urlscan.io logo urlscan.io
SecurityTrails logo

hinescu.ro Open in urlscan Pro
77.81.138.115  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://hinescu.ro/nitro.php
Effective URL: https://hinescu.ro/claim/
Submission: On April 14 via manual from ZA — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 13 HTTP transactions. The main IP is 77.81.138.115, located in Romania and belongs to SIMPLIQ-AS, RO. The main domain is hinescu.ro.
TLS certificate: Issued by cPanel, Inc. Certification Authority on April 12th 2023. Valid for: 3 months.
This is the only time hinescu.ro was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Scam (Online)

Domain & IP information

IP Address AS Autonomous System
1 8 77.81.138.115 39758 (SIMPLIQ-AS)
1 2600:9000:249... 16509 (AMAZON-02)
5 2600:9000:249... 16509 (AMAZON-02)
13 3
Apex Domain
Subdomains		 Transfer
8 hinescu.ro
hinescu.ro
2 MB
6 cloudfront.net
d2bb5k76l7oivo.cloudfront.net
d2punpeg7vtjci.cloudfront.net
26 KB
13 2
Domain Requested by
8 hinescu.ro 1 redirects hinescu.ro
5 d2punpeg7vtjci.cloudfront.net d2bb5k76l7oivo.cloudfront.net
1 d2bb5k76l7oivo.cloudfront.net hinescu.ro
13 3

This site contains no links.

Subject Issuer Validity Valid
hinescu.ro
cPanel, Inc. Certification Authority		 2023-04-12 -
2023-07-11		 3 months crt.sh
*.cloudfront.net
Amazon RSA 2048 M01		 2022-12-08 -
2023-12-07		 a year crt.sh

This page contains 1 frames:

Primary Page: https://hinescu.ro/claim/
Frame ID: 309934E22355227828848503F1C45546
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://hinescu.ro/nitro.php HTTP 302
    https://hinescu.ro/claim/ Page URL

Page Statistics

13
Requests

100 %
HTTPS

67 %
IPv6

2
Domains

3
Subdomains

3
IPs

2
Countries

2558 kB
Transfer

2572 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://hinescu.ro/nitro.php HTTP 302
    https://hinescu.ro/claim/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
hinescu.ro/claim/
Redirect Chain
  • https://hinescu.ro/nitro.php
  • https://hinescu.ro/claim/
3 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://hinescu.ro/claim/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
77.81.138.115 , Romania, ASN39758 (SIMPLIQ-AS, RO),
Reverse DNS
mail.alecia.ro
Software
Apache /
Resource Hash
fff7332a7fdbee30eaf7ed3b26a85f8b32e82b54888ba07e2508db861fa5b3f8

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
content-length
3133
content-type
text/html
date
Fri, 14 Apr 2023 17:40:41 GMT
last-modified
Sun, 09 Apr 2023 02:21:29 GMT
server
Apache

Redirect headers

content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Fri, 14 Apr 2023 17:40:40 GMT
location
claim/
server
Apache
vary
Accept-Encoding
40532.45cfda0794123b4bec3c.css
hinescu.ro/claim/ 		2 MB
2 MB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://hinescu.ro/claim/40532.45cfda0794123b4bec3c.css
Requested by
Host: hinescu.ro
URL: https://hinescu.ro/claim/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
77.81.138.115 , Romania, ASN39758 (SIMPLIQ-AS, RO),
Reverse DNS
mail.alecia.ro
Software
Apache /
Resource Hash
29835dbb43a62abdbbba78a38388d9fffc9127a7ac1e90e405099febfde52296

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://hinescu.ro/claim/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

date
Fri, 14 Apr 2023 17:40:41 GMT
last-modified
Tue, 21 Mar 2023 17:10:16 GMT
server
Apache
accept-ranges
bytes
content-length
2426798
content-type
text/css
0e4accd.js
d2bb5k76l7oivo.cloudfront.net/ 		23 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://d2bb5k76l7oivo.cloudfront.net/0e4accd.js
Requested by
Host: hinescu.ro
URL: https://hinescu.ro/claim/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2491:4200:d:e9c:2500:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
d212a5a732e0632cb7a63412830a021c8c0a4aaa835a604ef008c1b0e4b00300

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://hinescu.ro/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

date
Fri, 14 Apr 2023 17:15:38 GMT
content-encoding
br
via
1.1 099a327961f82798658bf21aa210d4a0.cloudfront.net (CloudFront)
last-modified
Wed, 11 Jan 2023 21:50:46 GMT
server
AmazonS3
x-amz-cf-pop
FRA56-P7
age
1508
etag
W/"8ab72c4473621e1b30a24ec89af90bcf"
vary
Accept-Encoding
x-cache
Error from cloudfront
content-type
application/javascript
x-amz-cf-id
vs-Qu-nXc21OZABbLnf8coFilTJdOUm4HTFClM0VqTPIhV0GTuSlsw==
html.3682902.8dbd0.0.js
d2punpeg7vtjci.cloudfront.net/public/external/v2/ 		10 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://d2punpeg7vtjci.cloudfront.net/public/external/v2/html.3682902.8dbd0.0.js
Requested by
Host: d2bb5k76l7oivo.cloudfront.net
URL: https://d2bb5k76l7oivo.cloudfront.net/0e4accd.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2491:8600:1c:8de0:8c80:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache/2.4.46 () OpenSSL/1.0.2k-fips PHP/7.4.11 / PHP/7.4.11
Resource Hash
f0a6a7dec68553e03f708e57b8082fc86d6705aa5456b64855fab5b7c7b2c59e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://hinescu.ro/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

date
Fri, 14 Apr 2023 17:40:43 GMT
via
1.1 78720628b37ebf3e33c42dc098252ee8.cloudfront.net (CloudFront)
server
Apache/2.4.46 () OpenSSL/1.0.2k-fips PHP/7.4.11
x-amz-cf-pop
FRA56-P7
x-powered-by
PHP/7.4.11
x-cache
Miss from cloudfront
content-type
application/javascript
x-amz-cf-id
OSrnwDdZTRS5zbOWksT-7kWdYC52eL9qeE06VnUKO7iZEWW8E21upw==
css_front.css
d2punpeg7vtjci.cloudfront.net/public/external/ 		6 KB
7 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://d2punpeg7vtjci.cloudfront.net/public/external/css_front.css
Requested by
Host: d2bb5k76l7oivo.cloudfront.net
URL: https://d2bb5k76l7oivo.cloudfront.net/0e4accd.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2491:8600:1c:8de0:8c80:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache/2.4.46 () OpenSSL/1.0.2k-fips PHP/7.4.11 /
Resource Hash
a7bd79b6fba60944ee3a9c153108ff0819d2db57850116ac7065a86db08af4ec

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://hinescu.ro/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

date
Fri, 14 Apr 2023 17:40:43 GMT
via
1.1 78720628b37ebf3e33c42dc098252ee8.cloudfront.net (CloudFront)
last-modified
Tue, 23 Jun 2020 20:06:47 GMT
server
Apache/2.4.46 () OpenSSL/1.0.2k-fips PHP/7.4.11
x-amz-cf-pop
FRA56-P7
etag
"19c4-5a8c5e62e9d0a"
x-cache
Miss from cloudfront
content-type
text/css
accept-ranges
bytes
content-length
6596
x-amz-cf-id
US1_8rXPfBXm1wlrX2l69XMeEEPs27FQEv5-WAGa27lT9PaXx1ckUg==
83e99dbc7c072587a2f096e0bf526dd7.png
hinescu.ro/claim/ 		79 KB
79 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://hinescu.ro/claim/83e99dbc7c072587a2f096e0bf526dd7.png
Requested by
Host: hinescu.ro
URL: https://hinescu.ro/claim/40532.45cfda0794123b4bec3c.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
77.81.138.115 , Romania, ASN39758 (SIMPLIQ-AS, RO),
Reverse DNS
mail.alecia.ro
Software
Apache /
Resource Hash
6aaceeecadcaed3c4b723fc8bae05b05b2c9e67aca5a4af0c208121f4521748d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://hinescu.ro/claim/40532.45cfda0794123b4bec3c.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

date
Fri, 14 Apr 2023 17:40:41 GMT
last-modified
Tue, 21 Mar 2023 17:07:34 GMT
server
Apache
accept-ranges
bytes
content-length
80560
content-type
image/png
a9009aaba5bfab576a517f6915b3c0b6.svg
hinescu.ro/claim/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://hinescu.ro/claim/a9009aaba5bfab576a517f6915b3c0b6.svg
Requested by
Host: hinescu.ro
URL: https://hinescu.ro/claim/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
77.81.138.115 , Romania, ASN39758 (SIMPLIQ-AS, RO),
Reverse DNS
mail.alecia.ro
Software
Apache /
Resource Hash
fe5b0d00b63b0e88f3b41126ead06193596f3998e9f64f7d2dd4411785b3fcd3

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://hinescu.ro/claim/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

date
Fri, 14 Apr 2023 17:40:41 GMT
last-modified
Tue, 21 Mar 2023 17:06:48 GMT
server
Apache
accept-ranges
bytes
content-length
2215
content-type
image/svg+xml
568d4eaa150e7daa3b0b03bcde881aef.woff2
hinescu.ro/claim/ 		26 KB
26 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://hinescu.ro/claim/568d4eaa150e7daa3b0b03bcde881aef.woff2
Requested by
Host: hinescu.ro
URL: https://hinescu.ro/claim/40532.45cfda0794123b4bec3c.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
77.81.138.115 , Romania, ASN39758 (SIMPLIQ-AS, RO),
Reverse DNS
mail.alecia.ro
Software
Apache /
Resource Hash
061b7a582a0a5dd252a71fcf01252a4dcb5e82504052359a3c064c1f09ed225b

Request headers

Referer
https://hinescu.ro/claim/40532.45cfda0794123b4bec3c.css
Origin
https://hinescu.ro
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

date
Fri, 14 Apr 2023 17:40:41 GMT
last-modified
Tue, 21 Mar 2023 17:07:52 GMT
server
Apache
accept-ranges
bytes
content-length
26636
content-type
font/woff2
8713b8a90bded5ae0c4872484f54fbde.woff2
hinescu.ro/claim/ 		25 KB
25 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://hinescu.ro/claim/8713b8a90bded5ae0c4872484f54fbde.woff2
Requested by
Host: hinescu.ro
URL: https://hinescu.ro/claim/40532.45cfda0794123b4bec3c.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
77.81.138.115 , Romania, ASN39758 (SIMPLIQ-AS, RO),
Reverse DNS
mail.alecia.ro
Software
Apache /
Resource Hash
4bf3050b6062e0e00c61e696cf26a7d6162c71c29062f2ae4d4647260934370f

Request headers

Referer
https://hinescu.ro/claim/40532.45cfda0794123b4bec3c.css
Origin
https://hinescu.ro
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

date
Fri, 14 Apr 2023 17:40:41 GMT
last-modified
Tue, 21 Mar 2023 17:08:04 GMT
server
Apache
accept-ranges
bytes
content-length
25424
content-type
font/woff2
2d7928e1003804522e56efd448d4777b.woff2
hinescu.ro/claim/ 		26 KB
26 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://hinescu.ro/claim/2d7928e1003804522e56efd448d4777b.woff2
Requested by
Host: hinescu.ro
URL: https://hinescu.ro/claim/40532.45cfda0794123b4bec3c.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
77.81.138.115 , Romania, ASN39758 (SIMPLIQ-AS, RO),
Reverse DNS
mail.alecia.ro
Software
Apache /
Resource Hash
eb23e767e0b0e47ad43f7f14558e003f451aeaff87315ef3e5c0acaf35a843ee

Request headers

Referer
https://hinescu.ro/claim/40532.45cfda0794123b4bec3c.css
Origin
https://hinescu.ro
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

date
Fri, 14 Apr 2023 17:40:41 GMT
last-modified
Tue, 21 Mar 2023 17:08:14 GMT
server
Apache
accept-ranges
bytes
content-length
26460
content-type
font/woff2
css.css
d2punpeg7vtjci.cloudfront.net/public/clockers/CustomButton/ 		1010 B
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://d2punpeg7vtjci.cloudfront.net/public/clockers/CustomButton/css.css
Requested by
Host: d2bb5k76l7oivo.cloudfront.net
URL: https://d2bb5k76l7oivo.cloudfront.net/0e4accd.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2491:8600:1c:8de0:8c80:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache/2.4.51 () OpenSSL/1.0.2k-fips PHP/7.4.11 /
Resource Hash
a7081a117335212b9e7f2e348f7369a64423d51db1666310b3451e7375f0b7de

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://hinescu.ro/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

date
Fri, 14 Apr 2023 17:40:43 GMT
via
1.1 78720628b37ebf3e33c42dc098252ee8.cloudfront.net (CloudFront)
last-modified
Fri, 10 Apr 2020 22:29:00 GMT
server
Apache/2.4.51 () OpenSSL/1.0.2k-fips PHP/7.4.11
x-amz-cf-pop
FRA56-P7
etag
"3f2-5a2f7428ae907"
x-cache
Miss from cloudfront
content-type
text/css
accept-ranges
bytes
content-length
1010
x-amz-cf-id
1qjWV4c4kOf581mTkA_zEuZ1uOK5JfEOb4BY-WiGu1X5CsKCpuZBKg==
guid
d2punpeg7vtjci.cloudfront.net/public/ 		0
277 B 		Script
General
Check archive.org
Download Go to
Full URL
https://d2punpeg7vtjci.cloudfront.net/public/guid?cpguid=fvfvc0y7d&e=ll&t=1681494044254
Requested by
Host: d2bb5k76l7oivo.cloudfront.net
URL: https://d2bb5k76l7oivo.cloudfront.net/0e4accd.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2491:8600:1c:8de0:8c80:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache/2.4.51 () OpenSSL/1.0.2k-fips PHP/7.4.11 / PHP/7.4.11
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://hinescu.ro/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

date
Fri, 14 Apr 2023 17:40:44 GMT
via
1.1 78720628b37ebf3e33c42dc098252ee8.cloudfront.net (CloudFront)
server
Apache/2.4.51 () OpenSSL/1.0.2k-fips PHP/7.4.11
x-amz-cf-pop
FRA56-P7
x-powered-by
PHP/7.4.11
x-cache
Miss from cloudfront
content-type
text/html; charset=UTF-8
content-length
0
x-amz-cf-id
KmUBBRbBE4uc92h6_STG242vBSDGcw_dguv7JBj0JG15MwPeC2VvGw==
check.php
d2punpeg7vtjci.cloudfront.net/public/external/ 		78 B
372 B 		Script
General
Check archive.org
Download Go to
Full URL
https://d2punpeg7vtjci.cloudfront.net/public/external/check.php?it=3682902&time=1681494045486
Requested by
Host: d2bb5k76l7oivo.cloudfront.net
URL: https://d2bb5k76l7oivo.cloudfront.net/0e4accd.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2491:8600:1c:8de0:8c80:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache/2.4.46 () OpenSSL/1.0.2k-fips PHP/7.4.11 / PHP/7.4.11
Resource Hash
9ef4a63fc5e0a14a7301d693d65d6acfc44cdf14853c4a20890198f2d5e52e3b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://hinescu.ro/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

date
Fri, 14 Apr 2023 17:40:45 GMT
via
1.1 78720628b37ebf3e33c42dc098252ee8.cloudfront.net (CloudFront)
server
Apache/2.4.46 () OpenSSL/1.0.2k-fips PHP/7.4.11
x-amz-cf-pop
FRA56-P7
x-powered-by
PHP/7.4.11
x-cache
Miss from cloudfront
content-type
application/javascript
content-length
78
x-amz-cf-id
hB16rqwP8jiI7Xg6ENQ1RhZgv8Is-EaKl0EUzi68bfEMpu9ZoZAPMw==

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Scam (Online)

17 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 boolean| credentialless object| CPABUILDSETTINGS object| CPABUILDContentLocker number| __cfRLUnblockHandlers function| CPBContentLocker function| CPABuildLock function| CPABuildGetFeedURL function| CPABuildGetIframeURL function| CPABuildGetIframeHTML function| CPABuildUnlock function| CPABuildOfferComplete function| CPABuildOffersComplete function| CPABuildCheckForLead function| og_load function| CPABuildComplete function| call_locker

1 Cookies

Domain/Path Name / Value
hinescu.ro/ Name: _cpguid
Value: fvfvc0y7d