www.fretolea.com Open in urlscan Pro
104.219.250.203 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://qwsed.s3.amazonaws.com/fedxpack.html
Effective URL:
https://www.fretolea.com/OO/BD_fmenbs/?uclick=ntejrn7v&uclickhash=ntejrn7v-ntejrn7v-525m-0-xiyd-xo15i4-k21n8n-1d1af2
Submission: On February 13 via manual (February 13th 2023, 10:51:31 am UTC) from US — Scanned from DE

Summary HTTP 15 Redirects Behaviour Indicators

Summary

This website contacted 6 IPs in 3 countries across 6 domains to perform 15 HTTP transactions. The main IP is 104.219.250.203, located in United States and belongs to NAMECHEAP-NET, US. The main domain is www.fretolea.com. The Cisco Umbrella rank of the primary domain is 601522.
TLS certificate: Issued by R3 on December 28th 2022. Valid for: 3 months.

This is the only time www.fretolea.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	52.216.217.9 52.216.217.9	16509 (AMAZON-02) (AMAZON-02)
1 1	192.64.115.202 192.64.115.202	22612 (NAMECHEAP...) (NAMECHEAP-NET)
8	104.219.250.203 104.219.250.203	22612 (NAMECHEAP...) (NAMECHEAP-NET)
3	2606:4700::68... 2606:4700::6812:e234	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:806::200a	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400d:802::200a	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:806::2003	15169 (GOOGLE) (GOOGLE)
15	6

1 52.216.217.9 (Ashburn, United States)

ASN16509 (AMAZON-02, US)
PTR: s3-1-w.amazonaws.com

qwsed.s3.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.64.115.202 (United States) 1 redirects

ASN22612 (NAMECHEAP-NET, US)
PTR: server1.vedicrococo.com

horgkava.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 104.219.250.203 (United States)

ASN22612 (NAMECHEAP-NET, US)
PTR: nc-ph-0833-27.web-hosting.com

www.fretolea.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700::6812:e234 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.onesignal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
onesignal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:806::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400d:802::200a (Ireland)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:806::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	fretolea.com www.fretolea.com — Cisco Umbrella Rank: 601522	169 KB
3	onesignal.com cdn.onesignal.com — Cisco Umbrella Rank: 3475 onesignal.com — Cisco Umbrella Rank: 1070	73 KB
2	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 510 fonts.googleapis.com — Cisco Umbrella Rank: 114	32 KB
1	gstatic.com fonts.gstatic.com	16 KB
1	horgkava.com 1 redirects horgkava.com	538 B
1	amazonaws.com qwsed.s3.amazonaws.com	651 B
15	6

	Domain	Requested by
8	www.fretolea.com	qwsed.s3.amazonaws.com www.fretolea.com
2	cdn.onesignal.com	www.fretolea.com cdn.onesignal.com
1	fonts.gstatic.com	fonts.googleapis.com
1	onesignal.com	cdn.onesignal.com
1	fonts.googleapis.com	www.fretolea.com
1	ajax.googleapis.com	www.fretolea.com
1	horgkava.com	1 redirects
1	qwsed.s3.amazonaws.com
15	8

This site contains no links.

Subject Issuer	Validity	Valid
*.s3.amazonaws.com Amazon	`2022-09-21` - `2023-08-26`	a year	crt.sh
www.bundokoa.com R3	`2022-12-28` - `2023-03-28`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-06-03` - `2023-06-02`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2023-01-31` - `2023-04-25`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2023-01-31` - `2023-04-25`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://www.fretolea.com/OO/BD_fmenbs/?uclick=ntejrn7v&uclickhash=ntejrn7v-ntejrn7v-525m-0-xiyd-xo15i4-k21n8n-1d1af2
Frame ID: 5D3DCBF38A4AEA886D46579000FAE85E
Requests: 15 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Fedex

Page URL History Show full URLs

https://qwsed.s3.amazonaws.com/fedxpack.html Page URL
http://horgkava.com/click.php?key=3rxkon9nptcga6fekiks&batchid=s1c16_ANDY_0210 HTTP 302
https://www.fretolea.com/OO/BD_fmenbs/?uclick=ntejrn7v&uclickhash=ntejrn7v-ntejrn7v-525m-0-xiyd-xo15i... Page URL

Detected technologies

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

OneSignal (Marketing automation) Expand

Overall confidence: 100%
Detected patterns

cdn\.onesignal\.com

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

15
Requests

100 %
HTTPS

57 %
IPv6

6
Domains

8
Subdomains

6
IPs

3
Countries

290 kB
Transfer

576 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://qwsed.s3.amazonaws.com/fedxpack.html Page URL
http://horgkava.com/click.php?key=3rxkon9nptcga6fekiks&batchid=s1c16_ANDY_0210 HTTP 302
https://www.fretolea.com/OO/BD_fmenbs/?uclick=ntejrn7v&uclickhash=ntejrn7v-ntejrn7v-525m-0-xiyd-xo15i4-k21n8n-1d1af2 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

15 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK fedxpack.html
qwsed.s3.amazonaws.com/ 295 B
651 B 406ms
146ms Document
text/html 52.216.217.9
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://qwsed.s3.amazonaws.com/fedxpack.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.216.217.9 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1-w.amazonaws.com
Software: AmazonS3 /
Resource Hash

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Content-Length: 295
Content-Type: text/html
Date: Mon, 13 Feb 2023 10:51:24 GMT
ETag: "f8135d78b41755b43effc81de647f3e4"
Last-Modified: Fri, 10 Feb 2023 11:24:58 GMT
Server: AmazonS3
x-amz-id-2: Chovg8RcetQfAKXwNPpRGxEwdRs8u5K8p4o0u7/E4g4CQevlmbWRxz8rNsnsgOzpIzLV4i0lKZA=
x-amz-request-id: JF78QZJJEQQW07C8

GET
H/1.1

200
OK

Primary Request / Show response
www.fretolea.com/OO/BD_fmenbs/
Redirect Chain

http://horgkava.com/click.php?key=3rxkon9nptcga6fekiks&batchid=s1c16_ANDY_0210
https://www.fretolea.com/OO/BD_fmenbs/?uclick=ntejrn7v&uclickhash=ntejrn7v-ntejrn7v-525m-0-xiyd-xo15i4-k21n8n-1d1af2

11 KB
3 KB

460ms
150ms

Document
text/html

104.219.250.203
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.fretolea.com/OO/BD_fmenbs/?uclick=ntejrn7v&uclickhash=ntejrn7v-ntejrn7v-525m-0-xiyd-xo15i4-k21n8n-1d1af2
Requested by: Host: qwsed.s3.amazonaws.com
URL: https://qwsed.s3.amazonaws.com/fedxpack.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 104.219.250.203 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: nc-ph-0833-27.web-hosting.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 5378fbe42b2735d078b9ca5a4bc855d0342b6f9e20dce4ef0aa9a1e3eeb8c031

Request headers

Referer: https://qwsed.s3.amazonaws.com/fedxpack.html
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html
Date: Mon, 13 Feb 2023 10:51:25 GMT
ETag: W/"63e9e453-2cae"
Last-Modified: Mon, 13 Feb 2023 07:18:43 GMT
Server: nginx/1.18.0 (Ubuntu)
Transfer-Encoding: chunked

Redirect headers

Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Date: Mon, 13 Feb 2023 10:51:24 GMT
Location: https://www.fretolea.com/OO/BD_fmenbs/?uclick=ntejrn7v&uclickhash=ntejrn7v-ntejrn7v-525m-0-xiyd-xo15i4-k21n8n-1d1af2
Server: nginx/1.18.0 (Ubuntu)
Transfer-Encoding: chunked

GET
H2 200 OneSignalSDK.js Show response
cdn.onesignal.com/sdks/ 9 KB
3 KB 55ms
23ms Script
application/javascript 2606:4700::6812:e234
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.onesignal.com/sdks/OneSignalSDK.js

Requested by

Host: www.fretolea.com
URL: https://www.fretolea.com/OO/BD_fmenbs/?uclick=ntejrn7v&uclickhash=ntejrn7v-ntejrn7v-525m-0-xiyd-xo15i4-k21n8n-1d1af2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:e234 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d12c6745eca14e06d4dea70f4c2bd875769b349770d04300477ab18d0db005d4

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.fretolea.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Mon, 13 Feb 2023 10:51:25 GMT
via: 1.1 google
content-encoding: br
cf-cache-status: HIT
server: cloudflare
strict-transport-security: max-age=15552000; includeSubDomains
age: 1575
etag: W/"ae63ef8ff03da61fffaa7f165729897a"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=259200
cf-ray: 798d023b4d9a3674-FRA
access-control-allow-headers: OneSignal-Subscription-Id
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Thu, 16 Feb 2023 10:51:25 GMT

GET
H/1.1 200
OK os.js Show response
www.fretolea.com/ 2 KB
3 KB 150ms
149ms Script
application/javascript 104.219.250.203
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.fretolea.com/os.js
Requested by: Host: www.fretolea.com
URL: https://www.fretolea.com/OO/BD_fmenbs/?uclick=ntejrn7v&uclickhash=ntejrn7v-ntejrn7v-525m-0-xiyd-xo15i4-k21n8n-1d1af2
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 104.219.250.203 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: nc-ph-0833-27.web-hosting.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: a1456e226883cecb317dffaf6e8333bf2d849281c7a983ca5b31c139447ebae8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.fretolea.com/OO/BD_fmenbs/?uclick=ntejrn7v&uclickhash=ntejrn7v-ntejrn7v-525m-0-xiyd-xo15i4-k21n8n-1d1af2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Date: Mon, 13 Feb 2023 10:51:25 GMT
Last-Modified: Mon, 13 Feb 2023 07:18:22 GMT
Server: nginx/1.18.0 (Ubuntu)
ETag: "63e9e43e-920"
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2336

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.5.1/ 87 KB
31 KB 117ms
36ms Script
text/javascript 2a00:1450:4001:806::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.5.1/jquery.min.js

Requested by

Host: www.fretolea.com
URL: https://www.fretolea.com/OO/BD_fmenbs/?uclick=ntejrn7v&uclickhash=ntejrn7v-ntejrn7v-525m-0-xiyd-xo15i4-k21n8n-1d1af2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.fretolea.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Sun, 12 Feb 2023 18:16:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 59698
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31021
x-xss-protection: 0
last-modified: Fri, 08 May 2020 07:05:03 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 12 Feb 2024 18:16:27 GMT

GET
H2 200 css2
fonts.googleapis.com/ 2 KB
961 B 185ms
69ms Stylesheet
text/css 2a00:1450:400d:802::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto&display=swap

Requested by

Host: www.fretolea.com
URL: https://www.fretolea.com/OO/BD_fmenbs/?uclick=ntejrn7v&uclickhash=ntejrn7v-ntejrn7v-525m-0-xiyd-xo15i4-k21n8n-1d1af2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:802::200a , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

df3ba57c1234e50c05735a0dedc033f43d5e638a97d5c51583cac8411d2ea34f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.fretolea.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Mon, 13 Feb 2023 10:51:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Mon, 13 Feb 2023 08:56:59 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 13 Feb 2023 10:51:25 GMT

GET
H/1.1 200
OK styles3.css
www.fretolea.com/OO/BD_fmenbs/files/ 37 KB
37 KB 448ms
298ms Stylesheet
text/css 104.219.250.203
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.fretolea.com/OO/BD_fmenbs/files/styles3.css
Requested by: Host: www.fretolea.com
URL: https://www.fretolea.com/OO/BD_fmenbs/?uclick=ntejrn7v&uclickhash=ntejrn7v-ntejrn7v-525m-0-xiyd-xo15i4-k21n8n-1d1af2
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 104.219.250.203 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: nc-ph-0833-27.web-hosting.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 086e8f2fe00fb63418e8d0e709ae6cdf71d86a9c91795aaffcb008383018a32b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.fretolea.com/OO/BD_fmenbs/?uclick=ntejrn7v&uclickhash=ntejrn7v-ntejrn7v-525m-0-xiyd-xo15i4-k21n8n-1d1af2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Date: Mon, 13 Feb 2023 10:51:25 GMT
Last-Modified: Mon, 13 Feb 2023 07:18:43 GMT
Server: nginx/1.18.0 (Ubuntu)
ETag: "63e9e453-9465"
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 37989

GET
H/1.1 200
OK bbRand.js Show response
www.fretolea.com/ 993 B
1 KB 282ms
149ms Script
application/javascript 104.219.250.203
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.fretolea.com/bbRand.js
Requested by: Host: www.fretolea.com
URL: https://www.fretolea.com/OO/BD_fmenbs/?uclick=ntejrn7v&uclickhash=ntejrn7v-ntejrn7v-525m-0-xiyd-xo15i4-k21n8n-1d1af2
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 104.219.250.203 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: nc-ph-0833-27.web-hosting.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: b72e6330d9510cd1681230eecf8461cada8dc6b230e6c41c2dc0c4cae1349090

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.fretolea.com/OO/BD_fmenbs/?uclick=ntejrn7v&uclickhash=ntejrn7v-ntejrn7v-525m-0-xiyd-xo15i4-k21n8n-1d1af2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Date: Mon, 13 Feb 2023 10:51:25 GMT
Last-Modified: Mon, 13 Feb 2023 07:18:46 GMT
Server: nginx/1.18.0 (Ubuntu)
ETag: "63e9e456-3e1"
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 993

GET
H/1.1 200
OK ved.png
www.fretolea.com/OO/BD_fmenbs/ 16 KB
17 KB 581ms
298ms Image
image/png 104.219.250.203
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.fretolea.com/OO/BD_fmenbs/ved.png
Requested by: Host: www.fretolea.com
URL: https://www.fretolea.com/OO/BD_fmenbs/?uclick=ntejrn7v&uclickhash=ntejrn7v-ntejrn7v-525m-0-xiyd-xo15i4-k21n8n-1d1af2
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 104.219.250.203 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: nc-ph-0833-27.web-hosting.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 10b3e1f812c40c0a71a2308b3692589506de1806faaa5004cf9fcbd0186115bf

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.fretolea.com/OO/BD_fmenbs/?uclick=ntejrn7v&uclickhash=ntejrn7v-ntejrn7v-525m-0-xiyd-xo15i4-k21n8n-1d1af2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Date: Mon, 13 Feb 2023 10:51:25 GMT
Last-Modified: Mon, 13 Feb 2023 07:18:43 GMT
Server: nginx/1.18.0 (Ubuntu)
ETag: "63e9e453-4107"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 16647

GET
H/1.1 200
OK art.png
www.fretolea.com/OO/BD_fmenbs/ 46 KB
46 KB 433ms
150ms Image
image/png 104.219.250.203
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.fretolea.com/OO/BD_fmenbs/art.png
Requested by: Host: www.fretolea.com
URL: https://www.fretolea.com/OO/BD_fmenbs/?uclick=ntejrn7v&uclickhash=ntejrn7v-ntejrn7v-525m-0-xiyd-xo15i4-k21n8n-1d1af2
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 104.219.250.203 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: nc-ph-0833-27.web-hosting.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 0f20842a89e17863b561240af183256cef1f09f60c4de860e6ae5b3304a6c1aa

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.fretolea.com/OO/BD_fmenbs/?uclick=ntejrn7v&uclickhash=ntejrn7v-ntejrn7v-525m-0-xiyd-xo15i4-k21n8n-1d1af2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Date: Mon, 13 Feb 2023 10:51:25 GMT
Last-Modified: Mon, 13 Feb 2023 07:18:43 GMT
Server: nginx/1.18.0 (Ubuntu)
ETag: "63e9e453-b8cc"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 47308

GET
H/1.1 200
OK spin.gif
www.fretolea.com/OO/BD_fmenbs/ 57 KB
57 KB 597ms
298ms Image
image/gif 104.219.250.203
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.fretolea.com/OO/BD_fmenbs/spin.gif
Requested by: Host: www.fretolea.com
URL: https://www.fretolea.com/OO/BD_fmenbs/?uclick=ntejrn7v&uclickhash=ntejrn7v-ntejrn7v-525m-0-xiyd-xo15i4-k21n8n-1d1af2
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 104.219.250.203 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: nc-ph-0833-27.web-hosting.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: f9ac5c5a899727f24d37e798cd1ba7451813d35f9287467c920dc4f2f3b2007a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.fretolea.com/OO/BD_fmenbs/?uclick=ntejrn7v&uclickhash=ntejrn7v-ntejrn7v-525m-0-xiyd-xo15i4-k21n8n-1d1af2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Date: Mon, 13 Feb 2023 10:51:25 GMT
Last-Modified: Mon, 13 Feb 2023 07:18:43 GMT
Server: nginx/1.18.0 (Ubuntu)
ETag: "63e9e453-e32f"
Content-Type: image/gif
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 58159

GET
H/1.1 200
OK script.js Show response
www.fretolea.com/OO/BD_fmenbs/files/ 5 KB
5 KB 450ms
149ms Script
application/javascript 104.219.250.203
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.fretolea.com/OO/BD_fmenbs/files/script.js
Requested by: Host: www.fretolea.com
URL: https://www.fretolea.com/OO/BD_fmenbs/?uclick=ntejrn7v&uclickhash=ntejrn7v-ntejrn7v-525m-0-xiyd-xo15i4-k21n8n-1d1af2
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 104.219.250.203 , United States, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: nc-ph-0833-27.web-hosting.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: f6ea6378def5d0f0fc785a0c4dac15c567c659156843a2a56e1f1b511493d64e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.fretolea.com/OO/BD_fmenbs/?uclick=ntejrn7v&uclickhash=ntejrn7v-ntejrn7v-525m-0-xiyd-xo15i4-k21n8n-1d1af2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Date: Mon, 13 Feb 2023 10:51:25 GMT
Last-Modified: Mon, 13 Feb 2023 07:18:43 GMT
Server: nginx/1.18.0 (Ubuntu)
ETag: "63e9e453-12ac"
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 4780

GET
H2 200 OneSignalPageSDKES6.js Show response
cdn.onesignal.com/sdks/ 283 KB
68 KB 28ms
27ms Script
application/javascript 2606:4700::6812:e234
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151514

Requested by

Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalSDK.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:e234 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

843114448aaeeda7e8caa0cf76d61e0c63b8bffccd34517483363fdb15cdc80c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.fretolea.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Mon, 13 Feb 2023 10:51:25 GMT
via: 1.1 google
content-encoding: br
cf-cache-status: HIT
server: cloudflare
strict-transport-security: max-age=15552000; includeSubDomains
age: 1496
etag: W/"2f96824aee4bf927e734cc519e3e726d"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=259200
cf-ray: 798d023c2ecc3674-FRA
access-control-allow-headers: OneSignal-Subscription-Id
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Thu, 16 Feb 2023 10:51:25 GMT

GET
H2 200 web Show response
onesignal.com/api/v1/sync/bf7a4b0b-0925-483f-a30e-71ae7011df6b/ 3 KB
2 KB 24ms
24ms Script
text/javascript 2606:4700::6812:e234
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://onesignal.com/api/v1/sync/bf7a4b0b-0925-483f-a30e-71ae7011df6b/web?callback=__jp0

Requested by

Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151514

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:e234 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ebc92cacd76db1331355541728f4e643882d4470cdee12f3accc243f31f60672

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.fretolea.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Mon, 13 Feb 2023 10:51:25 GMT
via: 1.1 google
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
x-permitted-cross-domain-policies: none
strict-transport-security: max-age=15552000; includeSubDomains
age: 3581
cf-polished: origSize=3316
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection: 1; mode=block
x-request-id: ca23476b-0f56-46e4-baed-2f4563de7f40
x-runtime: 0.025305
referrer-policy: strict-origin-when-cross-origin
cf-bgj: minify
server: cloudflare
etag: W/"3cb6272eecda265edc5d81a9f86c8ede"
x-download-options: noopen
vary: Origin, Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=3600
cf-ray: 798d023c8f353674-FRA
access-control-allow-headers: SDK-Version
expires: Mon, 13 Feb 2023 11:51:25 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ 15 KB
16 KB 125ms
41ms Font
font/woff2 2a00:1450:4001:806::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Roboto&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.fretolea.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Mon, 13 Feb 2023 01:29:06 GMT
x-content-type-options: nosniff
age: 33739
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 13 Feb 2024 01:29:06 GMT

Verdicts & Comments Add Verdict or Comment

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			horgkava.com/	1970-01-20 09:39:31	Name: uclick Value: ntejrn7v
			horgkava.com/	1970-01-20 09:39:31	Name: uclickhash Value: ntejrn7v-ntejrn7v-525m-0-xiyd-xo15i4-k21n8n-1d1af2

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
cdn.onesignal.com
fonts.googleapis.com
fonts.gstatic.com
horgkava.com
onesignal.com
qwsed.s3.amazonaws.com
www.fretolea.com
104.219.250.203
192.64.115.202
2606:4700::6812:e234
2a00:1450:4001:806::2003
2a00:1450:4001:806::200a
2a00:1450:400d:802::200a
52.216.217.9
086e8f2fe00fb63418e8d0e709ae6cdf71d86a9c91795aaffcb008383018a32b
0f20842a89e17863b561240af183256cef1f09f60c4de860e6ae5b3304a6c1aa
10b3e1f812c40c0a71a2308b3692589506de1806faaa5004cf9fcbd0186115bf
5378fbe42b2735d078b9ca5a4bc855d0342b6f9e20dce4ef0aa9a1e3eeb8c031
843114448aaeeda7e8caa0cf76d61e0c63b8bffccd34517483363fdb15cdc80c
a1456e226883cecb317dffaf6e8333bf2d849281c7a983ca5b31c139447ebae8
b72e6330d9510cd1681230eecf8461cada8dc6b230e6c41c2dc0c4cae1349090
d12c6745eca14e06d4dea70f4c2bd875769b349770d04300477ab18d0db005d4
df3ba57c1234e50c05735a0dedc033f43d5e638a97d5c51583cac8411d2ea34f
ebc92cacd76db1331355541728f4e643882d4470cdee12f3accc243f31f60672
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
f6ea6378def5d0f0fc785a0c4dac15c567c659156843a2a56e1f1b511493d64e
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
f9ac5c5a899727f24d37e798cd1ba7451813d35f9287467c920dc4f2f3b2007a

www.fretolea.com Open in urlscan Pro 104.219.250.203 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

15 Requests

100 %HTTPS

57 %IPv6

6 Domains

8 Subdomains

6 IPs

3 Countries

290 kBTransfer

576 kBSize

2 Cookies

0 Outgoing links

Page URL History

Redirected requests

15 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

13 JavaScript Global Variables

2 Cookies

Indicators

www.fretolea.com Open in urlscan Pro
104.219.250.203 Public Scan

Screenshot
Live screenshot

Full Image

15
Requests

100 %
HTTPS

57 %
IPv6

6
Domains

8
Subdomains

6
IPs

3
Countries

290 kB
Transfer

576 kB
Size

2
Cookies

15 HTTP transactions
0 data transactions