raleighdurhamdrugrehab.com
Open in
urlscan Pro
188.114.96.3
Malicious Activity!
Public Scan
Effective URL: https://raleighdurhamdrugrehab.com/it/sicurezza/cliente/brt/payment.php
Submission: On May 23 via automatic, source openphish — Scanned from NL
Summary
TLS certificate: Issued by GTS CA 1P5 on April 7th 2024. Valid for: 3 months.
This is the only time raleighdurhamdrugrehab.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: BRT S.p.A (Transportation)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
21 | 188.114.96.3 188.114.96.3 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 15.204.22.185 15.204.22.185 | 16276 (OVH) (OVH) | |
22 | 2 |
ASN16276 (OVH, FR)
PTR: ip185.ip-15-204-22.us
db.onlinewebfonts.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
21 |
raleighdurhamdrugrehab.com
raleighdurhamdrugrehab.com |
1 MB |
1 |
onlinewebfonts.com
db.onlinewebfonts.com — Cisco Umbrella Rank: 14462 |
673 B |
22 | 2 |
Domain | Requested by | |
---|---|---|
21 | raleighdurhamdrugrehab.com |
raleighdurhamdrugrehab.com
|
1 | db.onlinewebfonts.com |
raleighdurhamdrugrehab.com
|
22 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
raleighdurhamdrugrehab.com GTS CA 1P5 |
2024-04-07 - 2024-07-06 |
3 months | crt.sh |
*.onlinewebfonts.com Sectigo RSA Domain Validation Secure Server CA |
2023-11-22 - 2024-11-21 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://raleighdurhamdrugrehab.com/it/sicurezza/cliente/brt/payment.php
Frame ID: 6D8DEF36CFA58F73CFB21A47CE87BE71
Requests: 22 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://raleighdurhamdrugrehab.com/it/sicurezza/cliente/brt/payment.php
HTTP 307
https://raleighdurhamdrugrehab.com/it/sicurezza/cliente/brt/payment.php Page URL
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- \.php(?:$|\?)
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://raleighdurhamdrugrehab.com/it/sicurezza/cliente/brt/payment.php
HTTP 307
https://raleighdurhamdrugrehab.com/it/sicurezza/cliente/brt/payment.php Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
22 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H3 |
Primary Request
payment.php
raleighdurhamdrugrehab.com/it/sicurezza/cliente/brt/ Redirect Chain
|
14 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
header.css
raleighdurhamdrugrehab.com/it/sicurezza/cliente/brt/styles/ |
797 B 902 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
e5e8240915fa9efabe13f3bfeccef3db
db.onlinewebfonts.com/c/ |
1 KB 673 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
main.css
raleighdurhamdrugrehab.com/it/sicurezza/cliente/brt/styles/ |
4 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
mobile.css
raleighdurhamdrugrehab.com/it/sicurezza/cliente/brt/styles/ |
2 KB 1010 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
pc.css
raleighdurhamdrugrehab.com/it/sicurezza/cliente/brt/styles/ |
49 B 576 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
brt-background3.jpg
raleighdurhamdrugrehab.com/it/sicurezza/cliente/brt/images/ |
191 KB 191 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
brt-background2.jpg
raleighdurhamdrugrehab.com/it/sicurezza/cliente/brt/images/ |
174 KB 175 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
brt.png
raleighdurhamdrugrehab.com/it/sicurezza/cliente/brt/images/ |
338 KB 339 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
details.svg
raleighdurhamdrugrehab.com/it/sicurezza/cliente/brt/images/ |
261 B 695 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
visa.png
raleighdurhamdrugrehab.com/it/sicurezza/cliente/brt/images/ |
80 KB 81 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
mastercard.jpg
raleighdurhamdrugrehab.com/it/sicurezza/cliente/brt/images/ |
103 KB 103 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
amex.png
raleighdurhamdrugrehab.com/it/sicurezza/cliente/brt/images/ |
35 KB 36 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
maestro.png
raleighdurhamdrugrehab.com/it/sicurezza/cliente/brt/images/ |
40 KB 41 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
linkdin.png
raleighdurhamdrugrehab.com/it/sicurezza/cliente/brt/images/ |
8 KB 9 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
insta.png
raleighdurhamdrugrehab.com/it/sicurezza/cliente/brt/images/ |
11 KB 12 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
ytb.png
raleighdurhamdrugrehab.com/it/sicurezza/cliente/brt/images/ |
13 KB 13 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
twi.png
raleighdurhamdrugrehab.com/it/sicurezza/cliente/brt/images/ |
16 KB 17 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
footer-logo.png
raleighdurhamdrugrehab.com/it/sicurezza/cliente/brt/images/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
juniaframework.js
raleighdurhamdrugrehab.com/it/sicurezza/cliente/brt/javascript/ |
21 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
script.js
raleighdurhamdrugrehab.com/it/sicurezza/cliente/brt/javascript/ |
206 B 698 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
favicon.ico
raleighdurhamdrugrehab.com/ |
209 B 692 B |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: BRT S.p.A (Transportation)1 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| Cleave0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Frame-Options | SAMEORIGIN |
X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
db.onlinewebfonts.com
raleighdurhamdrugrehab.com
15.204.22.185
188.114.96.3
0342963ffb9a54079b741bfa9b72652710e7d6ccce3e8e8073261f5f0c200ec9
07fb85ec6f21fa9861447a6dcd851e42ba67b4c51f771fb8a90c4a23a9b67a0f
0b5a6e9ebd217ed4b2bf8fc8e9d350b2ae07989fe9834e57714dd6211abd65f0
0ce34c540c10651e8e5991321111d8d1098121f68ae03c78d0ce9c6fa7a1dcfc
17715c79d886ca5fb8e6194cb720cebe189f37e20ebf1760bc7e6bc1a88fada0
23ff0afe4369621392a6c71066c11515d1aefb5b558d8d30c868b6a9ad5b3e32
255c01d6580e09159070c65d900876e6024f34ed23e8519e8c764414410147c2
26f57032c60ab2ebecba2e479037cef85d2b2ea8eb11dbe77f94bc907ee2d0eb
2af0907e734056a085e1ae40a20835be43860a08dbefcca901361fa92447cf48
34b62d97af795b3c08c84994f3c9c0c95fcb52989ff6848df8d0928895961524
3510ed18d70cbcd0d1d7359a6268c6249ba375894cdb5be6c6c59e6a36b11903
4bcc1e5b6bfb781478082f1cbc21589c5b5e6935cfb2ca855eddd245cfe9cd28
60fc37f80886700e21b2f04c04bf880087a5a69d87a530e33d11e4eaea5ac67c
6b8bcb8f77668bec2cdf00ed339c7d544ae3ffe477f81a9db2ea8a35c83a9d3e
7e56e7b4b4c6004151eb38ab7edac2e59c8b1dba84167972aea5c36f5ef7b4f6
886a974b779525441dd4852b8b1f80439fb5d7534fd554194076cfebace4278e
905e5be42d7c438ce1d397f72d3a8e405476a8d5ba8e6d6f1fbfd4bc8418af72
9b6e8117d1546091dcea2394ce697c509be3f11e6f6d7f54531bf73293fde953
9f71dde1e427a12a5f007cb81e87e816d4bd4492b6ef5f0049418d2019c8a4fb
c8cef8389d9c9a8c2ff16afa6eb276268099aa921bdb36d2eefe2b33af50f50c
d8b0c64f17fef96d35ef346f05acb617ffb26a38ed5ae986965c33364b473d9d
f1e0b3f86a810a495db90cd9ed18f15ed6d9b63db09266481cd983c22237a45e