ilcavo.ro
Open in
urlscan Pro
86.35.1.13
Malicious Activity!
Public Scan
URL:
https://ilcavo.ro/posten/visa.html
Submission: On October 13 via manual from RO — Scanned from DE
Submission: On October 13 via manual from RO — Scanned from DE
Summary
This website contacted 2 IPs
in 1 countries
across 1 domains to perform 1 HTTP transactions.
The main IP is 86.35.1.13, located in
Romania and
belongs to RTD Bucharest, Romania, RO.
The main domain is ilcavo.ro.
TLS certificate: Issued by cPanel, Inc. Certification Authority on August 30th 2021. Valid for: 3 months.
This is the only time ilcavo.ro was scanned on urlscan.io!
TLS certificate: Issued by cPanel, Inc. Certification Authority on August 30th 2021. Valid for: 3 months.
This is the only time ilcavo.ro was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Posten Norge (Transportation)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 | 86.35.1.13 86.35.1.13 | 9050 (RTD Bucha...) (RTD Bucharest) | |
| 1 | 2 |
| Domain | Requested by | |
|---|---|---|
| 1 | ilcavo.ro | |
| 1 | 1 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| epayment.nets.eu |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| ilcavo.ro cPanel, Inc. Certification Authority |
2021-08-30 - 2021-11-28 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://ilcavo.ro/posten/visa.html
Frame ID: FABC5724C9A288DA636EBE880E79702E
Requests: 7 HTTP requests in this frame
1 Outgoing links
These are links going to different origins than the main page.
URL: https://epayment.nets.eu/Terminal/CardVerificationDetails.aspx?language=nb-NO
Title: Hva er CVV2 ?
Title: Hva er CVV2 ?
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
1 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
visa.html
ilcavo.ro/posten/ |
386 KB 387 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
3 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
3 KB 0 |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
5 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
421 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
723 B 0 |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
18 KB 18 KB |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Posten Norge (Transportation)3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect boolean| originAgentCluster function| savepage_ShadowLoader0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ilcavo.ro
86.35.1.13
113f9187add10b933203873cfa37fde31f849f56bc5c5d40c5e8175d4a6f6950
1dbe374ba9a0a6f17de1f72df450eed002f549d0d87046e6366196b596a377fc
28f4a9b06ba3b680c761332f0cfb724f9b90a6d66b8091611363e1299b6f4923
5a8f886ffb6afed6497f36d8940ab950086a2eb72fe82266f8ac96acc43a8de2
9265272c019f65ad802885044f338caf0f03bf32967e30a8d5486411f3cd8343
da9a61f55fc78ff7e04887d4fabb803bc9ad65838a9ec018d5562b5bdb52789c
fe185d11a49676890d47bb783312a0cda5a44c4039214094e7957b4c040ef11c