medicamentesentialepetitieonlinenr1.arleto.ro Open in urlscan Pro
95.214.132.17  Malicious Activity! Public Scan

URL: https://medicamentesentialepetitieonlinenr1.arleto.ro/
Submission: On June 24 via api from US — Scanned from DE

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 7 HTTP transactions. The main IP is 95.214.132.17, located in Romania and belongs to CYBER_FOLKS-RO-DC_CLJ, RO. The main domain is medicamentesentialepetitieonlinenr1.arleto.ro.
TLS certificate: Issued by cPanel, Inc. Certification Authority on June 23rd 2024. Valid for: 3 months.
This is the only time medicamentesentialepetitieonlinenr1.arleto.ro was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

IP Address AS Autonomous System
2 95.214.132.17 44043 (CYBER_FOL...)
7 2
Apex Domain
Subdomains
Transfer
2 arleto.ro
medicamentesentialepetitieonlinenr1.arleto.ro
95 KB
0 fbcdn.net Failed
static.xx.fbcdn.net Failed
7 2
Domain Requested by
2 medicamentesentialepetitieonlinenr1.arleto.ro medicamentesentialepetitieonlinenr1.arleto.ro
0 static.xx.fbcdn.net Failed medicamentesentialepetitieonlinenr1.arleto.ro
7 2

This site contains no links.

Subject Issuer Validity Valid
medicamentesentialepetitieonlinenr1.arleto.ro
cPanel, Inc. Certification Authority
2024-06-23 -
2024-09-21
3 months crt.sh

This page contains 1 frames:

Primary Page: https://medicamentesentialepetitieonlinenr1.arleto.ro/
Frame ID: 12055E469167D29868431B25690B10B9
Requests: 8 HTTP requests in this frame

Screenshot

Page Title

Bienvenue sur Facebook

Page Statistics

7
Requests

29 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

95 kB
Transfer

1237 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
medicamentesentialepetitieonlinenr1.arleto.ro/
1 MB
93 KB
Document
General
Full URL
https://medicamentesentialepetitieonlinenr1.arleto.ro/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
95.214.132.17 , Romania, ASN44043 (CYBER_FOLKS-RO-DC_CLJ, RO),
Reverse DNS
17-132-static.mxserver.ro
Software
LiteSpeed /
Resource Hash
294bb1b77aa9fa889a6e6f48676249bb973e5968364e56bf5cd533b05fcec33b

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

alt-svc
h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-encoding
br
content-type
text/html; charset=UTF-8
date
Mon, 24 Jun 2024 01:33:28 GMT
server
LiteSpeed
vary
Accept-Encoding
pBYEwhIStl6.js
static.xx.fbcdn.net/rsrc.php/v3ia7q4/yu/l/fr_FR/
0
0

eTjyy1sq5Pb.js
static.xx.fbcdn.net/rsrc.php/v3if1h4/y2/l/fr_FR/
0
0

ZEHQe8_eAh6.js
static.xx.fbcdn.net/rsrc.php/v3/yv/r/
0
0

j4g5goKSDpw.js
static.xx.fbcdn.net/rsrc.php/v3/yS/r/
0
0

Geb2ucamE4k.js
static.xx.fbcdn.net/rsrc.php/v3/y-/r/
0
0

truncated
/
31 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
72b57d229e163164cf6bcf281bcd98914617c1ccdcde4fddf73380eace27e734

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type
image/png
GPGyYijOozz.png
medicamentesentialepetitieonlinenr1.arleto.ro/rsrc.php/v3/yQ/r/
1 KB
1 KB
Image
General
Full URL
https://medicamentesentialepetitieonlinenr1.arleto.ro/rsrc.php/v3/yQ/r/GPGyYijOozz.png
Requested by
Host: medicamentesentialepetitieonlinenr1.arleto.ro
URL: https://medicamentesentialepetitieonlinenr1.arleto.ro/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
95.214.132.17 , Romania, ASN44043 (CYBER_FOLKS-RO-DC_CLJ, RO),
Reverse DNS
17-132-static.mxserver.ro
Software
LiteSpeed /
Resource Hash
5dc1ae0b875dc0d78dbc5532226f5f31b762b4d1229984f605d27bf895ab6807

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://medicamentesentialepetitieonlinenr1.arleto.ro/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Mon, 24 Jun 2024 01:33:29 GMT
cache-control
private, no-cache, no-store, must-revalidate, max-age=0
server
LiteSpeed
content-length
1238
content-type
text/html

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
static.xx.fbcdn.net
URL
https://static.xx.fbcdn.net/rsrc.php/v3ia7q4/yu/l/fr_FR/pBYEwhIStl6.js
Domain
static.xx.fbcdn.net
URL
https://static.xx.fbcdn.net/rsrc.php/v3if1h4/y2/l/fr_FR/eTjyy1sq5Pb.js
Domain
static.xx.fbcdn.net
URL
https://static.xx.fbcdn.net/rsrc.php/v3/yv/r/ZEHQe8_eAh6.js
Domain
static.xx.fbcdn.net
URL
https://static.xx.fbcdn.net/rsrc.php/v3/yS/r/j4g5goKSDpw.js
Domain
static.xx.fbcdn.net
URL
https://static.xx.fbcdn.net/rsrc.php/v3/y-/r/Geb2ucamE4k.js

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

undefined| event object| fence object| sharedStorage

0 Cookies

12 Console Messages

Source Level URL
Text
javascript error URL: https://medicamentesentialepetitieonlinenr1.arleto.ro/
Message:
Access to script at 'https://static.xx.fbcdn.net/rsrc.php/v3/yS/r/j4g5goKSDpw.js' from origin 'https://medicamentesentialepetitieonlinenr1.arleto.ro' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://static.xx.fbcdn.net/rsrc.php/v3/yS/r/j4g5goKSDpw.js
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: https://medicamentesentialepetitieonlinenr1.arleto.ro/
Message:
Access to script at 'https://static.xx.fbcdn.net/rsrc.php/v3/yv/r/ZEHQe8_eAh6.js' from origin 'https://medicamentesentialepetitieonlinenr1.arleto.ro' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://static.xx.fbcdn.net/rsrc.php/v3/yv/r/ZEHQe8_eAh6.js
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: https://medicamentesentialepetitieonlinenr1.arleto.ro/
Message:
Access to script at 'https://static.xx.fbcdn.net/rsrc.php/v3ia7q4/yu/l/fr_FR/pBYEwhIStl6.js' from origin 'https://medicamentesentialepetitieonlinenr1.arleto.ro' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://static.xx.fbcdn.net/rsrc.php/v3ia7q4/yu/l/fr_FR/pBYEwhIStl6.js
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: https://medicamentesentialepetitieonlinenr1.arleto.ro/
Message:
Access to script at 'https://static.xx.fbcdn.net/rsrc.php/v3if1h4/y2/l/fr_FR/eTjyy1sq5Pb.js' from origin 'https://medicamentesentialepetitieonlinenr1.arleto.ro' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://static.xx.fbcdn.net/rsrc.php/v3if1h4/y2/l/fr_FR/eTjyy1sq5Pb.js
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: https://medicamentesentialepetitieonlinenr1.arleto.ro/
Message:
Access to script at 'https://static.xx.fbcdn.net/rsrc.php/v3/y-/r/Geb2ucamE4k.js' from origin 'https://medicamentesentialepetitieonlinenr1.arleto.ro' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://static.xx.fbcdn.net/rsrc.php/v3/y-/r/Geb2ucamE4k.js
Message:
Failed to load resource: net::ERR_FAILED
recommendation verbose URL: https://medicamentesentialepetitieonlinenr1.arleto.ro/
Message:
[DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o
network error URL: https://medicamentesentialepetitieonlinenr1.arleto.ro/rsrc.php/v3/yQ/r/GPGyYijOozz.png
Message:
Failed to load resource: the server responded with a status of 404 ()