at": "2026-11-08T16:12:33Z", "stored_http_code": 200, "stored_http_observed_at": "2026-11-08T16:12:33Z", "legacy_site_status": "alive", "supports_outcome_badge": false, "content_classification": "unknown", "content_classification_at": null, "registration_state": "unknown", "policy": "20261102-dated-availability-v2" } ```