urlscan.io logo urlscan.io
SecurityTrails logo

omnia-grup.ro Open in urlscan Pro
89.33.44.179  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://u13966782.ct.sendgrid.net/ls/click?upn=aonrLCx4I4yznQJ0FX0U0v1ZAcCO8HZgOaXfwfRSTg50Y3LFuj9GAoVqUBtEbyZw2wuIakSK-2F-2FVz210...
Effective URL: https://omnia-grup.ro/count/facr/5fgff/?email=kseifert@apollolp.com
Submission: On March 18 via api from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 2 countries across 4 domains to perform 4 HTTP transactions. The main IP is 89.33.44.179, located in Romania and belongs to ROMARG, RO. The main domain is omnia-grup.ro.
TLS certificate: Issued by Let's Encrypt Authority X3 on March 5th 2020. Valid for: 3 months.
This is the only time omnia-grup.ro was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Excel / PDF download (Online)

Domain & IP information

IP Address AS Autonomous System
1 1 167.89.118.35 11377 (SENDGRID)
1 4 89.33.44.179 205275 (ROMARG)
4 2
Apex Domain
Subdomains		 Transfer
3 omnia-grup.ro
omnia-grup.ro
95 KB
1 ehalloween.ro
ehalloween.ro
216 B
1 sendgrid.net
u13966782.ct.sendgrid.net
254 B
0 googleapis.com Failed
fonts.googleapis.com Failed
4 4
Domain Requested by
3 omnia-grup.ro omnia-grup.ro
1 ehalloween.ro 1 redirects
1 u13966782.ct.sendgrid.net 1 redirects
0 fonts.googleapis.com Failed omnia-grup.ro
4 4

This site contains no links.

Subject Issuer Validity Valid
omnia-grup.ro
Let's Encrypt Authority X3		 2020-03-05 -
2020-06-03		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://omnia-grup.ro/count/facr/5fgff/?email=kseifert@apollolp.com
Frame ID: DFF7C7B2650DE3C61DCBCD0830DD4046
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://u13966782.ct.sendgrid.net/ls/click?upn=aonrLCx4I4yznQJ0FX0U0v1ZAcCO8HZgOaXfwfRSTg50Y3LFuj9GAoVqUBtEbyZ... HTTP 302
    https://ehalloween.ro/kseifert@apollolp.com HTTP 302
    https://omnia-grup.ro/count/facr/5fgff/?email=kseifert@apollolp.com Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /^LiteSpeed$/i
Overall confidence: 100%
Detected patterns
  • html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i

Page Statistics

4
Requests

75 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

2
IPs

2
Countries

95 kB
Transfer

96 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://u13966782.ct.sendgrid.net/ls/click?upn=aonrLCx4I4yznQJ0FX0U0v1ZAcCO8HZgOaXfwfRSTg50Y3LFuj9GAoVqUBtEbyZw2wuIakSK-2F-2FVz210L5ffHvQ-3D-3DI52L_eFd6Uf92sqrZvxoPwL3bTndipg-2FMaPRE2rupoWKx8BZQPU-2BUm7eTT1RSL2if-2F2Xme4LRBDPSApcPxE9XBkILOaPC6okPl-2FlAtWT-2BF8ZHX-2FeF1-2BLl5IjGwkDMjfy-2BgEygQuVoK9-2F-2B-2B9VIRkhtNcShMlUMjWNm-2BNpXpdO98ylTMiRJ8YDksAktDZUqiBVLaFfZ1VY-2FXW-2F9i3Rcn6Qpeuo8WWvtn7iBWJjIy5-2F7ka7uhHTaki80iIPTHguk-2B4WvjHPm HTTP 302
    https://ehalloween.ro/kseifert@apollolp.com HTTP 302
    https://omnia-grup.ro/count/facr/5fgff/?email=kseifert@apollolp.com Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
omnia-grup.ro/count/facr/5fgff/
Redirect Chain
  • https://u13966782.ct.sendgrid.net/ls/click?upn=aonrLCx4I4yznQJ0FX0U0v1ZAcCO8HZgOaXfwfRSTg50Y3LFuj9GAoVqUBtEbyZw2wuIakSK-2F-2FVz210L5ffHvQ-3D-3DI52L_eFd6Uf92sqrZvxoPwL3bTndipg-2FMaPRE2rupoWKx8BZQPU-...
  • https://ehalloween.ro/kseifert@apollolp.com
  • https://omnia-grup.ro/count/facr/5fgff/?email=kseifert@apollolp.com
1 KB
697 B 		Document
General
Check archive.org
Download Go to
Full URL
https://omnia-grup.ro/count/facr/5fgff/?email=kseifert@apollolp.com
Protocol
H2
Security
TLS 1.3, , CHACHA20_POLY1305
Server
89.33.44.179 , Romania, ASN205275 (ROMARG, RO),
Reverse DNS
Software
LiteSpeed / PHP/7.0.33
Resource Hash
a34ee00dd6905fcc7e6cf4378777fe5193581a8e51cb82a3e71c338c017f8279

Request headers

:method
GET
:authority
omnia-grup.ro
:scheme
https
:path
/count/facr/5fgff/?email=kseifert@apollolp.com
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest
document
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
document

Response headers

status
200
x-powered-by
PHP/7.0.33
content-type
text/html; charset=UTF-8
content-length
533
content-encoding
br
vary
Accept-Encoding
date
Wed, 18 Mar 2020 00:41:50 GMT
server
LiteSpeed
alt-svc
quic=":443"; ma=2592000; v="35,39,43,44"

Redirect headers

status
302
x-powered-by
PHP/7.1.33
location
https://omnia-grup.ro/count/facr/5fgff/?email=kseifert@apollolp.com
content-type
text/html; charset=UTF-8
content-length
0
date
Wed, 18 Mar 2020 00:41:50 GMT
server
LiteSpeed
cache-control
no-cache, no-store, must-revalidate, max-age=0
alt-svc
quic=":443"; ma=2592000; v="35,39,43,44"
style.css
omnia-grup.ro/count/facr/5fgff/ 		2 KB
669 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://omnia-grup.ro/count/facr/5fgff/style.css
Requested by
Host: omnia-grup.ro
URL: https://omnia-grup.ro/count/facr/5fgff/?email=kseifert@apollolp.com
Protocol
H2
Security
TLS 1.3, , CHACHA20_POLY1305
Server
89.33.44.179 , Romania, ASN205275 (ROMARG, RO),
Reverse DNS
Software
LiteSpeed /
Resource Hash
d79c162546f1b3d7e79c5d4557e619f9d990b2b044806ff058193e142e6c7f2c

Request headers

Referer
https://omnia-grup.ro/count/facr/5fgff/?email=kseifert@apollolp.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
style

Response headers

date
Wed, 18 Mar 2020 00:41:50 GMT
content-encoding
br
last-modified
Sun, 25 Jun 2017 10:48:50 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
text/css
status
200
cache-control
public, max-age=604800
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="35,39,43,44"
content-length
551
expires
Wed, 25 Mar 2020 00:41:50 GMT
css
fonts.googleapis.com/ 		0
0
bg.png
omnia-grup.ro/count/facr/5fgff/ 		94 KB
94 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://omnia-grup.ro/count/facr/5fgff/bg.png
Protocol
H2
Security
TLS 1.3, , CHACHA20_POLY1305
Server
89.33.44.179 , Romania, ASN205275 (ROMARG, RO),
Reverse DNS
Software
LiteSpeed /
Resource Hash
34aa021f8933baefa64cd07e049433d1052e6618713dfd7e5a77eefb4883ab90

Request headers

Referer
https://omnia-grup.ro/count/facr/5fgff/style.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Wed, 18 Mar 2020 00:41:50 GMT
last-modified
Sun, 25 Jun 2017 20:46:56 GMT
server
LiteSpeed
content-type
image/png
status
200
cache-control
public, max-age=604800
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="35,39,43,44"
content-length
96054
expires
Wed, 25 Mar 2020 00:41:50 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
fonts.googleapis.com
URL
http://fonts.googleapis.com/css?family=Oleo+Script

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Excel / PDF download (Online)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate

0 Cookies