cs2.itpharma.by Open in urlscan Pro
178.124.194.126 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://cs2.itpharma.by/
Submission Tags: phishingrod
Submission: On June 03 via api (June 3rd 2024, 6:16:10 am UTC) from DE — Scanned from DE

Summary HTTP 7 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 7 HTTP transactions. The main IP is 178.124.194.126, located in Polatsk, Belarus and belongs to BELPAK-AS BELPAK, BY. The main domain is cs2.itpharma.by.
TLS certificate: Issued by R3 on June 3rd 2024. Valid for: 3 months.

This is the only time cs2.itpharma.by was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
6	178.124.194.126 178.124.194.126	6697 (BELPAK-AS...) (BELPAK-AS BELPAK)
1	3.227.156.219 3.227.156.219	14618 (AMAZON-AES) (AMAZON-AES)
7	3

6 178.124.194.126 (Polatsk, Belarus)

ASN6697 (BELPAK-AS BELPAK, BY)
PTR: email.farmin.by

cs2.itpharma.by	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.227.156.219 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-227-156-219.compute-1.amazonaws.com

validator.swagger.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	itpharma.by cs2.itpharma.by	1 MB
1	swagger.io validator.swagger.io — Cisco Umbrella Rank: 179144	2 KB
7	2

	Domain	Requested by
6	cs2.itpharma.by	cs2.itpharma.by
1	validator.swagger.io
7	2

This site contains links to these domains. Also see Links.

Domain
validator.swagger.io

Subject Issuer	Validity	Valid
cs2.itpharma.by R3	`2024-06-03` - `2024-09-01`	3 months	crt.sh
*.swagger.io Amazon RSA 2048 M02	`2023-12-27` - `2025-01-25`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://cs2.itpharma.by/
Frame ID: D7396484342F00ED688329C4600650D8
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

iRetailCloudServer API

Detected technologies

React (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

<[^>]+data-react

Page Statistics

7
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

1480 kB
Transfer

1493 kB
Size

0
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://validator.swagger.io/validator/debug?url=https%3A%2F%2Fcs2.itpharma.by%2Fswagger.json

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions
3 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response cs2.itpharma.by/	1 KB 2 KB	173ms 57ms	Document text/html	178.124.194.126 BELPAK-AS BELPAK
General Check archive.org Show headers Download Go to Full URL https://cs2.itpharma.by/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 178.124.194.126 Polatsk, Belarus, ASN6697 (BELPAK-AS BELPAK, BY), Reverse DNS email.farmin.by Software nginx/1.20.1 / iRetailCloudServer v3.11.1 Resource Hash `2009fc39bb7ca90bfea736e62edf2ae2b13c3b8b8de26023446cbb5e139d5d79` Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" sec-ch-ua-mobile ?0 sec-ch-ua-platform "Win32" Response headers Accept-Ranges bytes Cache-Control public, max-age=0 Connection keep-alive Content-Length 1218 Content-Type text/html; charset=UTF-8 Date Mon, 03 Jun 2024 06:16:05 GMT ETag W/"4c2-18ebf364b43" Last-Modified Mon, 08 Apr 2024 19:36:30 GMT Server nginx/1.20.1 X-Powered-By iRetailCloudServer v3.11.1
GET H/1.1	200 OK	swagger-ui.css cs2.itpharma.by/index_files/	150 KB 151 KB	180ms 179ms	Stylesheet text/css	178.124.194.126 BELPAK-AS BELPAK
General Check archive.org Show headers Download Go to Full URL https://cs2.itpharma.by/index_files/swagger-ui.css Requested by Host: cs2.itpharma.by URL: https://cs2.itpharma.by/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 178.124.194.126 Polatsk, Belarus, ASN6697 (BELPAK-AS BELPAK, BY), Reverse DNS email.farmin.by Software nginx/1.20.1 / iRetailCloudServer v3.11.1 Resource Hash `9f46553f70440a1dc8b10ef85ecb8912b1efd6544168723a35bd799464882276` Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://cs2.itpharma.by/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Mon, 03 Jun 2024 06:16:05 GMT Last-Modified Mon, 08 Apr 2024 19:36:30 GMT Server nginx/1.20.1 X-Powered-By iRetailCloudServer v3.11.1 ETag W/"25996-18ebf364bbf" Content-Type text/css; charset=UTF-8 Cache-Control public, max-age=0 Connection keep-alive Accept-Ranges bytes Content-Length 154006
GET H/1.1	200 OK	swagger-ui-bundle.js Show response cs2.itpharma.by/index_files/	922 KB 922 KB	216ms 117ms	Script application/javascript	178.124.194.126 BELPAK-AS BELPAK
General Check archive.org Show headers Download Go to Full URL https://cs2.itpharma.by/index_files/swagger-ui-bundle.js Requested by Host: cs2.itpharma.by URL: https://cs2.itpharma.by/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 178.124.194.126 Polatsk, Belarus, ASN6697 (BELPAK-AS BELPAK, BY), Reverse DNS email.farmin.by Software nginx/1.20.1 / iRetailCloudServer v3.11.1 Resource Hash `c505277b43e6912c1673c05b139e6252cd1b515eb99e23d3d7084d091959cd78` Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://cs2.itpharma.by/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Mon, 03 Jun 2024 06:16:05 GMT Last-Modified Mon, 08 Apr 2024 19:36:30 GMT Server nginx/1.20.1 X-Powered-By iRetailCloudServer v3.11.1 ETag W/"e688d-18ebf364b5f" Content-Type application/javascript; charset=UTF-8 Cache-Control public, max-age=0 Connection keep-alive Accept-Ranges bytes Content-Length 944269
GET H/1.1	200 OK	swagger-ui-standalone-preset.js Show response cs2.itpharma.by/index_files/	320 KB 320 KB	273ms 171ms	Script application/javascript	178.124.194.126 BELPAK-AS BELPAK
General Check archive.org Show headers Download Go to Full URL https://cs2.itpharma.by/index_files/swagger-ui-standalone-preset.js Requested by Host: cs2.itpharma.by URL: https://cs2.itpharma.by/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 178.124.194.126 Polatsk, Belarus, ASN6697 (BELPAK-AS BELPAK, BY), Reverse DNS email.farmin.by Software nginx/1.20.1 / iRetailCloudServer v3.11.1 Resource Hash `9565113cb95319ae21ff0e4aab84d35d8a79c50ac9b9439b24c367e4af362e75` Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://cs2.itpharma.by/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Mon, 03 Jun 2024 06:16:05 GMT Last-Modified Mon, 08 Apr 2024 19:36:30 GMT Server nginx/1.20.1 X-Powered-By iRetailCloudServer v3.11.1 ETag W/"4fea6-18ebf364bab" Content-Type application/javascript; charset=UTF-8 Cache-Control public, max-age=0 Connection keep-alive Accept-Ranges bytes Content-Length 327334
GET H/1.1	200 OK	swagger.json Show response cs2.itpharma.by/	65 KB 65 KB	125ms 125ms	Fetch application/json	178.124.194.126 BELPAK-AS BELPAK
General Check archive.org Show headers Download Go to Full URL https://cs2.itpharma.by/swagger.json Requested by Host: cs2.itpharma.by URL: https://cs2.itpharma.by/index_files/swagger-ui-bundle.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 178.124.194.126 Polatsk, Belarus, ASN6697 (BELPAK-AS BELPAK, BY), Reverse DNS email.farmin.by Software nginx/1.20.1 / iRetailCloudServer v3.11.1 Resource Hash `dbdb0d087f63fc1f1d4618d9f1e2d22516ffc5ff4c9ef6028af1bba931e8bb0e` Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Accept application/json,/ Referer https://cs2.itpharma.by/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Mon, 03 Jun 2024 06:16:05 GMT Last-Modified Mon, 08 Apr 2024 19:36:30 GMT Server nginx/1.20.1 X-Powered-By iRetailCloudServer v3.11.1 ETag W/"1044e-18ebf364bc3" Content-Type application/json; charset=UTF-8 Cache-Control public, max-age=0 Connection keep-alive Accept-Ranges bytes Content-Length 66638
GET DATA	200 OK	truncated /	15 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `692881516b5727543e5d0e2afe602c1659d1b50d7af857219c33d12913167520` Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 Response headers Content-Type image/svg+xml
GET H2	200	validator validator.swagger.io/	2 KB 2 KB	1304ms 1070ms	Image image/png	3.227.156.219 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://validator.swagger.io/validator?url=https%3A%2F%2Fcs2.itpharma.by%2Fswagger.json Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 3.227.156.219 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-3-227-156-219.compute-1.amazonaws.com Software Jetty(9.4.53.v20231009) / Resource Hash `c2625a6d2f4a8eacd1bbde148a03b7d19e724f9c8faabb81935da84416780938` Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://cs2.itpharma.by/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Mon, 03 Jun 2024 06:16:06 GMT server Jetty(9.4.53.v20231009) access-control-allow-methods GET, POST, DELETE, PUT content-type image/png access-control-allow-origin * access-control-expose-headers Content-Disposition access-control-allow-headers Content-Type, api_key, Authorization content-length 1599
GET H/1.1	200 OK	favicon.ico cs2.itpharma.by/	17 KB 18 KB	129ms 129ms	Other image/x-icon	178.124.194.126 BELPAK-AS BELPAK
General Check archive.org Show headers Download Go to Full URL https://cs2.itpharma.by/favicon.ico Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 178.124.194.126 Polatsk, Belarus, ASN6697 (BELPAK-AS BELPAK, BY), Reverse DNS email.farmin.by Software nginx/1.20.1 / iRetailCloudServer v3.11.1 Resource Hash `ed52bfdb89b56636589ffc0bdb7797245bff5e653506c039b25edc9ec3a44191` Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://cs2.itpharma.by/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers Date Mon, 03 Jun 2024 06:16:05 GMT Server nginx/1.20.1 X-Powered-By iRetailCloudServer v3.11.1 ETag "45cc-O2iKxteejLFu/tDkJKN+OflSUR8" Content-Type image/x-icon Cache-Control public, max-age=31536000 Connection keep-alive Content-Length 17868
GET DATA	200 OK	truncated /	261 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `74bb6e4d4d9dce03624a54590957e142b49b0467bc617b7cc637f87d6e9d3f9e` Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	147 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `575ebc6a2f086b5de60916aa1b65dd785f69143178fc204ef7432db79ee08a50` Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 Response headers Content-Type image/svg+xml;charset=utf-8

Verdicts & Comments Add Verdict or Comment

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cs2.itpharma.by
validator.swagger.io
178.124.194.126
3.227.156.219
2009fc39bb7ca90bfea736e62edf2ae2b13c3b8b8de26023446cbb5e139d5d79
575ebc6a2f086b5de60916aa1b65dd785f69143178fc204ef7432db79ee08a50
692881516b5727543e5d0e2afe602c1659d1b50d7af857219c33d12913167520
74bb6e4d4d9dce03624a54590957e142b49b0467bc617b7cc637f87d6e9d3f9e
9565113cb95319ae21ff0e4aab84d35d8a79c50ac9b9439b24c367e4af362e75
9f46553f70440a1dc8b10ef85ecb8912b1efd6544168723a35bd799464882276
c2625a6d2f4a8eacd1bbde148a03b7d19e724f9c8faabb81935da84416780938
c505277b43e6912c1673c05b139e6252cd1b515eb99e23d3d7084d091959cd78
dbdb0d087f63fc1f1d4618d9f1e2d22516ffc5ff4c9ef6028af1bba931e8bb0e
ed52bfdb89b56636589ffc0bdb7797245bff5e653506c039b25edc9ec3a44191

cs2.itpharma.by Open in urlscan Pro 178.124.194.126 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

7 Requests

100 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

3 IPs

2 Countries

1480 kBTransfer

1493 kBSize

0 Cookies

1 Outgoing links

Redirected requests

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 3 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

7 JavaScript Global Variables

0 Cookies

Indicators

cs2.itpharma.by Open in urlscan Pro
178.124.194.126 Public Scan

Screenshot
Live screenshot

Full Image

7
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

1480 kB
Transfer

1493 kB
Size

0
Cookies

7 HTTP transactions
3 data transactions