www.pizzapapy.ro Open in urlscan Pro
85.204.69.64 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://www.pizzapapy.ro/.wp/
Effective URL:
https://www.pizzapapy.ro/.wp/
Submission: On March 10 via api (March 10th 2024, 1:41:30 am UTC) from SA — Scanned from DE

Summary HTTP 9 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 9 HTTP transactions. The main IP is 85.204.69.64, located in Bucharest, Romania and belongs to CLAUSWEB, RO. The main domain is www.pizzapapy.ro.
TLS certificate: Issued by R3 on February 21st 2024. Valid for: 3 months.

This is the only time www.pizzapapy.ro was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
1 6	85.204.69.64 85.204.69.64	203053 (CLAUSWEB) (CLAUSWEB)
2	2a00:1450:400... 2a00:1450:4001:828::200a	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:809::2003	15169 (GOOGLE) (GOOGLE)
9	3

6 85.204.69.64 (Bucharest, Romania) 1 redirects

ASN203053 (CLAUSWEB, RO)
PTR: cw85-b0d-fi64.romania-webhosting.com

www.pizzapapy.ro	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:828::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:809::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	pizzapapy.ro 1 redirects www.pizzapapy.ro	39 KB
2	gstatic.com fonts.gstatic.com	3 MB
2	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 30	2 KB
9	3

	Domain	Requested by
6	www.pizzapapy.ro	1 redirects www.pizzapapy.ro
2	fonts.gstatic.com	fonts.googleapis.com
2	fonts.googleapis.com	www.pizzapapy.ro
9	3

This site contains no links.

Subject Issuer	Validity	Valid
pizzapapy.ro R3	`2024-02-21` - `2024-05-21`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2024-02-19` - `2024-05-13`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2024-02-19` - `2024-05-13`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://www.pizzapapy.ro/.wp/
Frame ID: 6CBEC68C5D38134358A633A2D3551B70
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

One Drive

Page URL History Show full URLs

http://www.pizzapapy.ro/.wp/ HTTP 301
https://www.pizzapapy.ro/.wp/ Page URL

Detected technologies

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Page Statistics

9
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

3093 kB
Transfer

3104 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://www.pizzapapy.ro/.wp/ HTTP 301
https://www.pizzapapy.ro/.wp/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
www.pizzapapy.ro/.wp/
Redirect Chain

http://www.pizzapapy.ro/.wp/
https://www.pizzapapy.ro/.wp/

2 KB
1 KB

107ms
45ms

Document
text/html

85.204.69.64
CLAUSWEB

General

Check archive.org

Show headers Download Go to

Full URL: https://www.pizzapapy.ro/.wp/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 85.204.69.64 Bucharest, Romania, ASN203053 (CLAUSWEB, RO),
Reverse DNS: cw85-b0d-fi64.romania-webhosting.com
Software: ClausWeb-nginx /
Resource Hash: 646351d09a47f3be07e1a7a305ef94a5dc9734fa862f3bb50c1324df870095dd

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, must-revalidate
cluster-host: server45.romania-webhosting.com
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Sun, 10 Mar 2024 01:41:26 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: ClausWeb-nginx
vary: Accept-Encoding

Redirect headers

Connection: keep-alive
Content-Length: 237
Content-Type: text/html; charset=iso-8859-1
Date: Sun, 10 Mar 2024 01:41:26 GMT
Location: https://www.pizzapapy.ro/.wp/
Server: ClausWeb-nginx
cluster-host: server45.romania-webhosting.com

GET
H2 200 css2
fonts.googleapis.com/ 631 B
808 B 35ms
15ms Stylesheet
text/css 2a00:1450:4001:828::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Material+Symbols+Outlined:opsz,wght,FILL,GRAD@20..48,100..700,0..1,-50..200

Requested by

Host: www.pizzapapy.ro
URL: https://www.pizzapapy.ro/.wp/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

54252b80a76142164de2269c0b5f5744b401691fe067179bbce49a5585b7eba9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.pizzapapy.ro/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sun, 10 Mar 2024 01:41:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sun, 10 Mar 2024 01:41:25 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sun, 10 Mar 2024 01:41:25 GMT

GET
H2 200 styles.css
www.pizzapapy.ro/.wp/assets/css/ 4 KB
1 KB 37ms
37ms Stylesheet
text/css 85.204.69.64
CLAUSWEB

General

Check archive.org

Show headers Download Go to

Full URL: https://www.pizzapapy.ro/.wp/assets/css/styles.css
Requested by: Host: www.pizzapapy.ro
URL: https://www.pizzapapy.ro/.wp/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 85.204.69.64 Bucharest, Romania, ASN203053 (CLAUSWEB, RO),
Reverse DNS: cw85-b0d-fi64.romania-webhosting.com
Software: ClausWeb-nginx /
Resource Hash: 08786afb39777363c9dafacb12801968e5aa38725da7f841e428f101c64d9ca7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.pizzapapy.ro/.wp/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Sun, 10 Mar 2024 01:41:26 GMT
content-encoding: gzip
last-modified: Wed, 05 Jul 2023 08:14:27 GMT
server: ClausWeb-nginx
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=864000, max-age=864000
cluster-host: server45.romania-webhosting.com

GET
H2 200 main.js Show response
www.pizzapapy.ro/.wp/assets/js/ 859 B
584 B 36ms
35ms Script
application/javascript 85.204.69.64
CLAUSWEB

General

Check archive.org

Show headers Download Go to

Full URL: https://www.pizzapapy.ro/.wp/assets/js/main.js
Requested by: Host: www.pizzapapy.ro
URL: https://www.pizzapapy.ro/.wp/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 85.204.69.64 Bucharest, Romania, ASN203053 (CLAUSWEB, RO),
Reverse DNS: cw85-b0d-fi64.romania-webhosting.com
Software: ClausWeb-nginx /
Resource Hash: 8044e820ee3045c4a9e8cd1e309dfd5abd15a0de31a0cd25f58fc798def89891

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.pizzapapy.ro/.wp/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Sun, 10 Mar 2024 01:41:26 GMT
content-encoding: gzip
last-modified: Tue, 27 Feb 2024 23:18:25 GMT
server: ClausWeb-nginx
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=864000, max-age=864000
cluster-host: server45.romania-webhosting.com

GET
H2 200 ms.png
www.pizzapapy.ro/.wp/ 8 KB
9 KB 78ms
78ms Image
image/png 85.204.69.64
CLAUSWEB

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.pizzapapy.ro/.wp/ms.png
Requested by: Host: www.pizzapapy.ro
URL: https://www.pizzapapy.ro/.wp/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 85.204.69.64 Bucharest, Romania, ASN203053 (CLAUSWEB, RO),
Reverse DNS: cw85-b0d-fi64.romania-webhosting.com
Software: ClausWeb-nginx /
Resource Hash: 875aecc4e8bc4fc0637d1e6b365be112ab334f3ec5d839a37f249b2737d19d50

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.pizzapapy.ro/.wp/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Sun, 10 Mar 2024 01:41:26 GMT
last-modified: Sun, 02 Jul 2023 08:29:28 GMT
server: ClausWeb-nginx
content-type: image/png
cache-control: max-age=864000, max-age=864000
accept-ranges: bytes
cluster-host: server45.romania-webhosting.com
content-length: 8564

GET
H2 200 pdf.png
www.pizzapapy.ro/.wp/assets/images/ 27 KB
27 KB 64ms
63ms Image
image/png 85.204.69.64
CLAUSWEB

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.pizzapapy.ro/.wp/assets/images/pdf.png
Requested by: Host: www.pizzapapy.ro
URL: https://www.pizzapapy.ro/.wp/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 85.204.69.64 Bucharest, Romania, ASN203053 (CLAUSWEB, RO),
Reverse DNS: cw85-b0d-fi64.romania-webhosting.com
Software: ClausWeb-nginx /
Resource Hash: 7ea6c4d90f5c455270b517f13b99e99fe0a8544ec35d9cb7d8cb6dc30b9b8fba

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.pizzapapy.ro/.wp/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Sun, 10 Mar 2024 01:41:26 GMT
last-modified: Sun, 02 Jul 2023 08:44:59 GMT
server: ClausWeb-nginx
content-type: image/png
cache-control: max-age=864000, max-age=864000
accept-ranges: bytes
cluster-host: server45.romania-webhosting.com
content-length: 27401

GET
H2 200 css2
fonts.googleapis.com/ 11 KB
773 B 16ms
16ms Stylesheet
text/css 2a00:1450:4001:828::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Montserrat:wght@300;400;500;600;700;800&display=swap

Requested by

Host: www.pizzapapy.ro
URL: https://www.pizzapapy.ro/.wp/assets/css/styles.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

376aa716f5acbcefc1b0a7684a56f4d642f23bf6534917d787d163c2ad81ebb4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.pizzapapy.ro/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sun, 10 Mar 2024 01:41:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sun, 10 Mar 2024 00:35:49 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sun, 10 Mar 2024 01:41:25 GMT

GET
H2 200 JTUSjIg1_i6t8kCHKm459Wlhyw.woff2
fonts.gstatic.com/s/montserrat/v26/ 32 KB
33 KB 27ms
7ms Font
font/woff2 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v26/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Montserrat:wght@300;400;500;600;700;800&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bb2f90081933c0f2475883ca2c5cfee94e96d7314a09433fffc42e37f4cffd3b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.pizzapapy.ro
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 17:34:04 GMT
x-content-type-options: nosniff
age: 461241
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 33092
x-xss-protection: 0
last-modified: Wed, 13 Sep 2023 22:51:58 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 04 Mar 2025 17:34:04 GMT

GET
H2 200 kJEhBvYX7BgnkSrUwT8OhrdQw4oELdPIeeII9v6oFsI.woff2
fonts.gstatic.com/s/materialsymbolsoutlined/v166/ 3 MB
3 MB 34ms
14ms Font
font/woff2 2a00:1450:4001:809::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/materialsymbolsoutlined/v166/kJEhBvYX7BgnkSrUwT8OhrdQw4oELdPIeeII9v6oFsI.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Material+Symbols+Outlined:opsz,wght,FILL,GRAD@20..48,100..700,0..1,-50..200

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

edad7de161396190b0adebada4ebfed50e19b0529e3edacd9520a19fde70b974

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.pizzapapy.ro
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.111 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 02:27:32 GMT
x-content-type-options: nosniff
age: 429233
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3090820
x-xss-protection: 0
last-modified: Thu, 29 Feb 2024 16:03:01 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 05 Mar 2025 02:27:32 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.pizzapapy.ro/	1969-12-31 23:59:59	Name: PHPSESSID Value: e5be164505117544d6aa0f071ed67531

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.googleapis.com
fonts.gstatic.com
www.pizzapapy.ro
2a00:1450:4001:809::2003
2a00:1450:4001:828::200a
85.204.69.64
08786afb39777363c9dafacb12801968e5aa38725da7f841e428f101c64d9ca7
376aa716f5acbcefc1b0a7684a56f4d642f23bf6534917d787d163c2ad81ebb4
54252b80a76142164de2269c0b5f5744b401691fe067179bbce49a5585b7eba9
646351d09a47f3be07e1a7a305ef94a5dc9734fa862f3bb50c1324df870095dd
7ea6c4d90f5c455270b517f13b99e99fe0a8544ec35d9cb7d8cb6dc30b9b8fba
8044e820ee3045c4a9e8cd1e309dfd5abd15a0de31a0cd25f58fc798def89891
875aecc4e8bc4fc0637d1e6b365be112ab334f3ec5d839a37f249b2737d19d50
bb2f90081933c0f2475883ca2c5cfee94e96d7314a09433fffc42e37f4cffd3b
edad7de161396190b0adebada4ebfed50e19b0529e3edacd9520a19fde70b974

www.pizzapapy.ro Open in urlscan Pro 85.204.69.64 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

9 Requests

100 %HTTPS

67 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

3093 kBTransfer

3104 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

1 Cookies

Indicators

www.pizzapapy.ro Open in urlscan Pro
85.204.69.64 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

3093 kB
Transfer

3104 kB
Size

1
Cookies

9 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!