gov.pl

Government services Polandwww.gov.plRank 186 of the most impersonated
Cert findings · 24 h
0
Cert findings · 7 days
5
3 reported or listed · 2 on phishing hosts
Registered lookalikes
18
4 listed by a source or an address list
Official domains
0
verified from gov.pl's own sites and records

Certificate findings for gov.pl

Updated hourly · 2026-11-05 10:53 UTC

DomainSpoof matched these hostnames, from public certificate logs, to gov.pl's name or to lookalike spellings of its official domains. Each was reported or listed by one of our sources, or resolved to an address on Spamhaus DROP or DomainSpoof's phishing-host list.

Published now · 5 findings, grouped by hostname

  1. www.mobywatel.org PL · AS48707 · AS48707-OPS-PL AS48707 OPS …
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF -allDMARC rejectRegistered 4 y ago
    DetailsHide
    Hostname
    www.mobywatel.org
    First seen
    2026-11-04 01:21 UTC
    First published
    2026-11-04 01:42 UTC
    DNS
    Resolves · checked 2026-11-05 01:47 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 185.253.212.22.
    1. Certificate logged in CT
    2. Resolved to 185.253.212.22
    3. Phishing-host list fetched with the address
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-04 00:16 UTC to 2027-02-02 00:16 UTC
    Logged 2026-11-04 01:15 UTC in Google ParcelYard2027h1, entry 599,971,624
    SHA-256 3041df8485184dad26228e851d2f79be8fc2c495483ba9e2147d593abd8019b7
    Public key SHA-256 9e908e73dd5af37834af324aec4d07eb5d4ea50c7d3237374163b8dc642791ab
    Brand
    gov.pl
    Addresses
    185.253.212.22 · Poland · AS48707 AS48707-OPS-PL AS48707 OPS PL sp. z o.o.
    Domain
    mobywatel.org
    Registered
    2022-08-29 · Key-Systems GmbH
    MX
    Receives mail at blackhole.aftermarket.pl
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-05 01:41 UTC

    Suggest a correction

  2. mobywatel.org PL · AS48707 · AS48707-OPS-PL AS48707 OPS …
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF -allDMARC rejectRegistered 4 y ago
    DetailsHide
    Hostname
    mobywatel.org
    First seen
    2026-11-04 01:21 UTC
    First published
    2026-11-04 01:42 UTC
    DNS
    Resolves · checked 2026-11-05 01:47 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 185.253.212.22.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 185.253.212.22
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-04 00:16 UTC to 2027-02-02 00:16 UTC
    Logged 2026-11-04 01:15 UTC in Google ParcelYard2027h1, entry 599,971,624
    SHA-256 3041df8485184dad26228e851d2f79be8fc2c495483ba9e2147d593abd8019b7
    Public key SHA-256 9e908e73dd5af37834af324aec4d07eb5d4ea50c7d3237374163b8dc642791ab
    Brand
    gov.pl
    Addresses
    185.253.212.22 · Poland · AS48707 AS48707-OPS-PL AS48707 OPS PL sp. z o.o.
    Domain
    mobywatel.org
    Registered
    2022-08-29 · Key-Systems GmbH
    MX
    Receives mail at blackhole.aftermarket.pl
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-05 01:41 UTC

    Suggest a correction

  3. gov-pl.eu.cc CN · AS132203 · Tencent Building, Kejizhong…
    ListedTencent CloudListed by CERT Polska
    DetailsHide
    Hostname
    gov-pl.eu.cc
    First seen
    2026-11-03 19:26 UTC
    First published
    2026-11-03 20:36 UTC
    Listing
    CERT Polska listed it 2026-10-17 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 09:17 UTC
    DNS
    Resolves · checked 2026-11-04 20:44 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Sectigo Public Server Authentication CA DV E36 · precertificate
    Valid 2026-11-03 00:00 UTC to 2027-01-29 22:03 UTC
    Logged 2026-11-03 19:24 UTC in Geomys Tuscolo2027h1, entry 463,200,801
    SHA-256 220002f8786914dba7622088f620626ce7a3aa992a56611cfbcd1bcfe57a1912
    Public key SHA-256 559df26b21a403252d20c89b626b14c2fb7cbbe4dd33ad8c8739ff453e704c21
    Brand
    gov.pl
    Addresses
    43.133.172.108 · China · AS132203 TENCENT-NET-AP-CN - Tencent Building, Kejizhongyi Avenue · Tencent Cloud (cloud provider)
    Tencent Cloud
    Tencent Cloud (43.133.172.108): a cloud provider. It rents servers and addresses to its customers.

    Suggest a correction

  4. govpl.eu.cc CN · AS132203 · Tencent Building, Kejizhong…
    ListedTencent CloudListed by CERT Polska
    DetailsHide
    Hostname
    govpl.eu.cc
    First seen
    2026-10-31 22:20 UTC
    First published
    2026-10-31 22:45 UTC
    Listing
    CERT Polska listed it 2026-10-17 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 09:17 UTC
    DNS
    Resolves · checked 2026-11-04 22:58 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Sectigo Public Server Authentication CA DV E36 · precertificate
    Valid 2026-10-31 00:00 UTC to 2027-01-18 11:13 UTC
    Logged 2026-10-31 22:18 UTC in Let's Encrypt Willow2027h1, entry 870,747,911
    SHA-256 be5c94e694c60e2849e15512dd1fde28137d855f4f627926539a87b42a707d62
    Public key SHA-256 d27cb321a941de6f1c8b553e1bbe6a3e1522282d0c810e1fb27674b7fbfdce0d
    Brand
    gov.pl
    Addresses
    43.133.172.108 · China · AS132203 TENCENT-NET-AP-CN - Tencent Building, Kejizhongyi Avenue · Tencent Cloud (cloud provider)
    Tencent Cloud
    Tencent Cloud (43.133.172.108): a cloud provider. It rents servers and addresses to its customers.

    Suggest a correction

  5. govpl.one US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    govpl.one
    First seen
    2026-10-31 17:10 UTC
    First published
    2026-10-31 17:58 UTC
    Listing
    CERT Polska listed it 2026-05-08 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 09:17 UTC
    DNS
    Resolves · checked 2026-11-04 18:11 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-10-31 16:10 UTC to 2027-01-29 16:10 UTC
    Logged 2026-10-31 17:09 UTC in Google ParcelYard2027h1, entry 542,220,474
    SHA-256 45942a75b46cd26e8c6ced519a7e874c038eef5c6f8c03b2cedea305fe162625
    Public key SHA-256 0e73a64cdf407db053f4082ceceed0cf0fddad0b87adc0dde0edd73c153d54d9
    Brand
    gov.pl
    Addresses
    104.21.81.90 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.141.82 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3031::6815:515a
    2606:4700:3031::ac43:8d52
    Cloudflare
    Cloudflare (104.21.81.90, 172.67.141.82): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    govpl.one
    Registered
    2026-05-07 · Gname.com Pte. Ltd.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 19:26 UTC

    Suggest a correction

How certificate findings are selected

Reported: PhishTank or PhishDestroy reports the hostname as phishing. Listed: CERT Polska, MetaMask, USOM, MODA, NPA 165, JPCERT/CC, the AMF, the FSMA or BaFin lists it, in the source's own category. Phishing host: the name resolves to an address on DomainSpoof's phishing-host list, the addresses that hosted confirmed phishing in the last 48 hours. Spamhaus DROP: it resolves to an address on the Spamhaus DROP list. Same certificate: it shares a certificate with a finding and has listing evidence of its own, a report or listing by a source or its own Spamhaus DROP address.

DomainSpoof reads public certificate logs and the feeds on Sources every hour. A hostname matches gov.pl when a label carries the brand's name, by the rules on How it works. A lookalike spelling of an official domain matches too. A hostname with two kinds of finding is one row. Details shows the recorded checks, the source's claim and the check times available. How it works · Sources

More brands in Government services

All brands →