English

webvpnLang

webvpnlogin

CSRFtoken

Domain 'vpn.bankmillennium.pl' uses the Polish country-code top-level domain (.pl); it also runs on subdomain 'vpn'. The registrable portion 'bankmillennium' spans 14 characters holding 5 vowels versus 9 consonants. Splitting it apart reveals 2 words: bank, millennium. Expect seven characters per word on average. No strong language cues emerged from the frequency lists.

tgroup

tgcookieset

csrf_token

group_list

username

password

Login

html/ce/83/ce83951f-e377-4141-bd59-894c9e68c848.html.gz

default-src 'self' 'unsafe-inline' 'unsafe-eval' data: blob:; frame-ancestors 'self'; base-uri 'self'; block-all-mixed-content

56a34d69c74856589cda233ce475e6d50a291f5190cc7313bcba5b020cd32a73

5c246bf80ac1ecd6ae0190830370f451277c510e62088efb7fbc2c55b49aef43

958217a23fddeeca787d0bfd4e70ddb326d9acb93758f3efb4e6b49bf2b2af4c

cbe178de1253ccbe2c0bfc7e9716334a95cfb41745b22a5f030d95f50e1810e1

875ab602d263aabe96fc2b06cb515339ca73558f008e31e262a34e96457623e7

b02c8dfddc504c324834fd4e4caa34b3fabdcebf817da884f4552c848ef78f72

HandheldFriendly

viewport

HSTS header missing - vulnerable to protocol downgrade attacks

CSP header missing - vulnerable to XSS attacks

Bank Millennium S.A.

Domena.pl sp. z o.o.

bankmillennium.pl


if(self != top) top.location.href="/+CSCOE+/logon.html";



var blinkCounter=0;
var dap;

if (typeof navigator === 'object' && 'serviceWorker' in navigator && typeof navigator.serviceWorker === 'object' && 'register' in navigator.serviceWorker) {
    navigator.serviceWorker.getRegistration('/').then(function(registration) {
        if (registration) {
            registration.unregister().then(function() {
                location.reload();
            });
        }
    });
}
 
function scrollToLogonForm() {
    document.location.hash = "form_title_text";
}

function dap_message(){

      if(!dap) return;
      
      if(dap.style.visibility == "visible"){
         dap.style.visibility = "hidden"
      }else{
         dap.style.visibility = "visible"
      }
      blinkCounter++;
      if(dap.style.visibility == "visible" && blinkCounter > 5)
	      clearInterval(dap_interval)
} 

function blinkDapMessage(){
        dap=document.getElementById("dap");
        if(dap){
           dap_interval = setInterval('dap_message()',1000)
        }
}

function showDapMessage(){
        obj=document.getElementById("dap_message");
        if(obj){
           obj.style.visibility = "visible"
           obj.style.top = (document.body.clientHeight - obj.clientHeight)/2+"px"
           obj.style.left = (document.body.clientWidth - obj.clientWidth)/2+"px"
        }

        obj1=document.getElementById("dap_message_shield");
        if(obj1){
           obj1.style.visibility = "visible"
           obj1.style.top = (document.body.clientHeight - obj.clientHeight)/2+"px"
           obj1.style.left = (document.body.clientWidth - obj.clientWidth)/2+"px"
           obj1.style.height = obj.clientHeight+"px"
           obj1.style.width = obj.clientWidth+"px"
        }
} 

function hideDapMessage(){
        obj=document.getElementById("dap_message");
        if(obj){
           obj.style.visibility = "hidden"
        }

        obj1=document.getElementById("dap_message_shield");
        if(obj1){
           obj1.style.visibility = "hidden"
        }
} 









function base64_encode(data) {
  var b64 = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=';
  var o1, o2, o3, h1, h2, h3, h4, bits, i = 0,
    ac = 0,
    enc = '', 
    tmp_arr = []; 
  if (!data) {
    return data;
  }
  do {
    // pack three octets into four hexets
    o1 = data.charCodeAt(i++);
    o2 = data.charCodeAt(i++);
    o3 = data.charCodeAt(i++);
    bits = o1 << 16 | o2 << 8 | o3; 
    h1 = bits >> 18 & 0x3f;
    h2 = bits >> 12 & 0x3f;
    h3 = bits >> 6 & 0x3f;
    h4 = bits & 0x3f;
    // use hexets to index into b64, and append result to encoded string
    tmp_arr[ac++] = b64.charAt(h1) + b64.charAt(h2) + b64.charAt(h3) + b64.charAt(h4);
  } while (i < data.length);
  enc = tmp_arr.join('');
  var r = data.length % 3;
  return (r ? enc.slice(0, r - 3) : enc) + '==='.slice(r || 3); 
}
function updateLogonForm(group,reload){

    if(reload[group]){
    	var obj=document.getElementById("login");
    	if(obj) {
           obj.disabled=true
        }
        document.cookie = "tg=1" + base64_encode(group) + "; path=/; secure";
    	document.location = "/+CSCOE+/logon.html";
        return
    }
}
function PrefillError() {
      var obj = document.getElementById("logon_message_text");
      if (obj) {
         obj.innerHTML="Your certificate is invalid for the selected group";
         obj.style.fontWeight="bold";
         obj.style.color="red";
      }
      obj = document.getElementById("Login");
      if (obj) {
         obj.disabled=true;
      }
}



function formSubmit() {
    disableButton();

    var primary_username = document.getElementById("username"),
        secondary_username = document.getElementById("secondary_username");

    if ((primary_username && !validate_username(primary_username)) ||
        (secondary_username && !validate_username(secondary_username))) {
            document.location = "/+CSCOE+/logon.html?a0=15&a1=&a2=&a3=1#form_title_text";
            return false;
    }


     return true;

}


 document.cookie = "CSRFtoken=" + "2df1784bb25e7202f55df2a063174361ed896288" + "; path=/; secure"; 

Requests	IP Address	Location	AS Autonomous System
12	193.201.167.7	Poland	AS25055Bank Millennium SA
12	1	-	-

Security Scan Report: vpn.bankmillennium.pl

Summary

AI Security Verdict

Safe Website

Safety Factors

Details

Screenshot

Page Load Overview

Language Analysis

Primary Language

Detection Details

Website Classification

Primary Category

All Detected Categories

Detected Features

Domain & IP Information

Detected Technologies2

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

ssdeep (Context Triggered Piecewise Hashing)

sdhash (Similarity Digest Hashing)

Image Hashes

Perceptual Hashes

Other Hashes

Scan History