petreioancretu.ro Open in urlscan Pro
89.41.38.20  Malicious Activity! Public Scan

1 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response petreioancretu.ro/IL/index/	9 KB 3 KB	248ms 53ms	Document text/html	89.41.38.20 ROMARG HOSTING
General Check archive.org Show headers Download Go to Full URL https://petreioancretu.ro/IL/index/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 89.41.38.20 , Romania, ASN205275 (ROMARG HOSTING, RO), Reverse DNS purple.simplenet.ro Software LiteSpeed / Resource Hash 1a0612d479f3b7caa334079b64ffb13011822adec6bfbadf0b57b2e6dbb0f334 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" content-encoding br content-type text/html; charset=UTF-8 date Wed, 15 Feb 2023 13:18:28 GMT server LiteSpeed vary Accept-Encoding,User-Agent x-content-type-options nosniff x-xss-protection 1; mode=block
GET H2	200	screen.css petreioancretu.ro/IL/index/	3 KB 1010 B	53ms 52ms	Stylesheet text/css	89.41.38.20 ROMARG HOSTING
General Check archive.org Show headers Download Go to Full URL https://petreioancretu.ro/IL/index/screen.css Requested by Host: petreioancretu.ro URL: https://petreioancretu.ro/IL/index/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 89.41.38.20 , Romania, ASN205275 (ROMARG HOSTING, RO), Reverse DNS purple.simplenet.ro Software LiteSpeed / Resource Hash 4240658116347f70eea6163be279c9c3680dd81cb5f06275bd6a733dab1a91fc Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://petreioancretu.ro/IL/index/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Wed, 15 Feb 2023 13:18:28 GMT content-encoding br x-content-type-options nosniff last-modified Tue, 22 Feb 2022 08:48:50 GMT server LiteSpeed vary Accept-Encoding,User-Agent content-type text/css cache-control public, max-age=2592000 accept-ranges bytes content-length 899 x-xss-protection 1; mode=block expires Fri, 17 Mar 2023 13:18:28 GMT
GET H2	200	gh-buttons.css petreioancretu.ro/IL/index/	13 KB 2 KB	53ms 52ms	Stylesheet text/css	89.41.38.20 ROMARG HOSTING
General Check archive.org Show headers Download Go to Full URL https://petreioancretu.ro/IL/index/gh-buttons.css Requested by Host: petreioancretu.ro URL: https://petreioancretu.ro/IL/index/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 89.41.38.20 , Romania, ASN205275 (ROMARG HOSTING, RO), Reverse DNS purple.simplenet.ro Software LiteSpeed / Resource Hash 686251c35af3f83c0532d534a4df34651f06a875fe2b70a7f450c702106f2555 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://petreioancretu.ro/IL/index/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Wed, 15 Feb 2023 13:18:28 GMT content-encoding br x-content-type-options nosniff last-modified Tue, 22 Feb 2022 08:48:58 GMT server LiteSpeed vary Accept-Encoding,User-Agent content-type text/css cache-control public, max-age=2592000 accept-ranges bytes content-length 1988 x-xss-protection 1; mode=block expires Fri, 17 Mar 2023 13:18:28 GMT
GET H2	200	commons.js Show response petreioancretu.ro/IL/index/	1 KB 579 B	53ms 53ms	Script application/javascript	89.41.38.20 ROMARG HOSTING
General Check archive.org Show headers Download Go to Full URL https://petreioancretu.ro/IL/index/commons.js Requested by Host: petreioancretu.ro URL: https://petreioancretu.ro/IL/index/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 89.41.38.20 , Romania, ASN205275 (ROMARG HOSTING, RO), Reverse DNS purple.simplenet.ro Software LiteSpeed / Resource Hash 2da2729846948ccfd97ed924936cdc406a1037b4af9bf77d98027c1576d8f8cd Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://petreioancretu.ro/IL/index/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Wed, 15 Feb 2023 13:18:28 GMT content-encoding br x-content-type-options nosniff last-modified Tue, 22 Feb 2022 08:49:12 GMT server LiteSpeed vary Accept-Encoding,User-Agent content-type application/javascript cache-control public, max-age=2592000 accept-ranges bytes content-length 504 x-xss-protection 1; mode=block expires Fri, 17 Mar 2023 13:18:28 GMT
GET H2	200	banar.jpg petreioancretu.ro/IL/index/	25 KB 25 KB	52ms 52ms	Image image/jpeg	89.41.38.20 ROMARG HOSTING
General Check archive.org Show headers Download Go to Show image Full URL https://petreioancretu.ro/IL/index/banar.jpg Requested by Host: petreioancretu.ro URL: https://petreioancretu.ro/IL/index/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 89.41.38.20 , Romania, ASN205275 (ROMARG HOSTING, RO), Reverse DNS purple.simplenet.ro Software LiteSpeed / Resource Hash a44c24282d9380566e33a10948c78dab06ac24a1ad6c6596f02f337f013ec220 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://petreioancretu.ro/IL/index/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Wed, 15 Feb 2023 13:18:28 GMT x-content-type-options nosniff last-modified Mon, 28 Mar 2022 00:20:04 GMT server LiteSpeed vary User-Agent content-type image/jpeg cache-control public, max-age=2592000 accept-ranges bytes content-length 25489 x-xss-protection 1; mode=block expires Fri, 17 Mar 2023 13:18:28 GMT
GET H2	200	register-ad.png israelpost.co.il/media/1096/	74 KB 74 KB	181ms 74ms	Image image/png	66.22.35.41 RADWARE
General Check archive.org Show headers Download Go to Show image Full URL https://israelpost.co.il/media/1096/register-ad.png Requested by Host: petreioancretu.ro URL: https://petreioancretu.ro/IL/index/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 66.22.35.41 , United States, ASN48851 (RADWARE, IL), Reverse DNS Software / Resource Hash bef05b5087b95f81b1517c93eb7f47d1755d5d95adf41eff841cad5f8dd388ac Request headers accept-language de-DE,de;q=0.9 Referer https://petreioancretu.ro/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Wed, 15 Feb 2023 13:18:29 GMT last-modified Mon, 01 Feb 2021 08:51:50 GMT etag "d2c2307b77f8d61:0" content-type image/png access-control-expose-headers Request-Context cache-control max-age=86400 accept-ranges bytes content-length 75537 request-context appId=cid-v1:61665634-75fc-415e-8cc8-63525a50cf85
GET H2	404	gh-icons.png petreioancretu.ro/IL/index/	110 KB 110 KB	755ms 755ms	Image text/html	89.41.38.20 ROMARG HOSTING
General Check archive.org Show headers Download Go to Show image Full URL https://petreioancretu.ro/IL/index/gh-icons.png Requested by Host: petreioancretu.ro URL: https://petreioancretu.ro/IL/index/gh-buttons.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 89.41.38.20 , Romania, ASN205275 (ROMARG HOSTING, RO), Reverse DNS purple.simplenet.ro Software LiteSpeed / Resource Hash e331c2db0b65b3f7b707c281e7930e118c4185e60b94a1fadf4972387cebb387 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://petreioancretu.ro/IL/index/gh-buttons.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers date Wed, 15 Feb 2023 13:18:29 GMT content-encoding br x-content-type-options nosniff server LiteSpeed vary Accept-Encoding,User-Agent content-type text/html; charset=UTF-8 cache-control no-cache, must-revalidate, max-age=0 link <https://petreioancretu.ro/wp-json/>; rel="https://api.w.org/" x-xss-protection 1; mode=block expires Wed, 11 Jan 1984 05:00:00 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic (Online)

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| oncontentvisibilityautostatechange function| changeLanguage function| submitEnter function| dotToComma function| updateViewportOrientation function| onBodyLoad function| validate object| cardNumberField object| cvvField

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://petreioancretu.ro/IL/index/gh-icons.png Message: Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

israelpost.co.il
petreioancretu.ro
66.22.35.41
89.41.38.20
1a0612d479f3b7caa334079b64ffb13011822adec6bfbadf0b57b2e6dbb0f334
2da2729846948ccfd97ed924936cdc406a1037b4af9bf77d98027c1576d8f8cd
4240658116347f70eea6163be279c9c3680dd81cb5f06275bd6a733dab1a91fc
686251c35af3f83c0532d534a4df34651f06a875fe2b70a7f450c702106f2555
a44c24282d9380566e33a10948c78dab06ac24a1ad6c6596f02f337f013ec220
bef05b5087b95f81b1517c93eb7f47d1755d5d95adf41eff841cad5f8dd388ac
e331c2db0b65b3f7b707c281e7930e118c4185e60b94a1fadf4972387cebb387